Function at 0x1001a83d
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push ebx
push esi
push edi
mov eax, 0xb2c2
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa4], eax
xor esi, esi
mov dword [ebp - 0xa0], eax
inc esi
mov dword [ebp - 0x9c], eax
mov ecx, 0xffff
mov dword [ebp - 0x98], eax
push 4
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x417be187
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xd4dfbd6c
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xc2443ac4
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x2c]
mov dword [ebp - 4], 0x7222631
push 2
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0xb4ef66b
push 7
mov dword [ebp - 0xa8], edx
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], 0xa205
jle 0x1001a8e7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push 5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 6
pop edi
jmp 0x1001a954
mov dword [ebp - 4], ebx
jmp 0x1001a926
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], 0x68f62c4d
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a915
mov dword [ebp - 0x14], edi
jmp 0x1001a93b
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jne 0x1001a941
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
je 0x1001a930
mov dword [ebp - 0x10], ebx
jmp 0x1001a94c
dec dword [ebp - 0x30]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001a946
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jg 0x1001a910
mov dword [ebp - 8], 0xcf5720e8
mov dword [ebp - 0x2c], 0x49480dd0
mov dword [ebp - 0x18], 0x2b461593
mov dword [ebp - 4], ebx
jmp 0x1001a97e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001a974
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jne 0x1001a9e1
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, 0x8722
setne cl
xor edx, edx
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
setge cl
sub ecx, dword [ebp - 8]
jne 0x1001a9cb
mov eax, ebx
cmp dword [ebp - 8], ebx
je 0x1001a9cd
mov eax, esi
add eax, 0xfffffff6
mov ecx, ebx
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
neg eax
cmp dword [ebp - 8], eax
jne 0x1001a9e3
mov ecx, esi
mov eax, dword [ebp - 8]
imul eax, ecx
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp eax, 0x829cbc21
mov eax, dword [ebp - 8]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xfffd
setne al
cmp eax, dword [ebp - 8]
jle 0x1001ab5a
mov dword [ebp - 0x10], 0x8951fe51
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x1001ab4b
mov dword [ebp - 4], 0xfffffffb
mov dword [ebp - 0x2c], 0xffffffff
cmp dword [ebp - 0x10], ebx
je 0x1001aa7c
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1001aa59
push 0x1c5
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1001ab48
push 0x98d
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_Polyline]
jmp 0x1001ab48
xor edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], 5
cmp dword [ebp - 0x30], ebx
jne 0x1001ac36
dec dword [ebp - 4]
je 0x1001ab3d
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, 0x7f72
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, 1
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, 1
sbb eax, eax
neg eax
cmp eax, 2
sbb eax, eax
inc eax
cmp eax, 0x37a762af
jge 0x1001ab15
cmp dword [ebp - 0x10], ebx
jne 0x1001ab15
mov eax, ebx
jmp 0x1001ab18
xor eax, eax
inc eax
mov edx, dword [ebp - 0x44]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x14]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x575e
setle al
cmp eax, dword [ebp - 4]
jne 0x1001ab3d
xor ecx, ecx
inc ecx
jmp 0x1001ab3f
mov ecx, ebx
mov eax, dword [ebp - 0x40]
imul eax, ecx
mov dword [ebp - 0x20], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff3
jl 0x1001aa32
jmp 0x1001ac36
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
inc edx
jmp 0x1001ab85
mov dword [ebp - 0x10], 0xef1792f5
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x1001ab82
cmp dword [ebp - 0x44], ebx
jne 0x1001ab82
dec dword [ebp - 0x10]
jns 0x1001ab78
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1001ab69
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], edx
jg 0x1001ac36
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x44], ebx
jne 0x1001abe6
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov esi, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 4]
cmp eax, edx
mov eax, dword [ebp - 0x40]
setg cl
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
setle cl
mov eax, dword [ebp + eax*4 - 0x44]
add eax, ecx
cmp eax, dword [ebp - 4]
jge 0x1001abe3
mov edx, ebx
jmp 0x1001abe6
xor edx, edx
inc edx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
sete cl
mov dword [ebp + eax*4 - 0x44], ecx
neg ecx
je 0x1001ac07
cmp dword [ebp - 8], ebx
je 0x1001ac07
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1001ac0c
xor edx, edx
mov ecx, ebx
inc edx
mov eax, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x77dc9657
setge cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1001ab96
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], 0x3f5047c4
mov dword [ebp - 0x18], 0xafa01777
mov dword [ebp - 4], ebx
jmp 0x1001ac5a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 0xec299e88
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001ac49
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9cd4431f
setge cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jne 0x1001ac99
cmp dword [ebp - 0x14], ebx
jne 0x1001ac99
mov eax, ebx
jmp 0x1001ac9c
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1001acc3
push ebx
push 0xbfa
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x9ae4f78d
mov dword [ebp - 0x28], 0xbac8
push 2
mov dword [ebp - 0x28], 0x504e
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 8], ebx
jmp 0x1001ad04
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001acf3
push 3
mov dword [ebp - 8], ebx
pop edx
jmp 0x1001ad22
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001ad11
mov dword [ebp - 8], ebx
jmp 0x1001ad3d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001ad2c
dec dword [ebp - 0x2c]
mov eax, 0x747b1d00
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x20], 0xef7d6512
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 4], ebx
jmp 0x1001ad97
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0xc17e5c28
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001ad89
mov dword [ebp - 0xc], 0x4b4b1328
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
mov dword [ebp - 0x3c], edx
test edx, edx
je 0x1001ade0
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1001aef5
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1001aef5
mov dword [ebp - 0x14], 0x76373a4c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 8], ebx
jne 0x1001ae09
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3c], 0xfff9
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x20], ebx
je 0x1001aea8
cmp dword [ebp - 0x14], ebx
je 0x1001ae3e
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
inc ecx
jmp 0x1001ae40
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
lea eax, [ecx - 0xf603]
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 4]
jge 0x1001ae5d
cmp dword [ebp - 4], ebx
je 0x1001ae5d
xor edx, edx
inc edx
jmp 0x1001ae5f
mov edx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 2
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jne 0x1001ae96
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
sub eax, 0xfff6
je 0x1001aea8
xor ecx, ecx
inc ecx
jmp 0x1001aeaa
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
cmp ecx, dword [ebp - 0x10]
je 0x1001aeba
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 4]
jne 0x1001aee2
cmp dword [ebp - 0x10], ebx
jne 0x1001aee2
mov edx, ebx
jmp 0x1001aee5
xor edx, edx
inc edx
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0x2132
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffffe
inc ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x4ae9c241
mov dword [ebp - 0xc], ebx
jmp 0x1001af26
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5c], 0x7f47073e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001af18
mov dword [ebp - 0xc], ebx
jmp 0x1001af3e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34], 0xe769035a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001af30
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp ecx, eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
setle bl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp ebx, edx
setge al
add eax, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 8]
je 0x1001af74
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
add edx, 0x4448
cmp eax, edx
setge cl
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], ebx
je 0x1001af9c
xor eax, eax
inc eax
jmp 0x1001af9e
mov eax, ebx
imul edx, eax, 0xffff
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001afc1
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
imul ecx, dword [ebp - 8], 3
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setl dl
cmp edx, 0xffffffff
jae 0x1001b0fb
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x18], 0x93d1d1ce
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 8
cmp dword [ebp - 0xc], ebx
jne 0x1001b014
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xc]
jge 0x1001b02e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], 0xfff8
cmp dword [ebp - 0xc], ebx
je 0x1001b03d
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xfffffff8
setg cl
imul ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x30]
mov dword [ebp - 4], ebx
jmp 0x1001b0ef
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
sub eax, 6
je 0x1001b0d8
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, 0x9b47bed2
setge dl
cmp eax, edx
sbb eax, eax
inc eax
cmp dword [ebp - 0xc], eax
jne 0x1001b0d8
mov dword [ebp - 0x20], ebx
jmp 0x1001b0d1
mov dword [ebp - 0x10], ebx
jmp 0x1001b0c9
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1001b0a7
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001b0c6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x34], 2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x34]
dec dword [ebp - 0x14]
jns 0x1001b0af
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001b098
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001b093
jmp 0x1001b0ec
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001b0ec
mov dword [ebp - 0x2c], 1
dec dword [ebp - 0x10]
jns 0x1001b0e0
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x38
jne 0x1001b05e
jmp 0x1001b112
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setg dl
mov dword [ebp - 0x18], edx
mov eax, 0xe9d0
xor edx, edx
mov dword [ebp - 0xcc], eax
inc edx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], 0xd303f024
mov dword [ebp - 0x28], 0x88039d6b
push 3
mov dword [ebp - 0x28], 0xc593c869
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ebx
jmp 0x1001b166
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x180], 0x1ec2184e
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001b155
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
cmp eax, 0x51ea
setle cl
cmp ecx, edx
jg 0x1001b189
mov ecx, edx
cmp dword [ebp - 0xcc], ebx
jne 0x1001b18b
mov ecx, ebx
mov eax, dword [ebp - 0xc0]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc0]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x18]
mov dword [ebp - 4], ebx
jmp 0x1001b1c1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x198], 0x4778
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001b1b0
mov dword [ebp - 8], 0xb13638ec
mov dword [ebp - 0x18], 9
mov dword [ebp - 4], ebx
jmp 0x1001b1e8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0x3342eb90
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001b1da
push 2
pop edx
mov dword [ebp - 8], edx
cmp dword [ebp - 8], ebx
jl 0x1001b3cd
mov esi, 0xffff
mov dword [ebp - 4], 0xcc511ec1
mov dword [ebp - 0x2c], 0x4c3dc4d7
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0xc], ebx
jmp 0x1001b22d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10c], 0x89bdd777
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001b21c
mov dword [ebp - 0xc], ebx
jmp 0x1001b249
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd8], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b238
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x58], ecx
mov eax, dword [ebp - 8]
mov edx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 8]
neg eax
cmp eax, 4
mov eax, dword [ebp - 0x10c]
sbb ecx, ecx
inc ecx
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setle cl
xor ebx, ebx
inc ecx
cmp ecx, 0x4129
setle bl
add ebx, 0x8aad9e0e
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x100]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
imul eax, ecx, 0xfffc
mov dword [ebp - 0x108], ecx
add eax, dword [ebp - 0xd8]
je 0x1001b2e3
cmp dword [ebp - 0x50], ebx
je 0x1001b2e3
xor edx, edx
inc edx
jmp 0x1001b2e5
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 4], ebx
jmp 0x1001b3b1
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x54], 0xa099
test eax, eax
jne 0x1001b35b
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x58]
test eax, eax
setne cl
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x3dcd
setge cl
sub ecx, 0xfff7
jne 0x1001b35b
mov ecx, ebx
jmp 0x1001b35e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x58]
mov edx, dword [ebp - 8]
add edx, ecx
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0xd8], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x58]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x58], ebx
jne 0x1001b3bb
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe6
je 0x1001b2fd
dec dword [ebp - 8]
jns 0x1001b202
mov esi, dword [sym.imp.USER32.dll_GetDC]
push 2
pop edx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0x9ef3212
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0xfc8d6799
mov dword [ebp - 4], ebx
jmp 0x1001b3ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfc], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001b3ee
mov dword [ebp - 0x14], ebx
jmp 0x1001b599
mov dword [ebp - 0x10], 0x4c506d44
mov dword [ebp - 8], 0x41bbbbfe
mov dword [ebp - 0x10], ebx
jmp 0x1001b561
mov dword [ebp - 4], 0x8a6b950b
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 4], ebx
jmp 0x1001b554
xor ecx, ecx
mov dword [ebp - 0xc], ebx
inc ecx
cmp dword [ebp - 0xc], edx
jge 0x1001b453
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], ecx
inc dword [ebp - 0xc]
jmp 0x1001b43f
mov dword [ebp - 0xc], ebx
jmp 0x1001b462
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1001b458
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ecx
jg 0x1001b551
mov dword [ebp - 0x18], 0x9329
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp eax, 0xd7ba9668
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
add edx, 0x6286
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x20]
jle 0x1001b4a8
cmp dword [ebp - 0x14], ebx
jne 0x1001b4a8
mov edx, ebx
jmp 0x1001b4ab
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, 0x4c259dba
jne 0x1001b4da
cmp dword [ebp - 0x18], ebx
jne 0x1001b4da
mov eax, ebx
jmp 0x1001b4dd
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
je 0x1001b4e5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xe0], 0xfffffa1b
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
sub edx, 0x70669599
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
inc ecx
mov dword [ebp - 0xf8], ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 1
jle 0x1001b473
push 2
pop edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xb
jne 0x1001b439
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x1001b423
cmp dword [ebp - 0x2c], ebx
jne 0x1001b573
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x1001b58a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
jne 0x1001b40d
mov dword [ebp - 0x10], 0x24ec2e0c
push 9
pop ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x28], 0x3a79cc09
mov dword [ebp - 0x18], 0x3413
mov dword [ebp - 0x28], 0xc0e0752
mov dword [ebp - 0x10], ebx
jmp 0x1001b603
mov dword [ebp - 4], 0x6e52d8cb
mov dword [ebp - 4], ebx
jmp 0x1001b5fa
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x11c], ebx
jne 0x1001b600
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x1001b5eb
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe7
jle 0x1001b5df
inc dword [ebp - 0x18]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], ebx
jl 0x1001ba8d
mov dword [ebp - 0x14], ecx
xor ecx, ecx
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0x58d32ffa
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x18], 0x7a68
mov dword [ebp - 0x18], 0xf0b56fe1
mov dword [ebp - 0x18], 0xc49a7e12
mov dword [ebp - 0x28], 0xe8bfa085
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 4]
neg eax
mov dword [ebp - 0xbc], 0x2da
cmp eax, 0x442e
mov dword [ebp - 0x10], 0x2da
mov eax, dword [ebp - 0x10]
setle cl
imul eax, ecx
add eax, 0x712c5197
je 0x1001b6ab
cmp dword [ebp - 0xbc], ebx
je 0x1001b6ab
xor edx, edx
inc edx
jmp 0x1001b6ad
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 4]
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1001b6c9
cmp dword [ebp - 4], ebx
jne 0x1001b6d2
cmp dword [ebp - 0x14], ebx
jne 0x1001b6d2
mov edx, ebx
jmp 0x1001b6d5
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, 0xc0136ef6
setge cl
imul ecx, dword [ebp - 0x14]
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, 0xfffffff7
jne 0x1001b6f8
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
mov ecx, 0x8acc167d
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
add eax, 0xffff
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
jne 0x1001b729
cmp dword [ebp - 0x18], ebx
jne 0x1001b729
mov eax, ebx
jmp 0x1001b72c
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov byte [ebp - 0x19], bl
mov dword [ebp - 8], 0xe76f5020
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0xc], ebx
jmp 0x1001b76e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001b75d
push 3
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001b78a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], 0x40c18ab9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b77c
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], ebx
jl 0x1001b887
mov dword [ebp - 0x18], 1
xor edx, edx
mov dword [ebp - 0x18], 0xf79b347d
mov dword [ebp - 0x28], 0x6c49a7e
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0x18], 0xfadf
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setg dl
mov dword [ebp - 0x60], edx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001b87e
push ebx
push 0x1dea
push 0x1c5
push 0x1deb
push 0xad4
push 0x9da
push 0x1a0a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
dec dword [ebp - 8]
jns 0x1001b79b
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x7c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x64]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x60], ecx
cmp byte [ebp - 0x19], 0
je 0x1001ba81
mov dword [ebp - 0x14], 0x477862f
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x12
jg 0x1001ba79
push 2
pop ecx
mov eax, 0x4a0d461e
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 0xfffffffb
mov dword [ebp - 0xc], ebx
jmp 0x1001b924
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x90], 0x98070ade
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b913
mov dword [ebp - 0xc], ebx
jmp 0x1001b93f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], 0xfc3a065c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b92e
mov dword [ebp - 0x8c], ebx
jmp 0x1001b9de
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x1001b96c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x134], 0x367f5ed9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b95b
mov dword [ebp - 0xc], ebx
jmp 0x1001b987
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x158], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b976
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], ebx
jl 0x1001b9d8
mov dword [ebp - 0x28], 0x5336de01
mov dword [ebp - 0x28], 0xaaf5bfb6
mov dword [ebp - 0x10], ebx
jmp 0x1001b9bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x128], 0x9cdf9c77
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1001b9ab
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x134], 0xfffffffc
dec dword [ebp - 4]
dec dword [ebp - 0x20]
jns 0x1001b998
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xffffffeb
jg 0x1001b94f
mov dword [ebp - 0x10], 0x16
cmp dword [ebp - 0x10], 0xffffffea
jge 0x1001ba6c
mov dword [ebp - 4], ebx
jmp 0x1001ba31
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], ebx
jl 0x1001ba2e
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001ba29
push ebx
push 0xb64
push 0x14b4
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
dec dword [ebp - 0x20]
jns 0x1001ba09
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jle 0x1001b9fd
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001ba60
push 0x420
push 0x264e
push 0x148d
push 0xcf0
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
jl 0x1001b9f8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jle 0x1001b8ea
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
dec dword [ebp - 0x30]
push 9
pop ecx
jns 0x1001b618
mov dword [ebp - 0x28], 0x62fd41e5
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], 0x666a756a
mov dword [ebp - 0x18], 0xd9a924c0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x28], 0x20b95ae6
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 4], 0xfffffffc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xdc5336de
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x28], 0x2dd78f4f
push 4
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0x2c41ac3d
mov dword [ebp - 0x2c], 0xdf11bbb4
mov dword [ebp - 0x10], ebx
jmp 0x1001bb17
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001bb09
inc dword [ebp - 0x2c]
mov dword [ebp - 8], ebx
jmp 0x1001bc6b
mov dword [ebp - 0x18], 0xfffffffe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], ecx
mov dword [ebp - 0x30], 0xa4c63829
cmp dword [ebp - 0x30], ebx
jne 0x1001bb4f
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov eax, dword [ebp - 8]
setge cl
mov dword [ebp + eax*4 - 0x78], ecx
test ecx, ecx
je 0x1001bb78
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], ebx
je 0x1001bb9f
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], ecx
jmp 0x1001bc68
mov dword [ebp - 4], ebx
jmp 0x1001bbb1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x94], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001bba4
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 3
jg 0x1001bc58
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
cmp edx, 0x499c
setne cl
cmp dword [ebp + eax*4 - 0x78], ecx
jle 0x1001bbf9
mov eax, ebx
cmp dword [ebp - 0x94], ebx
je 0x1001bbfb
mov eax, esi
cmp eax, dword [ebp - 0x94]
jge 0x1001bc0c
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x78], ebx
jne 0x1001bc0e
mov esi, ebx
mov eax, dword [ebp - 8]
xor edx, edx
push 1
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
xor eax, eax
cmp esi, 0x939efd91
pop esi
setne al
imul edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x78]
imul ecx, edx, 0xe882
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
mov dword [ebp + eax*4 - 0x78], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x1001bbc3
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001bc68
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x1001bb27
push ebx
push 0x1dee
call fcn.1001e742
mov dword [ebp - 4], 0x1852
pop ecx
mov dword [ebp - 0x10], 0xfffffffc
pop ecx
mov dword [ebp - 0x20], ebx
jmp 0x1001bca2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x144], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001bc95
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001bcbc
push 0x1feb
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
imul edx, eax, 0x5c81
mov eax, dword [ebp - 0x10]
cmp eax, 0xb4e1
setne cl
cmp ecx, edx
jge 0x1001bcfd
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001bd2e
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1001bd2e
mov dword [ebp - 0x10], ebx
jmp 0x1001bd28
mov dword [ebp - 4], ebx
jmp 0x1001bd1f
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001bd1c
push 0xf1f
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x1001bd07
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
jg 0x1001bd02
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x18], 0xe24307a3
mov dword [ebp - 0xc], ebx
jmp 0x1001bd56
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x38], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001bd48
mov dword [ebp - 0xc], ebx
jmp 0x1001bd71
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x150], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001bd60
mov eax, esi
cmp dword [ebp - 0x38], ebx
jne 0x1001bd80
mov eax, ebx
add eax, 0xfffffffe
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
je 0x1001bd9c
mov ebx, esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, ebx
setge cl
mov dword [ebp - 0x28], ecx
mov ecx, 0x3e8
mov dword [ebp - 0x18], 0x41720348
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0xa8]
cdq
idiv ecx
mov ecx, dword [ebp - 0xac]
mov esi, edx
mov edi, eax
call fcn.1001a7cb
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret