Function at 0x100162bf
Capabilities:
Enumerate gui resources
Get graphical window text
Parse pe header
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bca6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x10b8
call fcn.10067d30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x944], 0xc6a53d06
mov dword [ebp - 0xd84], 0x16df251d
mov dword [ebp - 0xf20], 0xb1891f78
mov dword [ebp - 0x8f4], 1
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10020368
and dword [ebp - 4], 0
mov dword [ebp - 0x398], 0x9d0
mov dword [ebp - 0x31c], 0
jmp 0x10016344
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 3
jge 0x10016363
push dword [ebp - 0x31c]
lea ecx, [ebp - 0x9f0]
call fcn.100203e6
or dword [eax], 0xffffffff
jmp 0x10016337
mov eax, dword [ebp - 0x398]
dec eax
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x94c], 9
mov dword [ebp - 0xa64], 0x10007da8
cmp dword [ebp - 0x94c], 0x3c1
jle 0x1001646b
and dword [ebp - 0x218], 0
jmp 0x100163aa
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x79b9
jge 0x1001646b
and dword [ebp - 0x2b0], 0
jmp 0x100163d0
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x1abd
jge 0x10016466
and dword [ebp - 0x2e8], 0
jmp 0x100163f6
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x3493
jge 0x10016461
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2e8]
shl eax, cl
or eax, dword [ebp - 0x218]
cdq
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa84], edx
push dword [ebp - 0xa84]
push dword [ebp - 0xa88]
lea ecx, [ebp - 0x1064]
call fcn.1000a7be
pop ecx
pop ecx
mov dword [ebp - 0xa44], eax
mov ecx, dword [ebp - 0xa44]
call fcn.10020108
push eax
call fcn.100545af
pop ecx
lea ecx, [ebp - 0x1064]
call fcn.100200fe
jmp 0x100163e9
jmp 0x100163c3
jmp 0x1001639d
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0x944], 0
je 0x10016536
xor eax, eax
inc eax
je 0x100164a7
push 2
lea ecx, [ebp - 0x9f0]
call fcn.100203e6
cmp dword [eax], 0
je 0x100164a7
mov dword [ebp - 0x878], 1
jmp 0x100164ae
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 1
jb 0x100164c3
mov dword [ebp - 0xa5c], 1
jmp 0x100164ca
and dword [ebp - 0xa5c], 0
push 2
lea ecx, [ebp - 0x9f0]
call fcn.100203e6
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100203e6
mov eax, dword [eax]
add eax, 0x4198
jne 0x10016508
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100203e6
cmp dword [eax], 0
jne 0x10016508
and dword [ebp - 0x8ec], 0
jmp 0x10016512
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 0x50fa
jle 0x10016536
mov dword [ebp - 0x8fc], 1
jmp 0x1001653d
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x944], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x94c], 0xfffffc98
jge 0x10016565
push dword [ebp - 0xa64]
call fcn.100545af
pop ecx
jmp 0x10016581
and dword [ebp - 4], 0
jmp 0x1001658b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.100203ca
cmp dword [ebp + 0x10], 0
jbe 0x100165bc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100165bc
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100116bf
pop ecx
pop ecx
jmp 0x1001de27
mov dword [ebp - 0xb0], 0x8ef6b8f3
push 1
lea ecx, [ebp - 0xb50]
call fcn.10020368
mov dword [ebp - 4], 3
mov dword [ebp - 0x60], 0xfffffffa
mov dword [ebp - 0x170], 0xc11e043e
mov dword [ebp - 0x80], 0
jmp 0x100165fb
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10016617
push dword [ebp - 0x80]
lea ecx, [ebp - 0xb50]
call fcn.100203e6
mov dword [eax], 0xe164caf1
jmp 0x100165f4
mov dword [ebp - 0x80], 0
jmp 0x10016627
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001663d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xe84], 0
jmp 0x10016620
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x60]
add eax, 0xfffffffb
mov dword [ebp - 0x954], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x954]
mov dword [ebp + eax - 0xe84], ecx
imul eax, dword [ebp - 0x954], 0x31a
cmp eax, dword [ebp - 0x60]
jge 0x10016683
mov dword [ebp - 0x95c], 1
jmp 0x1001668a
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x95c], eax
jl 0x100166a1
mov dword [ebp - 0xa6c], 1
jmp 0x100166a8
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x170]
cmp eax, 7
jbe 0x100166cc
mov dword [ebp - 0x964], 1
jmp 0x100166d3
and dword [ebp - 0x964], 0
cmp dword [ebp - 0x964], 0x68451f1e
jl 0x100166eb
mov dword [ebp - 0x974], 1
jmp 0x100166f2
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x96c], eax
push 0
lea ecx, [ebp - 0xb50]
call fcn.100203e6
mov ecx, dword [ebp - 0x96c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x96c]
cmp eax, dword [ebp - 0x974]
jl 0x1001672d
mov dword [ebp - 0x998], 1
jmp 0x10016734
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0xffff
ja 0x1001674c
mov dword [ebp - 0x99c], 1
jmp 0x10016753
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x99c], eax
jne 0x1001676a
mov dword [ebp - 0x958], 1
jmp 0x10016771
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
sub eax, 0xfff6
imul eax, eax, 0xca4f
test eax, eax
je 0x1001683a
mov dword [ebp - 0x170], 0
jmp 0x100167a3
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xf
jg 0x10016838
mov dword [ebp - 0x60], 0xffffffe8
jmp 0x100167c0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x12
je 0x10016833
mov dword [ebp - 0xb0], 0
jmp 0x100167df
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jg 0x10016812
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb50]
call fcn.100203e6
mov esi, eax
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb50]
call fcn.100203e6
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100167d2
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x10016831
push 0
push 0x2384
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x100167b9
jmp 0x10016796
jmp 0x10016862
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x10016862
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10016893
push 0
push 0
push 0x5b3
push 0
push 0x41a
push 0
push 0
push 0x234e
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb50]
call fcn.100203ca
cmp dword [ebp + 0x10], 0
jne 0x1001a974
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a868
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0xf28], 0x31d83293
mov dword [ebp - 0x320], 0
jmp 0x100168ea
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x10016906
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0xa74], 0xffffffff
jmp 0x100168dd
mov dword [ebp - 0x1b8], 0xffffffed
jmp 0x1001691f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffef
jl 0x1001693d
mov eax, dword [ebp - 0x1b8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa74], eax
jmp 0x10016912
push 2
lea ecx, [ebp - 0xb70]
call fcn.10020368
mov dword [ebp - 4], 4
mov dword [ebp - 0x178], 6
mov dword [ebp - 0x220], 0
jmp 0x10016974
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x10016993
push dword [ebp - 0x220]
lea ecx, [ebp - 0xb70]
call fcn.100203e6
and dword [eax], 0
jmp 0x10016967
mov dword [ebp - 0x178], 0
jmp 0x100169ac
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jg 0x10016c28
push 1
lea ecx, [ebp - 0xa08]
call fcn.10020368
mov byte [ebp - 4], 5
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x2f0], 0
jmp 0x100169ed
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x10016a0f
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0xa08]
call fcn.100203e6
mov dword [eax], 0x473eb905
jmp 0x100169e0
push 0
lea ecx, [ebp - 0xa08]
call fcn.100203e6
and dword [eax], 0
jmp 0x10016a45
push 0
lea ecx, [ebp - 0xa08]
call fcn.100203e6
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa08]
call fcn.100203e6
cmp dword [eax], 1
jg 0x10016c14
mov dword [ebp - 0x228], 1
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x10016a88
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jg 0x10016bc3
push 3
lea ecx, [ebp - 0xb60]
call fcn.10020368
mov byte [ebp - 4], 6
push 1
lea ecx, [ebp - 0xd30]
call fcn.10020368
mov byte [ebp - 4], 7
mov dword [ebp - 0x68], 0
jmp 0x10016ac7
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10016ae3
push dword [ebp - 0x68]
lea ecx, [ebp - 0xb60]
call fcn.100203e6
mov dword [eax], 0x7bf48c44
jmp 0x10016ac0
mov dword [ebp - 0x68], 0
jmp 0x10016af3
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10016b0c
push dword [ebp - 0x68]
lea ecx, [ebp - 0xd30]
call fcn.100203e6
or dword [eax], 0xffffffff
jmp 0x10016aec
push 2
lea ecx, [ebp - 0xb60]
call fcn.100203e6
mov dword [eax], 1
jmp 0x10016b45
push 2
lea ecx, [ebp - 0xb60]
call fcn.100203e6
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x84c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xb60]
call fcn.100203e6
cmp dword [eax], 0
jl 0x10016ba0
push 0
lea ecx, [ebp - 0xa08]
call fcn.100203e6
push dword [eax]
lea ecx, [ebp - 0xb70]
call fcn.100203e6
imul eax, dword [eax], 0x66a0
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x420], eax
mov esi, dword [ebp - 0x420]
push 0
lea ecx, [ebp - 0xd30]
call fcn.100203e6
mov dword [eax], esi
jmp 0x10016b21
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd30]
call fcn.100203ca
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb60]
call fcn.100203ca
jmp 0x10016a7b
mov dword [ebp - 0xcc], 0
jmp 0x10016bdc
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x10016c0f
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xb70]
call fcn.100203e6
mov esi, eax
push dword [ebp - 0x178]
lea ecx, [ebp - 0xb70]
call fcn.100203e6
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10016bcf
jmp 0x10016a21
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa08]
call fcn.100203ca
jmp 0x1001699f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb70]
call fcn.100203ca
cmp dword [0x10614f8c], 0
jne 0x1001a69f
mov dword [ebp - 0x160], 0xfffffffc
push 1
lea ecx, [ebp - 0x984]
call fcn.10020368
mov dword [ebp - 4], 8
mov dword [ebp - 0x124], 0x276cc72b
mov dword [ebp - 0xa0], 0
jmp 0x10016c85
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x10016ca1
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x394], 0xfffffffc
jmp 0x10016c78
mov dword [ebp - 0xa0], 0
jmp 0x10016cba
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10016cdc
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x984]
call fcn.100203e6
mov dword [eax], 0xf9034e10
jmp 0x10016cad
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x394], 0
je 0x10016e3c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x394]
imul ecx, dword [ebp + eax - 0x394]
sub ecx, 0xfffc
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x394], ecx
jl 0x10016d3f
mov dword [ebp - 0xa7c], 1
jmp 0x10016d46
and dword [ebp - 0xa7c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xe74], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x394]
imul edx, dword [ebp + ecx - 0x394]
cmp edx, dword [ebp + eax - 0x394]
je 0x10016d8e
mov dword [ebp - 0x854], 1
jmp 0x10016d95
and dword [ebp - 0x854], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x854], eax
jge 0x10016db5
mov dword [ebp - 0x428], 1
jmp 0x10016dbc
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 3
jl 0x10016dd1
mov dword [ebp - 0x85c], 1
jmp 0x10016dd8
and dword [ebp - 0x85c], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x394]
add ecx, dword [ebp - 0x85c]
cmp ecx, dword [ebp + eax - 0x394]
jge 0x10016e06
mov dword [ebp - 0x430], 1
jmp 0x10016e0d
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x394]
imul eax, dword [ebp - 0x430]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
je 0x10016e3c
mov dword [ebp - 0x864], 1
jmp 0x10016e43
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0x9a023703
jb 0x10016e5b
mov dword [ebp - 0x438], 1
jmp 0x10016e62
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0xfffffff8
jle 0x10016e77
mov dword [ebp - 0x86c], 1
jmp 0x10016e7e
and dword [ebp - 0x86c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x86c], eax
jl 0x10016e9f
mov dword [ebp - 0x440], 1
jmp 0x10016ea6
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0xffffffff
jb 0x10016ebb
mov dword [ebp - 0x874], 1
jmp 0x10016ec2
and dword [ebp - 0x874], 0
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
mov ecx, dword [ebp - 0x874]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xe4c], eax
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x124], 0
jmp 0x10016f18
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 5
je 0x10017136
mov dword [ebp - 0x448], 0x307b
push 3
lea ecx, [ebp - 0xd54]
call fcn.10020368
mov byte [ebp - 4], 9
mov dword [ebp - 0x230], 0xdb40437e
mov dword [ebp - 0xae0], 0xf9f01020
mov dword [ebp - 0x338], 0
jmp 0x10016f6d
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x10016f8f
push dword [ebp - 0x338]
lea ecx, [ebp - 0xd54]
call fcn.100203e6
mov dword [eax], 0xfffffff7
jmp 0x10016f60
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x87c], eax
push 0
lea ecx, [ebp - 0xd54]
call fcn.100203e6
mov ecx, dword [ebp - 0x87c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x87c]
je 0x10016fca
mov dword [ebp - 0xac0], 1
jmp 0x10016fd1
and dword [ebp - 0xac0], 0
mov esi, dword [ebp - 0x230]
mov edi, dword [ebp - 0x160]
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
imul edi, dword [eax]
cmp edi, esi
je 0x10016ffd
mov dword [ebp - 0x450], 1
jmp 0x10017004
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x450]
jle 0x1001701e
mov dword [ebp - 0x884], 1
jmp 0x10017025
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x884]
cmp eax, 0xfffffff7
jne 0x10017043
mov dword [ebp - 0xac8], 1
jmp 0x1001704a
and dword [ebp - 0xac8], 0
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
cmp dword [ebp - 0x230], 0xffff
ja 0x1001706f
mov dword [ebp - 0xad0], 1
jmp 0x10017076
and dword [ebp - 0xad0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xe78], eax
mov dword [ebp - 0x160], 0x26dc75df
cmp dword [ebp - 0x160], 1
jg 0x100170a8
mov dword [ebp - 0xad8], 1
jmp 0x100170af
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xe54], eax
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x230]
jg 0x100170e2
mov dword [ebp - 0x458], 1
jmp 0x100170e9
and dword [ebp - 0x458], 0
imul eax, dword [ebp - 0x458], 0xece5
cmp eax, 0x9349
jg 0x10017106
mov dword [ebp - 0x88c], 1
jmp 0x1001710d
and dword [ebp - 0x88c], 0
push 0
lea ecx, [ebp - 0x984]
call fcn.100203e6
mov ecx, dword [ebp - 0x88c]
mov dword [eax], ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd54]
call fcn.100203ca
jmp 0x10016f0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x984]
call fcn.100203ca
mov dword [ebp - 0xae8], 0x8403
lea eax, [ebp - 0xae8]
push eax
call fcn.1001167c
pop ecx
mov dword [ebp - 0x858], eax
mov dword [ebp - 0x1a8], 0x951ad386
mov dword [ebp - 0x894], 0x7d0fa516
mov dword [ebp - 0x8ac], 0xc9a57b5b
push 1
lea ecx, [ebp - 0xa20]
call fcn.10020368
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x3d8], 0x75ff4442
mov dword [ebp - 0x2f8], 0
jmp 0x100171b7
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x100171d9
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0xa20]
call fcn.100203e6
mov dword [eax], 0x47c4d14
jmp 0x100171aa
cmp dword [ebp - 0x1a8], 0
jne 0x100172c8
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
push 0
lea ecx, [ebp - 0xa20]
call fcn.100203e6
mov dword [ebp - 0x460], eax
push 0
lea ecx, [ebp - 0xa20]
call fcn.100203e6
mov ecx, dword [ebp - 0x460]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x894]
jge 0x10017245
mov dword [ebp - 0x89c], 1
jmp 0x1001724c
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x8ac]
cmp eax, dword [ebp - 0x1a8]
jl 0x10017266
mov dword [ebp - 0x468], 1
jmp 0x1001726d
and dword [ebp - 0x468], 0
cmp dword [ebp - 0x468], 0xfffffffa
jge 0x10017282
mov dword [ebp - 0x470], 1
jmp 0x10017289
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x89c]
cmp eax, dword [ebp - 0x470]
jge 0x100172ac
cmp dword [ebp - 0x1a8], 0
je 0x100172ac
mov dword [ebp - 0x8a4], 1
jmp 0x100172b3
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 0x3372
jge 0x100172c8
and dword [ebp - 0x478], 0
jmp 0x100172d2
mov dword [ebp - 0x478], 1
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x8ac], eax
mov esi, dword [ebp - 0x1a8]
push 0
lea ecx, [ebp - 0xa20]
call fcn.100203e6
cmp dword [eax], esi
jl 0x10017301
mov dword [ebp - 0x480], 1
jmp 0x10017308
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x480], eax
jle 0x10017322
mov dword [ebp - 0x8b4], 1
jmp 0x10017329
and dword [ebp - 0x8b4], 0
push 0
lea ecx, [ebp - 0xa20]
call fcn.100203e6
mov ecx, dword [ebp - 0x8b4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.100203ca
push 4
lea ecx, [ebp - 0x384]
call fcn.10020368
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x1c8], 0x5d70512a
mov dword [ebp - 0x154], 0xfd66c4a8
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x3e8], 1
mov dword [ebp - 0x510], 0x1c47
mov dword [ebp - 0xb08], 0xe5f641d3
mov dword [ebp - 0xe7c], 0xd9b22f2c
mov dword [ebp - 0x238], 0
jmp 0x100173c7
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x100173e9
push dword [ebp - 0x238]
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov dword [eax], 0x60b4
jmp 0x100173ba
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov dword [eax], 0xfffffff8
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1001753f
push 1
lea ecx, [ebp - 0xcdc]
call fcn.10020368
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xaf0], 0xffffffff
mov dword [ebp - 0xf30], 1
mov dword [ebp - 0x330], 0
jmp 0x10017445
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x10017464
push dword [ebp - 0x330]
lea ecx, [ebp - 0xcdc]
call fcn.100203e6
and dword [eax], 0
jmp 0x10017438
mov esi, dword [ebp - 0x38]
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov edi, eax
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov eax, dword [eax]
imul eax, dword [edi]
cmp eax, esi
jl 0x10017498
mov dword [ebp - 0x488], 1
jmp 0x1001749f
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0xb3bfa32a
je 0x100174b7
mov dword [ebp - 0x8bc], 1
jmp 0x100174be
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x8bc]
jge 0x100174d5
mov dword [ebp - 0x490], 1
jmp 0x100174dc
and dword [ebp - 0x490], 0
push 0
lea ecx, [ebp - 0xcdc]
call fcn.100203e6
mov eax, dword [eax]
add eax, 0x74bf90ed
mov ecx, 0x99244325
sub ecx, eax
cmp ecx, dword [ebp - 0x490]
jg 0x1001750b
mov dword [ebp - 0x8c4], 1
jmp 0x10017512
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xcdc]
call fcn.100203ca
jmp 0x100178ad
mov dword [ebp - 0x3e0], 3
mov dword [ebp - 0xaf8], 0x9069002f
mov dword [ebp - 0x4e0], 0x6066fa41
mov dword [ebp - 0x240], 0
jmp 0x10017576
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x10017592
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x9c0], 0x86095610
jmp 0x10017569
mov dword [ebp - 0x38], 3
jmp 0x100175a2
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x100178a3
mov dword [ebp - 0x498], 5
mov dword [ebp - 0x12c], 0x93ce85dc
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x100175e4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, 0x44ed25e4
test eax, eax
je 0x1001772b
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x1c8]
jle 0x10017617
mov dword [ebp - 0x8cc], 1
jmp 0x1001761e
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0xfffffff7
jge 0x10017635
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c0]
cmp eax, dword [ebp - 0x38]
jg 0x10017653
mov dword [ebp - 0x4a0], 1
jmp 0x1001765a
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xffffffff
jge 0x1001766f
mov dword [ebp - 0x8d4], 1
jmp 0x10017676
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x8d4], eax
jge 0x10017690
mov dword [ebp - 0x4a8], 1
jmp 0x10017697
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [ebp - 0x4a8]
jne 0x100176b1
mov dword [ebp - 0x8dc], 1
jmp 0x100176b8
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xfffffffd
ja 0x100176cd
mov dword [ebp - 0x8e4], 1
jmp 0x100176d4
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0x8e4], eax
je 0x100176ee
mov dword [ebp - 0x880], 1
jmp 0x100176f5
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0xb816
je 0x1001770d
mov dword [ebp - 0x4b8], 1
jmp 0x10017714
and dword [ebp - 0x4b8], 0
imul eax, dword [ebp - 0x4b8], 6
test eax, eax
je 0x1001772b
mov dword [ebp - 0x740], 1
jmp 0x10017732
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x740]
je 0x10017755
cmp dword [ebp - 0x3e0], 0
je 0x10017755
mov dword [ebp - 0x4c0], 1
jmp 0x1001775c
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x4c0], eax
je 0x10017776
mov dword [ebp - 0x928], 1
jmp 0x1001777d
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x1c8], eax
mov esi, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x1c8]
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
add edi, dword [eax]
cmp edi, esi
jne 0x100177b4
mov dword [ebp - 0x4c8], 1
jmp 0x100177bb
and dword [ebp - 0x4c8], 0
mov esi, dword [ebp - 0x4c8]
sub esi, dword [ebp - 0x12c]
neg esi
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
cmp esi, dword [eax]
jg 0x100177e6
mov dword [ebp - 0x748], 1
jmp 0x100177ed
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x180]
je 0x1001780d
mov dword [ebp - 0x4d0], 1
jmp 0x10017814
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 1
je 0x10017829
mov dword [ebp - 0x888], 1
jmp 0x10017830
and dword [ebp - 0x888], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c0]
cmp eax, dword [ebp - 0x888]
jl 0x10017851
mov dword [ebp - 0x4d8], 1
jmp 0x10017858
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d8]
sub ecx, dword [ebp - 0x154]
cmp ecx, dword [ebp + eax - 0x9c0]
jle 0x1001787f
mov dword [ebp - 0x750], 1
jmp 0x10017886
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x12c], eax
jmp 0x1001759b
mov dword [ebp - 0x154], 0x55ef1c8d
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xe88], eax
mov esi, dword [ebp - 0x3e8]
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov eax, dword [eax]
sub eax, esi
cmp eax, 0xeae3254c
je 0x100178e3
mov dword [ebp - 0x988], 1
jmp 0x100178ea
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x988], eax
je 0x10017901
mov dword [ebp - 0x4e8], 1
jmp 0x10017908
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0xffff
jb 0x10017920
mov dword [ebp - 0x758], 1
jmp 0x10017927
and dword [ebp - 0x758], 0
push 0
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax]
jle 0x1001794a
mov dword [ebp - 0x4f0], 1
jmp 0x10017951
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x4f0]
jne 0x1001796b
mov dword [ebp - 0x890], 1
jmp 0x10017972
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x890], 0
jl 0x10017987
mov dword [ebp - 0x4f8], 1
jmp 0x1001798e
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x4f8]
jge 0x100179b7
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
cmp dword [eax], 0
jne 0x100179b7
and dword [ebp - 0x760], 0
jmp 0x100179c1
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jne 0x100179e5
cmp dword [ebp - 0x38], 0
jne 0x100179e5
and dword [ebp - 0x500], 0
jmp 0x100179ef
mov dword [ebp - 0x500], 1
cmp dword [ebp - 0x500], 0xdef0
je 0x10017a07
mov dword [ebp - 0x930], 1
jmp 0x10017a0e
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jne 0x10017a31
cmp dword [ebp - 0x154], 0
je 0x10017a31
mov dword [ebp - 0x508], 1
jmp 0x10017a38
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0x63ae
jl 0x10017a59
cmp dword [ebp - 0x3e8], 0
je 0x10017a59
mov dword [ebp - 0x768], 1
jmp 0x10017a60
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
sub eax, dword [ebp - 0x510]
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
cmp dword [ebp - 0x510], 0x33c9e489
jl 0x10017a91
mov dword [ebp - 0x898], 1
jmp 0x10017a98
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x898], eax
jne 0x10017aaf
mov dword [ebp - 0xb00], 1
jmp 0x10017ab6
and dword [ebp - 0xb00], 0
push 3
lea ecx, [ebp - 0x384]
call fcn.100203e6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xb08], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.100203ca
mov byte [ebp - 0x1ec], 0xa
mov byte [ebp - 0x1eb], 0x5b
mov byte [ebp - 0x1ea], 0
mov byte [ebp - 0x1e9], 2
mov byte [ebp - 0x1e8], 9
mov byte [ebp - 0x1e7], 0x29
mov byte [ebp - 0x1e6], 0xb
mov byte [ebp - 0x1e5], 0x16
mov byte [ebp - 0x1e4], 3
mov byte [ebp - 0x1e3], 0x2e
mov byte [ebp - 0x1e2], 5
mov byte [ebp - 0x1e1], 0x24
mov byte [ebp - 0x1e0], 4
mov byte [ebp - 0x1df], 0x17
mov byte [ebp - 0x1de], 0xc
mov byte [ebp - 0x1dd], 0x32
mov byte [ebp - 0x1dc], 8
mov byte [ebp - 0x1db], 0x38
mov byte [ebp - 0x1da], 7
mov byte [ebp - 0x1d9], 6
mov byte [ebp - 0x1d8], 6
mov byte [ebp - 0x1d7], 0x1a
mov byte [ebp - 0x1d6], 2
mov byte [ebp - 0x1d5], 2
mov byte [ebp - 0x1d4], 0x8f
mov byte [ebp - 0x1d3], 2
mov byte [ebp - 0x1d2], 7
mov byte [ebp - 0x1d1], 1
mov byte [ebp - 0x1d0], 0x11
mov dword [ebp - 0x300], 0
mov dword [ebp - 0xb10], 0x245f
mov dword [ebp - 0x300], 0x1b
jmp 0x10017bdf
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xffffffe9
jg 0x10017c40
mov dword [ebp - 0x188], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], 0
jmp 0x10017c17
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jle 0x10017c3e
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x10017c3c
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x10017c0a
jmp 0x10017bd2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1ec]
and eax, 0x1e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1ec]
or ecx, 0x1e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1ec]
mov byte [ebp + eax - 0xa30], cl
mov dword [ebp - 0x18], 2
and dword [ebp - 0x1a0], 0
jmp 0x10017c91
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1d
jae 0x1001888e
mov dword [ebp - 0x518], 0x6f35
mov dword [ebp - 0xb20], 0x10007e38
cmp dword [ebp - 0x518], 0x6fcc
jle 0x10017dc9
and dword [ebp - 0x248], 0
jmp 0x10017cd5
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x5b5
jge 0x10017dc9
and dword [ebp - 0x2ac], 0
jmp 0x10017cfb
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x7675
jge 0x10017dc4
and dword [ebp - 0x250], 0
jmp 0x10017d21
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x209f
jge 0x10017dbf
and dword [ebp - 0x2b4], 0
jmp 0x10017d47
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x151
jge 0x10017dba
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x2ac]
shl eax, cl
mov ecx, dword [ebp - 0x250]
sar eax, cl
or eax, dword [ebp - 0x2b4]
cdq
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa90], edx
push dword [ebp - 0xa90]
push dword [ebp - 0xa94]
lea ecx, [ebp - 0x1094]
call fcn.1000a7be
pop ecx
pop ecx
