Function at 0x1000d9b5
Capabilities:
Check os version
Delete file
Delete registry value
Extract resource via kernel32 functions
Get memory capacity
Get thread local storage value
Identify system language via api
Query environment variable
Query or enumerate registry key
Set registry value
Terminate process

Disassembly:
mov eax, 0x10065850
call fcn.100651e0
sub esp, 0x968
push ebx
push esi
mov dword [ebp - 0x38], 0x4ad8
cmp dword [ebp - 0x38], 0x4de4
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x6c], dl
mov dword [ebp - 0x58], ecx
jle 0x1000da65
xor eax, eax
mov esi, eax
jmp 0x1000d9ed
xor eax, eax
mov edi, eax
jmp 0x1000d9f3
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x1000d9fc
xor eax, eax
mov dword [ebp - 0x30], eax
xor ebx, ebx
add ecx, eax
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x800]
xor eax, esi
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000da21
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x800]
call fcn.1001d982
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x4878
jl 0x1000da01
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x761b
jl 0x1000d9fa
inc edi
cmp edi, 0x4510
jl 0x1000d9f1
inc esi
cmp esi, 0x42a3
jl 0x1000d9eb
xor edi, edi
mov dword [ebp - 0x60], 0x1006d5cc
inc edi
cmp dword [ebp - 0x38], 0x47e0
jge 0x1000da83
push 0x10007670
call fcn.10050266
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x308]
push edi
call fcn.1001d532
push 3
pop esi
push esi
lea ecx, [ebp - 0x5b0]
mov dword [ebp - 4], 2
call fcn.1001d532
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x50], 0x96f8f9ed
mov dword [ebp - 0x50], 0x9ec0021f
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], edi
jge 0x1000dae7
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x308]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000dad3
mov dword [ebp - 0x14], 0
jmp 0x1000db03
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5b0]
mov dword [eax + ecx*4], 0x65b49d58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000daf0
mov eax, dword [ebp - 0x308]
xor ebx, ebx
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000db23
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x5b0]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x308]
call fcn.1001d5b4
push edi
lea ecx, [ebp - 0x434]
call fcn.1001d532
push esi
lea ecx, [ebp - 0x644]
mov dword [ebp - 4], 4
call fcn.1001d532
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x50], 0x96f8f9ed
mov dword [ebp - 0x50], 0x9ec0021f
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], edi
jge 0x1000db9a
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x434]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000db86
mov dword [ebp - 0x14], 0
jmp 0x1000dbb6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x644]
mov dword [eax + ecx*4], 0x65b49d58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000dba3
mov eax, dword [ebp - 0x434]
xor ebx, ebx
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000dbd6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x644]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.1001d5b4
push edi
lea ecx, [ebp - 0xe0]
call fcn.1001d532
push 2
pop edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xceef
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jge 0x1000dc25
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000dc13
mov dword [ebp - 0x14], 0
jmp 0x1000dc41
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0x3f4f46db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000dc2e
mov eax, dword [ebp - 0xe0]
xor ebx, ebx
mov dword [eax], edx
mov eax, dword [eax]
mov dword [ebp - 0x2c], 0xcbfcf419
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp + eax*4 - 0xf8], ebx
jne 0x1000dce7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xe0]
imul eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x14]
imul edx, eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x18]
jne 0x1000dcb1
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov edx, dword [ebp - 0xe0]
cmp dword [edx], eax
sete cl
sub ecx, 0x508d4a8e
je 0x1000dcde
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf8]
cmp eax, 0x5d872073
mov eax, dword [ebp - 0xe0]
sete cl
mov dword [ebp - 0x2c], ecx
dec dword [eax]
jns 0x1000dc50
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000dd9f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1000dd7c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000dd62
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], bl
je 0x1000dd9c
push 0x150e
push 0xe30
push eax
push 0x413
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1000dd5a
lea ecx, [ebp - 0xe0]
call fcn.1001d5b4
mov dword [ebp - 0x20], 0x824a8c6a
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x28], 0x4100
