Function at 0x1000da15
Capabilities:
Check os version
Create directory
Encrypt data using speck
Extract resource via kernel32 functions
Get graphical window text
Get keyboard layout
Get session user name
Query environment variable
Query service status
Read .ini file

Disassembly:
mov eax, 0x10068bf1
call fcn.100684b0
sub esp, 0xc80
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
pop ebx
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x40], 0xc04e
mov dword [ebp - 0x28], 0x7b8f5f49
mov dword [ebp - 0x3c], 0xfffffff7
push ebx
mov byte [ebp - 0x60], dl
call fcn.1001cd0b
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x34], 0xf9a8551b
mov dword [ebp - 0x2c], 0x55adb51f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000da8a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3d0]
mov dword [eax + ecx*4], 0x49c23edb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000da70
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop edi
jmp 0x1000daa3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9dc], 0xc72fa5d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000da92
dec dword [ebp - 0x40]
xor eax, eax
mov edx, dword [ebp - 0x3d0]
xor esi, esi
cmp dword [edx + 4], esi
setne al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x2c9bf5e4
setg cl
cmp ecx, dword [ebp - 0x28]
jg 0x1000daee
cmp dword [edx + 4], esi
je 0x1000daee
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1000daf3
xor ebx, ebx
xor edx, edx
inc ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x28]
imul ecx, ecx, 0x9687
cmp eax, ecx
setge dl
lea eax, [edx + 0x4c405b40]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5f58cdc1
jge 0x1000db29
mov eax, dword [ebp - 0x4c]
xor eax, eax
push 9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
pop esi
jmp 0x1000db4e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000db4b
push ebx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
je 0x1000db36
lea ecx, [ebp - 0x3d0]
call fcn.1001cd8d
mov dword [ebp - 0x40], 0xc04e
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x28], 0x7b8f5f49
mov dword [ebp - 0x3c], 0xfffffff7
push 2
call fcn.1001cd0b
push 2
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x34], 0xf9a8551b
mov dword [ebp - 0x2c], 0x55adb51f
mov dword [ebp - 0x18], 0
jmp 0x1000dbb0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 0x49c23edb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000db9d
mov dword [ebp - 0x18], 0
jmp 0x1000dbcf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa18], 0xc72fa5d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000dbbe
dec dword [ebp - 0x40]
xor eax, eax
mov edx, dword [ebp - 0x394]
xor esi, esi
cmp dword [edx + 4], esi
setne al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x2c9bf5e4
setg cl
cmp ecx, dword [ebp - 0x28]
jg 0x1000dc17
cmp dword [edx + 4], esi
je 0x1000dc17
mov edx, ebx
jmp 0x1000dc19
xor edx, edx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0xa10]
mov eax, dword [ebp - 0x28]
imul ecx, ecx, 0x9687
cmp eax, ecx
setge dl
lea eax, [edx + 0x4c405b40]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5f58cdc1
jge 0x1000dc4f
mov eax, dword [ebp - 0x4c]
xor eax, eax
push 9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
pop esi
jmp 0x1000dc74
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000dc71
push ebx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
je 0x1000dc5c
lea ecx, [ebp - 0x394]
call fcn.1001cd8d
push 4
lea ecx, [ebp - 0x2f8]
call fcn.1001cd0b
xor eax, eax
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
push edi
call fcn.1001cd0b
lea ecx, [ebp - 0x900]
mov byte [ebp - 4], bl
movdqa xmm0, xmmword [0x1000c500]
lea eax, [ebp - 0x8f0]
push ecx
push eax
push ecx
lea ecx, [ebp - 0xa30]
movdqu xmmword [ebp - 0x900], xmm0
call fcn.1001cd67
mov byte [ebp - 4], 2
mov dword [ebp - 0x48], 0
jmp 0x1000dcf2
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], 0xf75dcec3
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x1000dcdf
mov dword [ebp - 0x3c], 0x4198
cmp dword [ebp - 0x3c], 0x41f1
jle 0x1000dd6a
xor edi, edi
mov dword [ebp - 0x34], edi
xor esi, esi
and dword [ebp - 0x38], 0
mov eax, edi
cdq
idiv esi
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x40], 0x96f
xor ebx, ebx
mov eax, edi
mov ecx, 0x10612c98
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1001cada
inc ebx
cmp ebx, 0x184a
jl 0x1000dd27
add edi, dword [ebp - 0x54]
dec dword [ebp - 0x40]
jne 0x1000dd25
mov edi, dword [ebp - 0x34]
inc esi
cmp esi, 0x5f40
jl 0x1000dd0f
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x6fa4
jl 0x1000dd0d
xor ebx, ebx
push 9
inc ebx
pop esi
mov dword [ebp - 0x48], 0
jmp 0x1000dd80
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x72c], esi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x1000dd73
mov byte [ebp - 4], 3
cmp dword [ebp - 0x3c], 0x3f35
jge 0x1000dda1
mov edx, 0x10007670
mov ecx, 0x10612c98
call fcn.1001f052
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x40], 0x2960
cmp dword [ebp - 0x40], 0x2c63
jle 0x1000de21
mov ebx, eax
jmp 0x1000ddda
xor eax, eax
mov edi, eax
xor esi, esi
mov eax, edi
lea ecx, [ebp - 0xb10]
and eax, ebx
cdq
push edx
push eax
call fcn.1000d99a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ddfa
mov eax, dword [eax]
push eax
call fcn.10053526
pop ecx
push esi
push 1
lea ecx, [ebp - 0xb10]
call fcn.1001d1c8
inc edi
cmp edi, 0x6565
jl 0x1000ddde
inc ebx
cmp ebx, 0x1fd6
jl 0x1000ddd8
mov dword [ebp - 0x48], 0
jmp 0x1000de3d
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x788]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jl 0x1000de2a
cmp dword [ebp - 0x40], 0x26dc
jge 0x1000de57
push 0x1000772c
call fcn.10053526
pop ecx
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000de82
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x484], 0xfffc
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jl 0x1000de69
xor eax, eax
mov dword [ebp - 0x20], 3
or edi, 0xffffffff
xor ebx, ebx
cmp dword [ebp - 0x20], eax
jl 0x1000df63
inc ebx
jmp 0x1000de9c
xor eax, eax
mov dword [ebp - 0x30], 0x2c60edac
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x30467731
mov dword [ebp - 0x3c], 0xfff6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfabaf1ba
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x38], 0xfffffffd
push ebx
call fcn.1001cd0b
mov dword [ebp - 0x28], 0
jmp 0x1000defd
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 0x6a1241a5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000deea
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov eax, dword [ebp - 0x2f8]
cmp dword [eax + ecx*4], esi
je 0x1000df33
mov eax, dword [ebp - 0x484]
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x484]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x3ac]
imul ecx, dword [eax]
mov dword [eax], ecx
lea ecx, [ebp - 0x3ac]
call fcn.1001cd8d
dec dword [ebp - 0x20]
jns 0x1000de9a
jmp 0x1000df66
xor esi, esi
inc ebx
lea ecx, [ebp - 0xa30]
call fcn.1001cd8d
lea ecx, [ebp - 0x788]
call fcn.1001cd8d
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 4], edi
call fcn.1001cd8d
mov dword [ebp - 0x24], 0xc04e
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x20], 0x6dad816f
mov dword [ebp - 0x2c], 0xd850270f
mov dword [ebp - 0x3c], esi
push 2
call fcn.1001cd0b
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x40], 0x30b6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000dff0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], 0x95f7626a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1000dfd5
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1000e087
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, edi
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 9
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 8
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xf7c2
setg al
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1000e089
mov eax, ebx
mov esi, dword [ebp - 0x310]
xor ecx, ecx
imul eax, eax, 3
cmp eax, dword [esi + 4]
setle cl
add ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x1000e1a4
push 3
lea ecx, [ebp - 0x87c]
call fcn.1001cd0b
lea ecx, [ebp - 0x9a0]
mov byte [ebp - 4], 8
movdqa xmm0, xmmword [0x1000c560]
lea eax, [ebp - 0x990]
push ecx
push eax
push ecx
mov dword [ebp - 0x3c], 0x67f5d1cc
lea ecx, [ebp - 0x7a0]
movdqu xmmword [ebp - 0x9a0], xmm0
call fcn.1001cd67
mov dword [ebp - 0x40], 0x772be76d
xor eax, eax
mov dword [ebp - 0x40], 0xc8d3fd90
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000e125
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x87c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000e10a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e13c
push eax
push 0x10af
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
cmp dword [esi + 4], 0xfffffffa
ja 0x1000e149
cmp dword [ebp - 0x3c], eax
je 0x1000e149
mov eax, ebx
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x7a0]
cmp ecx, dword [eax]
je 0x1000e161
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x1000e163
mov ecx, ebx
xor eax, eax
cmp ecx, 6
setl al
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xc7b
setge cl
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x7a0]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
call fcn.1001cd8d
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 7
call fcn.1001cd8d
jmp 0x1000e1c0
mov dword [ebp - 0x2c], 8
jmp 0x1000e1ba
mov dword [ebp - 0x40], 0x7756eb3e
dec dword [ebp - 0x40]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x18
je 0x1000e1ad
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], ebx
jg 0x1000e2a8
lea eax, [ebp - 0x598]
lea ecx, [ebp - 0x588]
movdqa xmm0, xmmword [0x1000c4f0]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x4fc]
movdqu xmmword [ebp - 0x598], xmm0
call fcn.1001cd67
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1000e20c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x1000e285
mov esi, dword [ebp - 0x4fc]
mov dword [ebp - 0x3c], 0xa628
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], eax
jmp 0x1000e25a
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add eax, 0x763
mov dword [esi + 0xc], 0xe228
add ecx, eax
mov eax, 0xe2271dd8
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1000e229
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x4fc]
push 0
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp edx, ebx
setg al
imul eax, dword [esi + 0xc]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x44]
pop eax
jns 0x1000e21a
lea ecx, [ebp - 0x4fc]
call fcn.1001cd8d
inc dword [ebp - 0x2c]
lea eax, [ebp - 0x598]
lea ecx, [ebp - 0x588]
cmp dword [ebp - 0x2c], ebx
jle 0x1000e1dc
lea ecx, [ebp - 0x310]
mov dword [ebp - 4], edi
call fcn.1001cd8d
mov dword [ebp - 0x2c], 0x7b8f5f49
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 0x70669599
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0xfffe
mov dword [ebp - 0x3c], 0x67cd
cmp dword [ebp - 0x3c], 0x6b8b
jle 0x1000e33b
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x34], 0x4bc2
mov dword [ebp - 0x40], ecx
mov eax, edi
and eax, ecx
mov ecx, 0x10612c98
xor eax, ebx
cdq
push edx
push eax
call fcn.1001cada
mov ecx, dword [ebp - 0x40]
add ecx, esi
dec dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
jne 0x1000e2fa
inc esi
cmp esi, 0x7874
jl 0x1000e2ee
inc edi
cmp edi, 0x1907
jl 0x1000e2ec
inc ebx
cmp ebx, 0x31a
jl 0x1000e2ea
xor ebx, ebx
inc ebx
or edi, 0xffffffff
push 9
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x3c], 0x659d
jge 0x1000e35c
mov edx, 0x10007750
mov ecx, 0x10612c98
call fcn.1001f052
push 9
pop ecx
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000e383
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x898], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000e36a
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff3
cmp dword [ebp - 0x28], 0xb
jle 0x1000e473
jmp 0x1000e3bf
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x57d67001
mov dword [ebp - 0x30], 0x4795ed7c
mov dword [ebp - 0x30], 0x6b79df94
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000e406
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3c4], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000e3ed
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1000e42f
mov eax, dword [ebp - 0x3c0]
inc dword [ebp - 0x3c0]
cmp eax, 0x25f5f996
jne 0x1000e422
mov eax, ebx
jmp 0x1000e424
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000e42d
mov ecx, ebx
jmp 0x1000e431
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x890]
sub ecx, eax
mov eax, dword [ebp - 0x890]
neg ecx
push 9
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, ebx
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x6eb2
pop ecx
setl al
mov dword [ebp - 0x88c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
jg 0x1000e3bd
push 2
lea ecx, [ebp - 0x3dc]
call fcn.1001cd0b
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], 0xb
movdqa xmm0, xmmword [0x1000c520]
lea eax, [ebp - 0x910]
push ecx
push eax
mov dword [ebp - 0x3c], 2
push ecx
mov dword [ebp - 0x40], 0xf9a8551b
lea ecx, [ebp - 0x690]
mov dword [ebp - 0x48], 0x7894
movdqu xmmword [ebp - 0x920], xmm0
call fcn.1001cd67
xor eax, eax
push 0xfffffffffffffffe
pop esi
cmp dword [ebp - 0x48], eax
je 0x1000e5cf
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], esi
jl 0x1000e6ec
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x358], 8
mov dword [ebp - 0x354], 8
mov dword [ebp - 0x350], 8
mov dword [ebp - 0x34c], 8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], eax
jmp 0x1000e52f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa68], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000e51e
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
push 9
pop edx
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x40], ecx
je 0x1000e55e
cmp dword [ebp - 0x48], eax
je 0x1000e55e
cmp dword [ebp - 0x358], eax
jne 0x1000e566
cmp dword [ebp - 0x34c], eax
je 0x1000e568
mov eax, ebx
push 0xfffffffffffffff8
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, 0xfffffff7
mov edx, 0x1417
setge cl
mov dword [ebp - 0xa60], ecx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop eax
setge cl
sub ecx, 0xbfe7374
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jge 0x1000e4e7
jmp 0x1000e6ea
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000e607
xor esi, esi
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa24], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000e5f2
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x1000e62b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e628
push 0xd3d
push 0x193f
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x14
jg 0x1000e60c
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1000e6ec
mov esi, dword [ebp - 0x690]
mov dword [ebp - 0x20], 0x9457720f
mov dword [ebp - 0x3c], 0x40e81688
mov eax, dword [ebp - 0x48]
mov dword [esi + 8], 0xfffffffd
mov dword [ebp + eax*4 - 0xa24], 0xfffffff6
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], 0
je 0x1000e69d
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x174]
cmp eax, ebx
mov eax, dword [ebp - 0x48]
setl cl
xor edx, edx
add ecx, 0xfffffff7
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
test ecx, ecx
jle 0x1000e6d8
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000e6da
mov eax, ebx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x1000e644
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e6fb
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea ecx, [ebp - 0x690]
call fcn.1001cd8d
mov dword [ebp - 0x20], 0x55adb51f
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x38], 0x34fda0e6
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], 0
je 0x1000e729
mov eax, dword [ebp - 0x1c]
jmp 0x1000e77d
mov dword [ebp - 0x28], 0x6b16b471
xor ebx, ebx
mov dword [ebp - 0x38], 0x4e797535
mov esi, 0xffff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge bl
imul eax, dword [ebp - 0x28], 0x47d
cmp esi, eax
sbb eax, eax
xor edx, edx
inc eax
imul ebx, eax
mov eax, dword [ebp - 0x28]
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x2a1e9487
setle al
xor ebx, ebx
inc ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1000e81e
mov dword [ebp - 0x40], 0x77ff
cmp dword [ebp - 0x40], 0x78fc
jle 0x1000e7cd
mov esi, eax
mov edi, eax
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10612c98
cdq
push edx
push eax
call fcn.1001cada
inc edi
cmp edi, 0x1984
jl 0x1000e7a2
inc esi
push 0
pop eax
cmp esi, 0x5f04
jl 0x1000e7a0
or edi, 0xffffffff
push eax
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x40], 0x75e2
jge 0x1000e815
mov edx, 0x100077c8
mov ecx, 0x10612c98
call fcn.1001f052
jmp 0x1000e815
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000e842
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3dc]
mov dword [eax + ecx*4], 0x49c23edb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000e827
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000e858
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9f4], 0xc72fa5d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000e847
mov dword [ebp - 0x18], 0xfffffff6
lea ecx, [ebp - 0x304]
push 3
call fcn.1001cd0b
push 3
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0xe
call fcn.1001cd0b
push 3
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x18], 0
pop edx
jmp 0x1000e8a9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000e896
mov dword [ebp - 0x18], 0
jmp 0x1000e8ca
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x49c]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000e8b7
mov dword [ebp - 0x18], 0x1a
jmp 0x1000e904
mov dword [ebp - 0x28], 0x7ca0029b
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], edx
jge 0x1000e901
xor esi, esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1000e8ed
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
je 0x1000e8d8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x49c]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
cmp dword [eax + 8], ebx
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x49c]
call fcn.1001cd8d
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xb
call fcn.1001cd8d
dec dword [ebp - 0x24]
xor eax, eax
mov edx, dword [ebp - 0x3dc]
xor esi, esi
cmp dword [edx + 4], esi
setne al
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp eax, 0x2c9bf5e4
setg cl
cmp ecx, dword [ebp - 0x2c]
jg 0x1000e993
cmp dword [edx + 4], esi
je 0x1000e993
mov edx, ebx
jmp 0x1000e995
xor edx, edx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x9ec]
mov eax, dword [ebp - 0x2c]
imul ecx, ecx, 0x9687
cmp eax, ecx
setge dl
lea eax, [edx + 0x4c405b40]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x5f58cdc1
jge 0x1000e9cb
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 9
jne 0x1000ecc4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000e9ff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa98], 0xcf5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000e9e6
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000eaa5
mov dword [ebp - 0x40], 0x43e6
cmp dword [ebp - 0x40], 0x442f
jle 0x1000ea56
mov esi, eax
mov edi, eax
mov ebx, 0x57c2
mov eax, edi
mov ecx, 0x10612c98
cdq
push edx
push eax
call fcn.1001cada
add edi, esi
dec ebx
jne 0x1000ea25
inc esi
push ebx
pop eax
cmp esi, 0x983
jl 0x1000ea1e
xor eax, eax
inc ebx
push eax
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
or edi, 0xffffffff
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x40], 0x4246
jge 0x1000ea9c
mov edx, 0x1000783c
mov ecx, 0x10612c98
call fcn.1001f052
jmp 0x1000ea9c
xor eax, eax
mov dword [ebp - 4], 0xb
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000eac1
push 0x1743
push 0x14c5
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x678]
push 4
call fcn.1001cd0b
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], 0xf2c36544
mov dword [ebp - 0x18], 0
jmp 0x1000eafe
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x678]
mov dword [eax + ecx*4], 0x464b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000eaeb
mov dword [ebp - 0x18], 0
jmp 0x1000eb1e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x73c], 0xb1c2a2c7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000eb0d
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x678]
call fcn.1001cd8d
cmp byte [ebp - 0x11], 0
je 0x1000ecba
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1001cd0b
mov dword [ebp - 0x40], 0x5530c4e2
mov dword [ebp - 0x1c], 0xfd77ccca
mov dword [ebp - 0x40], 0x122d800
mov dword [ebp - 0x34], ebx
push 2
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x18], 0
pop edx
jmp 0x1000eb86
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 0xe19d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000eb73
mov dword [ebp - 0x18], 0
jmp 0x1000eba5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x760], 0x33631af6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000eb94
mov esi, dword [ebp - 0x1d4]
cmp dword [esi + 4], 0
jne 0x1000ec87
mov dword [ebp - 0x40], 0xa7f4
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
setge dl
xor ecx, ecx
add edx, 8
mov dword [ebp - 0x1c], edx
mov edx, dword [esi + 4]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
cmp ecx, 0xa023703a
jne 0x1000ebf4
test edx, edx
jne 0x1000ebf4
xor ecx, ecx
jmp 0x1000ebf6
mov ecx, ebx
xor eax, eax
cmp ecx, edi
setge al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1d4]
setg cl
sub ecx, 0x4e10
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, edx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xfffd
test eax, eax
je 0x1000ec32
cmp dword [ebp - 0x1c], 0
je 0x1000ec32
mov eax, ebx
jmp 0x1000ec34
xor eax, eax
xor ecx, ecx
cmp eax, dword [esi + 4]
setne cl
xor eax, eax
cmp ecx, 0xf3bd791
setg al
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xe209
setne cl
cmp ecx, 0xa276
jg 0x1000ec62
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x760]
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi + 4]
sub eax, 0x169b41db
cmp edx, eax
setg cl
cmp ecx, edx
je 0x1000ec87
xor eax, eax
mov ecx, eax
jmp 0x1000ec8b
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000eca3
push eax
push 0x26f8
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x1d4]
call fcn.1001cd8d
push ebx
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
inc dword [ebp - 0x20]
xor eax, eax
jmp 0x1000e9d3
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 4], edi
call fcn.1001cd8d
push 4
pop esi
push esi
lea ecx, [ebp - 0x55c]
call fcn.1001cd0b
xor ebx, ebx
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x28], ebx
jmp 0x1000ecfe
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x55c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1000ecef
mov dword [ebp - 0x18], ebx
jmp 0x1000ed1b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x55c]
mov dword [eax + ecx*4], 0x2cb1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000ed08
mov dword [ebp - 0x18], 0xfffffff1
jmp 0x1000ed3b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ed38
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jl 0x1000ed29
lea ecx, [ebp - 0x55c]
call fcn.1001cd8d
push esi
lea ecx, [ebp - 0x3f4]
call fcn.1001cd0b
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x28], ebx
jmp 0x1000ed73
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1000ed64
mov dword [ebp - 0x18], ebx
jmp 0x1000ed90
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], 0x2cb1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000ed7d
mov dword [ebp - 0x18], 0xfffffff1
jmp 0x1000edb0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000edad
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jl 0x1000ed9e
lea ecx, [ebp - 0x3f4]
call fcn.1001cd8d
xor edi, edi
lea ecx, [ebp - 0x624]
inc edi
push edi
call fcn.1001cd0b
mov dword [ebp - 0x18], ebx
jmp 0x1000ede8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x624]
mov dword [eax + ecx*4], 0x64a6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000edd5
mov dword [ebp - 0x18], ebx
jmp 0x1000ee03
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x134], 0x60b4ffb8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000edf2
mov dword [ebp - 0x130], ebx
cmp dword [ebp - 0x130], ebx
jl 0x1000ee68
mov dword [ebp - 0x1c], 0x443250e6
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1000ee35
inc dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
jns 0x1000ee2d
mov dword [ebp - 0x2c], ebx
jmp 0x1000ee5b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ee49
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ee58
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000ee3a
dec dword [ebp - 0x130]
jns 0x1000ee17
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ee76
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x624]
call fcn.1001cd8d
push edi
lea ecx, [ebp - 0x864]
call fcn.1001cd0b
mov dword [ebp - 0x18], ebx
jmp 0x1000eea5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x864]
mov dword [eax + ecx*4], 0x64a6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000ee92
mov dword [ebp - 0x18], ebx
jmp 0x1000eec0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c], 0x60b4ffb8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000eeaf
mov dword [ebp - 0x128], ebx
cmp dword [ebp - 0x128], ebx
jl 0x1000ef25
mov dword [ebp - 0x1c], 0x443250e6
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1000eef2
inc dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
jns 0x1000eeea
mov dword [ebp - 0x2c], ebx
jmp 0x1000ef18
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ef06
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ef15
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000eef7
dec dword [ebp - 0x128]
jns 0x1000eed4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ef33
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x864]
call fcn.1001cd8d
mov dword [ebp - 0x1c], 0xf94f378
mov dword [ebp - 0x40], 0x951fe511
mov dword [ebp - 0x28], ebx
jmp 0x1000ef5f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x68], 0xc2e0cf57
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000ef51
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ef7e
push ebx
push ebx
push 0x2399
push 0x1b6
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1000f31c
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x40], 0xcc19583e
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x18], ebx
jmp 0x1000efb1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000efa0
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffeb
jne 0x1000f311
push edi
lea ecx, [ebp - 0x1c8]
call fcn.1001cd0b
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], ebx
jmp 0x1000eff1
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 0x6db6d037
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x1000efde
mov dword [ebp - 0x44], ebx
jmp 0x1000f008
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1a8], edi
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x1000effb
mov dword [ebp - 0x44], ebx
jmp 0x1000f024
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa00], 0xfcc86f80
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x1000f013
mov eax, dword [ebp - 0x1c8]
mov dword [eax], ebx
cmp dword [eax], 0xb
jne 0x1000f2fa
dec dword [ebp - 0x1c]
push 4
pop esi
jmp 0x1000ef81
movdqa xmm0, xmmword [0x1000c540]
lea ecx, [ebp - 0x980]
push ecx
lea eax, [ebp - 0x970]
push eax
push ecx
lea ecx, [ebp - 0x63c]
movdqu xmmword [ebp - 0x980], xmm0
call fcn.1001cd67
mov esi, dword [ebp - 0x63c]
mov dword [ebp - 0x3c], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x20], 0xfffffffe
cmp dword [ebp - 0x20], 0xffffffef
jg 0x1000f3e6
mov dword [ebp - 0x28], ebx
xor ecx, ecx
mov dword [ebp - 0x40], 0x4039ee49
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, 0xbb08
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
cmp ecx, edi
jg 0x1000f3b5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
push 0
setle cl
add ecx, dword [esi + 8]
sub ecx, eax
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
pop ebx
jle 0x1000f36d
dec dword [esi + 8]
cmp dword [esi + 8], 0xffffffed
jne 0x1000f352
lea ecx, [ebp - 0x63c]
call fcn.1001cd8d
push 4
pop esi
push esi
lea ecx, [ebp - 0x514]
call fcn.1001cd0b
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], 0xc184c506
push 2
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1000f43e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x108], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000f42d
mov dword [ebp - 0x18], ebx
jmp 0x1000f459
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a4], 0x5ed7c6ae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000f448
mov dword [ebp - 0x20], ebx
jmp 0x1000f55f
mov dword [ebp - 0x2c], 0x6b950ba1
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
jl 0x1000f55c
mov dword [ebp - 0x28], 0x65925ef2
mov dword [ebp - 0x38], 0x9481
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x108]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x108], ecx
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1000f553
mov ecx, dword [ebp - 0x28]
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x104]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
xor ebx, ebx
mov ecx, dword [ebp + eax*4 - 0x108]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x108]
imul ecx, edx
cmp eax, ecx
sete bl
xor edx, edx
cmp ebx, 9
mov dword [ebp - 0x6a0], ebx
mov eax, dword [ebp - 0x38]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000f54a
dec dword [ebp - 0x2c]
jns 0x1000f479
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1000f466
mov dword [ebp - 0x28], ebx
jmp 0x1000f57c