Function at 0x1000a747
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006cddc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x444
push esi
push edi
mov dword [ebp - 0x10], 0xd4e06482
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xa8], 0
jmp 0x1000a78e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000a7aa
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x42c], 0xfffffff9
jmp 0x1000a781
mov dword [ebp - 0x10], 0
jmp 0x1000a7ba
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xf
jg 0x1000aae6
push 3
lea ecx, [ebp - 0xec]
call fcn.10016ac8
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xc0], 0x4bda99da
mov dword [ebp - 0x98], 0
jmp 0x1000a809
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000a82b
push dword [ebp - 0x98]
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov dword [eax], 0xd925b0e4
jmp 0x1000a7fc
mov dword [ebp - 0x24], 0
jmp 0x1000a83b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1000aa4f
mov dword [ebp - 0xfc], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec]
call fcn.10016b66
push 0
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x10], 0
jl 0x1000a89c
mov dword [ebp - 0x2fc], 1
jmp 0x1000a8a3
and dword [ebp - 0x2fc], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec]
call fcn.10016b66
cmp dword [ebp - 0xc0], 5
jne 0x1000a8cf
mov eax, 0x9e6a0122
test eax, eax
je 0x1000a8cf
mov dword [ebp - 0x1ec], 1
jmp 0x1000a8d6
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x1ec]
jge 0x1000a8f0
mov dword [ebp - 0x2c8], 1
jmp 0x1000a8f7
and dword [ebp - 0x2c8], 0
push 2
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov edi, dword [ebp - 0x2c8]
add edi, dword [eax]
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec]
call fcn.10016b66
imul edi, dword [eax]
cmp dword [esi], edi
jl 0x1000a93d
mov dword [ebp - 0x2bc], 1
jmp 0x1000a944
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xffffffff
jl 0x1000a959
mov dword [ebp - 0x1f0], 1
jmp 0x1000a960
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1f0], eax
jg 0x1000a977
mov dword [ebp - 0x118], 1
jmp 0x1000a97e
and dword [ebp - 0x118], 0
push 0
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [eax]
jle 0x1000a99e
mov eax, 0x7fefb659
test eax, eax
jne 0x1000a9ae
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1000a9ae
and dword [ebp - 0x1f8], 0
jmp 0x1000a9b8
mov dword [ebp - 0x1f8], 1
mov esi, dword [ebp - 0x1f8]
sub esi, dword [ebp - 0x24]
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec]
call fcn.10016b66
imul esi, dword [eax]
add esi, dword [ebp - 0xb8]
cmp esi, dword [ebp - 0x10]
jle 0x1000a9e9
mov dword [ebp - 0x330], 1
jmp 0x1000a9f0
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x10]
cmp eax, 0x41dbc46d
jl 0x1000aa15
mov dword [ebp - 0x120], 1
jmp 0x1000aa1c
and dword [ebp - 0x120], 0
mov eax, 0xc2285faa
sub eax, dword [ebp - 0x120]
cmp eax, 0x4415
jge 0x1000aa3a
mov dword [ebp - 0x200], 1
jmp 0x1000aa41
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x30], eax
jmp 0x1000a834
cmp dword [ebp - 0x30], 4
jl 0x1000aa61
mov dword [ebp - 0x128], 1
jmp 0x1000aa68
and dword [ebp - 0x128], 0
push 1
lea ecx, [ebp - 0xec]
call fcn.10016b66
mov eax, dword [eax]
sub eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x30]
jle 0x1000aa8e
mov dword [ebp - 0x208], 1
jmp 0x1000aa95
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], eax
jle 0x1000aab8
mov dword [ebp - 0x130], 1
jmp 0x1000aabf
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x130]
mov dword [ebp - 0xb8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.10016b4a
jmp 0x1000a7b3
mov dword [ebp - 0x10], 3
jmp 0x1000aaf6
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff5
jge 0x1000ab25
mov dword [ebp - 0x30], 0
jmp 0x1000ab0c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x1000ab23
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x42c], 0
je 0x1000ab21
jmp 0x1000ab23
jmp 0x1000ab05
jmp 0x1000aaef
mov dword [ebp - 0x28], 0xde19d29b
mov dword [ebp - 0x58], 1
mov dword [ebp - 0xd4], 0x9ba87a5e
mov dword [ebp - 0x150], 0xccae
mov dword [ebp - 0x230], 0x4f9a0237
mov dword [ebp - 0x238], 0xfffffffb
mov dword [ebp - 0x78], 0xae9f9034
cmp dword [ebp - 0x28], 0xfd43
jge 0x1000ab77
mov dword [ebp - 0x210], 1
jmp 0x1000ab7e
and dword [ebp - 0x210], 0
mov eax, 0xffff468e
sub eax, dword [ebp - 0x210]
jne 0x1000ab8f
cmp dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jge 0x1000aba3
mov dword [ebp - 0x138], 1
jmp 0x1000abaa
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jl 0x1000abc4
mov dword [ebp - 0x218], 1
jmp 0x1000abcb
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x218]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x28], eax
jge 0x1000abeb
mov dword [ebp - 0x140], 1
jmp 0x1000abf2
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xd4], eax
jne 0x1000ac1e
mov eax, 0xa7f4
test eax, eax
je 0x1000ac1e
mov dword [ebp - 0x220], 1
jmp 0x1000ac25
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
neg eax
add eax, dword [ebp - 0x28]
jne 0x1000ac44
cmp dword [ebp - 0xd4], 0
jne 0x1000ac44
and dword [ebp - 0x148], 0
jmp 0x1000ac4e
mov dword [ebp - 0x148], 1
cmp dword [ebp - 0x148], 0xe3d1aa12
jae 0x1000ac66
mov dword [ebp - 0x228], 1
jmp 0x1000ac6d
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x28], eax
jle 0x1000ac9c
mov dword [ebp - 0x158], 1
jmp 0x1000aca3
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x1000acc8
xor eax, eax
je 0x1000acc8
mov dword [ebp - 0x160], 1
jmp 0x1000accf
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x160]
jge 0x1000ace6
mov dword [ebp - 0x240], 1
jmp 0x1000aced
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x58], 0
jmp 0x1000ad06
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jle 0x1000ad49
mov dword [ebp - 0x78], 0xffffffed
jmp 0x1000ad1c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffffc
jl 0x1000ad47
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x1000ad45
push 0x1ed1
push 0
push 0x1052
push 0x240
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x1000ad15
jmp 0x1000acff
mov dword [ebp - 0x20], 0xe39e
mov dword [ebp - 0x7c], 0xfd1f2e96
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x64], 0xd17cd953
mov dword [ebp - 0x34c], 0x158fb5c4
mov dword [ebp - 0xa0], 0
jmp 0x1000ad8b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000ada7
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x3f4], 0xfff8
jmp 0x1000ad7e
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x7c], 0xfffffff6
cmp dword [ebp - 0x7c], 0
je 0x1000adee
mov eax, 0xbe58
test eax, eax
je 0x1000adee
cmp dword [ebp - 0x20], 0
je 0x1000adee
mov dword [ebp - 0x168], 1
jmp 0x1000adf5
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0xfffffff6
jne 0x1000ae0a
mov dword [ebp - 0x248], 1
jmp 0x1000ae11
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x248], eax
jle 0x1000ae28
mov dword [ebp - 0x170], 1
jmp 0x1000ae2f
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x170]
cmp eax, 5
jle 0x1000ae49
mov dword [ebp - 0x250], 1
jmp 0x1000ae50
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x250], eax
je 0x1000ae67
mov dword [ebp - 0x178], 1
jmp 0x1000ae6e
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x178], eax
jl 0x1000ae85
mov dword [ebp - 0x260], 1
jmp 0x1000ae8c
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x260], eax
jl 0x1000aea3
mov dword [ebp - 0x180], 1
jmp 0x1000aeaa
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xf4], eax
jg 0x1000aecd
mov dword [ebp - 0x268], 1
jmp 0x1000aed4
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x268], eax
je 0x1000aef1
cmp dword [ebp - 0xf4], 0
jne 0x1000aef1
and dword [ebp - 0x188], 0
jmp 0x1000aefb
mov dword [ebp - 0x188], 1
cmp dword [ebp - 0x188], 0x67ab6ce1
jge 0x1000af13
mov dword [ebp - 0x270], 1
jmp 0x1000af1a
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x270], eax
je 0x1000af31
mov dword [ebp - 0x190], 1
jmp 0x1000af38
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x190], eax
je 0x1000af4f
mov dword [ebp - 0x278], 1
jmp 0x1000af56
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x278], eax
je 0x1000af6d
mov dword [ebp - 0x198], 1
jmp 0x1000af74
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x198], eax
jl 0x1000af8b
mov dword [ebp - 0x344], 1
jmp 0x1000af92
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x64], 0xfffe
mov dword [ebp - 0x34c], 0xa9e1a0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f4]
mov dword [ebp - 0x7c], eax
movzx eax, byte [0x10616220]
test eax, eax
je 0x1000afda
mov esi, 0x100737e0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000c5d3
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0xb0], 0xfffffff4
jmp 0x1000affd
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xfffffffc
jl 0x1000b0d9
or dword [ebp - 0x3ac], 0xffffffff
or dword [ebp - 0x3a8], 0xffffffff
or dword [ebp - 0x3a4], 0xffffffff
or dword [ebp - 0x3a0], 0xffffffff
lea ecx, [ebp - 0xc9]
call fcn.10016b75
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x448]
call fcn.10016b78
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x370]
call fcn.10016b24
mov dword [ebp - 4], 1
push 3
lea ecx, [ebp - 0x370]
call fcn.10016b66
and dword [eax], 0
jmp 0x1000b098
push 3
lea ecx, [ebp - 0x370]
call fcn.10016b66
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x280]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x370]
call fcn.10016b66
cmp dword [eax], 0xfffffffd
jg 0x1000b0c5
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x1000b0c3
push 0
push 0x9ec
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1000b074
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x370]
call fcn.10016b4a
jmp 0x1000aff0
mov dword [ebp - 0x3e4], 0x100737e0
mov dword [ebp - 0x74], 1
push 3
lea ecx, [ebp - 0x3d0]
call fcn.10016ac8
mov dword [ebp - 4], 2
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x354], 0xf0488f4f
mov dword [ebp - 0x90], 0
jmp 0x1000b12b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1000b14d
push dword [ebp - 0x90]
lea ecx, [ebp - 0x3d0]
call fcn.10016b66
mov dword [eax], 6
jmp 0x1000b11e
mov dword [ebp - 0x74], 0
jmp 0x1000b15d
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe9
jg 0x1000b26f
mov dword [ebp - 0x5c], 0x4c506d44
mov dword [ebp - 0x5c], 0xffffffe7
jmp 0x1000b17e
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1a
jne 0x1000b264
mov dword [ebp - 0x94], 1
cmp dword [ebp - 0x94], 0x106ec6e5
jge 0x1000b1aa
mov dword [ebp - 0xdc], 1
jmp 0x1000b1b1
and dword [ebp - 0xdc], 0
push 0
lea ecx, [ebp - 0x3d0]
call fcn.10016b66
mov ecx, dword [ebp - 0xdc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0xdc], eax
jne 0x1000b1e9
mov dword [ebp - 0x288], 1
jmp 0x1000b1f0
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x288]
jl 0x1000b20a
mov dword [ebp - 0x1a8], 1
jmp 0x1000b211
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jg 0x1000b22b
mov dword [ebp - 0x290], 1
jmp 0x1000b232
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x290]
jne 0x1000b24c
mov dword [ebp - 0x1b0], 1
jmp 0x1000b253
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x354], eax
jmp 0x1000b177
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x5c], eax
jmp 0x1000b156
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.10016b4a
mov dword [ebp - 0x3ec], 0x100737e4
mov dword [ebp - 0x398], 1
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x38c], 1
lea ecx, [ebp - 0xfd]
call fcn.10016b75
push eax
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x440]
call fcn.10016b78
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2d4]
call fcn.10016b24
mov dword [ebp - 4], 3
mov dword [ebp - 0x40], 0xc8ef34ea
mov dword [ebp - 0x318], 0x4e0b
mov dword [ebp - 0x34], 0
jmp 0x1000b30d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1000b323
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2e0], 0xa6847dfa
jmp 0x1000b306
mov dword [ebp - 0x34], 0
jmp 0x1000b333
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1000b349
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x334], 0xffffffff
jmp 0x1000b32c
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
mov dword [eax], 2
jmp 0x1000b382
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
cmp dword [eax], 0
jl 0x1000b734
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x44], 0x5ff57440
mov dword [ebp - 0x2c], 0
jmp 0x1000b3b6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1000b3d6
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1000b3d4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1000b3af
mov dword [ebp - 0x2c], 0
jmp 0x1000b3e6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1000b72f
push 4
lea ecx, [ebp - 0x2ec]
call fcn.10016ac8
mov byte [ebp - 4], 4
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x9c], 0
jmp 0x1000b42e
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1000b450
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x2ec]
call fcn.10016b66
mov dword [eax], 0xe58bfc4f
jmp 0x1000b421
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10016b66
mov dword [eax], 2
jmp 0x1000b489
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10016b66
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10016b66
cmp dword [eax], 0
jl 0x1000b71b
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1000b4c2
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x1000b716
mov dword [ebp - 0x384], 8
mov dword [ebp - 0x380], 8
mov dword [ebp - 0x37c], 8
mov dword [ebp - 0x378], 8
lea ecx, [ebp - 0x105]
call fcn.10016b75
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x450]
call fcn.10016b78
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2f8]
call fcn.10016b24
mov byte [ebp - 4], 5
mov dword [ebp - 0x2b8], 0x15b01d97
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016b66
and dword [eax], 0
jmp 0x1000b570
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016b66
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016b66
cmp dword [eax], 2
jg 0x1000b702
mov eax, 0xbc0d133f
test eax, eax
je 0x1000b59a
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x2e0], 0
cmp dword [ebp - 0x2c], 0
je 0x1000b5b1
xor eax, eax
inc eax
je 0x1000b5b1
mov dword [ebp - 0x1c0], 1
jmp 0x1000b5b8
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x35c], eax
jle 0x1000b5de
mov dword [ebp - 0x1c8], 1
jmp 0x1000b5e5
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
add eax, 0x1d0b6bd0
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000b611
mov dword [ebp - 0x2c0], 1
jmp 0x1000b618
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + eax*4 - 0x2e0]
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
imul eax, dword [eax], 0xf908
imul eax, dword [ebp - 0x84]
imul esi, eax
cmp esi, 0xfffffff8
jle 0x1000b65d
mov dword [ebp - 0x1d4], 1
jmp 0x1000b664
and dword [ebp - 0x1d4], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016b66
mov ecx, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
jle 0x1000b687
mov dword [ebp - 0x364], 1
jmp 0x1000b68e
and dword [ebp - 0x364], 0
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10016b66
or eax, 0xffffffff
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2e0], eax
mov dword [ebp - 0x44], 2
jmp 0x1000b6bb
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1000b6fd
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016b66
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2e0]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x3fc], eax
mov eax, 0xfc53
sub eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e0], eax
jmp 0x1000b6b4
jmp 0x1000b54c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2f8]
call fcn.10016b4a
jmp 0x1000b4b5
jmp 0x1000b465
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ec]
call fcn.10016b4a
jmp 0x1000b3df
jmp 0x1000b35e
xor eax, eax
jne 0x1000b747
cmp dword [ebp - 0x40], 0
jne 0x1000b747
and dword [ebp - 0x258], 0
jmp 0x1000b751
mov dword [ebp - 0x258], 1
cmp dword [ebp - 0x40], 0
jne 0x1000b766
cmp dword [ebp - 0x40], 0
jne 0x1000b766
and dword [ebp - 0x104], 0
jmp 0x1000b770
mov dword [ebp - 0x104], 1
push 2
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
mov ecx, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
add eax, 0xffff
cmp eax, 1
je 0x1000b79e
mov dword [ebp - 0x1dc], 1
jmp 0x1000b7a5
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x1dc]
jg 0x1000b7bf
mov dword [ebp - 0x328], 1
jmp 0x1000b7c6
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3d4], eax
push 1
lea ecx, [ebp - 0x2d4]
call fcn.10016b66
cmp dword [eax], 0
jne 0x1000b7f6
mov dword [ebp - 0x25c], 1
jmp 0x1000b7fd
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x25c], eax
jne 0x1000b817
mov dword [ebp - 0x1e4], 1
jmp 0x1000b81e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
add eax, 0xc9e4
cmp eax, 0x2921
jge 0x1000b84c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e0], 0
jne 0x1000b84c
mov dword [ebp - 0x30c], 1
jmp 0x1000b853
and dword [ebp - 0x30c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2e0]
mov dword [ebp - 0x414], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x334], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.10016b4a
mov byte [0x10616220], 1
mov dword [ebp - 0x14], 0xac64a684
mov dword [ebp - 0x31c], 0xd0b6
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x1000b8b4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x14], 0xfffffff7
jmp 0x1000b8c4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff9
jle 0x1000bab0
mov dword [ebp - 0x4c], 0x452a26f3
push 1
lea ecx, [ebp - 0x3c4]
call fcn.10016ac8
mov dword [ebp - 4], 6
mov dword [ebp - 0x3c], 0
jmp 0x1000b8f9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1000b915
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c4]
call fcn.10016b66
mov dword [eax], 0xa1434a9
jmp 0x1000b8f2
mov dword [ebp - 0x3c], 0
jmp 0x1000b925
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1000b93b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x348], 0xff57440e
jmp 0x1000b91e
cmp dword [ebp - 0x4c], 0x8858
je 0x1000b98c
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000b958
mov dword [ebp - 0x298], 1
jmp 0x1000b95f
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x298], eax
jl 0x1000b976
mov dword [ebp - 0x314], 1
jmp 0x1000b97d
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x4c], 0
je 0x1000b99e
cmp dword [ebp - 0x14], 0
je 0x1000b99e
mov dword [ebp - 0x10c], 1
jmp 0x1000b9a5
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x10c]
jne 0x1000b9b4
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x1000b9c8
mov dword [ebp - 0x264], 1
jmp 0x1000b9cf
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
add eax, 9
je 0x1000b9ec
cmp dword [ebp - 0x14], 0
je 0x1000b9ec
mov dword [ebp - 0x360], 1
jmp 0x1000b9f3
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x438], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10016b66
mov dword [eax], 6
cmp dword [ebp - 0x4c], 6
jne 0x1000ba21
mov dword [ebp - 0x1f4], 1
jmp 0x1000ba28
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1f4]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x31c]
jne 0x1000ba48
mov dword [ebp - 0x29c], 1
jmp 0x1000ba4f
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x29c], eax
jne 0x1000ba66
mov dword [ebp - 0x1fc], 1
jmp 0x1000ba6d
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xffffffff
jle 0x1000ba82
mov dword [ebp - 0x26c], 1
jmp 0x1000ba89
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x348], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.10016b4a
jmp 0x1000b8bd
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x100735d0
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0xc8], 2
mov dword [ebp - 0x224], 0xfffffff8
mov dword [ebp - 0x358], 0x2835357f
mov dword [ebp - 0x214], 1
push 2
lea ecx, [ebp - 0x340]
call fcn.10016ac8
mov dword [ebp - 4], 7
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x324], 0x5fb5
mov dword [ebp - 0xa4], 0
jmp 0x1000bb2d
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1000bb4f
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x340]
call fcn.10016b66
mov dword [eax], 0xec4f3f7e
jmp 0x1000bb20
push 1
lea ecx, [ebp - 0x340]
call fcn.10016b66
mov ecx, dword [ebp - 0x324]
cmp dword [eax], ecx
jne 0x1000bb72
mov dword [ebp - 0x204], 1
jmp 0x1000bb79
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x204]
je 0x1000bba0
mov dword [ebp - 0x2b4], 1
jmp 0x1000bba7
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0xc8]
sub eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x2b4]
jl 0x1000bbd0
cmp dword [ebp - 0x358], 0
je 0x1000bbd0
mov dword [ebp - 0x20c], 1
jmp 0x1000bbd7
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x20c], eax
jge 0x1000bbf1
mov dword [ebp - 0x274], 1
jmp 0x1000bbf8
and dword [ebp - 0x274], 0
push 1
lea ecx, [ebp - 0x340]
call fcn.10016b66
mov ecx, dword [ebp - 0x274]
cmp ecx, dword [eax]
jl 0x1000bc1b
mov dword [ebp - 0x2a4], 1
jmp 0x1000bc22
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x2a4], eax
jge 0x1000bc3c
mov dword [ebp - 0x21c], 1
jmp 0x1000bc43
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 1
jg 0x1000bc58
mov dword [ebp - 0x27c], 1
jmp 0x1000bc5f
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x27c]
cmp eax, 9
jne 0x1000bc7c
mov dword [ebp - 0x32c], 1
jmp 0x1000bc83
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x400], eax
mov esi, dword [ebp - 0x224]
push 1
lea ecx, [ebp - 0x340]
call fcn.10016b66
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.10016b4a
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x100735d0
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1c], 0xfffffffc
push 4
lea ecx, [ebp - 0x70]
call fcn.10016ac8
mov dword [ebp - 4], 8
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x22c], 0xfffffffe
mov dword [ebp - 0xe0], 0xfa6f63ee
mov dword [ebp - 0x1e8], 0x95cc9e52
mov dword [ebp - 0x17c], 0x8233
mov dword [ebp - 0x38], 0
jmp 0x1000bd1e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1000bd37
push dword [ebp - 0x38]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov dword [eax], 0xfffffff8
jmp 0x1000bd17
mov dword [ebp - 0x38], 0
jmp 0x1000bd47
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000bd5d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x144], 0
jmp 0x1000bd40
mov dword [ebp - 0x1c], 0xcff0ea75
mov dword [ebp - 0x1c], 0
jmp 0x1000bd74
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000c357
mov dword [ebp - 0x60], 0xf2a6add3
mov dword [ebp - 0xf0], 0x4518
mov dword [ebp - 0x88], 0xa91a76a4
mov dword [ebp - 0xac], 0
jmp 0x1000bdb2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1000bdce
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xd8], 0xb5f7a0d7
jmp 0x1000bda5
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1000bde5
push 0x2e8
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp dword [eax], 0
jle 0x1000be03
or eax, 0xffffffff
jne 0x1000be03
and dword [ebp - 0x350], 0
jmp 0x1000be0d
mov dword [ebp - 0x350], 1
push 0
lea ecx, [ebp - 0x70]
call fcn.10016b66
xor eax, eax
je 0x1000be3c
xor eax, eax
inc eax
je 0x1000be3c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp dword [eax], 0
je 0x1000be3c
mov dword [ebp - 0x2c4], 1
jmp 0x1000be43
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x284], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0xd8], ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov esi, dword [ebp - 0x284]
imul esi, dword [eax]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp dword [eax], esi
jg 0x1000bea9
mov dword [ebp - 0x234], 1
jmp 0x1000beb0
and dword [ebp - 0x234], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov ecx, dword [ebp - 0x234]
cmp ecx, dword [eax]
jne 0x1000bed1
mov dword [ebp - 0x2ac], 1
jmp 0x1000bed8
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 1
jne 0x1000beed
mov dword [ebp - 0x23c], 1
jmp 0x1000bef4
and dword [ebp - 0x23c], 0
mov esi, dword [ebp - 0x23c]
add esi, 6
push 2
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp esi, dword [eax]
jg 0x1000bf17
mov dword [ebp - 0x28c], 1
jmp 0x1000bf1e
and dword [ebp - 0x28c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov ecx, dword [ebp - 0x28c]
cmp ecx, dword [eax]
jle 0x1000bf3f
mov dword [ebp - 0x244], 1
jmp 0x1000bf46
and dword [ebp - 0x244], 0
push 3
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x434], eax
push 2
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp dword [eax], 1
jl 0x1000bf7d
mov dword [ebp - 0x294], 1
jmp 0x1000bf84
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0x711f64db
jle 0x1000bf9c
mov dword [ebp - 0x24c], 1
jmp 0x1000bfa3
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jne 0x1000bfd1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0
jne 0x1000bfd1
and dword [ebp - 0x1d0], 0
jmp 0x1000bfdb
mov dword [ebp - 0x1d0], 1
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x144]
mov dword [ebp - 0x254], eax
push 0
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov ecx, dword [ebp - 0x254]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x254]
mov eax, dword [eax]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x1d0]
jge 0x1000c02a
mov dword [ebp - 0x1d8], 1
jmp 0x1000c031
and dword [ebp - 0x1d8], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov eax, dword [eax]
imul eax, dword [ebp - 0x1d8]
test eax, eax
jne 0x1000c05b
cmp dword [ebp - 0x1e8], 0
jne 0x1000c05b
and dword [ebp - 0x1e0], 0
jmp 0x1000c065
mov dword [ebp - 0x1e0], 1
push 3
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov esi, dword [ebp - 0x1e0]
imul esi, dword [eax]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp esi, dword [eax]
jne 0x1000c093
mov dword [ebp - 0x304], 1
jmp 0x1000c09a
and dword [ebp - 0x304], 0
push 0
lea ecx, [ebp - 0x70]
call fcn.10016b66
cmp dword [ebp - 0x1e8], 0x8ef5
je 0x1000c0bc
mov dword [ebp - 0x110], 1
jmp 0x1000c0c3
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xd0519924
jne 0x1000c0e7
mov dword [ebp - 0x114], 1
jmp 0x1000c0ee
and dword [ebp - 0x114], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [eax]
jg 0x1000c22f
mov dword [ebp - 0x11c], 0xfffffffc
mov dword [ebp - 0xb4], 0
jmp 0x1000c12a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000c146
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x424], 1
jmp 0x1000c11d
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x3e0], eax
push 1
lea ecx, [ebp - 0x70]
call fcn.10016b66
mov ecx, dword [ebp - 0x60]
cmp dword [eax], ecx
jg 0x1000c16f
mov dword [ebp - 0xd0], 1
jmp 0x1000c176
and dword [ebp - 0xd0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x424], ecx
cmp dword [ebp - 0xd0], 0
je 0x1000c1b3
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x410], eax
mov eax, 0xac77
test eax, eax
je 0x1000c1b3
mov dword [ebp - 0x124], 1
jmp 0x1000c1ba
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0
je 0x1000c1df
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x424], 0
je 0x1000c1df
mov dword [ebp - 0x12c], 1
jmp 0x1000c1e6
and dword [ebp - 0x12c], 0
cmp dword [ebp - 0x12c], 0x40421a16
jg 0x1000c1fe
mov dword [ebp - 0x134], 1
jmp 0x1000c205
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 7
jb 0x1000c21a
mov dword [ebp - 0x13c], 1
jmp 0x1000c221
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x60], eax
jmp 0x1000c352
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x308], 3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 0xfffffffe
cmp dword [ebp - 0xe0], 0
je 0x1000c287
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x144], 0x627f
mov dword [ebp - 0x60], 0x627f
cmp dword [ebp - 0x60], 0
je 0x1000c287
mov dword [ebp - 0x154], 1
jmp 0x1000c28e
and dword [ebp - 0x154], 0
cmp dword [ebp - 0x15c], 0x9045
jg 0x1000c2af
mov eax, 0xde1f29a3
test eax, eax
je 0x1000c2af
mov dword [ebp - 0x14c], 1
jmp 0x1000c2b6
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x154]
lea eax, [ecx + eax + 0x68fb0c4f]
imul eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x15c]
jne 0x1000c2e4
mov dword [ebp - 0x164], 1
jmp 0x1000c2eb
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0xaa0
jle 0x1000c303
mov dword [ebp - 0x16c], 1
jmp 0x1000c30a
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x16c], eax
jne 0x1000c32d
mov eax, 0xeec8559c
test eax, eax
je 0x1000c32d
mov dword [ebp - 0x174], 1
jmp 0x1000c334
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x174]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x308], eax
jmp 0x1000bd6d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10016b4a
mov eax, dword [ebp - 0x1c4]
mov dword [0x100737e0], eax
mov dword [ebp - 0x18], 0xb25b3b9d
mov dword [ebp - 0x184], 0xd018d303
mov dword [ebp - 0x1a4], 0x2d621ec2
mov dword [ebp - 0x300], 0xa9cea445
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x18], eax
jne 0x1000c3b3
mov dword [ebp - 0x18c], 1
jmp 0x1000c3ba
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18c]
je 0x1000c3d1
mov dword [ebp - 0x194], 1
jmp 0x1000c3d8
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x18]
cmp eax, 0x8039
je 0x1000c3f4
mov dword [ebp - 0x19c], 1
jmp 0x1000c3fb
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
neg eax
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x1000c423
mov dword [ebp - 0x1ac], 1
jmp 0x1000c42a
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1ac]
mov ecx, 0x6e58d020
sub ecx, eax
cmp ecx, dword [ebp - 0x18]
je 0x1000c44b
mov dword [ebp - 0x310], 1
jmp 0x1000c452
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x1000c476
mov dword [ebp - 0x1b4], 1
jmp 0x1000c47d
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1b4], eax
jl 0x1000c494
mov dword [ebp - 0x1bc], 1
jmp 0x1000c49b
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x300], eax
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x1000c4bb
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0xf8]
mov dword [0x100737e4], eax
mov dword [ebp - 0x8c], 0x9b55bb2c
push 2
lea ecx, [ebp - 0x3b8]
call fcn.10016ac8
mov dword [ebp - 4], 9
mov dword [ebp - 0xbc], 0
jmp 0x1000c4fd
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1000c51f
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x3b8]
call fcn.10016b66
mov dword [eax], 0x6893
jmp 0x1000c4f0
mov dword [ebp - 0x8c], 0
jmp 0x1000c538
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffe7
jg 0x1000c576
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x80], 0
jmp 0x1000c558
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1000c574
push dword [ebp - 0x80]
lea ecx, [ebp - 0x3b8]
call fcn.10016b66
mov dword [eax], 0x417
jmp 0x1000c551
jmp 0x1000c52b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b8]
call fcn.10016b4a
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0xf8]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [eax + ecx]
call fcn.1000a706
mov dword [ebp - 0x320], eax
push dword [ebp - 0xf8]
mov edx, 0x1007380c
mov ecx, dword [ebp - 0x320]
call fcn.1000a712
pop ecx
mov esi, 0x100737e0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret