Function at 0x100166ba
Capabilities:
Accept command line arguments
Check os version
Connect pipe
Encrypt data using speck
Get system information on windows

Disassembly:
mov eax, 0x10066ac2
call fcn.10066180
sub esp, 0x980
push ebx
mov byte [ebp - 0x60], dl
xor edx, edx
mov dword [ebp - 0x28], 0xdb3ae355
inc edx
push esi
mov dword [ebp - 0x2c], 0xd3f7bf4
xor ebx, ebx
push edi
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x28], 0xffffffe2
cmp dword [ebp - 0x28], 0x1d
jle 0x1001677a
mov dword [ebp - 0x38], 0x7bb7ab61
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x40], 0x198ab79a
mov dword [ebp - 0x44], 0xfffffffa
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd3e9
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], 0xd6446bd2
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10016775
push 0x9ce
call dword [sym.imp.USER32.dll_IsIconic]
xor edx, edx
inc edx
inc dword [ebp - 0x28]
jmp 0x100166fa
mov dword [ebp - 0x28], 0xdb3ae355
mov dword [ebp - 0x2c], 0xd3f7bf4
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x28], 0xffffffe2
jmp 0x10016811
mov dword [ebp - 0x38], 0x7bb7ab61
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x40], 0x198ab79a
mov dword [ebp - 0x44], 0xfffffffa
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd3e9
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], 0xd6446bd2
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x1001680e
push 0x9ce
call dword [sym.imp.USER32.dll_IsIconic]
xor edx, edx
inc edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jg 0x10016798
push 4
lea ecx, [ebp - 0x338]
call fcn.100132fd
mov dword [ebp - 0x48], 0xfffffffd
xor edi, edi
mov dword [ebp - 0x28], 0x28f4e1c
inc edi
mov dword [ebp - 0x38], 0x4bf748dc
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001685a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], 0xfdf9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10016847
mov dword [ebp - 0x48], 3
cmp dword [ebp - 0x48], ebx
jl 0x100168e2
mov esi, dword [ebp - 0x338]
mov dword [ebp - 0x14], 0xfffffffd
xor ecx, ecx
imul edx, dword [ebp - 0x14], 0x2a3c
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0x9378
jne 0x1001689e
cmp dword [ebp - 0x28], ebx
jne 0x100168a5
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x100168a7
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
setne cl
add edx, ecx
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x48]
jns 0x10016872
lea ecx, [ebp - 0x338]
call fcn.10013359
mov dword [ebp - 0x3c], 9
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016908
push 0xf25
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x1001694f
push 0x18b
push 0x91b
push 0x1fae
push ebx
push 0x1b8f
push 0xd7
push 0x102e
push 0xf6f
push 0x20e1
push 0x2237
push 0xfee
push 0xa63
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x50], 0xdb3ae355
or esi, 0xffffffff
mov dword [ebp - 0x2c], 0xd3f7bf4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x24], 0xffffffe2
jmp 0x10016a15
push edi
lea ecx, [ebp - 0x398]
call fcn.100132fd
mov dword [ebp - 0x34], ebx
jmp 0x1001699a
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x398]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x10016987
mov dword [ebp - 0x34], ebx
jmp 0x100169b5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6f0], 0xfffffff8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100169a4
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x24], ebx
jne 0x100169dd
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, edi
setg dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jne 0x100169df
mov ecx, ebx
mov eax, dword [ebp - 0x398]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xe327
lea ecx, [ebp - 0x398]
setge al
mov dword [ebp - 0x6e8], eax
call fcn.10013359
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff6
je 0x10016976
mov dword [ebp - 0x24], ebx
jmp 0x10016a3b
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016a38
push 0xeeb
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
je 0x10016a24
mov dword [ebp - 0x44], 8
xor eax, eax
mov dword [ebp - 0x48], 0xa48bbca6
inc eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x48], 0xfffffffb
jmp 0x10016ac9
mov dword [ebp - 0x14], ebx
jmp 0x10016a89
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x260], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10016a78
mov dword [ebp - 0x4f8], 0xfffffff6
mov dword [ebp - 0x258], 0x10
jmp 0x10016abd
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016ab7
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
dec dword [ebp - 0x258]
cmp dword [ebp - 0x258], 0xffffffe4
jle 0x10016aa5
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 6
jle 0x10016a73
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016ae0
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x4c], 0x7cdf
cmp dword [ebp - 0x4c], 0x8094
mov dword [ebp - 0x58], 0x10007e88
jle 0x10016b1d
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10610838
cdq
push edx
push eax
call fcn.100130d2
inc edi
cmp edi, 0x3f9a
jl 0x10016afb
inc esi
cmp esi, 0x4f65
jl 0x10016af9
mov dword [ebp - 0x50], 0xffffffe2
or edi, 0xffffffff
cmp dword [ebp - 0x50], 0x1d
push 7
pop esi
jle 0x1001756d
mov dword [ebp - 0x38], 0x7bb7ab61
mov dword [ebp - 0x18], 0x1c7bf0b9
mov dword [ebp - 0x14], 0xdef906d8
mov dword [ebp - 0x14], ebx
jmp 0x10016b5f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0xa6847dfa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10016b4e
mov dword [ebp - 0x18], ebx
jmp 0x10016b8d
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb8], ebx
jne 0x10016b93
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10016b6a
mov eax, dword [ebp - 0xb8]
xor edx, edx
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
cmp edx, 0xf145ba13
je 0x10016c67
mov dword [ebp - 0x48], esi
xor esi, esi
inc esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], ebx
jmp 0x10016bef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x62c], 0x273426ae
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10016bde
mov dword [ebp - 0x18], ebx
jmp 0x10016c13
mov dword [ebp - 0x38], 0xfffffffb
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
jle 0x10016bfa
cmp dword [ebp - 0xb8], ebx
je 0x10016c53
cmp dword [ebp - 0x18], ebx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp eax, edx
mov edx, esi
setg cl
xor eax, eax
cmp ecx, 9
setg al
cmp eax, dword [ebp - 0xb8]
je 0x10016c55
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x628], ecx
jmp 0x10016c9d
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10016c89
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016c84
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
dec dword [ebp - 0x14]
jns 0x10016c73
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016c9a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor esi, esi
inc esi
movdqa xmm0, xmmword [0x1000c820]
lea ecx, [ebp - 0x694]
push ecx
lea eax, [ebp - 0x684]
mov dword [ebp - 0x14], esi
push eax
push ecx
mov dword [ebp - 0x24], 0x638ecf54
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x1c], 0x6ec7
movdqu xmmword [ebp - 0x694], xmm0
call fcn.1002353e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x5ec]
mov dword [ebp - 0x28], 0xfffffff7
push esi
call fcn.100132fd
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x3c], 0x1c16b31b
mov dword [ebp - 0x3c], 0x3026
mov dword [ebp - 0x34], ebx
jmp 0x10016d1a
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5ec]
mov dword [eax + ecx*4], 0xc3f4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10016d07
mov dword [ebp - 0x34], ebx
jmp 0x10016d35
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x95c], 0x492b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10016d24
cmp dword [ebp - 0x24], ebx
jne 0x10016d43
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x584]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
je 0x10016f13
mov dword [ebp - 0x3c], 0x129b
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x54], 0xc511
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x5c], 0xfffffffa
mov dword [ebp - 0x48], 0x137d3709
push 2
call fcn.100132fd
push 2
pop edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x18], ebx
jmp 0x10016dc0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0x261fc42f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016daf
mov dword [ebp - 0x18], ebx
jmp 0x10016ddd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0x64f69674
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016dca
mov dword [ebp - 0x18], ebx
jmp 0x10016df8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x764], 0x7d07
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016de7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x48]
mov dword [esi + 4], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xffffffe2
cmp dword [ebp - 0x28], 9
jg 0x10016f06
lea esi, [ebp - 0x6d4]
mov dword [ebp - 0x2c], 0xa473
lea ecx, [ebp - 0x638]
mov dword [ebp - 0x44], edi
push 4
call fcn.100132fd
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x6c4]
movdqa xmm0, xmmword [0x1000c860]
lea ecx, [ebp - 0x750]
push eax
mov dword [ebp - 0x3c], 0xfffffff6
push esi
movdqu xmmword [ebp - 0x6d4], xmm0
call fcn.1002353e
mov dword [ebp - 0x14], ebx
jmp 0x10016e96
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x638]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10016e83
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], ebx
jl 0x10016edc
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], 0x8bf51449
dec dword [ebp - 0x1c]
jns 0x10016ea8
dec dword [ebp - 0x38]
lea ecx, [ebp - 0x750]
call fcn.10013359
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 2
call fcn.10013359
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 9
jle 0x10016e38
lea ecx, [ebp - 0x56c]
call fcn.10013359
jmp 0x10016f2c
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016f2c
push 0xbc0
push 0x1606
call dword [sym.imp.GDI32.dll_SetROP2]
lea ecx, [ebp - 0x5ec]
call fcn.10013359
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], edi
call fcn.10013359
mov dword [ebp - 0x40], 0x198ab79a
lea ecx, [ebp - 0x624]
push 2
call fcn.100132fd
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 0x38], 0x290be443
inc esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x10016f80
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x624]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
jmp 0x10016f69
mov dword [ebp - 0x14], ebx
jmp 0x10016f9a
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016f97
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10016f85
dec dword [ebp - 0x38]
lea ecx, [ebp - 0x624]
call fcn.10013359
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x38], 0x504cd453
mov dword [ebp - 0x48], 0xfffffffa
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], ebx
jmp 0x10016fef
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10016fec
push 0x649
push 0x15c5
push ebx
push 0x33
call dword [sym.imp.USER32.dll_DrawFrameControl]
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe5
jge 0x10016fd0
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xd3e9
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], 0xd6446bd2
mov dword [ebp - 0x2c], 0x20bd2ab
mov dword [ebp - 0x3c], 0xccedb775
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1e0], 0x8436
mov dword [ebp - 0x1dc], 0x8436
mov dword [ebp - 0x1d8], 0x8436
mov dword [ebp - 0x1d4], 0x8436
mov dword [ebp - 0x3c], 0x9426cefc
mov dword [ebp - 0x3c], 0x2d17f492
mov dword [ebp - 0x14], ebx
jmp 0x10017098
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x238], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001708b
cmp dword [ebp - 0x2c], edx
jl 0x100170a8
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1e0]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xfffa
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x238]
inc eax
je 0x100170ea
mov dword [ebp - 0x44], 0xb81002a9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
jmp 0x1001718c
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4dc], edi
mov dword [ebp - 0x4d8], edi
mov dword [ebp - 0x4d4], edi
mov dword [ebp - 0x38], 0x50bd
cmp dword [ebp - 0x38], 0x510b
jle 0x1001715a
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10610838
cdq
push edx
push eax
call fcn.100130d2
inc esi
cmp esi, 0xbed
jl 0x1001711c
inc edi
cmp edi, 0x1777
jl 0x1001711a
push 0x3d0
push ebx
push 0x25f3
push 0x1cc3
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
or edi, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 4], 4
cmp dword [ebp - 0x38], 0x505e
jge 0x10017180
mov edx, 0x10007ee4
mov ecx, 0x10610838
call fcn.100159ac
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x1727
cmp dword [ebp - 0x40], 0x17d2
jle 0x1001721a
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
cdq
mov esi, ebx
idiv edi
mov edi, edx
and edi, ecx
mov eax, esi
lea ecx, [ebp - 0x82c]
xor eax, edi
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100171d0
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x82c]
call fcn.10013840
inc esi
cmp esi, 0x6613
jl 0x100171b4
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc edi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], edi
cmp edi, 0xbbf
jl 0x100171ab
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x47c8
jl 0x100171a6
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x779b
jl 0x100171a1
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x14], ebx
jmp 0x1001725c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x674], 0x841b3c69
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001724b
mov dword [ebp - 0x48], 3
cmp dword [ebp - 0x48], ebx
jl 0x10017298
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + eax*4 - 0x674]
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x674], ecx
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017293
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
dec dword [ebp - 0x48]
jns 0x1001726e
mov byte [ebp - 0x2d], bl
mov edi, 0x115252cb
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xc8], edi
xor edi, edi
mov dword [ebp - 0x28], 0xbb1bb30b
inc edi
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 3
jge 0x100172da
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x140], edi
inc dword [ebp - 0x34]
jmp 0x100172c5
push 2
mov dword [ebp - 0x34], ebx
pop ecx
jmp 0x100172f3
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x32c], 0x3a47399d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100172e2
mov dword [ebp - 0xcc], ecx
cmp dword [ebp - 0xcc], ebx
jl 0x10017480
mov dword [ebp - 0x34], 0x30722263
mov dword [ebp - 0x38], 0x4c3dc4d7
mov dword [ebp - 0x44], 0x45c545f0
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ecx
jg 0x10017474
lea eax, [ebp - 0x4c0]
lea edx, [ebp - 0x4b0]
push ecx
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0x1ebc5f93
push eax
lea ecx, [ebp - 0x404]
movdqu xmmword [ebp - 0x4c0], xmm0
call fcn.1002353e
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xd4]
cmp ecx, eax
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x404]
setge dl
mov dword [eax + 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0x404]
imul ecx, dword [eax]
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
setl dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x34]
imul esi, edx
sub esi, eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x34]
cmp esi, eax
mov eax, dword [ebp - 0xcc]
setl cl
add edx, ecx
neg edx
mov ecx, dword [ebp + eax*4 - 0x140]
sbb edx, edx
neg edx
lea eax, [edx + 7]
xor edx, edx
cmp eax, ecx
setle dl
sub edx, 0x9bdd7770
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0xcc]
setle dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x140]
cmp edx, eax
mov eax, dword [ebp - 0xcc]
setle bl
mov ecx, dword [ebp + eax*4 - 0x140]
xor eax, eax
cmp ebx, 3
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xcc]
setne dl
mov eax, dword [ebp + eax*4 - 0x140]
mov ecx, dword [ebp - 0x34]
imul eax, edx
imul ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x328], ecx
lea ecx, [ebp - 0x404]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
call fcn.10013359
inc dword [ebp - 0x34]
lea eax, [ebp - 0x4c0]
push 2
pop ecx
lea edx, [ebp - 0x4b0]
cmp dword [ebp - 0x34], ecx
jle 0x10017337
xor ebx, ebx
dec dword [ebp - 0xcc]
jns 0x1001730a
cmp dword [ebp - 0x138], ebx
je 0x10017493
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x32c], eax
jmp 0x100174db
mov dword [ebp - 0x38], 0xcf49cf94
mov dword [ebp - 0x28], 0xc
jmp 0x100174d5
mov dword [ebp - 0x14], 0x5e5ab8bf
mov dword [ebp - 0x44], 0x172abf77
mov dword [ebp - 0x54], 9
mov dword [ebp - 0x14], ebx
jmp 0x100174cc
mov dword [ebp - 0x3c], ebx
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x100174bd
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffe
jle 0x100174a3
cmp byte [ebp - 0x2d], 0
je 0x1001754b
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x14], ebx
jmp 0x100174fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], 0x841b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100174ed
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x10017540
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], ebx
jmp 0x10017522
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xc4], ebx
jne 0x10017527
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10017513
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc4], ecx
dec dword [ebp - 0x28]
jns 0x1001750b
push 0x9ce
call dword [sym.imp.USER32.dll_IsIconic]
cmp dword [ebp - 0x40], 0x1616
jge 0x1001755f
push 0x10007f28
call fcn.10050ebf
pop ecx
or edi, 0xffffffff
mov dword [ebp - 4], edi
inc dword [ebp - 0x50]
jmp 0x10016b27
mov dword [ebp - 4], 8
cmp dword [ebp - 0x4c], 0x7bcb
jge 0x1001758a
mov edx, dword [ebp - 0x58]
mov ecx, 0x10610838
call fcn.100159ac
mov dword [ebp - 4], edi
mov dword [ebp - 0x48], 0x53b26bdd
mov dword [ebp - 0x48], 0xfffffffe
jmp 0x100175d9
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x100175d1
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp dword [ebp - 0x48], ebx
jne 0x100175df
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff5
jg 0x100175bf
push 4
lea ecx, [ebp - 0x374]
call fcn.100132fd
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x28], 0x28f4e1c
mov dword [ebp - 0x40], 0x444f
cmp dword [ebp - 0x40], 0x4604
jle 0x10017659
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
cdq
mov edi, ebx
idiv esi
mov esi, edx
mov eax, edi
mov ecx, 0x10610838
xor eax, esi
cdq
push edx
push eax
call fcn.100130d2
inc edi
cmp edi, 0x691a
jl 0x10017622
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0xe20
jl 0x1001761b
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x258f
jl 0x10017616
mov dword [ebp - 0x38], 0x4bf748dc
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x40], 0x41a1
jge 0x1001767c
mov edx, 0x10007fac
mov ecx, 0x10610838
call fcn.100159ac
xor edi, edi
inc edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100176be
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0xfdf9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100176ab
mov dword [ebp - 0x48], 3
cmp dword [ebp - 0x48], ebx
jl 0x10017746
mov esi, dword [ebp - 0x374]
mov dword [ebp - 0x14], 0xfffffffd
xor ecx, ecx
imul edx, dword [ebp - 0x14], 0x2a3c
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0x9378
jne 0x10017702
cmp dword [ebp - 0x28], ebx
jne 0x10017709
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001770b
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
setne cl
add edx, ecx
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x48]
jns 0x100176d6
or esi, 0xffffffff
lea ecx, [ebp - 0x374]
mov dword [ebp - 4], esi
call fcn.10013359
mov dword [ebp - 0x3c], 0xc28ade19
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0x6df37d45
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0xe5664dc9
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xfaafe30f
mov dword [ebp - 0x3c], 0xe1c97412
mov dword [ebp - 0x3c], 0xa5b7d8cf
mov dword [ebp - 0x38], 0x5fe46c2e
mov dword [ebp - 0x3c], ebx
dec dword [ebp - 0x38]
mov dword [ebp - 0x48], ebx
jmp 0x100177e7
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x47c]
push 4
call fcn.100132fd
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x14], ebx
jmp 0x100177cb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x47c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100177b8
lea ecx, [ebp - 0x47c]
cmp dword [ebp - 0x44], ebx
jne 0x100177ee
inc dword [ebp - 0x38]
call fcn.10013359
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x1001779c
jmp 0x100177f3
call fcn.10013359
mov dword [ebp - 0x48], 0x53b26bdd
mov dword [ebp - 0x48], 0xfffffffe
jmp 0x1001781d
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017815
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp dword [ebp - 0x48], ebx
jne 0x10017823
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff5
jg 0x10017803
mov dword [ebp - 0x14], ebx
jmp 0x10017839
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x79c], 0x9ac78948
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10017828
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017855
push 0x358
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017865
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x24], 0xfebb6748
lea ecx, [ebp - 0x594]
push edi
call fcn.100132fd
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10017893
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x594]
mov dword [eax + ecx*4], 0x5c829ed8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10017880
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
je 0x10017940
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 9
jmp 0x10017935
mov dword [ebp - 0x14], ebx
jmp 0x100178c9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100178b8
inc dword [ebp - 0x28]
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jg 0x10017932
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jl 0x10017909
mov dword [ebp - 0x14], 0xa519d814
mov dword [ebp - 0x14], ebx
jmp 0x100178ff
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x218], ebx
jne 0x10017904
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100178f0
dec dword [ebp - 0x34]
jns 0x100178e4
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jl 0x10017927
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017922
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [ebp - 0x34]
jns 0x10017911
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100178d9
xor edx, edx
inc edx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100178b3
jmp 0x10017981
mov dword [ebp - 0x24], ebx
jmp 0x1001796b
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10017968
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017963
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
dec dword [ebp - 0x14]
jns 0x10017950
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10017945
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017981
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x594]
call fcn.10013359
push 4
lea ecx, [ebp - 0x3a4]
call fcn.100132fd
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x3c], 0x5568
mov dword [ebp - 0x3c], 0x453606de
mov dword [ebp - 0x3c], 0x5d09ea9
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x8d526d2e
mov dword [ebp - 0x14], 0x2b6a
cmp dword [ebp - 0x14], 0x2cdd
jle 0x10017a68
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x4c], ebx
cdq
mov esi, ebx
idiv ecx
mov eax, edx
mov dword [ebp - 0x40], eax
mov edi, ebx
mov dword [ebp - 0x38], 0x932
or eax, edi
lea ecx, [ebp - 0x7b4]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10017a0a
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7b4]
call fcn.10013840
mov eax, dword [ebp - 0x40]
add edi, esi
dec dword [ebp - 0x38]
jne 0x100179f0
inc esi
cmp esi, 0x297c
jl 0x100179e7
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x4c], ecx
cmp ecx, 0x1697
jl 0x100179dd
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x708d
jl 0x100179d8
push ebx
push 0x1bc7
push 0x264c
push 0x25b8
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0xd3f7bf48
cmp dword [ebp - 0x14], 0x29d8
jge 0x10017a83
push 0x10007ff8
call fcn.10050ebf
pop ecx
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x600]
mov dword [ebp - 0x3c], ebx
push 0xfffffffffffffffc
mov dword [ebp - 0x3c], 0x56251324
pop edi
mov dword [ebp - 0x3c], 0x1c71bc7d
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0x7182b47
mov dword [ebp - 0x3c], 0xc7747bb7
push 3
call fcn.100132fd
mov dword [ebp - 0x3c], 0x8b012130
mov dword [ebp - 0x3c], 0x91a8
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x14], ebx
jmp 0x10017ae9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x600]
mov dword [eax + ecx*4], 0x83dc0e3e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10017ad6
dec dword [ebp - 0x38]
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017b04
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0x600]
call fcn.10013359
mov dword [ebp - 0x50], 0xfffffffd
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x18], 0x24ec2e0c
push 2
call fcn.100132fd
push 1
lea ecx, [ebp - 0x38c]
mov byte [ebp - 4], 0x10
call fcn.100132fd
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
jmp 0x10017b56
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], 0x532b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10017b43
xor edx, edx
mov dword [ebp - 0x34], ebx
inc edx
jmp 0x10017b77
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38c]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10017b64
mov dword [ebp - 0x18], ebx
jmp 0x10017ba7
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
jmp 0x10017b9f
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017b9c
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10017b89
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jge 0x10017b81
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edx
jg 0x10017c4f
mov dword [ebp - 0x14], ebx
jmp 0x10017bcf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x248], 0xcc19583e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10017bbe
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38c]
mov eax, dword [eax]
sub eax, ecx
jne 0x10017be7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x248]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x244]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x304]
setne cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [eax + edi*4]
setg dl
sub eax, edx
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x10017bb9
or esi, 0xffffffff
lea ecx, [ebp - 0x38c]
call fcn.10013359
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xd
call fcn.10013359
mov dword [ebp - 0x14], 0x28f4e1c
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x38], 0x4bf748dc
mov dword [ebp - 0x14], 0x42a43d95
mov dword [ebp - 0x38], 0xaf5af8b5
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], 0xe5034859
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x3c], esi
push 1
call fcn.100132fd
xor edx, edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], ebx
inc edx
jmp 0x10017cc2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5d4], 6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10017cb1
mov dword [ebp - 0x34], ebx
jmp 0x10017cdf
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5ac]
mov dword [eax + ecx*4], 0x236728ad
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10017ccc
mov dword [ebp - 0x38], 0x6db6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, 0xfffffffe
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
add ecx, 5
cmp eax, ecx
lea ecx, [ebp - 0x5ac]
setne dl
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x44], edx
dec dword [ebp - 0x2c]
call fcn.10013359
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x40], 0x330
cmp dword [ebp - 0x40], 0x528
jle 0x10017d94
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
cdq
mov edi, ebx
idiv esi
mov esi, edx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10610838
cdq
push edx
push eax
call fcn.100130d2
inc edi
cmp edi, 0x20a7
jl 0x10017d5b
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x1a52
jl 0x10017d54
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x5d72
jl 0x10017d4f
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10017da5
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x40], 0x2d1
jge 0x10017ddf
mov edx, 0x10008044
mov ecx, 0x10610838
call fcn.100159ac
jmp 0x10017ddf
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x14], 0x18
cmp dword [ebp - 0x14], 9
jl 0x10017ede
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x4c], 0x231
cmp dword [ebp - 0x4c], 0x2ee
jle 0x10017ea4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov dword [ebp - 0x40], ebx
mov edx, ecx
mov edi, ebx
mov ecx, eax
mov dword [ebp - 0x38], edi
shl edx, cl
mov dword [ebp - 0x44], edx
mov ecx, edi
mov esi, ebx
mov edi, edx
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x85c]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10017e53
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x85c]
call fcn.10013840
inc esi
cmp esi, 0x57b2
jl 0x10017e35
mov edi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x44]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x1654
jl 0x10017e2d
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x7393
jl 0x10017e1f
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x48d2
jl 0x10017e1a
cmp byte [ebp - 0x2d], 0
je 0x10017ebb
push ebx
push 0x195e
push 0x1143
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [ebp - 0x4c], 0xfffffef4
jge 0x10017ecf
push 0x100080a8
call fcn.10050ebf
pop ecx
mov dword [ebp - 4], 0xd
dec dword [ebp - 0x14]
jmp 0x10017ded
mov dword [ebp - 0x14], ebx
jmp 0x10017ef6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3a4]
mov dword [eax + ecx*4], 0xfdf9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10017ee3
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x14], 0x3cf81320
push 2
call fcn.100132fd
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x34], ebx
jmp 0x10017f3a
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x31c]
mov dword [eax + ecx*4], 0xc869b7d6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10017f27
xor ecx, ecx
mov dword [ebp - 0x34], ebx
inc ecx
jmp 0x10017f52
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x68], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10017f48
mov dword [ebp - 0x40], 0x1102
cmp dword [ebp - 0x40], 0x120b
jle 0x10017fcf
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], edi
mov esi, ebx
xor edi, eax
mov eax, esi
lea ecx, [ebp - 0x8ec]
or eax, edi
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10017f94
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8ec]
call fcn.10013840
inc esi
cmp esi, 0x5d19
jl 0x10017f78
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x78c5
jl 0x10017f71
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x19e
jl 0x10017f6c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jle 0x10017fe6
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x1c]
cmp eax, 0x6273
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, 0x943e2f7c
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x31c]
setl cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test eax, eax
setns cl
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x40], 0xf3c
jge 0x10018043
push 0x100080f8
call fcn.10050ebf
pop ecx
mov dword [ebp - 4], 0x15
xor edi, edi
mov dword [ebp - 0x34], ebx
inc edi
cmp dword [ebp - 0x34], 0x15
jge 0x100180da
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0x767dbf12
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x1001807d
push 0xea9
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, edi
mov eax, dword [ebp - 0x14]
cmp eax, 0x7f45
mov eax, dword [ebp - 0x68]
setg dl
sub ecx, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
cmp edx, 0xfd39ef5b
ja 0x100180ae
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0x31c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x15
jl 0x1001805d
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0xd
call fcn.10013359
push 3
pop ecx
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], ebx
jl 0x10018544
mov esi, dword [ebp - 0x3a4]
mov dword [ebp - 0x44], esi
jmp 0x10018106
push 3
pop ecx
mov dword [ebp - 0x18], 0x897a4a12
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], 0xd5ec
mov dword [ebp - 0x4c], 0xe816884
mov dword [ebp - 0x14], ebx
jmp 0x10018133
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10018126
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10018216
push 7
pop esi
mov dword [ebp - 0x2c], 0x44ad
mov ecx, 0xae0fc36f
mov dword [ebp - 0x38], 0xfffffffa
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
neg ecx
lea eax, [eax + ecx*4]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x18]
add edx, 0x658cc1cc
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xa0]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x28], ebx
je 0x10018204
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x100181ea
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], edi
dec dword [ebp - 0x18]
jns 0x1001814b
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x10018318
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10018303
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x2c], 0x14e288a3
mov dword [ebp - 0x34], ebx
jmp 0x100182f0
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x100182ed
mov dword [ebp - 0x54], 0x95a2e206
xor edx, edx
mov eax, dword [ebp - 0x18]
push 0
mov eax, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, 0x6d35
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xa0]
cmp ecx, eax
setle bl
xor edx, edx
imul ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp ebx, eax
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp eax, edx
pop ebx
setg cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x28]
jns 0x10018263
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x10018253
dec dword [ebp - 0x18]
jns 0x1001823d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xa0], ebx
jne 0x10018318
dec dword [ebp - 0x1c]
jns 0x10018226
mov dword [ebp - 0x34], 0xfffffffd
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], 0x97412df3
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x48], 0x5c7d8169
mov dword [ebp - 0x54], 0x50d5
mov dword [ebp - 0x24], 0x12
cmp dword [ebp - 0x24], 0xe
jne 0x10018459
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x41c]
push 2
call fcn.100132fd
mov dword [ebp - 0x38], 0x4c5530c4
mov dword [ebp - 0x14], ebx
jmp 0x10018381
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 0xb9725245
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001836e
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0x285faafe
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x41c]
setle dl
mov dword [eax], edx
test edx, edx
jne 0x100183bf
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x24], ebx
je 0x100183d0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
jne 0x10018487
cmp dword [ebp - 0x48], ebx
jne 0x10018479
cmp dword [ebp - 0x28], ebx
jne 0x1001846e
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x48], 0x83eb
mov ecx, ebx
jl 0x1001847b
mov ecx, edx
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0x54], ecx
mov eax, ebx
je 0x10018489
mov eax, edx
mov ecx, dword [ebp - 0x48]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xba889b05
setg cl
sub ecx, dword [ebp - 0x48]
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x28], eax
imul edx, dword [ebp - 0x34], 0x2a3c
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x9378
jne 0x100184f4
cmp dword [ebp - 0x14], ebx
jne 0x10018500
cmp dword [ebp - 0x14], ebx
jne 0x10018500
xor edi, edi
mov edx, ebx
inc edi
jmp 0x10018505
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
setne cl
add edx, ecx
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x50]
jns 0x10018103
or esi, 0xffffffff
lea ecx, [ebp - 0x3a4]
mov dword [ebp - 4], esi
call fcn.10013359
mov eax, 0x1006e5ec
mov dword [ebp - 0x24], 0xa8eac8b1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 6
jge 0x100186ff
mov dword [ebp - 0x38], 0x90e86489
mov dword [ebp - 0x2c], 0x44b0
cmp dword [ebp - 0x2c], 0x477e
jle 0x100185f1
push 0x17b6
push ebx
push 0x1194
push 0x18fe
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x38], 0x4421
mov eax, esi
lea ecx, [ebp - 0x88c]
cdq
push edx
push eax
call fcn.1000dcee
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100185c9
mov eax, dword [eax]
push eax
call fcn.10050ebf
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x88c]
call fcn.10013840
add esi, edi
dec dword [ebp - 0x38]
jne 0x100185af
inc edi
cmp edi, 0x29d5
jl 0x100185a6
or esi, 0xffffffff
cmp dword [ebp - 0x2c], 0x4123
jge 0x10018605
push 0x10008198
call fcn.10050ebf
pop ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x44], 0xad21
mov dword [ebp - 0x2c], 0x9f4aec70
mov dword [ebp - 0x1c], ebx
jmp 0x10018629
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], 0x97a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001861b
xor edi, edi
mov dword [ebp - 0x1c], ebx
inc edi
jmp 0x10018644
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x240], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10018637
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x24], 0x83a7ef23
mov eax, dword [ebp - 0x6c]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setl bl
xor edx, edx
mov dword [ebp - 0x240], ebx
mov eax, dword [ebp - 0x6c]
cmp ebx, eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
setne dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
cmp ecx, 0x782e
jge 0x1001869b
mov eax, edi
cmp dword [ebp - 0x70], ebx
jne 0x1001869d
mov eax, ebx
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x24]
jge 0x100186bf
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec eax
cmp eax, 0x30b56bf5
jne 0x100186cd
mov dword [ebp - 0x3c], 0xc28ade19
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0x6df37d45
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0xe5664dc9
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xfaafe30f
mov dword [ebp - 0x3c], 0xe1c97412
mov dword [ebp - 0x3c], 0xa5b7d8cf
mov dword [ebp - 0x38], 0x5fe46c2e
mov dword [ebp - 0x3c], ebx
dec dword [ebp - 0x38]
mov dword [ebp - 0x48], ebx
jmp 0x1001878f
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x464]
push 4
call fcn.100132fd
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x14], ebx
jmp 0x10018773
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x464]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10018760
lea ecx, [ebp - 0x464]
cmp dword [ebp - 0x44], ebx
jne 0x10018796
inc dword [ebp - 0x38]
call fcn.10013359
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jl 0x10018744
jmp 0x1001879b
call fcn.10013359
push 4
lea ecx, [ebp - 0x274]
call fcn.100132fd
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 0x28], 6
push edi
call fcn.100132fd
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x38], 0x58b39d20
push 4
call fcn.100132fd
push 4
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100187f8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100187e9
mov dword [ebp - 0x18], ebx
jmp 0x10018815
cmp dword [ebp - 0x18], edi
jl 0x10018802