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb18]
call fcn.10020108
push eax
call fcn.100545af
pop ecx
lea ecx, [ebp - 0x1094]
call fcn.100200fe
jmp 0x10017d3a
jmp 0x10017d14
jmp 0x10017cee
jmp 0x10017cc8
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x518], 0x6cd4
jge 0x10017def
push dword [ebp - 0xb20]
call fcn.100545af
pop ecx
jmp 0x10017e0b
or dword [ebp - 4], 0xffffffff
jmp 0x10017e15
mov dword [ebp - 0x258], 0
jmp 0x10017e2e
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x10017e4a
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x134], 0x799ac789
jmp 0x10017e21
mov dword [ebp - 0x48], 0
jmp 0x10017e5a
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10018147
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xd4], 0x64b5c6f8
mov dword [ebp - 0x528], 8
mov dword [ebp - 0x4c], 0
jmp 0x10017e8f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x10017f9f
push 4
lea ecx, [ebp - 0xcf4]
call fcn.10020368
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xb30], 1
mov dword [ebp - 0x2bc], 0
jmp 0x10017ed0
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x10017ef2
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xcf4]
call fcn.100203e6
mov dword [eax], 0xed1e12aa
jmp 0x10017ec3
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xd4]
je 0x10017f10
mov dword [ebp - 0x770], 1
jmp 0x10017f17
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x770]
jl 0x10017f2e
mov dword [ebp - 0xb28], 1
jmp 0x10017f35
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd70], eax
mov esi, dword [ebp - 0xd4]
push 1
lea ecx, [ebp - 0xcf4]
call fcn.100203e6
mov dword [eax], esi
cmp dword [ebp - 0xb30], 0xfffffff6
je 0x10017f74
mov dword [ebp - 0x520], 1
jmp 0x10017f7b
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x134], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.100203ca
jmp 0x10017e88
cmp dword [ebp - 0xd4], 0
jne 0x100180ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp eax, dword [ebp - 0xd4]
jg 0x10017fcd
mov dword [ebp - 0x780], 1
jmp 0x10017fd4
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x4c], 0xcf7a
jne 0x10017fec
cmp dword [ebp - 0x4c], 0
jne 0x10017fec
and dword [ebp - 0xb38], 0
jmp 0x10017ff6
mov dword [ebp - 0xb38], 1
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xd80], eax
cmp dword [ebp - 0x48], 0x630971cf
jl 0x10018020
mov dword [ebp - 0x968], 1
jmp 0x10018027
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0xd90], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd98], eax
mov eax, 0xffff
test eax, eax
jbe 0x1001806f
mov eax, 0xfffc
test eax, eax
je 0x1001806f
mov dword [ebp - 0x778], 1
jmp 0x10018076
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0xffffffff
jge 0x1001808b
mov dword [ebp - 0x530], 1
jmp 0x10018092
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0x85869896
je 0x100180aa
mov dword [ebp - 0x8a0], 1
jmp 0x100180b1
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xffffffff
jg 0x100180c6
mov dword [ebp - 0x538], 1
jmp 0x100180cd
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
sub eax, 0x4f0b0d28
imul eax, eax, 0xfffffff9
imul eax, dword [ebp - 0x780]
test eax, eax
jne 0x100180ef
and dword [ebp - 0x540], 0
jmp 0x100180f9
mov dword [ebp - 0x540], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x134]
imul ecx, dword [ebp - 0x540]
cmp ecx, dword [ebp + eax - 0x134]
jne 0x10018128
mov dword [ebp - 0x938], 1
jmp 0x1001812f
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x938]
mov dword [ebp + eax - 0x134], ecx
jmp 0x10017e53
mov dword [ebp - 0x48], 0
jmp 0x10018157
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jg 0x1001819e
mov dword [ebp - 0x1b0], 0x8b742d63
mov dword [ebp - 0x1b0], 0
jmp 0x10018180
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x1001819c
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x134], 0xc82f3c07
jmp 0x10018173
jmp 0x10018150
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1ec]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x10018633
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1ec]
inc eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x18c], 7
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x260], 0
jmp 0x10018202
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1001821e
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x32c], 0xfffffff8
jmp 0x100181f5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x32c], 0
jmp 0x10018249
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x32c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x32c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c], 0xa
jl 0x10018286
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x10018284
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10018230
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c], 1
jb 0x100182a1
mov dword [ebp - 0x548], 1
jmp 0x100182a8
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 5
jg 0x100182bd
mov dword [ebp - 0x788], 1
jmp 0x100182c4
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0xe924
jne 0x100182dc
mov dword [ebp - 0x550], 1
jmp 0x100182e3
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x560]
inc eax
cmp eax, dword [ebp - 0x550]
jg 0x100182fe
mov dword [ebp - 0x8a8], 1
jmp 0x10018305
and dword [ebp - 0x8a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x32c]
cmp dword [ebp - 0x8a8], eax
jg 0x10018326
mov dword [ebp - 0x558], 1
jmp 0x1001832d
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x558], eax
jl 0x10018342
cmp dword [ebp - 0x18c], 0
xor eax, eax
cmp eax, 0x1d97
jge 0x10018357
mov dword [ebp - 0x790], 1
jmp 0x1001835e
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x18c]
cmp eax, 6
jne 0x1001837b
mov dword [ebp - 0x98c], 1
jmp 0x10018382
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x560]
cmp dword [ebp - 0x98c], eax
jle 0x1001839c
mov dword [ebp - 0x568], 1
jmp 0x100183a3
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
add eax, 0x3710cb16
cmp eax, 0x744ed25e
jne 0x100183c1
mov dword [ebp - 0x798], 1
jmp 0x100183c8
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x2c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c4]
imul ecx, dword [ebp + eax - 0x32c]
cmp ecx, 0xfbc6a687
jne 0x100183fc
mov dword [ebp - 0x570], 1
jmp 0x10018403
and dword [ebp - 0x570], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x32c]
add eax, dword [ebp - 0x570]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x32c]
sub ecx, eax
je 0x1001843c
cmp dword [ebp - 0x18c], 0
je 0x1001843c
mov dword [ebp - 0x8b0], 1
jmp 0x10018443
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x8b0], eax
jl 0x1001846c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c], 0
je 0x1001846c
mov dword [ebp - 0x578], 1
jmp 0x10018473
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0x69ed994a
jg 0x1001848c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c4]
imul ecx, dword [ebp + eax - 0x32c]
test ecx, ecx
je 0x100184b0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c], 0
cmp dword [ebp - 0x2c4], 1
je 0x100184c5
mov dword [ebp - 0x7a0], 1
jmp 0x100184cc
and dword [ebp - 0x7a0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7a0]
mov dword [ebp + eax - 0x32c], ecx
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1ec]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x268], 0
push 1
lea ecx, [ebp - 0xd00]
call fcn.10020368
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xb40], 0x5a9c4c8d
mov dword [ebp - 0xda0], 0
push 3
lea ecx, [ebp - 0xec0]
call fcn.10020368
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xda8], 1
mov dword [ebp - 0xdb0], 0x6d21
mov dword [ebp - 0x580], 0x6525
mov dword [ebp - 0x88], 0
jmp 0x1001856d
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1001858f
push dword [ebp - 0x88]
lea ecx, [ebp - 0xd00]
call fcn.100203e6
mov dword [eax], 0xffff
jmp 0x10018560
mov dword [ebp - 0x88], 0
jmp 0x100185a8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100185ca
push dword [ebp - 0x88]
lea ecx, [ebp - 0xec0]
call fcn.100203e6
mov dword [eax], 0xbf2121f9
jmp 0x1001859b
mov dword [ebp - 0x268], 0
jmp 0x100185e3
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xffffffe7
jl 0x10018603
push 0
lea ecx, [ebp - 0xd00]
call fcn.100203e6
mov eax, dword [eax]
mov dword [ebp - 0xb40], eax
jmp 0x100185d6
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xec0]
call fcn.100203ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd00]
call fcn.100203ca
jmp 0x10017c89
mov dword [ebp - 0xdb8], 0xffffffff
push 3
lea ecx, [ebp - 0xed0]
call fcn.10020368
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x940], 0xf782a183
mov dword [ebp - 0x2cc], 0
jmp 0x10018674
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x10018696
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xed0]
call fcn.100203e6
mov dword [eax], 0xd16df251
jmp 0x10018667
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x100186cc
push 0
push 0x2413
push 0x49c
push 0x5d3
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xed0]
call fcn.100203ca
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1a0]
movzx eax, byte [ebp + eax - 0x1ee]
movsx eax, byte [ebp + eax - 0xa30]
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x1eb]
and ecx, eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1a0]
movzx eax, byte [ebp + eax - 0x1ee]
movsx eax, byte [ebp + eax - 0xa30]
mov edx, dword [ebp - 0x18]
movzx edx, byte [ebp + edx - 0x1eb]
and edx, eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1a0]
movzx eax, byte [ebp + eax - 0x1ee]
movsx eax, byte [ebp + eax - 0xa30]
mov esi, dword [ebp - 0x18]
movzx ebx, byte [ebp + esi - 0x1eb]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x1ec]
mov byte [ebp + eax - 0xa30], bl
mov dword [ebp - 0x1c0], 0x69ad59e5
mov dword [ebp - 0x270], 0
jmp 0x10018786
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x100187a2
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xfc0], 0xffffffff
jmp 0x10018779
mov eax, dword [ebp - 0x1c0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xfc0], eax
mov dword [ebp - 0x1c0], 0xfffffff9
jmp 0x100187ce
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x18
jg 0x10018882
mov dword [ebp - 0x2d4], 0
jmp 0x100187f4
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x10018810
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xc38], 0
jmp 0x100187e7
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xc38], 0xffffffea
jmp 0x1001883b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc38]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xc38], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc38], 0xffffffeb
jne 0x1001887d
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1001887b
push 0x12a5
push 0x2334
push 0x18ea
push 0xd06
push 0x1101
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x10018822
jmp 0x100187c1
and dword [ebp - 0x1a0], 0
jmp 0x10017c89
mov dword [ebp - 0x40], 0x3ae35568
mov dword [ebp - 0x5a0], 1
mov dword [ebp - 0xdc0], 0
mov dword [ebp - 0xa54], 0x80a8
mov dword [ebp - 0x278], 0
jmp 0x100188cc
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x100188e8
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xe90], 0x374f1e5e
jmp 0x100188bf
mov dword [ebp - 0x40], 0
jmp 0x100188f8
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x16
jl 0x10019011
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x14c], 6
mov dword [ebp - 0x168], 0xeb818f8f
mov dword [ebp - 0x990], 0xc5b50a70
mov dword [ebp - 0x5d8], 0xd940354e
mov dword [ebp - 0x400], 1
mov dword [ebp - 0xc28], 6
mov dword [ebp - 0x6c], 0
jmp 0x10018955
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1001896b
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xc44], 0x3eb905d0
jmp 0x1001894e
mov dword [ebp - 0x6c], 0
jmp 0x1001897b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10018991
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x9b8], 0
jmp 0x10018974
mov dword [ebp - 0x44], 2
jmp 0x100189a1
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10018e8e
mov dword [ebp - 0x2e4], 0x7c2076a
mov dword [ebp - 0x280], 8
mov dword [ebp - 0x5c0], 0xcc545e21
mov dword [ebp - 0xc2c], 0x46c42882
cmp dword [ebp - 0x44], 0
je 0x100189e9
xor eax, eax
je 0x100189e9
mov dword [ebp - 0x7a8], 1
jmp 0x100189f0
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x40], 0xfffffffc
jne 0x10018a02
mov dword [ebp - 0x588], 1
jmp 0x10018a09
and dword [ebp - 0x588], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x588]
sub ecx, dword [ebp + eax - 0xc44]
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x7a8]
cmp eax, ecx
jl 0x10018a35
mov dword [ebp - 0x590], 1
jmp 0x10018a3c
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x3c61
jle 0x10018a54
mov dword [ebp - 0x8b8], 1
jmp 0x10018a5b
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x8b8], eax
jl 0x10018a75
mov dword [ebp - 0x598], 1
jmp 0x10018a7c
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x598], eax
jle 0x10018a93
mov dword [ebp - 0x7b0], 1
jmp 0x10018a9a
and dword [ebp - 0x7b0], 0
imul eax, dword [ebp - 0x7b0], 0xe817
test eax, eax
je 0x10018ba6
mov dword [ebp - 0xc0c], 0xffffffff
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0
jne 0x10018b75
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax*4 - 0xc44], ecx
cmp dword [ebp - 0x970], 0
je 0x10018afa
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xc44]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xdd8], eax
mov dword [ebp - 0x280], 0x2a67
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x44]
jge 0x10018b34
mov dword [ebp - 0x5a8], 1
jmp 0x10018b3b
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 3
je 0x10018b50
mov dword [ebp - 0x7b8], 1
jmp 0x10018b57
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x10018b75
and dword [ebp - 0x5b0], 0
jmp 0x10018b7f
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xde0], eax
mov dword [ebp - 0x5c0], 0xd076c56d
jmp 0x10018e89
mov dword [ebp - 0x288], 0x461d0ee3
mov dword [ebp - 0x3f0], 0x103ca543
mov dword [ebp - 0xca8], 0xa3ce577e
mov dword [ebp - 0xca4], 0xa3ce577e
mov dword [ebp - 0xca0], 0xa3ce577e
mov dword [ebp - 0xc9c], 0xa3ce577e
lea ecx, [ebp - 0x3c5]
call fcn.100203f5
push eax
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xca8]
push eax
lea ecx, [ebp - 0x1024]
call fcn.100203f8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xee0]
call fcn.100203a4
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x2dc], 0
jmp 0x10018c37
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x10018c53
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xe60], 0xe8fa1c18
jmp 0x10018c2a
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xde8], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x288]
jne 0x10018c83
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9b8], 0
jne 0x10018c83
and dword [ebp - 0x8c0], 0
jmp 0x10018c8d
mov dword [ebp - 0x8c0], 1
mov eax, dword [ebp - 0x3f0]
imul eax, dword [ebp - 0x8c0]
test eax, eax
jne 0x10018caa
mov dword [ebp - 0x5b8], 1
jmp 0x10018cb1
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x5b8]
je 0x10018cc8
mov dword [ebp - 0x7c0], 1
jmp 0x10018ccf
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x7c0], eax
jne 0x10018ce9
mov dword [ebp - 0xc14], 1
jmp 0x10018cf0
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x2e4]
jle 0x10018d13
mov dword [ebp - 0x948], 1
jmp 0x10018d1a
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 0
jge 0x10018d38
cmp dword [ebp - 0x3f0], 0
je 0x10018d38
mov dword [ebp - 0x5c8], 1
jmp 0x10018d3f
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x280], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9b8], 0xe33bd0d8
jne 0x10018d6a
mov dword [ebp - 0xc1c], 1
jmp 0x10018d71
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xdf8], eax
cmp dword [ebp - 0x2e4], 0
jne 0x10018d95
cmp dword [ebp - 0x40], 0
jne 0x10018d95
and dword [ebp - 0x7c8], 0
jmp 0x10018d9f
mov dword [ebp - 0x7c8], 1
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x7c8], eax
jle 0x10018db9
mov dword [ebp - 0x3f8], 1
jmp 0x10018dc0
and dword [ebp - 0x3f8], 0
push 2
lea ecx, [ebp - 0xee0]
call fcn.100203e6
mov ecx, dword [ebp - 0x3f8]
mov dword [eax], ecx
mov eax, 0x2b4b20f9
sub eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x2e4]
jle 0x10018e00
mov dword [ebp - 0x5d0], 1
jmp 0x10018e07
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0xffffffff
jle 0x10018e1c
mov dword [ebp - 0xc24], 1
jmp 0x10018e23
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe00], eax
mov eax, dword [ebp - 0xc2c]
cmp eax, dword [ebp - 0x288]
jg 0x10018e46
mov dword [ebp - 0x8c8], 1
jmp 0x10018e4d
and dword [ebp - 0x8c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b8]
imul eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe60], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.100203ca
jmp 0x1001899a
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
jne 0x10018f18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b8]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0xc28]
jge 0x10018eca
mov dword [ebp - 0x5e0], 1
jmp 0x10018ed1
and dword [ebp - 0x5e0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9b8], 0
je 0x10018ef3
cmp dword [ebp - 0x40], 0
je 0x10018ef3
mov dword [ebp - 0x7d0], 1
jmp 0x10018efa
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x990]
imul eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x5e0], eax
je 0x10018f18
and dword [ebp - 0xb74], 0
jmp 0x10018f22
mov dword [ebp - 0xb74], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc44]
mov dword [ebp - 0xe08], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe90], 0x7513
je 0x10018f53
mov dword [ebp - 0x5e8], 1
jmp 0x10018f5a
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x990]
cmp dword [ebp - 0x5e8], eax
jne 0x10018f74
mov dword [ebp - 0x7d8], 1
jmp 0x10018f7b
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b8]
cmp dword [ebp - 0x7d8], eax
je 0x10018f9c
mov dword [ebp - 0x5f0], 1
jmp 0x10018fa3
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0xa54]
add eax, dword [ebp - 0x5f0]
cmp dword [ebp - 0x14c], eax
jge 0x10018fc8
or eax, 0xffffffff
je 0x10018fc8
mov dword [ebp - 0x8d0], 1
jmp 0x10018fcf
and dword [ebp - 0x8d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b8]
cmp dword [ebp - 0x8d0], eax
jne 0x10018ff9
cmp dword [ebp - 0x14c], 0
je 0x10018ff9
mov dword [ebp - 0x5f8], 1
jmp 0x10019000
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x168], eax
jmp 0x100188f1
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xa30], 0
push 4
lea ecx, [ebp - 0x360]
call fcn.10020368
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xe10], 0xd4e677b5
mov dword [ebp - 0xb84], 1
mov dword [ebp - 0x24], 0
jmp 0x10019057
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001906d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9fc], 0xd7f825e7
jmp 0x10019050
mov dword [ebp - 0x24], 0
jmp 0x1001907d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10019099
push dword [ebp - 0x24]
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov dword [eax], 6
jmp 0x10019076
mov dword [ebp - 0x24], 0
jmp 0x100190a9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100190bf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3a8], 3
jmp 0x100190a2
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x100190e0
push 1
push 0
push 0x14b9
call dword [sym.imp.GDI32.dll_SelectPalette]
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
and dword [eax], 0
jmp 0x10019116
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x7e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7e0]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
cmp dword [eax], 2
jg 0x10019415
mov dword [ebp - 0xe18], 0x66e58d02
mov dword [ebp - 0x628], 4
mov dword [ebp - 0xa50], 0x35e1f6f0
mov dword [ebp - 0xe20], 0x456160cb
mov dword [ebp - 0x408], 0xffffffff
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9fc]
mov dword [ebp - 0xe28], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9fc], 0
je 0x100192ff
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x9fc]
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov eax, dword [eax]
mov edi, dword [ebp + eax*4 - 0x9fc]
push 1
lea ecx, [ebp - 0x360]
call fcn.100203e6
imul edi, dword [eax]
imul edi, esi
cmp edi, 0xffffffff
jge 0x100191de
mov dword [ebp - 0x600], 1
jmp 0x100191e5
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0
jbe 0x100191fa
mov dword [ebp - 0x950], 1
jmp 0x10019201
and dword [ebp - 0x950], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9fc]
cmp dword [ebp - 0x950], eax
jg 0x10019222
mov dword [ebp - 0x608], 1
jmp 0x10019229
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x608], eax
jl 0x1001924a
mov dword [ebp - 0x7e8], 1
jmp 0x10019251
and dword [ebp - 0x7e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x7e8], eax
jne 0x10019272
mov dword [ebp - 0x610], 1
jmp 0x10019279
and dword [ebp - 0x610], 0
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9fc]
cmp dword [ebp - 0x610], eax
jg 0x100192a3
mov dword [ebp - 0x8d8], 1
jmp 0x100192aa
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 1
jg 0x100192bf
mov dword [ebp - 0x618], 1
jmp 0x100192c6
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x628]
add esi, dword [ebp - 0x618]
sub esi, dword [ebp + eax - 0x3a8]
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
imul esi, dword [eax]
neg esi
je 0x100192ff
mov dword [ebp - 0x7f0], 1
jmp 0x10019306
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x7f0], eax
jl 0x10019327
mov dword [ebp - 0x620], 1
jmp 0x1001932e
and dword [ebp - 0x620], 0
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
mov ecx, dword [ebp - 0x620]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001934f
cmp dword [ebp - 0xa50], 0
push 2
lea ecx, [ebp - 0x360]
call fcn.100203e6
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3a8]
cmp ecx, dword [ebp + eax - 0x3a8]
jge 0x10019384
mov dword [ebp - 0x978], 1
jmp 0x1001938b
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0xbe4]
cmp eax, dword [ebp - 0xa58]
jg 0x100193ca
mov dword [ebp - 0x7f8], 1
jmp 0x100193d1
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x7f8], eax
jle 0x100193eb
mov dword [ebp - 0x630], 1
jmp 0x100193f2
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0xb84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x10019410
jmp 0x10019415
jmp 0x100190f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.100203ca
lea eax, [ebp - 0xa30]
push eax
lea ecx, [ebp - 0x10b8]
call fcn.100202d1
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xbec], eax
mov dword [ebp - 4], 0x15
mov edx, dword [ebp - 0x858]
mov ecx, dword [ebp - 0xbec]
call fcn.1000a868
mov dword [0x10614f8c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b8]
call fcn.100202f4
and dword [ebp - 0x2ec], 0
jmp 0x1001948a
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0xe
jae 0x100194a3
mov eax, dword [ebp - 0x2ec]
mov byte [ebp + eax - 0xa30], 0
jmp 0x1001947d
mov dword [ebp - 0xdc], 0xffffffff
push 2
lea ecx, [ebp - 0xb80]
call fcn.10020368
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x8e0], 0
mov dword [ebp - 0x910], 0x889e022a
push 1
lea ecx, [ebp - 0xd0c]
call fcn.10020368
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xb94], 0xfffffff8
mov dword [ebp - 0xe30], 0x63b0a6d0
mov dword [ebp - 0x98], 0
jmp 0x10019513
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10019535
push dword [ebp - 0x98]
lea ecx, [ebp - 0xb80]
call fcn.100203e6
mov dword [eax], 0x8ea38884
jmp 0x10019506
mov dword [ebp - 0x98], 0
jmp 0x1001954e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10019570
push dword [ebp - 0x98]
lea ecx, [ebp - 0xd0c]
call fcn.100203e6
mov dword [eax], 0x105fa2ef
jmp 0x10019541
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xa68], eax
push 1
lea ecx, [ebp - 0xb80]
call fcn.100203e6
mov ecx, dword [ebp - 0xa68]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe40], eax
mov eax, dword [ebp - 0xdc]
add eax, 0xa
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 0
mov esi, dword [ebp - 0xdc]
push 0
lea ecx, [ebp - 0xb80]
call fcn.100203e6
cmp esi, dword [eax]
jg 0x100195e2
mov dword [ebp - 0x638], 1
jmp 0x100195e9
and dword [ebp - 0x638], 0
imul eax, dword [ebp - 0x638], 0xfffffff8
cmp dword [ebp - 0xdc], eax
je 0x10019604
mov dword [ebp - 0x800], 1
jmp 0x1001960b
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 9
jl 0x10019620
mov dword [ebp - 0x640], 1
jmp 0x10019627
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0xe17c
jg 0x1001964b
mov dword [ebp - 0x648], 1
jmp 0x10019652
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x648]
jne 0x1001967b
push 1
lea ecx, [ebp - 0xb80]
call fcn.100203e6
cmp dword [eax], 0
jne 0x1001967b
and dword [ebp - 0x410], 0
jmp 0x10019685
mov dword [ebp - 0x410], 1
push 0
lea ecx, [ebp - 0xd0c]
call fcn.100203e6
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xb94], eax
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x100196c9
push 0x1fd1
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xd0c]
call fcn.100203ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb80]
call fcn.100203ca
mov dword [ebp - 0xcd0], 0x324ec2e0
mov dword [ebp - 0xccc], 0x324ec2e0
mov dword [ebp - 0xcc8], 0x324ec2e0
mov dword [ebp - 0xcc4], 0x324ec2e0
lea ecx, [ebp - 0x3cd]
call fcn.100203f5
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xcd0]
push eax
lea ecx, [ebp - 0x1004]
call fcn.100203f8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x198]
call fcn.100203a4
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0xa80], 0x45dd
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x290], 0
jmp 0x1001977f
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1001979b
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x16c], 1
jmp 0x10019772
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
and dword [eax], 0
jmp 0x100197d1
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x808]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x808]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp dword [eax], 0xffffffe7
jge 0x10019c65
mov dword [ebp - 0xe4], 0x495e
mov dword [ebp - 0x13c], 0x7b70d8ac
imul esi, dword [ebp - 0xe4], 0
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp dword [eax], esi
jge 0x1001982e
mov dword [ebp - 0x650], 1
jmp 0x10019835
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0xa522
je 0x1001984d
mov dword [ebp - 0x8e8], 1
jmp 0x10019854
and dword [ebp - 0x8e8], 0
push 3
lea ecx, [ebp - 0x198]
call fcn.100203e6
mov ecx, dword [ebp - 0x8e8]
add ecx, dword [eax]
cmp ecx, 3
jl 0x1001987a
mov dword [ebp - 0x658], 1
jmp 0x10019881
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
imul esi, dword [ebp - 0xe4]
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp esi, dword [eax]
jne 0x10019ade
mov dword [ebp - 0x90], 0xe734e2e0
mov dword [ebp - 0x30], 0
jmp 0x100198e1
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x10019a77
mov dword [ebp - 0xa70], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x16c]
push 2
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp esi, dword [eax]
jle 0x1001991f
mov dword [ebp - 0x810], 1
jmp 0x10019926
and dword [ebp - 0x810], 0
mov esi, dword [ebp - 0xe4]
sub esi, dword [ebp - 0x810]
push 2
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp esi, dword [eax]
jge 0x1001994f
mov dword [ebp - 0x660], 1
jmp 0x10019956
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x660], eax
jne 0x1001996d
mov dword [ebp - 0x914], 1
jmp 0x10019974
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
add eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x90]
jge 0x1001999b
mov dword [ebp - 0x668], 1
jmp 0x100199a2
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp + eax*4 - 0x16c]
add esi, dword [ebp - 0x668]
push 3
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp esi, dword [eax]
jle 0x100199cf
mov dword [ebp - 0x818], 1
jmp 0x100199d6
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x90]
jg 0x100199ff
cmp dword [ebp - 0x90], 0
je 0x100199ff
mov dword [ebp - 0x670], 1
jmp 0x10019a06
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x16c]
cmp eax, dword [ebp - 0x670]
jge 0x10019a24
mov dword [ebp - 0x8f0], 1
jmp 0x10019a2b
and dword [ebp - 0x8f0], 0
mov esi, dword [ebp - 0x90]
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
mov ecx, dword [ebp - 0x8f0]
sub ecx, dword [eax]
cmp ecx, esi
jl 0x10019a51
cmp dword [ebp - 0xe4], 0
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
mov eax, dword [eax]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xa70], eax
jmp 0x100198da
mov dword [ebp - 0x90], 0
jmp 0x10019a90
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10019ad9
mov dword [ebp - 0xbf4], 0xb126
mov dword [ebp - 0x30], 0
jmp 0x10019ab3
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x10019ad7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x16c]
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbf4], eax
jmp 0x10019aac
jmp 0x10019a83
jmp 0x10019c54
mov dword [ebp - 0x174], 0x9f00
mov dword [ebp - 0x91c], 0
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0xba4], 0xbd0c7f12
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x174]
jne 0x10019b20
mov dword [ebp - 0x680], 1
jmp 0x10019b27
and dword [ebp - 0x680], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x3a0]
cmp eax, 0xffffffff
jge 0x10019b41
mov dword [ebp - 0x678], 1
jmp 0x10019b48
and dword [ebp - 0x678], 0
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
mov ecx, dword [ebp - 0x678]
sub ecx, dword [eax]
jne 0x10019b71
cmp dword [ebp - 0x174], 0
jne 0x10019b71
and dword [ebp - 0x820], 0
jmp 0x10019b7b
mov dword [ebp - 0x820], 1
cmp dword [ebp - 0x820], 0x653d
jne 0x10019ba2
push 0
lea ecx, [ebp - 0x198]
call fcn.100203e6
cmp dword [eax], 0
jne 0x10019ba2
and dword [ebp - 0xa78], 0
jmp 0x10019bac
mov dword [ebp - 0xa78], 1
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xe58], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe64], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
sub eax, dword [ebp - 0x3a0]
add eax, 0x1580
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x174]
jge 0x10019c1f
cmp dword [ebp - 0x13c], 0
jne 0x10019c1f
and dword [ebp - 0x688], 0
jmp 0x10019c29
mov dword [ebp - 0x688], 1
cmp dword [ebp - 0x688], 0xa916a8e8
jbe 0x10019c41
mov dword [ebp - 0x828], 1
jmp 0x10019c48
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xa80], eax
jmp 0x100197ad
mov eax, dword [ebp - 0x690]
dec eax
mov dword [ebp - 0x690], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.100203ca
mov byte [ebp - 0x208], 4
mov byte [ebp - 0x207], 0xff
mov byte [ebp - 0x206], 3
mov byte [ebp - 0x205], 0x15
mov byte [ebp - 0x204], 6
mov byte [ebp - 0x203], 0x31
mov byte [ebp - 0x202], 9
mov byte [ebp - 0x201], 0x33
mov byte [ebp - 0x200], 5
mov byte [ebp - 0x1ff], 6
mov byte [ebp - 0x1fe], 0xb
mov byte [ebp - 0x1fd], 0x16
mov byte [ebp - 0x1fc], 0
mov byte [ebp - 0x1fb], 0x30
mov byte [ebp - 0x1fa], 0xa
mov byte [ebp - 0x1f9], 0x26
mov byte [ebp - 0x1f8], 0xd
mov byte [ebp - 0x1f7], 0x32
mov byte [ebp - 0x1f6], 0xc
mov byte [ebp - 0x1f5], 0x24
mov byte [ebp - 0x1f4], 8
mov byte [ebp - 0x1f3], 0x1c
mov byte [ebp - 0x1f2], 1
mov byte [ebp - 0x1f1], 0x1d
mov byte [ebp - 0x1f0], 2
mov byte [ebp - 0x1ef], 0x17
mov byte [ebp - 0x1ee], 7
mov byte [ebp - 0x1ed], 0x17
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x208]
and eax, 0x8b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x208]
or ecx, 0x8b
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x208]
mov byte [ebp + eax - 0xa40], cl
mov dword [ebp - 0xec], 0x2751c76d
mov dword [ebp - 0x298], 0x22515546
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x20], 0xffffffff
push 3
lea ecx, [ebp - 0xc50]
call fcn.10020368
mov dword [ebp - 4], 0x19
push 3
lea ecx, [ebp - 0xd48]
call fcn.10020368
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xe98], 0x3fccfb42
mov dword [ebp - 0x2c], 0
jmp 0x10019de4
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10019e00
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc50]
call fcn.100203e6
mov dword [eax], 0xfffffff7
jmp 0x10019ddd
mov dword [ebp - 0x2c], 0
jmp 0x10019e10
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10019e26
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xfcc], 0x3783
jmp 0x10019e09
mov dword [ebp - 0x2c], 0
jmp 0x10019e36
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10019e52
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd48]
call fcn.100203e6
mov dword [eax], 0x7ddd
jmp 0x10019e2f
mov eax, 0x9b8b
test eax, eax
je 0x10019eca
mov dword [ebp - 0x298], 0x52bf3388
cmp dword [ebp - 0x298], 0
jne 0x10019e7a
mov dword [ebp - 0x8f8], 1
jmp 0x10019e81
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0xfffffffa
jb 0x10019e96
mov dword [ebp - 0xbfc], 1
jmp 0x10019e9d
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xea8], eax
cmp dword [ebp - 0xec], 0
je 0x10019eca
mov dword [ebp - 0x698], 1
jmp 0x10019ed1
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x698]
jge 0x10019eeb
mov dword [ebp - 0x830], 1
jmp 0x10019ef2
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xec]
jne 0x10019f18
mov dword [ebp - 0x6a0], 1
jmp 0x10019f1f
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x6a0], eax
jg 0x10019f37
cmp dword [ebp - 0x20], 0
je 0x1001a005
mov dword [ebp - 0x20], 0
jmp 0x10019f47
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
jl 0x1001a000
mov dword [ebp - 0xeb0], 0xffffffff
mov dword [ebp - 0x924], 0xfffe
mov dword [ebp - 0x2f4], 0
jmp 0x10019f7e
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x10019f9a
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x1044], 0x9f21c9b6
jmp 0x10019f71
mov dword [ebp - 0x3c], 2
jmp 0x10019faa
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10019fcc
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x10019fca
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10019fa3
mov dword [ebp - 0x3c], 0
jmp 0x10019fdc
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10019ffb
mov dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
jmp 0x10019fd5
jmp 0x10019f40
jmp 0x1001a369
mov dword [ebp - 0x54], 0x737a30b9
push 3
lea ecx, [ebp - 0xb90]
call fcn.10020368
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x6b8], 7
push 2
lea ecx, [ebp - 0xd18]
call fcn.10020368
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x70], 0
jmp 0x1001a048
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001a061
push dword [ebp - 0x70]
lea ecx, [ebp - 0xb90]
call fcn.100203e6
or dword [eax], 0xffffffff
jmp 0x1001a041
mov dword [ebp - 0x70], 0
jmp 0x1001a071
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001a08d
push dword [ebp - 0x70]
lea ecx, [ebp - 0xd18]
call fcn.100203e6
mov dword [eax], 0xcc19ab5a
jmp 0x1001a06a
cmp dword [ebp - 0x298], 0
je 0x1001a09c
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf3c], eax
push 6
pop eax
cmp eax, 0xc9ff7503
jae 0x1001a0bb
mov dword [ebp - 0x6a8], 1
jmp 0x1001a0c2
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0x5685e9d0
jle 0x1001a0da
mov dword [ebp - 0x838], 1
jmp 0x1001a0e1
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x20]
imul esi, eax, 0xfff6
push 1
lea ecx, [ebp - 0xb90]
call fcn.100203e6
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xf4c], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xfcc], 1
mov eax, dword [ebp - 0x54]
dec eax
cmp eax, 2
jbe 0x1001a143
mov eax, 0xffff
test eax, eax
jne 0x1001a143
and dword [ebp - 0x6b0], 0
jmp 0x1001a14d
mov dword [ebp - 0x6b0], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6b0], eax
jl 0x1001a164
mov dword [ebp - 0x900], 1
jmp 0x1001a16b
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0xec]
jle 0x1001a191
mov dword [ebp - 0x840], 1
jmp 0x1001a198
and dword [ebp - 0x840], 0
mov esi, dword [ebp - 0x20]
push 1
lea ecx, [ebp - 0xc50]
call fcn.100203e6
mov ecx, dword [ebp - 0x840]
imul ecx, dword [eax]
sub ecx, 0xcec3
cmp ecx, esi
jle 0x1001a1c7
mov dword [ebp - 0x6c0], 1
jmp 0x1001a1ce
and dword [ebp - 0x6c0], 0
push 0
lea ecx, [ebp - 0xc50]
call fcn.100203e6
mov ecx, dword [ebp - 0x6c0]
cmp ecx, dword [eax]
jl 0x1001a1f1
mov dword [ebp - 0x6c8], 1
jmp 0x1001a1f8
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x92c], eax
push 2
lea ecx, [ebp - 0xb90]
call fcn.100203e6
mov ecx, dword [ebp - 0x92c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x92c]
cmp eax, dword [ebp - 0x6c8]
jle 0x1001a230
mov dword [ebp - 0x848], 1
jmp 0x1001a237
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x848], eax
jge 0x1001a24e
mov dword [ebp - 0x6d0], 1
jmp 0x1001a255
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x6d0], eax
je 0x1001a26f
mov dword [ebp - 0x90c], 1
jmp 0x1001a276
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0x3552
jne 0x1001a28e
mov dword [ebp - 0x6d8], 1
jmp 0x1001a295
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6d8], eax
jle 0x1001a2ac
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xd48]
call fcn.100203ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.100203ca
mov dword [ebp - 0x5c], 2
and dword [ebp - 0x404], 0
jmp 0x1001a39f
mov eax, dword [ebp - 0x5c]
inc eax
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1c
jae 0x1001a59c
mov dword [ebp - 0xcbc], 0x3dd33a4a
mov dword [ebp - 0xcb8], 0x3dd33a4a
mov dword [ebp - 0xcb4], 0x3dd33a4a
mov dword [ebp - 0xcb0], 0x3dd33a4a
lea ecx, [ebp - 0x399]
call fcn.100203f5
push eax
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xcbc]
push eax
lea ecx, [ebp - 0x104c]
call fcn.100203f8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xffc]
call fcn.100203a4
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2fc], 3
jmp 0x1001a430
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0
jl 0x1001a500
push 3
lea ecx, [ebp - 0xba0]
call fcn.10020368
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x2a0], 0
jmp 0x1001a467
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x1001a486
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xba0]
call fcn.100203e6
or dword [eax], 0xffffffff
jmp 0x1001a45a
push 1
lea ecx, [ebp - 0xba0]
call fcn.100203e6
and dword [eax], 0
jmp 0x1001a4bc
push 1
lea ecx, [ebp - 0xba0]
call fcn.100203e6
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6e8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xba0]
call fcn.100203e6
cmp dword [eax], 3
jg 0x1001a4ec
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x1001a4ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x1001a498
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xba0]
call fcn.100203ca
jmp 0x1001a423
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xffc]
call fcn.100203ca
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x404]
movzx eax, byte [ebp + eax - 0x20a]
movsx eax, byte [ebp + eax - 0xa40]
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x207]
and ecx, eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x404]
movzx eax, byte [ebp + eax - 0x20a]
movsx eax, byte [ebp + eax - 0xa40]
mov edx, dword [ebp - 0x5c]
movzx edx, byte [ebp + edx - 0x207]
and edx, eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x404]
movzx eax, byte [ebp + eax - 0x20a]
movsx eax, byte [ebp + eax - 0xa40]
mov esi, dword [ebp - 0x5c]
movzx ebx, byte [ebp + esi - 0x207]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x208]
mov byte [ebp + eax - 0xa40], bl
jmp 0x1001a397
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xa40], 0
lea eax, [ebp - 0xa40]
push eax
lea ecx, [ebp - 0x107c]
call fcn.100202d1
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0xa98], eax
mov dword [ebp - 4], 0x1f
mov edx, dword [ebp - 0x858]
mov ecx, dword [ebp - 0xa98]
call fcn.1000a868
mov dword [0x106d85a4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x107c]
call fcn.100202f4
and dword [ebp - 0x304], 0
jmp 0x1001a610
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0xf
jae 0x1001a69f
mov dword [ebp - 0xf64], 1
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1001a649
push 0xc66
push 0x2693
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1001a68c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1471
push 0x1afd
push 0x2081
push 0x249c
push 0x1c1f
call dword [sym.imp.GDI32.dll_CreateFontA]
mov eax, dword [ebp - 0x304]
mov byte [ebp + eax - 0xa40], 0
jmp 0x1001a603
mov dword [ebp - 0x15c], 0xbac64a68
mov dword [ebp - 0xf6c], 0
mov dword [ebp - 0x314], 0x133f29c8
mov dword [ebp - 0x3e4], 0xfffffffc
mov dword [ebp - 0x3ac], 3
mov dword [ebp - 0x2a8], 0
jmp 0x1001a6ea
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x1001a706
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xff0], 0xfffffff7
jmp 0x1001a6dd
mov dword [ebp - 0x15c], 0
jmp 0x1001a71f
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x1d
jg 0x1001a924
mov dword [ebp - 0x6f0], 6
mov dword [ebp - 0xbb0], 0x512a30a4
mov dword [ebp - 0xf80], 1
mov dword [ebp - 0x718], 0xfffffffc
mov dword [ebp - 0xaa4], 1
mov dword [ebp - 0xf8c], 0x5c82f744
mov dword [ebp - 0x30c], 0
jmp 0x1001a781
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 3
jge 0x1001a79d
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x10a0], 0x22401dbd
jmp 0x1001a774
cmp dword [ebp - 0x6f0], 0
jne 0x1001a81b
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0x6f0]
dec ecx
mov edx, dword [ebp - 0x3ac]
inc edx
mov dword [ebp - 0x3ac], edx
cmp ecx, eax
jne 0x1001a7d9
cmp dword [ebp - 0xbb0], 0x8d36
jg 0x1001a7d9
and dword [ebp - 0x93c], 0
jmp 0x1001a7e3
mov dword [ebp - 0x93c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax - 0xff0], ecx
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xf88], eax
or eax, 0xffffffff
sub eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x314]
jne 0x1001a81b
and dword [ebp - 0x6f8], 0
jmp 0x1001a825
mov dword [ebp - 0x6f8], 1
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x6f8], eax
jge 0x1001a83f
mov dword [ebp - 0x860], 1
jmp 0x1001a846
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x860], eax
jle 0x1001a860
mov dword [ebp - 0x700], 1
jmp 0x1001a867
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0xaa4]
je 0x1001a88d
mov dword [ebp - 0x918], 1
jmp 0x1001a894
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 5
je 0x1001a8a9
mov dword [ebp - 0x708], 1
jmp 0x1001a8b0
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x708]
jne 0x1001a8ca
mov dword [ebp - 0x868], 1
jmp 0x1001a8d1
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x868], eax
je 0x1001a8eb
mov dword [ebp - 0x710], 1
jmp 0x1001a8f2
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x718]
cmp dword [ebp - 0x710], eax
jle 0x1001a90c
mov dword [ebp - 0x994], 1
jmp 0x1001a913
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x718], eax
jmp 0x1001a712
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1001a942
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov eax, dword [0x10614f8c]
cmp eax, dword [ebp - 0x27c]
je 0x1001a95c
mov eax, dword [0x106d85a4]
cmp eax, dword [ebp - 0x27c]
jne 0x1001a974
mov ecx, dword [ebp + 0xc]
call fcn.10020108
push eax
push dword [ebp + 8]
call fcn.100116bf
pop ecx
pop ecx
jmp 0x1001de27
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x128], 0xdb50
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0xf58], 0xffffffff
mov dword [ebp - 0xbf8], 0xfffffff7
mov dword [ebp - 0x3c4], 0xfffffffe
mov dword [ebp - 0xf60], 0xffffffff
mov dword [ebp - 0xbf0], 0xaca62e26
mov dword [ebp - 0xf7c], 0
mov dword [ebp - 0xac4], 0xffffffff
mov dword [ebp - 0xd74], 0xbff7828e
mov dword [ebp - 0xab0], 0x489718b2
mov dword [ebp - 0xbb8], 0xfffffffa
mov dword [ebp - 0xe94], 7
mov dword [ebp - 0x3fc], 0xb13f
mov dword [ebp - 0xacc], 0xfffffffa
mov dword [ebp - 0x340], 0
jmp 0x1001aa4a
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x1001aa66
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x3b8], 0xfffffffc
jmp 0x1001aa3d
cmp dword [ebp - 0x128], 1
jl 0x1001aa7b
mov dword [ebp - 0x870], 1
jmp 0x1001aa82
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x720]
jg 0x1001aaa8
mov dword [ebp - 0x920], 1
jmp 0x1001aaaf
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x920], eax
je 0x1001ac1b
mov dword [ebp - 0x144], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x144]
jg 0x1001aaf1
mov dword [ebp - 0x728], 1
jmp 0x1001aaf8
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x728]
cmp eax, dword [ebp - 0xf4]
jle 0x1001ab18
mov dword [ebp - 0x414], 1
jmp 0x1001ab1f
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x414]
jne 0x1001ab3d
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1001ab3d
and dword [ebp - 0x730], 0
jmp 0x1001ab47
mov dword [ebp - 0x730], 1
mov eax, dword [ebp - 0x730]
sub eax, dword [ebp - 0x128]
je 0x1001ab6a
cmp dword [ebp - 0x144], 0
je 0x1001ab6a
mov dword [ebp - 0x960], 1
jmp 0x1001ab71
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x960], eax
jne 0x1001ab8b
mov dword [ebp - 0x738], 1
jmp 0x1001ab92
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0x738], eax
jne 0x1001abb5
mov eax, 0x82bc9063
test eax, eax
je 0x1001abb5
mov dword [ebp - 0x4ac], 1
jmp 0x1001abbc
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x4ac], eax
jne 0x1001abd6
mov dword [ebp - 0x4b4], 1
jmp 0x1001abdd
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x144], eax
jl 0x1001abfd
mov dword [ebp - 0x4bc], 1
jmp 0x1001ac04
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
sub eax, dword [ebp - 0x144]
mov dword [ebp - 0x4c4], eax
jmp 0x1001ace0
mov dword [ebp - 0xf38], 0xfffffff9
mov dword [ebp - 0xd68], 1
mov dword [ebp - 0xe9c], 5
mov dword [ebp - 0xd8c], 1
mov dword [ebp - 0xf68], 4
mov dword [ebp - 0xd94], 0xfffffff9
push 2
lea ecx, [ebp - 0xef0]
call fcn.10020368
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xea4], 0xfffffffe
mov dword [ebp - 0xd9c], 0x1f6e690d
mov dword [ebp - 0xf40], 0xffffffff
mov dword [ebp - 0x20c], 0
jmp 0x1001aca2
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1001acc4
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xef0]
call fcn.100203e6
mov dword [eax], 0xe7e5ff1f
jmp 0x1001ac95
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.100203ca
mov eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0xab0]
jle 0x1001acfa
mov dword [ebp - 0x4e4], 1
jmp 0x1001ad01
and dword [ebp - 0x4e4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b8], 0xac9c
jne 0x1001ad20
mov dword [ebp - 0x4cc], 1
jmp 0x1001ad27
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 1
jne 0x1001ad3c
mov dword [ebp - 0x4d4], 1
jmp 0x1001ad43
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 6
ja 0x1001ad58
mov dword [ebp - 0x4dc], 1
jmp 0x1001ad5f
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0xbb8]
cmp dword [ebp - 0x4dc], eax
jg 0x1001ad79
mov dword [ebp - 0x4ec], 1
jmp 0x1001ad80
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x4ec]
jl 0x1001ad9a
mov dword [ebp - 0xabc], 1
jmp 0x1001ada1
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0x4fc], 0
je 0x1001adbf
cmp dword [ebp - 0xf4], 0
je 0x1001adbf
mov dword [ebp - 0x4f4], 1
jmp 0x1001adc6
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f4]
sub ecx, dword [ebp + eax - 0x3b8]
je 0x1001ade7
mov dword [ebp - 0xc10], 1
jmp 0x1001adee
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xda4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xac4]
cmp ecx, dword [ebp + eax - 0x3b8]
jg 0x1001ae1b
mov dword [ebp - 0x504], 1
jmp 0x1001ae22
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp - 0x504], eax
jl 0x1001ae42
cmp dword [ebp - 0x128], 0
jne 0x1001ae42
and dword [ebp - 0x50c], 0
jmp 0x1001ae4c
mov dword [ebp - 0x50c], 1
cmp dword [ebp - 0x50c], 0x21d6ffc8
jne 0x1001ae64
mov dword [ebp - 0xbc0], 1
jmp 0x1001ae6b
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0xbf8]
jge 0x1001ae91
mov dword [ebp - 0x514], 1
jmp 0x1001ae98
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x514]
imul eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x2b8], 0
je 0x1001dbbf
mov eax, dword [ebp - 0x2b8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001dbbf
push 2
lea ecx, [ebp - 0xc68]
call fcn.10020368
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x51c], 0xffffffff
mov dword [ebp - 0x74], 0
jmp 0x1001af29
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1001af42
push dword [ebp - 0x74]
lea ecx, [ebp - 0xc68]
call fcn.100203e6
and dword [eax], 0
jmp 0x1001af22
mov dword [ebp - 0x74], 0
jmp 0x1001af52
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1001af68
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xe6c], 0x461e7071
jmp 0x1001af4b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x354], 1
jmp 0x1001af96
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x354], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x354], 0
jl 0x1001b1cc
mov dword [ebp - 0x3ec], 4
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1001afd0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x354]
lea ecx, [ebp - 0xc68]
call fcn.100203e6
mov dword [ebp - 0x524], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x354]
lea ecx, [ebp - 0xc68]
call fcn.100203e6
mov ecx, dword [ebp - 0x524]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x524]
cmp dword [ecx], eax
je 0x1001b03f
mov dword [ebp - 0x564], 1
jmp 0x1001b046
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x3ec], 0
jne 0x1001b068
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x354], 0
jne 0x1001b068
and dword [ebp - 0x52c], 0
jmp 0x1001b072
mov dword [ebp - 0x52c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp eax, dword [ebp - 0x52c]
jl 0x1001b093
mov dword [ebp - 0x534], 1
jmp 0x1001b09a
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp eax, dword [ebp - 0x534]
je 0x1001b0bb
mov dword [ebp - 0x53c], 1
jmp 0x1001b0c2
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 6
jle 0x1001b0d7
mov dword [ebp - 0x544], 1
jmp 0x1001b0de
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x544], eax
je 0x1001b0ff
mov dword [ebp - 0x54c], 1
jmp 0x1001b106
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x54c], eax
jne 0x1001b127
mov dword [ebp - 0x554], 1
jmp 0x1001b12e
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xffff
jb 0x1001b146
mov dword [ebp - 0xad4], 1
jmp 0x1001b14d
and dword [ebp - 0xad4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x55c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x55c]
mov dword [ebp + eax - 0xe6c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x55c]
sub ecx, dword [ebp + eax - 0x354]
cmp dword [ebp - 0x564], ecx
je 0x1001b1a6
mov dword [ebp - 0x56c], 1
jmp 0x1001b1ad
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x56c]
dec ecx
sub ecx, dword [ebp + eax - 0x354]
mov dword [ebp - 0x3ec], ecx
jmp 0x1001af7b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc68]
call fcn.100203ca
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x2b8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x584], 0xf69f
mov dword [ebp - 0x57c], 0x14b733c6
mov dword [ebp - 0xc20], 1
mov dword [ebp - 0x574], 0x359b
mov dword [ebp - 0xbc8], 0x10007ea8
cmp dword [ebp - 0x574], 0x387f
jle 0x1001b30b
and dword [ebp - 0x2c8], 0
jmp 0x1001b248
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x2cf2
jge 0x1001b30b
and dword [ebp - 0x308], 0
jmp 0x1001b26e
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x751f
jge 0x1001b306
and dword [ebp - 0x2c0], 0
jmp 0x1001b294
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x8eb
jge 0x1001b301
and dword [ebp - 0x344], 0
jmp 0x1001b2b6
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x173b
jge 0x1001b2ff
mov eax, dword [ebp - 0x308]
add eax, dword [ebp - 0x2c0]
and eax, dword [ebp - 0x344]
or eax, dword [ebp - 0x2c8]
cdq
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa9c], edx
push dword [ebp - 0xa9c]
push dword [ebp - 0xaa0]
mov ecx, 0x10613e58
call fcn.10020128
jmp 0x1001b2a9
jmp 0x1001b287
jmp 0x1001b261
jmp 0x1001b23b
mov dword [ebp - 0x310], 0x6ff6
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x574], 0x32e5
jge 0x1001b338
mov edx, dword [ebp - 0xbc8]
mov ecx, 0x10613e58
call fcn.10022a20
jmp 0x1001b354
or dword [ebp - 4], 0xffffffff
jmp 0x1001b35e
mov dword [ebp - 0x5b4], 0xffffffff
mov dword [ebp - 0x5cc], 0
mov dword [ebp - 0xae4], 6
mov dword [ebp - 0x7c], 0
jmp 0x1001b38c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001b3a2
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xaac], 0x758e
jmp 0x1001b385
mov dword [ebp - 0x7c], 0
jmp 0x1001b3b2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1001b3c8
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xadc], 1
jmp 0x1001b3ab
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001b3ee
push 1
push 0
push 0xcd2
push 0x24da
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0x2d1
jl 0x1001b412
mov dword [ebp - 0x5dc], 1
jmp 0x1001b419
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x584]
cmp ecx, dword [ebp + eax - 0xaac]
jge 0x1001b43a
mov dword [ebp - 0x58c], 1
jmp 0x1001b441
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0xffffffff
jg 0x1001b456
mov dword [ebp - 0x594], 1
jmp 0x1001b45d
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x310]
imul eax, dword [ebp - 0x594]
imul eax, eax, 0xffff
mov dword [ebp - 0x59c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x59c]
mov dword [ebp + eax - 0xadc], ecx
cmp dword [ebp - 0x59c], 0x2e88
jle 0x1001b4a1
mov dword [ebp - 0x5a4], 1
jmp 0x1001b4a8
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x310]
add eax, dword [ebp - 0x5a4]
cmp eax, 0xfffffffd
jle 0x1001b4c5
mov dword [ebp - 0x5ac], 1
jmp 0x1001b4cc
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b4], eax
mov eax, 0x49d585ed
sub eax, dword [ebp - 0x5b4]
cmp eax, 0xfffffffa
jne 0x1001b4f4
mov dword [ebp - 0x5bc], 1
jmp 0x1001b4fb
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x5bc]
cmp eax, dword [ebp - 0x310]
je 0x1001b51b
mov dword [ebp - 0x5c4], 1
jmp 0x1001b522
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0
je 0x1001b553
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaac], 0
je 0x1001b553
mov dword [ebp - 0x5d4], 1
jmp 0x1001b55a
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
cmp dword [ebp - 0x5d4], eax
je 0x1001b57b
mov dword [ebp - 0x5e4], 1
jmp 0x1001b582
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5dc]
add eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0x310]
jne 0x1001b5a2
mov dword [ebp - 0x5ec], 1
jmp 0x1001b5a9
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x1bc]
cmp dword [eax], 0x4550
jne 0x1001dbbf
mov eax, dword [ebp - 0x1bc]
cmp dword [eax + 0x74], 0
jbe 0x1001dbbf
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
cmp dword [ecx + eax + 0x78], 0
je 0x1001dbbf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x14], 0x3629aa81
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0xaec], 0
mov dword [ebp - 0x130], 1
mov dword [ebp - 0xd64], 0x4045
mov dword [ebp - 0xd60], 0x4045
mov dword [ebp - 0xd5c], 0x4045
mov dword [ebp - 0xd58], 0x4045
mov dword [ebp - 0x2d0], 0
jmp 0x1001b65d
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1001b679
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xab8], 1
jmp 0x1001b650
mov eax, 0x5890
test eax, eax
je 0x1001b760
cmp dword [ebp - 0x14], 0
je 0x1001b6a1
mov eax, 0x40826f39
test eax, eax
je 0x1001b6a1
mov dword [ebp - 0xbd0], 1
jmp 0x1001b6a8
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x1001b6c8
mov dword [ebp - 0x5f4], 1
jmp 0x1001b6cf
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5f4], eax
je 0x1001b6e6
mov dword [ebp - 0x5fc], 1
jmp 0x1001b6ed
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0xd383
jl 0x1001b705
mov dword [ebp - 0x604], 1
jmp 0x1001b70c
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x604], eax
jg 0x1001b723
mov dword [ebp - 0x60c], 1
jmp 0x1001b72a
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x60c]
jl 0x1001b741
mov dword [ebp - 0x614], 1
jmp 0x1001b748
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xf1edd1ed
jb 0x1001b760
mov dword [ebp - 0x61c], 1
jmp 0x1001b767
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xbe2d3d47
jb 0x1001b77f
mov dword [ebp - 0x624], 1
jmp 0x1001b786
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x624]
cmp eax, 0xa2ff
jge 0x1001b7a3
mov dword [ebp - 0x62c], 1
jmp 0x1001b7aa
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x62c], eax
jl 0x1001b7c1
mov dword [ebp - 0x634], 1
jmp 0x1001b7c8
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
imul eax, dword [ebp - 0xaec]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x1001b7f5
mov dword [ebp - 0xc00], 1
jmp 0x1001b7fc
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0x14], 4
jle 0x1001b81a
mov dword [ebp - 0x63c], 1
jmp 0x1001b821
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x63c]
jne 0x1001b838
mov dword [ebp - 0x644], 1
jmp 0x1001b83f
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
sub eax, 0xdfee
cmp eax, dword [ebp - 0x130]
jl 0x1001b85e
mov dword [ebp - 0x64c], 1
jmp 0x1001b865
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, 1
je 0x1001b884
mov dword [ebp - 0x654], 1
jmp 0x1001b88b
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0xfffffff9
jae 0x1001b8a0
mov dword [ebp - 0x65c], 1
jmp 0x1001b8a7
and dword [ebp - 0x65c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x65c]
mov dword [ebp + eax - 0xab8], ecx
mov dword [ebp - 0x130], 0x16
jmp 0x1001b8d3
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffb
jg 0x1001b96f
mov dword [ebp - 0xbd8], 0x8236511f
mov dword [ebp - 0xafc], 0x254764fe
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3cc]
cmp ecx, dword [ebp + eax - 0xab8]
jl 0x1001b915
mov dword [ebp - 0xaf4], 1
jmp 0x1001b91c
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xeb4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd64], 0
jne 0x1001b944
mov dword [ebp - 0x664], 1
jmp 0x1001b94b
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xab8], eax
mov dword [ebp - 0xafc], 0xffffffff
jmp 0x1001b8c6
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xdbc], 0x5e7a
mov dword [ebp - 0xf48], 0xa87013dc
mov dword [ebp - 0xdc4], 5
mov dword [ebp - 0xec4], 3
mov dword [ebp - 0x66c], 0xd2ab
mov dword [ebp - 0x33c], 0
jmp 0x1001b9d6
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x1001b9f2
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x10c8], 0x3ff82ff4
jmp 0x1001b9c9
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1001ba16
push 0x1de5
push 0
push 0x1f51
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
mov eax, 0xffff
mov word [ebp - 0x78], ax
or dword [ebp - 0x150], 0xffffffff
push 4
lea ecx, [ebp - 0x36c]
call fcn.10020368
mov dword [ebp - 4], 0x24
mov dword [ebp - 0xdcc], 0xd4e677b5
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0x28], 0
jmp 0x1001ba6b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001ba81
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9d8], 0xd7f825e7
jmp 0x1001ba64
mov dword [ebp - 0x28], 0
jmp 0x1001ba91
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1001baad
push dword [ebp - 0x28]
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov dword [eax], 6
jmp 0x1001ba8a
mov dword [ebp - 0x28], 0
jmp 0x1001babd
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001bad3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3b4], 3
jmp 0x1001bab6
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001baf4
push 1
push 0
push 0x14b9
call dword [sym.imp.GDI32.dll_SelectPalette]
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
and dword [eax], 0
jmp 0x1001bb2a
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x674]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
cmp dword [eax], 2
jg 0x1001be29
mov dword [ebp - 0xf70], 0x66e58d02
mov dword [ebp - 0x6cc], 4
mov dword [ebp - 0xc18], 0x35e1f6f0
mov dword [ebp - 0xdd4], 0x456160cb
mov dword [ebp - 0x40c], 0xffffffff
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9d8]
mov dword [ebp - 0xed4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9d8], 0
je 0x1001bd13
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x9d8]
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov eax, dword [eax]
mov edi, dword [ebp + eax*4 - 0x9d8]
push 1
lea ecx, [ebp - 0x36c]
call fcn.100203e6
imul edi, dword [eax]
imul edi, esi
cmp edi, 0xffffffff
jge 0x1001bbf2
mov dword [ebp - 0x67c], 1
jmp 0x1001bbf9
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0
jbe 0x1001bc0e
mov dword [ebp - 0x684], 1
jmp 0x1001bc15
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d8]
cmp dword [ebp - 0x684], eax
jg 0x1001bc36
mov dword [ebp - 0x68c], 1
jmp 0x1001bc3d
and dword [ebp - 0x68c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x68c], eax
jl 0x1001bc5e
mov dword [ebp - 0x694], 1
jmp 0x1001bc65
and dword [ebp - 0x694], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x694], eax
jne 0x1001bc86
mov dword [ebp - 0x69c], 1
jmp 0x1001bc8d
and dword [ebp - 0x69c], 0
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9d8]
cmp dword [ebp - 0x69c], eax
jg 0x1001bcb7
mov dword [ebp - 0x6a4], 1
jmp 0x1001bcbe
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 1
jg 0x1001bcd3
mov dword [ebp - 0x6ac], 1
jmp 0x1001bcda
and dword [ebp - 0x6ac], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x6cc]
add esi, dword [ebp - 0x6ac]
sub esi, dword [ebp + eax - 0x3b4]
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
imul esi, dword [eax]
neg esi
je 0x1001bd13
mov dword [ebp - 0x6b4], 1
jmp 0x1001bd1a
and dword [ebp - 0x6b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b4]
cmp dword [ebp - 0x6b4], eax
jl 0x1001bd3b
mov dword [ebp - 0x6bc], 1
jmp 0x1001bd42
and dword [ebp - 0x6bc], 0
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
mov ecx, dword [ebp - 0x6bc]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001bd63
cmp dword [ebp - 0xc18], 0
push 2
lea ecx, [ebp - 0x36c]
call fcn.100203e6
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3b4]
cmp ecx, dword [ebp + eax - 0x3b4]
jge 0x1001bd98
mov dword [ebp - 0x6c4], 1
jmp 0x1001bd9f
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0xb04]
cmp eax, dword [ebp - 0xbe0]
jg 0x1001bdde
mov dword [ebp - 0x6d4], 1
jmp 0x1001bde5
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x6d4], eax
jle 0x1001bdff
mov dword [ebp - 0x6dc], 1
jmp 0x1001be06
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0xb0c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b4], 0
je 0x1001be24
jmp 0x1001be29
jmp 0x1001bb06
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.100203ca
cmp dword [ebp + 0x10], 0
jbe 0x1001c2e8
mov dword [ebp - 0x2d8], 0x48bbca63
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1001be68
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x2d8], 0xfffffff2
jmp 0x1001be81
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xf
jne 0x1001bec4
mov dword [ebp - 0x6e4], 0x1265
mov eax, dword [ebp - 0x6e4]
inc eax
mov dword [ebp - 0x6e4], eax
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001bec2
push 1
push 0
push 0x1e5b
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x1001be74
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001c2e3
push 4
lea ecx, [ebp - 0x378]
call fcn.10020368
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xddc], 0xd4e677b5
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0x34], 0
jmp 0x1001bf0e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1001bf24
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x9e4], 0xd7f825e7
jmp 0x1001bf07
mov dword [ebp - 0x34], 0
jmp 0x1001bf34
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1001bf50
push dword [ebp - 0x34]
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov dword [eax], 6
jmp 0x1001bf2d
mov dword [ebp - 0x34], 0
jmp 0x1001bf60
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1001bf76
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3c0], 3
jmp 0x1001bf59
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x1001bf97
push 1
push 0
push 0x14b9
call dword [sym.imp.GDI32.dll_SelectPalette]
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
and dword [eax], 0
jmp 0x1001bfcd
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x6ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6ec]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
cmp dword [eax], 2
jg 0x1001c2cc
mov dword [ebp - 0xf50], 0x66e58d02
mov dword [ebp - 0x744], 4
mov dword [ebp - 0xc08], 0x35e1f6f0
mov dword [ebp - 0xde4], 0x456160cb
mov dword [ebp - 0x3d4], 0xffffffff
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9e4]
mov dword [ebp - 0xee4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9e4], 0
je 0x1001c1b6
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x9e4]
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov eax, dword [eax]
mov edi, dword [ebp + eax*4 - 0x9e4]
push 1
lea ecx, [ebp - 0x378]
call fcn.100203e6
imul edi, dword [eax]
imul edi, esi
cmp edi, 0xffffffff
jge 0x1001c095
mov dword [ebp - 0x6f4], 1
jmp 0x1001c09c
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0
jbe 0x1001c0b1
mov dword [ebp - 0x6fc], 1
jmp 0x1001c0b8
and dword [ebp - 0x6fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
cmp dword [ebp - 0x6fc], eax
jg 0x1001c0d9
mov dword [ebp - 0x704], 1
jmp 0x1001c0e0
and dword [ebp - 0x704], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x704], eax
jl 0x1001c101
mov dword [ebp - 0x70c], 1
jmp 0x1001c108
and dword [ebp - 0x70c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x70c], eax
jne 0x1001c129
mov dword [ebp - 0x714], 1
jmp 0x1001c130
and dword [ebp - 0x714], 0
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9e4]
cmp dword [ebp - 0x714], eax
jg 0x1001c15a
mov dword [ebp - 0x71c], 1
jmp 0x1001c161
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 1
jg 0x1001c176
mov dword [ebp - 0x724], 1
jmp 0x1001c17d
and dword [ebp - 0x724], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x744]
add esi, dword [ebp - 0x724]
sub esi, dword [ebp + eax - 0x3c0]
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
imul esi, dword [eax]
neg esi
je 0x1001c1b6
mov dword [ebp - 0x72c], 1
jmp 0x1001c1bd
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x72c], eax
jl 0x1001c1de
mov dword [ebp - 0x734], 1
jmp 0x1001c1e5
and dword [ebp - 0x734], 0
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
mov ecx, dword [ebp - 0x734]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001c206
cmp dword [ebp - 0xc08], 0
push 2
lea ecx, [ebp - 0x378]
call fcn.100203e6
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3c0]
cmp ecx, dword [ebp + eax - 0x3c0]
jge 0x1001c23b
mov dword [ebp - 0x73c], 1
jmp 0x1001c242
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xb14]
cmp eax, dword [ebp - 0xbe8]
jg 0x1001c281
mov dword [ebp - 0x74c], 1
jmp 0x1001c288
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x74c], eax
jle 0x1001c2a2
mov dword [ebp - 0x754], 1
jmp 0x1001c2a9
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xb1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c0], 0
je 0x1001c2c7
jmp 0x1001c2cc
jmp 0x1001bfa9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.100203ca
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x78], ax
jmp 0x1001d4b8
mov dword [ebp - 0xdec], 0xffffffff
mov dword [ebp - 0xf74], 0xffffffff
mov dword [ebp - 0x76c], 0x2f23d37f
mov dword [ebp - 0x84], 0
jmp 0x1001c31f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1001c33b
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x908], 0xa48bbca6
jmp 0x1001c312
mov dword [ebp - 0x84], 0
jmp 0x1001c354
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001c370
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x764], 0x90a6
jmp 0x1001c347
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x908], 0
jmp 0x1001c39e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x908]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x908], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x908], 0xfffffff7
je 0x1001c543
mov dword [ebp - 0x17c], 0xae77ab39
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x908]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x764], eax
mov dword [ebp - 0x17c], 0
jmp 0x1001c3ef
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1001c53e
push 4
lea ecx, [ebp - 0xa14]
call fcn.10020368
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x318], 0
jmp 0x1001c429
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 4
jge 0x1001c44b
push dword [ebp - 0x318]
lea ecx, [ebp - 0xa14]
call fcn.100203e6
mov dword [eax], 0xe4d9edbd
jmp 0x1001c41c
push 2
lea ecx, [ebp - 0xa14]
call fcn.100203e6
and dword [eax], 0
jmp 0x1001c481
push 2
lea ecx, [ebp - 0xa14]
call fcn.100203e6
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x75c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xa14]
call fcn.100203e6
cmp dword [eax], 0
jg 0x1001c509
mov dword [ebp - 0x2e0], 0x418a5273
mov dword [ebp - 0x2e0], 0
jmp 0x1001c4b6
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jl 0x1001c4de
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1001c4dc
push 0x2484
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1001c4a9
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1001c504
push 0
push 0
push 0x21d6
push 0x119e
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x1001c45d
mov eax, dword [ebp - 0x17c]
cmp dword [ebp + eax*4 - 0x764], 0
je 0x1001c52a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa14]
call fcn.100203ca
jmp 0x1001c53e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa14]
call fcn.100203ca
jmp 0x1001c3e2
jmp 0x1001c383
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
mov eax, dword [0x106d8554]
and eax, 1
jne 0x1001c587
mov eax, dword [0x106d8554]
or eax, 1
mov dword [0x106d8554], eax
mov dword [ebp - 4], 0x27
mov ecx, 0x106d85a8
call fcn.1002040c
push 0x1006cbc3
call fcn.10054585
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x334], 0x834504cd
cmp dword [ebp - 0x334], 0
je 0x1001c5c6
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1001c5c1
push 0xa5d
push 0x483
push 0x775
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1001c680
mov dword [ebp - 0x77c], 0x7563ffa
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001c5ee
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [ebp - 0x334], 0
je 0x1001c651
cmp dword [ebp - 0x334], 0x2513
jg 0x1001c60f
mov dword [ebp - 0x774], 1
jmp 0x1001c616
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0x774], eax
jl 0x1001c630
mov dword [ebp - 0x784], 1
jmp 0x1001c637
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0x784], eax
jg 0x1001c651
mov dword [ebp - 0x78c], 1
jmp 0x1001c658
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 1
jle 0x1001c66d
mov dword [ebp - 0x794], 1
jmp 0x1001c674
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x334], eax
movzx eax, byte [0x10614f9a]
test eax, eax
je 0x1001c7ca
mov ecx, 0x106d85a8
call fcn.100204d1
movzx eax, al
test eax, eax
jne 0x1001c7ca
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x79c]
push eax
mov ecx, 0x106d85a8
call fcn.100204da
push 3
lea ecx, [ebp - 0xf00]
call fcn.10020368
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x214], 8
mov dword [ebp - 0x210], 0
jmp 0x1001c6f3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1001c715
push dword [ebp - 0x210]
lea ecx, [ebp - 0xf00]
call fcn.100203e6
mov dword [eax], 6
jmp 0x1001c6e6
mov dword [ebp - 0x214], 0
jmp 0x1001c72e
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jg 0x1001c783
mov dword [ebp - 0x21c], 0x69aed23b
mov dword [ebp - 0x21c], 0
jmp 0x1001c75a
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jg 0x1001c781
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x1001c77f
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1001c74d
jmp 0x1001c721
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.100203ca
lea eax, [ebp - 0xdf4]
push eax
mov ecx, 0x106d85a8
call fcn.100204c3
push eax
lea ecx, [ebp - 0x79c]
call fcn.10020355
movzx eax, al
test eax, eax
je 0x1001c7ca
lea ecx, [ebp - 0x79c]
call fcn.100204ef
mov eax, dword [eax + 4]
mov dword [ebp - 0x150], eax
push 2
lea ecx, [ebp - 0xce8]
call fcn.10020368
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x8c], 0
jmp 0x1001c7f7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1001c819
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xce8]
call fcn.100203e6
mov dword [eax], 0x1757
jmp 0x1001c7ea
mov dword [ebp - 0x8c], 0
jmp 0x1001c832
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1001c84e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc84], 0xdf1febae
jmp 0x1001c825
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xc84], 0
jmp 0x1001c87c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc84]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xc84], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc84], 2
jge 0x1001c8ac
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xc84]
lea ecx, [ebp - 0xce8]
call fcn.100203e6
mov dword [eax], 0xe324
jmp 0x1001c861
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce8]
call fcn.100203ca
cmp dword [ebp - 0x150], 0xffffffff
jne 0x1001d4b8
mov ecx, 0x106d85a8
call fcn.10020533
mov ecx, dword [ebp - 0xbc]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106d85a8
call fcn.10020537
mov dword [ebp - 0x22c], 1
push 3
lea ecx, [ebp - 0x9cc]
call fcn.10020368
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0xba8], 0xfffffffc
mov dword [ebp - 0x224], 0
jmp 0x1001c931
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1001c953
push dword [ebp - 0x224]
lea ecx, [ebp - 0x9cc]
call fcn.100203e6
mov dword [eax], 0xfffb
jmp 0x1001c924
mov dword [ebp - 0x22c], 0
jmp 0x1001c96c
mov eax, dword [ebp - 0x22c]
dec eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xfffffff3
jle 0x1001c998
push 1
lea ecx, [ebp - 0x9cc]
call fcn.100203e6
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xba8], eax
jmp 0x1001c95f
mov dword [ebp - 0xb4], 0
jmp 0x1001c9b1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jg 0x1001c9f8
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x9cc]
call fcn.100203e6
mov esi, eax
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x9cc]
call fcn.100203e6
mov eax, dword [eax]
mov dword [esi], eax
push 1
lea ecx, [ebp - 0x9cc]
call fcn.100203e6
cmp dword [eax], 0
je 0x1001c9f6
jmp 0x1001c9f8
jmp 0x1001c9a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9cc]
call fcn.100203ca
and dword [ebp - 0x140], 0
jmp 0x1001ca1d
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x140]
cmp ecx, dword [eax + 0x18]
jae 0x1001d4b8
mov dword [ebp - 0x234], 0xb110c93b
mov dword [ebp - 0xbac], 0
mov dword [ebp - 0x234], 0
jmp 0x1001ca5f
cmp dword [ebp - 0x234], 0xfffffff4
je 0x1001cab9
mov dword [ebp - 0x184], 0xdf98a59c
mov dword [ebp - 0x184], 0
jmp 0x1001ca8b
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x140]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0xbb4], 1
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x64]
jge 0x1001cb06
push 2
lea ecx, [ebp - 0xd24]
call fcn.10020368
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x1ac], 0x638ecf54
mov dword [ebp - 0x284], 0
jmp 0x1001d4ef
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x1001d511
push dword [ebp - 0x284]
lea ecx, [ebp - 0xd24]
call fcn.100203e6
mov dword [eax], 0x90da
jmp 0x1001d4e2
mov dword [ebp - 0x1ac], 1
jmp 0x1001d52a
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1001d5aa
mov dword [ebp - 0x148], 0xfffffff9
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1001d55c
push 0x1252
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x148], 0
jmp 0x1001d582
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x1001d5a5
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xd24]
call fcn.100203e6
cmp dword [eax], 0
je 0x1001d5a3
jmp 0x1001d5a5
jmp 0x1001d575
jmp 0x1001d51d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd24]
call fcn.100203ca
cmp dword [ebp + 0x10], 0
jne 0x1001d5e5
cmp dword [ebp - 0x150], 0xffffffff
je 0x1001d5e5
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x150]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x78], ax
mov dword [ebp - 0xbdc], 0x76038591
mov dword [ebp - 0x9c], 0
jmp 0x1001d608
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1001d624
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x1b4], 0xfff7
jmp 0x1001d5fb
mov dword [ebp - 0x9c], 0
jmp 0x1001d63d
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1001d659
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x9ac], 0xffffffff
jmp 0x1001d630
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9ac], 0
jmp 0x1001d687
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9ac], 0
jg 0x1001d779
mov dword [ebp - 0x50], 0x96dd1e1e
mov dword [ebp - 0x294], 0
jmp 0x1001dbdf
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x1001dbfb
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x1cc], 1
jmp 0x1001dbd2
mov dword [ebp - 0x50], 0
jmp 0x1001dc0b
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1001dc2d
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1001dc2b
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x1001dc04
mov dword [ebp - 0x50], 0
jmp 0x1001dc3d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x14
jle 0x1001de25
mov dword [ebp - 0x2a4], 0xffffffff
push 1
lea ecx, [ebp - 0xd3c]
call fcn.10020368
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x29c], 0
jmp 0x1001dc7e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1001dca0
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xd3c]
call fcn.100203e6
mov dword [eax], 0x335900b0
jmp 0x1001dc71
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x2a4]
jle 0x1001dcba
mov dword [ebp - 0x49c], 1
jmp 0x1001dcc1
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x50], 0
jg 0x1001dcd3
mov dword [ebp - 0x464], 1
jmp 0x1001dcda
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0x799333c7
jle 0x1001dcf2
mov dword [ebp - 0x46c], 1
jmp 0x1001dcf9
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
add eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x2a4]
jge 0x1001dd30
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0
je 0x1001dd30
mov dword [ebp - 0x474], 1
jmp 0x1001dd37
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x474], eax
jg 0x1001dd4e
mov dword [ebp - 0x47c], 1
jmp 0x1001dd55
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0x537c
je 0x1001dd6d
mov dword [ebp - 0x484], 1
jmp 0x1001dd74
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x484], eax
jge 0x1001dd95
mov dword [ebp - 0x48c], 1
jmp 0x1001dd9c
and dword [ebp - 0x48c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x48c], eax
jge 0x1001ddbd
mov dword [ebp - 0x494], 1
jmp 0x1001ddc4
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
imul eax, dword [ebp - 0x494]
neg eax
imul eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x49c], eax
je 0x1001ddf5
mov dword [ebp - 0x4a4], 1
jmp 0x1001ddfc
and dword [ebp - 0x4a4], 0
push 0
lea ecx, [ebp - 0xd3c]
call fcn.100203e6
mov ecx, dword [ebp - 0x4a4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd3c]
call fcn.100203ca
jmp 0x1001dc36
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret