Function at 0x1001abb9
Capabilities:
Accept command line arguments
Check os version
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064ad1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16f8
call fcn.10060b10
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100252f5
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xe70], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0xc40]
movzx eax, byte [eax]
test eax, eax
je 0x1001ac86
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xccc], eax
mov eax, dword [ebp - 0xcc4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xccc]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x100252f0
mov eax, dword [ebp - 0xe60]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xe70]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x74], 0x7bb1a88a
mov dword [ebp - 0x11c], 4
mov dword [ebp - 0x24], 0x5ec7e011
mov dword [ebp - 0x534], 0xffffffff
mov dword [ebp - 0x1fc], 0
jmp 0x1001acf8
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1001ad14
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x137c], 1
jmp 0x1001aceb
mov dword [ebp - 0x44], 0
jmp 0x1001ad24
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xc
je 0x1001b088
mov dword [ebp - 0x5c], 0xa12b57e8
mov dword [ebp - 0x5c], 0x19
jmp 0x1001ad45
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff0
jg 0x1001b083
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0xb8], 0x44adca1a
mov dword [ebp - 0x320], 0
jmp 0x1001ad7c
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x1001ad98
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x200], 0x312b
jmp 0x1001ad6f
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x1001adc9
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1001adc9
mov dword [ebp - 0xe80], 1
jmp 0x1001add0
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0xb8]
jle 0x1001adf3
mov dword [ebp - 0xe88], 1
jmp 0x1001adfa
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1410], eax
mov eax, 0xffff
add eax, 0xf456
imul eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x483bbb66
jne 0x1001ae32
mov dword [ebp - 0xe90], 1
jmp 0x1001ae39
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x12e0], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x1001ae6d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x1001b07e
mov dword [ebp - 0xa88], 0xfffffffd
mov dword [ebp - 0x74], 0
jmp 0x1001ae91
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1001b079
mov dword [ebp - 0xa98], 0xfffffff8
mov dword [ebp - 0xb8], 0
jmp 0x1001aebe
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jg 0x1001b074
mov dword [ebp - 0xea0], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x200]
mov dword [ebp - 0x1528], eax
cmp dword [ebp - 0xa98], 0
jne 0x1001afd6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x200]
mov dword [ebp - 0x12e8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1420], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x12f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x137c]
cmp eax, dword [ebp - 0xa88]
jge 0x1001af35
mov dword [ebp - 0x7a0], 1
jmp 0x1001af3c
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 0x6603
jl 0x1001af54
mov dword [ebp - 0xa50], 1
jmp 0x1001af5b
and dword [ebp - 0xa50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
cmp dword [ebp - 0xa50], eax
jl 0x1001af7c
mov dword [ebp - 0xa58], 1
jmp 0x1001af83
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x188]
add eax, dword [ebp - 0xa58]
cmp eax, dword [ebp - 0x44]
jle 0x1001afa0
mov dword [ebp - 0xe98], 1
jmp 0x1001afa7
and dword [ebp - 0xe98], 0
push 5
pop eax
test eax, eax
jne 0x1001afc0
mov eax, 0xf88485bd
test eax, eax
jne 0x1001afc0
and dword [ebp - 0xa60], 0
jmp 0x1001afca
mov dword [ebp - 0xa60], 1
cmp dword [ebp - 0xa60], 0xc155
jle 0x1001aff2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x137c], 0
je 0x1001aff2
mov dword [ebp - 0xa68], 1
jmp 0x1001aff9
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x1454], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x200]
mov dword [ebp - 0x12f8], eax
mov eax, dword [ebp - 0xa98]
imul eax, dword [ebp - 0x11c]
test eax, eax
jge 0x1001b03e
mov dword [ebp - 0xaa0], 1
jmp 0x1001b045
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xaa0], eax
jg 0x1001b05c
mov dword [ebp - 0xaa8], 1
jmp 0x1001b063
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xea0], eax
jmp 0x1001aeb1
jmp 0x1001ae8a
jmp 0x1001ae66
jmp 0x1001ad3e
jmp 0x1001ad1d
mov dword [ebp - 0x24], 4
jmp 0x1001b098
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x19
jl 0x1001b25c
mov dword [ebp - 0x8c], 0
jmp 0x1001b0bb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1001b0d7
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x470], 0x86cc6b0
jmp 0x1001b0ae
mov dword [ebp - 0x8c], 0
jmp 0x1001b0f0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001b10c
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1548], 0x7da0bf3f
jmp 0x1001b0e3
mov dword [ebp - 0x11c], 0xfffffffa
cmp dword [ebp - 0x11c], 0
je 0x1001b12d
xor eax, eax
inc eax
jne 0x1001b12d
and dword [ebp - 0xa48], 0
jmp 0x1001b137
mov dword [ebp - 0xa48], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x470]
cmp dword [ebp - 0xa48], eax
jle 0x1001b158
mov dword [ebp - 0x51c], 1
jmp 0x1001b15f
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xb2d3f577
je 0x1001b177
mov dword [ebp - 0x808], 1
jmp 0x1001b17e
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x470]
cmp dword [ebp - 0x808], eax
je 0x1001b19f
mov dword [ebp - 0x524], 1
jmp 0x1001b1a6
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x524], eax
jge 0x1001b1bd
mov dword [ebp - 0x7fc], 1
jmp 0x1001b1c4
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x7fc]
cmp eax, 0x5052de17
jle 0x1001b1e6
mov dword [ebp - 0x52c], 1
jmp 0x1001b1ed
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x52c], eax
jle 0x1001b207
mov dword [ebp - 0x95c], 1
jmp 0x1001b20e
and dword [ebp - 0x95c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x95c]
dec ecx
cmp ecx, dword [ebp + eax - 0x470]
je 0x1001b230
mov dword [ebp - 0x804], 1
jmp 0x1001b237
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x534]
add eax, dword [ebp - 0x804]
mov dword [ebp - 0x74], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1548], 0x72faf722
jmp 0x1001b091
mov dword [ebp - 0xea8], 0xe6bc044b
mov dword [ebp - 0x1430], 0x5cd3860a
mov dword [ebp - 0x420], 0
jmp 0x1001b289
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 1
jge 0x1001b2a5
mov eax, dword [ebp - 0x420]
mov dword [ebp + eax*4 - 0x144], 0x831713b9
jmp 0x1001b27c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x144], 0xffffffe7
jmp 0x1001b2d3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x144], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x144], 0x1d
je 0x1001b3db
mov dword [ebp - 0x53c], 0xffffffff
mov dword [ebp - 0x208], 0
jmp 0x1001b30a
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x1001b326
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x14b8], 0xc38b
jmp 0x1001b2fd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x144], 0
je 0x1001b35e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14b8]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
je 0x1001b35e
mov dword [ebp - 0xa0c], 1
jmp 0x1001b365
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 0xbe8f2100
jb 0x1001b37d
mov dword [ebp - 0x544], 1
jmp 0x1001b384
and dword [ebp - 0x544], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x14b8]
cmp dword [ebp - 0x544], eax
jne 0x1001b3a4
mov dword [ebp - 0x80c], 1
jmp 0x1001b3ab
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
xor edx, edx
inc edx
sub edx, dword [ebp - 0x80c]
imul edx, dword [ebp + ecx - 0x144]
imul edx, dword [ebp + eax - 0x14b8]
mov dword [ebp - 0xea8], edx
jmp 0x1001b2b8
mov dword [ebp - 0xeb0], 1
mov dword [ebp - 0xeb8], 0xfffffff7
mov dword [ebp - 0x1300], 1
push 1
lea ecx, [ebp - 0x138c]
call fcn.1002ff7c
and dword [ebp - 4], 0
mov dword [ebp - 0x145c], 0xfaa3
mov dword [ebp - 0x54c], 4
push 0
lea eax, [ebp - 0x138c]
push eax
push 1
lea eax, [ebp - 0x1308]
push eax
push 0x44b9
call fcn.1000dbc8
add esp, 0x14
mov eax, dword [ebp - 0xeb0]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x54c]
dec eax
mov dword [ebp - 0x54c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138c]
call fcn.1002fffe
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x64], 0x7bb1a88a
mov dword [ebp - 0x138], 4
mov dword [ebp - 0x2c], 0x5ec7e011
mov dword [ebp - 0x1e4], 4
mov dword [ebp - 0x55c], 0xd1454bcd
mov dword [ebp - 0x9c], 0
jmp 0x1001b4b1
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1001b4cd
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x156c], 0xec0ae971
jmp 0x1001b4a4
mov dword [ebp - 0x9c], 0
jmp 0x1001b4e6
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1001b502
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xed0], 0xffffffff
jmp 0x1001b4d9
mov dword [ebp - 0x1e4], 0
jmp 0x1001b51b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jg 0x1001b669
mov dword [ebp - 0xec0], 0x31fa
mov eax, 0xffffa387
test eax, eax
je 0x1001b561
mov byte [ebp - 0xed], 0
push 1
push 1
push 0x5e1d
push 0
lea eax, [ebp - 0xed]
push eax
call fcn.1000ee42
add esp, 0x14
jmp 0x1001b664
mov dword [ebp - 0x210], 0xfffffff7
mov dword [ebp - 0x328], 0
jmp 0x1001b584
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 4
jge 0x1001b5a0
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x1104], 0x54165132
jmp 0x1001b577
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1104], 2
jmp 0x1001b5ce
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1104]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1104], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1104], 0
jl 0x1001b615
mov byte [ebp - 0xf0], 0
push 0x46bf
push 0x167
push 0
push 0x118
lea eax, [ebp - 0xf0]
push eax
push 0x222e
push 1
push 0
push 0x6797
call fcn.10016c6a
add esp, 0x24
jmp 0x1001b5b3
mov dword [ebp - 0x210], 2
jmp 0x1001b62e
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x1001b664
mov dword [ebp - 0xec8], 1
lea eax, [ebp - 0xec0]
push eax
push 0
push 0x6e7c
call fcn.10027cf8
add esp, 0xc
cmp dword [ebp - 0xec8], 0
je 0x1001b662
jmp 0x1001b621
jmp 0x1001b621
jmp 0x1001b50e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x156c]
mov dword [ebp - 0x964], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x964]
mov dword [ebp + eax - 0xed0], ecx
mov eax, dword [ebp - 0x55c]
cmp dword [ebp - 0x964], eax
jne 0x1001b6a9
mov dword [ebp - 0x554], 1
jmp 0x1001b6b0
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x554], eax
jle 0x1001b6ca
mov dword [ebp - 0x814], 1
jmp 0x1001b6d1
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0xa44], 0xffffffff
push 3
lea ecx, [ebp - 0x139c]
call fcn.1002ff7c
mov dword [ebp - 4], 1
mov dword [ebp - 0xc9c], 0xaeef20fe
mov dword [ebp - 0x1440], 0
push 0x166
push 0x4fbc
push 0x3a00
lea eax, [ebp - 0x1310]
push eax
push 0x1d70
push 0
lea eax, [ebp - 0x139c]
push eax
push 0
call fcn.10027e12
add esp, 0x20
push 0x45be
push 0x3e0b
push 1
lea eax, [ebp - 0xc9c]
push eax
push 0x620b
push 0
push 0
call fcn.1001048f
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x139c]
call fcn.1002fffe
mov dword [ebp - 0x3b8], 0
jmp 0x1001b789
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 3
jge 0x1001b7a5
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x13dc], 1
jmp 0x1001b77c
mov dword [ebp - 0x3c], 0
jmp 0x1001b7b5
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xc
je 0x1001e36c
mov dword [ebp - 0x38], 0xa12b57e8
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x218], 0x19
jmp 0x1001b7e9
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x1b
jl 0x1001bc16
push 1
lea ecx, [ebp - 0x10a0]
call fcn.1002ff7c
mov dword [ebp - 4], 2
mov dword [ebp - 0xac], 0x54fddd3f
mov dword [ebp - 0x330], 0
jmp 0x1001b82d
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x1001b84f
push dword [ebp - 0x330]
lea ecx, [ebp - 0x10a0]
call fcn.1003001a
mov dword [eax], 0xdf603fa7
jmp 0x1001b820
mov dword [ebp - 0xac], 0
jmp 0x1001b868
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x1001b8b1
push 1
push 0x642d
push 0x34fd
push 0x596e
push 0xceb
push 0x2068
push 0xf80
push 0x6a9d
push 0x18f8
push 0x39b8
push 0x3c82
push 0
call fcn.100112ad
add esp, 0x30
jmp 0x1001b85b
mov dword [ebp - 0xac], 0
jmp 0x1001b8ca
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x1001bc02
mov dword [ebp - 0x220], 1
mov dword [ebp - 0xe18], 0xe486aeba
mov byte [ebp - 0xf2], 0
lea eax, [ebp - 0xf2]
push eax
push 0
push 0x6f3b
push 0
push 0x6695
call fcn.100113f1
add esp, 0x14
mov dword [ebp - 0x220], 0
jmp 0x1001b928
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jg 0x1001bbfd
push 4
lea ecx, [ebp - 0xb0c]
call fcn.1002ff7c
mov byte [ebp - 4], 3
push 0x23fc
lea eax, [ebp - 0x1464]
push eax
lea eax, [ebp - 0xb0c]
push eax
push 0
push 0
push 0x3735
call fcn.10015cb5
add esp, 0x18
mov dword [ebp - 0xa64], 0x2926
mov dword [ebp - 0xd78], 0x10008b7c
cmp dword [ebp - 0xa64], 0x2ca4
jle 0x1001ba72
and dword [ebp - 0x338], 0
jmp 0x1001b9a4
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x120c
jge 0x1001ba65
and dword [ebp - 0x400], 0
jmp 0x1001b9ca
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x57ee
jge 0x1001ba60
and dword [ebp - 0x228], 0
jmp 0x1001b9f0
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x6359
jge 0x1001ba5b
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0x228]
sar eax, cl
or eax, dword [ebp - 0x338]
cdq
mov dword [ebp - 0xcd8], eax
mov dword [ebp - 0xcd4], edx
push dword [ebp - 0xcd4]
push dword [ebp - 0xcd8]
lea ecx, [ebp - 0x16d0]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xb40], eax
mov ecx, dword [ebp - 0xb40]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x16d0]
call fcn.1002fe3d
jmp 0x1001b9e3
jmp 0x1001b9bd
jmp 0x1001b997
push 1
push 0xa4b
call dword [sym.imp.USER32.dll_EnableWindow]
mov byte [ebp - 4], 4
cmp dword [ebp - 0xa64], 0x261b
jge 0x1001ba8e
push dword [ebp - 0xd78]
call fcn.1004eea6
pop ecx
jmp 0x1001baaa
mov dword [ebp - 4], 3
jmp 0x1001baba
push 1
lea ecx, [ebp - 0xb0c]
call fcn.1003001a
and dword [eax], 0
jmp 0x1001baf0
push 1
lea ecx, [ebp - 0xb0c]
call fcn.1003001a
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x564]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x564]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb0c]
call fcn.1003001a
cmp dword [eax], 0
jl 0x1001bbcc
mov dword [ebp - 0x170], 0x3d4e7030
mov dword [ebp - 0x170], 0
jmp 0x1001bb29
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x1001bb8c
mov dword [ebp - 0xb48], 0
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1001bb64
push 0x6a2a
push 1
push 0
push 0x3db4
call fcn.1000fafa
add esp, 0x10
lea eax, [ebp - 0xb48]
push eax
push 0
push 0x4d20
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x170]
push eax
push 0
call fcn.100107c5
add esp, 0x18
jmp 0x1001bb1c
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1001bbc7
push 0x21
push 0x7980
push 0x5b25
push 0x624d
push 0x3fe8
push 0
push 0
push 1
push 0x72bb
call fcn.100259b3
add esp, 0x24
jmp 0x1001bacc
push 3
lea ecx, [ebp - 0xb0c]
call fcn.1003001a
mov dword [eax], 0x6478c38e
mov dword [ebp - 0xe18], 0x6478c38e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb0c]
call fcn.1002fffe
jmp 0x1001b91b
jmp 0x1001b8bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10a0]
call fcn.1002fffe
jmp 0x1001b7dc
mov dword [ebp - 0x38], 0x19
jmp 0x1001bc26
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff0
jg 0x1001e367
mov dword [ebp - 0x56c], 0x1139
mov dword [ebp - 0xb50], 0x10008bd0
cmp dword [ebp - 0x56c], 0x1517
jle 0x1001bd07
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
and dword [ebp - 0x238], 0
jmp 0x1001bc72
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x507d
jge 0x1001bd07
and dword [ebp - 0x230], 0
jmp 0x1001bc98
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x658d
jge 0x1001bd02
and dword [ebp - 0x3c0], 0
jmp 0x1001bcba
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0x7b2b
jge 0x1001bd00
mov eax, dword [ebp - 0x230]
cdq
idiv dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x238]
sub eax, edx
cdq
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce0], edx
push dword [ebp - 0xce0]
push dword [ebp - 0xce4]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001bcad
jmp 0x1001bc8b
jmp 0x1001bc65
push 1
lea ecx, [ebp - 0xee0]
call fcn.1002ff7c
mov dword [ebp - 4], 6
mov dword [ebp - 0x1e8], 9
push 1
lea eax, [ebp - 0x1c8]
push eax
push 0x308a
push 0x6736
push 0
push 0x6db3
push 0x1a6d
lea eax, [ebp - 0xee0]
push eax
push 0x48b7
push 0
push 0x15b5
call fcn.1002a326
add esp, 0x2c
mov dword [ebp - 0x1c8], 0
jmp 0x1001bd78
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1001bd94
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xac0], 0x4f37831e
jmp 0x1001bd6b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xac0], 0
jmp 0x1001bdc2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xac0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xac0], 0
jl 0x1001be45
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xac0]
lea ecx, [ebp - 0xee0]
call fcn.1003001a
cmp dword [eax], 0xfc371865
jae 0x1001bdfe
mov dword [ebp - 0x81c], 1
jmp 0x1001be05
and dword [ebp - 0x81c], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xac0]
lea ecx, [ebp - 0xee0]
call fcn.1003001a
mov ecx, dword [ebp - 0x81c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xac0]
lea ecx, [ebp - 0xee0]
call fcn.1003001a
or dword [eax], 0xffffffff
jmp 0x1001bda7
mov dword [ebp - 0x1e8], 0xfffffffa
jmp 0x1001be5e
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x15
jge 0x1001beb0
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1001be88
push 0x1e2d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x1001beae
push 0x500f
push 0x688f
push 0
call fcn.100268a9
add esp, 0xc
jmp 0x1001be51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.1002fffe
mov dword [ebp - 4], 7
cmp dword [ebp - 0x56c], 0xf3c
jge 0x1001bee2
mov edx, dword [ebp - 0xb50]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001befe
or dword [ebp - 4], 0xffffffff
jmp 0x1001bf08
mov dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0xb4], 0x44adca1a
push 3
lea ecx, [ebp - 0x13ac]
call fcn.1002ff7c
mov dword [ebp - 4], 9
mov dword [ebp - 0x240], 0xdada439b
mov dword [ebp - 0x1318], 0x624cdb8f
mov dword [ebp - 0x340], 0
jmp 0x1001bf5d
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 3
jge 0x1001bf7f
push dword [ebp - 0x340]
lea ecx, [ebp - 0x13ac]
call fcn.1003001a
mov dword [eax], 0xffff
jmp 0x1001bf50
mov byte [ebp - 0xd7], 0
lea eax, [ebp - 0xd7]
push eax
push 0
push 0
push 0x4da4
call fcn.100103fa
add esp, 0x10
mov dword [ebp - 0x240], 0
jmp 0x1001bfb7
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x1001bfff
mov dword [ebp - 0x96c], 0x7ab3921d
mov byte [ebp - 0xfd], 0
push 0x41f
push 0
push 0x4ced
lea eax, [ebp - 0xfd]
push eax
push 0
push 1
call fcn.10010880
add esp, 0x18
mov eax, dword [ebp - 0x96c]
dec eax
mov dword [ebp - 0x96c], eax
jmp 0x1001bfaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13ac]
call fcn.1002fffe
push 2
lea ecx, [ebp - 0xef0]
call fcn.1002ff7c
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x440], 0
jmp 0x1001c03b
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 2
jge 0x1001c05a
push dword [ebp - 0x440]
lea ecx, [ebp - 0xef0]
call fcn.1003001a
and dword [eax], 0
jmp 0x1001c02e
push 0
lea ecx, [ebp - 0xef0]
call fcn.1003001a
mov dword [eax], 0xfffffff9
jmp 0x1001c093
push 0
lea ecx, [ebp - 0xef0]
call fcn.1003001a
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x574]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xef0]
call fcn.1003001a
cmp dword [eax], 0x13
je 0x1001c101
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1001c0d2
push 1
push 0x2a88
push 1
push 0x5813
push 0x73b9
call fcn.1000dbc8
add esp, 0x14
push 0x19e8
push 0x40f8
push 0x6e8a
push 1
push 0x4db1
push 0x22f2
push 0
push 0x4327
call fcn.1000f145
add esp, 0x20
jmp 0x1001c06f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.1002fffe
mov dword [ebp - 0x248], 0
jmp 0x1001c129
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1001c145
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x2d8], 0x312b
jmp 0x1001c11c
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x94], 9
mov dword [ebp - 0xd9c], 0
mov dword [ebp - 0x7c], 0
jmp 0x1001c173
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001c189
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x164], 0
jmp 0x1001c16c
mov dword [ebp - 0x7c], 0
jmp 0x1001c199
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001c1af
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x458], 0
jmp 0x1001c192
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x164]
cmp ecx, dword [ebp + eax - 0x164]
jl 0x1001c1e9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
add eax, 0x2a4863ae
je 0x1001c1e9
mov dword [ebp - 0x824], 1
jmp 0x1001c1f0
and dword [ebp - 0x824], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x824]
sub ecx, dword [ebp + eax - 0x164]
jne 0x1001c21c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x164], 0
jne 0x1001c21c
and dword [ebp - 0x57c], 0
jmp 0x1001c226
mov dword [ebp - 0x57c], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
imul eax, dword [ebp - 0x57c]
mov dword [ebp - 0x348], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x348]
cmp ecx, dword [ebp + eax - 0x164]
jle 0x1001c25f
mov dword [ebp - 0xa14], 1
jmp 0x1001c266
and dword [ebp - 0xa14], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa14]
mov dword [ebp + eax - 0x458], ecx
mov eax, 0x4392f209
test eax, eax
jne 0x1001c290
xor eax, eax
inc eax
jne 0x1001c290
and dword [ebp - 0x584], 0
jmp 0x1001c29a
mov dword [ebp - 0x584], 1
cmp dword [ebp - 0x584], 0x814b
jle 0x1001c2b2
mov dword [ebp - 0x82c], 1
jmp 0x1001c2b9
and dword [ebp - 0x82c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
cmp dword [ebp - 0x82c], eax
jne 0x1001c2d9
mov dword [ebp - 0x58c], 1
jmp 0x1001c2e0
and dword [ebp - 0x58c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x164]
add ecx, dword [ebp - 0x58c]
cmp ecx, dword [ebp + eax - 0x164]
jg 0x1001c30d
mov dword [ebp - 0x974], 1
jmp 0x1001c314
and dword [ebp - 0x974], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x164]
cmp dword [ebp - 0x974], eax
jg 0x1001c770
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x350], 0x19c29aed
mov dword [ebp - 0x34], 0x77d98a9a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x458]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1001c473
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1450], eax
imul eax, dword [ebp - 0x20], 0xfffb
mov dword [ebp - 0xd84], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd84]
mov dword [ebp + eax - 0x458], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x458]
mov dword [ebp - 0x112c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x458]
cmp eax, dword [ebp - 0x20]
je 0x1001c3b9
mov dword [ebp - 0x594], 1
jmp 0x1001c3c0
and dword [ebp - 0x594], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
cmp dword [ebp - 0x594], eax
jg 0x1001c3e0
mov dword [ebp - 0x834], 1
jmp 0x1001c3e7
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x1001c40b
cmp dword [ebp - 0x20], 0
jne 0x1001c40b
and dword [ebp - 0x59c], 0
jmp 0x1001c415
mov dword [ebp - 0x59c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
add eax, dword [ebp - 0x59c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1130], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1138], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
inc eax
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x164], eax
jle 0x1001c473
and dword [ebp - 0xb58], 0
jmp 0x1001c47d
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1148], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jge 0x1001c4a9
cmp dword [ebp - 0x94], 0
jne 0x1001c4a9
and dword [ebp - 0xe20], 0
jmp 0x1001c4b3
mov dword [ebp - 0xe20], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
mov dword [ebp - 0x1150], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x458], 0
je 0x1001c6fb
mov dword [ebp - 0xb68], 0xed0f
mov dword [ebp - 0xd90], 1
mov dword [ebp - 0xa74], 0x6de4
mov dword [ebp - 0xb60], 0x10008c0c
cmp dword [ebp - 0xa74], 0x6f55
jle 0x1001c5d2
push 0x1ae2
push 0x173a
push 0
push 0xa41
call dword [sym.imp.USER32.dll_DrawFrameControl]
and dword [ebp - 0x250], 0
jmp 0x1001c53e
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x6152
jge 0x1001c5d2
and dword [ebp - 0x3c8], 0
jmp 0x1001c564
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x456a
jge 0x1001c5cd
and dword [ebp - 0x258], 0
jmp 0x1001c586
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x6307
jge 0x1001c5cb
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x3c8]
sar eax, cl
and eax, dword [ebp - 0x258]
cdq
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0xcec], edx
push dword [ebp - 0xcec]
push dword [ebp - 0xcf0]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001c579
jmp 0x1001c557
jmp 0x1001c531
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1001c5f2
push 0
push 0xa1b
call fcn.1002809b
pop ecx
pop ecx
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0xa74], 0x6daa
jge 0x1001c615
mov edx, dword [ebp - 0xb60]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001c631
or dword [ebp - 4], 0xffffffff
jmp 0x1001c63b
mov dword [ebp - 0x34], 0
jmp 0x1001c64b
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffec
jg 0x1001c6f9
mov dword [ebp - 0xe28], 1
mov dword [ebp - 0x20], 0
jmp 0x1001c66f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1001c685
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x458], 0xffffffff
jmp 0x1001c668
mov dword [ebp - 0x94], 0
jmp 0x1001c69e
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1a
jl 0x1001c6f4
mov dword [ebp - 0xb70], 2
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xd90]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0xb68]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x6eb3
lea eax, [ebp - 0xe28]
push eax
push 0
lea eax, [ebp - 0xb70]
push eax
call fcn.1002ac39
add esp, 0x28
jmp 0x1001c691
jmp 0x1001c644
jmp 0x1001c76e
mov dword [ebp - 0x5a4], 1
cmp dword [ebp - 0x34], 0
jne 0x1001c736
cmp dword [ebp - 0x5a4], 0
jne 0x1001c71e
cmp dword [ebp - 0x5a4], 0xfff7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x164], 0
jne 0x1001c736
and dword [ebp - 0x5ac], 0
jmp 0x1001c740
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x83c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x83c]
mov dword [ebp + eax - 0x458], ecx
mov eax, dword [ebp - 0x83c]
sub eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x34], eax
jmp 0x1001c7bd
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x1001c79f
push 0x39eb
push 1
push 0x631d
push 0x43ee
push 0
push 1
call fcn.10010880
add esp, 0x18
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x164]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x1001c7ee
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1001c7ee
mov dword [ebp - 0xb78], 1
jmp 0x1001c7f5
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xb4]
jle 0x1001c818
mov dword [ebp - 0xe30], 1
jmp 0x1001c81f
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1170], eax
mov eax, 0xffff
add eax, 0xf456
imul eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x483bbb66
jne 0x1001c857
mov dword [ebp - 0xb80], 1
jmp 0x1001c85e
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xe38], 0xffffffff
mov dword [ebp - 0xba0], 0x9fe57f6c
mov dword [ebp - 0xe40], 0x1b4956e7
mov dword [ebp - 0xb98], 3
mov dword [ebp - 0xdb4], 0x51f1e283
mov dword [ebp - 0xb90], 1
push 3
lea ecx, [ebp - 0x13bc]
call fcn.1002ff7c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x260], 0
jmp 0x1001c8eb
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1001c90a
push dword [ebp - 0x260]
lea ecx, [ebp - 0x13bc]
call fcn.1003001a
or dword [eax], 0xffffffff
jmp 0x1001c8de
mov dword [ebp - 0x97c], 0x6b8a
mov dword [ebp - 0xb88], 0x10008c70
cmp dword [ebp - 0x97c], 0x6dbf
jle 0x1001ca3d
and dword [ebp - 0x358], 0
jmp 0x1001c944
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x318b
jge 0x1001ca3d
and dword [ebp - 0x270], 0
jmp 0x1001c96a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xf0a
jge 0x1001ca38
and dword [ebp - 0x408], 0
jmp 0x1001c990
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x1436
jge 0x1001ca33
and dword [ebp - 0x268], 0
jmp 0x1001c9b6
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x39a2
jge 0x1001ca2e
mov ecx, dword [ebp - 0x408]
imul ecx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x358]
cdq
idiv dword [ebp - 0x270]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0xcfc], eax
mov dword [ebp - 0xcf8], edx
push dword [ebp - 0xcf8]
push dword [ebp - 0xcfc]
lea ecx, [ebp - 0x1628]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xda8], eax
mov ecx, dword [ebp - 0xda8]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x1628]
call fcn.1002fe3d
jmp 0x1001c9a9
jmp 0x1001c983
jmp 0x1001c95d
jmp 0x1001c937
mov byte [ebp - 0x10d], 0
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x97c], 0x6aaa
jge 0x1001ca60
push dword [ebp - 0xb88]
call fcn.1004eea6
pop ecx
jmp 0x1001ca7c
mov dword [ebp - 4], 0xd
jmp 0x1001ca8c
push 0x733
push 0
push 0x57e6
lea eax, [ebp - 0x10d]
push eax
push 1
call fcn.1000e9a7
add esp, 0x14
push 0x45a4
lea eax, [ebp - 0xe38]
push eax
lea eax, [ebp - 0xb90]
push eax
lea eax, [ebp - 0xdb4]
push eax
push 0x6d99
lea eax, [ebp - 0xb98]
push eax
lea eax, [ebp - 0xe40]
push eax
push 0x4d04
push 0
lea eax, [ebp - 0xba0]
push eax
call fcn.1002f9f2
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13bc]
call fcn.1002fffe
mov dword [ebp - 0x2c], 0
jmp 0x1001cb0b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1001e362
push 2
lea ecx, [ebp - 0xb24]
call fcn.1002ff7c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x4d4], 0x3f9beab1
lea eax, [ebp - 0xb24]
push eax
push 0x7188
lea eax, [ebp - 0x1180]
push eax
push 0
push 0xe76
call fcn.1002a2f2
add esp, 0x14
push 1
lea ecx, [ebp - 0xb24]
call fcn.1003001a
mov dword [eax], 1
jmp 0x1001cb8e
push 1
lea ecx, [ebp - 0xb24]
call fcn.1003001a
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5b4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb24]
call fcn.1003001a
cmp dword [eax], 0xfffffff4
jge 0x1001cde1
mov dword [ebp - 0x128], 0xd4351cdc
mov dword [ebp - 0x84c], 0xffffffff
mov dword [ebp - 0x3d0], 0
jmp 0x1001cbd1
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 2
jge 0x1001cbed
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0xfdc], 0xeccc
jmp 0x1001cbc4
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001cc21
push 0
push 0x17a9
push 1
push 1
push 0xcfa
push 0x186a
push 0x500b
call fcn.1001018e
add esp, 0x1c
mov dword [ebp - 0x128], 0
jmp 0x1001cc3a
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jg 0x1001cddc
mov dword [ebp - 0x5e4], 0x66b7a7bc
cmp dword [ebp - 0x84c], 0
jne 0x1001cc6c
mov eax, 0x4495231f
test eax, eax
jne 0x1001cc6c
and dword [ebp - 0x844], 0
jmp 0x1001cc76
mov dword [ebp - 0x844], 1
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0xfdc]
cmp eax, dword [ebp - 0x4d4]
je 0x1001cca3
mov dword [ebp - 0x5bc], 1
jmp 0x1001ccaa
and dword [ebp - 0x5bc], 0
push 1
lea ecx, [ebp - 0xb24]
call fcn.1003001a
mov ecx, dword [ebp - 0x5bc]
cmp ecx, dword [eax]
jge 0x1001cccd
mov dword [ebp - 0xa1c], 1
jmp 0x1001ccd4
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0xe9120837
ja 0x1001ccec
mov dword [ebp - 0x5c4], 1
jmp 0x1001ccf3
and dword [ebp - 0x5c4], 0
push 9
pop eax
sub eax, dword [ebp - 0x5c4]
je 0x1001cd13
cmp dword [ebp - 0x4d4], 0
je 0x1001cd13
mov dword [ebp - 0x5cc], 1
jmp 0x1001cd1a
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x84c]
cmp dword [ebp - 0x5cc], eax
jge 0x1001cd34
mov dword [ebp - 0x984], 1
jmp 0x1001cd3b
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0x89f7a9d2
jae 0x1001cd53
mov dword [ebp - 0x5d4], 1
jmp 0x1001cd5a
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0xfdc]
cmp dword [ebp - 0x5d4], eax
jge 0x1001cd7b
mov dword [ebp - 0x854], 1
jmp 0x1001cd82
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0xfffffffe
jne 0x1001cd97
mov dword [ebp - 0x5dc], 1
jmp 0x1001cd9e
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x1932
jl 0x1001cdb6
mov dword [ebp - 0xa6c], 1
jmp 0x1001cdbd
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0
je 0x1001cdd7
jmp 0x1001cc2d
jmp 0x1001cc2d
jmp 0x1001cb6a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb24]
call fcn.1002fffe
mov dword [ebp - 0x9a4], 0xfffffffd
push 2
lea ecx, [ebp - 0xb00]
call fcn.1002ff7c
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x478], 0
push 0x96b
push 0x2b83
push 0
lea eax, [ebp - 0xb00]
push eax
push 0x5ce1
push 0x9e2
push 0xe83
push 0x39f9
push 0x77e7
push 0x495f
push 0x6d82
push 0x35cc
push 0x3fa4
push 0
push 0x4b9e
push 0x6446
push 0x2664
push 0x2f27
lea eax, [ebp - 0x121c]
push eax
push 0x6e87
push 0x2e51
call fcn.1002702b
add esp, 0x54
mov dword [ebp - 0xc8], 1
jmp 0x1001ceaa
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1001d085
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x5ec], 0xfffffff7
mov dword [ebp - 0xbb0], 0xf5c9b8db
mov dword [ebp - 0x54], 1
jmp 0x1001cee2
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1001cf46
mov dword [ebp - 0xfc], 0x73d2
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 0
jmp 0x1001cf18
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x1001cf44
lea eax, [ebp - 0xb00]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0
push 0x46b5
lea eax, [ebp - 0x54]
push eax
call fcn.10025989
add esp, 0x14
jmp 0x1001cf0b
jmp 0x1001cedb
mov dword [ebp - 0x54], 1
jmp 0x1001cf56
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1001d080
mov dword [ebp - 0x98c], 0x2b53
mov dword [ebp - 0xba8], 0xf79facd4
mov dword [ebp - 0xe48], 6
mov dword [ebp - 0x478], 1
cmp dword [ebp - 0x478], 0
jne 0x1001cf9d
mov dword [ebp - 0xdc0], 1
jmp 0x1001cfa4
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1224], eax
mov esi, 0x177cce45
sub esi, 0x64ce34aa
imul esi, dword [ebp - 0xba8]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xb00]
call fcn.1003001a
cmp dword [eax], esi
jge 0x1001cfe3
mov dword [ebp - 0x85c], 1
jmp 0x1001cfea
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x5ec], eax
mov esi, dword [ebp - 0x5ec]
mov edi, dword [ebp - 0xc8]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xb00]
call fcn.1003001a
add edi, dword [eax]
cmp edi, esi
je 0x1001d025
mov dword [ebp - 0x5f4], 1
jmp 0x1001d02c
and dword [ebp - 0x5f4], 0
mov dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xe48], eax
mov esi, dword [ebp - 0x54]
push 1
lea ecx, [ebp - 0xb00]
call fcn.1003001a
cmp dword [eax], esi
jl 0x1001d068
mov dword [ebp - 0x864], 1
jmp 0x1001d06f
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xbb0], eax
jmp 0x1001cf4f
jmp 0x1001ce9d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb00]
call fcn.1002fffe
mov dword [ebp - 0x64], 0
jmp 0x1001d0a4
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1001e35d
push 1
lea ecx, [ebp - 0xad8]
call fcn.1002ff7c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0xe00], 0x4ab274bf
mov dword [ebp - 0x122c], 1
mov dword [ebp - 0x1234], 1
mov dword [ebp - 0xbb8], 0
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xe50], 0x5950
mov dword [ebp - 0x86c], 0xcd8a6ce
push 0x3363
push 0xbe6
push 0
lea eax, [ebp - 0x178]
push eax
push 0
push 0x6f2a
lea eax, [ebp - 0xad8]
push eax
push 0x623a
call fcn.10028e46
add esp, 0x20
mov dword [ebp - 0x178], 0
jmp 0x1001d159
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x1001d175
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x4f8], 0x60b4ffb8
jmp 0x1001d14c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4f8], 0
jmp 0x1001d1a3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4f8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4f8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4f8], 0
jg 0x1001d2cf
mov dword [ebp - 0x123c], 0xfffffff8
mov dword [ebp - 0x1050], 0xc4f27d27
mov dword [ebp - 0x104c], 0xc4f27d27
mov dword [ebp - 0x1048], 0xc4f27d27
mov dword [ebp - 0x1044], 0xc4f27d27
lea ecx, [ebp - 0x4ed]
call fcn.10030029
push eax
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x15a4]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1584]
call fcn.1002ffd8
mov byte [ebp - 4], 0x13
push 4
lea ecx, [ebp - 0x10d0]
call fcn.1002ff7c
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x10d0]
push eax
push 0
push 0x2d4
lea eax, [ebp - 0x1244]
push eax
push 0x3dd
push 0
call fcn.100261d8
add esp, 0x18
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x4f8]
lea ecx, [ebp - 0xad8]
call fcn.1003001a
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x4f8]
lea ecx, [ebp - 0xad8]
call fcn.1003001a
mov eax, dword [eax]
mov dword [esi], eax
push 0x5fa1
push 1
push 1
lea eax, [ebp - 0x10d0]
push eax
push 0x5240
push 0
call fcn.100110d6
add esp, 0x18
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x10d0]
call fcn.1002fffe
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1584]
call fcn.1002fffe
jmp 0x1001d188
mov dword [ebp - 0x1b0], 0
jmp 0x1001d2e8
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x1001d601
mov dword [ebp - 0x5fc], 0x564
mov dword [ebp - 0xdcc], 0x10008cf4
cmp dword [ebp - 0x5fc], 0x8ba
jle 0x1001d3c1
and dword [ebp - 0x280], 0
jmp 0x1001d32f
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x7c35
jge 0x1001d3c1
and dword [ebp - 0x278], 0
jmp 0x1001d355
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x863
jge 0x1001d3bc
and dword [ebp - 0x360], 0
jmp 0x1001d377
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x4d0a
jge 0x1001d3ba
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x360]
or eax, dword [ebp - 0x280]
cdq
mov dword [ebp - 0xd08], eax
mov dword [ebp - 0xd04], edx
push dword [ebp - 0xd04]
push dword [ebp - 0xd08]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001d36a
jmp 0x1001d348
jmp 0x1001d322
mov dword [ebp - 0x4b8], 0xffff
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x5fc], 0x538
jge 0x1001d3eb
mov edx, dword [ebp - 0xdcc]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001d407
mov dword [ebp - 4], 0x12
jmp 0x1001d417
mov dword [ebp - 0xbc0], 0x64f2ca12
mov dword [ebp - 0xbc8], 0x2c75
mov dword [ebp - 0x84], 0
jmp 0x1001d444
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1001d460
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x13cc], 4
jmp 0x1001d437
mov dword [ebp - 0x84], 0
jmp 0x1001d479
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1001d495
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x118c], 0x26ae69ed
jmp 0x1001d46c
mov dword [ebp - 0xa24], 0x906d
cmp dword [ebp - 0xa24], 0
jne 0x1001d4c3
push 0
lea ecx, [ebp - 0xad8]
call fcn.1003001a
cmp dword [eax], 0
jne 0x1001d4c3
and dword [ebp - 0x60c], 0
jmp 0x1001d4cd
mov dword [ebp - 0x60c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbb8]
cmp ecx, dword [ebp + eax - 0x118c]
jg 0x1001d4ee
mov dword [ebp - 0x604], 1
jmp 0x1001d4f5
and dword [ebp - 0x604], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x13cc]
cmp dword [ebp - 0x604], eax
je 0x1001d524
cmp dword [ebp - 0xe50], 0
jne 0x1001d524
cmp dword [ebp - 0xbc0], 0
jne 0x1001d524
and dword [ebp - 0xe58], 0
jmp 0x1001d52e
mov dword [ebp - 0xe58], 1
mov eax, dword [ebp - 0x4b8]
dec eax
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x124c], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x1254], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0x60c]
inc eax
cmp eax, 0xaea1
je 0x1001d585
mov dword [ebp - 0x994], 1
jmp 0x1001d58c
and dword [ebp - 0x994], 0
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0xad8]
call fcn.1003001a
mov esi, dword [eax]
sub esi, dword [ebp - 0x994]
push 0
lea ecx, [ebp - 0xad8]
call fcn.1003001a
cmp esi, dword [eax]
jne 0x1001d5c2
mov dword [ebp - 0x614], 1
jmp 0x1001d5c9
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0xe00]
cmp dword [ebp - 0x614], eax
jl 0x1001d5e3
mov dword [ebp - 0x874], 1
jmp 0x1001d5ea
and dword [ebp - 0x874], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x874]
mov dword [ebp + eax - 0x13cc], ecx
jmp 0x1001d2db
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.1002fffe
mov dword [ebp - 0x654], 0xfffffff8
mov dword [ebp - 0xb0], 0xe76f5020
mov dword [ebp - 0xe84], 0x6d402da3
mov dword [ebp - 0x428], 0
jmp 0x1001d647
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 4
jge 0x1001d663
mov eax, dword [ebp - 0x428]
mov dword [ebp + eax*4 - 0x14cc], 0xffffffff
jmp 0x1001d63a
mov dword [ebp - 0xb0], 0
jmp 0x1001d67c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x1001d9c1
mov dword [ebp - 0x368], 0xff3d
mov dword [ebp - 0xbd0], 3
mov dword [ebp - 0xbd8], 0xe314a5ea
mov dword [ebp - 0x288], 0
jmp 0x1001d6c0
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 4
jge 0x1001d6dc
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x15fc], 1
jmp 0x1001d6b3
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14cc]
imul ecx, dword [ebp + eax - 0x14cc]
mov dword [ebp - 0x368], ecx
cmp dword [ebp - 0x368], 1
jb 0x1001d738
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb0]
je 0x1001d71a
cmp dword [ebp - 0xbd0], 0
cmp dword [ebp - 0x368], 0
jne 0x1001d72c
cmp dword [ebp - 0xb0], 0
je 0x1001d738
mov dword [ebp - 0xecc], 1
jmp 0x1001d73f
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x126c], eax
cmp dword [ebp - 0x368], 0
je 0x1001d7e8
mov dword [ebp - 0x290], 0
jmp 0x1001d771
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1001d78d
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x159c], 0xd21cd430
jmp 0x1001d764
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1001d7d0
push 0x60dd
push 1
push 0
push 0x2479
push 0x7b7e
push 0
push 0x1f81
push 0x5e40
push 0x22e3
push 0x4a60
call fcn.1002842e
add esp, 0x28
mov eax, dword [ebp - 0xbd8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x159c], eax
jmp 0x1001d988
mov dword [ebp - 0x61c], 0xb4d
mov dword [ebp - 0xbe0], 0x10008d54
cmp dword [ebp - 0x61c], 0xe47
jle 0x1001d932
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
and dword [ebp - 0x370], 0
jmp 0x1001d82a
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x12c4
jge 0x1001d922
and dword [ebp - 0x3d8], 0
jmp 0x1001d850
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0x914
jge 0x1001d91d
and dword [ebp - 0x298], 0
jmp 0x1001d876
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x12b6
jge 0x1001d918
and dword [ebp - 0x2a0], 0
jmp 0x1001d89c
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x270d
jge 0x1001d913
mov eax, dword [ebp - 0x3d8]
imul eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x370]
sub ecx, eax
and ecx, dword [ebp - 0x2a0]
mov eax, ecx
cdq
mov dword [ebp - 0xd14], eax
mov dword [ebp - 0xd10], edx
push dword [ebp - 0xd10]
push dword [ebp - 0xd14]
lea ecx, [ebp - 0x1640]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xdec], eax
mov ecx, dword [ebp - 0xdec]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x1640]
call fcn.1002fe3d
jmp 0x1001d88f
jmp 0x1001d869
jmp 0x1001d843
jmp 0x1001d81d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x14cc], 0
je 0x1001d943
jmp 0x1001d9c1
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x61c], 0x999
jge 0x1001d962
push dword [ebp - 0xbe0]
call fcn.1004eea6
pop ecx
jmp 0x1001d97e
or dword [ebp - 4], 0xffffffff
jmp 0x1001d988
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x15fc], 0
jne 0x1001d9a6
or eax, 0xffffffff
jne 0x1001d9a6
and dword [ebp - 0xa70], 0
jmp 0x1001d9b0
mov dword [ebp - 0xa70], 1
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xe84], eax
jmp 0x1001d66f
mov dword [ebp - 0xb4], 0
jmp 0x1001d9da
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jg 0x1001e358
mov dword [ebp - 0x624], 0x380e
mov dword [ebp - 0xbe8], 0x10008da8
cmp dword [ebp - 0x624], 0x3ab6
jle 0x1001daef
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and dword [ebp - 0x410], 0
jmp 0x1001da29
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x3f0b
jge 0x1001daef
and dword [ebp - 0x2a8], 0
jmp 0x1001da4f
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x5434
jge 0x1001daea
and dword [ebp - 0x378], 0
jmp 0x1001da75
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x2676
jge 0x1001dae5
and dword [ebp - 0x2b0], 0
jmp 0x1001da97
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x5d6e
jge 0x1001dae3
mov eax, dword [ebp - 0x410]
imul eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x2b0]
shl eax, cl
cdq
mov dword [ebp - 0xd20], eax
mov dword [ebp - 0xd1c], edx
push dword [ebp - 0xd1c]
push dword [ebp - 0xd20]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001da8a
jmp 0x1001da68
jmp 0x1001da42
jmp 0x1001da1c
mov dword [ebp - 0x1014], 0x713b9102
mov dword [ebp - 0x1010], 0x713b9102
mov dword [ebp - 0x100c], 0x713b9102
mov dword [ebp - 0x1008], 0x713b9102
lea ecx, [ebp - 0x461]
call fcn.10030029
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x15e4]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1560]
call fcn.1002ffd8
mov dword [ebp - 4], 0x19
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x624], 0x34d0
jge 0x1001db73
mov edx, dword [ebp - 0xbe8]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001db8f
mov dword [ebp - 4], 0x19
jmp 0x1001db9f
mov dword [ebp - 0x3e0], 0x29000d4e
mov dword [ebp - 0x3e0], 3
jmp 0x1001dbc2
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jl 0x1001dbea
push 0x6ce0
push 0
push 0
push 0x669c
push 0x7253
push 1
call fcn.100110d6
add esp, 0x18
jmp 0x1001dbb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1560]
call fcn.1002fffe
mov dword [ebp - 0xed4], 1
mov dword [ebp - 0x1274], 0xffffffff
mov dword [ebp - 0x87c], 0xb34
mov dword [ebp - 0xdf4], 0x10008e00
cmp dword [ebp - 0x87c], 0xd3a
jle 0x1001dcdb
and dword [ebp - 0x2c0], 0
jmp 0x1001dc47
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x7277
jge 0x1001dcdb
and dword [ebp - 0x2b8], 0
jmp 0x1001dc6d
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x36ce
jge 0x1001dcd6
and dword [ebp - 0x380], 0
jmp 0x1001dc8f
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x2c63
jge 0x1001dcd4
mov ecx, dword [ebp - 0x2b8]
sub ecx, dword [ebp - 0x380]
mov eax, dword [ebp - 0x2c0]
shl eax, cl
cdq
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0xd28], edx
push dword [ebp - 0xd28]
push dword [ebp - 0xd2c]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001dc82
jmp 0x1001dc60
jmp 0x1001dc3a
mov byte [ebp - 0xdf], 0
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x87c], 0x9b7
jge 0x1001dd05
mov edx, dword [ebp - 0xdf4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001dd21
or dword [ebp - 4], 0xffffffff
jmp 0x1001dd2b
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1001dd56
push 0
push 0xdc9
push 0x6d82
push 0x557b
push 1
push 0x4400
call fcn.100114c9
add esp, 0x18
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1001dd70
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x140], 0xfffffff6
mov dword [ebp - 0x130], 0xffffffff
push 2
lea ecx, [ebp - 0xfbc]
call fcn.1002ff7c
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x438], 0
jmp 0x1001ddbb
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 2
jge 0x1001dddd
push dword [ebp - 0x438]
lea ecx, [ebp - 0xfbc]
call fcn.1003001a
mov dword [eax], 1
jmp 0x1001ddae
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x127c], eax
mov dword [ebp - 0x140], 0xaaf0
cmp dword [ebp - 0x140], 0
jne 0x1001de08
mov dword [ebp - 0xbf0], 1
jmp 0x1001de0f
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0x140], 0x17f4039e
jle 0x1001de27
mov dword [ebp - 0x62c], 1
jmp 0x1001de2e
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x62c], eax
jne 0x1001de48
mov dword [ebp - 0xf14], 1
jmp 0x1001de4f
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x128c], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x129c], eax
xor eax, eax
inc eax
je 0x1001de99
cmp dword [ebp - 0x140], 0
je 0x1001de99
mov dword [ebp - 0xbf8], 1
jmp 0x1001dea0
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12a4], eax
imul eax, dword [ebp - 0xd0], 0x1c3ffbe4
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
neg eax
cmp eax, dword [ebp - 0x130]
jne 0x1001ded8
mov dword [ebp - 0x99c], 1
jmp 0x1001dedf
and dword [ebp - 0x99c], 0
cmp dword [ebp - 0x99c], 0xffff
jb 0x1001def7
mov dword [ebp - 0x634], 1
jmp 0x1001defe
and dword [ebp - 0x634], 0
push 0
lea ecx, [ebp - 0xfbc]
call fcn.1003001a
mov ecx, dword [ebp - 0x634]
mov dword [eax], ecx
mov dword [ebp - 0xd0], 0xf
jmp 0x1001df2c
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffe9
jne 0x1001df99
mov dword [ebp - 0xdfc], 0xfa72
push 0x492c
push 0x6921
push 0x2e87
push 0x204c
push 0xc69
push 1
push 0x68d2
push 0x53c7
push 0x3aa9
push 0x2cbf
push 0
push 0
lea eax, [ebp - 0xdfc]
push eax
push 0x1482
lea eax, [ebp - 0xfbc]
push eax
push 0x2031
push 0x6f8d
call fcn.1000fce0
add esp, 0x44
jmp 0x1001df1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.1002fffe
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x2d8]
mov dword [ebp - 0x12ac], eax
cmp dword [ebp - 0x654], 0
jne 0x1001e0a9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x2d8]
mov dword [ebp - 0x12b4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x12bc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x12c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13dc]
cmp eax, dword [ebp - 0x9a4]
jge 0x1001e008
mov dword [ebp - 0x884], 1
jmp 0x1001e00f
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0x6603
jl 0x1001e027
mov dword [ebp - 0x63c], 1
jmp 0x1001e02e
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
cmp dword [ebp - 0x63c], eax
jl 0x1001e04f
mov dword [ebp - 0xa2c], 1
jmp 0x1001e056
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0x3c]
jle 0x1001e073
mov dword [ebp - 0xc00], 1
jmp 0x1001e07a
and dword [ebp - 0xc00], 0
push 5
pop eax
test eax, eax
jne 0x1001e093
mov eax, 0xf88485bd
test eax, eax
jne 0x1001e093
and dword [ebp - 0x644], 0
jmp 0x1001e09d
mov dword [ebp - 0x644], 1
cmp dword [ebp - 0x644], 0xc155
jle 0x1001e0c5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13dc], 0
je 0x1001e0c5
mov dword [ebp - 0x88c], 1
jmp 0x1001e0cc
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x64c], 0x4bb8
mov dword [ebp - 0xc10], 0x10008e68
cmp dword [ebp - 0x64c], 0x4e11
jle 0x1001e20a
and dword [ebp - 0x3e8], 0
jmp 0x1001e112
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x6b05
jge 0x1001e20a
and dword [ebp - 0x2d0], 0
jmp 0x1001e138
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x4e14
jge 0x1001e205
and dword [ebp - 0x2c8], 0
jmp 0x1001e15e
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x6cd5
jge 0x1001e200
and dword [ebp - 0x388], 0
jmp 0x1001e184
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x663b
jge 0x1001e1fb
mov eax, dword [ebp - 0x2c8]
imul eax, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x2d0]
sub ecx, eax
or ecx, dword [ebp - 0x3e8]
mov eax, ecx
cdq
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd34], edx
push dword [ebp - 0xd34]
push dword [ebp - 0xd38]
lea ecx, [ebp - 0x1664]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xe8c], eax
mov ecx, dword [ebp - 0xe8c]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x1664]
call fcn.1002fe3d
jmp 0x1001e177
jmp 0x1001e151
jmp 0x1001e12b
jmp 0x1001e105
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0xc08], 0xffffffff
mov dword [ebp - 0x1d8], 0
jmp 0x1001e237
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xfffffff8
jle 0x1001e2a4
mov dword [ebp - 0x168], 7
mov dword [ebp - 0x168], 0xfffffff9
jmp 0x1001e263
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xf
je 0x1001e2a2
mov dword [ebp - 0xe04], 0x513c61c7
push 1
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xe04]
push eax
call fcn.1001018e
add esp, 0x1c
jmp 0x1001e256
jmp 0x1001e22a
mov dword [ebp - 4], 0x1f
cmp dword [ebp - 0x64c], 0x4941
jge 0x1001e2c3
push dword [ebp - 0xc10]
call fcn.1004eea6
pop ecx
jmp 0x1001e2df
or dword [ebp - 4], 0xffffffff
jmp 0x1001e2e9
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x12cc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x2d8]
mov dword [ebp - 0x12d4], eax
mov eax, dword [ebp - 0x654]
imul eax, dword [ebp - 0x138]
test eax, eax
jge 0x1001e322
mov dword [ebp - 0x894], 1
jmp 0x1001e329
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x894], eax
jg 0x1001e340
mov dword [ebp - 0x65c], 1
jmp 0x1001e347
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0xed4], eax
jmp 0x1001d9cd
jmp 0x1001d09d
jmp 0x1001cb04
jmp 0x1001bc1f
jmp 0x1001b7ae
mov dword [ebp - 0xc18], 0x923ccde6
mov dword [ebp - 0xc20], 0xa421e0b
mov dword [ebp - 0xe94], 0x2735
mov dword [ebp - 0xc28], 7
mov dword [ebp - 0xe14], 0xb748abb7
mov dword [ebp - 0x12dc], 0xc22c9208
mov dword [ebp - 0x390], 0
jmp 0x1001e3c1
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 1
jge 0x1001e3dd
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x154], 0x34678dc2
jmp 0x1001e3b4
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc18]
cmp ecx, dword [ebp + eax - 0x154]
jg 0x1001e3fe
mov dword [ebp - 0xe0c], 1
jmp 0x1001e405
and dword [ebp - 0xe0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x12e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x12ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc20]
cmp ecx, dword [ebp + eax - 0x154]
jg 0x1001e44c
mov dword [ebp - 0xa80], 1
jmp 0x1001e453
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xe94]
cmp dword [ebp - 0xa80], eax
jge 0x1001e46d
mov dword [ebp - 0x664], 1
jmp 0x1001e474
and dword [ebp - 0x664], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x664], eax
jl 0x1001e497
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
cmp dword [ebp - 0xc28], 0x2071
jne 0x1001e4af
mov dword [ebp - 0x89c], 1
jmp 0x1001e4b6
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xe14], eax
mov dword [ebp - 0x2c], 4
jmp 0x1001e4d2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x19
jl 0x1001ef6c
mov dword [ebp - 0x1b8], 0xdd1e
mov dword [ebp - 0x66c], 1
mov dword [ebp - 0x12f4], 0x5741311e
mov dword [ebp - 0xc30], 0xbbd4856c
mov dword [ebp - 0xf54], 2
mov dword [ebp - 0xc48], 0xffffffff
push 0x7053
push 0x32ff
push 0
push 0x6e7a
push 0x763c
push 0x2673
push 0x2cdb
push 0
push 0x7c8f
push 0x68a0
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0x597b
call fcn.1000eaab
add esp, 0x34
mov dword [ebp - 0x1b8], 0xfffffffa
jmp 0x1001e578
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
je 0x1001e6bb
mov dword [ebp - 0xe9c], 0xd8143836
push 4
lea ecx, [ebp - 0x10b8]
call fcn.1002ff7c
mov dword [ebp - 4], 0x21
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0xc38], 0xa9711f64
mov dword [ebp - 0xb34], 0
lea eax, [ebp - 0x12fc]
push eax
lea eax, [ebp - 0x10b8]
push eax
push 1
push 0x5b16
push 0x7da1
push 1
push 0
call fcn.1001048f
add esp, 0x1c
lea eax, [ebp - 0xc30]
push eax
push 0x2606
push 1
push 0x2a65
push 0x2ed5
push 0x3755
lea eax, [ebp - 0xf54]
push eax
push 0x20eb
lea eax, [ebp - 0xc38]
push eax
push 0x7248
lea eax, [ebp - 0x10b8]
push eax
push 0xd88
lea eax, [ebp - 0xe1c]
push eax
push 0
lea eax, [ebp - 0xb34]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0x7239
lea eax, [ebp - 0xe9c]
push eax
push 0x30a0
push 0x1316
lea eax, [ebp - 0xc48]
push eax
call fcn.1002702b
add esp, 0x54
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1001e6a7
push 0x2c18
push 1
push 0
push 0x4b66
push 0x3477
push 1
push 0x3053
push 0x2781
push 0x3a61
push 0x28ba
call fcn.1002842e
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b8]
call fcn.1002fffe
jmp 0x1001e56b
mov dword [ebp - 0x190], 0xdd1e
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x1304], 0x5741311e
mov dword [ebp - 0x67c], 0xbbd4856c
mov dword [ebp - 0xe24], 2
mov dword [ebp - 0xc50], 0xffffffff
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x190], 0xfffffffa
jmp 0x1001e71c
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
je 0x1001ea40
mov dword [ebp - 0x2e8], 0xd8143836
push 4
lea ecx, [ebp - 0xb18]
call fcn.1002ff7c
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x69c], 0xa9711f64
mov dword [ebp - 0xee4], 0
mov dword [ebp - 0x2e0], 0
jmp 0x1001e77e
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 4
jge 0x1001e7a0
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xb18]
call fcn.1003001a
mov dword [eax], 1
jmp 0x1001e771
cmp dword [ebp - 0x418], 0
jne 0x1001e96c
mov eax, dword [ebp - 0x480]
dec eax
mov dword [ebp - 0x480], eax
je 0x1001e879
push 0
lea ecx, [ebp - 0xb18]
call fcn.1003001a
cmp dword [eax], 0
jne 0x1001e7de
mov dword [ebp - 0x9ac], 1
jmp 0x1001e7e5
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x9ac], eax
je 0x1001e7ff
mov dword [ebp - 0x674], 1
jmp 0x1001e806
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0xa8db
jge 0x1001e81e
mov dword [ebp - 0x8a4], 1
jmp 0x1001e825
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xf29c
jl 0x1001e849
mov dword [ebp - 0xa34], 1
jmp 0x1001e850
and dword [ebp - 0xa34], 0
mov esi, dword [ebp - 0xa34]
sub esi, 0x1e33ecdc
push 3
lea ecx, [ebp - 0xb18]
call fcn.1003001a
cmp esi, dword [eax]
je 0x1001e879
mov dword [ebp - 0x684], 1
jmp 0x1001e880
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xa36a77d7
jb 0x1001e898
mov dword [ebp - 0x8ac], 1
jmp 0x1001e89f
and dword [ebp - 0x8ac], 0
push 0
lea ecx, [ebp - 0xb18]
call fcn.1003001a
mov ecx, dword [ebp - 0x8ac]
cmp ecx, dword [eax]
jle 0x1001e8c2
mov dword [ebp - 0x68c], 1
jmp 0x1001e8c9
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xe24]
imul eax, dword [ebp - 0x68c]
cmp eax, 0x8dad
jle 0x1001e8e9
mov dword [ebp - 0x9b4], 1
jmp 0x1001e8f0
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x9b4], eax
jl 0x1001e90a
mov dword [ebp - 0x694], 1
jmp 0x1001e911
and dword [ebp - 0x694], 0
push 0
lea ecx, [ebp - 0xb18]
call fcn.1003001a
mov ecx, dword [ebp - 0x694]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x130c], eax
cmp dword [ebp - 0x69c], 0x3f045180
jl 0x1001e94a
mov dword [ebp - 0x8b4], 1
jmp 0x1001e951
and dword [ebp - 0x8b4], 0
imul eax, dword [ebp - 0x8b4], 0x6536
cmp eax, dword [ebp - 0x69c]
jne 0x1001e96c
and dword [ebp - 0xa78], 0
jmp 0x1001e976
mov dword [ebp - 0xa78], 1
mov eax, dword [ebp - 0xc50]
cmp dword [ebp - 0xa78], eax
jge 0x1001e990
mov dword [ebp - 0x6a4], 1
jmp 0x1001e997
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x6a4], eax
jne 0x1001e9b1
mov dword [ebp - 0x8bc], 1
jmp 0x1001e9b8
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0x1ac4
jge 0x1001e9d0
mov dword [ebp - 0x6ac], 1
jmp 0x1001e9d7
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x6ac], eax
jne 0x1001e9f1
mov dword [ebp - 0x9bc], 1
jmp 0x1001e9f8
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x2e8]
add eax, dword [ebp - 0x9bc]
mov dword [ebp - 0xee4], eax
mov byte [ebp - 0xf3], 0
lea eax, [ebp - 0xf3]
push eax
push 0x62dd
push 0
push 0x110b
call fcn.10028606
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb18]
call fcn.1002fffe
jmp 0x1001e70f
push 0x58ff
push 0x48ec
push 0
push 0x40a3
push 0x70bc
push 1
push 1
call fcn.1001048f
add esp, 0x1c
mov dword [ebp - 0x1314], 0x5d6c05ba
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1001ea89
push 0x1319
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x1001eacc
push 1
push 0
push 0x706c
push 0x34b
push 0x60ce
push 0
push 0x5598
push 0x87
push 0x5a41
push 0x369
call fcn.100133cf
add esp, 0x28
mov dword [ebp - 0xa4], 0
jmp 0x1001eae5
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1001eb01
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x490], 0x86cc6b0
jmp 0x1001ead8
mov dword [ebp - 0xa4], 0
jmp 0x1001eb1a
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1001eb36
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1590], 0x7da0bf3f
jmp 0x1001eb0d
mov dword [ebp - 0x488], 1
mov dword [ebp - 0x6b4], 0x97412df3
mov dword [ebp - 0x4c0], 0x555145cc
mov dword [ebp - 0xea4], 0x245f5b1b
mov dword [ebp - 0xc58], 0xca27289f
mov dword [ebp - 0xc68], 0xccd2466e
mov dword [ebp - 0xe2c], 0xfffffff7
mov dword [ebp - 0x398], 0x493e623b
mov dword [ebp - 0x4d8], 5
push 1
lea ecx, [ebp - 0xf00]
call fcn.1002ff7c
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x68], 0
jmp 0x1001ebb4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1001ebca
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xfec], 0xd8cf4c59
jmp 0x1001ebad
mov dword [ebp - 0x68], 0
jmp 0x1001ebda
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1001ebf6
push dword [ebp - 0x68]
lea ecx, [ebp - 0xf00]
call fcn.1003001a
mov dword [eax], 1
jmp 0x1001ebd3
push 0x612f
push 0
call fcn.10026282
pop ecx
pop ecx
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x8c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8c4]
mov dword [ebp + eax - 0xfec], ecx
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x8c4], eax
jge 0x1001ec56
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfec], 0
jne 0x1001ec56
and dword [ebp - 0x8cc], 0
jmp 0x1001ec60
mov dword [ebp - 0x8cc], 1
cmp dword [ebp - 0xc58], 0
je 0x1001ec7e
cmp dword [ebp - 0xe2c], 0
je 0x1001ec7e
mov dword [ebp - 0x6bc], 1
jmp 0x1001ec85
and dword [ebp - 0x6bc], 0
push 0
lea ecx, [ebp - 0xf00]
call fcn.1003001a
mov ecx, dword [ebp - 0x6bc]
cmp ecx, dword [eax]
jl 0x1001eca8
mov dword [ebp - 0xa3c], 1
jmp 0x1001ecaf
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0xa3c], eax
jg 0x1001ecc9
mov dword [ebp - 0x6c4], 1
jmp 0x1001ecd0
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0
je 0x1001ece5
mov dword [ebp - 0xc60], 1
jmp 0x1001ecec
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x131c], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0x4c0]
jle 0x1001ed2b
mov dword [ebp - 0x6cc], 1
jmp 0x1001ed32
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x8cc]
cmp eax, dword [ebp - 0x6cc]
jg 0x1001ed4c
mov dword [ebp - 0x9c4], 1
jmp 0x1001ed53
and dword [ebp - 0x9c4], 0
mov esi, dword [ebp - 0x488]
sub esi, dword [ebp - 0x9c4]
push 0
lea ecx, [ebp - 0xf00]
call fcn.1003001a
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xf00]
call fcn.1003001a
cmp esi, dword [eax]
jle 0x1001ed8b
mov dword [ebp - 0x6d4], 1
jmp 0x1001ed92
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0xffff
jne 0x1001edaa
mov dword [ebp - 0x8d4], 1
jmp 0x1001edb1
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
jne 0x1001edd8
cmp dword [ebp - 0xea4], 0
jne 0x1001edd8
and dword [ebp - 0x6dc], 0
jmp 0x1001ede2
mov dword [ebp - 0x6dc], 1
cmp dword [ebp - 0x6dc], 0x122d800f
jg 0x1001edfa
mov dword [ebp - 0xa7c], 1
jmp 0x1001ee01
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xc68], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.1002fffe
mov dword [ebp - 0x138], 0xfffffffa
cmp dword [ebp - 0x138], 0
je 0x1001ee3d
xor eax, eax
inc eax
jne 0x1001ee3d
and dword [ebp - 0x6e4], 0
jmp 0x1001ee47
mov dword [ebp - 0x6e4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
cmp dword [ebp - 0x6e4], eax
jle 0x1001ee68
mov dword [ebp - 0x8dc], 1
jmp 0x1001ee6f
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xb2d3f577
je 0x1001ee87
mov dword [ebp - 0x6ec], 1
jmp 0x1001ee8e
and dword [ebp - 0x6ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
cmp dword [ebp - 0x6ec], eax
je 0x1001eeaf
mov dword [ebp - 0x9cc], 1
jmp 0x1001eeb6
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x9cc], eax
jge 0x1001eecd
mov dword [ebp - 0x6f4], 1
jmp 0x1001eed4
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x6f4]
cmp eax, 0x5052de17
jle 0x1001eef6
mov dword [ebp - 0x8e4], 1
jmp 0x1001eefd
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0xa44]
cmp dword [ebp - 0x8e4], eax
jle 0x1001ef17
mov dword [ebp - 0x6fc], 1
jmp 0x1001ef1e
and dword [ebp - 0x6fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6fc]
dec ecx
cmp ecx, dword [ebp + eax - 0x490]
je 0x1001ef40
mov dword [ebp - 0x704], 1
jmp 0x1001ef47
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0xa44]
add eax, dword [ebp - 0x704]
mov dword [ebp - 0x64], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1590], 0x72faf722
jmp 0x1001e4cb
mov eax, dword [ebp - 0xe34]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0xbc], 0x1f7e2799
mov dword [ebp - 0x4e0], 6
mov dword [ebp - 0x1324], 1
mov dword [ebp - 0x132c], 0xffffffff
mov dword [ebp - 0x1334], 0xe280bfe7
mov dword [ebp - 0x133c], 0
mov dword [ebp - 0x1344], 0x12b94821
mov dword [ebp - 0x134c], 0xc3c3ae50
mov dword [ebp - 0x1354], 0
mov dword [ebp - 0x714], 0x879a9257
mov dword [ebp - 0x135c], 0x538fd232
mov dword [ebp - 0x2f0], 0
jmp 0x1001f002
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1001f01e
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1610], 0x3396d56a
jmp 0x1001eff5
mov dword [ebp - 0xbc], 0
jmp 0x1001f037
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffffa
je 0x1001f2dc
mov dword [ebp - 0x300], 1
mov dword [ebp - 0xf24], 0xfffffffe
mov dword [ebp - 0x1364], 0x9172ddb7
mov dword [ebp - 0x8ec], 0x3fe8
mov dword [ebp - 0xc70], 0x10008ed0
cmp dword [ebp - 0x8ec], 0x415c
jle 0x1001f0fb
and dword [ebp - 0x3f0], 0
jmp 0x1001f098
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x234b
jge 0x1001f0fb
and dword [ebp - 0x2f8], 0
jmp 0x1001f0ba
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x1299
jge 0x1001f0f9
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x2f8]
sar eax, cl
cdq
mov dword [ebp - 0xd44], eax
mov dword [ebp - 0xd40], edx
push dword [ebp - 0xd40]
push dword [ebp - 0xd44]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001f0ad
jmp 0x1001f08b
mov dword [ebp - 0x136c], 6
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x8ec], 0x3d7f
jge 0x1001f128
mov edx, dword [ebp - 0xc70]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001f144
or dword [ebp - 4], 0xffffffff
jmp 0x1001f14e
mov dword [ebp - 0x147c], 6
mov dword [ebp - 0x1484], 0x6eab3ae5
mov dword [ebp - 0x148c], 0x9a164e62
mov dword [ebp - 0x1128], 8
mov dword [ebp - 0x149c], 0x1832d74
mov dword [ebp - 0x3a0], 0
jmp 0x1001f199
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 4
jge 0x1001f1b5
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x1708], 0xfffffff8
jmp 0x1001f18c
cmp dword [ebp - 0xbc], 0
je 0x1001f237
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x300]
jg 0x1001f1d8
mov dword [ebp - 0x70c], 1
jmp 0x1001f1df
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
add eax, 0x33e3
imul eax, dword [ebp - 0xbc]
neg eax
mov ecx, dword [ebp - 0xbc]
sub ecx, eax
cmp ecx, dword [ebp - 0x300]
jl 0x1001f215
cmp dword [ebp - 0x300], 0
jne 0x1001f215
and dword [ebp - 0x9d4], 0
jmp 0x1001f21f
mov dword [ebp - 0x9d4], 1
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x14a4], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xf24], eax
cmp dword [ebp - 0x300], 0
je 0x1001f266
push 0
push 0
push 0xe26
push 1
push 0x1c38
call fcn.1000ee42
add esp, 0x14
jmp 0x1001f2d7
mov dword [ebp - 0x151c], 0x74b6046e
mov dword [ebp - 0x1524], 1
mov dword [ebp - 0x152c], 0xa0211e9a
mov dword [ebp - 0x1520], 0x30971cf7
mov dword [ebp - 0x1458], 0xffffffff
mov dword [ebp - 0x1330], 0x44fb66c1
mov dword [ebp - 0x1320], 0x62600bf0
mov dword [ebp - 0x1134], 0xf2d89188
mov dword [ebp - 0x146c], 2
mov dword [ebp - 0x113c], 0x7dbc155
mov eax, dword [ebp - 0x714]
dec eax
mov dword [ebp - 0x714], eax
jmp 0x1001f02a
cmp dword [ebp - 0x4ac], 0
jle 0x100252f0
push 3
lea ecx, [ebp - 0x50c]
call fcn.1002ff7c
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x8f4], 0xfffffffe
push 2
lea ecx, [ebp - 0xfd4]
call fcn.1002ff7c
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x72c], 0xffffffff
mov dword [ebp - 0xa4c], 0xfffb
mov dword [ebp - 0xe3c], 0x844ba928
push 0
lea eax, [ebp - 0x40]
push eax
push 0x1dd1
push 0x30f7
lea eax, [ebp - 0x50c]
push eax
call fcn.1002a0be
add esp, 0x14
mov dword [ebp - 0x40], 0
jmp 0x1001f365
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1001f381
push dword [ebp - 0x40]
lea ecx, [ebp - 0xfd4]
call fcn.1003001a
mov dword [eax], 0x15fb57a6
jmp 0x1001f35e
mov dword [ebp - 0x40], 0
jmp 0x1001f391
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1001f3a7
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x14e0], 0xee50
jmp 0x1001f38a
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
mov eax, dword [eax]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x71c], eax
push 0
lea ecx, [ebp - 0xfd4]
call fcn.1003001a
mov ecx, dword [ebp - 0x71c]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
mov ecx, dword [ebp - 0x71c]
cmp ecx, dword [eax]
jge 0x1001f400
mov dword [ebp - 0xaa4], 1
jmp 0x1001f407
and dword [ebp - 0xaa4], 0
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
mov ecx, dword [ebp - 0xaa4]
cmp ecx, dword [eax]
jge 0x1001f439
push 0
lea ecx, [ebp - 0xfd4]
call fcn.1003001a
cmp dword [eax], 0
jne 0x1001f439
and dword [ebp - 0x724], 0
jmp 0x1001f443
mov dword [ebp - 0x724], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14e0]
cmp dword [ebp - 0x724], eax
jne 0x1001f464
mov dword [ebp - 0x8fc], 1
jmp 0x1001f46b
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
sub eax, 0xbb932a1
imul eax, eax, 0
mov dword [ebp - 0x72c], eax
mov esi, dword [ebp - 0x72c]
push 1
lea ecx, [ebp - 0x50c]
call fcn.1003001a
cmp esi, dword [eax]
jge 0x1001f4a2
mov dword [ebp - 0x9dc], 1
jmp 0x1001f4a9
and dword [ebp - 0x9dc], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x14e0]
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
mov ecx, dword [ebp - 0x9dc]
imul ecx, dword [eax]
imul eax, ecx, 0x1031
cmp eax, esi
jle 0x1001f4e2
mov dword [ebp - 0xc78], 1
jmp 0x1001f4e9
and dword [ebp - 0xc78], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x14e0]
mov dword [ebp - 0x1328], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001f50e
mov dword [ebp - 0x734], 1
jmp 0x1001f515
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x5c57
jg 0x1001f52d
mov dword [ebp - 0x904], 1
jmp 0x1001f534
and dword [ebp - 0x904], 0
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x904]
jg 0x1001f557
mov dword [ebp - 0x73c], 1
jmp 0x1001f55e
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xa4c], eax
mov esi, dword [ebp - 0xa4c]
push 2
lea ecx, [ebp - 0x50c]
call fcn.1003001a
cmp esi, dword [eax]
jge 0x1001f58d
mov dword [ebp - 0x744], 1
jmp 0x1001f594
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0
jbe 0x1001f5a9
mov dword [ebp - 0x90c], 1
jmp 0x1001f5b0
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 5
jne 0x1001f5c5
mov dword [ebp - 0x74c], 1
jmp 0x1001f5cc
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0xe3c], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xfd4]
call fcn.1002fffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50c]
call fcn.1002fffe
mov dword [ebp - 0x14c], 1
mov dword [ebp - 0xe44], 1
mov dword [ebp - 0x1144], 0xfffffff6
mov dword [ebp - 0x430], 0
jmp 0x1001f62d
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 2
jge 0x1001f649
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0xfe4], 0x713b
jmp 0x1001f620
mov dword [ebp - 0x14c], 0
jmp 0x1001f662
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jg 0x1001fcff
mov dword [ebp - 0x103c], 0xe6e83846
mov dword [ebp - 0x1038], 0xe6e83846
mov dword [ebp - 0x1034], 0xe6e83846
mov dword [ebp - 0x1030], 0xe6e83846
lea ecx, [ebp - 0x4ad]
call fcn.10030029
push eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x103c]
push eax
lea ecx, [ebp - 0x15d4]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf10]
call fcn.1002ffd8
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x774], 0
mov dword [ebp - 0x924], 0xc3532716
push 3
lea ecx, [ebp - 0x107c]
call fcn.1002ff7c
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x308], 0
jmp 0x1001f711
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x1001f730
push dword [ebp - 0x308]
lea ecx, [ebp - 0x107c]
call fcn.1003001a
and dword [eax], 0
jmp 0x1001f704
push 1
lea ecx, [ebp - 0xf10]
call fcn.1003001a
and dword [eax], 0
jmp 0x1001f766
push 1
lea ecx, [ebp - 0xf10]
call fcn.1003001a
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x9e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9e4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xf10]
call fcn.1003001a
cmp dword [eax], 1
jg 0x1001fcdc
mov dword [ebp - 0x754], 0x76e
mov dword [ebp - 0xc80], 0x10008f28
cmp dword [ebp - 0x754], 0x80b
jle 0x1001f894
push 0
push 0
push 0x1a18
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
and dword [ebp - 0x3f8], 0
jmp 0x1001f7c7
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x49e8
jge 0x1001f894
and dword [ebp - 0x318], 0
jmp 0x1001f7ed
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x1fa8
jge 0x1001f88f
and dword [ebp - 0x3a8], 0
jmp 0x1001f813
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x256a
jge 0x1001f88a
and dword [ebp - 0x310], 0
jmp 0x1001f835
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xc50
jge 0x1001f885
mov esi, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x310]
shl esi, cl
mov eax, dword [ebp - 0x3f8]
cdq
idiv dword [ebp - 0x318]
or edx, esi
mov eax, edx
cdq
mov dword [ebp - 0xd50], eax
mov dword [ebp - 0xd4c], edx
push dword [ebp - 0xd4c]
push dword [ebp - 0xd50]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001f828
jmp 0x1001f806
jmp 0x1001f7e0
jmp 0x1001f7ba
mov dword [ebp - 0x3b0], 0x934215e1
mov byte [ebp - 4], 0x2a
cmp dword [ebp - 0x754], 0x670
jge 0x1001f8be
mov edx, dword [ebp - 0xc80]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1001f8da
mov dword [ebp - 4], 0x29
jmp 0x1001f8ea
mov dword [ebp - 0x4c8], 0xa2e42846
mov dword [ebp - 0x3b0], 1
jmp 0x1001f90d
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
jl 0x1001fc76
mov dword [ebp - 0x1d0], 0xdc2a82a1
mov dword [ebp - 0x914], 0x1b2e
mov dword [ebp - 0xc88], 0x10008fb0
cmp dword [ebp - 0x914], 0x1b3b
jle 0x1001fa56
and dword [ebp - 0x1f4], 0
jmp 0x1001f95e
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xb74
jge 0x1001fa56
and dword [ebp - 0x1f0], 0
jmp 0x1001f984
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x3489
jge 0x1001fa51
and dword [ebp - 0x204], 0
jmp 0x1001f9aa
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x335d
jge 0x1001fa4c
and dword [ebp - 0x20c], 0
jmp 0x1001f9d0
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x7159
jge 0x1001fa47
mov eax, dword [ebp - 0x1f4]
imul eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x204]
shl eax, cl
mov ecx, dword [ebp - 0x20c]
sar eax, cl
cdq
mov dword [ebp - 0xd5c], eax
mov dword [ebp - 0xd58], edx
push dword [ebp - 0xd58]
push dword [ebp - 0xd5c]
lea ecx, [ebp - 0x1688]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xeac], eax
mov ecx, dword [ebp - 0xeac]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x1688]
call fcn.1002fe3d
jmp 0x1001f9c3
jmp 0x1001f99d
jmp 0x1001f977
jmp 0x1001f951
mov dword [ebp - 0x1474], 0xcd021aa2
mov byte [ebp - 4], 0x2c
cmp dword [ebp - 0x914], 0x178b
jge 0x1001fa7c
push dword [ebp - 0xc88]
call fcn.1004eea6
pop ecx
jmp 0x1001fa98
mov dword [ebp - 4], 0x29
jmp 0x1001faa8
mov dword [ebp - 0x1d0], 0
jmp 0x1001fac1
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jg 0x1001fc42
mov dword [ebp - 0x214], 5
mov dword [ebp - 0x114c], 0x93765224
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1001fafc
push 0
call fcn.10028244
pop ecx
mov dword [ebp - 0x214], 1
jmp 0x1001fb15
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1001fc3d
mov dword [ebp - 0x11b8], 1
mov dword [ebp - 0x1154], 2
mov dword [ebp - 0xa84], 3
push 2
lea ecx, [ebp - 0x13ec]
call fcn.1002ff7c
mov byte [ebp - 4], 0x2e
push 0
lea eax, [ebp - 0x13ec]
push eax
lea eax, [ebp - 0x11bc]
push eax
push 1
push 0x5ba7
push 0x4b11
call fcn.1000ed5c
add esp, 0x18
xor eax, eax
jne 0x1001fb8b
cmp dword [ebp - 0xa84], 0
jne 0x1001fb8b
and dword [ebp - 0x75c], 0
jmp 0x1001fb95
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x4c8]
imul eax, dword [ebp - 0x75c]
cmp eax, dword [ebp - 0xa84]
jge 0x1001fbb6
mov dword [ebp - 0x764], 1
jmp 0x1001fbbd
and dword [ebp - 0x764], 0
push 1
lea ecx, [ebp - 0xf10]
call fcn.1003001a
mov ecx, dword [ebp - 0x764]
cmp ecx, dword [eax]
jle 0x1001fbe0
mov dword [ebp - 0x498], 1
jmp 0x1001fbe7
and dword [ebp - 0x498], 0
push 1
lea ecx, [ebp - 0x107c]
call fcn.1003001a
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0x1d0]
push eax
push 1
lea eax, [ebp - 0x924]
push eax
push 0x20c0
push 1
push 0
call fcn.10010880
add esp, 0x18
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x13ec]
call fcn.1002fffe
jmp 0x1001fb08
jmp 0x1001fab4
mov eax, dword [ebp - 0x14c]
cmp dword [ebp + eax*4 - 0xfe4], 0
jne 0x1001fc5e
mov dword [ebp - 0x91c], 1
jmp 0x1001fc65
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x4c8], eax
jmp 0x1001f900
cmp dword [ebp - 0xe44], 0
jne 0x1001fc8d
xor eax, eax
inc eax
jne 0x1001fc8d
and dword [ebp - 0x76c], 0
jmp 0x1001fc97
mov dword [ebp - 0x76c], 1
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp + eax*4 - 0xfe4]
cmp eax, dword [ebp - 0x76c]
jg 0x1001fcb8
mov dword [ebp - 0x9ec], 1
jmp 0x1001fcbf
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x924], eax
jmp 0x1001f742
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x107c]
call fcn.1002fffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.1002fffe
jmp 0x1001f655
mov dword [ebp - 0x77c], 0x76fd
mov dword [ebp - 0xef4], 0x10008ff8
cmp dword [ebp - 0x77c], 0x7a32
jle 0x1001fdff
and dword [ebp - 0x22c], 0
jmp 0x1001fd39
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x142d
jge 0x1001fdff
and dword [ebp - 0x21c], 0
jmp 0x1001fd5f
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x4216
jge 0x1001fdfa
and dword [ebp - 0x224], 0
jmp 0x1001fd85
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x34eb
jge 0x1001fdf5
and dword [ebp - 0x234], 0
jmp 0x1001fda7
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x9f0
jge 0x1001fdf3
mov eax, dword [ebp - 0x21c]
cdq
idiv dword [ebp - 0x224]
mov eax, dword [ebp - 0x22c]
sub eax, edx
add eax, dword [ebp - 0x234]
cdq
mov dword [ebp - 0xd68], eax
mov dword [ebp - 0xd64], edx
push dword [ebp - 0xd64]
push dword [ebp - 0xd68]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1001fd9a
jmp 0x1001fd78
jmp 0x1001fd52
jmp 0x1001fd2c
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x115c], 0xfffffffb
push 3
lea ecx, [ebp - 0x13fc]
call fcn.1002ff7c
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0xc90], 3
mov dword [ebp - 0x11c4], 1
mov dword [ebp - 0x70], 0
jmp 0x1001fe4b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001fe61
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x164c], 9
jmp 0x1001fe44
mov dword [ebp - 0x70], 0
jmp 0x1001fe71
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001fe8d
push dword [ebp - 0x70]
lea ecx, [ebp - 0x13fc]
call fcn.1003001a
mov dword [eax], 0xa18e418a
jmp 0x1001fe6a
mov dword [ebp - 0x23c], 0
jmp 0x1001fea6
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xd
jge 0x1002002a
mov dword [ebp - 0x244], 0xfffffffb
mov dword [ebp - 0x1164], 0x17c10977
mov dword [ebp - 0x244], 0
jmp 0x1001fee0
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jg 0x1002000a
mov dword [ebp - 0x24c], 0
jmp 0x1001ff06
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x1001ff22
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xfb0], 0xfffffffa
jmp 0x1001fef9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xfb0], 0
jmp 0x1001ff4d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfb0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xfb0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xfb0], 2
jg 0x10020005
mov dword [ebp - 0x254], 0x68044455
mov dword [ebp - 0x254], 0
jmp 0x1001ff83
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jg 0x10020000
mov byte [ebp - 0xe5], 0
lea eax, [ebp - 0xe5]
push eax
push 0x136c
push 0
push 0
call fcn.1002652e
add esp, 0x10
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001fffb
push 0xf4d
push 0x25d9
push 0x70ad
push 0x5f07
push 0
push 0x71a3
push 0xaaf
push 0
push 0x1df3
push 0x3e1e
push 0x15a7
push 0x3d42
call fcn.10010efe
add esp, 0x30
jmp 0x1001ff76
jmp 0x1001ff34
jmp 0x1001fed3
push 0x4ed6
lea eax, [ebp - 0xc90]
push eax
push 0x682f
push 0
call fcn.10027a00
add esp, 0x10
jmp 0x1001fe99
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13fc]
call fcn.1002fffe
mov dword [ebp - 4], 0x30
cmp dword [ebp - 0x77c], 0x76ee
jge 0x1002005c
mov edx, dword [ebp - 0xef4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x10020078
or dword [ebp - 4], 0xffffffff
jmp 0x10020082
mov dword [ebp - 0xc4], 0x1f7e2799
mov dword [ebp - 0xa54], 0x831
mov dword [ebp - 0xc98], 0x10009068
cmp dword [ebp - 0xa54], 0x8b4
jle 0x10020123
and dword [ebp - 0x25c], 0
jmp 0x100200c2
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x759a
jge 0x10020123
and dword [ebp - 0x264], 0
jmp 0x100200e4
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x366f
jge 0x10020121
mov eax, dword [ebp - 0x25c]
sub eax, dword [ebp - 0x264]
cdq
mov dword [ebp - 0xd74], eax
mov dword [ebp - 0xd70], edx
push dword [ebp - 0xd70]
push dword [ebp - 0xd74]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x100200d7
jmp 0x100200b5
mov dword [ebp - 0x47c], 6
mov dword [ebp - 4], 0x32
cmp dword [ebp - 0xa54], 0x63c
jge 0x10020150
mov edx, dword [ebp - 0xc98]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002016c
or dword [ebp - 4], 0xffffffff
jmp 0x10020176
mov dword [ebp - 0x104], 0xa50b5f0b
mov dword [ebp - 0x78], 0xf59172dd
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x4a0], 0xbb66efe0
mov dword [ebp - 0x11cc], 0xbfe73744
mov dword [ebp - 0x4cc], 1
mov dword [ebp - 0xca0], 0x6de6eab3
push 3
lea ecx, [ebp - 0xf98]
call fcn.1002ff7c
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x4a8], 0xb9ab
mov dword [ebp - 0xeb4], 0x165aae70
mov dword [ebp - 0x116c], 0x41bd8e70
mov dword [ebp - 0x11d4], 3
mov dword [ebp - 0x1174], 0x8d11a6c9
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0xca8], 0xa6071001
mov dword [ebp - 0x48], 0
jmp 0x10020223
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10020239
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xf74], 7
jmp 0x1002021c
lea eax, [ebp - 0x48]
push eax
push 0x72ba
push 0x5c2a
push 1
lea eax, [ebp - 0xf98]
push eax
push 0
call fcn.10015c05
add esp, 0x18
mov dword [ebp - 0x48], 0
jmp 0x1002026a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x10020280
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x11a4], 1
jmp 0x10020263
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf74]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x1002043d
cmp dword [ebp - 0x104], 0
jne 0x100202fe
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf74]
imul eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0x104]
je 0x100202d0
mov dword [ebp - 0x784], 1
jmp 0x100202d7
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
imul eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x198]
jle 0x100202fe
and dword [ebp - 0xe4c], 0
jmp 0x10020308
mov dword [ebp - 0xe4c], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x104]
je 0x1002032b
mov dword [ebp - 0x92c], 1
jmp 0x10020332
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 0x232c2a4e
je 0x1002034a
mov dword [ebp - 0x78c], 1
jmp 0x10020351
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0
jne 0x10020373
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf74], 0
jne 0x10020373
and dword [ebp - 0x9f4], 0
jmp 0x1002037d
mov dword [ebp - 0x9f4], 1
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x9f4], eax
jl 0x10020397
mov dword [ebp - 0x794], 1
jmp 0x1002039e
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x78], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf74]
cmp eax, dword [ebp - 0x78]
jl 0x100203c4
mov dword [ebp - 0x934], 1
jmp 0x100203cb
and dword [ebp - 0x934], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf74]
cmp dword [ebp - 0x934], eax
jne 0x100203ec
mov dword [ebp - 0x79c], 1
jmp 0x100203f3
and dword [ebp - 0x79c], 0
imul eax, dword [ebp - 0x79c], 0
test eax, eax
jne 0x10020419
push 2
lea ecx, [ebp - 0xf98]
call fcn.1003001a
cmp dword [eax], 0
jne 0x10020419
and dword [ebp - 0xa9c], 0
jmp 0x10020423
mov dword [ebp - 0xa9c], 1
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0xa9c], eax
je 0x1002043d
mov dword [ebp - 0x7a4], 1
jmp 0x10020444
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x7a4]
cmp eax, dword [ebp - 0xca0]
jg 0x10020464
mov dword [ebp - 0x93c], 1
jmp 0x1002046b
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
add eax, 0x7fff7a8
cmp eax, 0x62600bf0
jne 0x10020489
mov dword [ebp - 0x7ac], 1
jmp 0x10020490
and dword [ebp - 0x7ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf74]
cmp dword [ebp - 0x7ac], eax
jle 0x100204b1
mov dword [ebp - 0x9fc], 1
jmp 0x100204b8
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
sub eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x4a8]
jl 0x100204d8
mov dword [ebp - 0x7b4], 1
jmp 0x100204df
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x117c], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x11e4], eax
mov esi, dword [ebp - 0x4cc]
push 1
lea ecx, [ebp - 0xf98]
call fcn.1003001a
mov eax, dword [eax]
sub eax, esi
je 0x10020603
mov dword [ebp - 0x1184], 9
mov dword [ebp - 0xcb0], 0xe816884
mov dword [ebp - 0x11ec], 1
mov dword [ebp - 0x1190], 0xfffffffe
mov dword [ebp - 0x11f4], 0x340c09c4
mov dword [ebp - 0x119c], 1
mov dword [ebp - 0x11fc], 4
mov dword [ebp - 0x11a8], 0x961dfa23
mov dword [ebp - 0x14f4], 1
mov dword [ebp - 0x14f0], 1
mov dword [ebp - 0x14ec], 1
mov dword [ebp - 0x14e8], 1
mov dword [ebp - 0x1204], 0xf8e16d71
mov dword [ebp - 0xe54], 0xcfa70dae
push 1
lea eax, [ebp - 0xeb4]
push eax
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 1
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 0x3b0d
lea eax, [ebp - 0x4a8]
push eax
push 0x5dcd
push 0x1e7f
call fcn.1000e3b9
add esp, 0x38
jmp 0x100206de
mov dword [ebp - 0x26c], 0
jmp 0x1002061c
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x10020638
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1198], 0xffffffff
jmp 0x1002060f
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1002066c
push 1
push 0x537e
push 0
push 1
push 0x144f
push 0x37b7
push 0x6523
call fcn.1001018e
add esp, 0x1c
mov dword [ebp - 0x78], 0
jmp 0x1002067c
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffff8
jge 0x100206de
mov dword [ebp - 0x1c0], 0
jmp 0x1002069b
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x1c
jge 0x100206dc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1198], 1
jge 0x100206c0
mov dword [ebp - 0x944], 1
jmp 0x100206c7
and dword [ebp - 0x944], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x944]
mov dword [ebp + eax - 0x11a4], ecx
jmp 0x1002068e
jmp 0x10020675
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf98]
call fcn.1002fffe
mov dword [ebp - 0x11b4], 1
mov dword [ebp - 0x1a0], 0x97f6af11
mov dword [ebp - 0x1064], 0x41449c9f
mov dword [ebp - 0x1060], 0x41449c9f
mov dword [ebp - 0x105c], 0x41449c9f
mov dword [ebp - 0x1058], 0x41449c9f
lea ecx, [ebp - 0x4c1]
call fcn.10030029
push eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x1064]
push eax
lea ecx, [ebp - 0x15dc]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x140c]
call fcn.1002ffd8
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x1a0], 0xffffffe6
jmp 0x1002077e
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xd
jle 0x10020903
mov dword [ebp - 0x80], 5
mov dword [ebp - 0x80], 0x18
jmp 0x100207a2
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffffd
je 0x100207e1
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100207df
push 0x23fc
push 0x73c2
push 0x3f37
push 0x1a1b
push 1
push 0x5dea
push 0
call fcn.10010e13
add esp, 0x1c
jmp 0x1002079b
mov dword [ebp - 0x80], 0xfffffffb
jmp 0x100207f1
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffff9
je 0x100208fe
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0x1ec], 0
jmp 0x1002081e
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x1002083a
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x1578], 0
jmp 0x10020811
mov dword [ebp - 0x1e0], 3
jmp 0x10020853
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x100208f9
mov byte [ebp - 0xe9], 0
push 0x3678
push 0x4e9c
push 0
push 0x62f9
push 1
lea eax, [ebp - 0xe9]
push eax
push 0x3999
call fcn.10016b73
add esp, 0x1c
xor eax, eax
inc eax
je 0x100208db
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x1a0]
cmp eax, 1
jne 0x100208ad
mov dword [ebp - 0x7bc], 1
jmp 0x100208b4
and dword [ebp - 0x7bc], 0
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x140c]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7bc]
jle 0x100208db
mov dword [ebp - 0xa5c], 1
jmp 0x100208e2
and dword [ebp - 0xa5c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa5c]
mov dword [ebp + eax - 0x1578], ecx
jmp 0x10020846
jmp 0x100207ea
jmp 0x10020771
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140c]
call fcn.1002fffe
mov dword [ebp - 0x120c], 0xffffffff
mov dword [ebp - 0x1214], 0xe280bfe7
mov dword [ebp - 0x1a8], 7
mov dword [ebp - 0xcc0], 0
mov dword [ebp - 0xcc8], 0xfffffffb
mov dword [ebp - 0xe5c], 0xafbd13d
mov dword [ebp - 0xebc], 5
mov dword [ebp - 0x1a8], 0x17
jmp 0x10020971
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 9
je 0x10020a51
push 2
lea ecx, [ebp - 0x10ac]
call fcn.1002ff7c
mov dword [ebp - 4], 0x36
mov dword [ebp - 0xf44], 0xd99ea7eb
mov dword [ebp - 0xcb8], 0xb676bd76
lea eax, [ebp - 0x11c0]
push eax
push 0
push 1
push 0x255c
lea eax, [ebp - 0x10ac]
push eax
push 0x4b0b
push 0x6785
push 0x4249
push 0x3d85
call fcn.1000f8e3
add esp, 0x24
lea eax, [ebp - 0x1a8]
push eax
push 0x6f94
lea eax, [ebp - 0xf44]
push eax
push 0x14f3
push 0x67f3
push 1
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0x10ac]
push eax
push 1
push 0
push 0x3f4c
lea eax, [ebp - 0xebc]
push eax
push 0x6703
push 0x171a
lea eax, [ebp - 0xcc8]
push eax
call fcn.1000fce0
add esp, 0x44
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.1002fffe
jmp 0x10020964
mov dword [ebp - 0x14a8], 0
push 3
lea ecx, [ebp - 0xa94]
call fcn.1002ff7c
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x530], 0x9e843631
mov dword [ebp - 0x954], 0x43ccc099
mov dword [ebp - 0x11c8], 0xed5b6062
mov dword [ebp - 0x274], 0
jmp 0x10020aa6
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x10020ac8
push dword [ebp - 0x274]
lea ecx, [ebp - 0xa94]
call fcn.1003001a
mov dword [eax], 0x7ddc85f7
jmp 0x10020a99
push 1
lea ecx, [ebp - 0xa94]
call fcn.1003001a
and dword [eax], 0
jmp 0x10020afe
push 1
lea ecx, [ebp - 0xa94]
call fcn.1003001a
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa94]
call fcn.1003001a
cmp dword [eax], 0xfffffff8
jge 0x1002104b
push 4
lea ecx, [ebp - 0xab4]
call fcn.1002ff7c
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x1124], 0x88acc167
mov dword [ebp - 0x1120], 0x88acc167
mov dword [ebp - 0x111c], 0x88acc167
mov dword [ebp - 0x1118], 0x88acc167
push 0x2d6f
push 0x4e39
push 1
push 0x74b5
push 0x3e59
push 0
push 0x51bb
lea eax, [ebp - 0xab4]
push eax
push 0x79fc
lea eax, [ebp - 0x1338]
push eax
push 0x77e8
push 0x33df
call fcn.1000e622
add esp, 0x30
mov dword [ebp - 0x94c], 0xa78
mov dword [ebp - 0xe64], 0x100090d4
cmp dword [ebp - 0x94c], 0xc9b
jle 0x10020c4e
push 0x1982
push 0x1033
call dword [sym.imp.GDI32.dll_SetLayout]
and dword [ebp - 0x27c], 0
jmp 0x10020be3
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x5add
jge 0x10020c44
and dword [ebp - 0x284], 0
jmp 0x10020c05
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0x53f8
jge 0x10020c42
mov eax, dword [ebp - 0x27c]
add eax, dword [ebp - 0x284]
cdq
mov dword [ebp - 0xd80], eax
mov dword [ebp - 0xd7c], edx
push dword [ebp - 0xd7c]
push dword [ebp - 0xd80]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x10020bf8
jmp 0x10020bd6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov byte [ebp - 4], 0x39
cmp dword [ebp - 0x94c], 0x947
jge 0x10020c6e
mov edx, dword [ebp - 0xe64]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x10020c8a
mov dword [ebp - 4], 0x38
jmp 0x10020c9a
push 3
lea ecx, [ebp - 0xab4]
call fcn.1003001a
mov dword [eax], 0xffffffe6
jmp 0x10020cd3
push 3
lea ecx, [ebp - 0xab4]
call fcn.1003001a
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xab4]
call fcn.1003001a
cmp dword [eax], 0x19
jne 0x10021037
push 2
lea ecx, [ebp - 0xb30]
call fcn.1002ff7c
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x28c], 0
jmp 0x10020d1d
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x10020d3f
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xb30]
call fcn.1003001a
mov dword [eax], 0x48afa2fa
jmp 0x10020d10
push 1
lea ecx, [ebp - 0xb30]
call fcn.1003001a
and dword [eax], 0
jmp 0x10020d75
push 1
lea ecx, [ebp - 0xb30]
call fcn.1003001a
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xa04]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa04]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb30]
call fcn.1003001a
cmp dword [eax], 0
jne 0x10020fde
mov dword [ebp - 0xcd0], 0x4acc
mov dword [ebp - 0x294], 0
jmp 0x10020dae
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x10020dca
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xae0], 0x9f8d19c9
jmp 0x10020da1
push 2
lea ecx, [ebp - 0xa94]
call fcn.1003001a
mov eax, dword [eax]
mov dword [ebp - 0x120], eax
mov esi, dword [ebp - 0x120]
push 3
lea ecx, [ebp - 0xab4]
call fcn.1003001a
cmp esi, dword [eax]
jge 0x10020e02
mov dword [ebp - 0x7d4], 1
jmp 0x10020e09
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 0x4adc6f79
jne 0x10020e2d
mov dword [ebp - 0x7dc], 1
jmp 0x10020e34
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xffff
jbe 0x10020e4c
mov dword [ebp - 0x7f4], 1
jmp 0x10020e53
and dword [ebp - 0x7f4], 0
push 3
lea ecx, [ebp - 0xab4]
call fcn.1003001a
mov ecx, dword [ebp - 0x7f4]
cmp ecx, dword [eax]
jge 0x10020e76
mov dword [ebp - 0x7e4], 1
jmp 0x10020e7d
and dword [ebp - 0x7e4], 0
push 2
lea ecx, [ebp - 0xa94]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7e4]
jge 0x10020ea0
mov dword [ebp - 0x7f8], 1
jmp 0x10020ea7
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 8
jae 0x10020ebc
mov dword [ebp - 0x7ec], 1
jmp 0x10020ec3
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0xcd0]
cmp dword [ebp - 0x7ec], eax
jl 0x10020edd
mov dword [ebp - 0x800], 1
jmp 0x10020ee4
and dword [ebp - 0x800], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xae0]
cmp dword [ebp - 0x800], eax
jle 0x10020f05
mov dword [ebp - 0x514], 1
jmp 0x10020f0c
and dword [ebp - 0x514], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xae0]
add esi, dword [ebp - 0x514]
push 1
lea ecx, [ebp - 0xa94]
call fcn.1003001a
cmp esi, dword [eax]
jne 0x10020f3d
xor eax, eax
jne 0x10020f3d
and dword [ebp - 0x518], 0
jmp 0x10020f47
mov dword [ebp - 0x518], 1
mov esi, dword [ebp - 0x538]
push 1
lea ecx, [ebp - 0xb30]
call fcn.1003001a
mov ecx, dword [ebp - 0x518]
add ecx, dword [eax]
cmp ecx, esi
jge 0x10020f72
mov dword [ebp - 0x520], 1
jmp 0x10020f79
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0x58905b8b
jg 0x10020f91
mov dword [ebp - 0x528], 1
jmp 0x10020f98
and dword [ebp - 0x528], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xae0]
mov dword [ebp - 0x530], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x528]
sub ecx, dword [ebp + eax - 0xae0]
mov eax, dword [ebp - 0x530]
sub eax, ecx
sub eax, dword [ebp - 0x538]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1124], eax
jmp 0x10020d51
mov dword [ebp - 0x120], 0
jmp 0x10020ff7
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x11
jl 0x10021023
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x10021021
push 0x240f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x10020fea
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xb30]
call fcn.1002fffe
jmp 0x10020caf
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xab4]
call fcn.1002fffe
jmp 0x10020ada
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa94]
call fcn.1002fffe
mov dword [ebp - 0x11d0], 0x12b94821
push 2
lea ecx, [ebp - 0x10c4]
call fcn.1002ff7c
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x16c], 0xfffffff9
mov dword [ebp - 0x29c], 0
jmp 0x1002109b
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x100210ba
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x10c4]
call fcn.1003001a
or dword [eax], 0xffffffff
jmp 0x1002108e
mov dword [ebp - 0x16c], 0
jmp 0x100210d3
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jg 0x10021146
mov dword [ebp - 0xcdc], 0
mov dword [ebp - 0xce8], 0
mov dword [ebp - 0xe6c], 0xfffffffe
mov dword [ebp - 0xf04], 0xfffffff9
lea eax, [ebp - 0xf04]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0x10c4]
push eax
push 0x30c
push 0
push 0x152c
lea eax, [ebp - 0xce8]
push eax
call fcn.1002a4c1
add esp, 0x28
jmp 0x100210c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c4]
call fcn.1002fffe
mov dword [ebp - 0x1460], 0xc3c3ae50
push 4
lea ecx, [ebp - 0xaf4]
call fcn.1002ff7c
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x88], 0
jmp 0x10021196
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x100211b2
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x15bc], 0x10c9
jmp 0x10021189
mov dword [ebp - 0x88], 0
jmp 0x100211cb
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x100211ea
push dword [ebp - 0x88]
lea ecx, [ebp - 0xaf4]
call fcn.1003001a
or dword [eax], 0xffffffff
jmp 0x100211be
push 2
lea ecx, [ebp - 0xaf4]
call fcn.1003001a
mov dword [eax], 3
jmp 0x10021223
push 2
lea ecx, [ebp - 0xaf4]
call fcn.1003001a
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x540]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xaf4]
call fcn.1003001a
cmp dword [eax], 0
jl 0x100212c7
push 2
lea ecx, [ebp - 0xaf4]
call fcn.1003001a
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x15bc]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x174], 0
jmp 0x1002126e
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 8
jge 0x100212c2
mov byte [ebp - 0xeb], 0
push 0
push 0x37b8
push 0x7327
push 0x6a3d
push 0
push 0x6269
push 0xc92
push 0x380e
push 0x4b86
push 0x4356
lea eax, [ebp - 0xeb]
push eax
push 1
push 0x5ebb
call fcn.10026a77
add esp, 0x34
jmp 0x10021261
jmp 0x100211ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.1002fffe
mov dword [ebp - 0x11d8], 0
mov dword [ebp - 0xe74], 0xffffffff
mov dword [ebp - 0xd00], 0xfffffff7
push 4
lea ecx, [ebp - 0x10dc]
call fcn.1002ff7c
mov dword [ebp - 4], 0x3e
mov dword [ebp - 0x548], 0x6d63
mov dword [ebp - 0xec4], 0x10009118
cmp dword [ebp - 0x548], 0x704e
jle 0x100213d6
and dword [ebp - 0x2a4], 0
jmp 0x10021342
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x4e69
jge 0x100213d6
and dword [ebp - 0x2ac], 0
jmp 0x10021368
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x1f00
jge 0x100213d1
and dword [ebp - 0x2b4], 0
jmp 0x1002138a
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x1ced
jge 0x100213cf
mov eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0x2ac]
imul eax, dword [ebp - 0x2b4]
cdq
mov dword [ebp - 0xd8c], eax
mov dword [ebp - 0xd88], edx
push dword [ebp - 0xd88]
push dword [ebp - 0xd8c]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002137d
jmp 0x1002135b
jmp 0x10021335
mov dword [ebp - 0xcf4], 0x3d2c82f3
mov byte [ebp - 4], 0x3f
cmp dword [ebp - 0x548], 0x6a74
jge 0x10021400
mov edx, dword [ebp - 0xec4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002141c
mov dword [ebp - 4], 0x3e
jmp 0x1002142c
mov dword [ebp - 0x2bc], 0
jmp 0x10021445
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x10021464
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x10dc]
call fcn.1003001a
and dword [eax], 0
jmp 0x10021438
lea eax, [ebp - 0xcf4]
push eax
lea eax, [ebp - 0x10dc]
push eax
push 0x193b
push 0
push 0x198
push 1
lea eax, [ebp - 0xe74]
push eax
push 0x5aab
push 0x6ac0
lea eax, [ebp - 0xd00]
push eax
call fcn.1000f457
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10dc]
call fcn.1002fffe
push 2
lea ecx, [ebp - 0xfc8]
call fcn.1002ff7c
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0xf34], 0
push 0x4085
push 0x7e34
push 1
lea eax, [ebp - 0xfc8]
push eax
lea eax, [ebp - 0x1340]
push eax
push 0x30c6
push 0
push 0x4447
call fcn.10016da3
add esp, 0x20
mov dword [ebp - 0x17c], 1
jmp 0x1002151e
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x10021651
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0xe7c], 0xfffffff7
mov dword [ebp - 0xd18], 0xf5c9b8db
mov dword [ebp - 0x50], 1
jmp 0x10021556
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x100215c9
mov dword [ebp - 0x10c], 0x73d2
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], 0
jmp 0x1002158c
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jg 0x100215c7
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xfc8]
push eax
push 0x420a
push 0x5272
lea eax, [ebp - 0x10c]
push eax
push 0x58ae
push 0x320d
call fcn.100269ee
add esp, 0x20
jmp 0x1002157f
jmp 0x1002154f
mov dword [ebp - 0x50], 1
jmp 0x100215d9
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1002164c
mov dword [ebp - 0xd24], 0x2b53
mov dword [ebp - 0xdd4], 0xf79facd4
mov dword [ebp - 0xd0c], 6
lea eax, [ebp - 0xf34]
push eax
push 0x531b
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0xd0c]
push eax
push 1
lea eax, [ebp - 0xe7c]
push eax
lea eax, [ebp - 0xd18]
push eax
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xdd4]
push eax
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xfc8]
push eax
call fcn.10010efe
add esp, 0x30
jmp 0x100215d2
jmp 0x10021511
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc8]
call fcn.1002fffe
mov dword [ebp - 0x908], 0x879a9257
mov dword [ebp - 0x11e0], 0x538fd232
push 1
lea ecx, [ebp - 0xf20]
call fcn.1002ff7c
mov dword [ebp - 4], 0x42
mov dword [ebp - 0x2c4], 9
push 0x26f4
push 0x623f
push 1
push 0
lea eax, [ebp - 0xf20]
push eax
push 0x6e76
lea eax, [ebp - 0x184]
push eax
call fcn.100150d7
add esp, 0x1c
mov dword [ebp - 0x184], 0
jmp 0x100216d4
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x100216f0
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xacc], 0x4f37831e
jmp 0x100216c7
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xacc], 0
jmp 0x1002171e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xacc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xacc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xacc], 0
jl 0x100217a1
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xacc]
lea ecx, [ebp - 0xf20]
call fcn.1003001a
cmp dword [eax], 0xfc371865
jae 0x1002175a
mov dword [ebp - 0x550], 1
jmp 0x10021761
and dword [ebp - 0x550], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xacc]
lea ecx, [ebp - 0xf20]
call fcn.1003001a
mov ecx, dword [ebp - 0x550]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xacc]
lea ecx, [ebp - 0xf20]
call fcn.1003001a
or dword [eax], 0xffffffff
jmp 0x10021703
mov dword [ebp - 0x2c4], 0xfffffffa
jmp 0x100217ba
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x15
jge 0x10021840
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x100217e4
push 0x1e2d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1002183b
push 0
push 0x2725
push 0x2254
push 0x7d87
push 1
push 0
push 0x473c
push 0x2bf9
push 0x5915
push 0x5b10
push 0x390a
push 0x3548
push 0x2bdb
push 0x6377
call fcn.1000e3b9
add esp, 0x38
jmp 0x100217ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf20]
call fcn.1002fffe
mov dword [ebp - 0x2cc], 0
jmp 0x10021868
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x10021884
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x1670], 0x3396d56a
jmp 0x1002185b
mov dword [ebp - 0x150c], 0x124f01c0
mov dword [ebp - 0x11e8], 0xa3df603f
mov dword [ebp - 0x1348], 8
mov dword [ebp - 0x11f0], 1
mov dword [ebp - 0x1468], 0x5912491e
mov dword [ebp - 0x558], 0x3eb2
mov dword [ebp - 0xd30], 0x100091a8
cmp dword [ebp - 0x558], 0x4003
jle 0x100219b8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0x2e4], 0
jmp 0x100218f6
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xb85
jge 0x100219b8
and dword [ebp - 0x2d4], 0
jmp 0x1002191c
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x73ff
jge 0x100219b3
and dword [ebp - 0x2dc], 0
jmp 0x10021942
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x2c4f
jge 0x100219ae
mov eax, dword [ebp - 0x2d4]
cdq
idiv dword [ebp - 0x2dc]
and edx, dword [ebp - 0x2e4]
mov eax, edx
cdq
mov dword [ebp - 0xd98], eax
mov dword [ebp - 0xd94], edx
push dword [ebp - 0xd94]
push dword [ebp - 0xd98]
lea ecx, [ebp - 0x16b8]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0xde8], eax
mov ecx, dword [ebp - 0xde8]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x16b8]
call fcn.1002fe3d
jmp 0x10021935
jmp 0x1002190f
jmp 0x100218e9
push 2
lea ecx, [ebp - 0x141c]
call fcn.1002ff7c
mov dword [ebp - 4], 0x43
mov byte [ebp - 4], 0x44
cmp dword [ebp - 0x558], 0x3b4f
jge 0x100219e8
push dword [ebp - 0xd30]
call fcn.1004eea6
pop ecx
jmp 0x10021a04
mov dword [ebp - 4], 0x43
jmp 0x10021a14
mov dword [ebp - 0x11f8], 0xffffffff
mov dword [ebp - 0xdf0], 1
push 0x4dfe
lea eax, [ebp - 0x141c]
push eax
push 0
push 0x43d0
push 0x6437
lea eax, [ebp - 0x1350]
push eax
push 0x779a
push 0x3fae
call fcn.10026a3f
add esp, 0x20
push 0x512b
lea eax, [ebp - 0xdf0]
push eax
push 0x4d23
push 0
call fcn.10029fd7
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x141c]
call fcn.1002fffe
mov dword [ebp - 0xc4], 0
jmp 0x10021a9c
cmp dword [ebp - 0xc4], 0xfffffffa
je 0x1002470e
push 3
lea ecx, [ebp - 0x142c]
call fcn.1002ff7c
mov dword [ebp - 4], 0x46
mov dword [ebp - 0x2f4], 0xdada439b
mov dword [ebp - 0x1200], 0x624cdb8f
mov dword [ebp - 0x2ec], 0
jmp 0x10021aea
cmp dword [ebp - 0x2ec], 3
jge 0x10021b0c
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x142c]
call fcn.1003001a
mov dword [eax], 0xffff
jmp 0x10021add
push 0x47ea
push 1
push 0x5e19
push 0x68ad
push 0x77d0
push 0
call fcn.100107c5
add esp, 0x18
mov dword [ebp - 0x2f4], 0
jmp 0x10021b45
mov dword [ebp - 0xcc], 0xe0a8eac8
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x910], 0x56123d4a
mov dword [ebp - 0x920], 0x96fd0fe1
mov dword [ebp - 0x3f4], 0
jmp 0x1002474c
cmp dword [ebp - 0x3f4], 2
jge 0x10024768
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0xae8], 0x3b7c39c9
jmp 0x1002473f
mov dword [ebp - 0xcc], 0xf
jmp 0x10024781
jmp 0x100253ed
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0xc94]
movzx eax, byte [eax]
test eax, eax
je 0x10025330
push 0
push 0x1092
push 0x1f0a
push 0
push 0x3fa
push 0x258
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x100253ed
mov dword [ebp - 0x1000], 0x713b9102
mov dword [ebp - 0xffc], 0x713b9102
mov dword [ebp - 0xff8], 0x713b9102
mov dword [ebp - 0xff4], 0x713b9102
lea ecx, [ebp - 0x4b9]
call fcn.10030029
push eax
lea eax, [ebp - 0xff0]
push eax
lea eax, [ebp - 0x1000]
push eax
lea ecx, [ebp - 0x1604]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1554]
call fcn.1002ffd8
mov dword [ebp - 0x1f8], 0x29000d4e
mov dword [ebp - 0x1f8], 3
jmp 0x100253b0
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x100253e2
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x100253e0
push 0
push 0
push 0xc06
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x100253a3
lea ecx, [ebp - 0x1554]
call fcn.1002fffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret