Function at 0x1000b2dc
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005b0e1
call fcn.1005a768
sub esp, 0x220
mov eax, 0x48d327cb
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], 0xfffffffa
push ebx
mov dword [ebp - 0x34], 0xedad
xor ebx, ebx
dec dword [ebp - 0x34]
push esi
mov dword [ebp - 0x40], 0x532e
cmp dword [ebp - 0x40], 0x5442
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x1ac], ebx
jle 0x1000b39f
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov dword [ebp - 0x34], 0x2b40
mov dword [ebp - 0x30], ebx
mov esi, 0x3e46
mov eax, ebx
mov ecx, 0x10075b18
cdq
push edx
push eax
call fcn.10001b85
add ebx, edi
dec esi
jne 0x1000b35f
mov esi, dword [ebp - 0x44]
add edi, esi
dec dword [ebp - 0x34]
push 0
pop ebx
jne 0x1000b357
inc esi
mov dword [ebp - 0x44], esi
cmp esi, 0x1bb
jl 0x1000b34e
push ebx
push ebx
push 0x14b8
xor edi, edi
push ebx
inc edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [ebp - 0x1d], bl
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x40], 0x50e3
jge 0x1000b3bd
mov edx, str.onkboupn_zhjfl_avxqc
mov ecx, 0x10075b18
call fcn.100036dc
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x1d], 0
je 0x1000b3cd
call dword [sym.imp.USER32.dll_EndMenu]
push 0x62
pop eax
push 2
mov dword [ebp - 0x74], 0xd027a03
mov word [ebp - 0x70], 0x305
mov byte [ebp - 0x6e], 1
mov byte [ebp - 0x6d], bl
mov dword [ebp - 0x6c], 0x27ce3b03
mov dword [ebp - 0x68], 0x3d060d04
mov byte [ebp - 0x64], bl
mov byte [ebp - 0x63], 0x1b
mov word [ebp - 0x176], ax
pop esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], esi
cmp esi, 0x12
jae 0x1000bb56
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x88]
push 4
call fcn.10001c9a
mov dword [ebp - 0x1c], ebx
jmp 0x1000b463
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000b450
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xe
jne 0x1000b59b
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jg 0x1000b588
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 1
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000b4aa
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebx + 4], 0xfffe
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x88]
setg cl
xor edx, edx
cmp dword [eax + esi*4], ecx
setl dl
xor ecx, ecx
cmp dword [eax + edi*4], edx
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, dword [ebx + 4]
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x3c]
setne cl
xor ebx, ebx
cmp dword [edx + eax*4], ecx
mov ecx, dword [ebp - 0x38]
sete bl
sub ebx, 0x1540
neg ebx
sbb ebx, ebx
xor eax, eax
inc ebx
cmp ebx, dword [edx + ecx*4]
setl al
xor ebx, ebx
add eax, 3
jne 0x1000b53c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x88]
cmp dword [eax + ecx*4], ebx
jne 0x1000b53c
mov eax, ebx
jmp 0x1000b53f
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jl 0x1000b54e
cmp dword [ebp - 0x18], ebx
je 0x1000b54e
xor ecx, ecx
inc ecx
jmp 0x1000b550
mov ecx, ebx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
add eax, ecx
mov ecx, dword [ebp - 0x18]
imul ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
test ecx, ecx
jle 0x1000b576
cmp dword [ebp - 0x18], ebx
je 0x1000b576
xor eax, eax
inc eax
jmp 0x1000b578
mov eax, ebx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1000b493
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xe
je 0x1000b476
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x88], 0
je 0x1000b5bf
push dword [ebp - 0x88]
call fcn.10042747
pop ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
movzx eax, byte [ebp - 0x74]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x1000b6b2
push 3
pop esi
push esi
lea ecx, [ebp - 0x138]
call fcn.10001c9a
push esi
lea ecx, [ebp - 0x154]
mov dword [ebp - 4], 2
call fcn.10001c9a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000b613
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0xb58e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b600
mov dword [ebp - 0x18], ebx
jmp 0x1000b62d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b61d
xor edi, edi
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x1000b64b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b0], 0x36173948
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000b63a
mov eax, dword [ebp - 0x154]
mov esi, dword [ebp - 0x138]
push eax
inc dword [esi + 8]
mov dword [eax + 8], 0xffffffee
call fcn.10042747
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
call fcn.10042747
mov esi, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
movzx eax, byte [ebp + esi - 0x74]
dec esi
mov dword [ebp - 0x130], ebx
add esi, eax
lea ecx, [eax + 1]
mov dword [ebp - 0x40], ecx
jmp 0x1000bb4e
xor edi, edi
lea ecx, [ebp - 0xa4]
inc edi
push edi
call fcn.10001c9a
push 3
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], 0xff8ee1d1
mov dword [ebp - 0x1c], 0xcdf5ef88
mov dword [ebp - 0x1c], 0xc007c7be
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], 0xc12a7b09
mov dword [ebp - 0x28], 0x21dd2eb2
push edi
call fcn.10001c9a
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x28], 0x3ca5
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1000b72a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b717
mov dword [ebp - 0x18], ebx
jmp 0x1000b747
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xa10dd664
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b734
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jge 0x1000b972
xor edi, edi
inc edi
cmp dword [ebp - 0x110], 0
je 0x1000b782
push dword [ebp - 0x110]
call fcn.10042747
pop ecx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xa4], 0
je 0x1000b7ad
push dword [ebp - 0xa4]
call fcn.10042747
pop ecx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov eax, dword [ebp - 0x2c]
movzx edx, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x76]
movzx ecx, word [ebp + eax*2 - 0x17c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
mov eax, dword [ebp - 0x2c]
add ecx, edx
movzx eax, byte [ebp + eax - 0x74]
mov word [ebp + eax*2 - 0x17c], cx
mov dword [ebp - 0x28], 0xa8f9
mov dword [ebp - 0x38], 0x757e
cmp dword [ebp - 0x38], 0x7756
jle 0x1000b896
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x24], 0x6d2c
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x40], ebx
mov eax, edx
mov dword [ebp - 0x44], 0x73bd
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 0x34], eax
cdq
lea ecx, [ebp - 0x228]
push edx
push eax
call fcn.10001a41
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b837
mov eax, dword [eax]
push eax
call fcn.100425d6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x228]
call fcn.10001f96
mov eax, dword [ebp - 0x34]
inc eax
dec dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
jne 0x1000b81f
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x40], ecx
cmp ecx, 0x6577
jl 0x1000b80e
mov eax, dword [ebp - 0x18]
add edx, eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
jne 0x1000b809
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x46c4
jl 0x1000b7fd
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x38], 0x7499
jge 0x1000b8b1
push str.qpb_pbvz_assu_qsmzevlbn
call fcn.100425d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xc6f1bf50
mov dword [ebp - 0x44], 0x1fe2
cmp dword [ebp - 0x44], 0x21bd
jle 0x1000b903
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
add eax, ebx
mov ecx, 0x10075b18
cdq
push edx
push eax
call fcn.10001b85
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x3b6a
jl 0x1000b8d7
inc ebx
push 0
mov dword [ebp - 0x34], ebx
cmp ebx, 0x2388
pop ebx
jl 0x1000b8cf
mov dword [ebp - 0x28], 4
mov dword [ebp - 4], 7
cmp dword [ebp - 0x44], 0x1d8e
jge 0x1000b929
mov edx, str.olpcr_ybuhr_fdxhwo_azhxzyz_ncgo_xbu_airjldhz_ymev_vzw_xliy
mov ecx, 0x10075b18
call fcn.100036dc
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xf36f6dd8
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 7
push esi
call fcn.10001c9a
mov eax, 0xae28de6
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000baf9
xor edx, edx
inc edx
mov dword [ebp - 0x28], 0xfffffffc
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x6e86ff18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
push esi
call fcn.10001c9a
mov dword [ebp - 0x30], 0x337672a6
mov dword [ebp - 0x3c], 0xf7cd
mov dword [ebp - 0x18], ebx
jmp 0x1000b9c5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x939e63a5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b9b2
mov dword [ebp - 0x18], ebx
jmp 0x1000b9e0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x198], 0xaf1ba137
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b9cf
xor edi, edi
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x1000b9fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], 0x24df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000b9ed
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + eax*4], 6
jae 0x1000ba18
cmp dword [ecx], ebx
mov ecx, ebx
je 0x1000ba1a
mov ecx, edi
mov eax, dword [ebp - 0x198]
xor edx, edx
dec dword [ebp - 0x198]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jne 0x1000ba4c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + ecx*4]
mov ecx, 0x89bb5c1e
add eax, 0xa760
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1000ba8c
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], edi
dec dword [ebp - 0xa8]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000ba73
push dword [ebp - 0xf8]
call fcn.10042747
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
dec dword [ebp - 0x24]
pop ecx
jns 0x1000b96f
jmp 0x1000b75b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0x6923607a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000bae8
mov dword [ebp - 0x18], ebx
jmp 0x1000bb16
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xdcef989b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000bb03
dec dword [ebp - 0x188]
cmp dword [ebp - 0xec], 0
je 0x1000bb48
push dword [ebp - 0xec]
call fcn.10042747
pop ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ebx
add esi, 2
jmp 0x1000b406
xor eax, eax
lea ecx, [ebp - 0x104]
push 1
mov word [ebp - 0x16e], ax
call fcn.10001c9a
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x2c], 0x83c7730f
mov dword [ebp - 0x30], 0x8b5131d8
mov dword [ebp - 0x34], 0xa5223fa3
mov dword [ebp - 0x38], 0xffffffff
push 2
call fcn.10001c9a
mov dword [ebp - 0x24], 0x3413f087
mov dword [ebp - 0x18], ebx
jmp 0x1000bbbb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xec2e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1000bba8
mov dword [ebp - 0x18], ebx
jmp 0x1000bbd9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xe7b79f6a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000bbc6
mov dword [ebp - 0x2c], ebx
jmp 0x1000bbf7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000bbf4
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000bbe4
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x24]
cmp ecx, eax
je 0x1000bc0e
xor eax, eax
inc eax
jmp 0x1000bc10
mov eax, ebx
cmp eax, dword [ebp - 0x2c]
jl 0x1000bc3d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
je 0x1000bc26
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
mov eax, dword [ebp - 0xc0]
mov dword [eax + 4], 0xfffffffa
jne 0x1000bc3d
mov eax, ebx
jmp 0x1000bc40
xor eax, eax
inc eax
add eax, 0xffff
jne 0x1000bc50
cmp dword [ebp - 0x34], ebx
jne 0x1000bc50
mov eax, ebx
jmp 0x1000bc53
xor eax, eax
inc eax
cmp dword [ebp - 0xc0], 0
mov dword [ebp - 0x2c], eax
je 0x1000bc7d
push dword [ebp - 0xc0]
call fcn.10042747
pop ecx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x104], 0
je 0x1000bca8
push dword [ebp - 0x104]
call fcn.10042747
pop ecx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
xor eax, eax
mov dword [ebp - 0x1b4], 7
mov word [ebp - 0x1c8], ax
lea ecx, [ebp - 0x1c8]
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x1b8], ebx
push eax
call fcn.1000a767
mov dword [ebp - 4], 0xa
lea edi, [ebp - 0x17c]
xor eax, eax
lea ecx, [ebp - 0xb4]
stosd dword es:[edi], eax
push 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3c], 0x2db58e46
xor edi, edi
mov dword [ebp - 0x28], 0x7ad95e17
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xbe4438b
mov dword [ebp - 0x2c], 0x985a9576
mov dword [ebp - 0x44], 0xfffffff8
call fcn.10001c9a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], 0x2f44
cmp dword [ebp - 0x18], 0x2f9f
jle 0x1000bd78
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0x22d3
mov esi, ebx
mov ebx, dword [ebp - 0x38]
mov eax, ebx
mov ecx, 0x10075b18
and eax, esi
cdq
push edx
push eax
call fcn.10001b85
inc esi
cmp esi, 0x28ab
jl 0x1000bd42
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x40]
push 0
mov dword [ebp - 0x38], ebx
pop ebx
jne 0x1000bd3d
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x14be
jl 0x1000bd33
mov dword [ebp - 0x24], 0x815898f
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x18], 0x2bd3
jge 0x1000bdbc
mov edx, str.awbhlb_wbdiw_zxs_gpcpm_kzwa_npqhohen_vmd_gyelil_gzg_vlusksjjq_uylux_oixumh
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1000bdbc
push 2
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xb
call fcn.10001c9a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000bdf3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000bde0
mov dword [ebp - 0x3c], 0x215f
cmp dword [ebp - 0x3c], 0x24b9
jle 0x1000be68
mov edx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], ebx
mov esi, ebx
mov eax, ebx
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
lea ecx, [eax + esi]
mov eax, ebx
shl eax, cl
mov ecx, 0x10075b18
or eax, edx
cdq
push edx
push eax
call fcn.10001b85
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x3f4a
jl 0x1000be1b
inc esi
push 0
pop ebx
cmp esi, 0x745
jl 0x1000be13
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x18ac
jl 0x1000be11
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 0x2e63
jl 0x1000be0e
mov dword [ebp - 0x18], ebx
jmp 0x1000be80
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000be6d
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x3c], 0x1f0b
jge 0x1000bec3
mov edx, str.dtxxzox_wdxyxbm_hdxr_xfomakowp_fgu_nio_yoxn_hpajlrwq_bthdabyu
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1000bec3
mov dword [ebp - 4], 0xe
xor ecx, ecx
inc dword [ebp - 0x24]
mov esi, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub edx, dword [esi + 0xc]
cmp edx, eax
mov eax, 0xb5cf0adc
setne cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp dword [esi + 0xc], eax
jg 0x1000bef5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x44]
cmp dword [ecx + 8], eax
je 0x1000bf16
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x1000bf18
mov eax, edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x44], eax
jg 0x1000bf2a
mov edx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1000bf2c
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x11c]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x24]
cmp edx, eax
push dword [ebp - 0x11c]
setg cl
xor edx, edx
cmp esi, ecx
mov esi, dword [ebp - 0xb4]
setg dl
xor eax, eax
cmp edx, dword [esi]
setge al
mov dword [ebp - 0x30], eax
call fcn.10042747
pop ecx
push esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov byte [ebp - 4], 0xa
call fcn.10042747
pop ecx
push dword [ebp - 0x120]
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.10006877
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x28], 2
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000bfca
push 0x1f63
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000bfe0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 3
pop esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 0x9fb37b04
mov dword [ebp - 0x3c], 0x672d714f
mov dword [ebp - 0x28], 0xf9c32812
mov dword [ebp - 0x30], 0x89afca86
mov dword [ebp - 0x28], 0xb1e5de2c
mov dword [ebp - 0x30], 0x8663
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul eax, dword [ebp - 0x3c], 0x26d
sub ecx, eax
add ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x1c], ecx
jne 0x1000c068
mov dword [ebp - 0x30], 0xd238
mov ecx, 0xfffc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setle dl
sub edx, 0x487a49b9
mov dword [ebp - 0x30], edx
jmp 0x1000c085
mov dword [ebp - 0x34], ebx
mov eax, edi
mov dword [ebp - 0x28], 0xb8ffd020
mov dword [ebp - 0x34], 0xf890
cmp dword [ebp - 0x34], ebx
jne 0x1000c082
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x1c], ebx
jmp 0x1000c0a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x204], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000c097
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], ebx
jl 0x1000c0df
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000c0c5
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000c0da
push 0xfa9
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
dec dword [ebp - 0x24]
jns 0x1000c0b5
mov dword [ebp - 0x24], ebx
jmp 0x1000c0f3
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x204], ebx
jne 0x1000c0f9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1000c0e4
push 0x5c
pop eax
push 2
pop ecx
mov byte [ebp - 0x58], bl
mov dword [ebp - 0x57], 0x705b046a
mov word [ebp - 0x53], 0xd477
mov word [ebp - 0x50], ax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000c12f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000c11e
mov dword [ebp - 0x18], ebx
jmp 0x1000c143
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000c139
mov dword [ebp - 0x78], ebx
cmp dword [ebp - 0x78], 2
jg 0x1000c1a2
mov dword [ebp - 0x28], 0xfffffffd
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x1a4], ebx
jne 0x1000c180
mov eax, dword [ebp - 0x78]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
sete dl
cmp edx, 0xffffffff
mov edx, ebx
jl 0x1000c182
mov edx, edi
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 2
jle 0x1000c152
mov ecx, dword [ebp - 0x1c]
cmp ecx, 2
jne 0x1000c1b3
push 5
mov dword [ebp - 0x34], 5
pop ecx
jmp 0x1000c1e2
movzx edx, byte [ebp + ecx - 0x57]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ebx
movzx eax, byte [ebp + ecx - 0x5a]
movzx ecx, word [ebp + eax*2 - 0x50]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
mov eax, dword [ebp - 0x1c]
add ecx, edx
movzx eax, byte [ebp + eax - 0x58]
mov word [ebp + eax*2 - 0x50], cx
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp ecx, 7
jb 0x1000c119
xor eax, eax
mov dword [ebp - 0x158], 7
mov word [ebp - 0x4e], ax
lea ecx, [ebp - 0x16c]
mov word [ebp - 0x16c], ax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x15c], ebx
call fcn.1000a767
mov byte [ebp - 4], 0x12
mov eax, 0x70ad6f2e
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x28], 0x152c58fb
mov dword [ebp - 0x28], 0x748afa2f
mov dword [ebp - 0x30], 0xc6ef
mov dword [ebp - 0x1c], ebx
jmp 0x1000c270
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x210], 0x62ee6d05
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000c25f
dec dword [ebp - 0x30]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x2c], 0xce125d16
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0xf9150fae
mov dword [ebp - 0x2c], ebx
jmp 0x1000c29f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x48], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 1
jl 0x1000c295
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x1000c427
mov dword [ebp - 0x24], 0x891f782a
mov dword [ebp - 0x30], 0x8d72a67f
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1000c328
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x48], ebx
je 0x1000c31b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x1c], eax
jne 0x1000c2e5
cmp dword [ebp - 0x1c], ebx
jne 0x1000c2e5
mov eax, ebx
jmp 0x1000c2e8
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x1000c2f5
cmp dword [ebp - 0x18], ebx
jne 0x1000c302
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x1000c302
mov ecx, ebx
jmp 0x1000c305
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x48]
sub ecx, eax
cmp ecx, 0x3927
jg 0x1000c31b
xor eax, eax
inc eax
jmp 0x1000c31d
mov eax, ebx
imul eax, eax, 0xe
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x24]
jns 0x1000c2c7
mov dword [ebp - 0x44], 0x1fa9
cmp dword [ebp - 0x44], 0x229e
jle 0x1000c39c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 0x2479
mov esi, dword [ebp - 0x34]
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 0x4a30
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10075b18
cdq
push edx
push eax
call fcn.10001b85
add ebx, edi
dec dword [ebp - 0x30]
jne 0x1000c354
inc edi
push 0
pop ebx
cmp edi, 0x5d79
jl 0x1000c34a
mov esi, dword [ebp - 0x38]
add dword [ebp - 0x34], esi
dec dword [ebp - 0x3c]
jne 0x1000c345
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x373a
jl 0x1000c33b
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
call esi
jmp 0x1000c3a2
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], ebx
jmp 0x1000c3d9
mov dword [ebp - 0x24], ebx
jmp 0x1000c3c8
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1000c3c5
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000c3c0
push ebx
call esi
dec dword [ebp - 0x1c]
jns 0x1000c3b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1000c3ac
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x1000c3de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000c3a7
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x44], 0x1d38
jge 0x1000c418
mov edx, str.tockztz_xtmokxcfe_zxcnucr
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1000c418
mov dword [ebp - 4], 0x12
dec dword [ebp - 0x2c]
jmp 0x1000c2a8
mov dword [ebp - 0x18], ebx
jmp 0x1000c437
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jne 0x1000c43d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
je 0x1000c42c
push 0x5f
pop eax
push 2
mov byte [ebp - 0x60], bl
mov ecx, ebx
mov dword [ebp - 0x5f], 0xc4e1046c
mov word [ebp - 0x5b], 0x5c5e
mov word [ebp - 0x4c], ax
pop esi
cmp esi, 2
jne 0x1000c465
push 5
pop ecx
push ecx
pop esi
jmp 0x1000c48c
movzx edx, byte [ebp + esi - 0x5f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx eax, word [ebp + eax*2 - 0x4c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x60]
mov word [ebp + eax*2 - 0x4c], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x1000c459
xor eax, eax
lea ecx, [ebp - 0x94]
mov word [ebp - 0x4a], ax
mov dword [ebp - 0x1c], 0xfffffff6
push 3
call fcn.10001c9a
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x2c], ebx
jmp 0x1000c4d1
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0xc69aed23
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000c4be
dec dword [ebp - 0x1c]
jne 0x1000c5bd
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x1000c5bd
push 2
pop esi
push esi
lea ecx, [ebp - 0x12c]
call fcn.10001c9a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1000c520
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc8], 0xe01afec1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000c50f
mov dword [ebp - 0x24], ebx
jmp 0x1000c53d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0x4b79a97a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000c52a
mov eax, dword [ebp - 0x94]
mov ecx, 0x295a5277
xor ebx, ebx
mov dword [eax], ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x94]
cmp eax, dword [ecx + 4]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x94]
setne bl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0xc8]
setge dl
xor ecx, ecx
cmp edx, ebx
setge cl
add eax, ecx
mov ecx, dword [ebp - 0x12c]
push ecx
mov dword [ecx + 4], eax
mov dword [ebp - 0x28], eax
call fcn.10042747
xor ebx, ebx
xor edi, edi
pop ecx
mov dword [ebp - 0x12c], ebx
inc edi
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
jmp 0x1000c65d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], 0xda72
mov dword [ebp - 0x30], 0x30477ae2
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x2c], ebx
je 0x1000c5d9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x94]
push 2
mov eax, dword [esi + 8]
mov edx, dword [esi + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x1c]
cmp edx, ecx
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle bl
xor edx, edx
cmp ebx, eax
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
pop esi
setle cl
xor edi, edi
xor edx, edx
inc edi
cmp ecx, edi
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
sub eax, 0x628e
neg eax
sbb eax, eax
inc eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 0x12
push dword [ebp - 0x94]
call fcn.10042747
xor eax, eax
mov dword [ebp - 0x94], ebx
pop ecx
mov word [ebp - 0x1e0], ax
lea ecx, [ebp - 0x1e0]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x90], ebx
push eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x1cc], 7
mov dword [ebp - 0x1d0], ebx
call fcn.1000a767
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x4c], ebx
push dword [ebp - 0x15c]
cmp dword [ebp - 0x158], 8
lea eax, [ebp - 0x16c]
push ebx
cmovae eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x1f8]
push eax
call fcn.1000cd09
cmp eax, 0xffffffff
je 0x1000c6f3
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x1e0]
push ecx
push edi
push eax
lea ecx, [ebp - 0x1f8]
call fcn.1000ca15
jmp 0x1000c6ae
mov dword [ebp - 0x18], 0x5596960f
mov dword [ebp - 0x1c], ebx
jmp 0x1000c710
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd4], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000c6ff
mov dword [ebp - 0x18], ebx
jmp 0x1000c796
push 4
lea ecx, [ebp - 0xe0]
call fcn.10001c9a
mov dword [ebp - 0x1c], ebx
jmp 0x1000c73c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000c72d
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x28], eax
mov dword [eax + 4], ebx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1000c76d
push ebx
push ebx
push 0x25f9
push 0x18d9
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [ebp - 0x28]
inc dword [eax + 4]
cmp dword [eax + 4], esi
jle 0x1000c74e
push dword [ebp - 0xe0]
call fcn.10042747
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
inc dword [ebp - 0x18]
pop ecx
cmp dword [ebp - 0x18], esi
jle 0x1000c71b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x18], eax
jg 0x1000c7ac
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x1000c7ba
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], ebx
je 0x1000c7c7
cmp dword [ebp - 0x18], ebx
jne 0x1000c7cd
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x1f8]
push eax
mov dword [ebp - 0x18], edi
call fcn.1000cdac
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1e0]
call fcn.10006b31
push ebx
push edi
lea ecx, [ebp - 0x16c]
call fcn.10006b31
push ebx
push edi
lea ecx, [ebp - 0x1f8]
call fcn.10006b31
push ebx
push edi
lea ecx, [ebp - 0x1c8]
call fcn.10006b31
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x98]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret