Function at 0x100215b0
Capabilities:
Create thread
Encrypt data using speck

Disassembly:
mov eax, 0x10066c84
call fcn.10066180
sub esp, 0x320
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 0x504cd453
push ebx
mov dword [ebp - 0x1c], 0xfffffffa
xor ebx, ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x10021608
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x10021605
push 0x649
push 0x15c5
push ebx
push 0x33
call dword [sym.imp.USER32.dll_DrawFrameControl]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jge 0x100215ea
xor edi, edi
mov dword [ebp - 0x34], 0x3277
inc edi
cmp dword [ebp - 0x34], 0x3367
jle 0x10021699
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov edx, ebx
mov dword [ebp - 0x3c], ebx
add ecx, edx
shl eax, cl
lea ecx, [ebp - 0x278]
xor eax, esi
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021650
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x278]
call fcn.10013840
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
inc edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
cmp edx, 0x64e6
jl 0x10021632
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x2a33
jl 0x1002162d
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x635c
jl 0x10021628
inc esi
cmp esi, 0x7c96
jl 0x10021623
mov dword [ebp - 0x1c], 0x20bd2ab
cmp dword [ebp - 0x34], 0x2ed7
jge 0x100216b4
push 0x10008f04
call fcn.10050ebf
pop ecx
or ecx, 0xffffffff
mov eax, 0x8436
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], 0xccedb775
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x30], 0x9426cefc
mov dword [ebp - 0x30], 0x2d17f492
mov dword [ebp - 0x28], ebx
jmp 0x10021701
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf0], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100216f4
cmp dword [ebp - 0x1c], edi
jl 0x10021711
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xdc]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xfffa
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xf0]
inc eax
je 0x10021750
mov dword [ebp - 0x20], 0xb81002a9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x10021778
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x20], 0xfffffffd
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x20], eax
mov eax, dword [0x106119f0]
test al, 1
jne 0x10021810
or eax, edi
mov dword [0x106119f0], eax
push 2
pop esi
push ebx
mov dword [ebp - 4], esi
push ebx
mov dword [0x106119b0], ebx
mov dword [0x106119b4], ebx
call fcn.100158bf
mov dword [0x106119b0], eax
mov dword [0x106119b8], ebx
mov dword [0x106119c0], ebx
mov byte [ebp - 4], 4
mov ecx, 0x106119b8
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1f8]
mov dword [0x106119cc], 0x3f800000
push eax
mov dword [0x106119bc], ebx
call fcn.10015697
push 0x10067810
mov dword [0x106119c4], 7
mov dword [0x106119c8], 8
call fcn.10050e95
or dword [ebp - 4], 0xffffffff
pop ecx
jmp 0x10021813
push 2
pop esi
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x28], ebx
jmp 0x10021830
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x230], 0x841b3c69
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1002181f
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1002186c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x230]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x230], ecx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10021867
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
dec dword [ebp - 0x1c]
jns 0x10021842
imul eax, dword [ebp - 0x48], 0x2710
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x98], eax
mov eax, 0x115252cb
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x2c], 0xbb1bb30b
mov dword [ebp - 0x28], 0x69a1
cmp dword [ebp - 0x28], 0x6bea
jle 0x1002190e
push ebx
push 0x9c1
push ebx
push ebx
push 0x1f9d
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x3c], 0x7528
mov ebx, dword [ebp - 0x34]
mov eax, edi
mov ecx, 0x10610838
cdq
push edx
push eax
call fcn.100130d2
add edi, ebx
dec dword [ebp - 0x3c]
jne 0x100218c7
inc ebx
push 0
mov dword [ebp - 0x34], ebx
cmp ebx, 0x1a90
pop ebx
jl 0x100218bb
push 0x1e51
push 0x332
push 0x6d9
push 0x645
push 0x80d
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor edi, edi
inc edi
mov dword [ebp - 0x14], ebx
jmp 0x10021920
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10021913
mov dword [ebp - 4], 5
cmp dword [ebp - 0x28], 0x6843
jge 0x10021945
mov edx, 0x10008f4c
mov ecx, 0x10610838
call fcn.100159ac
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10021987
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x130], 0x3a47399d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10021976
mov dword [ebp - 0x78], esi
cmp dword [ebp - 0x78], ebx
jl 0x10021afa
mov dword [ebp - 0x14], 0x30722263
mov dword [ebp - 0x3c], 0x4c3dc4d7
mov dword [ebp - 0x20], 0x45c545f0
mov dword [ebp - 0x14], ebx
jmp 0x10021ae8
push dword [ebp + 8]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x38], 0x1ebc5f93
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0xb4], ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0xb0], ebx
push ebx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xac], ebx
movdqu xmmword [ebp - 0x240], xmm0
call fcn.10023a33
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x80]
cmp ecx, eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xb4]
setge dl
mov dword [eax + 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0xb4]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x78]
setl dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x14]
imul esi, edx
sub esi, eax
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x14]
cmp esi, eax
mov eax, dword [ebp - 0x78]
setl cl
add edx, ecx
neg edx
mov ecx, dword [ebp + eax*4 - 0xa8]
sbb edx, edx
neg edx
lea eax, [edx + 7]
xor edx, edx
cmp eax, ecx
setle dl
sub edx, 0x9bdd7770
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x78]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa8]
cmp edx, eax
mov eax, dword [ebp - 0x78]
setle cl
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + eax*4 - 0xa8]
xor eax, eax
cmp dword [ebp - 0x20], 3
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x78]
setne dl
mov eax, dword [ebp + eax*4 - 0xa8]
mov ecx, dword [ebp - 0x14]
imul eax, edx
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x12c], ecx
lea ecx, [ebp - 0xb4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
call fcn.10013359
inc dword [ebp - 0x14]
push 2
pop esi
cmp dword [ebp - 0x14], esi
jle 0x100219b5
dec dword [ebp - 0x78]
jns 0x10021998
cmp dword [ebp - 0xa0], ebx
je 0x10021ba5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x98]
push eax
call fcn.10023578
mov eax, dword [eax]
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x1c], 0x19a
cmp dword [ebp - 0x1c], 0x33b
mov dword [ebp - 0x3c], eax
jle 0x10021b9d
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
shl eax, cl
lea ecx, [ebp - 0x290]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021b5b
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x290]
call fcn.10013840
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x13fb
jl 0x10021b41
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x672c
jl 0x10021b3c
push 0x19c0
push 0x1cf2
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
mov dword [ebp - 0x28], ebx
jmp 0x10021c8b
mov dword [ebp - 0x34], 0xcf49cf94
mov dword [ebp - 0x2c], 0xc
cmp dword [ebp - 0x2c], 0xfffffffe
jg 0x10021b0f
mov dword [ebp - 0x28], 0x5e5ab8bf
mov dword [ebp - 0x3c], 0x6e66
cmp dword [ebp - 0x3c], 0x719a
jle 0x10021c02
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov ecx, 0x10610838
or eax, edi
cdq
push edx
push eax
call fcn.100130d2
inc ebx
cmp ebx, 0x2dc
jl 0x10021bd9
inc edi
push 0
pop ebx
cmp edi, 0x3149
jl 0x10021bd6
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x172abf77
mov dword [ebp - 4], 7
cmp dword [ebp - 0x3c], 0x6b34
jge 0x10021c28
mov edx, 0x10008f88
mov ecx, 0x10610838
call fcn.100159ac
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x28], ebx
jmp 0x10021c6f
mov dword [ebp - 0x30], ebx
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe3
jg 0x10021c60
dec dword [ebp - 0x2c]
jmp 0x10021bb3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x70], 0x841b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10021c7d
cmp dword [ebp - 0x1c], 0x11f
jge 0x10021ca4
push 0x10008ff8
call fcn.10050ebf
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10021cdc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10021cc4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x70], ebx
jne 0x10021cc9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10021cb8
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x70], ecx
dec dword [ebp - 0x2c]
jns 0x10021cb0
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x10021e39
mov dword [ebp - 0x18], 7
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x28], 0x3cf81320
push esi
mov dword [ebp - 0xc0], eax
call fcn.100132fd
mov dword [ebp - 0x14], ebx
jmp 0x10021d26
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0xc869b7d6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10021d13
mov dword [ebp - 0x14], ebx
jmp 0x10021d3a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021d30
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jle 0x10021d56
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x18]
cmp eax, 0x6273
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 0x943e2f7c
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x11c]
setl cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
test eax, eax
setns cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10021e1f
mov dword [ebp - 0x30], 0x767dbf12
mov dword [ebp - 0x4c], 0xffffffff
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10021dc8
push 0xea9
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, edi
mov eax, dword [ebp - 0x28]
cmp eax, 0x7f45
mov eax, dword [ebp - 0x44]
setg dl
sub ecx, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
cmp edx, 0xfd39ef5b
ja 0x10021df9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
jl 0x10021da4
lea ecx, [ebp - 0x11c]
call fcn.10013359
jmp 0x10023451
mov eax, dword [0x106119f0]
test al, 2
jne 0x10021ed0
or eax, esi
mov dword [0x106119f0], eax
push ebx
mov dword [ebp - 4], 0xb
push ebx
mov dword [0x106119d0], ebx
mov dword [0x106119d4], ebx
call fcn.100158bf
mov dword [0x106119d0], eax
mov dword [0x106119d8], ebx
mov dword [0x106119e0], ebx
mov byte [ebp - 4], 0xd
mov ecx, 0x106119d8
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xfc]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1d8]
mov dword [0x106119ec], 0x3f800000
push eax
mov dword [0x106119dc], ebx
call fcn.10015697
push 0x1006780b
mov dword [0x106119e4], 7
mov dword [0x106119e8], 8
call fcn.10050e95
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x14], 0xfebb6748
lea ecx, [ebp - 0x1d4]
push edi
call fcn.100132fd
mov dword [ebp - 0x28], ebx
jmp 0x10021efb
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 0x5c829ed8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10021ee8
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
je 0x10021fa6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], 9
jmp 0x10021f9b
mov dword [ebp - 0x28], ebx
jmp 0x10021f31
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x100], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10021f20
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
jmp 0x10021f93
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10021f72
mov dword [ebp - 0x28], 0xa519d814
mov dword [ebp - 0x28], ebx
jmp 0x10021f68
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x100], ebx
jne 0x10021f6d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10021f59
dec dword [ebp - 0x18]
jns 0x10021f4d
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10021f90
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10021f8b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [ebp - 0x18]
jns 0x10021f7a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x10021f3e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021f1b
jmp 0x10021feb
mov dword [ebp - 0x14], ebx
jmp 0x10021fd5
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x10021fd2
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10021fcd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
dec dword [ebp - 0x28]
jns 0x10021fba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10021fab
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10021feb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x1d4]
call fcn.10013359
xorps xmm0, xmm0
lea ecx, [ebp - 0x1b8]
movdqu xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0x30], 0x5568
mov dword [ebp - 0x30], 0x453606de
mov dword [ebp - 0x30], 0x5d09ea9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x8d526d2e
mov dword [ebp - 0x30], 0xd3f7bf48
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x56251324
mov dword [ebp - 0x30], 0x1c71bc7d
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], 0x7182b47
mov dword [ebp - 0x30], 0xc7747bb7
push 3
call fcn.100132fd
mov dword [ebp - 0x30], 0x8b012130
mov dword [ebp - 0x30], 0x91a8
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x28], ebx
jmp 0x10022087
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1b8]
mov dword [eax + ecx*4], 0x83dc0e3e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10022074
dec dword [ebp - 0x34]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100220a2
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0x1b8]
call fcn.10013359
lea eax, [ebp - 0x48]
push eax
call fcn.100235da
push esi
lea ecx, [ebp - 0x128]
mov eax, dword [eax]
mov dword [ebp - 0x18], 0x24ec2e0c
mov dword [ebp - 0x28], eax
call fcn.100132fd
push edi
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], 0xe
call fcn.100132fd
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10022104
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x532b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100220f1
mov dword [ebp - 0x14], ebx
jmp 0x10022121
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002210e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xb
jl 0x100221f9
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x14], 0x5c6
cmp dword [ebp - 0x14], 0x92d
jle 0x100221b9
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
cdq
idiv ecx
mov eax, dword [ebp - 0x2c]
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x2a8]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022179
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2a8]
call fcn.10013840
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x3065
jl 0x10022157
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x5e7e
jl 0x10022152
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x3bbe
jl 0x1002214d
mov dword [ebp - 0x1c], ebx
jmp 0x100221d1
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100221ce
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x100221be
cmp dword [ebp - 0x14], 0x42f
jge 0x100221ea
push 0x10009048
call fcn.10050ebf
pop ecx
mov dword [ebp - 4], 0xf
inc dword [ebp - 0x18]
jmp 0x10022129
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edi
jg 0x1002229c
mov dword [ebp - 0x1c], ebx
jmp 0x1002221b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf8], 0xcc19583e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002220a
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
sub eax, ecx
jne 0x10022232
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
push 2
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0xf8]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x128]
setne cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [eax + edi*4]
setg dl
xor edi, edi
sub eax, edx
inc edi
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
pop esi
cmp dword [ebp - 0x18], edi
jle 0x10022205
lea ecx, [ebp - 0x168]
call fcn.10013359
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.10013359
cmp byte [ebp + 0xc], 0
jne 0x100222c7
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x10023275
mov dword [ebp - 0x18], 0x897a4a12
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], 0xd5ec
push 3
mov dword [ebp - 0x20], 0xe816884
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x100222f4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100222ea
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100223b8
mov dword [ebp - 0x34], 0x44ad
mov ecx, 0xae0fc36f
mov dword [ebp - 0x40], 0xfffffffa
mov eax, dword [ebp - 0x18]
push 7
mov eax, dword [ebp + eax*4 - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
neg ecx
lea eax, [eax + ecx*4]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x18]
add edx, 0x658cc1cc
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x60]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x2c], ebx
je 0x100223a9
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x10022395
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x18]
jns 0x10022305
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x10022496
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10022484
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x34], 0x14e288a3
mov dword [ebp - 0x14], ebx
jmp 0x10022472
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1002246f
mov dword [ebp - 0x20], 0x95a2e206
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, 0x6d35
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x60]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x40], edx
xor edx, edx
cmp dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x2c]
jns 0x100223f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100223e9
dec dword [ebp - 0x18]
jns 0x100223d3
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x60], ebx
jne 0x10022496
dec dword [ebp - 0x1c]
jns 0x100223c4
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x32c]
mov ecx, dword [ebp - 0x48]
push eax
call fcn.100166ba
mov esi, eax
lea edi, [ebp - 0xec]
pop ecx
push 2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x97412df3
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], 0x5c7d8169
mov dword [ebp - 0x20], 0x50d5
mov dword [ebp - 0x18], 0x12
pop esi
cmp dword [ebp - 0x18], 0xe
jne 0x100225e0
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x18c]
push esi
call fcn.100132fd
mov dword [ebp - 0x20], 0x4c5530c4
mov dword [ebp - 0x14], ebx
jmp 0x10022519
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 0xb9725245
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10022506
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0x285faafe
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
setle dl
mov dword [eax], edx
test edx, edx
jne 0x10022556
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], ebx
je 0x10022562
mov edx, edi
cmp dword [ebp - 0x14], ebx
jne 0x10022564
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0xffffffeb
jmp 0x100225c7
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x20], 0xac116e07
cmp dword [ebp - 0x18], ebx
je 0x100225a2
imul eax, dword [ebp - 0x14], 9
xor ecx, ecx
test eax, eax
mov eax, edi
setns cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
jne 0x100225a4
mov eax, ebx
cmp eax, dword [ebp - 0x34]
jle 0x100225b0
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x100225b2
mov ecx, edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
shl eax, 2
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
jne 0x1002257a
lea ecx, [ebp - 0x18c]
call fcn.10013359
dec dword [ebp - 0x18]
jmp 0x100224e1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], ebx
jne 0x1002260e
cmp dword [ebp - 0x1c], ebx
jne 0x10022600
cmp dword [ebp - 0x2c], ebx
jne 0x100225f5
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], 0x83eb
mov ecx, ebx
jl 0x10022602
mov ecx, edi
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, ebx
je 0x10022610
mov eax, edi
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xba889b05
setg cl
sub ecx, dword [ebp - 0x1c]
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x2c], eax
je 0x10022857
cmp dword [ebp - 0xe4], 0
je 0x10022857
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x18], ebx
jmp 0x1002268a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10022680
mov dword [ebp - 0x18], ebx
jmp 0x1002269e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10022694
mov dword [ebp - 0x18], ebx
jmp 0x100226b9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138], 0x1a796d40
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100226a8
mov dword [ebp - 0x54], ebx
jmp 0x10022785
push edi
lea ecx, [ebp - 0xcc]
call fcn.100132fd
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x1c], ebx
jmp 0x100226f1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xd3b3152c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100226de
mov eax, dword [ebp - 0xcc]
mov dword [eax], ebx
mov eax, dword [eax]
mov dword [ebp - 0x20], 0x835a
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1002271a
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
dec dword [eax]
jns 0x100226fe
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x6c], ebx
je 0x10022760
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0xcc]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x38]
setl dl
mov dword [ebp - 0x20], edx
xor edx, edx
cmp dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xcc]
setle dl
xor ecx, ecx
add edx, 0x15cc5b2f
cmp dword [eax], edx
setl cl
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x138]
cmp eax, ecx
lea ecx, [ebp - 0xcc]
setne dl
mov dword [ebp - 0x20], edx
call fcn.10013359
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], ebx
jle 0x100226c6
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x18], 0xe8e56f9b
mov dword [ebp - 0x20], ebx
push 3
mov dword [ebp - 0xbc], eax
call fcn.100132fd
mov dword [ebp - 0x30], 0x95866b38
mov dword [ebp - 0x14], ebx
jmp 0x100227cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xbdde0bcd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100227bd
mov dword [ebp - 0x14], ebx
jmp 0x100227e5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100227d5
mov dword [ebp - 0x18], ebx
jmp 0x100227fe
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
jle 0x100227f0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x150]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10022836
inc dword [ebp - 0x20]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jle 0x10022830
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10013359
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0x28], 0
jne 0x10023275
cmp dword [ebp - 0xec], 0
jle 0x10023275
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xc5336de0
mov dword [ebp - 0x1c], ebx
jmp 0x10022891
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0x477862fd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10022880
push 3
mov dword [ebp - 0x90], 4
pop edx
cmp dword [ebp - 0x90], 0x13
jle 0x1002291c
mov dword [ebp - 0x14], 0xde2167fa
mov dword [ebp - 0x1c], ebx
jmp 0x100228c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x258], 0x67f5ed9a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100228b8
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x1002290e
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10022906
mov dword [ebp - 0x2c], 0xba20b95a
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x10022903
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x258], ebx
jne 0x10022903
dec dword [ebp - 0x2c]
jns 0x100228f2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100228e3
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jl 0x100228d7
inc dword [ebp - 0x90]
jmp 0x100228a3
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], 0xcc2fdcb
mov dword [ebp - 0x20], 0x5d367296
mov dword [ebp - 0x1c], ebx
jmp 0x1002294c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x31c], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002293f
mov dword [ebp - 0x2c], 0xa
jmp 0x10022998
mov dword [ebp - 0x30], 0xfc558bac
mov dword [ebp - 0x30], 0x194ddbc3
mov dword [ebp - 0x30], 0xe6e7f737
mov dword [ebp - 0x30], 0x4e76ab2a
mov dword [ebp - 0x1c], ebx
jmp 0x1002298d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x260], 0x64ba8b35
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002297c
dec dword [ebp - 0x20]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jne 0x1002295b
mov dword [ebp - 0x30], 0xbdde
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x45cdbe8e
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x210b999f
mov dword [ebp - 0x30], 0x15de05da
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x29ef4a04
mov dword [ebp - 0x30], 0x10e5
mov dword [ebp - 0x30], 0x1023f126
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x9140de19
mov dword [ebp - 0x30], 0xc8e11f31
mov dword [ebp - 0x30], 0xf936
mov dword [ebp - 0x30], 0x4a05a9ee
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10022a20
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x30c], 0x585b7f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10022a0f
mov dword [ebp - 0x18], ebx
jmp 0x10022a3c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1fc], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10022a2b
mov dword [ebp - 0x18], ebx
jmp 0x10022a57
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1c8], 0x830b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10022a46
inc dword [ebp - 0x20]
mov dword [ebp - 0x30], 0x27cb3f4f
mov dword [ebp - 0x30], 0x52061f66
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x9d5fac12
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10022a96
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e4], 0xc558bac0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10022a85
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x18], 0x256915a
movdqa xmm0, xmmword [0x1000c870]
mov dword [ebp - 0x34], 0x1ad386cc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0xb9849b76
push 0xfffffffffffffffc
pop eax
push dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], 0xdd9cd443
mov dword [ebp - 0x14], 0xd7d393e7
mov dword [ebp - 0x40], 0x42afa017
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x2c], 0xe61780ee
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x20], 0x81320f2d
push eax
mov dword [ebp - 0x20], 0x5943e2f7
push ebx
movdqu xmmword [ebp - 0x220], xmm0
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
call fcn.10023a33
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 0x1db5
cmp dword [ebp - 0x38], 0x1fa2
jle 0x10022bc9
mov edx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov dword [ebp - 0x20], ebx
shl eax, cl
lea ecx, [ebp - 0x2d8]
or eax, edx
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022b89
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2d8]
call fcn.10013840
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
inc ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
cmp ecx, 0x3059
jl 0x10022b6d
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x3b20
jl 0x10022b68
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 0x45b4
jl 0x10022b63
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x38], 0x1abb
jge 0x10022be0
push 0x1000909c
call fcn.10050ebf
pop ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, 0xfa3fda37
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
inc dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
mov ecx, edi
cmovl ecx, ebx
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 0x20]
setle cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
cmp eax, 0x6b87d0fa
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp dword [ebp - 0x30], ecx
setge dl
sub eax, edx
je 0x10022c57
mov dword [ebp - 0x20], 0x8fc786c7
dec dword [ebp - 0x20]
jmp 0x10022dac
mov dword [ebp - 0x1c], 0xaf2c67a9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
jmp 0x10022c77
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9c], 0xd6c8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10022c66
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 0x13
jg 0x10022da0
mov dword [ebp - 0x18], 0x4adb5d23
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10022ca0
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x10022d90
mov dword [ebp - 0x20], 0x27488f
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp eax, edi
mov eax, dword [ebp - 0x8c]
setle dl
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x18]
imul eax, edx
test eax, eax
jne 0x10022cde
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10022ce0
mov eax, edi
xor edx, edx
cmp eax, 0x98a8
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
dec ecx
jne 0x10022cfa
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edi
setl cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10022d14
cmp dword [ebp - 0x1c], ebx
jne 0x10022d16
mov edi, ebx
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x8c]
push 1
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + ecx*4]
imul eax, edi
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x8c]
setne cl
imul ecx, dword [ebp - 0x9c]
neg ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [eax + edi*4]
mov edx, dword [ebp - 0x38]
setge cl
pop edi
mov dword [eax + edx*4], ecx
dec dword [ebp - 0x14]
jns 0x10022cb0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
jle 0x10022c89
push 2
pop esi
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10013359
cmp dword [ebp - 0xe8], 0
je 0x10023275
mov dword [ebp - 0x38], 0x7cb4
cmp dword [ebp - 0x38], 0x7f19
jle 0x10022e2d
mov eax, ebx
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov dword [ebp - 0x20], ebx
add eax, ecx
lea ecx, [ebp - 0x2fc]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022dfc
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2fc]
call fcn.10013840
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x2926
jl 0x10022de2
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x3ffb
jl 0x10022ddd
mov dword [ebp - 0x14], 0xd29be1d9
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x30], 0xc59cdc34
push edi
call fcn.100132fd
push 3
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], 0x16
call fcn.100132fd
mov dword [ebp - 0x20], 0x52bf
mov dword [ebp - 0x18], ebx
jmp 0x10022e75
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], 0x648261f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10022e67
mov dword [ebp - 0x18], ebx
jmp 0x10022e92
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xcc895931
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10022e7f
mov dword [ebp - 0x18], ebx
jmp 0x10022eaf
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10022e9c
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10022ec5
