Function at 0x10006f6b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bcbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xeb4
push esi
push edi
mov dword [ebp - 0x88], 0
push 1
lea ecx, [ebp - 0xa08]
call fcn.10013e31
and dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0
jmp 0x10006fbf
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x10006fe1
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xa08]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
jmp 0x10006fb2
mov dword [ebp - 0x88], 0x1b
jmp 0x10006ffa
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 5
jg 0x10007087
mov dword [ebp - 0x34], 0x2304b25b
mov dword [ebp - 0x34], 0
jmp 0x1000701e
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10007050
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa08]
call fcn.10013ed2
mov esi, eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa08]
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
cmp dword [ebp - 0x34], 0
je 0x1000704e
jmp 0x10007017
jmp 0x10007017
mov dword [ebp - 0x34], 0
jmp 0x10007060
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10007082
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x10007080
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x10007059
jmp 0x10006fed
mov dword [ebp - 0x88], 0
jmp 0x100070a0
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x100070ff
mov dword [ebp - 0x1b4], 0x84217059
mov dword [ebp - 0x87c], 0x4c3f4f88
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x88], eax
je 0x100070e7
mov dword [ebp - 0x87c], 0xea0d018d
jmp 0x100070fd
mov dword [ebp - 0x910], 0xfffffff7
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x910], eax
jmp 0x10007093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa08]
call fcn.10013eb6
mov dword [ebp - 0x50], 0
push 1
lea ecx, [ebp - 0xab0]
call fcn.10013e31
mov dword [ebp - 4], 1
mov dword [ebp - 0x144], 0
jmp 0x10007142
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x10007164
push dword [ebp - 0x144]
lea ecx, [ebp - 0xab0]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
jmp 0x10007135
mov dword [ebp - 0x50], 0x1b
jmp 0x10007174
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 5
jg 0x100071fe
mov dword [ebp - 0x38], 0x2304b25b
mov dword [ebp - 0x38], 0
jmp 0x10007195
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x100071c7
push dword [ebp - 0x38]
lea ecx, [ebp - 0xab0]
call fcn.10013ed2
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0xab0]
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
cmp dword [ebp - 0x38], 0
je 0x100071c5
jmp 0x1000718e
jmp 0x1000718e
mov dword [ebp - 0x38], 0
jmp 0x100071d7
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x100071f9
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x100071f7
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x100071d0
jmp 0x1000716d
mov dword [ebp - 0x50], 0
jmp 0x1000720e
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x10007267
mov dword [ebp - 0x20c], 0x84217059
mov dword [ebp - 0x918], 0x4c3f4f88
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x50], eax
je 0x1000724f
mov dword [ebp - 0x918], 0xea0d018d
jmp 0x10007265
mov dword [ebp - 0x880], 0xfffffff7
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x880], eax
jmp 0x10007207
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab0]
call fcn.10013eb6
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x124], 0xcfb6318d
push 4
lea ecx, [ebp - 0xbd8]
call fcn.10013e31
mov dword [ebp - 4], 2
mov dword [ebp - 0x898], 1
mov dword [ebp - 0x14c], 0
jmp 0x100072cb
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x100072ea
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xbd8]
call fcn.10013ed2
or dword [eax], 0xffffffff
jmp 0x100072be
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
je 0x1000730e
cmp dword [ebp - 0x2b0], 0
je 0x1000730e
mov dword [ebp - 0x888], 1
jmp 0x10007315
and dword [ebp - 0x888], 0
mov dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x570], eax
push 3
lea ecx, [ebp - 0xbd8]
call fcn.10013ed2
mov ecx, dword [ebp - 0x570]
mov dword [eax], ecx
cmp dword [ebp - 0x570], 0xffffffff