cmp dword [ebp - 0x28], 0x4282
jle 0x1000de11
xor edi, edi
mov dword [ebp - 0x30], edi
xor esi, esi
mov eax, edi
mov edi, 0x68c
cdq
idiv esi
mov ebx, edx
mov eax, ebx
mov ecx, 0x1060f618
cdq
push edx
push eax
call fcn.1001d301
inc ebx
dec edi
jne 0x1000dde0
mov edi, dword [ebp - 0x30]
inc esi
cmp esi, 0x1532
jl 0x1000ddd4
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x1184
jl 0x1000ddd2
xor edi, edi
push 3
inc edi
pop esi
mov dword [ebp - 0x14], 0
jmp 0x1000de2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x684], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000de1a
mov dword [ebp - 4], 6
cmp dword [ebp - 0x28], 0x3e7b
jge 0x1000de50
mov edx, 0x100076e8
mov ecx, 0x1060f618
call fcn.1001f80c
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000de76
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8fc], 0x5156
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000de5e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff5
je 0x1000dfc2
jmp 0x1000deaf
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x18], eax
jmp 0x1000decc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], 0x8900fdb6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000debb
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x150], 0
jne 0x1000deef
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14c], 0xe328
je 0x1000df07
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x1000df09
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x150]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
sub eax, edx
je 0x1000df4a
mov dword [ebp - 0x2c], 0xed383de4
mov dword [ebp - 0x48], 0xe0fa1a8f
cmp dword [ebp - 0x14c], 0
jne 0x1000dfc2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
jmp 0x1000dfb5
mov dword [ebp - 0x30], 0x1bd53d2a
mov dword [ebp - 0x2c], 0xab0c3e5f
cmp dword [ebp - 0x20], 0
je 0x1000df79
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
mov dword [ebp - 0x684], edx
test edx, edx
je 0x1000df79
mov edx, edi
jmp 0x1000df7b
xor edx, edx
mov eax, dword [ebp - 0x150]
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x150]
setl cl
xor edx, edx
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x1c5adf85
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jne 0x1000dead
mov dword [ebp - 0x30], 0x40cc74bf
lea ecx, [ebp - 0x1f0]
push edi
call fcn.1001d532
push edi
lea ecx, [ebp - 0x564]
mov dword [ebp - 4], 8
call fcn.1001d532
push 2
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 9
call fcn.1001d532
mov dword [ebp - 0x2c], 0xba4d3ec9
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x14], 0
jmp 0x1000e01f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x564]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e010
mov dword [ebp - 0x14], 0
jmp 0x1000e040
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d8]
mov dword [eax + ecx*4], 0x1f2c29a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e02d
mov eax, dword [ebp - 0x1d8]
xor ebx, ebx
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000e062
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x1d8]
dec dword [eax]
jns 0x1000e050
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1d8]
mov dword [eax], ecx
lea ecx, [ebp - 0x1d8]
call fcn.1001d5b4
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 8
call fcn.1001d5b4
push esi
lea ecx, [ebp - 0x374]
call fcn.1001d532
push 4
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0xa
call fcn.1001d532
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000e0d5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x140], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e0c1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000e0f9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x32c]
mov dword [eax + ecx*4], 0xe83c773
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000e0de
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000e11a
push eax
push 0x2378
push 0x9bd
push 0x1faf
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
mov esi, dword [ebp - 0x32c]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x140]
mov eax, dword [esi + 0xc]
mov dword [ebp + eax*4 - 0x140], ecx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000e145
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
dec dword [esi + 0xc]
jns 0x1000e123
lea ecx, [ebp - 0x32c]
call fcn.1001d5b4
mov dword [ebp - 0x30], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x18], 0xe6768459
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000e18a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x67c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e175
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000e1ac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x230], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e193
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000e1ea
push 0x1a4d
push 0x1c22
push 0x15b2
push 0x17f7
push 0xfec
push 0x1e71
push 0x2490
push 0x221f
push 0xdc1
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov dword [ebp - 0x230], eax
jmp 0x1000e347
mov dword [ebp - 0x14], 0x54fddd3f
mov dword [ebp - 0x20], 0x2542
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1000e2b6
mov dword [ebp - 0x28], 0xc3d4e703
lea ecx, [ebp - 0x4c4]
push 3
call fcn.1001d532
mov dword [ebp - 0x18], 0
jmp 0x1000e23c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000e22d
cmp dword [ebp - 0x28], 0
jne 0x1000e260
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edi
setl cl
imul eax, ecx, 0xa47c
test eax, eax
jne 0x1000e260
xor ebx, ebx
jmp 0x1000e262
mov ebx, edi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x67c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x67c], edx
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c4]
imul ecx, edx
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x4c4]
call fcn.1001d5b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1000e210
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000e337
mov dword [ebp - 0x28], 0x8a99
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], 0xffffffe4
cmp dword [ebp - 0x14], eax
jl 0x1000e334
mov dword [ebp - 0x2c], 0x2046
cmp dword [ebp - 0x18], eax
je 0x1000e322
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, 0x2c6eb81f
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x1000e309
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x1000e30b
mov ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x2812
jg 0x1000e320
mov ecx, edi
jmp 0x1000e324
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
push 0
pop eax
jns 0x1000e2d5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jg 0x1000e2bb
inc dword [ebp - 0x230]
cmp dword [ebp - 0x230], 2
jle 0x1000e1f5
mov dword [ebp - 0x30], 0x96f8f9ed
mov dword [ebp - 0x18], 0x399841b3
mov dword [ebp - 0x2c], 0xd538770c
mov dword [ebp - 0x50], 0x332e0c28
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0xa227283a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
je 0x1000e52e
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x54], 0xd0657689
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x24], eax
je 0x1000e4f6
push edi
lea ecx, [ebp - 0x5dc]
call fcn.1001d532
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x30], 0x72b416c2
mov dword [ebp - 0x40], 0
jmp 0x1000e3db
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5dc]
mov dword [eax + ecx*4], 0x9c14
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x1000e3c8
mov dword [ebp - 0x24], 0
jmp 0x1000e4cf
mov dword [ebp - 0x40], 0x33c63384
mov dword [ebp - 0x40], 0x1a
jmp 0x1000e4c2
mov dword [ebp - 0x20], 0x42b48371
lea ecx, [ebp - 0x344]
push 3
call fcn.1001d532
mov dword [ebp - 0x44], 0
jmp 0x1000e42f
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x344]
mov dword [eax + ecx*4], 0x30688cdf
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x1000e41c
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
jl 0x1000e451
mov dword [ebp - 0x54], 0x34c865b4
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
jns 0x1000e442
mov dword [ebp - 0x20], 0xfffffff9
jmp 0x1000e4ae
mov dword [ebp - 0x30], 0xad901516
cmp dword [ebp - 0x20], 0
jne 0x1000e482
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000e47b
mov ecx, edi
cmp dword [ebp - 0x40], eax
jne 0x1000e47d
mov ecx, eax
cmp ecx, dword [ebp - 0x30]
je 0x1000e484
mov eax, edi
mov ecx, dword [ebp - 0x18]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x344]
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jle 0x1000e45a
lea ecx, [ebp - 0x344]
call fcn.1001d5b4
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffee
jl 0x1000e3ff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
jge 0x1000e3ec
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x5dc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xa
call fcn.1001d5b4
jmp 0x1000e51e
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], 0xe45a9172
mov dword [ebp - 0x40], eax
jmp 0x1000e516
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x628], 0xfffffffb
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x1000e505
inc dword [ebp - 0x30]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
push 0
pop eax
jne 0x1000e387
mov dword [ebp - 0x30], 0x5261
cmp dword [ebp - 0x30], 0x550c
jle 0x1000e582
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ebx, ebx
xor edi, edi
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1060f618
xor eax, ebx
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x4334
jl 0x1000e54f
inc edi
cmp edi, 0x7148
jl 0x1000e54d
inc ebx
cmp ebx, 0x54d9
jl 0x1000e54b
xor edi, edi
inc edi
mov dword [ebp - 0x38], 0x9ec0021f
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x30], 0x50d5
jge 0x1000e5a5
mov edx, 0x1000775c
mov ecx, 0x1060f618
call fcn.1001f80c
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x18], 0x80d4
mov dword [ebp - 0x28], 0x71808adc
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x48], 0xc25c5395
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000e601
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44c], 0x8700d35d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e5e8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000e621
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e609
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xa
jge 0x1000e6e8
mov dword [ebp - 0x30], 0x68b6
cmp dword [ebp - 0x30], 0x6ae6
jle 0x1000e68c
mov edi, eax
mov esi, eax
xor ebx, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x95c]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e662
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x95c]
call fcn.1001d982
inc esi
cmp esi, 0x5c95
jl 0x1000e644
inc edi
push 0
pop eax
cmp edi, 0x630f
jl 0x1000e640
mov byte [ebp - 0x31], al
cmp dword [ebp - 0x30], 0x6549
jge 0x1000e6a5
push 0x100077b0
call fcn.10050266
pop ecx
xor eax, eax
mov dword [ebp - 4], 0xa
cmp byte [ebp - 0x31], 0
je 0x1000e6ba
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
inc dword [ebp - 0x40]
xor eax, eax
jmp 0x1000e624
mov eax, dword [ebp - 0x40]
xor edi, edi
inc edi
mov dword [ebp - 0x444], edi
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
neg edx
sub edx, 0xb07d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
mov dword [ebp - 0x174], edx
test edx, edx
jne 0x1000e72d
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x18]
dec eax
je 0x1000e739
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44c]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete bl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x40], edx
xor edx, edx
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setg dl
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x48]
jne 0x1000e86b
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000e860
mov dword [ebp - 0x38], 0x5fbb
cmp dword [ebp - 0x38], 0x6025
jle 0x1000e818
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor esi, esi
mov dword [ebp - 0x28], esi
mov ebx, esi
mov dword [ebp - 0x30], 0x45ca
mov edi, ebx
mov esi, 0x45d5
mov eax, edi
mov ecx, 0x1060f618
cdq
push edx
push eax
call fcn.1001d301
dec edi
dec esi
jne 0x1000e7d3
dec ebx
dec dword [ebp - 0x30]
jne 0x1000e7cc
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x3a0b
jl 0x1000e7c3
xor eax, eax
push eax
push 0x19c0
push eax
push eax
push 0x680
push 0xd6e
call dword [sym.imp.USER32.dll_ToAsciiEx]
xor edi, edi
inc edi
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x38], 0x5bea
jge 0x1000e859
mov edx, 0x100077f8
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1000e859
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
jmp 0x1000e91c
mov dword [ebp - 0x28], 0xd0e
cmp dword [ebp - 0x28], 0x1021
jle 0x1000e8ca
xor esi, esi
xor edi, edi
mov dword [ebp - 0x30], 0x2453
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x794]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e8a2
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x794]
call fcn.1001d982
add edi, esi
dec dword [ebp - 0x30]
jne 0x1000e888
inc esi
cmp esi, 0x6d23
jl 0x1000e87d
xor edi, edi
inc edi
mov byte [ebp - 0x31], 0
cmp dword [ebp - 0x28], 0xb1a
jge 0x1000e8e2
push 0x1000785c
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0xa
cmp byte [ebp - 0x31], 0
je 0x1000e8fa
push 0x7c6
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000e91c
push eax
push 0x19c0
push eax
push eax
push 0x680
push 0xd6e
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x30], 0x439beb06
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x50], 0x265ab3e9
push edi
call fcn.1001d532
mov dword [ebp - 0x2c], 0x1bc383c6
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x40], 0x813bf58a
mov dword [ebp - 0x28], 0x8cbdb62b
mov dword [ebp - 0x14], 0
jmp 0x1000e96e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x654]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e95b
mov dword [ebp - 0x14], 0
jmp 0x1000e98d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], 0x1ded
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e97c
dec dword [ebp - 0x40]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
imul ecx, eax
mov eax, dword [ebp - 0x114]
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x30]
jg 0x1000e9f4
mov dword [ebp - 0x40], 5
cmp dword [ebp - 0x40], 0x11
jge 0x1000ea20
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000e9e9
push eax
push 0x13ca
push eax
push 0xca0
push eax
push 0x26b6
call dword [sym.imp.USER32.dll_DrawTextExW]
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x11
jl 0x1000e9c6
jmp 0x1000ea20
mov dword [ebp - 0x50], 0xa1d2
imul eax, dword [ebp - 0x2c], 7
test eax, eax
je 0x1000ea0f
mov dword [ebp - 0x50], 0xffffffff
inc dword [ebp - 0x28]
jmp 0x1000ea20
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000ea20
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea ecx, [ebp - 0x654]
call fcn.1001d5b4
mov dword [ebp - 0x14], 0
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jge 0x1000ea4a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1f0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
jmp 0x1000ea34
push 2
lea ecx, [ebp - 0x134]
call fcn.1001d532
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x14], ebx
push 2
call fcn.1001d532
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x30], 0x719efcc7
mov dword [ebp - 0x3c], 0
jmp 0x1000ea8d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x68], 0x4a8c6a53
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1000ea7f
mov dword [ebp - 0x3c], 0
jmp 0x1000eaae
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x16df251d
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1000ea9b
mov dword [ebp - 0x3c], 0
jmp 0x1000ead0
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x244]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1000eabd
mov eax, dword [ebp - 0x134]
xor ebx, ebx
mov dword [eax], ebx
push 3
lea ecx, [ebp - 0x35c]
call fcn.1001d532
mov dword [ebp - 0x18], ebx
jmp 0x1000eb05
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x35c]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000eaf2
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x35c]
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, edi
mov eax, dword [ebp - 0x244]
setne cl
xor edx, edx
cmp ecx, 0x2397bde5
setl dl
mov dword [eax], edx
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000eb99
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
lea ecx, [ebp - 0x35c]
call fcn.1001d5b4
mov eax, dword [ebp - 0x134]
inc dword [eax]
cmp dword [eax], ebx
jle 0x1000eae0
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1000ec25
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x30], 0xfffffff7
xor ecx, ecx
mov dword [ebp - 0x2c], 0x506546d7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
test eax, eax
mov eax, dword [ebp - 0x244]
mov dword [edx + 4], 0x8487
setne cl
mov dword [eax], 0x8487
mov dword [ebp - 0x30], 0x8487
mov eax, dword [ebp - 0x30]
imul eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1000ebc4
lea ecx, [ebp - 0x244]
call fcn.1001d5b4
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0xa
call fcn.1001d5b4
mov dword [ebp - 0x40], 0x6d5f
cmp dword [ebp - 0x40], 0x6eb8
jle 0x1000ecb2
xor eax, eax
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x38], 0x4a3d
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov ebx, 0x7123
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1060f618
cdq
push edx
push eax
call fcn.1001d301
dec edi
dec ebx
jne 0x1000ec6f
mov ebx, dword [ebp - 0x30]
dec ebx
dec dword [ebp - 0x38]
mov dword [ebp - 0x30], ebx
jne 0x1000ec68
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6058
jl 0x1000ec59
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x721a
jl 0x1000ec54
xor edi, edi
inc edi
mov dword [ebp - 0x14], 0
jmp 0x1000ecce
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0x65b49d58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000ecbb
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x40], 0x6d2d
jge 0x1000ecf0
mov edx, 0x10007878
mov ecx, 0x1060f618
call fcn.1001f80c
xor eax, eax
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1f0]
mov dword [ecx], eax
cmp dword [ecx], 0xfffffff6
jge 0x1000f164
mov dword [ebp - 0x28], 0x6be0
cmp dword [ebp - 0x28], 0x6d8d
jle 0x1000ed47
mov edi, eax
mov esi, eax
mov eax, edi
mov ecx, 0x1060f618
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x3488
jl 0x1000ed1e
inc edi
push 0
pop eax
cmp edi, 0x5e49
jl 0x1000ed1c
mov dword [ebp - 0x30], 0x48ab
cmp dword [ebp - 0x30], 0x4b9d
jle 0x1000ed95
push 0x1576
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + ebx]
mov ecx, 0x1060f618
and eax, esi
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x3943
jl 0x1000ed68
inc edi
cmp edi, 0x2125
jl 0x1000ed66
inc ebx
cmp ebx, 0x6305
jl 0x1000ed64
push 2
lea ecx, [ebp - 0x5f4]
call fcn.1001d532
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x30], 0x47a0
jge 0x1000edbe
mov edx, 0x10007968
mov ecx, 0x1060f618
call fcn.1001f80c
mov dword [ebp - 4], 0x18
xor eax, eax
xor edi, edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
inc edi
cmp dword [ebp - 0x18], 2
jge 0x1000edf1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5f4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000edda
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000ee48
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000ee45
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1000ee34
lea ecx, [ebp - 0x5f4]
call fcn.1001d5b4
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x28], 0x6807
jge 0x1000ee93
mov edx, 0x10007900
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1000ee93
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x18], 9
push edi
call fcn.1001d532
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff8
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000eece
push eax
push 0x12ab
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x40], 3
jmp 0x1000ef2e
push edi
lea ecx, [ebp - 0x25c]
call fcn.1001d532
mov dword [ebp - 0x24], 0
jmp 0x1000eeff
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x25c]
mov dword [eax + ecx*4], 0x97eede0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000eeec
mov eax, dword [ebp - 0x25c]
xor ebx, ebx
mov dword [eax], ebx
cmp dword [ebp - 0x40], ebx
jne 0x1000ef20
mov eax, dword [ebp - 0x25c]
dec dword [eax]
cmp dword [eax], 0xffffffff
jg 0x1000ef0e
lea ecx, [ebp - 0x25c]
call fcn.1001d5b4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x1c
je 0x1000eed7
mov dword [ebp - 0x30], 8
xor ebx, ebx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x40], 0xec2e0cf5
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x40], ebx
jmp 0x1000ef61
mov dword [ebp - 0x2c], 0x2bb11acc
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x14
jg 0x1000ef57
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000ef81
push ebx
push 0x1414
push 0x109f
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x40], ebx
jmp 0x1000ef95
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2f0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x1000ef86
mov dword [ebp - 0x14], 0xfffffff8
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], 0xfffffff6
push edi
call fcn.1001d532
mov dword [ebp - 0x30], 0x806aa1c3
mov dword [ebp - 0x30], 0x2b607800
mov dword [ebp - 0x20], ebx
jmp 0x1000efe1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50c]
mov dword [eax + ecx*4], 0xe2de4bf7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000efce
mov dword [ebp - 0x20], ebx
jmp 0x1000eff8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x638], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000efeb
cmp dword [ebp - 0x14], ebx
je 0x1000f05c
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x44], 0x88a97331
mov dword [ebp - 0x2c], 0xffffffff
push 2
call fcn.1001d532
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x1e
movdqa xmm0, xmmword [0x1000c4f0]
lea eax, [ebp - 0x690]
push ecx
push eax
push ecx
mov dword [ebp - 0x28], 2
lea ecx, [ebp - 0x690]
movdqu xmmword [ebp - 0x6a0], xmm0
call fcn.1001d58e
mov dword [ebp - 0x48], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x30], 0xfffa
mov dword [ebp - 0x2c], 0xeb256cd2
mov dword [ebp - 0x40], ebx
jmp 0x1000f1e9
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2a4]
mov dword [eax + ecx*4], 0x9e62b560
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x1000f1d6
cmp dword [ebp - 0x18], ebx
je 0x1000f1ff
mov eax, dword [ebp - 0x690]
mov ecx, edi
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, 0xc3f406f6
setg dl
sub eax, edx
cmp eax, dword [ebp - 0x44]
jl 0x1000f21e
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2a4]
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x28], 0xf3b
cmp eax, 0xfffffff6
setl cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x690]
call fcn.1001d5b4
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 0xa
call fcn.1001d5b4
mov dword [ebp - 0x18], 0x4cf4
cmp dword [ebp - 0x18], 0x4d16
jle 0x1000f2d7
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov edi, esi
mov dword [ebp - 0x30], 0x3e53
mov esi, dword [ebp - 0x28]
mov eax, esi
lea ecx, [ebp - 0x8d8]
or eax, edi
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f29c
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8d8]
call fcn.1001d982
dec edi
dec dword [ebp - 0x30]
jne 0x1000f280
mov esi, dword [ebp - 0x38]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x452c
jl 0x1000f274
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x7469
jl 0x1000f26f
xor edi, edi
inc edi
cmp dword [ebp - 0x18], 0x4966
jge 0x1000f2eb
push 0x100079f8
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], 0x94801897
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], 0x3a0
cmp dword [ebp - 0x38], 0x558
jle 0x1000f382
push ebx
push 0x203
push 0x14db
push 0x19f3
push 0x24b4
push 0x140
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
cdq
mov esi, ebx
idiv edi
mov edi, edx
mov eax, edi
mov ecx, 0x1060f618
xor eax, esi
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x922
jl 0x1000f348
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x77fb
jl 0x1000f341
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x7640
jl 0x1000f33c
xor edi, edi
inc edi
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x38], 0x393
jge 0x1000f3bf
mov edx, 0x10007a20
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1000f3bf
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], ebx
jmp 0x1000f3d8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000f3cb
dec dword [ebp - 0x14]
mov dword [ebp - 0x24], 0x16
cmp dword [ebp - 0x24], 0xffffffe8
jne 0x1000f786
mov dword [ebp - 0x20], 0xa1f05067
mov dword [ebp - 0x2c], 0x948214d2
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x38], 0x3c6
cmp dword [ebp - 0x38], 0x54a
jle 0x1000f4aa
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
cdq
mov esi, ebx
idiv edi
mov edi, ecx
mov ecx, edx
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x854]
or eax, esi
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f451
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x854]
call fcn.1001d982
inc esi
cmp esi, 0x6f0e
jl 0x1000f435
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
inc edi
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
cmp edi, 0x4323
jl 0x1000f42a
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4913
jl 0x1000f425
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x65e4
jl 0x1000f420
push ebx
push 0x19f5
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor edi, edi
inc edi
mov dword [ebp - 0x18], 0x657cf7a0
cmp dword [ebp - 0x38], 0x2d8
jge 0x1000f4c5
push 0x10007a98
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 0xfffffffe
je 0x1000f599
mov dword [ebp - 0x30], 0x3575
cmp dword [ebp - 0x30], 0x3824
jle 0x1000f530
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x92c]
or eax, edi
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f509
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x92c]
call fcn.1001d982
inc esi
cmp esi, 0x4b6c
jl 0x1000f4ed
inc edi
cmp edi, 0x35f6
jl 0x1000f4eb
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 0x30], 0x31dc
jge 0x1000f54b
push 0x10007af0
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0xa
xor edi, edi
mov dword [ebp - 0x28], 0xe0cd1b7e
xor ecx, ecx
mov eax, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, edi
setl cl
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x3c]
jmp 0x1000f4cf
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edi
jg 0x1000f77e
push edi
lea ecx, [ebp - 0x274]
call fcn.1001d532
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x40], ebx
jmp 0x1000f5cd
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], 0xee8c4b05
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x1000f5ba
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], ebx
jl 0x1000f767
mov dword [ebp - 0x28], 0x116e
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], edi
jg 0x1000f75f
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1000f689
mov dword [ebp - 0x28], 0x1951
cmp dword [ebp - 0x28], 0x1d12
jle 0x1000f662
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x30], 0x3181
mov eax, edi
lea ecx, [ebp - 0x884]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f63a
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x884]
call fcn.1001d982
add edi, esi
dec dword [ebp - 0x30]
jne 0x1000f620
inc esi
cmp esi, 0x69e0
jl 0x1000f617
xor edi, edi
inc edi
push ebx
push 0x1e41
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [ebp - 0x28], 0x15f5
jge 0x1000f682
push 0x10007b54
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x20], ebx
jmp 0x1000f74e
mov dword [ebp - 0x14], ebx
jmp 0x1000f742
mov eax, dword [ebp - 0x18]
xor edx, edx
mov esi, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x274]
imul esi, dword [eax]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x14]
sub esi, eax
mov eax, dword [ebp - 0x14]
cmp ecx, esi
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc4]
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
add eax, 0x4669cc0
je 0x1000f6e3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x274]
cmp dword [eax], ebx
je 0x1000f6f0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
mov dword [ebp - 0xc4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1000f699
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1000f691
inc dword [ebp - 0x40]
jmp 0x1000f5e8
dec dword [ebp - 0x3c]
jmp 0x1000f5d5
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0xa
call fcn.1001d5b4
inc dword [ebp - 0x18]
jmp 0x1000f59c
dec dword [ebp - 0x24]
jmp 0x1000f3e8
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x24], 0x3401
cmp dword [ebp - 0x24], 0x3658
jle 0x1000f81e
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 0x2a05
mov edi, dword [ebp - 0x28]
mov esi, ebx
mov dword [ebp - 0x30], 0xd76
mov eax, ecx
mov ecx, esi
shl eax, cl
lea ecx, [ebp - 0x7ac]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f7d9
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7ac]
call fcn.1001d982
mov ecx, dword [ebp - 0x18]
add esi, edi
dec dword [ebp - 0x30]
jne 0x1000f7bb
mov edi, dword [ebp - 0x40]
add dword [ebp - 0x28], edi
dec dword [ebp - 0x38]
jne 0x1000f7af
inc edi
mov dword [ebp - 0x40], edi
cmp edi, 0x54fd
jl 0x1000f7a5
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x800a
jl 0x1000f7a2
xor edi, edi
inc edi
push 4
lea ecx, [ebp - 0x60c]
call fcn.1001d532
cmp dword [ebp - 0x24], 0x31ff
jge 0x1000f83f
push 0x10007b74
call fcn.10050266
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x1000f865
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000f852
mov dword [ebp - 0x18], ebx
jmp 0x1000f88a
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1000f887
push ebx
push 0x1f7a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1000f870
lea ecx, [ebp - 0x60c]
call fcn.1001d5b4
cmp byte [ebp - 0x19], 0
je 0x1000fc20
mov dword [ebp - 0x28], 0x78a4
cmp dword [ebp - 0x28], 0x7bd7
jle 0x1000f8df
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x30], 0x11c2
mov eax, edi
mov ecx, 0x1060f618
cdq
push edx
push eax
call fcn.1001d301
add edi, esi
dec dword [ebp - 0x30]
jne 0x1000f8c0
inc esi
cmp esi, 0x3130
jl 0x1000f8b7
mov byte [ebp - 4], 0x2c
cmp dword [ebp - 0x28], 0x7637
jge 0x1000f919
mov edx, 0x10007ba8
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1000f919
mov dword [ebp - 4], 0xa
xor edi, edi
mov dword [ebp - 0x3c], 3
inc edi
mov dword [ebp - 0x20], 0xffbefa5f
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000f94e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0x574b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000f940
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov esi, 0xaa53f0d3
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp esi, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
mov edx, 0xffff1f04
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 7
cmp ecx, 0xa71a
setle al
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
je 0x1000fb1b
mov dword [ebp - 0x2c], 0x27420ea1
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000fc19
mov dword [ebp - 0x18], 0x630971cf
mov dword [ebp - 0x30], 0x70c5
cmp dword [ebp - 0x30], 0x745a
jle 0x1000fa53
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], ebx
jg 0x1000fc19
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1000fc11
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x374]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.1001d5b4
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], 0xc44
cmp dword [ebp - 0x38], 0xeb2
jle 0x1000fccc
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
lea esi, [edi + eax]
mov edi, 0x7cc
add esi, ecx
mov eax, esi
lea ecx, [ebp - 0x7c4]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fc84
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7c4]
call fcn.1001d982
dec esi
dec edi
jne 0x1000fc6a
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
inc edi
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
cmp edi, 0x2364
jl 0x1000fc60
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0xd4f
jl 0x1000fc5b
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x5140
jl 0x1000fc56
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0xffbefa5f
cmp dword [ebp - 0x38], 0x973
jge 0x1000fce7
push 0x10007c78
call fcn.10050266
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000fd08
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0x574b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000fcfa
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov edi, 0xaa53f0d3
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp edi, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
mov edx, 0xffff1f04
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 7
cmp ecx, 0xa71a
setle al
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
je 0x1000fe3f
mov dword [ebp - 0x2c], 0x27420ea1
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000fe95
mov dword [ebp - 0x18], 0x630971cf
mov dword [ebp - 0x20], ebx
jmp 0x1000fdcb
mov dword [ebp - 0x3c], ebx
jmp 0x1000fe90
cmp dword [ebp - 0x3c], ebx
jle 0x1000fe44
xor esi, esi
lea ecx, [ebp - 0xec]
inc esi
push esi
call fcn.1001d532
push 2
mov dword [ebp - 4], 0x34
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0xceef
mov dword [ebp - 0x14], ebx
jmp 0x1000feca