Function at 0x1001f160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006183e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x8f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x8748
mov dword [ebp - 0x64], 5
push 2
lea ecx, [ebp - 0x1f4]
call fcn.1000ff33
and dword [ebp - 4], 0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x26c], 0xb5e35254
mov dword [ebp - 0xd8], 0
jmp 0x1001f1ce
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1001f1f0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
mov dword [eax], 0xfd03b15a
jmp 0x1001f1c1
cmp dword [ebp - 0x1c], 0
je 0x1001f2f0
xor eax, eax
jne 0x1001f20d
cmp dword [ebp - 0x1c], 0
jne 0x1001f20d
and dword [ebp - 0x198], 0
jmp 0x1001f217
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x64], 0xc18ab9c2
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x198]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x198]
je 0x1001f24e
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001f24e
and dword [ebp - 0x290], 0
jmp 0x1001f258
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x290], eax
jne 0x1001f26f
mov dword [ebp - 0x518], 1
jmp 0x1001f276
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x518], eax
jl 0x1001f28d
mov dword [ebp - 0x274], 1
jmp 0x1001f294
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x274]
je 0x1001f2b1
cmp dword [ebp - 0x1c], 0
je 0x1001f2b1
mov dword [ebp - 0x498], 1
jmp 0x1001f2b8
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1001f2d2
mov dword [ebp - 0x204], 1
jmp 0x1001f2d9
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x204]
jne 0x1001f2f0
mov dword [ebp - 0x4a0], 1
jmp 0x1001f2f7
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001f315
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x34]
jl 0x1001f32c
cmp dword [ebp - 0x34], 0
jne 0x1001f32c
and dword [ebp - 0x20c], 0
jmp 0x1001f336
mov dword [ebp - 0x20c], 1
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1c]
cmp eax, 1
ja 0x1001f358
mov dword [ebp - 0x4a8], 1
jmp 0x1001f35f
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfb6f85a0
jae 0x1001f378
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
mov eax, 0x8acc167d
test eax, eax
je 0x1001f835
mov dword [ebp - 0xe0], 0x8ae0512e
mov dword [ebp - 0x1a8], 5
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x63c], 4
mov dword [ebp - 0x838], 0xdc67586e
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0xcc], 0x8d320cd5
mov dword [ebp - 0x44], 0
jmp 0x1001f3db
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1001f3f1
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x758], 0
jmp 0x1001f3d4
mov dword [ebp - 0x44], 0
jmp 0x1001f401
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1001f417
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x86c], 0xfffffffb
jmp 0x1001f3fa
mov dword [ebp - 0x34], 5
jmp 0x1001f427
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe3
jge 0x1001f5b2
mov dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x1001f454
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x1001f470
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x854], 0xfffffffa
jmp 0x1001f447
mov dword [ebp - 0x214], 0xffffffff
mov esi, dword [ebp - 0x214]
neg esi
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
cmp esi, dword [eax]
jg 0x1001f49f
mov dword [ebp - 0x4b0], 1
jmp 0x1001f4a6
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x4b0]
jle 0x1001f4bd
mov dword [ebp - 0x224], 1
jmp 0x1001f4c4
and dword [ebp - 0x224], 0
cmp dword [ebp - 0xe0], 0
je 0x1001f4de
xor eax, eax
inc eax
je 0x1001f4de
mov dword [ebp - 0x21c], 1
jmp 0x1001f4e5
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
sub eax, 0xcede
cmp eax, 0x6b93dced
jge 0x1001f503
mov dword [ebp - 0x4b8], 1
jmp 0x1001f50a
and dword [ebp - 0x4b8], 0
imul eax, dword [ebp - 0x4b8], 0x2de4
cmp eax, 0xf8f0b53c
je 0x1001f527
mov dword [ebp - 0x4c0], 1
jmp 0x1001f52e
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x4c0]
jl 0x1001f548
mov dword [ebp - 0x22c], 1
jmp 0x1001f54f
and dword [ebp - 0x22c], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [eax]
jg 0x1001f572
mov dword [ebp - 0x4c8], 1
jmp 0x1001f579
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x854]
cmp dword [ebp - 0x4c8], eax
jle 0x1001f59a
mov dword [ebp - 0x234], 1
jmp 0x1001f5a1
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x1a8], eax
jmp 0x1001f420
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x634]
jne 0x1001f5fa
mov dword [ebp - 0x4d0], 1
jmp 0x1001f601
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
add eax, 0x503ecef3
je 0x1001f61a
mov dword [ebp - 0x23c], 1
jmp 0x1001f621
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0xffffffff
je 0x1001f636
mov dword [ebp - 0x4d8], 1
jmp 0x1001f63d
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0xfffffff7
jge 0x1001f652
mov dword [ebp - 0x244], 1
jmp 0x1001f659
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x244]
je 0x1001f677
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1001f677
mov dword [ebp - 0x4e0], 1
jmp 0x1001f67e
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x4e0], eax
jne 0x1001f698
mov dword [ebp - 0x24c], 1
jmp 0x1001f69f
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x24c], eax
jne 0x1001f6b9
mov dword [ebp - 0x5a8], 1
jmp 0x1001f6c0
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x4e8]
sub eax, 0x38e4a6a7
imul eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1a8], eax
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
cmp dword [eax], 0xffffffff
jne 0x1001f702
mov dword [ebp - 0x254], 1
jmp 0x1001f709
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x254], eax
jl 0x1001f723
mov dword [ebp - 0x4f0], 1
jmp 0x1001f72a
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4f0], eax
jne 0x1001f741
mov dword [ebp - 0x25c], 1
jmp 0x1001f748
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x25c], eax
jle 0x1001f762
mov dword [ebp - 0x4f8], 1
jmp 0x1001f769
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, 0xe796
cmp eax, dword [ebp - 0x1c8]
jge 0x1001f788
mov dword [ebp - 0x538], 1
jmp 0x1001f78f
and dword [ebp - 0x538], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.1000ffd1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x86c], 0
je 0x1001f7bc
xor eax, eax
je 0x1001f7bc
mov dword [ebp - 0x264], 1
jmp 0x1001f7c3
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x264], eax
jl 0x1001f7dd
mov dword [ebp - 0x500], 1
jmp 0x1001f7e4
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x758]
cmp eax, dword [ebp - 0x500]
je 0x1001f80e
cmp dword [ebp - 0x1c8], 0
je 0x1001f80e
mov dword [ebp - 0x52c], 1
jmp 0x1001f815
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x34], eax
jmp 0x1001f854
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1001f854
push 0x21f0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0x64], 1
jmp 0x1001f864
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1001f885
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x1001f883
push 0
push 0xcd2
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1001f85d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f4]
call fcn.1000ffb5
mov dword [ebp - 0x20], 0x8748
mov dword [ebp - 0x60], 5
push 2
lea ecx, [ebp - 0x1e8]
call fcn.1000ff33
mov dword [ebp - 4], 1
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48c], 0xb5e35254
mov dword [ebp - 0xe8], 0
jmp 0x1001f8e0
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x1001f902
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
mov dword [eax], 0xfd03b15a
jmp 0x1001f8d3
cmp dword [ebp - 0x20], 0
je 0x1001fa02
xor eax, eax
jne 0x1001f91f
cmp dword [ebp - 0x20], 0
jne 0x1001f91f
and dword [ebp - 0x1b0], 0
jmp 0x1001f929
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x60], 0xc18ab9c2
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x1b0]
je 0x1001f960
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001f960
and dword [ebp - 0x508], 0
jmp 0x1001f96a
mov dword [ebp - 0x508], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x508], eax
jne 0x1001f981
mov dword [ebp - 0x510], 1
jmp 0x1001f988
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x510], eax
jl 0x1001f99f
mov dword [ebp - 0x4c4], 1
jmp 0x1001f9a6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x4c4]
je 0x1001f9c3
cmp dword [ebp - 0x20], 0
je 0x1001f9c3
mov dword [ebp - 0x27c], 1
jmp 0x1001f9ca
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x1001f9e4
mov dword [ebp - 0x3cc], 1
jmp 0x1001f9eb
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3cc]
jne 0x1001fa02
mov dword [ebp - 0x284], 1
jmp 0x1001fa09
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1001fa27
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x38]
jl 0x1001fa3e
cmp dword [ebp - 0x38], 0
jne 0x1001fa3e
and dword [ebp - 0x474], 0
jmp 0x1001fa48
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x474]
imul eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x20]
cmp eax, 1
ja 0x1001fa6a
mov dword [ebp - 0x28c], 1
jmp 0x1001fa71
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0xfb6f85a0
jae 0x1001fa8a
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
mov eax, 0x8acc167d
test eax, eax
je 0x1001ff47
mov dword [ebp - 0xf0], 0x8ae0512e
mov dword [ebp - 0x1d8], 5
mov dword [ebp - 0x1b8], 0xffffffff
mov dword [ebp - 0x5b4], 4
mov dword [ebp - 0x71c], 0xdc67586e
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x168], 0x8d320cd5
mov dword [ebp - 0x58], 0
jmp 0x1001faed
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1001fb03
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x764], 0
jmp 0x1001fae6
mov dword [ebp - 0x58], 0
jmp 0x1001fb13
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1001fb29
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x878], 0xfffffffb
jmp 0x1001fb0c
mov dword [ebp - 0x38], 5
jmp 0x1001fb39
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe3
jge 0x1001fcc4
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0x188], 0
jmp 0x1001fb66
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x1001fb82
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x860], 0xfffffffa
jmp 0x1001fb59
mov dword [ebp - 0x3d4], 0xffffffff
mov esi, dword [ebp - 0x3d4]
neg esi
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
cmp esi, dword [eax]
jg 0x1001fbb1
mov dword [ebp - 0x294], 1
jmp 0x1001fbb8
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x294]
jle 0x1001fbcf
mov dword [ebp - 0x3dc], 1
jmp 0x1001fbd6
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0xf0], 0
je 0x1001fbf0
xor eax, eax
inc eax
je 0x1001fbf0
mov dword [ebp - 0x504], 1
jmp 0x1001fbf7
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
sub eax, 0xcede
cmp eax, 0x6b93dced
jge 0x1001fc15
mov dword [ebp - 0x29c], 1
jmp 0x1001fc1c
and dword [ebp - 0x29c], 0
imul eax, dword [ebp - 0x29c], 0x2de4
cmp eax, 0xf8f0b53c
je 0x1001fc39
mov dword [ebp - 0x2a4], 1
jmp 0x1001fc40
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0x2a4]
jl 0x1001fc5a
mov dword [ebp - 0x47c], 1
jmp 0x1001fc61
and dword [ebp - 0x47c], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [eax]
jg 0x1001fc84
mov dword [ebp - 0x2ac], 1
jmp 0x1001fc8b
and dword [ebp - 0x2ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x860]
cmp dword [ebp - 0x2ac], eax
jle 0x1001fcac
mov dword [ebp - 0x3e4], 1
jmp 0x1001fcb3
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x1d8], eax
jmp 0x1001fb32
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x5b8]
cmp eax, dword [ebp - 0x534]
jne 0x1001fd0c
mov dword [ebp - 0x2b4], 1
jmp 0x1001fd13
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
add eax, 0x503ecef3
je 0x1001fd2c
mov dword [ebp - 0x4cc], 1
jmp 0x1001fd33
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xffffffff
je 0x1001fd48
mov dword [ebp - 0x2bc], 1
jmp 0x1001fd4f
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xfffffff7
jge 0x1001fd64
mov dword [ebp - 0x3ec], 1
jmp 0x1001fd6b
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x3ec]
je 0x1001fd89
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1001fd89
mov dword [ebp - 0x2c4], 1
jmp 0x1001fd90
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x2c4], eax
jne 0x1001fdaa
mov dword [ebp - 0x484], 1
jmp 0x1001fdb1
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x5b4]
cmp dword [ebp - 0x484], eax
jne 0x1001fdcb
mov dword [ebp - 0x53c], 1
jmp 0x1001fdd2
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x2cc]
sub eax, 0x38e4a6a7
imul eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1d8], eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
cmp dword [eax], 0xffffffff
jne 0x1001fe14
mov dword [ebp - 0x3f4], 1
jmp 0x1001fe1b
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3f4], eax
jl 0x1001fe35
mov dword [ebp - 0x2d4], 1
jmp 0x1001fe3c
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2d4], eax
jne 0x1001fe53
mov dword [ebp - 0x4f4], 1
jmp 0x1001fe5a
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x4f4], eax
jle 0x1001fe74
mov dword [ebp - 0x2dc], 1
jmp 0x1001fe7b
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
sub eax, 0xe796
cmp eax, dword [ebp - 0x1b8]
jge 0x1001fe9a
mov dword [ebp - 0x604], 1
jmp 0x1001fea1
and dword [ebp - 0x604], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.1000ffd1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x878], 0
je 0x1001fece
xor eax, eax
je 0x1001fece
mov dword [ebp - 0x3fc], 1
jmp 0x1001fed5
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3fc], eax
jl 0x1001feef
mov dword [ebp - 0x2e4], 1
jmp 0x1001fef6
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x764]
cmp eax, dword [ebp - 0x2e4]
je 0x1001ff20
cmp dword [ebp - 0x1b8], 0
je 0x1001ff20
mov dword [ebp - 0x544], 1
jmp 0x1001ff27
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x38], eax
jmp 0x1001ff60
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x1001ff60
push 0x21f0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0x60], 1
jmp 0x1001ff70
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1001ff97
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1001ff95
push 0
push 0xcd2
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1001ff69
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e8]
call fcn.1000ffb5
mov dword [ebp - 0x180], 0x730f94f3
mov dword [ebp - 0xf8], 0
jmp 0x1001ffc9
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x1001ffe5
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x8e8], 0xec2e0cf5
jmp 0x1001ffbc
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1001fffe
push 0x1ef0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov dword [ebp - 0x180], 0
jmp 0x10020017
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1002005f
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x10020044
push 0x12c0
push 0x6a7
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1002005d
push 0
push 0x1352
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1002000a
mov dword [ebp - 0x30c], 0x4b11
mov dword [ebp - 0x554], 0x10008f18
cmp dword [ebp - 0x30c], 0x4d39
jle 0x1002012c
and dword [ebp - 0x108], 0
jmp 0x10020099
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x13ec
jge 0x1002012c
and dword [ebp - 0x100], 0
jmp 0x100200bf
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1143
jge 0x10020127
and dword [ebp - 0x170], 0
jmp 0x100200e1
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x2dcd
jge 0x10020125
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x170]
xor eax, dword [ebp - 0x108]
cdq
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], edx
push dword [ebp - 0x5c0]
push dword [ebp - 0x5c4]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x100200d4
jmp 0x100200b2
jmp 0x1002008c
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x5bc], 0x7f4a7d2a
mov dword [ebp - 0x640], 0xc0ec0dce
mov dword [ebp - 0x190], 0
jmp 0x1002016a
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x10020186
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x6d0], 1
jmp 0x1002015d
mov dword [ebp - 0x24], 2
jmp 0x10020196
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x100201d3
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x100201d1
push 0
push 0xd67
push 0x1b7c
push 0x1c35
push 0x87
push 0x1165
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x1002018f
mov dword [ebp - 0x24], 2
jmp 0x100201e3
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10020348
mov dword [ebp - 0x70], 0xc34eea2a
mov dword [ebp - 0x40c], 0xfeae2151
mov dword [ebp - 0x494], 0xfffffffc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x70]
je 0x1002022b
cmp dword [ebp - 0x70], 0
je 0x1002022b
mov dword [ebp - 0x2ec], 1
jmp 0x10020232
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x2ec]
jl 0x10020249
mov dword [ebp - 0x404], 1
jmp 0x10020250
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0x3847
jge 0x10020268
mov dword [ebp - 0x2f4], 1
jmp 0x1002026f
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
sub eax, 0x86f2
imul eax, dword [ebp - 0x70]
test eax, eax
jne 0x100202a6
cmp dword [ebp - 0x70], 0
jne 0x100202a6
mov eax, 0x6548aab5
test eax, eax
jne 0x100202a6
and dword [ebp - 0x2fc], 0
jmp 0x100202b0
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x24]
je 0x100202dc
cmp dword [ebp - 0x5bc], 0
je 0x100202dc
mov dword [ebp - 0x304], 1
jmp 0x100202e3
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d0]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x6d0], ecx
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6d0]
mov dword [ebp - 0x640], eax
jmp 0x100201dc
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30c], 0x4afb
jge 0x1002036b
mov edx, dword [ebp - 0x554]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10020387
or dword [ebp - 4], 0xffffffff
jmp 0x10020391
mov dword [ebp - 0x164], 0x730f94f3
mov dword [ebp - 0x110], 0
jmp 0x100203b4
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x100203d0
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x894], 0xec2e0cf5
jmp 0x100203a7
mov dword [ebp - 0x414], 0x4529
mov dword [ebp - 0x55c], 0x10008f68
cmp dword [ebp - 0x414], 0x468b
jle 0x10020506
and dword [ebp - 0x15c], 0
jmp 0x1002040a
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x18ea
jge 0x10020506
and dword [ebp - 0x120], 0
jmp 0x10020430
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x370b
jge 0x10020501
and dword [ebp - 0x178], 0
jmp 0x10020456
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x35de
jge 0x100204fc
and dword [ebp - 0x118], 0
jmp 0x1002047c
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x6baf
jge 0x100204f7
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x120]
sar edx, cl
mov ecx, eax
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5cc], edx
push dword [ebp - 0x5cc]
push dword [ebp - 0x5d0]
lea ecx, [ebp - 0x8b8]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x8b8]
call fcn.1000fdf4
jmp 0x1002046f
jmp 0x10020449
jmp 0x10020423
jmp 0x100203fd
mov byte [ebp - 0x79], 0
mov dword [ebp - 4], 4
cmp dword [ebp - 0x414], 0x428b
jge 0x10020529
push dword [ebp - 0x55c]
call fcn.1004bc16
pop ecx
jmp 0x10020545
or dword [ebp - 4], 0xffffffff
jmp 0x1002054f
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10020564
push 0x1ef0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov dword [ebp - 0x164], 0
jmp 0x1002057d
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jg 0x100205cb
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100205aa
push 0x12c0
push 0x6a7
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x100205c9
push 0
push 0x1352
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x10020570
mov dword [ebp - 0x43c], 0x30ea
mov dword [ebp - 0x638], 0x10008fdc
cmp dword [ebp - 0x43c], 0x316b
jle 0x10020690
and dword [ebp - 0x128], 0
jmp 0x10020605
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x6579
jge 0x10020690
and dword [ebp - 0x16c], 0
jmp 0x10020627
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x442b
jge 0x1002068b
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x16c]
cdq
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 0x5d8], edx
push dword [ebp - 0x5d8]
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x8dc]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x8dc]
call fcn.1000fdf4
jmp 0x1002061a
jmp 0x100205f8
mov dword [ebp - 0x18], 0x4c23afc3
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0xb4], 0xe5034859
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7b8], eax
xor eax, eax
neg eax
cmp eax, 0x5e3b372b
je 0x100206dd
mov dword [ebp - 0x314], 1
jmp 0x100206e4
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x314]
jle 0x100206fb
mov dword [ebp - 0x514], 1
jmp 0x10020702
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x514], eax
jge 0x10020719
mov dword [ebp - 0x31c], 1
jmp 0x10020720
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x31c]
jle 0x10020743
mov dword [ebp - 0x41c], 1
jmp 0x1002074a
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x18]
cmp eax, 6
jg 0x1002076a
mov eax, 0xe75
test eax, eax
jne 0x1002076a
and dword [ebp - 0x324], 0
jmp 0x10020774
mov dword [ebp - 0x324], 1
imul eax, dword [ebp - 0x324], 0
test eax, eax
je 0x1002079b
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10020799
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x100207f6
mov dword [ebp - 0x564], 0x3b16aac8
mov dword [ebp - 0x5d4], 1
mov dword [ebp - 0x18], 0
jmp 0x100207bf
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffd
je 0x100207ea
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x100207dd
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
cmp dword [ebp - 0xb4], 0
je 0x100207e8
jmp 0x100207b8
jmp 0x100207b8
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0xb4], 0xfffffff1
jmp 0x1002080f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x2d
je 0x10020aa4
mov dword [ebp - 0x94], 0x5c5395f8
mov dword [ebp - 0x35c], 0xf3bc9f
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x18], 0
jmp 0x1002084a
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
jg 0x10020a9f
mov dword [ebp - 0x434], 0x28ad
mov dword [ebp - 0x6ac], 1
mov dword [ebp - 0x6a8], 1
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 0x6a0], 1
lea ecx, [ebp - 0x1d9]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6ac]
push eax
lea ecx, [ebp - 0x880]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7f8]
call fcn.1000ff8f
mov dword [ebp - 4], 6
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x354], 0xc80d673
cmp dword [ebp - 0x94], 0xffffffff
jg 0x100208eb
mov dword [ebp - 0x49c], 1
jmp 0x100208f2
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 1
jb 0x10020907
mov dword [ebp - 0x32c], 1
jmp 0x1002090e
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x32c]
cmp eax, 0xfffc
jbe 0x1002092e
mov dword [ebp - 0x424], 1
jmp 0x10020935
and dword [ebp - 0x424], 0
push 0
lea ecx, [ebp - 0x7f8]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x424]
mov dword [eax], ecx
cmp dword [ebp - 0x94], 0x24015e1b
jle 0x10020962
mov dword [ebp - 0x334], 1
jmp 0x10020969
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x334], eax
je 0x10020983
mov dword [ebp - 0x4dc], 1
jmp 0x1002098a
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x4dc]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x94]
jl 0x100209b9
mov dword [ebp - 0x42c], 1
jmp 0x100209c0
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x42c]
cmp eax, 0x46c20b13
jl 0x100209df
mov dword [ebp - 0x344], 1
jmp 0x100209e6
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x344], eax
jge 0x10020a00
mov dword [ebp - 0x4a4], 1
jmp 0x10020a07
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4a4], eax
jne 0x10020a21
mov dword [ebp - 0x34c], 1
jmp 0x10020a28
and dword [ebp - 0x34c], 0
imul eax, dword [ebp - 0x34c], 0
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x354]
cmp eax, 0xfff8
jb 0x10020a6c
mov dword [ebp - 0x4fc], 1
jmp 0x10020a73
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x56c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f8]
call fcn.1000ffb5
jmp 0x10020843
jmp 0x10020802
mov dword [ebp - 4], 7
cmp dword [ebp - 0x43c], 0x2dca
jge 0x10020ac3
push dword [ebp - 0x638]
call fcn.1004bc16
pop ecx
jmp 0x10020adf
or dword [ebp - 4], 0xffffffff
jmp 0x10020ae9
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x574], 0x7f4a7d2a
mov dword [ebp - 0x57c], 0xc0ec0dce
mov dword [ebp - 0x130], 0
jmp 0x10020b27
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x10020b43
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x6dc], 1
jmp 0x10020b1a
mov dword [ebp - 0x28], 2
jmp 0x10020b53
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10020b90
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10020b8e
push 0
push 0xd67
push 0x1b7c
push 0x1c35
push 0x87
push 0x1165
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x10020b4c
mov dword [ebp - 0x28], 2
jmp 0x10020ba0
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10020d05
mov dword [ebp - 0x78], 0xc34eea2a
mov dword [ebp - 0x4e4], 0xfeae2151
mov dword [ebp - 0x44c], 0xfffffffc
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x78]
je 0x10020be8
cmp dword [ebp - 0x78], 0
je 0x10020be8
mov dword [ebp - 0x364], 1
jmp 0x10020bef
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x364]
jl 0x10020c06
mov dword [ebp - 0x4ac], 1
jmp 0x10020c0d
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0x3847
jge 0x10020c25
mov dword [ebp - 0x36c], 1
jmp 0x10020c2c
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
sub eax, 0x86f2
imul eax, dword [ebp - 0x78]
test eax, eax
jne 0x10020c63
cmp dword [ebp - 0x78], 0
jne 0x10020c63
mov eax, 0x6548aab5
test eax, eax
jne 0x10020c63
and dword [ebp - 0x374], 0
jmp 0x10020c6d
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x28]
je 0x10020c99
cmp dword [ebp - 0x574], 0
je 0x10020c99
mov dword [ebp - 0x37c], 1
jmp 0x10020ca0
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6dc]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp + eax*4 - 0x6dc], ecx
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x7e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6dc]
mov dword [ebp - 0x57c], eax
jmp 0x10020b99
movzx eax, byte [0x1060ad3c]
test eax, eax
je 0x10020d23
mov esi, 0x106094c8
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10022d7a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x464], 0xfffffff8
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x10020d52
push 0x1334
push 0
push 0x150e
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x30], 0
jmp 0x10020d62
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x10
jge 0x10020fb8
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x45c], 0x708b
mov dword [ebp - 0x584], 2
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jg 0x10020da5
mov dword [ebp - 0x4ec], 1
jmp 0x10020dac
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x40], 0
jne 0x10020ef3
cmp dword [ebp - 0x40], 0
je 0x10020e72
cmp dword [ebp - 0x30], 0
jne 0x10020dd2
mov dword [ebp - 0x384], 1
jmp 0x10020dd9
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
sub eax, dword [ebp - 0x30]
cmp eax, 9
jl 0x10020df3
mov dword [ebp - 0x4b4], 1
jmp 0x10020dfa
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
add eax, 0x708c70a8
cmp eax, dword [ebp - 0x40]
jl 0x10020e16
mov dword [ebp - 0x38c], 1
jmp 0x10020e1d
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0xdfe924f6
je 0x10020e35
mov dword [ebp - 0x61c], 1
jmp 0x10020e3c
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x30], 0
jne 0x10020e51
cmp dword [ebp - 0x30], 0
jne 0x10020e51
and dword [ebp - 0x454], 0
jmp 0x10020e5b
mov dword [ebp - 0x454], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x454], eax
jge 0x10020e72
mov dword [ebp - 0x394], 1
jmp 0x10020e79
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x394], eax
jl 0x10020e90
mov dword [ebp - 0x50c], 1
jmp 0x10020e97
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x50c], eax
jne 0x10020eb1
mov dword [ebp - 0x39c], 1
jmp 0x10020eb8
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x39c], eax
jl 0x10020ecf
mov dword [ebp - 0x3a4], 1
jmp 0x10020ed6
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x3a4], eax
jle 0x10020ef3
cmp dword [ebp - 0x40], 0
jne 0x10020ef3
and dword [ebp - 0x4bc], 0
jmp 0x10020efd
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x4bc], eax
jge 0x10020f17
mov dword [ebp - 0x3ac], 1
jmp 0x10020f1e
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x3ac]
je 0x10020f3a
xor eax, eax
inc eax
je 0x10020f3a
mov dword [ebp - 0x3b4], 1
jmp 0x10020f41
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x464]
add eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x4ec], eax
je 0x10020f61
mov dword [ebp - 0x3bc], 1
jmp 0x10020f68
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0x40]
imul eax, eax, 0xfffffffc
mov ecx, dword [ebp - 0x1d0]
inc ecx
mov dword [ebp - 0x1d0], ecx
test eax, eax
jne 0x10020f9d
cmp dword [ebp - 0x40], 0
jne 0x10020f9d
and dword [ebp - 0x46c], 0
jmp 0x10020fa7
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x584], eax
jmp 0x10020d5b
mov dword [ebp - 0x814], 0x106094c8
mov dword [ebp - 0x14], 0x4c23afc3
mov dword [ebp - 0x98], 1
mov dword [ebp - 0xac], 0xe5034859
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7a4], eax
xor eax, eax
neg eax
cmp eax, 0x5e3b372b
je 0x1002100f
mov dword [ebp - 0x3c4], 1
jmp 0x10021016
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3c4]
jle 0x1002102d
mov dword [ebp - 0x270], 1
jmp 0x10021034
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x270], eax
jge 0x1002104b
mov dword [ebp - 0x278], 1
jmp 0x10021052
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x278]
jle 0x10021075
mov dword [ebp - 0x280], 1
jmp 0x1002107c
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
sub eax, dword [ebp - 0x14]
cmp eax, 6
jg 0x1002109c
mov eax, 0xe75
test eax, eax
jne 0x1002109c
and dword [ebp - 0x288], 0
jmp 0x100210a6
mov dword [ebp - 0x288], 1
imul eax, dword [ebp - 0x288], 0
test eax, eax
je 0x100210cd
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x100210cb
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10021128
mov dword [ebp - 0x5ec], 0x3b16aac8
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x14], 0
jmp 0x100210f1
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffd
je 0x1002111c
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1002110f
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
cmp dword [ebp - 0xac], 0
je 0x1002111a
jmp 0x100210ea
jmp 0x100210ea
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0xac], 0xfffffff1
jmp 0x10021141
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x2d
je 0x100214e2
mov dword [ebp - 0xa4], 0x5c5395f8
mov dword [ebp - 0x2f8], 0xf3bc9f
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x14], 0
jmp 0x1002117c
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff1
jg 0x100214dd
mov dword [ebp - 0x2e0], 0x28ad
mov dword [ebp - 0x698], 1
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x690], 1
mov dword [ebp - 0x68c], 1
lea ecx, [ebp - 0x19d]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x888]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x808]
call fcn.1000ff8f
mov dword [ebp - 4], 9
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2e8], 0xc80d673
mov dword [ebp - 0x300], 0x4735
mov dword [ebp - 0x5f8], 0x10009038
cmp dword [ebp - 0x300], 0x474a
jle 0x100212cc
and dword [ebp - 0x174], 0
jmp 0x10021242
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x2455
jge 0x100212cc
and dword [ebp - 0x138], 0
jmp 0x10021264
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x32f4
jge 0x100212c7
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x138]
cdq
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], edx
push dword [ebp - 0x5e4]
push dword [ebp - 0x5e8]
lea ecx, [ebp - 0x900]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0x650], eax
mov ecx, dword [ebp - 0x650]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x900]
call fcn.1000fdf4
jmp 0x10021257
jmp 0x10021235
cmp dword [ebp - 0xa4], 0xffffffff
jg 0x100212e1
mov dword [ebp - 0x1f8], 1
jmp 0x100212e8
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 1
jb 0x100212fd
mov dword [ebp - 0x298], 1
jmp 0x10021304
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x298]
cmp eax, 0xfffc
jbe 0x10021324
mov dword [ebp - 0x2a0], 1
jmp 0x1002132b
and dword [ebp - 0x2a0], 0
push 0
lea ecx, [ebp - 0x808]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x2a0]
mov dword [eax], ecx
cmp dword [ebp - 0xa4], 0x24015e1b
jle 0x10021358
mov dword [ebp - 0x2a8], 1
jmp 0x1002135f
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x2a8], eax
je 0x10021379
mov dword [ebp - 0x2b0], 1
jmp 0x10021380
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2e0]
sub eax, dword [ebp - 0x2b0]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
cmp eax, dword [ebp - 0xa4]
jl 0x100213af
mov dword [ebp - 0x2c0], 1
jmp 0x100213b6
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x2c0]
cmp eax, 0x46c20b13
jl 0x100213d5
mov dword [ebp - 0x2c8], 1
jmp 0x100213dc
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x2c8], eax
jge 0x100213f6
mov dword [ebp - 0x2d0], 1
jmp 0x100213fd
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x2d0], eax
jne 0x10021417
mov dword [ebp - 0x2d8], 1
jmp 0x1002141e
and dword [ebp - 0x2d8], 0
imul eax, dword [ebp - 0x2d8], 0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x2e0]
sub eax, dword [ebp - 0x2e8]
cmp eax, 0xfff8
jb 0x10021462
mov dword [ebp - 0x2f0], 1
jmp 0x10021469
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x594], eax
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x300], 0x4636
jge 0x1002149d
push dword [ebp - 0x5f8]
call fcn.1004bc16
pop ecx
jmp 0x100214b9
mov dword [ebp - 4], 9
jmp 0x100214c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x808]
call fcn.1000ffb5
jmp 0x10021175
jmp 0x10021134
mov dword [ebp - 0x17c], 0
jmp 0x100214fb
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x10021517
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x67c], 0x62fd
jmp 0x100214ee
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10021536
push 0x2112
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x67c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x67c], eax
mov dword [ebp - 0x6f8], 0x106094cc
mov byte [0x1060ad3c], 1
mov dword [ebp - 0x19c], 0xd06ce125
mov dword [ebp - 0x1c0], 0xfffffff7
mov dword [ebp - 0x320], 9
mov dword [ebp - 0x7ac], 0x2250db85
mov dword [ebp - 0x59c], 1
mov dword [ebp - 0x48], 0
jmp 0x100215a4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x100215ba
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x834], 0x7be9fb1c
jmp 0x1002159d
mov dword [ebp - 0x48], 0
jmp 0x100215ca
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x100215e0
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x140], 0x7be2d3d4
jmp 0x100215c3
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x140], eax
cmp dword [ebp - 0x59c], 0
je 0x1002165e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x834], 0x64d9
jge 0x1002163b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jne 0x1002163b
and dword [ebp - 0x308], 0
jmp 0x10021645
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x308]
sub eax, 0xffff
je 0x1002165e
mov dword [ebp - 0x310], 1
jmp 0x10021665
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 1
jle 0x10021687
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jne 0x10021687
and dword [ebp - 0x318], 0
jmp 0x10021691
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x318]
cmp dword [ebp - 0x320], eax
jge 0x100216ca
mov dword [ebp - 0x328], 1
jmp 0x100216d1
and dword [ebp - 0x328], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x328]
neg ecx
cmp ecx, dword [ebp + eax - 0x834]
jge 0x100216f4
mov dword [ebp - 0x330], 1
jmp 0x100216fb
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x834], ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x390], 0xfffffff8
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x10021743
push 0x1334
push 0
push 0x150e
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x2c], 0
jmp 0x10021753
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x10
jge 0x100219a9
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x370], 0x708b
mov dword [ebp - 0x5a4], 2
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jg 0x10021796
mov dword [ebp - 0x3a0], 1
jmp 0x1002179d
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3c], 0
jne 0x100218e4
cmp dword [ebp - 0x3c], 0
je 0x10021863
cmp dword [ebp - 0x2c], 0
jne 0x100217c3
mov dword [ebp - 0x338], 1
jmp 0x100217ca
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
sub eax, dword [ebp - 0x2c]
cmp eax, 9
jl 0x100217e4
mov dword [ebp - 0x340], 1
jmp 0x100217eb
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
add eax, 0x708c70a8
cmp eax, dword [ebp - 0x3c]
jl 0x10021807
mov dword [ebp - 0x348], 1
jmp 0x1002180e
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 0xdfe924f6
je 0x10021826
mov dword [ebp - 0x5ac], 1
jmp 0x1002182d
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x2c], 0
jne 0x10021842
cmp dword [ebp - 0x2c], 0
jne 0x10021842
and dword [ebp - 0x350], 0
jmp 0x1002184c
mov dword [ebp - 0x350], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x350], eax
jge 0x10021863
mov dword [ebp - 0x358], 1
jmp 0x1002186a
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x358], eax
jl 0x10021881
mov dword [ebp - 0x360], 1
jmp 0x10021888
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x360], eax
jne 0x100218a2
mov dword [ebp - 0x368], 1
jmp 0x100218a9
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x368], eax
jl 0x100218c0
mov dword [ebp - 0x378], 1
jmp 0x100218c7
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x378], eax
jle 0x100218e4
cmp dword [ebp - 0x3c], 0
jne 0x100218e4
and dword [ebp - 0x380], 0
jmp 0x100218ee
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x380], eax
jge 0x10021908
mov dword [ebp - 0x388], 1
jmp 0x1002190f
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x388]
je 0x1002192b
xor eax, eax
inc eax
je 0x1002192b
mov dword [ebp - 0x398], 1
jmp 0x10021932
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x390]
add eax, dword [ebp - 0x398]
cmp dword [ebp - 0x3a0], eax
je 0x10021952
mov dword [ebp - 0x3a8], 1
jmp 0x10021959
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1a4]
add eax, dword [ebp - 0x3c]
imul eax, eax, 0xfffffffc
mov ecx, dword [ebp - 0x1a4]
inc ecx
mov dword [ebp - 0x1a4], ecx
test eax, eax
jne 0x1002198e
cmp dword [ebp - 0x3c], 0
jne 0x1002198e
and dword [ebp - 0x3b0], 0
jmp 0x10021998
mov dword [ebp - 0x3b0], 1
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x5a4], eax
jmp 0x1002174c
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x106094d8
mov dword [ebp - 0x230], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x106094d8
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x184], 0
jmp 0x100219e7
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x10021a03
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x684], 0x62fd
jmp 0x100219da
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x10021a22
push 0x2112
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x684]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x684], eax
push 2
lea ecx, [ebp - 0x674]
call fcn.1000ff33
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa0], 0x6ff23b1a
mov dword [ebp - 0x1ac], 0x8cccddd
mov dword [ebp - 0x3b8], 0x5032
mov dword [ebp - 0x5b0], 0x100090cc
cmp dword [ebp - 0x3b8], 0x515d
jle 0x10021b3e
and dword [ebp - 0x148], 0
jmp 0x10021a9f
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x7c4d
jge 0x10021b31
and dword [ebp - 0x18c], 0
jmp 0x10021ac5
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x5231
jge 0x10021b2c
and dword [ebp - 0x150], 0
jmp 0x10021ae7
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x4248
jge 0x10021b2a
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0x150]
cdq
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], edx
push dword [ebp - 0x5f0]
push dword [ebp - 0x5f4]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x10021ada
jmp 0x10021ab8
jmp 0x10021a92
push 0xab5
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x700], 0x884cb8f6
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x3b8], 0x4d60
jge 0x10021b68
mov edx, dword [ebp - 0x5b0]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10021b84
mov dword [ebp - 4], 0xc
jmp 0x10021b94
mov dword [ebp - 0x194], 0x9b58331c
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x708], 0x4c3d
mov dword [ebp - 0x3e8], 0x61ca7276
mov dword [ebp - 0x4c], 0
jmp 0x10021bd6
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10021bef
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x674]
call fcn.1000ffd1
or dword [eax], 0xffffffff
jmp 0x10021bcf
mov dword [ebp - 0x4c], 0
jmp 0x10021bff
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10021c15
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x64c], 1
jmp 0x10021bf8
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
jne 0x10021cd8
cmp dword [ebp - 0x1ac], 0
jne 0x10021cd8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x64c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x194], 0x7b83
jle 0x10021c6c
mov dword [ebp - 0x3c0], 1
jmp 0x10021c73
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x3c0], eax
jle 0x10021c8d
mov dword [ebp - 0x3c8], 1
jmp 0x10021c94
and dword [ebp - 0x3c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64c]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10021cd8
and dword [ebp - 0x3d0], 0
jmp 0x10021ce2
mov dword [ebp - 0x3d0], 1
push 1
lea ecx, [ebp - 0x674]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [eax]
jge 0x10021d05
mov dword [ebp - 0x3d8], 1
jmp 0x10021d0c
and dword [ebp - 0x3d8], 0
push 1
lea ecx, [ebp - 0x674]
call fcn.1000ffd1
mov eax, dword [eax]
sub eax, dword [ebp - 0x3d8]
je 0x10021f4f
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x7fc], 0xbf7c295a
mov dword [ebp - 0x718], 0xfffffffe
mov dword [ebp - 0x7bc], 0xffffffff
mov dword [ebp - 0x720], 0xb1bb30b1
mov dword [ebp - 0x810], 0xe8e548e0
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x7c4], 0x6eae1177
mov dword [ebp - 0x730], 0x18d7c584
mov dword [ebp - 0x80c], 0xa81f6ed7
mov dword [ebp - 0x738], 0xfffffffb
mov dword [ebp - 0x7cc], 0x5fe96f77
mov dword [ebp - 0x740], 0xcd890f6d
mov dword [ebp - 0x76c], 0x2fd17ba7
mov dword [ebp - 0x748], 7
mov dword [ebp - 0x3e0], 0x26ab
mov dword [ebp - 0x524], 0x10009128
cmp dword [ebp - 0x3e0], 0x289a
jle 0x10021e89
and dword [ebp - 0xd0], 0
jmp 0x10021df7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x49ef
jge 0x10021e89
and dword [ebp - 0xd4], 0
jmp 0x10021e1d
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x5d1a
jge 0x10021e84
and dword [ebp - 0xdc], 0
jmp 0x10021e3f
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xdc5
jge 0x10021e82
mov eax, dword [ebp - 0xd0]
sub eax, dword [ebp - 0xd4]
or eax, dword [ebp - 0xdc]
cdq
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], edx
push dword [ebp - 0x5fc]
push dword [ebp - 0x600]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x10021e32
jmp 0x10021e10
jmp 0x10021dea
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x3e0], 0x23b3
jge 0x10021ea9
mov edx, dword [ebp - 0x524]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10021ec5
mov dword [ebp - 4], 0xc
jmp 0x10021ed5
mov dword [ebp - 0xe4], 0
jmp 0x10021eee
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x10021f0a
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x8a0], 0xffffffff
jmp 0x10021ee1
mov dword [ebp - 0xa0], 0
jmp 0x10021f23
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 9
jl 0x10021f40
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x64c]
mov dword [ebp - 0x528], eax
jmp 0x10021f16
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
jmp 0x10021fc3
mov dword [ebp - 0xc4], 0xd5f5ab95
mov dword [ebp - 0x530], 0xffffffff
mov dword [ebp - 0xc4], 0xd012cd0a
mov dword [ebp - 0xc4], 0
jmp 0x10021f86
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1c
jne 0x10021fc3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64c]
mov dword [ebp - 0x3f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp + eax - 0x64c], ecx
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x530], eax
jmp 0x10021f79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.1000ffb5
mov eax, dword [ebp - 0x230]
mov dword [0x106094c8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [0x106094cc], eax
mov dword [ebp - 0xb8], 9
mov dword [ebp - 0x540], 0x60edac7a
mov dword [ebp - 0xec], 0
jmp 0x10022015
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x10022031
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x60c], 0x11c15747
jmp 0x10022008
mov dword [ebp - 0xb8], 0xffffffe7
jmp 0x1002204a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff7
jge 0x1002231a
mov dword [ebp - 0xbc], 0
push 1
lea ecx, [ebp - 0x6b8]
call fcn.1000ff33
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xf4], 0
jmp 0x1002208e
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x100220b0
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x6b8]
call fcn.1000ffd1
mov dword [eax], 0xc1543f36
jmp 0x10022081
mov dword [ebp - 0xbc], 0x17
jmp 0x100220c9
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffff5
jl 0x10022306
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0xc0], 0xc3cbaa6f
mov dword [ebp - 0xb0], 0
jmp 0x10022103
cmp dword [ebp - 0xb0], 1
jg 0x100222e8
mov dword [ebp - 0xfc], 0xfffffffd
mov dword [ebp - 0x420], 0xd1532d49
mov dword [ebp - 0x550], 9
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0xfc], 4
jge 0x1002214f
mov dword [ebp - 0x3f8], 1
jmp 0x10022156
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0xbc]
jne 0x10022183
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x60c], 0
jne 0x10022183
and dword [ebp - 0x400], 0
jmp 0x1002218d
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x400], eax
jge 0x100221a7
mov dword [ebp - 0x408], 1
jmp 0x100221ae
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
sub eax, 6
jne 0x100221cb
mov eax, 0x55126ed4
test eax, eax
jne 0x100221cb
and dword [ebp - 0x410], 0
jmp 0x100221d5
mov dword [ebp - 0x410], 1
cmp dword [ebp - 0x410], 0x25f3
jl 0x100221ed
mov dword [ebp - 0x418], 1
jmp 0x100221f4
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xfffffffb
jbe 0x10022209
mov dword [ebp - 0x520], 1
jmp 0x10022210
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x750], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60c], 0
je 0x10022241
cmp dword [ebp - 0xb8], 0
je 0x10022241
mov dword [ebp - 0x1b4], 1
jmp 0x10022248
and dword [ebp - 0x1b4], 0
push 0
lea ecx, [ebp - 0x6b8]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x1b4]
mov dword [eax], ecx
cmp dword [ebp - 0x1b4], 0xfffffffd
jne 0x10022272
mov dword [ebp - 0x548], 1
jmp 0x10022279
and dword [ebp - 0x548], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60c]
add eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x420]
add eax, 0x4ce3095f
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc0], 0
jmp 0x100222b7
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x10022301
push 0x140e
push 0x1d
call dword [sym.imp.USER32.dll_SetCaretPos]
jmp 0x100220bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
call fcn.1000ffb5
jmp 0x1002203d
mov dword [ebp - 0x1c4], 0xd06ce125
mov dword [ebp - 0x1bc], 0xfffffff7
mov dword [ebp - 0x440], 9
mov dword [ebp - 0x778], 0x2250db85
mov dword [ebp - 0x560], 1
mov dword [ebp - 0x50], 0
jmp 0x1002235c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10022372
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x848], 0x7be9fb1c
jmp 0x10022355
mov dword [ebp - 0x50], 0
jmp 0x10022382
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10022398
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x104], 0x7be2d3d4
jmp 0x1002237b
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x104], eax
cmp dword [ebp - 0x560], 0
je 0x10022416
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x848], 0x64d9
jge 0x100223f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
jne 0x100223f3
and dword [ebp - 0x428], 0
jmp 0x100223fd
mov dword [ebp - 0x428], 1
mov eax, dword [ebp - 0x428]
sub eax, 0xffff
je 0x10022416
mov dword [ebp - 0x430], 1
jmp 0x1002241d
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 1
jle 0x1002243f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
jne 0x1002243f
and dword [ebp - 0x438], 0
jmp 0x10022449
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x438]
cmp dword [ebp - 0x440], eax
jge 0x10022482
mov dword [ebp - 0x448], 1
jmp 0x10022489
and dword [ebp - 0x448], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x448]
neg ecx
cmp ecx, dword [ebp + eax - 0x848]
jge 0x100224ac
mov dword [ebp - 0x450], 1
jmp 0x100224b3
and dword [ebp - 0x450], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x450]
mov dword [ebp + eax - 0x848], ecx
mov dword [ebp - 0x80], 8
mov dword [ebp - 0x12c], 0x9ea7
mov dword [ebp - 0x458], 0x7b48
mov dword [ebp - 0x568], 0x100091c0
cmp dword [ebp - 0x458], 0x7c29
jle 0x100225d6
and dword [ebp - 0x11c], 0
jmp 0x10022511
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x7259
jge 0x100225d6
and dword [ebp - 0x124], 0
jmp 0x10022537
cmp dword [ebp - 0x124], 0x51ce
jge 0x100225d1
and dword [ebp - 0x10c], 0
jmp 0x1002255d
cmp dword [ebp - 0x10c], 0x2361
jge 0x100225cc
jmp 0x10022504
push 1
lea ecx, [ebp - 0x65c]
call fcn.1000ff33
mov dword [ebp - 4], 0x12
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x458], 0x79e6
jge 0x1002260a
mov edx, dword [ebp - 0x568]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10022626
mov dword [ebp - 4], 0x12
jmp 0x10022636
mov dword [ebp - 0x478], 0xffffffff
push 1
lea ecx, [ebp - 0x6c4]
call fcn.1000ff33
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x208], 0x85b3d925
mov dword [ebp - 0x578], 0xfffffff8
mov dword [ebp - 0x580], 0x4a788afb
mov dword [ebp - 0x54], 0
jmp 0x1002267f
cmp dword [ebp - 0x54], 1
jge 0x10022698
push dword [ebp - 0x54]
lea ecx, [ebp - 0x65c]
call fcn.1000ffd1
and dword [eax], 0
jmp 0x10022678
mov dword [ebp - 0x54], 0
jmp 0x100226a8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret