Function at 0x1000a4d8
Capabilities:
Check os version
Connect pipe
Extract resource via kernel32 functions
Get file system object information
Suspend thread

Disassembly:
mov eax, 0x1007606e
call fcn.100757f4
mov eax, 0x1e5c
call fcn.100716d0
push ebx
mov dword [ebp - 0x1c], 0xa32b1cec
xor ebx, ebx
mov dword [ebp - 0x84], ecx
xor ecx, ecx
mov dword [ebp - 0x48], 0x64f16efa
inc ecx
push esi
mov dword [ebp - 0x2c], 0xbf9cc53a
push edi
mov byte [ebp - 0x75], dl
mov dword [ebp - 0x18], ebx
jmp 0x1000a525
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0x841b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000a517
mov dword [ebp - 0x1c], ebx
mov edx, 0xffff
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x1c], ebx
jg 0x1000a7fb
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xeb6b9dd9
mov dword [ebp - 0x20], 0x1516ea3d
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000a798
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0x2132
cmp dword [ebp - 0x2c], 0xf2c
jge 0x1000a71b
lea eax, [ebp - 0xc0]
push eax
push 0x100081dc
call fcn.1005d64b
mov eax, dword [ebp - 0xc0]
pop ecx
pop ecx
test eax, eax
je 0x1000a70f
dec eax
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x100081e0
call fcn.1005d64b
mov ecx, dword [ebp - 0xb4]
add esp, 0xc
mov eax, dword [ebp - 0xd8]
dec ecx
add eax, ecx
lea ecx, [ebp - 0x96c]
push eax
call fcn.1001ae5e
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xb4]
dec ecx
add eax, ecx
lea ecx, [ebp - 0x908]
push eax
call fcn.1001ae5e
mov ecx, dword [ebp - 0xd8]
mov edi, ebx
mov ebx, dword [ebp - 0x96c]
mov esi, dword [ebp - 0x908]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x4c], esi
test ecx, ecx
jle 0x1000a68c
mov edx, esi
mov dword [ebp - 0x38], edx
and dword [ebp - 0x44], 0
test eax, eax
jle 0x1000a67e
sub ebx, esi
mov edi, edx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x17c]
push eax
push 0x100081d8
call fcn.1005d64b
mov eax, dword [ebp - 0x17c]
add dword [ebx + edi], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x17c]
add dword [edi], eax
inc esi
pop ecx
pop ecx
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0xb4]
cmp esi, eax
jl 0x1000a632
mov ecx, dword [ebp - 0xd8]
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
inc edi
add edx, 4
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], edx
cmp edi, ecx
jl 0x1000a620
and dword [ebp - 0x38], 0
lea edi, [ecx + eax]
push 2
pop eax
cmp edi, eax
jle 0x1000a6d2
lea edx, [edi - 2]
mov dword [ebp - 0x40], eax
lea edx, [esi + edx*4]
sub ebx, esi
mov ecx, dword [edx + ebx]
add ecx, dword [esi + ebx]
mov eax, dword [esi]
add eax, dword [edx]
cmp ecx, eax
push 4
cmovl eax, ecx
mov ecx, dword [ebp - 0x38]
add ecx, eax
pop eax
sub edx, eax
mov dword [ebp - 0x38], ecx
add esi, eax
mov eax, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x40], eax
cmp eax, edi
jl 0x1000a6a5
jmp 0x1000a6d5
mov ecx, dword [ebp - 0x38]
push ecx
push 0x100081e8
call fcn.1005dc93
pop ecx
pop ecx
lea ecx, [ebp - 0x908]
call fcn.1001b9e4
or esi, 0xffffffff
lea ecx, [ebp - 0x96c]
mov dword [ebp - 4], esi
call fcn.1001b9e4
mov eax, dword [ebp - 0xc0]
push 0
pop ebx
test eax, eax
jne 0x1000a596
dec eax
mov edx, 0xffff
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1000a78c
mov dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0xfffffff6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x74]
sub ecx, dword [ebp - 0x2c]
cmp edx, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0x30]
je 0x1000a772
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], ecx
dec dword [ebp - 0x18]
jns 0x1000a723
dec dword [ebp - 0x14]
jns 0x1000a55b
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x74], ebx
je 0x1000a7b7
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000a7e7
push 0x7c6
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000a7e7
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x20], ebx
jne 0x1000a7d7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x18], ecx
jb 0x1000a7d7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0xe99fd40f
inc dword [ebp - 0x1c]
mov edx, 0xffff
push 1
pop ecx
cmp dword [ebp - 0x1c], ebx
jle 0x1000a53e
mov dword [ebp - 0x1c], 0xa32b1cec
mov dword [ebp - 0x28], 0x64f16efa
mov dword [ebp - 0x2c], 0xbf9cc53a
mov dword [ebp - 0x18], ebx
jmp 0x1000a823
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], 0x841b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000a815
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1000ab9a
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x26fd
cmp dword [ebp - 0x2c], 0x900
jge 0x1000a9d3
lea eax, [ebp - 0x9c]
push eax
push ecx
lea eax, [ebp - 0xa8]
push eax
push ecx
lea eax, [ebp - 0x170]
mov ecx, 0x10666be8
push eax
call fcn.1001a5ec
pop ecx
mov ecx, eax
call fcn.1001a5ec
pop ecx
mov ecx, eax
call fcn.1001a5ec
mov ecx, dword [ebp - 0x9c]
mov eax, ecx
imul eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x170]
jge 0x1000a8b3
push 0x100081f0
call fcn.1005dee6
pop ecx
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2bc], ebx
push eax
push ecx
lea ecx, [ebp - 0xa54]
call fcn.1001ae9a
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x87c]
push eax
push dword [ebp - 0xa8]
call fcn.1001b031
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 3
call fcn.1001b9e4
mov eax, dword [ebp - 0xa8]
mov esi, ebx
mov edi, dword [ebp - 0x87c]
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x2c], edi
test eax, eax
jle 0x1000a96b
xor edx, edx
test ecx, ecx
jle 0x1000a960
inc esi
cmp esi, dword [ebp - 0x170]
jg 0x1000a95a
mov eax, ecx
and eax, 0x80000001
jns 0x1000a92b
dec eax
or eax, 0xfffffffe
inc eax
jne 0x1000a94a
mov eax, ebx
and eax, 0x80000001
jns 0x1000a93b
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000a94a
mov eax, dword [edi]
sub ecx, edx
mov dword [eax + ecx*4 - 4], esi
jmp 0x1000a94f
mov eax, dword [edi]
mov dword [eax + edx*4], esi
mov ecx, dword [ebp - 0x9c]
inc edx
cmp edx, ecx
jl 0x1000a914
mov eax, dword [ebp - 0xa8]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x1000a90e
mov edi, dword [ebp - 0x2c]
xor edx, edx
mov ebx, edx
test eax, eax
jle 0x1000a9c0
mov esi, edx
test ecx, ecx
jle 0x1000a99d
mov eax, dword [edi]
mov ecx, 0x10666b38
push dword [eax + esi*4]
call fcn.1001a9e3
mov edx, 0x100081f4
mov ecx, eax
call fcn.1001f59f
inc esi
cmp esi, dword [ebp - 0x9c]
jl 0x1000a979
push 0x10666b38
call fcn.1001f776
pop ecx
push 0xc
pop eax
inc ebx
add edi, eax
cmp ebx, dword [ebp - 0xa8]
jge 0x1000a9c0
mov ecx, dword [ebp - 0x9c]
xor edx, edx
jmp 0x1000a973
or esi, 0xffffffff
lea ecx, [ebp - 0x87c]
mov dword [ebp - 4], esi
call fcn.1001bb27
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xeb6b9dd9
mov dword [ebp - 0x20], 0x1516ea3d
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000ab3c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0x199c
cmp dword [ebp - 0x2c], 0x1077
jge 0x1000aab7
push 0x10c76f48
push ecx
push 0x106c96f8
mov ecx, 0x10666be8
call fcn.1001a701
pop ecx
mov ecx, eax
call fcn.1001a701
xorps xmm0, xmm0
mov esi, 0xa7640000
movlpd qword [ebp - 0x58], xmm0
mov edi, 0xde0b6b3
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
mov ecx, esi
add ecx, eax
mov eax, edi
push 0
push 2
adc eax, ebx
push eax
push ecx
call fcn.10075820
mov ecx, edx
mov dword [ebp - 0x48], eax
push ecx
push eax
mov dword [ebp - 0x40], ecx
call section..iisgpr
or eax, edx
pop ecx
pop ecx
je 0x1000aa82
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov edx, dword [ebp - 0x40]
inc ebx
mov dword [ebp - 0x34], eax
add eax, ebx
mov ebx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], eax
adc ebx, 0
jmp 0x1000aa96
mov esi, dword [ebp - 0x48]
xor eax, eax
mov edi, dword [ebp - 0x40]
inc eax
mov edx, dword [ebp - 0x30]
sub esi, eax
mov eax, dword [ebp - 0x38]
sbb edi, 0
cmp ebx, edi
jl 0x1000aa3f
jg 0x1000aaa0
cmp eax, esi
jbe 0x1000aa3f
push edx
push dword [ebp - 0x34]
mov ecx, 0x10666b38
call fcn.1001aaf5
push eax
call fcn.1001f776
pop ecx
xor ebx, ebx
inc dword [ebp - 0x28]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1000ab30
mov dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0xfffffff6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x70]
mov eax, 0xffff
sub ecx, dword [ebp - 0x2c]
cmp eax, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0x24]
je 0x1000ab16
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70], ecx
dec dword [ebp - 0x18]
jns 0x1000aac2
dec dword [ebp - 0x14]
jns 0x1000a9f0
or esi, 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x70], ebx
je 0x1000ab5b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000ab8e
push 0x7c6
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000ab8e
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x20], ebx
jne 0x1000ab7e
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x70]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jb 0x1000ab7e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0xe99fd40f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000a846
push 5
pop edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x54], 0x3580d416
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x1a
jmp 0x1000ac17
push 2
lea ecx, [ebp - 0x8ac]
call fcn.1001ae5e
xor edx, edx
push 0xfffffffffffffff6
pop eax
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000abec
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8ac]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000abdd
mov dword [ebp - 0x18], ebx
jmp 0x1000ac04
mov dword [ebp - 0x48], 0x223fa3a9
dec dword [ebp - 0x48]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1000abf7
lea ecx, [ebp - 0x8ac]
call fcn.1001b9e4
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jle 0x1000abb6
push 3
lea ecx, [ebp - 0x524]
call fcn.1001ae5e
push 4
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x710]
xor eax, eax
inc eax
push eax
call fcn.1001ae5e
mov dword [ebp - 0x1c], 0xa284868f
mov dword [ebp - 0x28], 0x4a938f73
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000ac64
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x524]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000ac55
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000ac85
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x710]
mov dword [eax + ecx*4], 0xbdae4f9d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000ac72
mov edi, dword [ebp - 0x524]
xor edx, edx
mov ecx, dword [edi + 8]
mov esi, dword [edi + 4]
lea eax, [ecx + esi]
cmp eax, esi
setg dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
cmp edx, dword [edi]
je 0x1000acb5
cmp dword [edi], 0
je 0x1000acb5
xor eax, eax
inc eax
jmp 0x1000acb7
mov eax, ebx
neg eax
sbb ecx, ecx
mov eax, dword [ebp - 0x710]
add ecx, 0xffff4c63
xor edx, edx
cmp ecx, 0x3d9
mov dword [eax], ecx
setge dl
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
or esi, 0xffffffff
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x9561
setg cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1000ad50
mov eax, dword [ebp - 0x1c]
cmp dword [edi + 4], ecx
jne 0x1000ad11
mov dword [ebp - 0x48], esi
dec dword [ebp - 0x48]
jmp 0x1000ad2c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000ad2c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x28], ebx
jmp 0x1000ad44
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000ad41
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1000ad31
inc dword [ebp - 0x1c]
push 1
pop ecx
cmp dword [ebp - 0x1c], ebx
jle 0x1000ad01
lea ecx, [ebp - 0x710]
call fcn.1001b9e4
lea ecx, [ebp - 0x524]
mov dword [ebp - 4], esi
call fcn.1001b9e4
xor eax, eax
lea ecx, [ebp - 0x254]
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xfffffff6
push eax
call fcn.1001ae5e
mov dword [ebp - 0x18], 0xbe360de5
xor edx, edx
mov dword [ebp - 0x2c], 0x8dad4f6c
inc edx
mov dword [ebp - 0x24], ebx
jmp 0x1000adb0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000ad9d
mov dword [ebp - 0x24], ebx
jmp 0x1000adcb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x35c], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000adba
mov dword [ebp - 0x24], ebx
jmp 0x1000ade6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa84], 0x447d0519
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000add5
cmp dword [ebp - 0x14], ebx
jne 0x1000ae0a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x254]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, 0xc7d24b5e
setne dl
inc edx
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], ebx
je 0x1000ae3d
cmp dword [ebp - 0x28], ebx
je 0x1000ae3d
xor edi, edi
inc edi
mov esi, edi
jmp 0x1000ae42
xor edi, edi
mov esi, ebx
inc edi
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x254]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setg dl
add eax, edx
jne 0x1000ae60
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1000ae62
mov ecx, edi
mov eax, dword [ebp - 0x254]
mov edx, dword [eax]
xor eax, eax
cmp esi, ecx
setg al
imul eax, edx
test eax, eax
jne 0x1000ae7e
mov eax, ebx
test edx, edx
je 0x1000ae80
mov eax, edi
mov ecx, dword [ebp - 0x28]
imul ecx, eax
mov eax, dword [ebp - 0x254]
cmp ecx, 0xfffffff8
mov dword [eax], ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x3395
setge cl
shl ecx, 2
cmp ecx, 0x8d58945c
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x6ad982fc
setle dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
cmp edx, 0xc114
mov dword [ebp - 0x35c], edx
mov eax, dword [ebp - 0xa80]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x254]
call fcn.1001b9e4
push 4
mov dword [ebp - 0x24], 0xa32b1cec
lea ecx, [ebp - 0x53c]
pop eax
mov dword [ebp - 0x28], 0x1247adf1
or esi, 0xffffffff
mov dword [ebp - 0x20], 0x2e77e815
mov dword [ebp - 0x18], esi
push eax
call fcn.1001ae5e
mov dword [ebp - 4], 5
push 4
mov dword [ebp - 0x14], 0x3fa3c9e4
mov dword [ebp - 0x30], ebx
pop edx
jmp 0x1000af5d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x53c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x1000af4a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], 9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, 0x16
neg eax
sbb eax, eax
add eax, 0xffff568e
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 0xfffe
jg 0x1000af9a
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1000af9c
mov eax, edi
cmp eax, dword [ebp - 0x18]
je 0x1000afa4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x53c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0xcb8ce3e
setl dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
dec ecx
imul ecx, dword [ebp - 0x14]
imul eax, ecx, 0x25cf
test eax, eax
je 0x1000b056
mov dword [ebp - 0x54], 0xe78de611
lea ecx, [ebp - 0x674]
push 2
call fcn.1001ae5e
mov dword [ebp - 0x18], ebx
jmp 0x1000b016
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x674]
mov dword [eax + ecx*4], 0x461d90bc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000b003
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x1000b049
mov ecx, dword [ebp - 0x674]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x54], 0x12106df3
mov eax, dword [ebp - 0x14]
mov dword [ecx + 4], eax
dec dword [ebp - 0x14]
jns 0x1000b02e
lea ecx, [ebp - 0x674]
call fcn.1001b9e4
jmp 0x1000b06c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b06c
xor eax, eax
inc eax
push eax
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x53c]
mov dword [ebp - 4], esi
call fcn.1001b9e4
mov dword [ebp - 0x94], 0x64f16efa
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x3c], 0xbf9cc53a
xor eax, eax
mov dword [ebp - 0x1c], 0xdb3ae355
inc eax
mov dword [ebp - 0x48], 0x5d3e9973
mov dword [ebp - 0x38], 0x7d6446bd
mov dword [ebp - 0x40], 0xfffd
push eax
call fcn.1001ae5e
push 6
pop edi
xor edx, edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000b0d3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x554]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b0c4
push 2
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1000b0f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4ec], 0x543565e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b0e0
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffe2
jg 0x1000b271
push 4
pop esi
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x71c]
push esi
call fcn.1001ae5e
mov dword [ebp - 0x20], 0x2560
mov dword [ebp - 0x14], ebx
jmp 0x1000b132
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb80], 0x8f6a1c3d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b121
mov dword [ebp - 0x14], ebx
jmp 0x1000b14f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x71c]
mov dword [eax + ecx*4], 0x1d0ee3b0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b13c
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x1c]
je 0x1000b17f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x28], 0x2a30
jge 0x1000b17f
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1000b184
xor esi, esi
mov ecx, ebx
inc esi
xor eax, eax
cmp ecx, 0x8588
setle al
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
sub ecx, 0xf77722ab
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x554]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
dec dword [ebp - 0x20]
cmp eax, ecx
mov eax, esi
mov esi, dword [ebp - 0x1c]
cmove eax, ebx
mov dword [ebp - 0xb7c], esi
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4e8]
cmp ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
setl bl
imul edx, ebx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
imul ecx, ecx, 0xca4d
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x786ff529
setle al
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x4ec]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x71c]
lea ecx, [ebp - 0x71c]
setne dl
sub edx, 0xc8c
neg edx
sbb edx, edx
inc edx
mov dword [eax + 0xc], edx
call fcn.1001b9e4
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
push 0
pop ebx
push 1
pop edx
jle 0x1000b103
or esi, 0xffffffff
lea ecx, [ebp - 0x554]
mov dword [ebp - 4], esi
call fcn.1001b9e4
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x1000b295
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], 0x841b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000b287
mov eax, 0x8ade19d2
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000b2c9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2cc], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000b2bc
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b2e6
push ebx
push 0x214e
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3d4], ebx
cmp dword [ebp - 0x3d4], ebx
jl 0x1000b31e
mov dword [ebp - 0x18], 0xe6d4f288
mov dword [ebp - 0x18], ebx
jmp 0x1000b311
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2cc], 0xf2e5664d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000b300
dec dword [ebp - 0x3d4]
jns 0x1000b2f4
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jg 0x1000c4b6
mov dword [ebp - 0x54], 0xeac8b13e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b34c
push ebx
push ebx
push 0x1748
push 0x1e57
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b367
push 0x1c86
push ebx
push ebx
push 0x1d5a
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x7fc]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x54], 0x283066c9
push 3
call fcn.1001ae5e
mov dword [ebp - 0x54], 0x35637001
push 3
mov dword [ebp - 0x48], 0x7f8b4dfe
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1000b3ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f0], 0xa8c6a53d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b39d
mov dword [ebp - 0x14], ebx
jmp 0x1000b3cb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7fc]
mov dword [eax + ecx*4], 0x439cb61d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b3b8
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1000b407
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b3ee
push ebx
push 0xec3
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x7f0]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7f0], ecx
dec dword [ebp - 0x18]
jns 0x1000b3d8
inc dword [ebp - 0x48]
lea ecx, [ebp - 0x7fc]
call fcn.1001b9e4
mov dword [ebp - 0x18], 0xeb6b9dd9
lea ecx, [ebp - 0x68c]
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x20], 0x85faafe3
mov dword [ebp - 0x48], 0xe7ccc895
mov dword [ebp - 0x20], 0x12f3ccd2
push edi
call fcn.1001ae5e
mov dword [ebp - 0x48], 0xe3d1aa12
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x30], ebx
jmp 0x1000b46a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x68c]
mov dword [eax + ecx*4], 0xa11600d5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1000b457
mov dword [ebp - 0x20], 0xfffe
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x68c]
setge dl
mov dword [eax], edx
test edx, edx
jne 0x1000b492
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], ebx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x14]
jge 0x1000b4df
cmp dword [ebp - 0x20], ebx
jne 0x1000b4df
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1000b4e4
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b4f7
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x68c]
call fcn.1001b9e4
mov dword [ebp - 0x38], 0x1516ea3d
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x28], 0x860b4ffb
push esi
call fcn.1001ae5e
or esi, 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000b534
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x814], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b527
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000b555
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x474]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b542
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1000b632
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], 0x2a17d0b0
mov dword [ebp - 0x30], ebx
jmp 0x1000b589
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x56c], 0x5ca42045
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1000b578
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
test eax, eax
jne 0x1000b5ed
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x814]
mov eax, dword [ebp - 0x474]
cmp ecx, dword [eax]
setge dl
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x474]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x814], ebx
jne 0x1000b5dc
cmp dword [ebp - 0x14], ebx
jne 0x1000b5dc
xor edx, edx
mov eax, ebx
inc edx
jmp 0x1000b5e1
xor edx, edx
inc edx
mov eax, edx
add eax, 0x448112de
cmp eax, dword [ebp - 0x28]
mov eax, ebx
jle 0x1000b5ef
mov eax, edx
mov dword [ebp - 0x34], eax
mov ecx, 0xf738f585
mov eax, dword [ebp - 0x34]
sub eax, 0x434a
neg eax
push 1
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x56c]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov eax, dword [ebp - 0x564]
cmp edx, eax
pop edx
sete cl
mov dword [ebp - 0x56c], ecx
dec dword [ebp - 0x28]
jns 0x1000b566
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000b64c
push 0x257a
push 0x23f3
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
lea ecx, [ebp - 0x474]
call fcn.1001b9e4
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000bdcc
mov dword [ebp - 0x48], 0xfffffff8
xor edx, edx
mov dword [ebp - 0x48], 0xff446cd5
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1000b68d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10c], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000b67c
mov dword [ebp - 0x1c], ebx
jmp 0x1000b6a5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x940], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b698
mov eax, dword [ebp - 0x108]
xor ecx, ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x104]
cmp eax, esi
push 6
setne cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
pop ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0x22736378
setl al
add eax, 0xfffef8a3
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
inc eax
cmp eax, esi
je 0x1000b712
cmp dword [ebp - 0x10c], ebx
jne 0x1000b714
mov edx, ebx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10c]
setle cl
sub ecx, eax
mov eax, dword [ebp - 0x108]
add eax, ecx
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
inc dword [ebp - 0x94]
mov dword [ebp - 0x1c], 0x68ec0ae9
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jge 0x1000b780
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa9c], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000b766
xor eax, eax
inc eax
mov dword [ebp - 0x1c], 0xb
cmp dword [ebp - 0x1c], 0xfffffffe
jne 0x1000ba19
jmp 0x1000b796
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000b7ae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x584], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000b7a1
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1000ba06
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1000b9fd
mov dword [ebp - 0x44], 0xf4442628
mov dword [ebp - 0x44], 0x1462
cmp dword [ebp - 0x44], 0x46b
jge 0x1000b98d
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x100081e0
call fcn.1005d64b
add esp, 0xc
lea ecx, [ebp - 0x8c4]
push dword [ebp - 0xa4]
call fcn.1001ae5e
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0xa4]
mov esi, dword [ebp - 0x8c4]
test eax, eax
jle 0x1000b84f
mov edi, esi
push edi
push 0x100081dc
call fcn.1005d64b
pop ecx
pop ecx
push 4
pop eax
add edi, eax
inc ebx
mov eax, dword [ebp - 0xa4]
cmp ebx, eax
jl 0x1000b832
and dword [ebp - 0x3f0], 0
lea ecx, [ebp - 0x3f0]
push ecx
push eax
lea ecx, [ebp - 0x758]
call fcn.1001ae9a
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xa4]
lea eax, [ecx - 1]
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x34c]
push eax
push ecx
lea ecx, [ebp - 0x82c]
call fcn.1001ae9a
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
inc ecx
mov edx, ecx
cmp eax, ecx
jle 0x1000b8c9
mov ecx, dword [ebp - 0x758]
mov edi, esi
sub edi, ecx
mov eax, dword [edi + ecx]
cmp eax, dword [esi + edx*4]
jl 0x1000b8b4
mov eax, dword [ecx]
jmp 0x1000b8b6
mov eax, edx
mov dword [ecx + 4], eax
inc edx
push 4
pop eax
add ecx, eax
mov eax, dword [ebp - 0xa4]
cmp edx, eax
jl 0x1000b8a8
mov ebx, dword [ebp - 0x82c]
lea ecx, [eax - 2]
test ecx, ecx
js 0x1000b8f9
lea edx, [ebx + 4]
mov edi, esi
lea edx, [edx + ecx*4]
sub edi, ebx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edi + edx]
jg 0x1000b8ec
mov eax, dword [edx]
jmp 0x1000b8ee
mov eax, ecx
mov dword [edx - 4], eax
push 4
pop eax
sub edx, eax
dec ecx
jns 0x1000b8e0
mov eax, dword [ebp - 0xc8]
test eax, eax
je 0x1000b95d
mov esi, dword [ebp - 0x758]
dec eax
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0x100081e0
call fcn.1005d64b
mov eax, dword [ebp - 0x2f0]
add esp, 0xc
mov edx, 0x100081f8
mov edi, 0x100081fc
mov ecx, dword [esi + eax*4 - 4]
mov eax, dword [ebp - 0x2b8]
cmp ecx, dword [ebx + eax*4 - 4]
cmovg edx, edi
push edx
call fcn.1005dee6
mov eax, dword [ebp - 0xc8]
pop ecx
test eax, eax
jne 0x1000b909
dec eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0xc8], eax
call fcn.1001b9e4
lea ecx, [ebp - 0x758]
call fcn.1001b9e4
or esi, 0xffffffff
lea ecx, [ebp - 0x8c4]
mov dword [ebp - 4], esi
call fcn.1001b9e4
xor ebx, ebx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x584], ebx
je 0x1000b99c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1000b9cb
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 7
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
setle dl
sub ecx, edx
cmp ecx, dword [ebp + eax*4 - 0x584]
jg 0x1000b9cb
mov eax, ebx
jmp 0x1000b9ce
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x584]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
mov dword [ebp - 0x44], edx
dec dword [ebp - 0x28]
jns 0x1000b7d2
push 2
pop edi
dec dword [ebp - 0x18]
jns 0x1000b7c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
je 0x1000b793
mov dword [ebp - 0x1c], ebx
jmp 0x1000ba9b
mov dword [ebp - 0x20], 0x4fa3fda3
mov dword [ebp - 0x44], 0x5534fd39
mov dword [ebp - 0x18], ebx
jmp 0x1000ba42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa6c], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000ba31
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000ba5a
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0x48], 6
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub eax, 0x3ed13222
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jne 0x1000ba1e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1000bdc3
mov dword [ebp - 0x30], 0xd4e06482
lea ecx, [ebp - 0x6a4]
mov dword [ebp - 0x7c], ebx
push 3
call fcn.1001ae5e
mov dword [ebp - 0x38], 0xeafb
mov dword [ebp - 0x48], 0xd8142c78
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x54], 0x659b
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], ebx
jmp 0x1000baff
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6a4]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1000baec
mov dword [ebp - 0x30], 0xffffffeb
cmp dword [ebp - 0x30], 0xffffffe9
je 0x1000bbed
mov esi, dword [ebp - 0x6a4]
mov dword [ebp - 0x28], 0x3d37
xor ecx, ecx
mov dword [ebp - 0x1c], 9
inc ecx
mov dword [ebp - 0x34], ecx
or eax, 0xffffffff
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x623b4709
mov dword [ebp - 0x20], 0xa7f4
mov dword [ebp - 0x4c], 0x9034
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x34], ebx
je 0x1000bb5e
cmp dword [ebp - 0x1c], ebx
jne 0x1000bb60
mov ecx, ebx
dec dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x38]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 8], edx
sete cl
xor edx, edx
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x34]
sub edx, eax
neg edx
sbb edx, edx
add edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe9
jne 0x1000bb1c
or esi, 0xffffffff
dec dword [ebp - 0x44]
lea ecx, [ebp - 0x6a4]
call fcn.1001b9e4
push ecx
mov dword [ebp - 0x64], 8
lea eax, [ebp - 0x998]
push eax
mov dword [ebp - 0x20], 0xde0980db
lea eax, [ebp - 0x9a8]
mov dword [ebp - 0x38], 0x9a8551b3
lea ecx, [ebp - 0x808]
xorps xmm0, xmm0
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x4c], 0xfffffff7
push eax
movdqu xmmword [ebp - 0x9a8], xmm0
call fcn.1001af11
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x44], eax
xor edx, edx
mov dword [ebp - 0x44], esi
inc edx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0x5af849f
mov dword [ebp - 0x3c], 0x402a53eb
mov dword [ebp - 0x1c], ebx
jmp 0x1000bc72
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x80], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000bc64
push 4
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1000bc8c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb58], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000bc7f
cmp dword [ebp - 0x20], ebx
je 0x1000bcda
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x20]
imul ecx, eax, 0xfffd
mov eax, dword [ebp - 0x20]
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jl 0x1000bcbc
mov eax, edx
cmp dword [ebp - 0x38], ebx
jne 0x1000bcbe
mov eax, ebx
mov dword [ebp - 0x44], eax
mov ecx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x4c]
jle 0x1000bcdc
mov ecx, ebx
mov eax, dword [ebp - 0x808]
mov dword [eax + 4], ecx
mov ecx, edx
mov eax, dword [ebp - 0x80]
sub ecx, eax
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x44]
cmp eax, 0xfffffffd
setge cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x4c]
imul eax, eax, 0x2743
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, 0xca62
mov eax, dword [ebp - 0x80]
setge cl
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0xb58], ecx
lea ecx, [ebp - 0x808]
call fcn.1001b9e4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], 0xfffffff6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
sub ecx, dword [ebp + eax*4 - 0x68]
mov eax, 0xffff
sub ecx, dword [ebp - 0x64]
cmp eax, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0x2c]
je 0x1000bda5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x68], ecx
dec dword [ebp - 0x18]
jns 0x1000bab1
dec dword [ebp - 0x14]
jns 0x1000b663
xor ecx, ecx
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x30], ebx
inc ecx
jmp 0x1000bdec
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x944], 0x3250e6da
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x1000bddb
push 4
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1000be08
mov dword [ebp - 0x3c], 0x2cb51dba
cmp dword [ebp - 0x3c], ebx
jne 0x1000be0d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x1000bdf9
mov dword [ebp - 0x14], ebx
jmp 0x1000be2a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000be27
push ebx
push 0x4e0
call dword [sym.imp.GDI32.dll_GetClipBox]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1000be12
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x68], ebx
je 0x1000c25d
push 6
pop eax
mov dword [ebp - 0x768], eax
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x75c], eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x3c], 0x2088
cmp dword [ebp - 0x3c], 0x8cd
jge 0x1000c00d
mov edx, 0x10666324
mov ecx, 0x10666be8
call fcn.1002056a
mov ebx, dword [0x10666334]
push ecx
push ecx
mov dword [ebp - 0x7c], ebx
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x100089c0]
movsd qword [esp], xmm0
call fcn.1005d270
fstp qword [ebp - 0x58]
cvttsd2si esi, qword [ebp - 0x58]
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, esi
cmp ecx, ebx
jge 0x1000bec6
inc eax
add ecx, esi
cmp eax, 0x14
jle 0x1000beb5
mov eax, dword [ebp - 0x40]
jmp 0x1000bec9
mov dword [ebp - 0x40], eax
imul eax, esi
sub eax, ebx
cdq
idiv esi
mov dword [ebp - 0x64], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 4], 9
test esi, esi
jle 0x1000bf36
mov ebx, dword [ebp - 0x64]
mov edi, esi
mov esi, edx
mov dword [ebp - 0x180], ebx
test esi, esi
jle 0x1000bf13
lea eax, [ebx + 1]
dec esi
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.1001aebc
dec edi
jne 0x1000beff
mov edi, dword [ebp - 0x2c8]
cvttsd2si esi, qword [ebp - 0x58]
mov ebx, dword [ebp - 0x7c]
push dword [ebp - 0x40]
push esi
push 0x10008200
call fcn.1005dc93
xor edx, edx
add esp, 0xc
mov eax, edx
mov ecx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], ecx
test ebx, ebx
jle 0x1000bff4
cmp ecx, esi
jge 0x1000bff4
mov dword [ebp - 0x2c], edx
mov ecx, edx
cmp eax, ebx
jge 0x1000bfb2
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
sub eax, dword [edi]
cmp ecx, eax
jge 0x1000bfa8
cmp dword [0x10666338], 0x10
mov eax, 0x10666324
cmovae eax, dword [0x10666324]
movsx eax, byte [esi + eax]
push eax
push 0x10008208
call fcn.1005dc93
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
inc esi
inc ecx
mov dword [ebp - 0x2c], ecx
cmp esi, ebx
jl 0x1000bf6f
mov dword [ebp - 0x20], esi
xor edx, edx
cvttsd2si esi, qword [ebp - 0x58]
mov dword [ebp - 0x3c], edx
cmp dword [edi], edx
jle 0x1000bfd0
mov esi, edx
push 0x10008144
call fcn.1005dc93
inc esi
pop ecx
cmp esi, dword [edi]
jl 0x1000bfbb
cvttsd2si esi, qword [ebp - 0x58]
inc dword [ebp - 0x38]
push 4
pop eax
push 0x10008146
add edi, eax
call fcn.1005dee6
mov eax, dword [ebp - 0x20]
pop ecx
mov ecx, dword [ebp - 0x38]
push 0
pop edx
cmp eax, ebx
jl 0x1000bf5b
or esi, 0xffffffff
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], esi
call fcn.1001b9e4
push 4
pop edi
push 6
xor ebx, ebx
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000c022
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x27c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c015
mov dword [ebp - 0x278], ebx
jmp 0x1000c092
mov dword [ebp - 0x20], 0xc41fd9d0
mov dword [ebp - 0x3c], 0x6917ab6d
mov eax, dword [ebp - 0x760]
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x278]
cmp eax, 0xfffffff7
setne cl
xor eax, eax
inc eax
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x278]
cmp dword [ebp - 0x278], 3
jle 0x1000c02f
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000c0b4
push 0xea
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0xe
mov dword [ebp - 0x18], ebx
pop eax
jmp 0x1000c0cf
cmp byte [ebp - 0xd], 0
je 0x1000c0cc
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xe
pop eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
mov byte [ebp - 0xd], bl
jg 0x1000c0bc
mov dword [ebp - 0x18], 0xfff6
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffe8
jge 0x1000c1fb
mov dword [ebp - 0x20], 0x18e418a5
push 3
mov dword [ebp - 0x2c], ecx
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x14], ebx
jmp 0x1000c119
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x59c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000c10c
mov dword [ebp - 0x14], ebx
jmp 0x1000c134
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb38], 0xb2097e65
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000c123
cmp dword [ebp - 0x20], ebx
jne 0x1000c1d5
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ebx
je 0x1000c183
cmp dword [ebp - 0x1c], ebx
je 0x1000c183
xor esi, esi
inc esi
mov edx, esi
jmp 0x1000c188
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0x2633
imul ecx, dword [ebp - 0x59c]
test ecx, ecx
je 0x1000c1a6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x59c], 0x649690b2
mov ecx, esi
mov dword [ebp - 0xb34], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x59c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
jne 0x1000c1d2
mov edx, ebx
jmp 0x1000c1d7
xor ecx, ecx
inc ecx
mov edx, ecx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
neg eax
cmp eax, edx
push 1
setl cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
pop ecx
push 0xffffffffffffffff
pop esi
jl 0x1000c0f7
or esi, esi
cmp byte [ebp - 0xd], 0
je 0x1000c4a7
mov dword [ebp - 0x18], 0xc96dd1e1
mov dword [ebp - 0x18], ebx
jmp 0x1000c21e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb00], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c211
mov dword [ebp - 0x18], ebx
jmp 0x1000c235
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb00], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c228
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000c24d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x7c6
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1000c4a7
mov dword [ebp - 0x30], 0xd7f825e
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x3c], 0x18aa
cmp dword [ebp - 0x3c], 0xc4e
jge 0x1000c31c
lea eax, [ebp - 0x114]
push eax
push 0x100081d8
call fcn.1005d64b
pop ecx
pop ecx
push dword [ebp - 0x114]
lea ecx, [ebp - 0x734]
call fcn.1001ae5e
mov dword [ebp - 4], 0xa
mov esi, ebx
cmp dword [ebp - 0x114], 0
jle 0x1000c2d0
mov eax, dword [ebp - 0x734]
lea eax, [eax + esi*4]
push eax
push 0x100081d8
call fcn.1005d64b
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x114]
jl 0x1000c2b1
lea eax, [ebp - 0x734]
push eax
push ebx
push ebx
push 0x1e
pop edx
push edx
pop ecx
call fcn.1000a30e
add esp, 0xc
mov ecx, ebx
mov eax, 0x10c76f50
push 0x3d
pop edx
add ecx, dword [eax]
add eax, edi
dec edx
jne 0x1000c2f0
cmp eax, 0x10c7a974
jl 0x1000c2ed
push ecx
push 0x100081e8
call fcn.1005dc93
pop ecx
pop ecx
or esi, 0xffffffff
lea ecx, [ebp - 0x734]
mov dword [ebp - 4], esi
call fcn.1001b9e4
cmp byte [ebp - 0xd], 0
je 0x1000c449
mov dword [ebp - 0x3c], 0x25d9
cmp dword [ebp - 0x3c], 0x948
jge 0x1000c43c
push 0x10c7a97c
push 0x100081d8
call fcn.1005d64b
cmp dword [0x10c7a97c], 0
mov edi, ebx
pop ecx
pop ecx
jle 0x1000c391
mov esi, 0x10667c70
push esi
push 0x100081d8
call fcn.1005d64b
pop ecx
pop ecx
imul ecx, dword [esi], 0xc
lea eax, [ebp - 0x3dc]
inc edi
push eax
mov dword [ebp - 0x3dc], edi
add ecx, 0x10e27060
call fcn.1001aebc
push 4
pop eax
add esi, eax
cmp edi, dword [0x10c7a97c]
jl 0x1000c35b
push 0x106c96f4
push 0x100081d8
call fcn.1005d64b
mov eax, dword [0x106c96f4]
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x58]
movlpd qword [ebp - 0x90], xmm0
mov ebx, dword [ebp - 0x8c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x90]
test eax, eax
je 0x1000c420
mov dword [ebp - 0x2c], ecx
dec eax
mov dword [0x106c96f4], eax
lea eax, [ebp - 0x2dc]
push eax
push 0x100081d8
call fcn.1005d64b
pop ecx
pop ecx
imul ecx, dword [ebp - 0x2dc], 0xc
mov eax, dword [ecx + 0x10e27060]
mov ecx, dword [ecx + 0x10e27064]
mov eax, dword [eax]
cdq
add edi, eax
mov eax, dword [0x10c7a97c]
adc esi, edx
sub eax, dword [ecx - 4]
mov ecx, dword [ebp - 0x2c]
inc eax
cdq
add ecx, eax
mov eax, dword [0x106c96f4]
mov dword [ebp - 0x2c], ecx
adc ebx, edx
test eax, eax
jne 0x1000c3d0
push ebx
push ecx
push esi
dec eax
push edi
push 0x1000820c
mov dword [0x106c96f4], eax
call fcn.1005dc93
add esp, 0x14
xor ebx, ebx
or esi, 0xffffffff
xor eax, eax
inc eax
push eax
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x30], 0xfffffff4
jmp 0x1000c46e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000c46b
push 0x2090
push 0xf3a
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe4
jl 0x1000c452
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x38], ebx
jne 0x1000c497
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jb 0x1000c497
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], 0xe99fd40f
inc dword [ebp - 0x24]
push 2
pop edi
cmp dword [ebp - 0x24], ebx
jle 0x1000b32a
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x54], 0x3580d416
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x1a
jmp 0x1000c536
push edi
lea ecx, [ebp - 0x8dc]
call fcn.1001ae5e
xor edx, edx
push 0xfffffffffffffff6
pop eax
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000c50c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8dc]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000c4f9
mov dword [ebp - 0x18], ebx
jmp 0x1000c523
mov dword [ebp - 0x2c], 0x223fa3a9
dec dword [ebp - 0x2c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1000c516
lea ecx, [ebp - 0x8dc]
call fcn.1001b9e4
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jle 0x1000c4d3
movdqa xmm0, xmmword [0x10008b90]
lea ecx, [ebp - 0x9f8]
push ecx
lea eax, [ebp - 0x9e8]
push eax
push ecx
lea ecx, [ebp - 0x198]
movdqu xmmword [ebp - 0x9f8], xmm0
call fcn.1001af11
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], 0x6840eb44
mov dword [ebp - 0x28], 0xcb27f08e
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x3c], 0x1eda
cmp dword [ebp - 0x3c], 0x5c1
jge 0x1000c6ad
xor eax, eax
mov dword [0x10d3e024], ebx
inc eax
mov dword [0x10d3e028], edi
mov dword [0x10d3e020], eax
mov esi, 0x10d3e020
mov dword [0x10d3e02c], ebx
mov ecx, dword [esi]
add ecx, dword [esi + 8]
mov eax, dword [esi + 4]
adc eax, dword [esi + 0xc]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
add esi, 8
cmp esi, 0x10d3e648
jl 0x1000c5b8
lea eax, [ebp - 0xc4]
push eax
push 0x100081d8
call fcn.1005d64b
mov eax, dword [ebp - 0xc4]
pop ecx
pop ecx
test eax, eax
je 0x1000c6a3
dec eax
xorps xmm0, xmm0
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0x228]
push eax
push 0x10008218
movlpd qword [ebp - 0x58], xmm0
call fcn.1005d64b
mov edx, dword [0x10d3e024]
pop ecx
pop ecx
cmp edx, dword [ebp - 0x224]
ja 0x1000c67a
mov ecx, dword [0x10d3e020]
jb 0x1000c635
cmp ecx, dword [ebp - 0x228]
ja 0x1000c67a
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x58]
mov eax, ecx
and eax, 1
or eax, 0
je 0x1000c653
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
add edi, ecx
mov ecx, dword [ebx*8 + 0x10d3e028]
adc esi, edx
mov edx, dword [ebx*8 + 0x10d3e02c]
inc ebx
cmp edx, dword [ebp - 0x224]
jb 0x1000c63b
ja 0x1000c680
cmp ecx, dword [ebp - 0x228]
jbe 0x1000c63b
jmp 0x1000c680
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x58]
push esi
push edi
push 0x10008220
call fcn.1005dc93
mov eax, dword [ebp - 0xc4]
add esp, 0xc
push 0
pop ebx
test eax, eax
jne 0x1000c5f5
push 2
pop edi
dec eax
or esi, 0xffffffff
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x1000c9e7
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x64], eax
jmp 0x1000c6c8
push 2
pop edi
mov dword [ebp - 0x3c], 0x22d7
cmp dword [ebp - 0x3c], 0xb82
jge 0x1000c865
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x36c], ebx
push eax
push edi
lea ecx, [ebp - 0xa60]
call fcn.1001ae9a
push eax
push 0x3b
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0xc
call fcn.1001b031
lea ecx, [ebp - 0xa60]
mov byte [ebp - 4], 0xb
call fcn.1001b9e4
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
mov esi, edi
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x178]
push eax
push 0x100081dc
mov dword [ebp - 0x44], esi
call fcn.1005d64b
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x178], edi
jl 0x1000c84a
lea eax, [ebp - 0x154]
push eax
push 0x100081dc
call fcn.1005d64b
pop ecx
pop ecx
test edi, edi
je 0x1000c7c4
mov eax, dword [ebp - 0x154]
xor ecx, ecx
mov edi, esi
inc ecx
sub edi, dword [ebp - 0x40]
cmp edi, ecx
jle 0x1000c77c
cmp eax, ecx
movzx ebx, bl
cmovg ebx, ecx
mov dword [ebp - 0x2c], ebx
and dword [ebp - 0x3c], 0
test eax, eax
jle 0x1000c7b9
mov ebx, dword [ebp - 0x3c]
imul ecx, esi, 0xc
mov esi, dword [ebp - 0x40]
add ecx, dword [ebp - 0x2d8]
mov eax, dword [ecx]
push 0xc
mov dword [eax], esi
mov eax, ebx
cdq
idiv edi
mov eax, dword [ecx]
add edx, esi
inc ebx
mov dword [eax + 4], edx
pop eax
add ecx, eax
mov eax, dword [ebp - 0x154]
cmp ebx, eax
jl 0x1000c793
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x40], esi
add esi, eax
mov dword [ebp - 0x44], esi
inc edi
mov dword [ebp - 0x4c], edi
cmp edi, dword [ebp - 0x178]
jle 0x1000c748
test bl, bl
je 0x1000c84a
push 0x10008228
call fcn.1005dee6
xor eax, eax
inc eax
pop ecx
cmp esi, eax
jle 0x1000c80e
mov edi, dword [ebp - 0x2d8]
lea ebx, [esi - 1]
add edi, 0xc
mov eax, dword [edi]
push dword [eax]
push 0x10008234
call fcn.1005dc93
pop ecx
pop ecx
push 0xc
pop eax
add edi, eax
dec ebx
jne 0x1000c7f6
mov ebx, dword [ebp - 0x2d8]
push 0x10008146
call fcn.1005dee6
xor eax, eax
inc eax
pop ecx
cmp esi, eax
jle 0x1000c843
lea edi, [ebx + 0xc]
dec esi
mov eax, dword [edi]
push dword [eax + 4]
push 0x10008234
call fcn.1005dc93
pop ecx
pop ecx
push 0xc
pop eax
add edi, eax
dec esi
jne 0x1000c82a
push 0x10008146
jmp 0x1000c84f
push 0x1000823c
call fcn.1005dee6
pop ecx
lea ecx, [ebp - 0x2d8]
call fcn.1001bb27
xor ebx, ebx
or esi, 0xffffffff
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x7c], 0x8718302c
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ecx + 8], 0xfffffff6
push 0xfffffffffffffff7
sete al
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x198]
pop edx
sub edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jne 0x1000c8d7
mov eax, dword [ebp - 0x198]
cmp dword [eax + 4], ebx
jne 0x1000c8d7
mov edx, ebx
jmp 0x1000c8dc
xor eax, eax
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x198]
push 3
mov eax, dword [eax + ecx*4]
sub eax, edx
mov dword [ebp - 0x14], eax
pop eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jl 0x1000c9db
mov ecx, 0xffff
mov dword [ebp - 0x40], 0x656d
mov dword [ebp - 0x20], 0xad46d232
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], 0xe023024a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jl 0x1000c9cf
push 4
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x1000c940
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0x35300547
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1000c92d
mov dword [ebp - 0x40], 0xd55be984
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x198]
cmp dword [eax + ecx*4], 0xfffffff6
jge 0x1000c973
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
test eax, eax
mov eax, dword [ebp - 0x198]
setns cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [eax + edi*4]
setg dl
mov byte [ebp - 0xd], bl
sub eax, edx
dec eax
dec eax
je 0x1000c9b2
cmp byte [ebp - 0xd], 0
je 0x1000c9aa
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jmp 0x1000c9be
cmp byte [ebp - 0xd], 0
je 0x1000c9be
call dword [sym.imp.USER32.dll_GetMessageTime]
dec dword [ebp - 0x14]
jns 0x1000c925
push 3
pop eax
mov ecx, 0xffff
dec dword [ebp - 0x24]
jns 0x1000c901
or esi, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000c6c5
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000ca04
xor eax, eax
push 0xa02
inc eax
push eax
push 0x2501
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], esi
call fcn.1001b9e4
push 2
pop esi
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x20], 0xf5ebec5
xor eax, eax
mov dword [ebp - 0x38], 0x8a52b4b5
inc eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x4c], ebx
push eax
call fcn.1001ae5e
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000ca5d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5b4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000ca4e
cmp dword [ebp - 0x14], ebx
je 0x1000cb07
mov dword [ebp - 0x28], 0x8d020bd2
mov dword [ebp - 0x2c], 0x695cd1d2
mov dword [ebp - 0x3c], 0x670fc244
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x28]
je 0x1000cab6
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov esi, 0xffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, 0x305aba9a
jge 0x1000cadf
cmp dword [ebp - 0x3c], ebx
jne 0x1000cae8
cmp dword [ebp - 0x14], ebx
jne 0x1000cae8
mov edx, ebx
jmp 0x1000caed
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xfffffffd
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
jmp 0x1000cbc7
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x4c], 0xdad8be77
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x3a
jg 0x1000cb8a
jmp 0x1000cb23
xor edx, edx
inc edx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0xb395b91
cmp dword [ebp - 0x38], ebx
jne 0x1000cb39
cmp dword [ebp - 0x2c], ebx
jne 0x1000cb39
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 6
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3a
jle 0x1000cb20
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1000cbc2
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5b4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000cbbd
push 0x14dd
push 0x18e5
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
dec dword [ebp - 0x28]
jns 0x1000cb92
mov esi, 0xffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000cbd8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
lea ecx, [ebp - 0x5b4]
call fcn.1001b9e4
movdqa xmm0, xmmword [0x10008b90]
lea ecx, [ebp - 0xa38]
push ecx
lea eax, [ebp - 0xa28]
push eax
push ecx
lea ecx, [ebp - 0x1ac]
movdqu xmmword [ebp - 0xa38], xmm0
call fcn.1001af11
mov dword [ebp - 4], 0xd
or edi, 0xffffffff
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0x6840eb44
mov dword [ebp - 0x28], 0xcb27f08e
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x1000d146
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x44], 0x8718302c
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ecx + 8], 0xfffffff6
push 0xfffffffffffffff7
sete al
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1ac]
pop edx
sub edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jne 0x1000ccb7
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 4], ebx
jne 0x1000ccb7
mov edx, ebx
jmp 0x1000ccbc
xor eax, eax
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + ecx*4]
sub eax, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], ebx
jl 0x1000d133
mov dword [ebp - 0x40], 0x656d
mov dword [ebp - 0x20], 0xad46d232
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x2c], 0xe023024a
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x1000d127
mov dword [ebp - 0x28], ebx
jmp 0x1000cfa4
mov dword [ebp - 0x3c], 0x1b6e
cmp dword [ebp - 0x3c], 0x11e8
jge 0x1000cf91
push 0x10008244
lea ecx, [ebp - 0x3b8]
call fcn.1001a3e8
push 0xe
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov ebx, dword [ebp - 0x3a8]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
call fcn.1001f247
mov dword [ebp - 0xd4], eax
xor eax, eax
mov byte [ebp - 4], 0xf
inc eax
mov edi, eax
cmp ebx, eax
jle 0x1000ce5a
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ebp - 0x3b8]
cmp ecx, 0x10
lea eax, [ebp - 0x3b8]
cmovae eax, edx
cmp byte [eax + edi], 0x51
je 0x1000ce51
cmp ecx, 0x10
lea eax, [ebp - 0x3b8]
cmovae eax, edx
cmp byte [eax + edi], 0x41
je 0x1000ce51
cmp ecx, 0x10
lea eax, [ebp - 0x3b8]
cmovae eax, edx
cmp byte [eax + edi], 0x5a
je 0x1000ce51
cmp ecx, 0x10
lea ebx, [ebp - 0x3b8]
lea eax, [ebp - 0x3b8]
cmovae eax, edx
lea ecx, [ebp - 0xd4]
cmovae ebx, edx
mov dword [ebp - 0x3c], eax
add ebx, edi
lea eax, [ebp - 0x188]
push ebx
push eax
call fcn.1001bbb3
mov esi, dword [ebp - 0x188]
cmp esi, dword [ebp - 0xd4]
je 0x1000cdfa
mov al, byte [ebx]
cmp al, byte [esi + 0xe]
jge 0x1000ce38
push ecx
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], ebx
push eax
push ecx
lea ecx, [ebp - 0xd4]
call fcn.10020926
push eax
add eax, 0xe
lea ecx, [ebp - 0xd4]
push eax
push esi
lea eax, [ebp - 0x3c0]
push eax
call fcn.10020952
mov esi, dword [ebp - 0x3c0]
mov dword [ebp - 0x188], esi
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x64]
mov al, byte [eax + edi - 1]
mov byte [esi + 0xf], al
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ebp - 0x3b8]
inc edi
cmp edi, ebx
jl 0x1000cd76
xor ebx, ebx
lea ecx, [ebp - 0x294]
push ebx
push ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], ebx
call fcn.1001b673
lea edx, [ebp - 0x294]
mov byte [ebp - 4], 0x10
mov ecx, 0x10666be8
call fcn.1001f7b0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1000cf65
mov ebx, dword [ebp - 0x284]
xor esi, esi
test ebx, ebx
jle 0x1000cf38
cmp dword [ebp - 0x280], 0x10
lea edi, [ebp - 0x294]
lea eax, [ebp - 0x2f4]
cmovae edi, dword [ebp - 0x294]
lea ecx, [ebp - 0xd4]
add edi, esi
push edi
push eax
call fcn.1001bbb3
mov eax, dword [ebp - 0x2f4]
mov edx, dword [ebp - 0xd4]
cmp eax, edx
je 0x1000cef7
mov cl, byte [edi]
cmp cl, byte [eax + 0xe]
jl 0x1000cef7
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x37c]
jmp 0x1000cf03
mov dword [ebp - 0x304], edx
lea eax, [ebp - 0x304]
mov eax, dword [eax]
mov ecx, 0x10666b38
cmp eax, edx
je 0x1000cf13
mov dl, byte [eax + 0xf]
jmp 0x1000cf2a
cmp dword [ebp - 0x280], 0x10
lea eax, [ebp - 0x294]
cmovae eax, dword [ebp - 0x294]
mov dl, byte [esi + eax]
call fcn.1001f7d7
inc esi
cmp esi, ebx
jl 0x1000cea9
push 0x10666b38
call fcn.1001f776
pop ecx
lea edx, [ebp - 0x294]
mov ecx, 0x10666be8
call fcn.1001f7b0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1000ce99
xor ebx, ebx
xor esi, esi
lea ecx, [ebp - 0x294]
push ebx
inc esi
push esi
call fcn.1001b673
lea ecx, [ebp - 0xd4]
call fcn.1001b0dc
push ebx
push esi
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0xd
call fcn.1001b673
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1ac]
mov dword [eax + ecx*4], 0x35300547
inc dword [ebp - 0x28]
push 4
pop eax
cmp dword [ebp - 0x28], eax
jl 0x1000cd0d
mov dword [ebp - 0x40], 0xd55be984
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + ecx*4], 0xfffffff6
jge 0x1000cfde
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
test eax, eax
mov eax, dword [ebp - 0x1ac]
setns cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [eax + edi*4]
setg dl
mov byte [ebp - 0xd], bl
sub eax, edx
dec eax
dec eax
je 0x1000d10d
cmp byte [ebp - 0xd], 0
je 0x1000d105
mov dword [ebp - 0x3c], 0x19f6
cmp dword [ebp - 0x3c], 0x115a
jge 0x1000d0fe
lea eax, [ebp - 0x1c0]
mov ecx, 0x10666be8
push eax
call fcn.1001a4ac
mov esi, dword [ebp - 0x1c0]
jmp 0x1000d0ef
push ebx
push ebx
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x41c], ebx
dec esi
mov dword [ebp - 0x418], ebx
call fcn.1001b673
lea edx, [ebp - 0x42c]
mov byte [ebp - 4], 0x11
mov ecx, 0x10666be8
call fcn.1002056a
cmp dword [ebp - 0x41c], 0
mov ecx, ebx
mov edi, ebx
mov dword [ebp - 0x20], ecx
jle 0x1000d0c7
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
cmp byte [ebx + eax], 0x3c
jne 0x1000d0a1
inc edi
jmp 0x1000d0be
push ebx
lea ecx, [ebp - 0x42c]
call fcn.1001a474
mov ecx, dword [ebp - 0x20]
cmp byte [eax], 0x3e
jne 0x1000d0be
test edi, edi
je 0x1000d0be
dec edi
inc ecx
mov dword [ebp - 0x20], ecx
inc ebx
cmp ebx, dword [ebp - 0x41c]
jl 0x1000d084
push ecx
mov ecx, 0x10666b38
call fcn.1001a8d1
push eax
call fcn.1001f776
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 0xd
xor eax, eax
lea ecx, [ebp - 0x42c]
push ebx
inc eax
push eax
call fcn.1001b673
test esi, esi
jne 0x1000d046
dec esi
mov dword [ebp - 0x1c0], esi
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jmp 0x1000d119
cmp byte [ebp - 0xd], 0
je 0x1000d119
call dword [sym.imp.USER32.dll_GetMessageTime]
dec dword [ebp - 0x14]
jns 0x1000cd05
mov esi, 0xffff
dec dword [ebp - 0x24]
jns 0x1000ccdd
or edi, 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
mov ecx, dword [ebp - 0x94]
jle 0x1000cc48
xor esi, esi
mov byte [ebp - 0xd], bl
inc esi
cmp byte [ebp - 0xd], 0
je 0x1000d163
push 0xa02
push esi
push 0x2501
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 4], edi
call fcn.1001b9e4
mov dword [ebp - 0x18], 0x9714
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], 0x951ad386
mov dword [ebp - 0x34], 0x1454bcd7
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x28], ebx
je 0x1000d1a7
mov eax, dword [ebp - 0x28]
mov edx, esi
add eax, dword [ebp - 0x18]
jne 0x1000d1a9
mov edx, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
neg eax
sbb eax, eax
add eax, 0x75cb5548
add eax, edx
cmp edi, eax
mov edi, 0x54c1ce2a
sbb eax, eax
inc eax
cmp eax, 0xa017
jl 0x1000d40f
push 4
pop esi
push esi
lea ecx, [ebp - 0x4a4]
call fcn.1001ae5e
push 3
lea ecx, [ebp - 0x6bc]
mov dword [ebp - 4], 0x12
call fcn.1001ae5e
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x14], ebx
jmp 0x1000d222
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4a4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000d213
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jge 0x1000d248
or edx, 0xffffffff
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6bc]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000d233
mov dword [ebp - 0x14], 0x45acee61
mov dword [ebp - 0x3c], 0x1ce4
cmp dword [ebp - 0x3c], 0x58c
jge 0x1000d39d
lea eax, [ebp - 0xe4]
push eax
push 0x100081d8
call fcn.1005d64b
pop ecx
pop ecx
lea eax, [ebp - 0x3f8]
mov dword [ebp - 0x3f8], ebx
push eax
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xa78]
call fcn.1001ae9a
push eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x48c]
push dword [ebp - 0xe4]
call fcn.1001b031
lea ecx, [ebp - 0xa78]
mov byte [ebp - 4], 0x16
call fcn.1001b9e4
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
inc ecx
mov esi, ecx
cmp eax, ecx
jle 0x1000d333
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0x1000826c
call fcn.1005d64b
imul ecx, dword [ebp - 0x1d0], 0xc
add esp, 0x10
mov eax, dword [ebp - 0x48c]
mov edx, dword [ecx + eax]
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x18c]
mov dword [edx + ecx*4], eax
imul ecx, dword [ebp - 0x1d4], 0xc
inc esi
mov eax, dword [ebp - 0x48c]
mov edx, dword [ecx + eax]
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x18c]
mov dword [edx + eax*4], ecx
mov eax, dword [ebp - 0xe4]
cmp esi, eax
jl 0x1000d2c8
lea ecx, [ebp - 0x9d]
mov dword [ebp - 0x158], ebx
push ecx
push eax
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 0x9d], bl
call fcn.1001af57
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x9d8]
xor ecx, ecx
push ebx
push eax
lea edx, [ebp - 0x48c]
call fcn.1000a432
add esp, 0xc
push dword [ebp - 0x158]
push 0x100081e8
call fcn.1005dc93
pop ecx
pop ecx
lea ecx, [ebp - 0x9d8]
call fcn.1001afb8
lea ecx, [ebp - 0x48c]
call fcn.1001bb27
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x18]
cmp dword [ecx + 4], eax
sete dl
sub edx, 0x8f3b
jne 0x1000d3e0
mov eax, dword [ebp - 0x4a4]
cmp dword [eax + 0xc], ebx
jne 0x1000d3e0
mov ecx, ebx
jmp 0x1000d3e5
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x6bc]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x6bc]
call fcn.1001b9e4
or esi, 0xffffffff
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 4], esi
call fcn.1001b9e4
jmp 0x1000d602
mov dword [ebp - 0x1c], 0x277ed469
mov dword [ebp - 0x20], 0x956a74ab
mov dword [ebp - 0x2c], 0xf1470902
mov dword [ebp - 0x30], ebx
jmp 0x1000d43a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x94c], 0x72970974
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1000d429
cmp dword [ebp - 0x1c], ebx
jne 0x1000d447
mov esi, ebx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x34]
cmp ecx, 0xfffffff8
setle al
imul eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x1c]
jne 0x1000d472
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x24]
setle cl
sub eax, ecx
cmp eax, dword [ebp - 0x1c]
jne 0x1000d552
mov eax, 0xb84a8a62
lea ecx, [ebp - 0x5cc]
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 0x7bc], eax
push 2
call fcn.1001ae5e
mov dword [ebp - 0x14], ebx
jmp 0x1000d4d2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5cc]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000d4bf
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000d4f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x314], 0xd73c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000d4e0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], eax
jl 0x1000d508
mov dword [ebp - 0x7c4], edx
mov ecx, edx
jmp 0x1000d50a
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub eax, ecx
cmp dword [ebp - 0x28], eax
jne 0x1000d51b
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1000d51d
mov eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x5cc]
mov ecx, dword [ebp - 0x314]
imul ecx, dword [eax + 4]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x24]
imul eax, ecx
lea ecx, [ebp - 0x5cc]
sub eax, 0x669d
mov dword [ebp - 0x14], eax
call fcn.1001b9e4
jmp 0x1000d5f9
xor edx, edx
mov dword [ebp - 0x44], 0x4cde8b7
mov dword [ebp - 0x40], 0x4896b3c8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
cmp eax, 0x84e0
mov eax, dword [ebp - 0x44]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, 0x2b4d
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, edi
setl cl
sub edx, ecx
add edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x3eeac61c
setl al
xor edx, edx
cmp eax, 0x780a
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
test eax, eax
setle cl
add edx, ecx
jne 0x1000d5c9
cmp dword [ebp - 0x24], ebx
je 0x1000d5d3
cmp dword [ebp - 0x40], ebx
je 0x1000d5d3
xor eax, eax
inc eax
jmp 0x1000d5d5
mov eax, ebx
mov edx, dword [ebp - 0x34]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
setl cl
cmp ecx, 0xfffffffb
sbb eax, eax
xor ecx, ecx
neg eax
or esi, 0xffffffff
cmp eax, esi
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94c], eax
mov eax, 0x3b26bdde
lea ecx, [ebp - 0x74c]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
xor eax, eax
inc eax
push eax
call fcn.1001ae5e
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000d649
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74c]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000d636
mov dword [ebp - 0x21c], 0xfffffff7
jmp 0x1000d688
mov dword [ebp - 0x2c], 9
xor edx, edx
imul ecx, dword [ebp - 0x2c], 0xf37c
mov eax, dword [ebp - 0x21c]
add ecx, eax
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x74c]
setl dl
mov dword [eax], edx
inc dword [ebp - 0x21c]
cmp dword [ebp - 0x21c], 0xd
je 0x1000d65a
lea ecx, [ebp - 0x74c]
call fcn.1001b9e4
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x54], 0x3580d416
mov dword [ebp - 0x1c], 0xf7e2799a
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
jmp 0x1000d6cd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb0], 0x6a162c9c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1000d6bc
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffe9
jne 0x1000d943
xor eax, eax
inc eax
mov dword [ebp - 0x14], 0x8b72fd49
mov dword [ebp - 0x2c], 0x6d35df96
mov dword [ebp - 0x14], 0x12
jmp 0x1000d924
mov dword [ebp - 0x24], 0x38c08872
mov dword [ebp - 0x40], 0x1bca
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x4c], 0xf3fd26f3
mov dword [ebp - 0x24], ebx
jmp 0x1000d734
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000d731
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
inc eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1000d71e
mov dword [ebp - 0x24], ebx
jmp 0x1000d918
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x5e4]
push eax
call fcn.1001ae5e
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000d76b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5e4]
mov dword [eax + ecx*4], 0xae50714b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000d758
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xac]
imul edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
dec eax
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0xac]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
mov ecx, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x24]
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
shl edx, 2
cmp edx, 0xec7e011b
mov edx, 0xffff
setne cl
add ecx, eax
mov eax, dword [ebp - 0x5e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xb0], edx
mov eax, dword [ebp - 0xb0]
sbb edx, edx
add eax, ecx
inc edx
cmp eax, 0xf7a0211e
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [ebp - 0xb0]
setle cl
add eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x40]
shl eax, 3
sub ecx, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x14], ebx
jne 0x1000d8a0
cmp dword [ebp - 0x1c], ebx
jne 0x1000d867
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb0]
cmp ecx, eax
sete dl
xor edi, edi
imul edx, dword [ebp - 0xb0]
xor ebx, ebx
mov eax, dword [ebp - 0x28]
inc edi
cmp edx, edi
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x14]
jge 0x1000d86a
mov edx, ebx
jmp 0x1000d86c
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb0]
mov dword [ebp - 0x40], ebx
xor ecx, ecx
mov dword [ebp - 0x3c], 0x47387092
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb0]
cmp eax, 0xbb76
setne cl
xor eax, eax
cmp eax, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x4c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor eax, eax
inc edx
inc eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], ebx
jmp 0x1000d902
cmp dword [ebp - 0x40], ebx
jne 0x1000d907
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1000d8fa
lea ecx, [ebp - 0x5e4]
call fcn.1001b9e4
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jle 0x1000d741
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
je 0x1000d6fd
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
je 0x1000d6e3
mov edi, 0x54c1ce2a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
cmp ecx, 0x6aa55a69
jle 0x1000d963
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, esi
setg dl
xor ecx, ecx
sub eax, edx
cmp eax, 0x9a6a
setle cl
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
jne 0x1000d99b
cmp dword [ebp - 0x20], ebx
jne 0x1000d99b
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1000d9a0
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x8ec]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
push 3
call fcn.1001ae5e
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x14], ebx
jmp 0x1000d9cf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000d9c2
mov dword [ebp - 0x14], ebx
jmp 0x1000d9ed
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8ec]
mov dword [eax + ecx*4], 0xbea5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000d9da
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000da09
push ebx
push 0x799
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x2e8], 0xffffffef
jmp 0x1000daa5
push 3
lea ecx, [ebp - 0x820]
call fcn.1001ae5e
mov dword [ebp - 0x20], 0xd8cb4c23
mov dword [ebp - 0x18], ebx
jmp 0x1000da44
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x820]
mov dword [eax + ecx*4], 0x2bb11acc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000da31
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1000da94
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], ebx
jmp 0x1000da89
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000da83
push 0xf5e
push ebx
push ebx
push 0x2677
push ebx
push 0x25ad
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1000da62
dec dword [ebp - 0x20]
jns 0x1000da56
lea ecx, [ebp - 0x820]
call fcn.1001b9e4
inc dword [ebp - 0x2e8]
cmp dword [ebp - 0x2e8], 0x15
jl 0x1000da18
or eax, 0xffffffff
lea ecx, [ebp - 0x8ec]
mov dword [ebp - 4], eax
call fcn.1001b9e4
mov dword [ebp - 0x34], 0x1a
cmp dword [ebp - 0x34], 0xfffffff5
jg 0x1000e51e
or edi, 0xffffffff
push esi
lea ecx, [ebp - 0x1ec]
call fcn.1001ae5e
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], ebx
jmp 0x1000db03
cmp dword [ebp - 0x14], 3
jl 0x1000daf2
xor eax, eax
lea ecx, [ebp - 0x728]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], eax
push 3
call fcn.1001ae5e
mov eax, 0xbf495e3b
xor esi, esi
mov dword [ebp - 0x7a8], eax
inc esi
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x79c], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000e56f
cmp dword [ebp - 0x14], 3
jl 0x1000e55c