Function at 0x1000ddb9
Capabilities:
Connect pipe
Create thread
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1488
call fcn.10079790
push esi
push edi
mov dword [ebp - 0x1a8], 0xfffa
mov dword [ebp - 0xd28], 0x2971c1e
mov dword [ebp - 0x348], 0
jmp 0x1000ddf5
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jge 0x1000de11
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x1380], 0x8114
jmp 0x1000dde8
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0x1a8], 0
jmp 0x1000de36
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1000de52
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x1380], 0x39ed
jmp 0x1000de29
mov dword [ebp - 0x1b4], 0xfffa
mov dword [ebp - 0xe40], 0x2971c1e
mov dword [ebp - 0x350], 0
jmp 0x1000de7f
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x1000de9b
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x1410], 0x8114
jmp 0x1000de72
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0x1b4], 0
jmp 0x1000dec0
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x1000dedc
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x1410], 0x39ed
jmp 0x1000deb3
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x3f0], 0xd52a2848
mov dword [ebp - 0xc2c], 0xdf860956
mov dword [ebp - 0xe58], 4
mov dword [ebp - 0x8c], 0
jmp 0x1000df1d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000df39
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x374], 1
jmp 0x1000df10
mov dword [ebp - 0x8c], 0
jmp 0x1000df52
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000df6e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xe48], 0xc0d133f2
jmp 0x1000df45
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x374]
cmp dword [ebp + eax - 0x374], ecx
je 0x1000df96
mov dword [ebp - 0xc3c], 1
jmp 0x1000df9d
and dword [ebp - 0xc3c], 0
mov dword [ebp - 0x3f8], 5
mov eax, dword [ebp - 0x3f8]
dec eax
jne 0x1000dfd9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x374], 0
jne 0x1000dfd9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x374], 0
jne 0x1000dfd9
and dword [ebp - 0xb08], 0
jmp 0x1000dfe3
mov dword [ebp - 0xb08], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
sub eax, dword [ebp - 0xb08]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x374]
cmp eax, 8
ja 0x1000e014
mov dword [ebp - 0xc1c], 1
jmp 0x1000e01b
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0xc1c]
add eax, 4
jne 0x1000e038
mov eax, 0x8112def9
test eax, eax
jne 0x1000e038
and dword [ebp - 0x390], 0
jmp 0x1000e042
mov dword [ebp - 0x390], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0xe48], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x390]
sub ecx, dword [ebp + eax - 0x374]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x374]
jl 0x1000e083
mov dword [ebp - 0xc24], 1
jmp 0x1000e08a
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xc2c], eax
cmp dword [ebp - 0xc2c], 2
jle 0x1000e0b7
mov dword [ebp - 0xc34], 1
jmp 0x1000e0be
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xffffffff
jl 0x1000e0d3
mov dword [ebp - 0xe50], 1
jmp 0x1000e0da
and dword [ebp - 0xe50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
mov dword [ebp - 0x10d4], eax
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0xc3c], eax
jl 0x1000e107
mov dword [ebp - 0xc44], 1
jmp 0x1000e10e
and dword [ebp - 0xc44], 0
cmp dword [ebp - 0xc44], 0xdfe9
jge 0x1000e126
mov dword [ebp - 0xc4c], 1
jmp 0x1000e12d
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc4c]
shl eax, 3
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0x3f8], 0x491d0b6b
mov dword [ebp - 0x1c0], 0xfffa
mov dword [ebp - 0xfc], 0xe229edca
mov dword [ebp - 0x1fc], 0xd5fba252
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x24], 0
jmp 0x1000e17e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000e194
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1d8], 0xdec9
jmp 0x1000e177
mov dword [ebp - 0x24], 0
jmp 0x1000e1a4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000e1ba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x13f8], 0xfffffffd
jmp 0x1000e19d
mov dword [ebp - 0x24], 0
jmp 0x1000e1ca
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000e1e0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf90], 0x46e9
jmp 0x1000e1c3
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1000e30d
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0xfc], 0xc657
jge 0x1000e20f
mov dword [ebp - 0xc54], 1
jmp 0x1000e216
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xc54], eax
jne 0x1000e230
mov dword [ebp - 0xc5c], 1
jmp 0x1000e237
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xc5c], eax
jle 0x1000e251
mov dword [ebp - 0xc64], 1
jmp 0x1000e258
and dword [ebp - 0xc64], 0
cmp dword [ebp - 0xc64], 0x3d3b
jl 0x1000e270
mov dword [ebp - 0xc6c], 1
jmp 0x1000e277
and dword [ebp - 0xc6c], 0
imul eax, dword [ebp - 0xc6c], 0xe7ad
cmp eax, dword [ebp - 0xfc]
je 0x1000e295
mov dword [ebp - 0xc74], 1
jmp 0x1000e29c
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xc74], eax
je 0x1000e2b6
mov dword [ebp - 0xc7c], 1
jmp 0x1000e2bd
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xc7c], eax
jge 0x1000e2d7
mov dword [ebp - 0xe60], 1
jmp 0x1000e2de
and dword [ebp - 0xe60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0x1120], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d8], 0
je 0x1000e30d
mov dword [ebp - 0xc84], 1
jmp 0x1000e314
and dword [ebp - 0xc84], 0
cmp dword [ebp - 0xc84], 3
jb 0x1000e329
mov dword [ebp - 0xcb0], 1
jmp 0x1000e330
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
sub eax, 0x5d9f20c7
cmp eax, 0xc1d99ea5
jbe 0x1000e35a
mov dword [ebp - 0xb30], 1
jmp 0x1000e361
and dword [ebp - 0xb30], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb30]
sub ecx, dword [ebp + eax - 0x1d8]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x1d8]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x1d8]
jge 0x1000e39d
mov dword [ebp - 0xa34], 1
jmp 0x1000e3a4
and dword [ebp - 0xa34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp dword [ebp - 0xa34], eax
jge 0x1000e3c5
mov dword [ebp - 0x49c], 1
jmp 0x1000e3cc
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp dword [ebp - 0x49c], eax
jg 0x1000e3ed
mov dword [ebp - 0xa3c], 1
jmp 0x1000e3f4
and dword [ebp - 0xa3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp dword [ebp - 0xa3c], eax
jl 0x1000e415
mov dword [ebp - 0x4a4], 1
jmp 0x1000e41c
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xf30385d0
je 0x1000e601
mov dword [ebp - 0xe80], 0x5cf455db
mov dword [ebp - 0x1128], 0xc2657a77
mov dword [ebp - 0xe68], 0x7b249e3c
mov dword [ebp - 0xe78], 0x90538e0e
mov dword [ebp - 0x1130], 0xaa9b2235
mov dword [ebp - 0x234], 0
jmp 0x1000e477
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x1000e493
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x13b0], 0xc359
jmp 0x1000e46a
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1138], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x13b0], 0xd707
jle 0x1000e4bd
mov dword [ebp - 0xa44], 1
jmp 0x1000e4c4
and dword [ebp - 0xa44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf90]
inc eax
mov dword [ebp - 0x418], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x418]
mov dword [ebp + eax - 0xf90], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x418]
mov dword [ebp + eax - 0x13f8], ecx
mov eax, dword [ebp - 0xa44]
cmp eax, dword [ebp - 0x418]
jl 0x1000e565
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0x1148], eax
xor eax, eax
je 0x1000e53d
cmp dword [ebp - 0x1fc], 0
je 0x1000e53d
mov dword [ebp - 0x4ac], 1
jmp 0x1000e544
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp eax, dword [ebp - 0x4ac]
jl 0x1000e565
mov dword [ebp - 0xa4c], 1
jmp 0x1000e56c
and dword [ebp - 0xa4c], 0
cmp dword [ebp - 0xa4c], 0xffffffff
ja 0x1000e581
mov dword [ebp - 0xe70], 1
jmp 0x1000e588
and dword [ebp - 0xe70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x178], 0xbbb3
cmp dword [ebp - 0x178], 0x2bd6
jge 0x1000e5c6
cmp dword [ebp - 0x178], 0
je 0x1000e5c6
mov dword [ebp - 0x4b4], 1
jmp 0x1000e5cd
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
neg eax
cmp eax, dword [ebp - 0xe78]
jne 0x1000e5e9
mov dword [ebp - 0xa54], 1
jmp 0x1000e5f0
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xe80], eax
jmp 0x1000e7b8
mov dword [ebp - 0xa6c], 1
mov dword [ebp - 0x178], 0xffffffe8
jmp 0x1000e624
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffff3
jge 0x1000e7b8
mov dword [ebp - 0x4d4], 8
mov dword [ebp - 0x358], 0
mov dword [ebp - 0xe90], 0xffffffff
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0xa6c], 0
je 0x1000e674
xor eax, eax
je 0x1000e674
mov dword [ebp - 0x4bc], 1
jmp 0x1000e67b
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
imul ecx, dword [ebp - 0x4bc]
cmp dword [ebp + eax - 0xf90], ecx
jle 0x1000e6a3
mov dword [ebp - 0xe88], 1
jmp 0x1000e6aa
and dword [ebp - 0xe88], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d8], 0xffff
jne 0x1000e6c9
mov dword [ebp - 0xa5c], 1
jmp 0x1000e6d0
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xa5c], eax
jg 0x1000e6ea
mov dword [ebp - 0x4c4], 1
jmp 0x1000e6f1
and dword [ebp - 0x4c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp eax, dword [ebp - 0x4c4]
jg 0x1000e712
mov dword [ebp - 0xa64], 1
jmp 0x1000e719
and dword [ebp - 0xa64], 0
cmp dword [ebp - 0xa64], 0xfffffff7
jae 0x1000e72e
mov dword [ebp - 0x4cc], 1
jmp 0x1000e735
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x4cc], eax
jg 0x1000e751
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf90], 0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x358]
add eax, 0x19d465f
je 0x1000e77f
mov eax, 0x3bb8
test eax, eax
je 0x1000e77f
mov dword [ebp - 0xa74], 1
jmp 0x1000e786
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x4d4]
cmp dword [ebp - 0xa74], eax
jl 0x1000e7a0
mov dword [ebp - 0x4dc], 1
jmp 0x1000e7a7
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0xe90], eax
jmp 0x1000e617
mov dword [ebp - 0xf7c], 0x2971c1e
mov dword [ebp - 0x210], 0xfe0a8eac
mov dword [ebp - 0xea8], 0x4c90d297
mov dword [ebp - 0x1160], 0xfffffff8
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x1168], 0x790e8648
mov dword [ebp - 0x1170], 0xffffffff
mov dword [ebp - 0x1178], 0
mov dword [ebp - 0xf1c], 0x2038e85a
mov dword [ebp - 0x1180], 9
mov dword [ebp - 0x1188], 0xffffffff
mov dword [ebp - 0xea0], 0x9fe5
mov dword [ebp - 0x1190], 0xffffffff
mov dword [ebp - 0x1198], 0x74e80031
mov dword [ebp - 0x218], 0xfffffff6
mov dword [ebp - 0x428], 0x68451f1e
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0xe98], 0x3132d683
mov dword [ebp - 0xf14], 9
mov dword [ebp - 0x360], 0
jmp 0x1000e899
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jge 0x1000e8b5
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x13c8], 0x3588c556
jmp 0x1000e88c
mov dword [ebp - 0x210], 0
jmp 0x1000e8ce
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xd
jg 0x1000e8f1
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000e8ef
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x1000e8c1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x420], 0x3ca4d9a5
cmp dword [ebp - 0x420], 0
jne 0x1000e922
cmp dword [ebp - 0x420], 0
jne 0x1000e922
and dword [ebp - 0xa7c], 0
jmp 0x1000e92c
mov dword [ebp - 0xa7c], 1
mov eax, dword [ebp - 0xe98]
cmp dword [ebp - 0xa7c], eax
jle 0x1000e946
mov dword [ebp - 0xa8c], 1
jmp 0x1000e94d
and dword [ebp - 0xa8c], 0
xor eax, eax
inc eax
je 0x1000e967
cmp dword [ebp - 0xea0], 0
je 0x1000e967
mov dword [ebp - 0x4e4], 1
jmp 0x1000e96e
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
sub eax, dword [ebp - 0x218]
mov dword [ebp - 0xa84], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa84]
mov dword [ebp + eax - 0x13c8], ecx
cmp dword [ebp - 0xa84], 0xfff9
jne 0x1000e9ab
mov dword [ebp - 0x4ec], 1
jmp 0x1000e9b2
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0
jne 0x1000e9c7
mov dword [ebp - 0x4f4], 1
jmp 0x1000e9ce
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0xea8]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0xeb0]
cmp eax, dword [ebp - 0xeb8]
je 0x1000ea19
mov dword [ebp - 0xec0], 1
jmp 0x1000ea20
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xf14]
mov dword [ebp - 0x11a8], eax
cmp dword [ebp - 0xf1c], 0
je 0x1000ea58
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x1000ea53
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1000eade
mov dword [ebp - 0x218], 2
jmp 0x1000ea71
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffef
jge 0x1000eade
mov dword [ebp - 0x368], 0x11
jmp 0x1000ea93
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x14
jg 0x1000eadc
mov dword [ebp - 0x23c], 0
jmp 0x1000eab5
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x13
jle 0x1000eada
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1000ead8
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x1000eaa8
jmp 0x1000ea86
jmp 0x1000ea64
mov dword [ebp - 0x318], 0
jmp 0x1000eaf7
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 3
jge 0x1000eb13
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x13e0], 0x8114
jmp 0x1000eaea
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x440], 0xd8143836
mov dword [ebp - 0xf4], 0x9b4af7bd
mov dword [ebp - 0xf58], 0x5199242
mov dword [ebp - 0x244], 0
jmp 0x1000eb51
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x1000eb6d
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x1478], 0xffffffff
jmp 0x1000eb44
mov dword [ebp - 0x3c], 0
jmp 0x1000eb7d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x19
je 0x1000ef57
mov dword [ebp - 0x430], 2
mov dword [ebp - 0x438], 0x54dbbe5
mov dword [ebp - 0xe4], 0xffff
mov dword [ebp - 0x430], 0x81d2
cmp dword [ebp - 0x430], 0xd94b
je 0x1000ebc7
mov dword [ebp - 0xa9c], 1
jmp 0x1000ebce
and dword [ebp - 0xa9c], 0
cmp dword [ebp - 0x438], 0
jne 0x1000ec41
cmp dword [ebp - 0x438], 0xb541
jle 0x1000ebef
mov dword [ebp - 0xa94], 1
jmp 0x1000ebf6
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x440], eax
jne 0x1000ec1c
mov dword [ebp - 0xf24], 1
jmp 0x1000ec23
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x121c], eax
cmp dword [ebp - 0xe4], 4
jbe 0x1000ec41
and dword [ebp - 0x4fc], 0
jmp 0x1000ec4b
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x4fc]
imul eax, dword [ebp - 0x3c]
cmp eax, 1
je 0x1000ec69
mov dword [ebp - 0x504], 1
jmp 0x1000ec70
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0xa9c]
cmp eax, dword [ebp - 0x504]
jne 0x1000ec8a
mov dword [ebp - 0xaa4], 1
jmp 0x1000ec91
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xaa4], eax
jne 0x1000ecab
mov dword [ebp - 0x50c], 1
jmp 0x1000ecb2
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x50c], eax
jge 0x1000ecc9
mov dword [ebp - 0xaac], 1
jmp 0x1000ecd0
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0xe4]
je 0x1000ed09
cmp dword [ebp - 0x430], 0
je 0x1000ed04
jmp 0x1000ef57
jmp 0x1000ef38
mov dword [ebp - 0xad4], 0x9f3c5a4a
mov dword [ebp - 0xf74], 1
mov dword [ebp - 0x320], 0
jmp 0x1000ed36
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 4
jge 0x1000ed52
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0xf68], 0x6709e149
jmp 0x1000ed29
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
cmp dword [ebp - 0x3c], eax
jle 0x1000ed70
mov dword [ebp - 0x514], 1
jmp 0x1000ed77
and dword [ebp - 0x514], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
cmp eax, dword [ebp - 0x514]
jge 0x1000ed98
mov dword [ebp - 0xab4], 1
jmp 0x1000ed9f
and dword [ebp - 0xab4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf68], 0
jne 0x1000edc8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf68], 0
jne 0x1000edc8
and dword [ebp - 0xf2c], 0
jmp 0x1000edd2
mov dword [ebp - 0xf2c], 1
cmp dword [ebp - 0xab4], 0xffffffff
je 0x1000ede7
mov dword [ebp - 0x51c], 1
jmp 0x1000edee
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0xe4], 6
ja 0x1000ee0f
mov dword [ebp - 0xf34], 1
jmp 0x1000ee16
and dword [ebp - 0xf34], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf68]
mov dword [ebp - 0x1224], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
inc eax
inc eax
cmp eax, dword [ebp - 0xf58]
je 0x1000ee4b
mov dword [ebp - 0xf6c], 1
jmp 0x1000ee52
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x122c], eax
cmp dword [ebp - 0xf74], 0
je 0x1000ee70
mov dword [ebp - 0xabc], 1
jmp 0x1000ee77
and dword [ebp - 0xabc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf68]
cmp eax, dword [ebp - 0xabc]
jne 0x1000ee98
mov dword [ebp - 0x524], 1
jmp 0x1000ee9f
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0xf559cde8
jb 0x1000eeb7
mov dword [ebp - 0xac4], 1
jmp 0x1000eebe
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0xac4], eax
je 0x1000eed8
mov dword [ebp - 0x52c], 1
jmp 0x1000eedf
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x1000ef09
cmp dword [ebp - 0x440], 0
je 0x1000ef09
mov dword [ebp - 0xacc], 1
jmp 0x1000ef10
and dword [ebp - 0xacc], 0
cmp dword [ebp - 0xacc], 4
jle 0x1000ef25
mov dword [ebp - 0x534], 1
jmp 0x1000ef2c
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xad4], eax
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x1000ef52
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1000eb76
mov dword [ebp - 0xf4], 0
jmp 0x1000ef70
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffff9
je 0x1000f019
mov dword [ebp - 0x1234], 0xa8e4
mov dword [ebp - 0x123c], 0x7b1d0057
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x24c], 0
jmp 0x1000efb4
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000efd0
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x143c], 1
jmp 0x1000efa7
mov dword [ebp - 0x3c], 3
jmp 0x1000efe0
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000f007
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1000f005
push 0
push 0x25d9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1000efd9
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
jmp 0x1000ef63
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xf7c], eax
mov dword [ebp - 0x40], 0xfebaeef2
mov dword [ebp - 0xcc], 0
jmp 0x1000f045
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 4
jge 0x1000f061
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xd14], 0x5711
jmp 0x1000f038
mov dword [ebp - 0xcc], 0
jmp 0x1000f07a
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1000f096
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1428], 0x85ba5616
jmp 0x1000f06d
mov dword [ebp - 0x40], 3
jmp 0x1000f0a6
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1000f2b0
mov dword [ebp - 0x328], 0
jmp 0x1000f0c9
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1000f0e5
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xfc8], 0
jmp 0x1000f0bc
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xd14], 0x9e923e64
jae 0x1000f101
mov dword [ebp - 0xaf4], 1
jmp 0x1000f108
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xd14], 0
je 0x1000f236
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xfc8], 0xfffffffd
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xd14]
mov ecx, dword [ebp - 0x40]
add eax, dword [ebp + ecx*4 - 0xd14]
cmp eax, dword [ebp - 0x40]
je 0x1000f14f
mov dword [ebp - 0xadc], 1
jmp 0x1000f156
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
sub eax, 5
je 0x1000f176
mov eax, 0x208a
test eax, eax
je 0x1000f176
mov dword [ebp - 0x544], 1
jmp 0x1000f17d
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd14]
cmp dword [ebp - 0x544], eax
jg 0x1000f19e
mov dword [ebp - 0xae4], 1
jmp 0x1000f1a5
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xd14]
cmp dword [ebp - 0xae4], eax
jge 0x1000f1d3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfc8], 0
je 0x1000f1d3
mov dword [ebp - 0x54c], 1
jmp 0x1000f1da
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0xb689
jge 0x1000f1f2
mov dword [ebp - 0xaec], 1
jmp 0x1000f1f9
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xaec]
sub ecx, dword [ebp + eax*4 - 0xd14]
je 0x1000f20f
cmp dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xd14]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0xd14]
test eax, eax
je 0x1000f236
mov dword [ebp - 0x554], 1
jmp 0x1000f23d
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0x887
je 0x1000f255
mov dword [ebp - 0x55c], 1
jmp 0x1000f25c
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0xaf4]
cmp eax, dword [ebp - 0x55c]
jg 0x1000f276
mov dword [ebp - 0xafc], 1
jmp 0x1000f27d
and dword [ebp - 0xafc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xafc]
mov dword [ebp + eax - 0x1428], ecx
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x1000f2ab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x1000f09f
mov dword [ebp - 0x1c0], 0
jmp 0x1000f2c9
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x1000f514
mov dword [ebp - 0x330], 0xf3d37a5b
mov dword [ebp - 0x94], 0
jmp 0x1000f2f9
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1000f315
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x474], 0xe0648261
jmp 0x1000f2ec
mov dword [ebp - 0x94], 0
jmp 0x1000f32e
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1000f34a
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x1028], 0x6df37d45
jmp 0x1000f321
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x474], 0
jmp 0x1000f378
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x474]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x474], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x474], 0xffffffe3
jge 0x1000f3ff
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x220], 3
jmp 0x1000f3ab
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x1000f3ee
mov dword [ebp - 0x254], 0x7e4fc22
mov dword [ebp - 0x254], 3
jmp 0x1000f3d7
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jl 0x1000f3ec
mov dword [ebp - 0x330], 0xffffffff
jmp 0x1000f3ca
jmp 0x1000f39e
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x330], eax
jmp 0x1000f35d
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x330]
cmp dword [ebp + eax - 0x1028], ecx
jle 0x1000f420
mov dword [ebp - 0x564], 1
jmp 0x1000f427
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0x55145ccb
jg 0x1000f43f
mov dword [ebp - 0xb0c], 1
jmp 0x1000f446
and dword [ebp - 0xb0c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1028]
cmp dword [ebp + eax - 0x1028], ecx
jle 0x1000f46e
mov dword [ebp - 0xb04], 1
jmp 0x1000f475
and dword [ebp - 0xb04], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x474]
add eax, dword [ebp - 0xb04]
cmp eax, dword [ebp - 0x330]
jne 0x1000f49c
mov dword [ebp - 0x56c], 1
jmp 0x1000f4a3
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1028]
cmp dword [ebp - 0x56c], eax
jl 0x1000f4c3
mov dword [ebp - 0x574], 1
jmp 0x1000f4ca
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0xb0c]
cmp eax, dword [ebp - 0x574]
je 0x1000f4e4
mov dword [ebp - 0xb14], 1
jmp 0x1000f4eb
and dword [ebp - 0xb14], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb14]
mov dword [ebp + eax - 0x474], ecx
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x13e0], 0x39ed
jmp 0x1000f2bc
mov dword [ebp - 0x338], 0xfffffffb
mov dword [ebp - 0x25c], 0
jmp 0x1000f537
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x1000f553
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x1450], 1
jmp 0x1000f52a
mov dword [ebp - 0x338], 0
jmp 0x1000f56c
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jg 0x1000f58f
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x1000f58d
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x1000f55f
mov dword [ebp - 0x78], 0x90ac204e
mov dword [ebp - 0xec], 0xfffffff9
mov dword [ebp - 0x194], 0xbca0becc
mov dword [ebp - 0xe38], 0
mov dword [ebp - 0x78], 0
jmp 0x1000f5c4
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffef
je 0x1000f8f9
mov dword [ebp - 0x594], 0
mov dword [ebp - 0xd34], 0
mov dword [ebp - 0x340], 0
jmp 0x1000f5fb
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 2
jge 0x1000f617
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x458], 0
jmp 0x1000f5ee
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1000f643
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x458], 1
jne 0x1000f668
mov dword [ebp - 0x57c], 1
jmp 0x1000f66f
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x57c], eax
jl 0x1000f68f
cmp dword [ebp - 0x78], 0
je 0x1000f68f
mov dword [ebp - 0xf84], 1
jmp 0x1000f696
and dword [ebp - 0xf84], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x458], 4
jl 0x1000f6b2
mov dword [ebp - 0xb1c], 1
jmp 0x1000f6b9
and dword [ebp - 0xb1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb1c]
sub ecx, dword [ebp + eax - 0x458]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x458]
jg 0x1000f6e7
mov dword [ebp - 0x584], 1
jmp 0x1000f6ee
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0xbe4438b
jne 0x1000f796
mov dword [ebp - 0x268], 0
jmp 0x1000f717
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1000f733
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x11b4], 0x2206
jmp 0x1000f70a
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1000f75d
push 0
push 0xcb4
push 0
push 0
push 0x1964
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xec], 0
jmp 0x1000f776
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffff0
je 0x1000f791
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x11b4], ecx
jmp 0x1000f769
jmp 0x1000f8f4
mov dword [ebp - 0x33c], 0
jmp 0x1000f7af
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 1
jge 0x1000f7cb
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0xb24], 0x6de6b933
jmp 0x1000f7a2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb24], 0
jne 0x1000f865
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x124c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb24]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x458]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x194]
imul eax, eax, 0xab72
test eax, eax
je 0x1000f845
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x458], 0
je 0x1000f845
mov dword [ebp - 0x58c], 1
jmp 0x1000f84c
and dword [ebp - 0x58c], 0
xor eax, eax
sub eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x194]
jne 0x1000f865
and dword [ebp - 0xb4c], 0
jmp 0x1000f86f
mov dword [ebp - 0xb4c], 1
mov eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0xb4c]
jl 0x1000f889
mov dword [ebp - 0xb54], 1
jmp 0x1000f890
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0xb54], eax
jl 0x1000f8aa
mov dword [ebp - 0x59c], 1
jmp 0x1000f8b1
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0x194], 0
jmp 0x1000f8d6
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jg 0x1000f8f4
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp + eax*4 - 0x458]
mov dword [ebp - 0xd34], eax
jmp 0x1000f8c9
jmp 0x1000f5bd
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x2fc], 0xfffffffb
mov dword [ebp - 0x270], 0
jmp 0x1000f923
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x1000f93f
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x145c], 1
jmp 0x1000f916
mov dword [ebp - 0x2fc], 0
jmp 0x1000f958
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jg 0x1000f97b
mov byte [ebp - 0x18c], 0
movzx eax, byte [ebp - 0x18c]
test eax, eax
je 0x1000f979
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x1000f94b
mov dword [ebp - 0x7c], 0x90ac204e
mov dword [ebp - 0xd8], 0xfffffff9
mov dword [ebp - 0x180], 0xbca0becc
mov dword [ebp - 0xd3c], 0
mov dword [ebp - 0x7c], 0
jmp 0x1000f9b0
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffef
je 0x1000fce5
mov dword [ebp - 0xb74], 0
mov dword [ebp - 0xf28], 0
mov dword [ebp - 0x278], 0
jmp 0x1000f9e7
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x1000fa03
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x464], 0
jmp 0x1000f9da
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1000fa2f
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 1
jne 0x1000fa54
mov dword [ebp - 0xb5c], 1
jmp 0x1000fa5b
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xb5c], eax
jl 0x1000fa7b
cmp dword [ebp - 0x7c], 0
je 0x1000fa7b
mov dword [ebp - 0xe7c], 1
jmp 0x1000fa82
and dword [ebp - 0xe7c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x464], 4
jl 0x1000fa9e
mov dword [ebp - 0x5a4], 1
jmp 0x1000faa5
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5a4]
sub ecx, dword [ebp + eax - 0x464]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x464]
jg 0x1000fad3
mov dword [ebp - 0xb64], 1
jmp 0x1000fada
and dword [ebp - 0xb64], 0
cmp dword [ebp - 0xb64], 0xbe4438b
jne 0x1000fb82
mov dword [ebp - 0x384], 0
jmp 0x1000fb03
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 2
jge 0x1000fb1f
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x11c0], 0x2206
jmp 0x1000faf6
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x1000fb49
push 0
push 0xcb4
push 0
push 0
push 0x1964
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xd8], 0
jmp 0x1000fb62
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffff0
je 0x1000fb7d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + eax - 0x11c0], ecx
jmp 0x1000fb55
jmp 0x1000fce0
mov dword [ebp - 0x280], 0
jmp 0x1000fb9b
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x1000fbb7
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x5ac], 0x6de6b933
jmp 0x1000fb8e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5ac], 0
jne 0x1000fc51
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1254], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x125c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5ac]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x464]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x180]
imul eax, eax, 0xab72
test eax, eax
je 0x1000fc31
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0
je 0x1000fc31
mov dword [ebp - 0xb6c], 1
jmp 0x1000fc38
and dword [ebp - 0xb6c], 0
xor eax, eax
sub eax, dword [ebp - 0xb6c]
add eax, dword [ebp - 0x180]
jne 0x1000fc51
and dword [ebp - 0x5b4], 0
jmp 0x1000fc5b
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0xb74]
cmp eax, dword [ebp - 0x5b4]
jl 0x1000fc75
mov dword [ebp - 0x5bc], 1
jmp 0x1000fc7c
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xb74]
cmp dword [ebp - 0x5bc], eax
jl 0x1000fc96
mov dword [ebp - 0xb7c], 1
jmp 0x1000fc9d
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 0x180], 0
jmp 0x1000fcc2
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jg 0x1000fce0
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp + eax*4 - 0x464]
mov dword [ebp - 0xf28], eax
jmp 0x1000fcb5
jmp 0x1000f9a9
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x288], 0xfffffffb
mov dword [ebp - 0x304], 0
jmp 0x1000fd0f
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 3
jge 0x1000fd2b
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1468], 1
jmp 0x1000fd02
mov dword [ebp - 0x288], 0
jmp 0x1000fd44
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jg 0x1000fd67
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1000fd65
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x1000fd37
mov dword [ebp - 0x58], 0x14a02569
mov dword [ebp - 0x614], 0xfffffffc
mov dword [ebp - 0x400], 0xffffffff
mov dword [ebp - 0x1c4], 0x211521fa
mov dword [ebp - 0xbf4], 5
mov dword [ebp - 0x1c], 0
jmp 0x1000fda6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000fdbc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x298], 0xfffc
jmp 0x1000fd9f
mov dword [ebp - 0x1c], 0
jmp 0x1000fdcc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000fde2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc90], 0
jmp 0x1000fdc5
mov dword [ebp - 0x1c], 0
jmp 0x1000fdf2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000fe08
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0x93e75cb5
jmp 0x1000fdeb
mov dword [ebp - 0x58], 0
jmp 0x1000fe18
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1000fe2e
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x298], 0xa136
jmp 0x1000fe11
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jle 0x1000fe42
mov dword [ebp - 0xb94], 1
jmp 0x1000fe49
and dword [ebp - 0xb94], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xc90]
cmp dword [ebp + eax - 0xc90], ecx
jl 0x1000fe71
mov dword [ebp - 0x5c4], 1
jmp 0x1000fe78
and dword [ebp - 0x5c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp + eax - 0x1a0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
cmp dword [ebp + eax - 0xc90], ecx
je 0x1000feac
mov dword [ebp - 0xb84], 1
jmp 0x1000feb3
and dword [ebp - 0xb84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc90]
cmp dword [ebp - 0xb84], eax
jl 0x1000fed4
mov dword [ebp - 0x5cc], 1
jmp 0x1000fedb
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 5
jge 0x1000fef0
mov dword [ebp - 0xb8c], 1
jmp 0x1000fef7
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xb8c]
cmp eax, 1
ja 0x1000ff14
mov dword [ebp - 0x5d4], 1
jmp 0x1000ff1b
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x614]
sub eax, dword [ebp - 0x5d4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xc90]
cmp dword [ebp - 0xb94], eax
jl 0x100101df
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x30c], 0xffff
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x344], 0
jmp 0x1000ff77
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 1
jge 0x1000ff93
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0xf3c], 0x34832001
jmp 0x1000ff6a
mov dword [ebp - 0x58], 0xfffffffb
jmp 0x1000ffa3
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 7
jl 0x100101da
mov dword [ebp - 0x5ec], 0x2585fafe
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0xd4c], 1
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x290], eax
jl 0x1000fff1
mov dword [ebp - 0x5fc], 1
jmp 0x1000fff8
and dword [ebp - 0x5fc], 0
imul eax, dword [ebp - 0x30c], 0
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x44c], eax
jne 0x1001001f
mov dword [ebp - 0x5dc], 1
jmp 0x10010026
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0xbb4]
cmp eax, dword [ebp - 0x5ec]
jl 0x10010046
mov dword [ebp - 0xb9c], 1
jmp 0x1001004d
and dword [ebp - 0xb9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
add eax, dword [ebp - 0xb9c]
cmp dword [ebp - 0x290], eax
jge 0x10010074
mov dword [ebp - 0x5e4], 1
jmp 0x1001007b
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x5e4], eax
jle 0x10010095
mov dword [ebp - 0xd44], 1
jmp 0x1001009c
and dword [ebp - 0xd44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
mov dword [ebp - 0x1264], eax
cmp dword [ebp - 0x44c], 4
ja 0x100100c4
mov dword [ebp - 0xe84], 1
jmp 0x100100cb
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x126c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0xd4c]
cmp dword [ebp - 0x400], eax
jl 0x10010104
mov dword [ebp - 0xba4], 1
jmp 0x1001010b
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0xba4]
sub eax, dword [ebp - 0x30c]
je 0x1001012c
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1001012c
mov dword [ebp - 0xbac], 1
jmp 0x10010133
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0xbac]
jle 0x1001014d
mov dword [ebp - 0x5f4], 1
jmp 0x10010154
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0x494d
jle 0x10010172
cmp dword [ebp - 0xbb4], 0
jne 0x10010172
and dword [ebp - 0xbbc], 0
jmp 0x1001017c
mov dword [ebp - 0xbbc], 1
mov eax, dword [ebp - 0x5fc]
cmp eax, dword [ebp - 0xbbc]
jg 0x1001019f
mov eax, 0xfffc
test eax, eax
je 0x1001019f
mov dword [ebp - 0x604], 1
jmp 0x100101a6
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 3
je 0x100101bb
mov dword [ebp - 0xbc4], 1
jmp 0x100101c2
and dword [ebp - 0xbc4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp + eax - 0xf3c], ecx
jmp 0x1000ff9c
jmp 0x100104e2
mov dword [ebp - 0x3a4], 0xffffffff
mov dword [ebp - 0x410], 0xffffffff
mov dword [ebp - 0x1c4], 0x10
jmp 0x1001020c
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x17
jge 0x100104e2
mov dword [ebp - 0xbe4], 0xffffffff
mov dword [ebp - 0x408], 0x196c9a5c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x298], 0
jne 0x100103ac
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
mov dword [ebp - 0x410], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x410], eax
jge 0x10010275
mov dword [ebp - 0x60c], 1
jmp 0x1001027c
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xd73c
jne 0x10010294
mov dword [ebp - 0xbcc], 1
jmp 0x1001029b
and dword [ebp - 0xbcc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0xbcc], eax
jle 0x100102bc
mov dword [ebp - 0xbd4], 1
jmp 0x100102c3
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0xbd4], eax
je 0x100102dd
mov dword [ebp - 0x61c], 1
jmp 0x100102e4
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xde77bf6b
ja 0x100102fc
mov dword [ebp - 0xbdc], 1
jmp 0x10010303
and dword [ebp - 0xbdc], 0
cmp dword [ebp - 0xbdc], 1
je 0x10010318
mov dword [ebp - 0x624], 1
jmp 0x1001031f
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0xbe4], eax
jle 0x10010345
mov dword [ebp - 0x62c], 1
jmp 0x1001034c
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x62c], eax
jne 0x10010366
mov dword [ebp - 0xbec], 1
jmp 0x1001036d
and dword [ebp - 0xbec], 0
imul eax, dword [ebp - 0xbec], 0xfffb
test eax, eax
je 0x10010397
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
je 0x10010397
mov dword [ebp - 0x634], 1
jmp 0x1001039e
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0xbf4]
je 0x100103c1
mov eax, 0x1ce9
test eax, eax
je 0x100103c1
mov dword [ebp - 0x63c], 1
jmp 0x100103c8
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0xbf4]
cmp dword [ebp - 0x63c], eax
je 0x100103e2
mov dword [ebp - 0x39c], 1
jmp 0x100103e9
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0x1a0], ecx
mov eax, dword [ebp - 0x39c]
add eax, 0x3d58cdd2
cmp dword [ebp - 0x3a4], eax
jge 0x1001041b
mov dword [ebp - 0xbfc], 1
jmp 0x10010422
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xbfc]
add eax, 0x6ec7
je 0x10010444
cmp dword [ebp - 0x410], 0
je 0x10010444
mov dword [ebp - 0x644], 1
jmp 0x1001044b
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0x4b4fbf64
jne 0x10010469
cmp dword [ebp - 0x408], 0
jne 0x10010469
and dword [ebp - 0xc04], 0
jmp 0x10010473
mov dword [ebp - 0xc04], 1
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xc04], eax
jl 0x1001048d
mov dword [ebp - 0x64c], 1
jmp 0x10010494
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0xffff
jbe 0x100104ac
mov dword [ebp - 0xc0c], 1
jmp 0x100104b3
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0xc0c], eax
jne 0x100104cd
mov dword [ebp - 0xc14], 1
jmp 0x100104d4
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x58], eax
jmp 0x100101ff
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0xb4], 0
jmp 0x1001050f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1001052b
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xd54], 0x5755261f
jmp 0x10010502
mov dword [ebp - 0xb4], 0
jmp 0x10010544
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10010560
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xb34], 0x5dd68647
jmp 0x10010537
mov dword [ebp - 0x188], 0x15
jmp 0x10010579
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffff6
jle 0x10010875
mov dword [ebp - 0x9c], 0x1d8f8f57
mov dword [ebp - 0xf30], 0xffffffff
mov dword [ebp - 0x364], 0
jmp 0x100105b3
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x100105cf
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0xcc8], 0
jmp 0x100105a6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd54], 1
jle 0x100105f1
cmp dword [ebp - 0x188], 0
jne 0x100105f1
and dword [ebp - 0x658], 0
jmp 0x100105fb
mov dword [ebp - 0x658], 1
cmp dword [ebp - 0x658], 0xc77dcda7
jne 0x1001061f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0x9c], eax
jmp 0x10010855
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x998], 0x734895c4
mov dword [ebp - 0x2a0], 0
jmp 0x1001064c
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x10010668
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x1088], 0xfff6
jmp 0x1001063f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1088]
mov dword [ebp - 0x127c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x30b137d3
je 0x100106a6
mov dword [ebp - 0x990], 1
jmp 0x100106ad
and dword [ebp - 0x990], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1088]
cmp dword [ebp - 0x990], eax
jl 0x100106ce
mov dword [ebp - 0x660], 1
jmp 0x100106d5
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 0
jbe 0x100106ea
mov dword [ebp - 0xb44], 1
jmp 0x100106f1
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x128c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 4
jne 0x10010749
mov dword [ebp - 0xe8c], 1
jmp 0x10010750
and dword [ebp - 0xe8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1088]
mov dword [ebp - 0x1314], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xcc8]
sub ecx, 0x1690883
cmp dword [ebp + eax - 0x1088], ecx
jl 0x10010790
mov dword [ebp - 0xd5c], 1
jmp 0x10010797
and dword [ebp - 0xd5c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0x131c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1bc], 3
jmp 0x100107ce
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x18
jle 0x10010855
mov dword [ebp - 0x9c], 2
jmp 0x100107f0
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10010836
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp + ecx*4 - 0xcc8]
cmp dword [ebp + eax*4 - 0xcc8], ecx
je 0x10010821
mov dword [ebp - 0x670], 1
jmp 0x10010828
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0xf30], eax
jmp 0x100107e3
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10010850
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x100107c1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb34]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb34], eax
jmp 0x1001056c
mov dword [ebp - 0x74], 0x90ac204e
mov dword [ebp - 0xe0], 0xfffffff9
mov dword [ebp - 0x104], 0xbca0becc
mov dword [ebp - 0xe94], 0
mov dword [ebp - 0x74], 0
jmp 0x100108aa
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffef
je 0x10010bdf
mov dword [ebp - 0x690], 0
mov dword [ebp - 0xd6c], 0
mov dword [ebp - 0x314], 0
jmp 0x100108e1
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 2
jge 0x100108fd
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x448], 0
jmp 0x100108d4
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10010929
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x448], 1
jne 0x1001094e
mov dword [ebp - 0x678], 1
jmp 0x10010955
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x678], eax
jl 0x10010975
cmp dword [ebp - 0x74], 0
je 0x10010975
mov dword [ebp - 0xd64], 1
jmp 0x1001097c
and dword [ebp - 0xd64], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 4
jl 0x10010998
mov dword [ebp - 0x9a0], 1
jmp 0x1001099f
and dword [ebp - 0x9a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a0]
sub ecx, dword [ebp + eax - 0x448]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x448]
jg 0x100109cd
mov dword [ebp - 0x680], 1
jmp 0x100109d4
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0xbe4438b
jne 0x10010a7c
mov dword [ebp - 0x2a8], 0
jmp 0x100109fd
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x10010a19
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x11cc], 0x2206
jmp 0x100109f0
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10010a43
push 0
push 0xcb4
push 0
push 0
push 0x1964
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xe0], 0
jmp 0x10010a5c
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff0
je 0x10010a77
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x74]
mov dword [ebp + eax - 0x11cc], ecx
jmp 0x10010a4f
jmp 0x10010bda
mov dword [ebp - 0x34c], 0
jmp 0x10010a95
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x10010ab1
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xc48], 0x6de6b933
jmp 0x10010a88
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc48], 0
jne 0x10010b4b
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1324], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x132c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc48]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x448]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x104]
imul eax, eax, 0xab72
test eax, eax
je 0x10010b2b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x448], 0
je 0x10010b2b
mov dword [ebp - 0x688], 1
jmp 0x10010b32
and dword [ebp - 0x688], 0
xor eax, eax
sub eax, dword [ebp - 0x688]
add eax, dword [ebp - 0x104]
jne 0x10010b4b
and dword [ebp - 0x9a8], 0
jmp 0x10010b55
mov dword [ebp - 0x9a8], 1
mov eax, dword [ebp - 0x690]
cmp eax, dword [ebp - 0x9a8]
jl 0x10010b6f
mov dword [ebp - 0xb38], 1
jmp 0x10010b76
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x690]
cmp dword [ebp - 0xb38], eax
jl 0x10010b90
mov dword [ebp - 0x698], 1
jmp 0x10010b97
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0x104], 0
jmp 0x10010bbc
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jg 0x10010bda
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp + eax*4 - 0x448]
mov dword [ebp - 0xd6c], eax
jmp 0x10010baf
jmp 0x100108a3
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x50], 0x14a02569
mov dword [ebp - 0x9d8], 0xfffffffc
mov dword [ebp - 0x40c], 0xffffffff
mov dword [ebp - 0x1b0], 0x211521fa
mov dword [ebp - 0x710], 5
mov dword [ebp - 0x2c], 0
jmp 0x10010c25
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10010c3b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x378], 0xfffc
jmp 0x10010c1e
mov dword [ebp - 0x2c], 0
jmp 0x10010c4b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10010c61
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc9c], 0
jmp 0x10010c44
mov dword [ebp - 0x2c], 0
jmp 0x10010c71
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10010c87
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x154], 0x93e75cb5
jmp 0x10010c6a
mov dword [ebp - 0x50], 0
jmp 0x10010c97
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10010cad
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x378], 0xa136
jmp 0x10010c90
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x10010cc1
mov dword [ebp - 0x6b0], 1
jmp 0x10010cc8
and dword [ebp - 0x6b0], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xc9c]
cmp dword [ebp + eax - 0xc9c], ecx
jl 0x10010cf0
mov dword [ebp - 0x9b0], 1
jmp 0x10010cf7
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp + eax - 0x154], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x40c]
cmp dword [ebp + eax - 0xc9c], ecx
je 0x10010d2b
mov dword [ebp - 0x6a0], 1
jmp 0x10010d32
and dword [ebp - 0x6a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x6a0], eax
jl 0x10010d53
mov dword [ebp - 0xbf0], 1
jmp 0x10010d5a
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0xbf0], 5
jge 0x10010d6f
mov dword [ebp - 0x6a8], 1
jmp 0x10010d76
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x6a8]
cmp eax, 1
ja 0x10010d93
mov dword [ebp - 0x9b8], 1
jmp 0x10010d9a
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9d8]
sub eax, dword [ebp - 0x9b8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xc9c]
cmp dword [ebp - 0x6b0], eax
jl 0x1001105e
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x2b8], 0xffff
mov dword [ebp - 0x6d0], 1
mov dword [ebp - 0x2b0], 0
jmp 0x10010df6
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x10010e12
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xd7c], 0x34832001
jmp 0x10010de9
mov dword [ebp - 0x50], 0xfffffffb
jmp 0x10010e22
cmp dword [ebp - 0x50], 7
jl 0x10011059
mov dword [ebp - 0xc78], 0x2585fafe
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0xe9c], 1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x31c], eax
jl 0x10010e70
mov dword [ebp - 0xb48], 1
jmp 0x10010e77
and dword [ebp - 0xb48], 0
imul eax, dword [ebp - 0x2b8], 0
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x3ac], eax
jne 0x10010e9e
mov dword [ebp - 0xb40], 1
jmp 0x10010ea5
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xb40]
sub eax, dword [ebp - 0x6d0]
cmp eax, dword [ebp - 0xc78]
jl 0x10010ec5
jmp 0x10011361
mov dword [ebp - 0x3bc], 0xffffffff
mov dword [ebp - 0x434], 0xffffffff
mov dword [ebp - 0x1b0], 0x10
jmp 0x1001108b
cmp dword [ebp - 0x1b0], 0x17
jge 0x10011361
mov dword [ebp - 0x700], 0xffffffff
mov dword [ebp - 0x414], 0x196c9a5c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x378], 0
jne 0x1001122b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
mov dword [ebp - 0x434], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x434], eax
jge 0x100110f4
mov dword [ebp - 0xbf8], 1
jmp 0x100110fb
and dword [ebp - 0xbf8], 0
cmp dword [ebp - 0xbf8], 0xd73c
jne 0x10011113
mov dword [ebp - 0x6e8], 1
jmp 0x1001111a
and dword [ebp - 0x6e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x6e8], eax
jle 0x1001113b
mov dword [ebp - 0x6f0], 1
jmp 0x10011142
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x9d8]
cmp dword [ebp - 0x6f0], eax
je 0x1001115c
mov eax, 0x1ce9
test eax, eax
je 0x10011240
mov dword [ebp - 0xb58], 1
jmp 0x10011247
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0xb58], eax
je 0x10011261
mov dword [ebp - 0x3b4], 1
jmp 0x10011268
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x154], ecx
mov eax, dword [ebp - 0x3b4]
add eax, 0x3d58cdd2
cmp dword [ebp - 0x3bc], eax
jge 0x1001129a
mov dword [ebp - 0x718], 1
jmp 0x100112a1
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
add eax, 0x6ec7
je 0x100112c3
mov dword [ebp - 0x1068], 5
mov dword [ebp - 0x1064], 5
mov dword [ebp - 0x1060], 5
mov dword [ebp - 0x105c], 5
mov dword [ebp - 0x134c], 0xed23b618
mov dword [ebp - 0x1354], 0
mov dword [ebp - 0x135c], 0x6ff23b1a
mov dword [ebp - 0x1364], 0xfffffffe
mov dword [ebp - 0x136c], 1
mov dword [ebp - 0x1374], 0x165352f7
mov dword [ebp - 0x12d0], 0
mov dword [ebp - 0x1350], 1
mov dword [ebp - 0x10a4], 0xbd0a7084
mov dword [ebp - 0x1358], 0xffffffff
mov dword [ebp - 0x730], 0xfffffff6
mov dword [ebp - 0x10ac], 0x8f6c
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1068], 0x3342eb9
mov eax, dword [ebp - 0x730]
dec eax
mov dword [ebp - 0x730], eax
movzx eax, byte [0x10682268]
test eax, eax
je 0x1001143d
mov esi, 0x10096614
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10017392
mov dword [ebp - 0x738], 0x3dfad5be
mov dword [ebp - 0xd84], 0x51dd2e91
mov dword [ebp - 0x748], 0x2d38ca8c
mov dword [ebp - 0xa10], 0xdfd99643
mov dword [ebp - 0x760], 0x14a3a6d7
mov dword [ebp - 4], 0
jmp 0x1001147f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x10011495
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12a4], 1
jmp 0x10011478
mov dword [ebp - 4], 0
jmp 0x100114a5
cmp dword [ebp - 4], 4
jge 0x100114bb
pop edi
pop esi
mov esp, ebp
pop ebp
ret