Function at 0x1001b1ca
Capabilities:
Check os version
Encrypt data using speck
Extract resource via kernel32 functions
Get disk information
Query environment variable

Disassembly:
mov eax, 0x10061ee8
call fcn.10061410
sub esp, 0x8c8
push ebx
mov dword [ebp - 0x28], 0x84b
xor ebx, ebx
mov dword [ebp - 0x20], 0xb17b
push esi
mov dword [ebp - 0x54], 0x7874
cmp dword [ebp - 0x54], 0x78e3
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x6c], dl
mov dword [ebp - 0x70], ecx
jle 0x1001b24f
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x7d4]
cdq
push edx
push eax
call fcn.1000d0ee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b228
mov eax, dword [eax]
push eax
call fcn.1004c14f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7d4]
call fcn.10012ee2
inc edi
cmp edi, 0x3499
jl 0x1001b20a
inc esi
cmp esi, 0x5dad
jl 0x1001b208
xor edi, edi
mov dword [ebp - 0x24], 0xcc511ec1
inc edi
cmp dword [ebp - 0x54], 0x76cb
jge 0x1001b26d
push 0x100082f8
call fcn.1004c14f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x14], 0xfffffff7
push 3
call fcn.10012962
push 2
pop esi
push 3
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 4], esi
call fcn.10012962
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x50], 0xca2a
push 4
call fcn.10012962
push 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x1001b2d6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xeaf6082f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001b2c3
mov dword [ebp - 0x2c], ebx
jmp 0x1001b2f3
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2e4]
mov dword [eax + ecx*4], 0x53ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001b2e0
mov dword [ebp - 0x2c], ebx
jmp 0x1001b310
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], 0xd489
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001b2fd
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xffff
setne cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], eax
jg 0x1001b334
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jg 0x1001b33f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
test eax, eax
setg cl
cmp ecx, dword [ebp - 0x28]
jl 0x1001b405
cmp dword [ebp - 0x20], ebx
jne 0x1001b405
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x438]
push edx
call fcn.10012962
mov dword [ebp - 0x14], ebx
jmp 0x1001b382
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x438]
mov dword [eax + ecx*4], 0x7b30477a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b36f
cmp dword [ebp - 0x28], ebx
jne 0x1001b3a2
mov edx, dword [ebp - 0x2e4]
mov esi, ebx
mov ecx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edx + 4], eax
test ecx, ecx
je 0x1001b3a4
mov esi, edi
mov eax, dword [ebp - 0x114]
xor ecx, ecx
cmp dword [eax], 0x8d7c
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x438]
cmp dword [eax + 8], edi
sete cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
add edx, 0x65fe96f7
cmp esi, edx
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x114]
setne cl
add ecx, 3
mov dword [eax], ecx
lea ecx, [ebp - 0x438]
call fcn.100129e4
xor ebx, ebx
jmp 0x1001b43c
mov dword [ebp - 0x14], ebx
jmp 0x1001b417
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x63c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b40a
mov dword [ebp - 0x24], 0xfffffff6
jmp 0x1001b436
mov ecx, dword [ebp - 0x638]
mov eax, dword [ebp - 0x114]
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
jg 0x1001b425
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x14], edi
mov esi, 0xe0bbe0e2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
cmp esi, edx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x114]
imul edx, dword [eax]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jle 0x1001b48c
mov eax, dword [ebp - 0x114]
mov edx, ebx
cmp dword [eax], ebx
je 0x1001b48e
mov edx, edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2e4]
imul ecx, dword [eax + 4]
mov eax, dword [ebp - 0x450]
imul ecx, edx
xor edx, edx
neg ecx
cmp ecx, 0x8eaf535
lea ecx, [ebp - 0x450]
setne dl
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x114]
mov dword [eax], edx
call fcn.100129e4
lea ecx, [ebp - 0x2e4]
call fcn.100129e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.100129e4
mov dword [ebp - 0x28], 0x84b
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x20], 0xb17b
mov dword [ebp - 0x24], 0xcc511ec1
mov dword [ebp - 0x14], 0xfffffff7
push 3
call fcn.10012962
push 3
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 4], 5
call fcn.10012962
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x50], 0xca2a
push 4
call fcn.10012962
push 3
mov byte [ebp - 4], 7
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x1001b55c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xeaf6082f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001b549
mov dword [ebp - 0x2c], ebx
jmp 0x1001b579
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2fc]
mov dword [eax + ecx*4], 0x53ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001b566
mov dword [ebp - 0x2c], ebx
jmp 0x1001b596
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4a4]
mov dword [eax + ecx*4], 0xd489
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001b583
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xffff
setne cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], eax
jg 0x1001b5ba
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jg 0x1001b5c5
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
test eax, eax
setg cl
cmp ecx, dword [ebp - 0x28]
jl 0x1001b690
cmp dword [ebp - 0x20], ebx
jne 0x1001b690
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x468]
push edx
call fcn.10012962
mov dword [ebp - 0x14], ebx
jmp 0x1001b608
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0x7b30477a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b5f5
cmp dword [ebp - 0x28], ebx
jne 0x1001b628
mov edx, dword [ebp - 0x2fc]
mov esi, ebx
mov ecx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edx + 4], eax
test ecx, ecx
je 0x1001b62a
mov esi, edi
mov eax, dword [ebp - 0x108]
xor ecx, ecx
cmp dword [eax], 0x8d7c
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x468]
cmp dword [eax + 8], edi
sete cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
add edx, 0x65fe96f7
cmp esi, edx
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x108]
setne cl
add ecx, 3
mov dword [eax], ecx
lea ecx, [ebp - 0x468]
call fcn.100129e4
xor ebx, ebx
mov esi, 0xe0bbe0e2
jmp 0x1001b6c8
mov dword [ebp - 0x14], ebx
jmp 0x1001b6a2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x600], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b695
mov dword [ebp - 0x24], 0xfffffff6
jmp 0x1001b6c2
mov ecx, dword [ebp - 0x5fc]
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
jg 0x1001b6b1
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
cmp esi, edx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x108]
imul edx, dword [eax]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x3c]
jle 0x1001b713
mov eax, dword [ebp - 0x108]
mov edx, ebx
cmp dword [eax], ebx
je 0x1001b715
mov edx, edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2fc]
imul ecx, edx
xor edx, edx
imul ecx, dword [eax + 4]
mov eax, dword [ebp - 0x4a4]
neg ecx
cmp ecx, 0x8eaf535
lea ecx, [ebp - 0x4a4]
setne dl
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x108]
mov dword [eax], edx
call fcn.100129e4
lea ecx, [ebp - 0x2fc]
call fcn.100129e4
or esi, 0xffffffff
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], esi
call fcn.100129e4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001b783
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x234], 0xc93
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b772
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001b9cd
movdqa xmm0, xmmword [0x1000bc80]
lea ecx, [ebp - 0x694]
push ecx
lea eax, [ebp - 0x684]
push eax
push ecx
lea ecx, [ebp - 0x384]
movdqu xmmword [ebp - 0x694], xmm0
call fcn.100129be
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x384]
mov dword [eax], ebx
cmp dword [eax], ebx
jg 0x1001b99f
mov dword [ebp - 0x20], 0xda622a14
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1001b982
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
jl 0x1001b97a
mov dword [ebp - 0x14], 0x2bc40ed3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b812
push 0x1a37
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x1001b972
push 2
lea ecx, [ebp - 0x360]
call fcn.10012962
mov byte [ebp - 4], 9
mov dword [ebp - 0x2c], ebx
jmp 0x1001b847
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x360]
mov dword [eax + ecx*4], 0xd2c87a75
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1001b834
mov dword [ebp - 0x2c], ebx
jmp 0x1001b863
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x278], 0xcd49fcfb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001b852
mov ecx, dword [ebp - 0x360]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
mov dword [ebp + eax*4 - 0x234], edi
cmp dword [ecx + 4], edi
jl 0x1001b872
mov dword [ebp - 0x30], 0x246e
cmp dword [ebp - 0x30], 0x2593
jle 0x1001b90a
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0x21e8
mov eax, edi
mov dword [ebp - 0x34], 0x2cf0
mov dword [ebp - 0x54], eax
cdq
lea ecx, [ebp - 0x8ac]
push edx
push eax
call fcn.1000d0ee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b8c6
mov eax, dword [eax]
push eax
call fcn.1004c14f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8ac]
call fcn.10012ee2
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x3c]
add eax, ecx
dec dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
jne 0x1001b8ae
add ecx, esi
dec dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
jne 0x1001b8a2
inc esi
cmp esi, 0x7f6d
jl 0x1001b898
inc edi
cmp edi, 0x27bb
jl 0x1001b896
xor edi, edi
inc edi
mov dword [ebp - 0x270], edi
cmp dword [ebp - 0x270], ebx
jl 0x1001b944
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b93c
push 0x4c6
push 0x20c
push 0x2c6
push 0x1ca9
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
dec dword [ebp - 0x270]
jns 0x1001b918
cmp dword [ebp - 0x30], 0x22aa
jge 0x1001b958
push 0x10008368
call fcn.1004c14f
pop ecx
lea ecx, [ebp - 0x360]
mov dword [ebp - 4], 8
call fcn.100129e4
inc dword [ebp - 0x14]
jmp 0x1001b815
dec dword [ebp - 0x40]
jmp 0x1001b7ee
dec dword [ebp - 0x20]
jmp 0x1001b7df
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b992
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [ebp - 0x384]
inc dword [eax]
jmp 0x1001b7cd
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b9b4
push 0x9d1
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
or esi, 0xffffffff
lea ecx, [ebp - 0x384]
mov dword [ebp - 4], esi
call fcn.100129e4
dec dword [ebp - 0x28]
jmp 0x1001b78b
mov dword [ebp - 0x20], 0x84b
mov dword [ebp - 0xc8], 0x11c1
mov dword [ebp - 0xc4], 0x11c1
mov dword [ebp - 0xc0], 0x11c1
mov dword [ebp - 0xbc], 0x11c1
mov dword [ebp - 0x1c], 0x23498e6
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x2c], 0x8f4727ca
mov dword [ebp - 0x28], 0x7be02189
mov dword [ebp - 0x30], 0xdd2eb2fc
mov dword [ebp - 0x14], ebx
jmp 0x1001ba35
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 0x84c81e2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ba24
mov edx, edi
cmp dword [ebp - 0xc8], ebx
jne 0x1001ba46
mov edx, ebx
mov dword [ebp - 0x1c], edi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc8]
cmp edx, eax
push 3
setne cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc8]
imul ecx, eax
cmp dword [ebp - 0x28], 0xac7a8cf1
mov edx, dword [ebp - 0x2c]
sbb eax, eax
inc eax
imul edx, ecx
sub edx, eax
mov eax, dword [ebp - 0xc0]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xc8]
mov edx, 0x584f60a7
setl cl
sub edx, ecx
sub edx, eax
mov dword [ebp - 0x30], edx
je 0x1001bbf4
mov dword [ebp - 0x34], 0x9ced
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x24], ebx
pop eax
jmp 0x1001bbe6
mov dword [ebp - 0x40], 0x64f6b903
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x14], 0x6a1241a5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jl 0x1001bbe3
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x50], 0xb48103b8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jl 0x1001bbda
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, edi
setl cl
imul ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
add ecx, 0xffff563b
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1001bb5c
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x1001bb5e
mov eax, edi
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xc8]
cmp eax, 0xfffffff8
setle cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xc8]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
sub eax, 0x9709
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
jg 0x1001bba4
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001bba6
mov ecx, edi
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x1c], 0xad24
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setl al
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x30]
jns 0x1001bb0e
push 3
pop eax
dec dword [ebp - 0x2c]
jns 0x1001baf1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1001bac9
jmp 0x1001bcc8
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1001bc60
mov dword [ebp - 0x28], ebx
jmp 0x1001bc16
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc8], 0x6135
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001bc05
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
jl 0x1001bc5d
mov dword [ebp - 0x2c], ebx
jmp 0x1001bc53
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bc50
push ebx
push 0x217
push 0x962
push 0x16d6
push 0x1f49
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 3
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1001bc29
dec dword [ebp - 0x30]
jns 0x1001bc24
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1001bc00
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x28], ebx
je 0x1001bc74
mov ecx, edi
cmp dword [ebp - 0x24], ebx
jne 0x1001bc76
mov ecx, ebx
mov eax, dword [ebp - 0x23c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x54], eax
jne 0x1001bca2
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001bca4
mov eax, edi
xor ecx, ecx
cmp eax, 0xc5cb
setge cl
xor eax, eax
cmp ecx, 0xd6201886
setne al
imul eax, eax, 0x8347
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0xb17b
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], edi
push 2
mov dword [ebp - 0x4c], 0x1ab4456e
pop esi
mov dword [ebp - 0x34], 0x3837aced
mov dword [ebp - 0x54], 0x78470ed9
mov dword [ebp - 0x4c], 0xfffffffb
push esi
call fcn.10012962
push 3
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x1001bd20
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x290], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001bd0f
mov dword [ebp - 0x2c], ebx
jmp 0x1001bd3b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x314], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001bd2a
mov dword [ebp - 0x2c], ebx
jmp 0x1001bd58
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x654]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001bd45
mov dword [ebp - 0x2c], ebx
jmp 0x1001bd6f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x73c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001bd62
mov eax, dword [ebp - 0x28c]
xor edx, edx
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x310]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x654]
setg dl
mov dword [ebp - 0x310], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x14], eax
call fcn.100129e4
mov dword [ebp - 0x1c], 0xcc511ec1
mov dword [ebp - 0x40], ebx
push 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
pop ecx
jmp 0x1001bdf0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1b4], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1001bde3
mov dword [ebp - 0x2c], ebx
jmp 0x1001be04
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x68], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001bdfa
cmp dword [ebp - 0x40], ebx
je 0x1001beab
mov dword [ebp - 0x3c], 0xcbeb969
mov dword [ebp - 0x14], 0x303f0244
mov dword [ebp - 0x1ac], esi
mov dword [ebp - 0x68], edi
mov eax, dword [ebp - 0x14]
inc eax
imul eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x1ac], edi
jge 0x1001be44
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x1ac]
neg edx
push 9
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x40]
pop edx
setge cl
sub edx, ecx
mov ecx, dword [ebp - 0x14]
sub edx, eax
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x1ac]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setg dl
cmp edx, esi
jne 0x1001be9e
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001bea0
mov eax, edi
push 2
mov dword [ebp - 0x14], eax
pop esi
jmp 0x1001c056
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0x175e0423
mov dword [ebp - 0x54], 0x52682fba
push 3
call fcn.10012962
mov dword [ebp - 0x54], 0x570b93d6
mov dword [ebp - 0x2c], ebx
jmp 0x1001beed
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9c], 0x2a55
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001bedc
mov dword [ebp - 0x2c], ebx
jmp 0x1001bf0a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x444]
mov dword [eax + ecx*4], 0x2afe5885
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001bef7
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp eax, 0x35ca
mov eax, dword [ebp - 0x98]
setne cl
sub ecx, eax
jne 0x1001bf3a
cmp dword [ebp - 0x9c], ebx
jne 0x1001bf3a
cmp dword [ebp - 0x1b4], ebx
je 0x1001bf3c
mov ebx, edi
mov dword [ebp - 0x1b0], ebx
xor edx, edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x14], 0x3d57
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
neg ecx
cmp eax, 0x285b
mov eax, dword [ebp - 0x68]
setg dl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x98]
setge cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x98]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge bl
xor ecx, ecx
cmp eax, ebx
setg cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
add ecx, 0x4653
cmp ecx, eax
setg dl
sub edx, 0x3649e8ee
jne 0x1001bfc6
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x98]
sub eax, 0x3638
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1ac], ebx
jne 0x1001bfed
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001bfef
mov ecx, edi
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x7f3d
setge cl
xor edx, edx
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x444]
lea ecx, [ebp - 0x444]
setle dl
imul edx, dword [eax]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
inc eax
imul eax, dword [ebp - 0x24]
cmp edi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
call fcn.100129e4
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0x2667
mov dword [ebp - 0x54], 0x32b96ce0
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x40], ebx
jmp 0x1001c088
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x26c], 0xcd79
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x1001c077
cmp dword [ebp - 0x14], 0xfffffffd
je 0x1001c0f3
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x1001c155
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c0cc
push 0x1352
push 0x1018
push 0x934
push 0xb8
push 0x1f2
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c0ec
push ebx
push 0x18f6
push ebx
push 0x2115
push 0x118e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
dec dword [ebp - 0x14]
jns 0x1001c0a4
jmp 0x1001c155
mov dword [ebp - 0x40], 0x5bb00289
mov dword [ebp - 0x54], 0x36d15de2
mov dword [ebp - 0x54], 0x2de4bf74
cmp dword [ebp - 0x264], 0xfffffff6
jb 0x1001c114
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x40]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x260]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
push 3
lea ecx, [ebp - 0x120]
call fcn.10012962
push 3
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], 0xc
call fcn.10012962
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x2c], 0x925b0e44
mov dword [ebp - 0x40], 0xcd2466e9
mov dword [ebp - 0x24], 0x14c5530c
mov dword [ebp - 0x38], 0xae7a
mov dword [ebp - 0x14], ebx
jmp 0x1001c1b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x140], 0x5faafe30
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001c1a2
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x40]
cmp ecx, 0xe623b470
jne 0x1001c1f5
mov edx, edi
cmp dword [ebp - 0x2c], ebx
jne 0x1001c1f7
mov edx, ebx
xor ecx, ecx
mov dword [ebp - 0x140], 0x9ed9ba07
mov eax, dword [ebp - 0x2c]
cmp eax, 0x9ed9ba07
setne cl
xor eax, eax
cmp ecx, edx
mov edx, dword [ebp - 0x2c]
setne al
sub eax, 0xfffb
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 0x14
jg 0x1001c42d
mov dword [ebp - 0x30], 0x7d75
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x40], ebx
jne 0x1001c42d
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 9
jge 0x1001c425
mov dword [ebp - 0x54], 0x4969
cmp dword [ebp - 0x54], 0x4c54
jle 0x1001c2bf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
mov ecx, 0x10609d98
cdq
push edx
push eax
call fcn.1001273a
inc esi
cmp esi, 0x531b
jl 0x1001c27a
inc edi
cmp edi, 0x6158
jl 0x1001c278
push ebx
push 0x186c
push 0xead
push ebx
push 0x56b
push 0xfcd
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
push 2
inc edi
pop esi
push 4
lea ecx, [ebp - 0x5c0]
call fcn.10012962
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x54], 0x47d7
jge 0x1001c30c
mov edx, 0x100083d0
mov ecx, 0x10609d98
call fcn.1001505e
jmp 0x1001c30c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x14], ebx
jmp 0x1001c32b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5c0]
mov dword [eax + ecx*4], 0x9c82
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001c318
mov dword [ebp - 0x2c], ebx
jmp 0x1001c404
mov dword [ebp - 0x54], 0xfffffffb
mov dword [ebp - 0x3c], 0x3631af66
mov dword [ebp - 0x14], ebx
jmp 0x1001c35d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x194], 0x9da97273
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c34c
mov dword [ebp - 0x194], 0x1a
jmp 0x1001c3f4
mov dword [ebp - 0x28], 0xbbfad0d7
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1001c3ee
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x140], ecx
test ecx, ecx
jne 0x1001c3d6
mov eax, dword [ebp - 0x30]
neg eax
jne 0x1001c3a3
mov edx, ebx
cmp dword [ebp - 0x38], ebx
je 0x1001c3a5
mov edx, edi
mov eax, dword [ebp - 0x140]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
mov dword [ebp + eax*4 - 0x140], ecx
lea eax, [ecx - 0x6a3f]
cmp eax, dword [ebp - 0x54]
jl 0x1001c3ca
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub eax, 0xaaf0
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x28]
jns 0x1001c381
dec dword [ebp - 0x194]
cmp dword [ebp - 0x194], 0xffffffed
jg 0x1001c372
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1c
jge 0x1001c339
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 0xd
call fcn.100129e4
inc dword [ebp - 0x24]
jmp 0x1001c254
inc dword [ebp - 0x40]
jmp 0x1001c234
movdqa xmm0, xmmword [0x1000bc40]
lea ecx, [ebp - 0x6f4]
push ecx
lea eax, [ebp - 0x6e4]
mov dword [ebp - 0x44], 0xca2a
push eax
push ecx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 0x28], 5
movdqu xmmword [ebp - 0x6f4], xmm0
call fcn.100129be
mov dword [ebp - 0x14], ebx
jmp 0x1001c47e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x188], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c46d
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x1001c4f1
mov esi, dword [ebp - 0x5d8]
mov dword [ebp - 0x28], 0xc4185a1f
cmp dword [ebp - 0x28], ebx
jne 0x1001c4b9
mov eax, dword [ebp - 0x24]
mov edx, ebx
mov ecx, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
jg 0x1001c4bb
mov edx, edi
mov eax, dword [ebp - 0x184]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x24]
setne cl
mov dword [esi + 8], ecx
mov ecx, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x188], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1001c492
push 2
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1001c51a
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x188], ebx
jne 0x1001c51a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c515
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec dword [ebp - 0x28]
jns 0x1001c4f9
lea ecx, [ebp - 0x5d8]
call fcn.100129e4
push 4
lea ecx, [ebp - 0x498]
call fcn.10012962
push esi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x11
call fcn.10012962
mov dword [ebp - 0x2c], 0xb02971c
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001c560
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x230]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001c551
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
jl 0x1001c580
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x230]
cmp dword [eax + ecx*4], ebx
jne 0x1001c580
dec dword [ebp - 0x2c]
jns 0x1001c56d
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edi
jg 0x1001c664
mov esi, dword [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x54], ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 0x24], edi
setne al
mov dword [ebp - 0x38], 0xebdab6ac
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
neg eax
neg eax
je 0x1001c5b7
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
cmp eax, edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esi + 4]
je 0x1001c5ec
cmp dword [ebp - 0x24], ebx
je 0x1001c5ee
mov ebx, edi
xor ecx, ecx
mov dword [ebp - 0x54], 0x38591b68
mov eax, dword [ebp - 0x24]
cmp ebx, 0xffffffff
push 0
sete cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x230]
setle bl
imul edx, ebx
mov dword [eax + ecx*4], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
neg ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1001c592
push 2
pop esi
lea ecx, [ebp - 0x230]
call fcn.100129e4
mov dword [ebp - 0x4c], 0xffffffff
lea ecx, [ebp - 0x39c]
push 3
call fcn.10012962
mov dword [ebp - 0x28], 0x3187110e
mov dword [ebp - 0x14], ebx
jmp 0x1001c69e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x39c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c68f
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], ebx
jmp 0x1001c6c1
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x39c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1001c6ac
lea ecx, [ebp - 0x39c]
call fcn.100129e4
mov dword [ebp - 0x2c], ebx
jmp 0x1001c6e9
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xeaf6082f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001c6d6
mov dword [ebp - 0x28], 0xaeef20fe
lea ecx, [ebp - 0x480]
push 4
call fcn.10012962
mov dword [ebp - 0x2c], ebx
jmp 0x1001c715
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa4], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001c708
mov dword [ebp - 0x2c], ebx
jmp 0x1001c72f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x480]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001c71f
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001c788
mov edx, dword [ebp - 0x480]
or dword [edx + 0xc], 0xffffffff
mov dword [ebp - 0x14], 0xf147909b
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001c76f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4], ecx
dec dword [ebp - 0x14]
jns 0x1001c756
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4], ecx
dec dword [ebp - 0x28]
jns 0x1001c743
lea ecx, [ebp - 0x480]
call fcn.100129e4
mov dword [ebp - 0x2c], ebx
jmp 0x1001c7ab
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2a8]
mov dword [eax + ecx*4], 0x53ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001c798
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], 0xc12a7b09
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001c7e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6a4], 0x278c007c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001c7d1
cmp dword [ebp - 0x40], ebx
jne 0x1001c7fa