jbe 0x10007355
mov dword [ebp - 0x788], 1
jmp 0x1000735c
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x2b0]
imul eax, dword [ebp - 0x788]
cmp eax, 1
je 0x1000737a
mov dword [ebp - 0x790], 1
jmp 0x10007381
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x790], eax
jl 0x1000739b
mov dword [ebp - 0x890], 1
jmp 0x100073a2
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x2b0], eax
jle 0x100073bc
mov dword [ebp - 0x66c], 1
jmp 0x100073c3
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x898]
cmp dword [ebp - 0x66c], eax
jne 0x100073f9
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x100073f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x10007425
mov dword [ebp - 0x8a0], 1
mov dword [ebp - 0x950], 0xfffffff6
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x950], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd8]
call fcn.10013eb6
mov dword [ebp - 0x60], 0
push 1
lea ecx, [ebp - 0xa74]
call fcn.10013e31
mov dword [ebp - 4], 3
mov dword [ebp - 0x1bc], 0
jmp 0x10007468
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x1000748a
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0xa74]
call fcn.10013ed2
mov dword [eax], 0x7013dce9
jmp 0x1000745b
mov dword [ebp - 0x60], 0x1b
jmp 0x1000749a
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 5
jg 0x10007e45
mov dword [ebp - 0x30], 0x2304b25b
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x958], 0xf6d4a0d4
mov dword [ebp - 0xd58], 0xeb4c
mov dword [ebp - 0xd54], 0xeb4c
mov dword [ebp - 0xd50], 0xeb4c
mov dword [ebp - 0xd4c], 0xeb4c
mov dword [ebp - 0x154], 0
jmp 0x10007500
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x1000751c
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xdd8], 0xe08974b6
jmp 0x100074f3
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xd80], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xdd8], 5
cmp dword [ebp - 0x1f4], 5
jl 0x1000754d
mov dword [ebp - 0x674], 1
jmp 0x10007554
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x1f4]
neg eax
cmp eax, 0xb95
jg 0x1000756f
mov dword [ebp - 0x2dc], 1
jmp 0x10007576
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x2dc]
je 0x10007590
mov dword [ebp - 0x2e4], 1
jmp 0x10007597
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x674]
imul eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x958], eax
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x100075d8
push 0x10c7
push 0x1f46
push 0xde1
push 0xac5
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x30], 0
jmp 0x100075e8
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10007a67
mov dword [ebp - 0x70], 0x743d837b
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x15c], 0
jmp 0x10007619
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jge 0x10007635
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0xd90], 0x20624039
jmp 0x1000760c
mov dword [ebp - 0x70], 0
jmp 0x10007645
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jg 0x10007700
mov dword [ebp - 0x1c4], 0xe1ca2961
mov dword [ebp - 0xd18], 0x1860ec01
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0xd90], 0
je 0x10007675
jmp 0x10007700
mov dword [ebp - 0x1c4], 2
jmp 0x1000768e
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x100076fb
push 3
lea ecx, [ebp - 0xd28]
call fcn.10013e31
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], 0
jmp 0x100076c1
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x100076e3
push dword [ebp - 0x164]
lea ecx, [ebp - 0xd28]
call fcn.10013ed2
mov dword [eax], 1
jmp 0x100076b4
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd28]
call fcn.10013eb6
jmp 0x10007681
jmp 0x1000763e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd90], 0
xor eax, eax
jne 0x10007721
mov dword [ebp - 0x67c], 1
jmp 0x10007728
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xfffffff6
jbe 0x1000773d
mov dword [ebp - 0x2ec], 1
jmp 0x10007744
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 1
je 0x10007759
mov dword [ebp - 0x684], 1
jmp 0x10007760
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x684], eax
jle 0x10007777
mov dword [ebp - 0x2f4], 1
jmp 0x1000777e
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0xfffd
jne 0x10007796
mov dword [ebp - 0x68c], 1
jmp 0x1000779d
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x68c], eax
je 0x100077b4
mov dword [ebp - 0x2fc], 1
jmp 0x100077bb
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2fc], eax
jne 0x100077d2
mov dword [ebp - 0x694], 1
jmp 0x100077d9
and dword [ebp - 0x694], 0
xor eax, eax
sub eax, dword [ebp - 0x694]
add eax, 0x1f4d0986
je 0x1000783c
mov eax, 0x12c0
test eax, eax
je 0x1000783c
mov dword [ebp - 0x21c], 0
jmp 0x1000780a
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x10007826
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xe64], 0x300c
jmp 0x100077fd
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xe64], 1
jmp 0x100078ee
mov dword [ebp - 0x304], 0x108f
mov dword [ebp - 0x70], 0xfffffff0
jmp 0x10007856
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffff5
jle 0x100078ee
mov dword [ebp - 0x960], 0x97ab83de
mov dword [ebp - 0x58], 0xfffffffd
jmp 0x1000787a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x38
jge 0x100078e9
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x16c], 0
jmp 0x100078a3
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jg 0x100078dc
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x100078da
push 0x7d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10007896
cmp dword [ebp - 0x960], 0
je 0x100078e7
jmp 0x10007873
jmp 0x10007873
jmp 0x1000784f
push dword [ebp - 0x30]
lea ecx, [ebp - 0xa74]
call fcn.10013ed2
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0xa74]
call fcn.10013ed2
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0xb2c], 0x5252
mov dword [ebp - 0xb28], 0x5252
mov dword [ebp - 0xb24], 0x5252
mov dword [ebp - 0xb20], 0x5252
lea ecx, [ebp - 0x235]
call fcn.10006dcf
push eax
lea eax, [ebp - 0xb1c]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xe34]
call fcn.10013ee1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbf0]
call fcn.10013e90
mov byte [ebp - 4], 5
push 2
lea ecx, [ebp - 0xbf0]
call fcn.10013ed2
mov esi, eax
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013ed2
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x100079f5
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x1cc], 0
jmp 0x100079b6
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfffffff1
je 0x100079db
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x100079d9
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x100079a9
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x100079f3
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x10007a48
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10007a16
push 0
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x10007a48
push 0
push 0x2268
push 0x161f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbf0]
call fcn.10013eb6
cmp dword [ebp - 0x30], 0
je 0x10007a62
jmp 0x100075e1
jmp 0x100075e1
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x298], 0xbe135e1f
mov dword [ebp - 0x978], 0x8a52b4b5
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x988], 0xffffffff
mov dword [ebp - 0x990], 0x69919c44
push 1
lea ecx, [ebp - 0xac8]
call fcn.10013e31
mov byte [ebp - 4], 6
mov dword [ebp - 0xdc0], 0x28e4
mov dword [ebp - 0x314], 2
mov dword [ebp - 0x74], 0
jmp 0x10007ad8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10007aee
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xbfc], 0x141a9c21
jmp 0x10007ad1
mov dword [ebp - 0x74], 0
jmp 0x10007afe
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10007b1a
push dword [ebp - 0x74]
lea ecx, [ebp - 0xac8]
call fcn.10013ed2
mov dword [eax], 0x79dc8669
jmp 0x10007af7
mov dword [ebp - 0xb0], 0x1a
jmp 0x10007b33
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xfffffff8
jl 0x10007bd2
mov dword [ebp - 0x174], 5
mov dword [ebp - 0x69c], 0xffffffff
mov dword [ebp - 0x174], 0xfffffff6
jmp 0x10007b6d
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xfffffff4
je 0x10007bcd
mov dword [ebp - 0x6a4], 0x3d4e
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x69c], eax
jg 0x10007b9a
mov dword [ebp - 0x30c], 1
jmp 0x10007ba1
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x298], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbfc], 0
je 0x10007bcb
jmp 0x10007b60
jmp 0x10007b60
jmp 0x10007b26
mov dword [ebp - 0xb0], 0xfffffff8
jmp 0x10007beb
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x11
jg 0x10007dff
mov dword [ebp - 0x968], 0xfff6
mov dword [ebp - 0x6c0], 0xbcf5
mov dword [ebp - 0x268], 0x1a770aac
mov dword [ebp - 0x1fc], 0
jmp 0x10007c2f
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x10007c4b
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xd38], 0xec5ec62b
jmp 0x10007c22
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
je 0x10007d84
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x6ac], 0x16037280
cmp dword [ebp - 0x6ac], 0
jne 0x10007c9c
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
jne 0x10007c9c
and dword [ebp - 0x6b8], 0
jmp 0x10007ca6
mov dword [ebp - 0x6b8], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd38], 0
je 0x10007cfc
cmp dword [ebp - 0x6c0], 0xbb6a
je 0x10007cdb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbfc], 0
jne 0x10007cdb
and dword [ebp - 0x31c], 0
jmp 0x10007ce5
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
add eax, 7
je 0x10007cfc
mov dword [ebp - 0x324], 1
jmp 0x10007d03
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0x324]
jge 0x10007d1d
mov dword [ebp - 0x970], 1
jmp 0x10007d24
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x978]
cmp dword [ebp + eax - 0xbfc], ecx
jg 0x10007d51
mov dword [ebp - 0x32c], 1
jmp 0x10007d58
and dword [ebp - 0x32c], 0
push 0
lea ecx, [ebp - 0xac8]
call fcn.10013ed2
mov eax, dword [eax]
mov ecx, dword [ebp - 0x32c]
lea eax, [ecx + eax + 0x1eb1ed30]
test eax, eax
je 0x10007d84
mov dword [ebp - 0x2c0], 1
jmp 0x10007d8b
and dword [ebp - 0x2c0], 0
push 0
lea ecx, [ebp - 0xac8]
call fcn.10013ed2
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
cmp dword [ebp - 0x2c0], 0xb915
jne 0x10007db8
mov dword [ebp - 0x6c8], 1
jmp 0x10007dbf
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 4
je 0x10007dd4
mov dword [ebp - 0x980], 1
jmp 0x10007ddb
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xd2c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x990]
mov dword [ebp + eax - 0xd38], ecx
jmp 0x10007bde
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac8]
call fcn.10013eb6
mov dword [ebp - 0x30], 0
jmp 0x10007e1e
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10007e40
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10007e3e
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x10007e17
jmp 0x10007493
mov dword [ebp - 0x60], 0
jmp 0x10007e55
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10007eae
mov dword [ebp - 0x17c], 0x84217059
mov dword [ebp - 0x998], 0x4c3f4f88
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x60], eax
je 0x10007e96
mov dword [ebp - 0x998], 0xea0d018d
jmp 0x10007eac
mov dword [ebp - 0x9a0], 0xfffffff7
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x9a0], eax
jmp 0x10007e4e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xbc0]
call fcn.10013e31
mov dword [ebp - 4], 7
mov dword [ebp - 0x7c], 0xfffffffd
mov dword [ebp - 0x9a8], 0xffffffff
mov dword [ebp - 0xd3c], 0x3384
mov dword [ebp - 0x1d4], 0
jmp 0x10007f05
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x10007f27
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0xbc0]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
jmp 0x10007ef8
mov dword [ebp - 0x7c], 0
jmp 0x10007f37
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10007f53
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xbc0]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
jmp 0x10007f30
mov dword [ebp - 0x7c], 1
jmp 0x10007f63
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x10007f9a
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10007f8d
push 0x201f
push 0x16d0
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [ebp - 0x9a8], 0
je 0x10007f98
jmp 0x10007f5c
jmp 0x10007f5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc0]
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xc08]
