Function at 0x1000aeb4
Capabilities:
Create directory
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a2bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xebc
push esi
push edi
mov dword [ebp - 0xa18], 0x2db5
push 2
lea ecx, [ebp - 0xc14]
call fcn.1001a32c
and dword [ebp - 4], 0
mov dword [ebp - 0x288], 0
jmp 0x1000af08
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1000af2a
push dword [ebp - 0x288]
lea ecx, [ebp - 0xc14]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
jmp 0x1000aefb
mov esi, dword [ebp - 0xa18]
push 0
lea ecx, [ebp - 0xc14]
call fcn.1001a399
mov dword [eax], esi
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1000af6b
push 0x1f66
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.1001a394
mov dword [ebp - 0xa50], 0x2db5
push 2
lea ecx, [ebp - 0xc38]
call fcn.1001a32c
mov dword [ebp - 4], 1
mov dword [ebp - 0x220], 0
jmp 0x1000afb1
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x1000afd3
push dword [ebp - 0x220]
lea ecx, [ebp - 0xc38]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
jmp 0x1000afa4
mov esi, dword [ebp - 0xa50]
push 0
lea ecx, [ebp - 0xc38]
call fcn.1001a399
mov dword [eax], esi
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1000b014
push 0x1f66
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc38]
call fcn.1001a394
mov dword [ebp - 0xfc], 2
mov dword [ebp - 0x2a4], 0
jmp 0x1000b046
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1000b062
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xde8], 0xffffffff
jmp 0x1000b039
mov dword [ebp - 0xfc], 1
jmp 0x1000b07b
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x1000b172
push 3
lea ecx, [ebp - 0xc50]
call fcn.1001a32c
mov dword [ebp - 4], 2
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x1000b0bf
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1000b0de
push dword [ebp - 0x228]
lea ecx, [ebp - 0xc50]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000b0b2
push 2
lea ecx, [ebp - 0xc50]
call fcn.1001a399
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x8a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8a8]
mov dword [ecx], eax
mov dword [ebp - 0x2ac], 2
jmp 0x1000b11b
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jl 0x1000b15e
mov byte [ebp - 0x14f], 0
movzx eax, byte [ebp - 0x14f]
test eax, eax
je 0x1000b13e
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000b15c
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1000b10e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.1001a394
jmp 0x1000b06e
mov dword [ebp - 0xfc], 0xe
jmp 0x1000b18b
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x12
jl 0x1000b1ba
mov byte [ebp - 0x153], 0
movzx eax, byte [ebp - 0x153]
test eax, eax
je 0x1000b1b8
push 0x16d8
push 0x1993
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1000b17e
push 2
lea ecx, [ebp - 0x3cc]
call fcn.1001a32c
mov dword [ebp - 4], 3
mov dword [ebp - 0x8d4], 2
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x310], 0x14c5530c
mov dword [ebp - 0xa68], 0x21029358
mov dword [ebp - 0x90], 0
jmp 0x1000b20f
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000b22b
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x39c], 0xe0648261
jmp 0x1000b202
mov dword [ebp - 0x90], 0
jmp 0x1000b244
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000b266
push dword [ebp - 0x90]
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
mov dword [eax], 0x46df37d4
jmp 0x1000b237
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x39c], 0
jmp 0x1000b294
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x39c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x39c], 0xffffffe7
jle 0x1000b6cb
mov dword [ebp - 0x54], 0x2887cf2e
mov dword [ebp - 0x1b4], 0xccaea0a9
mov dword [ebp - 0x6f4], 1
mov dword [ebp - 0x54], 1
jmp 0x1000b2d3
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000b6ae
push 3
lea ecx, [ebp - 0x994]
call fcn.1001a32c
mov byte [ebp - 4], 4
mov dword [ebp - 0x230], 0
jmp 0x1000b307
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x1000b329
push dword [ebp - 0x230]
lea ecx, [ebp - 0x994]
call fcn.1001a399
mov dword [eax], 0xf3ccd246
jmp 0x1000b2fa
mov eax, 0xdb8e9646
test eax, eax
je 0x1000b387
push 0
lea ecx, [ebp - 0x994]
call fcn.1001a399
mov eax, dword [eax]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x2b4], eax
jl 0x1000b35e
mov dword [ebp - 0xa58], 1
jmp 0x1000b365
and dword [ebp - 0xa58], 0
push 0
lea ecx, [ebp - 0x994]
call fcn.1001a399
mov eax, 0xb5d1cb6a
test eax, eax
je 0x1000b387
mov dword [ebp - 0x8cc], 1
jmp 0x1000b38e
and dword [ebp - 0x8cc], 0
push 0
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
or dword [eax], 0xffffffff
mov dword [ebp - 0x8d4], 0xffffffff
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x8d4]
add eax, dword [ebp - 0x310]
cmp eax, 0xfffffff7
jbe 0x1000b3d1
mov dword [ebp - 0x8dc], 1
jmp 0x1000b3d8
and dword [ebp - 0x8dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0x8dc], eax
jge 0x1000b3f9
mov dword [ebp - 0x8e4], 1
jmp 0x1000b400
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x1b4], eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
cmp dword [eax], 0
je 0x1000b5ef
mov eax, 0x6658
test eax, eax
je 0x1000b51f
cmp dword [ebp - 0x1b4], 1
ja 0x1000b445
mov dword [ebp - 0x91c], 1
jmp 0x1000b44c
and dword [ebp - 0x91c], 0
push 0
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
mov ecx, dword [ebp - 0x91c]
cmp ecx, dword [eax]
jle 0x1000b46f
mov dword [ebp - 0x924], 1
jmp 0x1000b476
and dword [ebp - 0x924], 0
push 0
lea ecx, [ebp - 0x994]
call fcn.1001a399
mov esi, dword [ebp - 0x924]
sub esi, dword [eax]
sub esi, 0xa
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
sub esi, dword [eax]
jne 0x1000b4b0
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1000b4b0
and dword [ebp - 0xa60], 0
jmp 0x1000b4ba
mov dword [ebp - 0xa60], 1
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x1b4], eax
jl 0x1000b4e2
mov dword [ebp - 0x92c], 1
jmp 0x1000b4e9
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x92c], eax
jne 0x1000b500
mov dword [ebp - 0x934], 1
jmp 0x1000b507
and dword [ebp - 0x934], 0
cmp dword [ebp - 0x934], 0xfea1e173
jbe 0x1000b51f
mov dword [ebp - 0x3d8], 1
jmp 0x1000b526
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0xaaf09d89
ja 0x1000b53e
mov dword [ebp - 0x6dc], 1
jmp 0x1000b545
and dword [ebp - 0x6dc], 0
push 1
lea ecx, [ebp - 0x994]
call fcn.1001a399
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6dc]
jge 0x1000b580
push 2
lea ecx, [ebp - 0x994]
call fcn.1001a399
cmp dword [eax], 0
jne 0x1000b580
mov eax, 0xcc3231a2
test eax, eax
jne 0x1000b580
and dword [ebp - 0x3e0], 0
jmp 0x1000b58a
mov dword [ebp - 0x3e0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
imul eax, dword [ebp - 0x3e0]
test eax, eax
jne 0x1000b5b4
cmp dword [ebp - 0x1b4], 0
jne 0x1000b5b4
and dword [ebp - 0x6e4], 0
jmp 0x1000b5be
mov dword [ebp - 0x6e4], 1
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
mov ecx, dword [ebp - 0x6e4]
cmp ecx, dword [eax]
jl 0x1000b5e2
mov dword [ebp - 0x3e8], 1
jmp 0x1000b5e9
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x54], eax
jg 0x1000b606
mov dword [ebp - 0x6ec], 1
jmp 0x1000b60d
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0xcec], eax
push 4
pop eax
test eax, eax
jne 0x1000b64a
mov eax, 0x781be2fc
test eax, eax
jne 0x1000b64a
and dword [ebp - 0x3f0], 0
jmp 0x1000b654
mov dword [ebp - 0x3f0], 1
cmp dword [ebp - 0x3f0], 0x737e
jle 0x1000b66c
mov dword [ebp - 0x318], 1
jmp 0x1000b673
and dword [ebp - 0x318], 0
push 0
lea ecx, [ebp - 0x3cc]
call fcn.1001a399
mov ecx, dword [ebp - 0x318]
mov dword [eax], ecx
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x6f4]
mov dword [ebp - 0xa68], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x994]
call fcn.1001a394
jmp 0x1000b2cc
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000b6c6
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x1000b279
mov byte [ebp - 0x157], 0
movzx eax, byte [ebp - 0x157]
test eax, eax
je 0x1000b6ee
push 0
push 0
push 0xf57
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3cc]
call fcn.1001a394
mov dword [ebp - 0xaa0], 0x2db5
push 2
lea ecx, [ebp - 0xc80]
call fcn.1001a32c
mov dword [ebp - 4], 5
mov dword [ebp - 0x1e0], 0x632667a8
push 3
lea ecx, [ebp - 0x9d0]
call fcn.1001a32c
mov byte [ebp - 4], 6
mov dword [ebp - 0xcc4], 1
mov dword [ebp - 0xa90], 6
mov dword [ebp - 0xa78], 0xffffffff
mov dword [ebp - 0xcf0], 7
mov dword [ebp - 0xa80], 0xb42b08f1
mov dword [ebp - 0xa88], 0x30fb
mov dword [ebp - 0x238], 0
jmp 0x1000b78b
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000b7ad
push dword [ebp - 0x238]
lea ecx, [ebp - 0x9d0]
call fcn.1001a399
mov dword [eax], 0xdc164f94
jmp 0x1000b77e
cmp dword [ebp - 0x1e0], 1
jbe 0x1000bae5
mov dword [ebp - 0x428], 0xba80
mov dword [ebp - 0xccc], 0xf314
mov dword [ebp - 0x714], 0x3d9c8c74
mov dword [ebp - 0xcf8], 0xffffffff
push 2
lea ecx, [ebp - 0xc68]
call fcn.1001a32c
mov byte [ebp - 4], 7
mov dword [ebp - 0x2bc], 0
jmp 0x1000b80c
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 2
jge 0x1000b82e
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xc68]
call fcn.1001a399
mov dword [eax], 0xe495ee35
jmp 0x1000b7ff
mov dword [ebp - 0x1e0], 0x11
jmp 0x1000b847
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jl 0x1000b987
mov dword [ebp - 0x6fc], 3
mov dword [ebp - 0xa1c], 1
mov dword [ebp - 0x704], 0x7b400765
mov dword [ebp - 0xcd4], 0
push 2
lea ecx, [ebp - 0xd70]
call fcn.1001a32c
mov byte [ebp - 4], 8
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x240], 0
jmp 0x1000b8b0
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1000b8d2
push dword [ebp - 0x240]
lea ecx, [ebp - 0xd70]
call fcn.1001a399
mov dword [eax], 0xfeb4e522
jmp 0x1000b8a3
xor eax, eax
inc eax
je 0x1000b8ec
cmp dword [ebp - 0x428], 0
je 0x1000b8ec
mov dword [ebp - 0x3f8], 1
jmp 0x1000b8f3
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x6fc]
imul eax, dword [ebp - 0x3f8]
imul eax, eax, 0x5eb2
add eax, dword [ebp - 0x6fc]
jne 0x1000b920
cmp dword [ebp - 0xa1c], 0
jne 0x1000b920
and dword [ebp - 0x400], 0
jmp 0x1000b92a
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x400]
sub eax, 0xe9e5
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0xbc795c38
jae 0x1000b953
mov dword [ebp - 0x408], 1
jmp 0x1000b95a
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x70c]
inc eax
mov dword [ebp - 0x70c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd70]
call fcn.1001a394
jmp 0x1000b83a
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x410], eax
push 1
lea ecx, [ebp - 0xc68]
call fcn.1001a399
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
cmp dword [ebp - 0x410], 0
je 0x1000b9c6
cmp dword [ebp - 0xa88], 0
je 0x1000b9c6
mov dword [ebp - 0x418], 1
jmp 0x1000b9cd
and dword [ebp - 0x418], 0
mov dword [ebp - 0x714], 0x709c1800
mov eax, dword [ebp - 0x714]
cmp dword [ebp - 0x418], eax
jl 0x1000b9f1
mov dword [ebp - 0x71c], 1
jmp 0x1000b9f8
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x71c]
jge 0x1000ba12
mov dword [ebp - 0x420], 1
jmp 0x1000ba19
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x420], eax
jg 0x1000ba33
mov dword [ebp - 0x724], 1
jmp 0x1000ba3a
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0x4a91a3d0
jge 0x1000ba52
mov dword [ebp - 0xa98], 1
jmp 0x1000ba59
and dword [ebp - 0xa98], 0
push 2
lea ecx, [ebp - 0x9d0]
call fcn.1001a399
mov esi, eax
push 1
lea ecx, [ebp - 0x9d0]
call fcn.1001a399
mov esi, dword [esi]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x9d0]
call fcn.1001a399
cmp esi, dword [eax]
jl 0x1000ba97
mov dword [ebp - 0x72c], 1
jmp 0x1000ba9e
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x72c], eax
jle 0x1000bab8
mov dword [ebp - 0x430], 1
jmp 0x1000babf
and dword [ebp - 0x430], 0
push 1
lea ecx, [ebp - 0x9d0]
call fcn.1001a399
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc68]
call fcn.1001a394
jmp 0x1000bb0d
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000bb0d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9d0]
call fcn.1001a394
mov dword [ebp - 0x2c4], 0
jmp 0x1000bb35
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x1000bb57
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xc80]
call fcn.1001a399
mov dword [eax], 0x9e57ad95
jmp 0x1000bb28
mov esi, dword [ebp - 0xaa0]
push 0
lea ecx, [ebp - 0xc80]
call fcn.1001a399
mov dword [eax], esi
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1000bb98
push 0x1f66
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.1001a394
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xb98], 0x66bafcb1
mov dword [ebp - 0xb94], 0x66bafcb1
mov dword [ebp - 0xb90], 0x66bafcb1
mov dword [ebp - 0xb8c], 0x66bafcb1
push 1
lea ecx, [ebp - 0xb30]
call fcn.1001a32c
mov dword [ebp - 4], 9
mov dword [ebp - 0x30], 0
jmp 0x1000bbfa
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1000bc10
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xdf8], 0xf3617394
jmp 0x1000bbf3
mov dword [ebp - 0x30], 0
jmp 0x1000bc20
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000bc39
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb30]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000bc19
mov dword [ebp - 0x30], 0
jmp 0x1000bc49
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000bc5f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xe6c], 0
jmp 0x1000bc42
cmp dword [ebp - 0x4c], 0
je 0x1000bc77
cmp dword [ebp - 0x4c], 0
je 0x1000bc77
mov dword [ebp - 0x438], 1
jmp 0x1000bc7e
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jne 0x1000bc92
mov dword [ebp - 0x734], 1
jmp 0x1000bc99
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb98], 0xa0b8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdf8], 0xa0b8
mov eax, dword [ebp - 0x4c]
add eax, 0xa0b8
cmp eax, dword [ebp - 0x734]
jge 0x1000bcd7
mov dword [ebp - 0x390], 1
jmp 0x1000bcde
and dword [ebp - 0x390], 0
push 0
lea ecx, [ebp - 0xb30]
call fcn.1001a399
mov ecx, dword [ebp - 0x390]
mov dword [eax], ecx
mov eax, dword [ebp - 0x390]
add eax, 6
cmp eax, dword [ebp - 0x4c]
jge 0x1000bd0d
mov dword [ebp - 0x73c], 1
jmp 0x1000bd14
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x73c]
jge 0x1000bd2e
mov dword [ebp - 0x440], 1
jmp 0x1000bd35
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 7
jmp 0x1000bd4e
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1000bf6d
mov dword [ebp - 0xc0], 0x2b90f998
mov dword [ebp - 0xc0], 0x18
jmp 0x1000bd7b
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xfffffff9
jle 0x1000be58
push 1
lea ecx, [ebp - 0xb20]
call fcn.1001a32c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x248], 0
jmp 0x1000bdb2
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000bdd4
push dword [ebp - 0x248]
lea ecx, [ebp - 0xb20]
call fcn.1001a399
mov dword [eax], 0x42206dd2
jmp 0x1000bda5
push 0
lea ecx, [ebp - 0xb20]
call fcn.1001a399
mov dword [eax], 0xf
jmp 0x1000be0d
push 0
lea ecx, [ebp - 0xb20]
call fcn.1001a399
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x744]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x744]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb20]
call fcn.1001a399
cmp dword [eax], 0xd
jge 0x1000be44
mov byte [ebp - 0x1a5], 0
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x1000be42
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1000bde9
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb20]
call fcn.1001a394
jmp 0x1000bd6e
cmp dword [ebp - 0xc0], 0
je 0x1000bebb
cmp dword [ebp - 0xc0], 0
je 0x1000beaf
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
je 0x1000be84
mov dword [ebp - 0x448], 1
jmp 0x1000be8b
and dword [ebp - 0x448], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb98]
cmp dword [ebp - 0x448], eax
je 0x1000beaf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb98], 0
je 0x1000bebb
mov dword [ebp - 0x74c], 1
jmp 0x1000bec2
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x74c]
jg 0x1000bedc
mov dword [ebp - 0x450], 1
jmp 0x1000bee3
and dword [ebp - 0x450], 0
push 0
lea ecx, [ebp - 0xb30]
call fcn.1001a399
mov eax, dword [eax]
cmp eax, dword [ebp - 0x450]
jg 0x1000bf06
mov dword [ebp - 0x754], 1
jmp 0x1000bf0d
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x754]
lea eax, [ecx + eax + 0x722d53d0]
cmp eax, 0xbecc33b
jne 0x1000bf30
mov dword [ebp - 0x458], 1
jmp 0x1000bf37
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0
je 0x1000bf4c
mov dword [ebp - 0x75c], 1
jmp 0x1000bf53
and dword [ebp - 0x75c], 0
push 0
lea ecx, [ebp - 0xb30]
call fcn.1001a399
mov ecx, dword [ebp - 0x75c]
mov dword [eax], ecx
jmp 0x1000bd47
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb30]
call fcn.1001a394
mov dword [ebp - 0x124], 2
mov dword [ebp - 0x2cc], 0
jmp 0x1000bf9f
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x1000bfbb
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xdc8], 0xffffffff
jmp 0x1000bf92
mov dword [ebp - 0x124], 1
jmp 0x1000bfd4
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1000c0cb
push 3
lea ecx, [ebp - 0xbe4]
call fcn.1001a32c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x250], 0
jmp 0x1000c018
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000c037
push dword [ebp - 0x250]
lea ecx, [ebp - 0xbe4]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000c00b
push 2
lea ecx, [ebp - 0xbe4]
call fcn.1001a399
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x460]
mov dword [ecx], eax
mov dword [ebp - 0x2d4], 2
jmp 0x1000c074
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x1000c0b7
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1000c097
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1000c0b5
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1000c067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe4]
call fcn.1001a394
jmp 0x1000bfc7
mov dword [ebp - 0x124], 0xe
jmp 0x1000c0e4
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x12
jl 0x1000c113
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1000c111
push 0x16d8
push 0x1993
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1000c0d7
mov dword [ebp - 0x104], 0x5031
mov dword [ebp - 0x1bc], 2
mov dword [ebp - 0x764], 0
mov dword [ebp - 0x98], 0xfdadf860
mov dword [ebp - 0xab0], 0x506ed55c
mov dword [ebp - 0x258], 0
jmp 0x1000c15e
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1000c17a
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xab8], 0xc178
jmp 0x1000c151
mov byte [ebp - 0x1ad], 0
movzx eax, byte [ebp - 0x1ad]
test eax, eax
je 0x1000c196
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x764]
cmp dword [ebp - 0x104], eax
jg 0x1000c1bc
mov dword [ebp - 0x468], 1
jmp 0x1000c1c3
and dword [ebp - 0x468], 0
cmp dword [ebp - 0x468], 0x9c8d
jge 0x1000c1db
mov dword [ebp - 0x76c], 1
jmp 0x1000c1e2
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0xfffffff8
jne 0x1000c1f7
mov dword [ebp - 0x470], 1
jmp 0x1000c1fe
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x470], eax
je 0x1000c218
mov dword [ebp - 0x774], 1
jmp 0x1000c21f
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
neg eax
je 0x1000c23e
mov eax, 0x9b78
test eax, eax
je 0x1000c23e
mov dword [ebp - 0x478], 1
jmp 0x1000c245
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x478], eax
je 0x1000c25f
mov dword [ebp - 0x77c], 1
jmp 0x1000c266
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x77c]
je 0x1000c280
mov dword [ebp - 0x480], 1
jmp 0x1000c287
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jg 0x1000c2a8
mov dword [ebp - 0x784], 1
jmp 0x1000c2af
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x784]
jne 0x1000c2c4
cmp dword [ebp - 0x98], 0
cmp dword [ebp - 0x1bc], 0
je 0x1000c2e2
cmp dword [ebp - 0x98], 0
je 0x1000c2e2
mov dword [ebp - 0x488], 1
jmp 0x1000c2e9
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
add eax, 0x24f63abe
je 0x1000c302
mov dword [ebp - 0x78c], 1
jmp 0x1000c309
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x78c]
je 0x1000c323
mov dword [ebp - 0x490], 1
jmp 0x1000c32a
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
inc eax
inc eax
neg eax
cmp eax, dword [ebp - 0x1bc]
jge 0x1000c348
mov dword [ebp - 0xaa8], 1
jmp 0x1000c34f
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd00], eax
cmp dword [ebp - 0x1bc], 0
jae 0x1000c370
mov dword [ebp - 0x794], 1
jmp 0x1000c377
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0x104]
je 0x1000c39d
cmp dword [ebp - 0xab0], 0
je 0x1000c39d
cmp dword [ebp - 0x1bc], 0
jne 0x1000c3a4
push 9
pop eax
test eax, eax
je 0x1000c3c0
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1000c3be
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000c41c
mov dword [ebp - 0x98], 0
jmp 0x1000c3d9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jg 0x1000c41c
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1000c408
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0xab8], 0
je 0x1000c41a
jmp 0x1000c3cc
jmp 0x1000c3cc
mov dword [ebp - 0x40], 0
mov dword [ebp - 0xba8], 0x66bafcb1
mov dword [ebp - 0xba4], 0x66bafcb1
mov dword [ebp - 0xba0], 0x66bafcb1
mov dword [ebp - 0xb9c], 0x66bafcb1
push 1
lea ecx, [ebp - 0xb50]
call fcn.1001a32c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x28], 0
jmp 0x1000c46f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000c485
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe10], 0xf3617394
jmp 0x1000c468
mov dword [ebp - 0x28], 0
jmp 0x1000c495
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000c4ae
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb50]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000c48e
mov dword [ebp - 0x28], 0
jmp 0x1000c4be
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000c4d4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe9c], 0
jmp 0x1000c4b7
cmp dword [ebp - 0x40], 0
je 0x1000c4ec
cmp dword [ebp - 0x40], 0
je 0x1000c4ec
mov dword [ebp - 0x79c], 1
jmp 0x1000c4f3
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jne 0x1000c507
mov dword [ebp - 0x498], 1
jmp 0x1000c50e
and dword [ebp - 0x498], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xba8], 0xa0b8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe10], 0xa0b8
mov eax, dword [ebp - 0x40]
add eax, 0xa0b8
cmp eax, dword [ebp - 0x498]
jge 0x1000c54c
mov dword [ebp - 0x320], 1
jmp 0x1000c553
and dword [ebp - 0x320], 0
push 0
lea ecx, [ebp - 0xb50]
call fcn.1001a399
mov ecx, dword [ebp - 0x320]
mov dword [eax], ecx
mov eax, dword [ebp - 0x320]
add eax, 6
cmp eax, dword [ebp - 0x40]
jge 0x1000c582
mov dword [ebp - 0x4a0], 1
jmp 0x1000c589
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x79c]
cmp eax, dword [ebp - 0x4a0]
jge 0x1000c5a3
mov dword [ebp - 0x7a4], 1
jmp 0x1000c5aa
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 7
jmp 0x1000c5c3
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1000c7e2
mov dword [ebp - 0xd8], 0x2b90f998
mov dword [ebp - 0xd8], 0x18
jmp 0x1000c5f0
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffff9
jle 0x1000c6cd
push 1
lea ecx, [ebp - 0xb40]
call fcn.1001a32c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2dc], 0
jmp 0x1000c627
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x1000c649
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xb40]
call fcn.1001a399
mov dword [eax], 0x42206dd2
jmp 0x1000c61a
push 0
lea ecx, [ebp - 0xb40]
call fcn.1001a399
mov dword [eax], 0xf
jmp 0x1000c682
push 0
lea ecx, [ebp - 0xb40]
call fcn.1001a399
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb40]
call fcn.1001a399
cmp dword [eax], 0xd
jge 0x1000c6b9
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1000c6b7
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1000c65e
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb40]
call fcn.1001a394
jmp 0x1000c5e3
cmp dword [ebp - 0xd8], 0
je 0x1000c730
cmp dword [ebp - 0xd8], 0
je 0x1000c724
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], eax
je 0x1000c6f9
mov dword [ebp - 0x7ac], 1
jmp 0x1000c700
and dword [ebp - 0x7ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xba8]
cmp dword [ebp - 0x7ac], eax
je 0x1000c724
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xba8], 0
je 0x1000c730
mov dword [ebp - 0x4b0], 1
jmp 0x1000c737
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x4b0]
jg 0x1000c751
mov dword [ebp - 0x7b4], 1
jmp 0x1000c758
and dword [ebp - 0x7b4], 0
push 0
lea ecx, [ebp - 0xb50]
call fcn.1001a399
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7b4]
jg 0x1000c77b
mov dword [ebp - 0x4b8], 1
jmp 0x1000c782
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x4b8]
lea eax, [ecx + eax + 0x722d53d0]
cmp eax, 0xbecc33b
jne 0x1000c7a5
mov dword [ebp - 0x7bc], 1
jmp 0x1000c7ac
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0
je 0x1000c7c1
mov dword [ebp - 0x4c0], 1
jmp 0x1000c7c8
and dword [ebp - 0x4c0], 0
push 0
lea ecx, [ebp - 0xb50]
call fcn.1001a399
mov ecx, dword [ebp - 0x4c0]
mov dword [eax], ecx
jmp 0x1000c5bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb50]
call fcn.1001a394
mov dword [ebp - 0x11c], 2
mov dword [ebp - 0x260], 0
jmp 0x1000c814
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x1000c830
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xdd8], 0xffffffff
jmp 0x1000c807
mov dword [ebp - 0x11c], 1
jmp 0x1000c849
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x1000c940
push 3
lea ecx, [ebp - 0xc5c]
call fcn.1001a32c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x2e4], 0
jmp 0x1000c88d
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x1000c8ac
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xc5c]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000c880
push 2
lea ecx, [ebp - 0xc5c]
call fcn.1001a399
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ecx], eax
mov dword [ebp - 0x268], 2
jmp 0x1000c8e9
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x1000c92c
mov byte [ebp - 0x1a7], 0
movzx eax, byte [ebp - 0x1a7]
test eax, eax
je 0x1000c90c
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1000c92a
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1000c8dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc5c]
call fcn.1001a394
jmp 0x1000c83c
mov dword [ebp - 0x11c], 0xe
jmp 0x1000c959
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x12
jl 0x1000c988
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1000c986
push 0x16d8
push 0x1993
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1000c94c
mov dword [ebp - 0x10c], 0x58d32ffa
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x4d8], 0xfffffffb
mov dword [ebp - 0x7ec], 0x9642e40c
mov dword [ebp - 0xac0], 0xa20b2878
mov dword [ebp - 0x2ec], 0
jmp 0x1000c9d3
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
jge 0x1000c9ef
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xe28], 1
jmp 0x1000c9c6
cmp dword [ebp - 0x10c], 0xe9e84363
jbe 0x1000ca07
mov dword [ebp - 0x4c8], 1
jmp 0x1000ca0e
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 7
jbe 0x1000ca23
mov dword [ebp - 0x7cc], 1
jmp 0x1000ca2a
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x7cc], eax
jge 0x1000ca44
mov dword [ebp - 0x360], 1
jmp 0x1000ca4b
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x360]
mov dword [ebp + eax - 0xe28], ecx
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x360], eax
jge 0x1000ca78
mov dword [ebp - 0x4d0], 1
jmp 0x1000ca7f
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0x14a5
je 0x1000ca97
mov dword [ebp - 0x7d4], 1
jmp 0x1000ca9e
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x4d8], eax
jl 0x1000cac4
mov dword [ebp - 0x7dc], 1
jmp 0x1000cacb
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x7dc]
jle 0x1000cae5
mov dword [ebp - 0x4e0], 1
jmp 0x1000caec
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x4e0]
jle 0x1000cb06
mov dword [ebp - 0x4e8], 1
jmp 0x1000cb0d
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x7e4]
add eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x7ec], eax
je 0x1000cb45
mov dword [ebp - 0x4f0], 1
jmp 0x1000cb4c
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0x12c], 0x5031
mov dword [ebp - 0x1dc], 2
mov dword [ebp - 0x7f4], 0
mov dword [ebp - 0xa0], 0xfdadf860
mov dword [ebp - 0xad0], 0x506ed55c
mov dword [ebp - 0x270], 0
jmp 0x1000cba3
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1000cbbf
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xad8], 0xc178
jmp 0x1000cb96
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1000cbdb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
cmp dword [ebp - 0x12c], eax
jg 0x1000cc01
mov dword [ebp - 0x4f8], 1
jmp 0x1000cc08
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0x9c8d
jge 0x1000cc20
mov dword [ebp - 0x7fc], 1
jmp 0x1000cc27
and dword [ebp - 0x7fc], 0
cmp dword [ebp - 0x7fc], 0xfffffff8
jne 0x1000cc3c
mov dword [ebp - 0x500], 1
jmp 0x1000cc43
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x500], eax
je 0x1000cc5d
mov dword [ebp - 0x804], 1
jmp 0x1000cc64
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
neg eax
je 0x1000cc83
mov eax, 0x9b78
test eax, eax
je 0x1000cc83
mov dword [ebp - 0x508], 1
jmp 0x1000cc8a
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x508], eax
je 0x1000cca4
mov dword [ebp - 0x80c], 1
jmp 0x1000ccab
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x80c]
je 0x1000ccc5
mov dword [ebp - 0x510], 1
jmp 0x1000cccc
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x1000cced
mov dword [ebp - 0x814], 1
jmp 0x1000ccf4
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x814]
jne 0x1000cd09
cmp dword [ebp - 0xa0], 0
cmp dword [ebp - 0x1dc], 0
je 0x1000cd27
cmp dword [ebp - 0xa0], 0
je 0x1000cd27
mov dword [ebp - 0x518], 1
jmp 0x1000cd2e
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
add eax, 0x24f63abe
je 0x1000cd47
mov dword [ebp - 0x81c], 1
jmp 0x1000cd4e
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x81c]
je 0x1000cd68
mov dword [ebp - 0x520], 1
jmp 0x1000cd6f
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
inc eax
inc eax
neg eax
cmp eax, dword [ebp - 0x1dc]
jge 0x1000cd8d
mov dword [ebp - 0xac8], 1
jmp 0x1000cd94
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0x1dc], 0
jae 0x1000cdb5
mov dword [ebp - 0x824], 1
jmp 0x1000cdbc
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x12c]
je 0x1000cde2
cmp dword [ebp - 0xad0], 0
je 0x1000cde2
cmp dword [ebp - 0x1dc], 0
jne 0x1000cde9
push 9
pop eax
test eax, eax
je 0x1000ce05
mov byte [ebp - 0x1ab], 0
movzx eax, byte [ebp - 0x1ab]
test eax, eax
je 0x1000ce03
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000ce61
mov dword [ebp - 0xa0], 0
jmp 0x1000ce1e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x1000ce61
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x1000ce4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0xad8], 0
je 0x1000ce5f
jmp 0x1000ce11
jmp 0x1000ce11
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xb88], 0x66bafcb1
mov dword [ebp - 0xb84], 0x66bafcb1
mov dword [ebp - 0xb80], 0x66bafcb1
mov dword [ebp - 0xb7c], 0x66bafcb1
push 1
lea ecx, [ebp - 0xb70]
call fcn.1001a32c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x38], 0
jmp 0x1000ceb4
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1000ceca
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe40], 0xf3617394
jmp 0x1000cead
mov dword [ebp - 0x38], 0
jmp 0x1000ceda
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000cef3
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb70]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x1000ced3
mov dword [ebp - 0x38], 0
jmp 0x1000cf03
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000cf19
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe90], 0
jmp 0x1000cefc
cmp dword [ebp - 0x44], 0
je 0x1000cf31
cmp dword [ebp - 0x44], 0
je 0x1000cf31
mov dword [ebp - 0x82c], 1
jmp 0x1000cf38
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jne 0x1000cf4c
mov dword [ebp - 0x528], 1
jmp 0x1000cf53
and dword [ebp - 0x528], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb88], 0xa0b8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe40], 0xa0b8
mov eax, dword [ebp - 0x44]
add eax, 0xa0b8
cmp eax, dword [ebp - 0x528]
jge 0x1000cf91
mov dword [ebp - 0x328], 1
jmp 0x1000cf98
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.1001a399
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
mov eax, dword [ebp - 0x328]
add eax, 6
cmp eax, dword [ebp - 0x44]
jge 0x1000cfc7
mov dword [ebp - 0x530], 1
jmp 0x1000cfce
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x530]
jge 0x1000cfe8
mov dword [ebp - 0x834], 1
jmp 0x1000cfef
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 7
jmp 0x1000d008