Function at 0x1000c4c6
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f9ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000c53d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1b4], eax
push dword [ebp - 0x1b4]
push dword [ebp - 0x198]
push dword [ebp - 0x1a0]
push 0x5fc5
push 0
push dword [ebp - 0x190]
call fcn.1000ec3c
add esp, 0x18
jmp 0x1000d54d
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x17c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x90], 0xf5540d7f
and dword [ebp - 0x204], 0
and dword [ebp - 0x200], 0
and dword [ebp - 0x1fc], 0
and dword [ebp - 0x1f8], 0
lea ecx, [ebp - 0x95]
call fcn.1000f499
push eax
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x298]
call fcn.1000f49c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.1000f45f
and dword [ebp - 4], 0
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x90], 0x10
jmp 0x1000c5e0
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000c892
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x78], 0
jmp 0x1000c604
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000c61a
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x26c], 0x44d4e2b7
jmp 0x1000c5fd
mov dword [ebp - 0x30], 0
jmp 0x1000c62a
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffffe
jle 0x1000c88d
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x88], 0
jmp 0x1000c654
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000c670
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x254], 0x8a0c0902
jmp 0x1000c647
mov dword [ebp - 0x10], 0
jmp 0x1000c680
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1000c83f
mov dword [ebp - 0x40], 0xfffffff8
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1000c6a3
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x48], 0x2bb2
mov esi, dword [ebp - 0x10]
neg esi
push 1
lea ecx, [ebp - 0x1d0]
call fcn.1000f48a
cmp esi, dword [eax]
jg 0x1000c6cc
mov dword [ebp - 0xd4], 1
jmp 0x1000c6d3
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd4], eax
jg 0x1000c6ed
cmp dword [ebp - 0x10], 0
jne 0x1000c6ed
and dword [ebp - 0x148], 0
jmp 0x1000c6f7
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x164], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x26c], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x230], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1d0]
call fcn.1000f48a
mov eax, dword [eax]
dec eax
cmp eax, dword [ebp - 0x10]
jg 0x1000c747
mov dword [ebp - 0x19c], 1
jmp 0x1000c74e
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x238], eax
mov eax, 0xfffa
cmp eax, 0xc254
jb 0x1000c76f
mov dword [ebp - 0x144], 1
jmp 0x1000c776
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x144], eax
jge 0x1000c796
mov eax, 0xffff
test eax, eax
je 0x1000c796
mov dword [ebp - 0xd0], 1
jmp 0x1000c79d
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd0], eax
jg 0x1000c7b3
push 7
pop eax
test eax, eax
jne 0x1000c7b3
cmp dword [ebp - 0x10], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1d0]
call fcn.1000f48a
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x10], eax
jle 0x1000c7e2
mov dword [ebp - 0x110], 0xfffe
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
jmp 0x1000c83a
mov dword [ebp - 0x48], 0
jmp 0x1000c7f2
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1000c83a
mov dword [ebp - 0x40], 0
jmp 0x1000c808
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1000c838
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1000c82e
push 0x28b
push 0
push 0
push 0x1800
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [ebp - 0x48], 0
je 0x1000c836
jmp 0x1000c801
jmp 0x1000c801
jmp 0x1000c7eb
jmp 0x1000c679
mov dword [ebp - 0x10], 0
jmp 0x1000c84f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xc
jge 0x1000c888
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x1000c886
push 0
push 0xa
push 0x289
push 0x7fd
push 0x2581
push 0x2414
push 0x1a0d
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1000c848
jmp 0x1000c623
jmp 0x1000c5d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.1000f485
mov eax, dword [ebp - 0x16c]
movzx eax, byte [eax]
test eax, eax
je 0x1000d093
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x14], 9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000c914
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1000c90f
push 0
push 0x1c91
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1000cb19
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x1000cb19
mov dword [ebp - 0x1a8], 0x16be
cmp dword [ebp - 0x1a8], 0xff9
jge 0x1000cb07
lea eax, [ebp - 0x4c]
push eax
push 0x100081bc
call fcn.10055adb
pop ecx
pop ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xc0]
call fcn.1000f401
mov dword [ebp - 4], 1
and dword [ebp - 0x64], 0
jmp 0x1000c975
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x64], eax
jge 0x1000c99e
push dword [ebp - 0x64]
lea ecx, [ebp - 0xc0]
call fcn.1000f48a
push eax
push 0x1000817c
call fcn.10055adb
pop ecx
pop ecx
jmp 0x1000c96e
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0xc0]
call fcn.1000f5ed
push dword [eax]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0xc0]
call fcn.1000f59b
push dword [eax]
call fcn.10012087
pop ecx
pop ecx
lea ecx, [ebp - 0x154]
call fcn.1000f5e0
mov byte [ebp - 4], 2
and dword [ebp - 0xa4], 0
jmp 0x1000c9f2
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x4c]
jge 0x1000caa3
lea ecx, [ebp - 0xc0]
call fcn.1000f605
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xc0]
call fcn.1000f65f
and dword [ebp - 0x80], 0
jmp 0x1000ca2c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x154]
call fcn.1000f5fc
cmp dword [ebp - 0x80], eax
jae 0x1000ca8c
push dword [ebp - 0x80]
lea ecx, [ebp - 0x154]
call fcn.1000f48a
push dword [eax]
push dword [ebp - 0xd8]
call section..ylol
pop ecx
pop ecx
mov dword [ebp - 0x174], eax
lea ecx, [ebp - 0xc0]
call fcn.1000f605
mov eax, dword [eax]
cmp eax, dword [ebp - 0x174]
jne 0x1000ca8a
lea ecx, [ebp - 0xc0]
call fcn.1000f65f
lea ecx, [ebp - 0xc0]
call fcn.1000f65f
jmp 0x1000ca25
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x154]
call fcn.1000f60c
jmp 0x1000c9e5
and dword [ebp - 0x6c], 0
jmp 0x1000cab0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0x154]
call fcn.1000f5fc
cmp dword [ebp - 0x6c], eax
jae 0x1000cade
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x154]
call fcn.1000f48a
push dword [eax]
push 0x100081c4
call fcn.10055d0f
pop ecx
pop ecx
jmp 0x1000caa9
push 0x100080e5
call fcn.10055ec6
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x154]
call fcn.1000f485
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.1000f485
push 0
push 0x1a4a
push 0x2a9
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x14], 0x72226312
cmp dword [ebp - 0x14], 0
je 0x1000cb91
mov dword [ebp - 0x14], 0
jmp 0x1000cb36
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffeb
jl 0x1000cb8c
mov dword [ebp - 0x5c], 0x576c5165
mov dword [ebp - 0x1a4], 1
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1000cb69
push 0x527
push 0xc1d
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x5c], 0xb
jmp 0x1000cb79
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe4
jg 0x1000cb8a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1a4], eax
jmp 0x1000cb72
jmp 0x1000cb2f
jmp 0x1000cd53
mov dword [ebp - 0x1c], 0xb4ef66b1
mov dword [ebp - 0x14], 0
jmp 0x1000cba8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1000cd0d
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x1000cbc9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1000cbd8
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x1000cbc2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x1c4], ecx
cmp dword [ebp - 0x130], 0
jne 0x1000cc10
cmp dword [ebp - 0x18], 0
jne 0x1000cc10
and dword [ebp - 0xe8], 0
jmp 0x1000cc1a
mov dword [ebp - 0xe8], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], eax
jne 0x1000cc2e
mov dword [ebp - 0xe0], 1
jmp 0x1000cc35
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xe0]
sub eax, ecx
cmp dword [ebp - 0x1c], eax
jle 0x1000cc54
mov dword [ebp - 0x118], 1
jmp 0x1000cc5b
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x118], eax
je 0x1000cc72
mov dword [ebp - 0x140], 1
jmp 0x1000cc79
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x140]
jge 0x1000cc93
mov dword [ebp - 0xf0], 1
jmp 0x1000cc9a
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0xf0]
cmp eax, 1
jl 0x1000ccbc
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1000ccbc
mov dword [ebp - 0x120], 1
jmp 0x1000ccc3
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x120], eax
je 0x1000ccda
mov dword [ebp - 0xf8], 1
jmp 0x1000cce1
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xf8], eax
je 0x1000ccf8
mov dword [ebp - 0x138], 1
jmp 0x1000ccff
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x18], eax
jmp 0x1000cba1
mov dword [ebp - 0x1c], 0
jmp 0x1000cd1d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000cd53
mov dword [ebp - 0x100], 1
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
mov byte [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x1000cd51
push 0xe3
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1000cd16
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1ac], eax
push 2
lea ecx, [ebp - 0x1dc]
call fcn.1000f401
mov dword [ebp - 4], 3
mov dword [ebp - 0x50], 0x39beb064
mov dword [ebp - 0x74], 0
jmp 0x1000cd96
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000cdb2
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1dc]
call fcn.1000f48a
mov dword [eax], 0xbca63185
jmp 0x1000cd8f
mov dword [ebp - 0x50], 1
jmp 0x1000cdc2
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1000d060
mov dword [ebp - 0x20], 0x90a624cd
mov dword [ebp - 0x20], 1
jmp 0x1000cde3
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1000d044
mov dword [ebp - 0x44], 0x3921ded6
mov dword [ebp - 0x18c], 0xb8cff26a
mov dword [ebp - 0x184], 0x2276
cmp dword [ebp - 0x184], 0x1138
jge 0x1000ceb6
and dword [ebp - 0xa0], 0
and dword [ebp - 0x9c], 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x100081cc
call fcn.10055adb
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
lea eax, [ecx + eax - 1]
push eax
push 0x10008198
call fcn.10055d0f
pop ecx
pop ecx
mov dword [ebp - 0x7c], 1
jmp 0x1000ce6e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x9c]
jg 0x1000ce8a
push dword [ebp - 0x7c]
push 0x100081d4
call fcn.10055d0f
pop ecx
pop ecx
jmp 0x1000ce67
mov dword [ebp - 0x68], 2
jmp 0x1000ce9a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0xa0]
jg 0x1000ceb6
push dword [ebp - 0x68]
push 0x100081dc
call fcn.10055d0f
pop ecx
pop ecx
jmp 0x1000ce93
mov dword [ebp - 0x44], 1
jmp 0x1000cec6
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000d03f
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xc8], 0xf4f23013
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x44], eax
jge 0x1000cf08
mov dword [ebp - 0xdc], 1
jmp 0x1000cf0f
and dword [ebp - 0xdc], 0
push 1
lea ecx, [ebp - 0x1dc]
call fcn.1000f48a
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1000cf30
mov dword [ebp - 0x128], 1
jmp 0x1000cf37
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x128]
add eax, 0x7eb4ee0d
cmp eax, dword [ebp - 0xc8]
jne 0x1000cf56
mov dword [ebp - 0x108], 1
jmp 0x1000cf5d
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x108], eax
jne 0x1000cf74
mov dword [ebp - 0xcc], 1
jmp 0x1000cf7b
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xcc]
jne 0x1000cf97
or eax, 0xffffffff
jne 0x1000cf97
and dword [ebp - 0xc4], 0
jmp 0x1000cfa1
mov dword [ebp - 0xc4], 1
mov eax, dword [ebp - 0xc4]
add eax, 0x706b3799
cmp dword [ebp - 0xdc], eax
jg 0x1000cfc0
mov dword [ebp - 0xe4], 1
jmp 0x1000cfc7
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x50]
jne 0x1000cfe1
mov dword [ebp - 0xec], 1
jmp 0x1000cfe8
and dword [ebp - 0xec], 0
push 1
lea ecx, [ebp - 0x1dc]
call fcn.1000f48a
mov ecx, dword [ebp - 0xec]
cmp ecx, dword [eax]
jge 0x1000d00b
mov dword [ebp - 0xf4], 1
jmp 0x1000d012
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xf4], eax
je 0x1000d029
mov dword [ebp - 0x1b0], 1
jmp 0x1000d030
and dword [ebp - 0x1b0], 0
mov dword [ebp - 0x18c], 0x40271dbc
jmp 0x1000cebf
jmp 0x1000cddc
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x1000d05b
push 0x19a0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000cdbb
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1000d074
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.1000f485
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x1000d54d
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x58], 0x5020f89b
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x218], 0xa23e86f8
mov dword [ebp - 0x214], 0xa23e86f8
mov dword [ebp - 0x210], 0xa23e86f8
mov dword [ebp - 0x20c], 0xa23e86f8
lea ecx, [ebp - 0xa5]
call fcn.1000f499
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x290]
call fcn.1000f49c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x224]
call fcn.1000f45f
mov dword [ebp - 4], 4
mov dword [ebp - 0x84], 0
jmp 0x1000d139
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000d155
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x250], 0x5f70
jmp 0x1000d12c
mov dword [ebp - 0x58], 0
jmp 0x1000d165
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x1000d1d2
mov dword [ebp - 0x270], 1
mov dword [ebp - 0xfc], 7
mov dword [ebp - 0x8c], 0
jmp 0x1000d198
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1000d1b4
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x2a4], 0x77c8748a
jmp 0x1000d18b
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x250], 0
je 0x1000d1c3
jmp 0x1000d1d2
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
jmp 0x1000d15e
push 0
lea ecx, [ebp - 0x224]
call fcn.1000f48a
mov esi, dword [eax]
neg esi
push 3
lea ecx, [ebp - 0x224]
call fcn.1000f48a
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.1000f485
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x3c], 0x24a8c6a5
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x94], 0
jmp 0x1000d245
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1000d261
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x134], 0xcd333563
jmp 0x1000d238
mov dword [ebp - 0x3c], 0xffffffe7
jmp 0x1000d271
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffa
jge 0x1000d452
mov dword [ebp - 0x104], 0x91f782a1
mov dword [ebp - 0x280], 4
mov dword [ebp - 0x27c], 0xfdb696
mov dword [ebp - 0x22c], 9
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x258], 0xfecbe92e
mov dword [ebp - 0x170], 0xfffffff8
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 0x244], 0xdd1edb6b
mov dword [ebp - 0xb4], 0xfff7
mov dword [ebp - 0x1f0], 0xfffffff6
mov dword [ebp - 0x1ec], 0xfffffff6
mov dword [ebp - 0x1e8], 0xfffffff6
mov dword [ebp - 0x1e4], 0xfffffff6
lea ecx, [ebp - 0xad]
call fcn.1000f499
push eax
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x288]
call fcn.1000f49c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x264]
call fcn.1000f45f
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1000d377
mov eax, 0xb61d2250
test eax, eax
jne 0x1000d377
and dword [ebp - 0x11c], 0
jmp 0x1000d381
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x168], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp + eax - 0x134], ecx
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0x3c], 0xe141
je 0x1000d3c2
mov dword [ebp - 0x10c], 1
jmp 0x1000d3c9
and dword [ebp - 0x10c], 0
push 3
lea ecx, [ebp - 0x264]
call fcn.1000f48a
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [eax]
jl 0x1000d3ec
mov dword [ebp - 0x114], 1
jmp 0x1000d3f3
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x114], eax
jl 0x1000d40d
mov dword [ebp - 0x124], 1
jmp 0x1000d414
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x124]
jl 0x1000d42e
mov dword [ebp - 0x12c], 1
jmp 0x1000d435
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x60], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.1000f485
jmp 0x1000d26a
mov dword [ebp - 0x60], 0xe
jmp 0x1000d462
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x13
jg 0x1000d4b0
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x1000d488
push 0
push 0x4d4
push 0
push 0x1c49
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 0x38], 0
jmp 0x1000d498
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000d4ae
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x134], 0
jmp 0x1000d491
jmp 0x1000d45b
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x70], 0
jmp 0x1000d4d3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000d4e9
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x180], 0xfffffffc
jmp 0x1000d4cc
mov dword [ebp - 0x54], 0
jmp 0x1000d4f9
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1000d50f
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x180], 6
jmp 0x1000d4f2
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x1000d526
push 0x13a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
imul esi, dword [eax], 0xa
mov ecx, dword [ebp - 0x188]
call fcn.1000f324
movsx eax, byte [eax]
lea eax, [esi + eax - 0x30]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret