Function at 0x10015b55
Capabilities:
Check os version
Create thread
Delete registry key
Get common file path
Get disk size
Get graphical window text
Get system information on windows

Disassembly:
mov eax, 0x10063b29
call fcn.10062dd8
sub esp, 0x8d4
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push esi
mov esi, 0x532bb11a
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x24], esi
xor ecx, ecx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x34], 0x8cda2ae7
mov dword [ebp - 0x4c], 0xa29f
mov dword [ebp - 0x34], 8
mov byte [ebp - 0x39], cl
push edi
mov edi, 0xd2f
mov byte [ebp - 0x5d], dl
cmp byte [ebp - 0x39], cl
je 0x10015bac
push edi
call ebx
xor ecx, ecx
push 1
pop edx
cmp dword [ebp - 0x24], ecx
je 0x10015be9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x24]
jne 0x10015bdf
cmp dword [ebp - 0x4c], ecx
je 0x10015be6
xor edx, edx
inc edx
mov eax, edx
jmp 0x10015beb
xor edx, edx
inc edx
mov eax, ecx
add eax, 0xa00d
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x34], 0x8cda2ae7
mov dword [ebp - 0x4c], 0xa29f
mov dword [ebp - 0x34], 8
mov byte [ebp - 0x39], cl
cmp byte [ebp - 0x39], 0
je 0x10015c25
push edi
call ebx
xor edx, edx
inc edx
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
je 0x10015c5a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x24]
jne 0x10015c55
cmp dword [ebp - 0x4c], ebx
je 0x10015c5a
xor eax, eax
inc eax
jmp 0x10015c5c
mov eax, ebx
add eax, 0xa00d
lea ecx, [ebp - 0x490]
imul eax, dword [ebp - 0x4c]
push 2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x28], 7
call fcn.1000e0be
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x28], 0x4f8d36fb
mov dword [ebp - 0x2c], ebx
jmp 0x10015cb3
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x490]
mov dword [eax + ecx*4], 0x76d9935f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10015ca0
mov dword [ebp - 0x2c], 0xc64a6847
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x20], eax
jne 0x10015cf9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x490]
mov dword [eax], ecx
test ecx, ecx
je 0x10015d15
cmp dword [ebp - 0x2c], ebx
je 0x10015d15
xor edx, edx
inc edx
jmp 0x10015d17
mov edx, ebx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add eax, edx
add ecx, eax
xor eax, eax
cmp ecx, 0x5c82f744
setl al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x24]
je 0x10015d49
cmp dword [ebp - 0x34], ebx
je 0x10015d49
xor eax, eax
inc eax
jmp 0x10015d4b
mov eax, ebx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x490]
call fcn.1000ed07
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x24], 0xea75c96
mov dword [ebp - 0x44], 0x6b779c63
mov dword [ebp - 0x44], 0xf9c25b05
push 1
call fcn.1000e0be
push 4
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], ebx
call fcn.1000e0be
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x1c], ebx
jmp 0x10015dac
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c0]
mov dword [eax + ecx*4], 0x6890c544
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015d99
mov dword [ebp - 0x1c], ebx
jmp 0x10015dc9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x550]
mov dword [eax + ecx*4], 0x70ab227d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10015db6
push 5
mov dword [ebp - 0x24], ebx
pop edi
jmp 0x10016136
mov dword [ebp - 0x20], 0x108f8256
mov dword [ebp - 0x20], ebx
jmp 0x10015df8
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10015df5
call dword [sym.imp.KERNEL32.dll_GetACP]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jg 0x10015de6
mov dword [ebp - 0x20], 6
cmp dword [ebp - 0x20], edi
jge 0x10016133
push 2
lea ecx, [ebp - 0x66c]
call fcn.1000e0be
push 2
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 2
call fcn.1000e0be
push 3
pop ecx
push 2
mov byte [ebp - 4], cl
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x10015e4d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x66c]
mov dword [eax + ecx*4], 0xac488899
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015e3a
mov dword [ebp - 0x1c], ebx
jmp 0x10015e6a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3a0]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015e57
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10015e7f
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov ebx, dword [ebp - 0x3a0]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 4], 1
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10015eb1
push eax
push 0x8b4
push 0x1fb3
push 0x50f
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x28], 0x25a5
cmp dword [ebp - 0x28], 0x655
jge 0x100160e6
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x100077a8
call fcn.1004a93b
add esp, 0x10
lea eax, [ebp - 0x254]
xor ebx, ebx
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x198], ebx
push eax
push dword [ebp - 0xa8]
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
call fcn.1000eeba
mov byte [ebp - 4], 4
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
call fcn.1002228f
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 6
call fcn.1000ed07
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xa8]
test ecx, ecx
jle 0x10015f94
mov edi, dword [ebp - 0x168]
xor esi, esi
test eax, eax
jle 0x10015f8c
mov eax, dword [edi]
lea eax, [eax + esi*4]
push eax
push 0x10007748
call fcn.1004a93b
mov eax, dword [ebp - 0xa8]
inc esi
pop ecx
pop ecx
cmp esi, eax
jl 0x10015f6c
mov ecx, dword [ebp - 0x7c]
inc ebx
add edi, 0xc
cmp ebx, ecx
jl 0x10015f66
xor edx, edx
mov dword [ebp - 0x10], edx
mov edi, edx
mov dword [ebp - 0x30], edi
mov ebx, edx
mov esi, edx
test eax, eax
jle 0x100160c1
mov dword [ebp - 0x234], edx
lea eax, [ebp - 0x234]
push eax
push ecx
lea ecx, [ebp - 0x598]
call fcn.1000e4c7
mov ecx, dword [ebp - 0x168]
mov edi, dword [ebp - 0x598]
mov eax, dword [ecx]
mov eax, dword [eax + esi*4]
mov dword [edi], eax
xor eax, eax
mov edx, dword [ebp - 0x7c]
inc eax
mov ebx, eax
cmp edx, eax
jle 0x1001600b
lea eax, [ecx + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
mov ecx, dword [edi + ebx*4 - 4]
add ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0x28]
mov dword [edi + ebx*4], ecx
add eax, 0xc
mov edx, dword [ebp - 0x7c]
inc ebx
mov dword [ebp - 0x28], eax
cmp ebx, edx
jl 0x10015fe8
mov ecx, dword [ebp - 0x168]
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov eax, ebx
mov dword [ebp - 0x58], eax
test edx, edx
jle 0x10016094
mov edx, dword [ebp - 0x130]
mov eax, ecx
dec edx
mov dword [ebp - 0x50], eax
lea ecx, [edi - 4]
mov dword [ebp - 0x34], ecx
lea edx, [edi + edx*4]
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0x7c]
mov eax, dword [eax]
cmp dword [eax + esi*4], 0
je 0x10016079
test ebx, ebx
jle 0x10016047
mov eax, dword [ecx]
mov dword [ebp - 0x28], eax
jmp 0x1001604b
and dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x130]
lea eax, [edx - 1]
dec ecx
add ecx, ebx
cmp ecx, eax
jg 0x10016062
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
jmp 0x10016066
mov eax, dword [edi + edx*4 - 4]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
cmp eax, dword [ebp - 0x58]
jle 0x10016076
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
inc ebx
add dword [ebp - 0x4c], 4
add eax, 0xc
add ecx, 4
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x34], ecx
cmp ebx, edx
jl 0x10016034
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x598]
mov edi, dword [ebp - 0x30]
add ebx, eax
add edi, dword [ebp - 0x38]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x30], edi
call fcn.1000ed07
inc esi
cmp esi, dword [ebp - 0xa8]
jge 0x100160c1
mov ecx, dword [ebp - 0x7c]
jmp 0x10015fb0
push edi
push ebx
push 0x10007a10
call fcn.1004ace5
add esp, 0xc
lea ecx, [ebp - 0x168]
push 3
pop eax
mov byte [ebp - 4], al
call fcn.1000ef61
mov ebx, dword [ebp - 0x1c]
xor eax, eax
cmp byte [ebp - 0x39], 0
je 0x100160fe
push 0x1512
push eax
push 0x2472
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
dec dword [ebx + 4]
jns 0x10015e8f
lea ecx, [ebp - 0x3a0]
call fcn.1000ed07
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 1
call fcn.1000ed07
dec dword [ebp - 0x20]
push 5
pop edi
push 0
pop ebx
cmp dword [ebp - 0x20], edi
jl 0x10015e0e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x10015dda
mov eax, dword [ebp - 0x550]
lea ecx, [ebp - 0x550]
dec dword [eax + 8]
call fcn.1000ed07
or esi, 0xffffffff
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 4], esi
call fcn.1000ed07
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x44], 0xf0ea75c9
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1001618a
push 0x1cfc
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1001619e
push 0xb8b
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [ebp - 0x34], 0x8cda2ae7
mov dword [ebp - 0x20], 0x462d5e48
mov dword [ebp - 0x20], ebx
jmp 0x100161cd
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x100161ca
push 0xb92
push 0x621
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
je 0x100161b1
mov dword [ebp - 0x20], ebx
jmp 0x100161e7
mov dword [ebp - 0x28], 0x5b40194d
cmp dword [ebp - 0x28], ebx
jne 0x100161ec
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
je 0x100161d8
mov dword [ebp - 0x4c], 0xa29f
xor edx, edx
mov dword [ebp - 0x20], 7
inc edx
mov dword [ebp - 0x30], 0x3191b495
push 8
mov dword [ebp - 0x28], 0xde2e510b
pop edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x24], ebx
jmp 0x10016220
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10016216
mov eax, dword [ebp - 0x74]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x74]
setl cl
add eax, ecx
je 0x1001623d
mov eax, edx
cmp dword [ebp - 0x74], ebx
jne 0x1001623f
mov eax, ebx
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
cmp eax, edx
mov eax, dword [ebp - 0x74]
setle cl
add eax, ecx
jne 0x1001625d
mov ecx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001625f
mov ecx, edx
mov eax, dword [ebp - 0x74]
sub ecx, eax
jne 0x10016269
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], ebx
jmp 0x100163e1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0x9d0e131a
mov dword [ebp - 0x20], ebx
jmp 0x100163d4
mov dword [ebp - 0x18], 0x181f51b4
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 0x28], 0x315eac84
mov dword [ebp - 0x10], 0x5c87e177
mov dword [ebp - 0x28], 0xfad6770d
push 2
call fcn.1000e0be
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x100162c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24c], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100162b7
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
jge 0x100162f2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3b8]
mov dword [eax + ecx*4], 0xc164d14
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100162d6
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], ebx
je 0x10016304
mov eax, ecx
cmp dword [ebp - 0x24], ebx
jne 0x10016306
mov eax, ebx
cmp eax, dword [ebp - 0x24]
jne 0x10016312
mov edx, ecx
cmp dword [ebp - 0x74], ebx
jne 0x10016314
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, 1
setge cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jg 0x1001636e
cmp dword [ebp - 0x10], ebx
jne 0x1001636e
mov eax, ebx
jmp 0x10016371
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], 0xfa7dc071
mov eax, dword [ebp - 0x28]
sub eax, 7
imul eax, dword [ebp - 0x18]
cmp eax, esi
setle cl
sub ecx, 0xdbdc
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3b8]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 1
sbb ecx, ecx
add ecx, 0xa7bf6b89
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x3b8]
call fcn.1000ed07
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
jle 0x10016286
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
je 0x10016274
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x18], ebx
push 2
call fcn.1000e0be
push 3
pop eax
push eax
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 4], 7
call fcn.1000e0be
mov dword [ebp - 0x18], ebx
jmp 0x1001642c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3d0]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10016419
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x10016447
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001643a
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10016467
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4a8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016454
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1001648b
push ebx
push 0x8b4
push 0x1fb3
push 0x50f
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffa
jge 0x10016547
mov esi, dword [ebp - 0x3d0]
mov edi, dword [ebp - 0x4a8]
mov dword [ebp - 0x24], 0xc9d5fac1
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
cmp ebx, 0x687f
mov dword [ebp - 0x240], ebx
sete cl
xor eax, eax
cmp ecx, 0xbac0
setg al
mov dword [edi + 4], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jl 0x100164a4
push 8
xor ebx, ebx
or esi, 0xffffffff
pop edi
lea ecx, [ebp - 0x4a8]
call fcn.1000ed07
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], esi
call fcn.1000ed07
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], esi
push 3
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x9744
mov dword [ebp - 0x58], 0x65f5c9b8
mov dword [ebp - 0x24], ebx
jmp 0x10016590
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x788], 0x764c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1001657f
cmp dword [ebp - 0x10], ebx
je 0x100165e9
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xb30498d2
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x50f6
mov eax, dword [ebp - 0x780]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 9
imul eax, ecx, 7
test eax, eax
je 0x100165e9
xor eax, eax
inc eax
jmp 0x100165eb
mov eax, ebx
mov ecx, dword [ebp - 0x34]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
sub ecx, dword [ebp - 0x10]
jne 0x1001661e
cmp dword [ebp - 0x20], ebx
jne 0x1001661e
mov edx, ebx
jmp 0x10016621
xor edx, edx
inc edx
mov eax, dword [ebp - 0x780]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 3
sete cl
sub eax, ecx
neg eax
pop ecx
sbb eax, eax
add eax, 2
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x24], ebx
jmp 0x10016655
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a8], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10016648
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1001666f
push ebx
push 0x1f43
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0x1a4], 0xffffffe3
jmp 0x100166cb
mov dword [ebp - 0x20], 0xd925b0e4
mov dword [ebp - 0x20], 0xfffffff4
jmp 0x100166bf
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0xfffffff6
jmp 0x100166b6
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x100166b3
push ebx
push ebx
push 0x139b
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jg 0x1001669b
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffeb
jne 0x1001668b
inc dword [ebp - 0x1a4]
cmp dword [ebp - 0x1a4], 9
jne 0x1001667b
cmp byte [ebp - 0x11], 0
je 0x100166e5
push 0xd2f
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x44], 0x10e1
mov dword [ebp - 0x44], 1
push 4
call fcn.1000e0be
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0xc23782ec
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x28], 0x7106cf36
mov dword [ebp - 0x24], ebx
jmp 0x10016732
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x630]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10016723
mov dword [ebp - 0x20], 0xfffffffc
cmp dword [ebp - 0x20], 0xfffffff2
jne 0x10016782
push 3
pop eax
mov dword [ebp - 0x24], 0xfda0e60f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x13
jl 0x10016779
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001676d
push ebx
push 0x1b9f
call dword [sym.imp.GDI32.dll_GetClipBox]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
jge 0x10016758
push 3
pop eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
je 0x10016748
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x630]
call fcn.1000ed07
cmp dword [ebp - 0x2c], ebx
je 0x100167c7
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x2c]
jne 0x100167c2
cmp dword [ebp - 0x4c], ebx
je 0x100167c7
xor eax, eax
inc eax
jmp 0x100167c9
mov eax, ebx
add eax, 0xa00d
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x2685
cmp dword [ebp - 0x28], 0x58f
jge 0x10016955
lea eax, [ebp - 0x70]
push eax
push 0x10007788
call fcn.1004a93b
pop ecx
pop ecx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x714]
call fcn.1000e0be
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], edi
call fcn.1000e26d
xor ecx, ecx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x70]
inc ecx
mov esi, ecx
cmp eax, ecx
jl 0x1001684c
lea eax, [ebp - 0x204]
mov dword [ebp - 0x204], esi
push eax
lea eax, [ebp - 0x868]
push eax
lea ecx, [ebp - 0xf4]
call fcn.10021ce7
mov eax, dword [ebp - 0x70]
inc esi
cmp esi, eax
jle 0x10016825
mov edi, ebx
mov ebx, dword [ebp - 0x714]
test eax, eax
jle 0x1001688c
mov esi, ebx
push esi
push 0x1000774c
call fcn.1004a93b
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0xf4]
call fcn.10021d99
test eax, eax
je 0x10016883
push esi
lea ecx, [ebp - 0xf4]
call fcn.10021d05
inc edi
add esi, 4
cmp edi, dword [ebp - 0x70]
jl 0x1001685a
lea ecx, [ebp - 0x25c]
call fcn.1000e26d
mov byte [ebp - 4], 0xa
xor edi, edi
mov eax, dword [ebp - 0x70]
test eax, eax
jle 0x10016906
mov esi, ebx
push esi
lea ecx, [ebp - 0x25c]
call fcn.10021d99
test eax, eax
jne 0x100168d6
mov eax, dword [esi]
test eax, eax
jle 0x100168d6
cmp eax, dword [ebp - 0x70]
jg 0x100168d6
push esi
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x25c]
call fcn.10021ce7
jmp 0x100168fb
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x248], eax
mov dword [esi], eax
lea eax, [ebp - 0x248]
push eax
call fcn.10021d05
mov eax, dword [ebp - 0x70]
inc edi
add esi, 4
cmp edi, eax
jl 0x100168a6
xor esi, esi
test eax, eax
jle 0x10016921
push dword [ebx + esi*4]
push 0x10007a1c
call fcn.1004ace5
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x70]
jl 0x1001690c
push 0x100076b5
call fcn.1004b3f4
pop ecx
lea ecx, [ebp - 0x25c]
call fcn.1001c64e
lea ecx, [ebp - 0xf4]
call fcn.1001c64e
or esi, 0xffffffff
lea ecx, [ebp - 0x714]
mov dword [ebp - 4], esi
call fcn.1000ed07
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x24], 1
push 2
call fcn.1000e0be
mov dword [ebp - 0x1c], ebx
jmp 0x10016984
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x27c]
mov dword [eax + ecx*4], 0xfda0e60f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10016971
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1001699f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x718], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016992
mov eax, dword [ebp - 0x20]
mov edx, 0xfffa
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x10016a53
mov dword [ebp - 0x10], 0x4e797535
mov dword [ebp - 0x20], ebx
jmp 0x10016a42
push 3
mov dword [ebp - 0x2c], ebx
pop ecx
jmp 0x100169e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7c4], 0xe74e8003
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100169cf
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x27c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax + esi*4], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x27c]
mov edx, 0xfffa
setge cl
sub ecx, dword [eax + edi*4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 6
setg al
xor ecx, ecx
mov dword [ebp - 0x7bc], eax
inc dword [ebp - 0x20]
inc ecx
cmp dword [ebp - 0x20], ecx
jle 0x100169c7
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x24]
jns 0x100169bb
lea ecx, [ebp - 0x27c]
call fcn.1000ed07
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x24], 1
push 2
call fcn.1000e0be
mov dword [ebp - 0x1c], ebx
jmp 0x10016a8d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x300]
mov dword [eax + ecx*4], 0xfda0e60f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10016a7a
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10016aac
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d8], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016a9b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x10016b5b
mov dword [ebp - 0x10], 0x4e797535
mov dword [ebp - 0x20], ebx
jmp 0x10016b4a
push 3
mov dword [ebp - 0x2c], ebx
pop ecx
jmp 0x10016ae8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7f4], 0xe74e8003
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10016ad7
mov esi, dword [ebp - 0x20]
mov ecx, 0xfffa
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x300]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax + esi*4], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x300]
setge cl
sub ecx, dword [eax + edi*4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 6
setg al
xor ecx, ecx
mov dword [ebp - 0x7ec], eax
inc dword [ebp - 0x20]
inc ecx
cmp dword [ebp - 0x20], ecx
jle 0x10016acf
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x24]
jns 0x10016ac3
lea ecx, [ebp - 0x300]
call fcn.1000ed07
push 3
mov esi, 0x606de713
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x24], esi
mov edi, 0x2fe81720
mov dword [ebp - 0x20], 1
pop eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 8
push eax
call fcn.1000e0be
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10016baf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xac], 0x35568345
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016b9e
push 3
mov dword [ebp - 0x1c], ebx
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10016bda
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x520]
mov dword [eax + ecx*4], 0x260e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10016bbf
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jg 0x10016c16
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10016c0e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10016c03
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10016bf5
xor ecx, ecx
inc ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10016bea
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xac]
cmp eax, 1
mov eax, dword [ebp - 0xac]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
inc dword [ebp - 0x38]
cmp eax, edx
jge 0x10016c5d
xor eax, eax
inc eax
jmp 0x10016c5f
xor eax, eax
cmp eax, dword [ebp - 0x34]
jg 0x10016c67
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x20]
add ecx, 9
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x24]
cmp edx, 0x2138
jne 0x10016ca5
cmp dword [ebp - 0xac], 0
je 0x10016ca5
xor edx, edx
inc edx
jmp 0x10016ca7
xor edx, edx
mov eax, dword [ebp - 0x520]
xor ecx, ecx
cmp edx, dword [eax + 4]
sete cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x520]
call fcn.1000ed07
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x3e8]
push 3
mov dword [ebp - 0x20], 1
pop eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 8
push eax
call fcn.1000e0be
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x1c], edx
inc ecx
jmp 0x10016d08
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], 0x35568345
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016cf7
push 3
mov dword [ebp - 0x1c], edx
pop eax
cmp dword [ebp - 0x1c], eax
jge 0x10016d36
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3e8]
push 3
mov dword [eax + ecx*4], 0x260e
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10016d18
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], edx
jmp 0x10016d62
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], edx
jg 0x10016d5f
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x10016d54
push edx
call ebx
xor edx, edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x10016d46
xor ecx, ecx
inc ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10016d3b
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x10], ecx
inc ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0xa0]
cmp eax, ebx
mov eax, dword [ebp - 0xa0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
inc dword [ebp - 0x38]
cmp eax, edx
jge 0x10016dad
mov eax, ebx
xor ebx, ebx
cmp eax, dword [ebp - 0x34]
jg 0x10016db7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x20]
add ecx, 9
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x24]
cmp edx, 0x2138
jne 0x10016df4
cmp dword [ebp - 0xa0], ebx
je 0x10016df4
xor edx, edx
inc edx
jmp 0x10016df6
mov edx, ebx
mov eax, dword [ebp - 0x3e8]
xor ecx, ecx
cmp edx, dword [eax + 4]
sete cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x3e8]
call fcn.1000ed07
mov dword [ebp - 0x10], 0xab1943c6
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xc14ab653
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xba6aed1d
mov dword [ebp - 0x1c], ebx
jmp 0x10016e46
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0x8c66f5a9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016e35
push 3
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x10016e64
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x818], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10016e53
mov ecx, dword [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push 2
setge dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x10]
cmp eax, 0xfa3dfad5
mov eax, dword [ebp - 0xb4]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, 0xe6f7fbf2
setle cl
imul ecx, ecx, 0x1c94
sub ecx, 0x2717f403
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x10]
cmp eax, 0xfff9
mov eax, dword [ebp - 0xb4]
setne cl
sub eax, ecx
lea ecx, [ebp - 0x2b8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 1
call fcn.1000e0be
push 2
lea ecx, [ebp - 0x648]
mov dword [ebp - 4], 0xb
call fcn.1000e0be
mov dword [ebp - 0x20], 0xf1febaee
mov dword [ebp - 0x2c], ebx
jmp 0x10016f31