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x14], ebx
jmp 0x10022f3a
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x28], ebx
jmp 0x10022ee3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x204], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10022ed6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x64], ebx
jne 0x10022ef8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x15c]
inc dword [eax]
mov eax, dword [ebp - 0x110]
cmp dword [eax], 0x76ac116e
setge cl
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10022eca
lea ecx, [ebp - 0x15c]
call fcn.10013359
lea ecx, [ebp - 0x110]
call fcn.10013359
cmp dword [ebp - 0x38], 0x7964
jge 0x10022f69
push 0x100090c8
call fcn.10050ebf
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xe8]
call fcn.10021577
mov dword [ebp - 0x1c], 0xfffffffc
lea ecx, [ebp - 0x1f4]
push 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], eax
call fcn.100132fd
mov dword [ebp - 4], 0x19
mov eax, 0x35b5b06a
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x40], 0x54d1843a
mov dword [ebp - 0x18], 0x407b
mov dword [ebp - 0x14], ebx
jmp 0x10022fda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x24c], 0xa30a4ccf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10022fc9
mov dword [ebp - 0x14], ebx
jmp 0x10022ff5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1f4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10022fe5
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x18
jge 0x10023236
mov dword [ebp - 0x2c], 0xb96ca2cb
mov dword [ebp - 0x38], 0x40
cmp dword [ebp - 0x38], 0x2d2
jle 0x10023068
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov eax, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
add eax, edi
mov ecx, 0x10610838
and eax, ebx
cdq
push edx
push eax
call fcn.100130d2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x2ec
jl 0x1002302c
inc edi
push 0
pop ebx
cmp edi, 0xaef
jl 0x10023024
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x38], 0xfffffe31
jge 0x100230b1
mov edx, 0x10009114
mov ecx, 0x10610838
call fcn.100159ac
jmp 0x100230b1
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x20], 0x288586fd
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x38], 0x6390
cmp dword [ebp - 0x38], 0x63d9
jle 0x1002312b
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1f4]
mov eax, dword [ebp - 0x1c]
or esi, 0xffffffff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], esi
call fcn.10013359
lea eax, [ebp - 0x48]
push eax
call fcn.100235da
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
jmp 0x10023278
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x42a43d95
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x20], 0xaf5af8b5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 0xe5034859
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x30], esi
push edi
call fcn.100132fd
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], ebx
jmp 0x100232bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e8], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100232ae
mov dword [ebp - 0x14], ebx
jmp 0x100232dc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c4]
mov dword [eax + ecx*4], 0x236728ad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100232c9
mov dword [ebp - 0x20], 0x6db6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, 0xfffffffe
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add ecx, 5
cmp eax, ecx
lea ecx, [ebp - 0x1c4]
setne dl
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edx
dec dword [ebp - 0x38]
call fcn.10013359
lea ecx, [ebp - 0xec]
call fcn.1001d64c
cmp dword [ebp - 0x3c], 0
jne 0x1002340d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1002340d
mov edx, dword [ebp - 0x4c]
mov ecx, eax
call fcn.100215a6
push 2
lea ecx, [ebp - 0x144]
mov dword [ebp - 0xc0], eax
call fcn.100132fd
push 3
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], 0x20
call fcn.100132fd
mov dword [ebp - 0x30], 0xe71f09a2
mov dword [ebp - 0x14], ebx
jmp 0x10023392
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10023383
mov dword [ebp - 0x14], ebx
jmp 0x100233ac
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002339d
mov edx, dword [ebp - 0x180]
mov dword [edx + 8], ebx
mov ebx, dword [ebp - 0x144]
mov eax, dword [edx + 8]
xor ecx, ecx
mov eax, dword [ebx + eax*4]
cmp eax, dword [ebx + 4]
setne cl
imul ecx, dword [edx + 4]
inc dword [edx + 8]
mov dword [ebp - 0x30], ecx
cmp dword [edx + 8], edi
jle 0x100233c1
lea ecx, [ebp - 0x180]
call fcn.10013359
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], esi
call fcn.10013359
lea eax, [ebp - 0x98]
push eax
call fcn.10023578
mov ecx, dword [ebp - 0xc0]
xor ebx, ebx
mov dword [eax], ecx
mov dword [ebp - 0x28], 2
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10023425
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
mov dword [ebp - 0x28], 0x18
jmp 0x1002344b
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10023448
push ebx
push 0x195e
push 0x1143
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 9
jge 0x1002342e
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret