Function at 0x1000ff9e
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, 0x10069e61
call fcn.100693b8
mov eax, 0x10e4
call fcn.10065230
push ebx
push esi
push edi
mov dword [ebp - 0xd4], ecx
lea ecx, [ebp - 0x224]
push 2
mov byte [ebp - 0x71], dl
call fcn.1000bb6e
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x54], 0xd2ca8e1f
mov dword [ebp - 0x40], 0xd81c9193
mov dword [ebp - 0x20], edx
jmp 0x10010007
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x224]
mov dword [eax + ecx*4], 0x90ac204e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000fff4
mov esi, dword [ebp - 0x224]
mov eax, 0x70d97802
mov ebx, dword [sym.imp.GDI32.dll_RectVisible]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi], edx
jmp 0x1001002a
xor edx, edx
mov dword [ebp - 0x24], 0xb143e95a
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [esi + 4], 0x220985a9
setg al
xor edx, edx
cmp eax, 0xb8ee
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
neg eax
cmp ecx, eax
jge 0x10010083
inc dword [ebp - 0x10]
jmp 0x100100c0
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1001009c
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
push 0xb
pop ecx
mov dword [ebp - 0x1c], ecx
jmp 0x100100ba
mov dword [ebp - 0x24], ecx
jmp 0x100100b1
cmp dword [ebp - 0x24], eax
jne 0x100100b7
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jle 0x100100a9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x100100a4
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x224]
cmp ecx, dword [eax]
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x224]
dec dword [eax]
cmp dword [eax], 0xffffffee
mov eax, 0x70d97802
jg 0x10010028
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1001014e
cmp dword [ebp - 0x1c], eax
je 0x10010145
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], 0x2bba
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x54], ecx
ja 0x1001014e
mov ecx, eax
jmp 0x10010153
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x224]
mov dword [eax], ecx
lea ecx, [ebp - 0x224]
call fcn.1000bbf0
push 2
lea ecx, [ebp - 0x20c]
call fcn.1000bb6e
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x54], 0xd2ca8e1f
mov dword [ebp - 0x40], 0xd81c9193
mov dword [ebp - 0x20], edx
jmp 0x100101ae
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20c]
mov dword [eax + ecx*4], 0x90ac204e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001019b
mov esi, dword [ebp - 0x20c]
mov dword [esi], edx
mov dword [ebp - 0x24], 0xb143e95a
mov eax, 0x70d97802
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [esi + 4], 0x220985a9
setg al
xor edx, edx
cmp eax, 0xb8ee
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
neg eax
cmp ecx, eax
jge 0x1001021a
inc dword [ebp - 0x10]
jmp 0x10010257
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10010233
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
push 0xb
pop ecx
mov dword [ebp - 0x1c], ecx
jmp 0x10010251
mov dword [ebp - 0x24], ecx
jmp 0x10010248
cmp dword [ebp - 0x24], eax
jne 0x1001024e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jle 0x10010240
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x1001023b
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
push 0
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20c]
pop edx
cmp ecx, dword [eax]
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x20c]
dec dword [eax]
cmp dword [eax], 0xffffffee
jg 0x100101bc
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
jne 0x100102e1
cmp dword [ebp - 0x1c], ebx
je 0x100102d8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], 0x2bba
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x54], ecx
ja 0x100102e1
mov ecx, ebx
jmp 0x100102e6
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
lea ecx, [ebp - 0x20c]
call fcn.1000bbf0
push 2
pop esi
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], ebx
inc ecx
jmp 0x10010318
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x27c], 0x17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10010307
mov dword [ebp - 0x10], ebx
jmp 0x10010346
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10010334
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10010343
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jne 0x10010322
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x10010365
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x27c], ebx
jne 0x10010365
dec dword [ebp - 0x10]
jns 0x10010354
push esi
lea ecx, [ebp - 0x230]
call fcn.1000bb6e
push esi
lea ecx, [ebp - 0x414]
mov dword [ebp - 4], ebx
call fcn.1000bb6e
mov dword [ebp - 0x30], 0x13532fe2
xor edx, edx
mov dword [ebp - 0x34], 0x34ccbb24
inc edx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x100103aa
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x414]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
jmp 0x10010394
mov dword [ebp - 0x30], ebx
jmp 0x10010463
mov dword [ebp - 0x10], 0x252604
mov dword [ebp - 0x40], 0x95ff
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10010460
mov dword [ebp - 0x24], 0x672a8358
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], edx
jg 0x10010457
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1001044f
mov dword [ebp - 0x34], 0xfffa
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x414]
cmp dword [eax + ecx*4], ebx
jne 0x1001040b
cmp dword [ebp - 0x10], ebx
jne 0x1001040b
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x20]
je 0x1001041d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x414]
push 1
pop edx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
add ecx, 0x4be3d0e8
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x20]
jns 0x100103ec
or eax, 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x100103e1
dec dword [ebp - 0x10]
jns 0x100103cc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x100103b2
lea ecx, [ebp - 0x414]
call fcn.1000bbf0
or eax, 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x2c], eax
push 3
call fcn.1000bb6e
xor eax, eax
lea ecx, [ebp - 0x218]
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], 0x439beb06
push esi
call fcn.1000bb6e
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], ebx
jmp 0x100104bf
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xbbca6318
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100104ac
mov dword [ebp - 0x24], ebx
jmp 0x100104dd
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x218]
mov dword [eax + ecx*4], 0xe4cf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100104ca
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
push 2
pop esi
jg 0x100106c1
mov dword [ebp - 0x2c], 0x4cdb8faa
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x38], 0xb2faa963
mov dword [ebp - 0x30], eax
xor eax, eax
inc eax
push eax
call fcn.1000bb6e
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10010531
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4bc]
mov dword [eax + ecx*4], 0x2fafeceb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001051e
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x10010626
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x54], eax
cmp dword [eax + 4], ebx
jne 0x1001056e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x1001056e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x1001056e
mov edx, ebx
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x218]
cmp edx, dword [eax]
mov eax, dword [ebp - 0x120]
sete cl
xor edx, edx
cmp dword [eax + esi*4], ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
add eax, edx
mov edx, dword [ebp - 0x54]
cmp eax, dword [edx + 4]
setg cl
xor eax, eax
cmp ecx, 0xebf3
setl al
xor edx, edx
imul ecx, eax, 0x9031
mov eax, dword [ebp - 0x120]
add ecx, 0x627e80a7
imul ecx, dword [eax + edi*4]
add ecx, ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x120]
setg cl
cmp ecx, dword [eax + ebx*4]
jge 0x100105e4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
dec eax
neg eax
push 0
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x38]
cmp dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x2c]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x54]
pop ebx
setne cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
push 1
pop edx
jns 0x1001054b
push 2
pop esi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x100106a1
mov esi, dword [ebp - 0x218]
push 3
mov dword [ebp - 0x20], ebx
pop ecx
jmp 0x10010649
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x33c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1001063c
cmp dword [esi + 4], ebx
jne 0x1001069e
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x30], ebx
je 0x1001066a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x334]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x334]
mov eax, dword [ebp - 0x218]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x4bc]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
jns 0x10010634
push 2
pop esi
lea ecx, [ebp - 0x4bc]
call fcn.1000bbf0
inc dword [ebp - 0x1c]
push 0xfffffffffffffffe
pop eax
cmp dword [ebp - 0x1c], esi
jle 0x100104f6
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0xffffffea
cmp dword [ebp - 0x1c], 0xffffffee
je 0x10010765
xor eax, eax
inc eax
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], ebx
jmp 0x100106f2
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], 0xbdec7e1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100106e1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jl 0x10010758
push eax
lea ecx, [ebp - 0x4a4]
call fcn.1000bb6e
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10010723
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4a4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10010713
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ebp - 0x218]
mov dword [ecx], ebx
mov eax, dword [ecx]
mov dword [edx + eax*4], 0xec8e
inc dword [ecx]
cmp dword [ecx], esi
jl 0x10010736
lea ecx, [ebp - 0x4a4]
call fcn.1000bbf0
dec dword [ebp - 0x10]
push 1
pop eax
jns 0x100106ff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jne 0x100106d5
lea ecx, [ebp - 0x218]
call fcn.1000bbf0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], bl
call fcn.1000bbf0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], ebx
jmp 0x1001079d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x28c], 0x17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1001078c
mov dword [ebp - 0x10], ebx
jmp 0x100107cd
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100107ba
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100107ca
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jne 0x100107a7
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x100107ec
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x28c], ebx
jne 0x100107ec
dec dword [ebp - 0x10]
jns 0x100107db
mov dword [ebp - 0x44], 0xfffffffa
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 0x34], 0xd2ca8e1f
push 3
call fcn.1000bb6e
mov dword [ebp - 0x20], ebx
jmp 0x1001081f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6fc]
mov dword [eax + ecx*4], 0x8261f9c2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001080c
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001083d
push ebx
push ebx
push 0x3c6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001084e
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [ebp - 0x6fc]
call fcn.1000bbf0
mov dword [ebp - 0x4c], 0xd81c9193
xor edx, edx
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x40], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1c]
sub ecx, 0x32a17d0b
jne 0x10010897
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x100108a6
mov eax, ebx
jmp 0x100108a9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
push 6
setge dl
sub edx, 0xfffffff9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
dec ecx
pop ecx
je 0x1001099b
mov dword [ebp - 0x20], ebx
jmp 0x100108e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x66c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100108d9
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x100109b0
mov dword [ebp - 0x20], ebx
jmp 0x10010910
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc0], 0xfaab39e2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100108ff
mov dword [ebp - 0xc0], ecx
cmp dword [ebp - 0xc0], ebx
jl 0x10010973
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jl 0x1001093f
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x66c], ebx
jne 0x1001093f
dec dword [ebp - 0x20]
jns 0x1001092e
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001096b
push 0x6d2
push ebx
push 0x1c16
push 0xdb1
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor ecx, ecx
inc ecx
dec dword [ebp - 0xc0]
jns 0x10010923
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001098d
push 0x707
push 0x2035
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
dec dword [ebp - 0x1c]
push 1
pop ecx
jns 0x100108fa
jmp 0x100109b0
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100109b0
push 0x554
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0x40], 0xfffffff7
lea ecx, [ebp - 0x714]
push 3
call fcn.1000bb6e
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 3
jge 0x100109ec
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x714]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100109d7
mov dword [ebp - 0x24], ebx
jmp 0x100109fe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x42c], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100109f1
mov dword [ebp - 0x424], esi
cmp dword [ebp - 0x424], ebx
jl 0x10010a5d
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010a2a
push 0xfe
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x48], ebx
jl 0x10010a55
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010a50
push 0x334
push 0x2080
push 0x1a0f
call dword [sym.imp.KERNEL32.dll_MulDiv]
dec dword [ebp - 0x48]
jns 0x10010a32
dec dword [ebp - 0x424]
jns 0x10010a12
lea ecx, [ebp - 0x714]
call fcn.1000bbf0
mov dword [ebp - 0x20], ebx
jmp 0x10010a80
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x230]
mov dword [eax + ecx*4], 0x90ac204e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10010a6d
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0x3c0]
push 3
call fcn.1000bb6e
mov dword [ebp - 0x38], 0xbbbc
or edx, 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jge 0x10010ac0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
jmp 0x10010aa9
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x14
jmp 0x10010d89
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0xf06e85fc
mov dword [ebp - 0x54], 0x42fa43de
mov dword [ebp - 0x20], ebx
jmp 0x10010af6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x72c], 0x4e2b79dc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10010ae5
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jg 0x10010d86
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], ebx
jmp 0x10010d13
mov dword [ebp - 0x10], 0x20bd2ab
mov dword [ebp - 0x40], 0x254e
cmp dword [ebp - 0x40], 0x1135
jge 0x10010c67
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x98], ebx
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x14c], ebx
push eax
push 0x10007a00
call fcn.10050dfb
add esp, 0xc
mov dword [ebp - 0xac], ebx
lea eax, [ebp - 0xac]
mov dword [ebp - 0xb0], ebx
mov edi, 0x100079f8
mov dword [ebp - 0x2cc], ebx
push eax
push edi
call fcn.10050dfb
cmp dword [ebp - 0x98], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x10010ba2
lea eax, [ebp - 0x2cc]
push eax
push edi
call fcn.10050dfb
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x98]
jl 0x10010b8a
lea eax, [ebp - 0xb0]
push eax
push edi
call fcn.10050dfb
mov eax, dword [ebp - 0x14c]
pop ecx
pop ecx
cmp dword [ebp - 0x98], eax
jge 0x10010bcf
push 0x10007a08
call fcn.1005329d
pop ecx
jmp 0x10010c64
jle 0x10010bf4
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0xac]
test eax, eax
jns 0x10010bed
push 0x10007a0c
call fcn.1005118c
pop ecx
push 0x10007a10
jmp 0x10010bc4
cmp dword [ebp - 0x98], eax
jne 0x10010c64
mov esi, dword [ebp - 0xb0]
mov eax, esi
mov edi, dword [ebp - 0xac]
imul eax, edi
test eax, eax
jns 0x10010c28
push 0x10007a0c
call fcn.1005118c
mov edi, dword [ebp - 0xac]
mov esi, dword [ebp - 0xb0]
pop ecx
test edi, edi
jns 0x10010c34
neg edi
mov dword [ebp - 0xac], edi
test esi, esi
jns 0x10010c40
neg esi
mov dword [ebp - 0xb0], esi
mov edx, esi
mov ecx, edi
call fcn.1076f000
mov ecx, eax
mov eax, esi
cdq
idiv ecx
push eax
mov eax, edi
cdq
idiv ecx
push eax
push 0x10007a1c
call fcn.1005118c
add esp, 0xc
push 2
pop esi
mov dword [ebp - 0x10], ebx
jmp 0x10010ce8
mov edi, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c0]
push 6
cmp dword [eax + ecx*4], 0x6c849023
mov eax, dword [eax]
setl dl
pop ecx
add eax, ecx
imul edx, eax
mov eax, dword [ebp - 0x1c]
push 2
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c0]
sub ecx, dword [eax + esi*4]
neg ecx
pop esi
sbb ecx, ecx
inc ecx
imul ecx, dword [eax + edi*4]
mov eax, dword [ebp - 0x24]
imul edx, ecx, 0xb4b5
sub edx, eax
sub edx, 3
sub edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x38], ebx
jne 0x10010cf1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10010c6c
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010d10
push ebx
push 0xdcd
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10010b17
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10010d77
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x724]
mov eax, dword [ebp - 0x24]
imul edx, dword [ebp - 0x54], 0x372
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setge cl
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010d72
push 0x16c3
push 0xe65
push 0x8be
call edi
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [ebp - 0x20]
jns 0x10010d24
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10010b08
or edx, 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1f
jle 0x10010acf
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], bl
call fcn.1000bbf0
mov edi, dword [ebp - 0x230]
lea eax, [ebp - 0x620]
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x58], 5
mov dword [edi], ebx
movdqa xmm0, xmmword [0x10007fc0]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x880]
movdqu xmmword [ebp - 0x620], xmm0
call fcn.1000bbca
mov dword [ebp - 0x20], 0x32a27689
mov dword [ebp - 0x20], ebx
jmp 0x10010dfb
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010df8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10010de9
lea ecx, [ebp - 0x880]
call fcn.1000bbf0
mov dword [ebp - 0x10], 0xb143e95a
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x30], 4
push 3
call fcn.1000bb6e
mov dword [ebp - 0x40], 0xbbbc
or edx, 0xffffffff
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jge 0x10010e4e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x408]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
jmp 0x10010e37
inc dword [ebp - 0x30]
mov dword [ebp - 0x30], 0x14
cmp dword [ebp - 0x30], 0x1f
jg 0x10010fe2
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], 0xf06e85fc
mov dword [ebp - 0x38], 0x42fa43de
mov dword [ebp - 0x20], ebx
jmp 0x10010e89
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x744], 0x4e2b79dc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10010e78
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], esi
jg 0x10010fd2
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], ebx
jmp 0x10010f5b
mov dword [ebp - 0x1c], 0x20bd2ab
mov dword [ebp - 0x1c], ebx
jmp 0x10010f32
mov edi, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x408]
push 6
cmp dword [eax + ecx*4], 0x6c849023
mov eax, dword [eax]
setl dl
pop ecx
add eax, ecx
imul edx, eax
mov eax, dword [ebp - 0x2c]
push 2
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x408]
sub ecx, dword [eax + esi*4]
neg ecx
pop esi
sbb ecx, ecx
inc ecx
imul ecx, dword [eax + edi*4]
mov eax, dword [ebp - 0x24]
imul edx, ecx, 0xb4b5
sub edx, eax
sub edx, 3
sub edx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x40], ebx
jne 0x10010f3b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10010eb6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010f58
push ebx
push 0xdcd
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10010eaa
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10010fc3
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x24]
imul edx, dword [ebp - 0x38], 0x372
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setge cl
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10010fbe
push 0x16c3
push 0xe65
push 0x8be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [ebp - 0x20]
jns 0x10010f6c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10010e9b
or edx, 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1f
jle 0x10010e62
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x408]
call fcn.1000bbf0
mov dword [ebp - 0x20], ebx
xor ecx, ecx
mov dword [ebp - 0x1c], 0x42c70bb7
inc ecx
mov dword [ebp - 0x2c], 0x7bc75286
mov dword [ebp - 0x30], 0x8b9b
push 2
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x24], ebx
pop edx
cmp dword [ebp - 0x24], edx
jge 0x10011029
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x24]
jmp 0x10011015
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ecx
jg 0x10011247
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001104a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x90], ebx
je 0x10011059
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
push 7
pop ecx
mov edx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, edx
setle al
cmp eax, dword [ebp - 0x1c]
jne 0x1001107d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
cmp dword [ebp - 0x30], 0xfffffff7
jne 0x100110aa
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x90], ebx
je 0x100110aa
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100110ac
mov ecx, ebx
xor eax, eax
cmp ecx, 3
sete al
xor edx, edx
cmp eax, 0xe3cf9575
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
imul edx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
cmp edx, eax
setl cl
test ecx, ecx
je 0x10011131
xor ecx, ecx
mov dword [ebp - 0x30], ebx
inc ecx
jmp 0x10011127
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001111a
push 0x156
push 0x11cc
push 0x31f
push 0x4fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jle 0x100110e6
jmp 0x10011238
mov dword [ebp - 0x24], 0x1c2a9118
mov dword [ebp - 0x40], 0x8a5a2d53
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x100111af
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x90], ebx
je 0x1001116e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
cmp dword [ebp - 0x24], eax
jg 0x1001116e
cmp dword [ebp - 0x2c], ebx
je 0x1001116e
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10011170
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
imul ecx, ecx, 0x198f
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x2c]
je 0x1001119f
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100111da
push ebx
push ebx
push ebx
push 0x208
push 0x13bb
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x90]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setl dl
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x663b
setne al
xor ecx, ecx
add edx, eax
add edx, dword [ebp - 0x40]
inc ecx
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1001103b
push 2
pop edx
mov dword [ebp - 0x40], ebx
mov eax, 0x70d97802
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0x6673e7ed
mov dword [ebp - 0x40], 0xd9532955
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
jmp 0x10011297
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x124], 0x624039b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10011286
mov dword [ebp - 0x24], ebx
jmp 0x100112ae
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x470], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100112a1
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100112d0
push 0x68b
push 0x230f
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001145a
push 5
pop edi
jmp 0x100112e4
xor ecx, ecx
inc ecx
mov dword [ebp - 0x48], 0xaeb59008
mov dword [ebp - 0x18], 0xd927f7b6
mov dword [ebp - 0x2c], 0xe1a812c0
push 6
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x1001134a
mov esi, ecx
cmp dword [ebp - 0x24], ebx
jne 0x1001134c
mov esi, ebx
inc dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp esi, eax
setge cl
imul edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x30]
imul eax, edx, 0x39ca6438
cmp eax, 0x437f
setl cl
cmp ecx, dword [ebp - 0x1c]
jg 0x10011426
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
cmp edx, edi
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x24], ebx
je 0x100113d3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
push 0
mov dword [ebp + eax*4 - 0x124], ecx
lea eax, [ecx - 2]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x32f
pop eax
setge cl
sub ecx, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x30]
setns al
sub ecx, eax
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfffffffb
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x46c], ecx
jmp 0x1001144e
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001144e
push ebx
push 0x1252
push 0x264a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
dec dword [ebp - 0x1c]
jns 0x100112e1
mov edi, dword [ebp - 0x3c]
push 4
lea ecx, [ebp - 0x75c]
call fcn.1000bb6e
mov dword [ebp - 0x18], ebx
or edx, 0xffffffff
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x24], ebx
jmp 0x10011488
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x75c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10011475
mov dword [ebp - 0x24], ebx
jmp 0x100114a0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10011493
push 3
mov dword [ebp - 0x18], ebx
pop esi
cmp dword [ebp - 0x18], esi
jg 0x100115d0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0x814b
mov dword [ebp - 0x38], 0x3843046b
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x24], 9
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
jmp 0x100115bb
mov dword [ebp - 0x30], ebx
jmp 0x100114f1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x164], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x100114e4
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jg 0x100115b3
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], esi
jg 0x10011538
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x1f4]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f4], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x1f4], ebx
jne 0x10011535
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1001150d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], esi
jg 0x100115a1
mov dword [ebp - 0x2c], ebx
jmp 0x10011552
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x674], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10011545
mov eax, dword [ebp - 0x164]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x38]
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x670]
push 0
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x24]
pop ebx
setle cl
push 1
mov dword [ebp + eax*4 - 0x1f4], ecx
inc dword [ebp - 0x44]
pop ecx
cmp dword [ebp - 0x44], esi
jle 0x10011540
inc dword [ebp - 0x1c]
push 1
pop ecx
cmp dword [ebp - 0x1c], esi
jle 0x10011502
or edx, 0xffffffff
cmp dword [ebp - 0x1c], ebx
jne 0x100115c4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x100114df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100114b8
lea ecx, [ebp - 0x75c]
call fcn.1000bbf0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [edi + 4], 0x220985a9
setg al
xor edx, edx
cmp eax, 0xb8ee
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge cl
neg eax
cmp ecx, eax
jge 0x100116a4
movdqa xmm0, xmmword [0x10007f90]
lea ecx, [ebp - 0x7b4]
push ecx
lea eax, [ebp - 0x7a4]
push eax
push ecx
lea ecx, [ebp - 0x7fc]
movdqu xmmword [ebp - 0x7b4], xmm0
call fcn.1000bbca
xor eax, eax
mov dword [ebp - 0x18], 0xa35f394a
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001168e
mov dword [ebp - 0x48], 0x7a3a11c1
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x48], ebx
jl 0x10011689
mov dword [ebp - 0x38], 0xfffe
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10011681
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
dec dword [ebp - 0x38]
dec dword [ebp - 0x48]
jns 0x1001165c
dec dword [ebp - 0x18]
jns 0x1001164d
lea ecx, [ebp - 0x7fc]
call fcn.1000bbf0
inc dword [ebp - 0x20]
push 2
pop esi
jmp 0x1001214f
xor edx, edx
mov dword [ebp - 0x30], 0x1bc7dcd6
inc edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], 0xd3e99730
mov dword [ebp - 0x24], ebx
jmp 0x100116ca
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf8], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100116bd
push 2
mov dword [ebp - 0x24], ebx
pop esi
cmp dword [ebp - 0x24], esi
jge 0x100116ef
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x688], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100116dd
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, edx
push 4
setle cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x3f0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add eax, 0x138b
mov dword [ebp - 0x688], eax
call fcn.1000bb6e
xor eax, eax
mov byte [ebp - 4], 4
inc eax
lea ecx, [ebp - 0x160]
push eax
call fcn.1000bb6e
mov dword [ebp - 0x40], 0x6840eb44
xor edx, edx
push 5
pop eax
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x54], eax
inc edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x100117a9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f0]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10011796
mov dword [ebp - 0x1c], ebx
jmp 0x100117c7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0x1febaeef
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100117b4
mov dword [ebp - 0x1c], ebx
jmp 0x100117e2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x894], 0x63530054
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100117d1
mov eax, dword [ebp - 0x160]
push 3
pop edi
mov dword [eax], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1001180b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x360], 0x9a2b441
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100117fa
mov ecx, dword [ebp - 0x360]
xor ebx, ebx
mov eax, dword [ebp - 0x160]
mov esi, dword [ebp - 0x3f0]
mov edi, dword [eax]
test edi, edi
mov eax, dword [ebp - 0x160]
setne bl
xor edx, edx
cmp ecx, dword [eax]
setle dl
xor eax, eax
cmp edx, 0x8951
setge al
imul ecx, eax, 0x1e46
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
setne al
xor ecx, ecx
cmp dword [esi + edi*4], eax
mov eax, dword [ebp - 0x35c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
sub edx, eax
add edx, dword [ebp - 0x360]
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x160]
mov eax, dword [eax]
inc dword [ebp - 0x48]
cmp ecx, eax
je 0x10011893
xor eax, eax
xor ebx, ebx
lea esi, [eax + 1]
jmp 0x10011897
xor ebx, ebx
mov esi, ebx
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [edx]
cmp dword [eax + ecx*4], 0xfffffff7
jle 0x100118b7
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x160]
inc dword [edx]
lea eax, [esi - 0x46d3]
push 3
pop edi
mov dword [ebp - 0x35c], eax
cmp dword [edx], edi
jle 0x100117f2
lea ecx, [ebp - 0x160]
call fcn.1000bbf0
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], bl
call fcn.1000bbf0
mov byte [ebp - 0x11], bl
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], 0xc42ff18c
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001191a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0xffffffec
jg 0x10011a15
or esi, 0xffffffff
push edi
lea ecx, [ebp - 0x378]
call fcn.1000bb6e
push 5
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x44], 0x7222631
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], ebx
jmp 0x1001195e
cmp byte [ebp - 0x11], 0
je 0x10011c92
mov dword [ebp - 0x44], 0xb7c7ce53
mov dword [ebp - 0x18], ebx
jmp 0x1001216c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001215b
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], ebx
jl 0x100121c1
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xd03248c6
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x100121bc
mov dword [ebp - 0x38], 0x7fbf2121
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100121b1
call dword [sym.imp.USER32.dll_CreateMenu]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001218f
or eax, 0xffffffff
dec dword [ebp - 0x44]
jns 0x1001217d
mov eax, dword [ebp - 0x888]
mov ecx, 0xffff
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x230]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x610]
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x230]
dec dword [eax]
cmp dword [eax], 0xffffffee
lea eax, [ebp - 0x620]
jg 0x10010dbf
push esi
lea ecx, [ebp - 0x170]
call fcn.1000bb6e
mov dword [ebp - 0x24], 0x9bdba76a
mov dword [ebp - 0x18], ebx
jmp 0x1001225d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001224a
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jl 0x10012346
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x38], 0xca7
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x64], 0xbc4433ac
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x170]
cmp dword [eax], ebx
jne 0x1001229b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x170]
push 0
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 4]
cmp eax, edx
setle cl
sub ecx, edx
imul eax, ecx, 0xffff
xor ecx, ecx
cmp eax, 0x4aee5077
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x170]
setge dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
setl cl
mov esi, dword [ebp - 0x24]
xor ebx, ebx
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp - 0x170]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ecx + edx*4]
mov edx, dword [ebp - 0x170]
setl bl
xor ecx, ecx
sub ebx, dword [ebp - 0x64]
sub ebx, dword [edx]
cmp ebx, dword [edx + esi*4]
mov esi, dword [ebp - 0x40]
setle cl
xor eax, eax
sub ecx, 0x1fcc1031
pop ebx
cmp dword [edx + esi*4], ecx
push 1
sete al
add eax, dword [edx + edi*4]
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
dec dword [ebp - 0x24]
pop eax
jns 0x1001227a
push 2
pop esi
lea ecx, [ebp - 0x170]
call fcn.1000bbf0
cmp dword [ebp - 0x44], ebx
jne 0x1001237f
cmp dword [ebp - 0x2c], ebx
je 0x10012371
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], 0x2bba
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, 0xffff
cmp dword [ebp - 0x34], eax
ja 0x1001237f
mov ecx, ebx
jmp 0x10012384
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x230]
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], eax
call fcn.1000bbf0
push esi
lea ecx, [ebp - 0x298]
call fcn.1000bb6e
push 0xfffffffffffffffe
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x4d4]
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xf7806aa1
mov dword [ebp - 0x38], 0xa82b5dfe
push esi
call fcn.1000bb6e
xor eax, eax
mov dword [ebp - 0x34], 0x77734166
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], ebx
jmp 0x100123f5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x298]
mov dword [eax + ecx*4], 0xf1f13b01
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100123e2
mov dword [ebp - 0x10], ebx
mov edi, 0x95c3c62e
jmp 0x10012414
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4d4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10012405
mov eax, dword [ebp - 0x298]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
je 0x1001249a
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x298]
cmp dword [ecx], eax
mov esi, dword [ecx]
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
sub ecx, 9
cmp ecx, esi
setle dl
sub edx, 0xec73
neg edx
sbb edx, edx
xor eax, eax
add edx, 0x3014b1af
cmp edx, esi
setge al
sub eax, 0x10d32de9
neg eax
sbb eax, eax
inc eax
cmp eax, 0xe3473ede
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xe5ab
setle cl
xor eax, eax
cmp ecx, 0x6e8597a0
setl al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x298]
mov esi, dword [eax]
mov eax, dword [ebp - 0x20]
cmp eax, 2
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
cmp ecx, 0xfffffffa
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4d4]
setl cl
xor edx, edx
imul ecx, esi
cmp ecx, esi
lea ecx, [ebp - 0x4d4]
setle dl
mov dword [eax], edx
xor eax, eax
cmp edx, 0xfffffffc
sete al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
sub eax, 0x37a2e34d
imul eax, dword [ebp - 0x38]
imul eax, eax, 0xcde4
sub eax, 8
mov dword [ebp - 0x40], eax
call fcn.1000bbf0
or eax, 0xffffffff
lea ecx, [ebp - 0x298]
mov dword [ebp - 4], eax
call fcn.1000bbf0
movdqa xmm0, xmmword [0x10007f90]
lea ecx, [ebp - 0x7c4]
push ecx
lea eax, [ebp - 0x7b4]
push eax
push ecx
lea ecx, [ebp - 0x820]
movdqu xmmword [ebp - 0x7c4], xmm0
call fcn.1000bbca
xor eax, eax
mov dword [ebp - 0x48], 0xa35f394a
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 3
cmp dword [ebp - 0x48], ebx
jl 0x1001259e
mov dword [ebp - 0x3c], 0x7a3a11c1
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], ebx
jl 0x10012599
mov dword [ebp - 0x34], 0xfffe
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10012591
dec dword [ebp - 0x48]
jns 0x10012559
lea ecx, [ebp - 0x820]
call fcn.1000bbf0
push 2
lea ecx, [ebp - 0x2a8]
call fcn.1000bb6e
push 0xfffffffffffffffe
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x594]
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xf7806aa1
mov dword [ebp - 0x38], 0xa82b5dfe
push 2
call fcn.1000bb6e
xor eax, eax
mov dword [ebp - 0x34], 0x77734166
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], ebx
jmp 0x10012603
cmp dword [ebp - 0x10], 2
jl 0x100125f0