call fcn.10013e31
mov dword [ebp - 4], 8
mov dword [ebp - 0x68], 0xfffffffd
mov dword [ebp - 0x9fc], 0xffffffff
mov dword [ebp - 0xd7c], 0x3384
mov dword [ebp - 0x184], 0
jmp 0x10007ff1
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x10008013
push dword [ebp - 0x184]
lea ecx, [ebp - 0xc08]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
jmp 0x10007fe4
mov dword [ebp - 0x68], 0
jmp 0x10008023
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1000803f
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc08]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
jmp 0x1000801c
mov dword [ebp - 0x68], 1
jmp 0x1000804f
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10008086
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x10008079
push 0x201f
push 0x16d0
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [ebp - 0x9fc], 0
je 0x10008084
jmp 0x10008048
jmp 0x10008048
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.10013eb6
push 2
lea ecx, [ebp - 0xc20]
call fcn.10013e31
mov dword [ebp - 4], 9
mov dword [ebp - 0x84], 0xfffffffd
mov dword [ebp - 0x9d8], 0xffffffff
mov dword [ebp - 0xd84], 0x3384
mov dword [ebp - 0x214], 0
jmp 0x100080e0
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x10008102
push dword [ebp - 0x214]
lea ecx, [ebp - 0xc20]
call fcn.10013ed2
mov dword [eax], 0xfffffffa
jmp 0x100080d3
mov dword [ebp - 0x84], 0
jmp 0x1000811b
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000813d
push dword [ebp - 0x84]
lea ecx, [ebp - 0xc20]
call fcn.10013ed2
mov dword [eax], 0xa32b1cec
jmp 0x1000810e
mov dword [ebp - 0x84], 1
jmp 0x10008156
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x10008190
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x10008183
push 0x201f
push 0x16d0
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [ebp - 0x9d8], 0
je 0x1000818e
jmp 0x10008149
jmp 0x10008149
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc20]
call fcn.10013eb6
mov dword [ebp - 0x11c], 0xa76aabec
mov dword [ebp - 0x9b4], 0x9f3690f1
mov dword [ebp - 0x18c], 0
jmp 0x100081cc
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x100081e8
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xdf0], 0x3dd3
jmp 0x100081bf
mov dword [ebp - 0x11c], 0
jmp 0x10008201
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jg 0x1000823b
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp + eax*4 - 0xdf0]
mov dword [ebp - 0x9b4], eax
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10008239
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x100081f4
mov dword [ebp - 0x120], 0xa76aabec
mov dword [ebp - 0x884], 0x9f3690f1
mov dword [ebp - 0x1dc], 0
jmp 0x10008268
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x10008284
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0xe20], 0x3dd3
jmp 0x1000825b
mov dword [ebp - 0x120], 0
jmp 0x1000829d
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jg 0x100082d7
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp + eax*4 - 0xe20]
mov dword [ebp - 0x884], eax
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x100082d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x10008290
mov dword [ebp - 0xc0], 0x1928c176
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x1e4], 5
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x920], 0xffffffff
mov dword [ebp - 0x194], 0
jmp 0x10008322
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1000833e
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0xa2c], 0xb4763523
jmp 0x10008315
mov dword [ebp - 0xc0], 0xfffffffa
jmp 0x10008357
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x1d
je 0x1000868f
mov dword [ebp - 0x204], 0xd193
mov dword [ebp - 0x19c], 4
mov dword [ebp - 0x930], 0xbbc1846e
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xd94], eax
cmp dword [ebp - 0xc0], 0
je 0x100083e6
cmp dword [ebp - 0x204], 1
jae 0x100083b9
mov dword [ebp - 0x334], 1
jmp 0x100083c0
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
sub eax, 8
neg eax
imul eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0xc0]
je 0x100083e6
mov dword [ebp - 0x6d0], 1
jmp 0x100083ed
and dword [ebp - 0x6d0], 0
imul eax, dword [ebp - 0x6d0], 0x3718
cmp eax, dword [ebp - 0x1e4]
jl 0x1000840b
mov dword [ebp - 0x33c], 1
jmp 0x10008412
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0xc0]
jge 0x10008432
mov dword [ebp - 0x6d8], 1
jmp 0x10008439
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x6d8], eax
jle 0x10008450
mov eax, 0x7d96711d
test eax, eax
je 0x10008457
cmp dword [ebp - 0x270], 0
cmp dword [ebp - 0x19c], 0
je 0x1000856d
mov dword [ebp - 0x88c], 0xc2f5
mov dword [ebp - 0x6e0], 0x99e1f953
mov dword [ebp - 0x8a8], 0xe7baa9d7
cmp dword [ebp - 0x204], 0
je 0x10008509
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xcaf1e2cd
ja 0x100084af
mov dword [ebp - 0x344], 1
jmp 0x100084b6
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 1
jae 0x100084d7
mov dword [ebp - 0x34c], 1
jmp 0x100084de
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x920]
mov dword [ebp - 0x1e4], eax
mov eax, 0xacb314b8
sub eax, dword [ebp - 0x1e4]
je 0x10008509
mov dword [ebp - 0x6e8], 1
jmp 0x10008510
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x270]
add eax, dword [ebp - 0x6e8]
cmp eax, dword [ebp - 0xc0]
jne 0x10008530
mov dword [ebp - 0x354], 1
jmp 0x10008537
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
add eax, dword [ebp - 0x354]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa2c], eax
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xf0], eax
jmp 0x1000868a
mov dword [ebp - 0x364], 0xece01153
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x6f0], 1
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x89c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa2c]
add eax, 0x702b6816
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x894]
cmp dword [ebp - 0x6f0], eax
jge 0x100085d1
mov dword [ebp - 0x6f8], 1
jmp 0x100085d8
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
sub eax, dword [ebp - 0x6f8]
cmp dword [ebp - 0x930], eax
jl 0x10008604
mov dword [ebp - 0x700], 1
jmp 0x1000860b
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x270]
add eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x700]
sub ecx, 0x24e2
imul eax, ecx
test eax, eax
jne 0x1000864c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa2c], 0
jne 0x1000864c
cmp dword [ebp - 0x89c], 0
jne 0x1000864c
and dword [ebp - 0x36c], 0
jmp 0x10008656
mov dword [ebp - 0x36c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa2c]
cmp dword [ebp - 0x36c], eax
je 0x10008677
mov dword [ebp - 0x708], 1
jmp 0x1000867e
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x1e4], eax
jmp 0x1000834a
mov dword [ebp - 0x128], 0xa76aabec
mov dword [ebp - 0x938], 0x9f3690f1
mov dword [ebp - 0x1a4], 0
jmp 0x100086bc
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x100086d8
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xe08], 0x3dd3
jmp 0x100086af
mov dword [ebp - 0x128], 0
jmp 0x100086f1
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jg 0x1000872b
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0xe08]
mov dword [ebp - 0x938], eax
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x10008729
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x100086e4
mov dword [ebp - 0xb7c], 5
mov dword [ebp - 0xb78], 5
mov dword [ebp - 0xb74], 5
mov dword [ebp - 0xb70], 5
lea ecx, [ebp - 0x24d]
call fcn.10006dcf
push eax
lea eax, [ebp - 0xb6c]
push eax
lea eax, [ebp - 0xb7c]
push eax
lea ecx, [ebp - 0xe8c]
call fcn.10013ee1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7cc]
call fcn.10013e90
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xb8], 0xfffffff6
mov dword [ebp - 0x948], 0xa2910a83
mov dword [ebp - 0xb8], 0
jmp 0x100087bc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x1000894b
mov dword [ebp - 0x2a0], 0x504dbf0c
mov dword [ebp - 0x278], 7
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
cmp dword [eax], 0x826a056e
jb 0x10008813
mov dword [ebp - 0x374], 1
jmp 0x1000881a
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0xda4], eax
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
mov ecx, dword [ebp - 0xb8]
cmp dword [eax], ecx
jg 0x10008859
mov dword [ebp - 0x8a4], 1
jmp 0x10008860
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x2a0], eax
je 0x10008886
mov dword [ebp - 0x940], 1
jmp 0x1000888d
and dword [ebp - 0x940], 0
push 3
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
push 1
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
push 3
lea ecx, [ebp - 0x7cc]
call fcn.10013ed2
mov eax, 0xa43b
cmp eax, 7
jg 0x100088ca
mov dword [ebp - 0x710], 1
jmp 0x100088d1
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0x8f21009d
jne 0x100088e9
mov dword [ebp - 0x37c], 1
jmp 0x100088f0
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0xb593
jne 0x10008908
mov dword [ebp - 0x718], 1
jmp 0x1000890f
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
add eax, 0xa8d7
cmp eax, dword [ebp - 0x278]
jl 0x10008930
or eax, 0xffffffff
jne 0x10008930
and dword [ebp - 0x384], 0
jmp 0x1000893a
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x948], eax
jmp 0x100087af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7cc]
call fcn.10013eb6
mov dword [ebp - 0x860], 0xffb871c7
mov dword [ebp - 0x85c], 0xffb871c7
mov dword [ebp - 0x858], 0xffb871c7
mov dword [ebp - 0x854], 0xffb871c7
mov dword [ebp - 0x44], 0x3250e6da
mov dword [ebp - 0x928], 7
mov dword [ebp - 0x39c], 0xc9b780f8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x860], 0x64a6847d
mov dword [ebp - 0x44], 0
jmp 0x100089be
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x10008af4
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x860], 0
je 0x10008ace
xor eax, eax
inc eax
je 0x100089f3
cmp dword [ebp - 0x928], 0
je 0x100089f3
mov dword [ebp - 0x720], 1
jmp 0x100089fa
and dword [ebp - 0x720], 0
cmp dword [ebp - 0x720], 0xffffffff
jg 0x10008a0f
mov dword [ebp - 0x38c], 1
jmp 0x10008a16
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0x39e2
jge 0x10008a2e
mov dword [ebp - 0x728], 1
jmp 0x10008a35
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x39c]
mov edx, dword [ebp - 0x728]
lea ecx, [edx + ecx - 0x3e294c41]
cmp dword [ebp + eax - 0x860], ecx
jle 0x10008a63
mov dword [ebp - 0x394], 1
jmp 0x10008a6a
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xffff
jae 0x10008a82
mov dword [ebp - 0x730], 1
jmp 0x10008a89
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x860]
cmp eax, dword [ebp - 0x730]
jge 0x10008aad
cmp dword [ebp - 0x44], 0
je 0x10008aad
mov dword [ebp - 0x738], 1
jmp 0x10008ab4
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x738], eax
jl 0x10008ace
mov dword [ebp - 0x3a4], 1
jmp 0x10008ad5
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x860]
add eax, dword [ebp - 0x3a4]
mov ecx, dword [ebp - 0x44]
mov dword [ebp + ecx*4 - 0x860], eax
jmp 0x100089b7
mov dword [ebp - 0xac], 0x1928c176
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x138], 5
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x8b4], 0xffffffff
mov dword [ebp - 0x224], 0
jmp 0x10008b3f
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10008b5b
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xaa4], 0xb4763523
jmp 0x10008b32
mov dword [ebp - 0xac], 0xfffffffa
jmp 0x10008b74
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x1d
je 0x10008eac
mov dword [ebp - 0x1ac], 0xd193
mov dword [ebp - 0x134], 4
mov dword [ebp - 0x8c4], 0xbbc1846e
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0xac], 0
je 0x10008c03
cmp dword [ebp - 0x1ac], 1
jae 0x10008bd6
mov dword [ebp - 0x740], 1
jmp 0x10008bdd
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
sub eax, 8
neg eax
imul eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0xac]
je 0x10008c03
mov dword [ebp - 0x3ac], 1
jmp 0x10008c0a
and dword [ebp - 0x3ac], 0
imul eax, dword [ebp - 0x3ac], 0x3718
cmp eax, dword [ebp - 0x138]
jl 0x10008c28
mov dword [ebp - 0x748], 1
jmp 0x10008c2f
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x748]
cmp eax, dword [ebp - 0xac]
jge 0x10008c4f
mov dword [ebp - 0x3b4], 1
jmp 0x10008c56
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x3b4], eax
jle 0x10008c6d
mov eax, 0x7d96711d
test eax, eax
je 0x10008c74
cmp dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x134], 0
je 0x10008d8a
mov dword [ebp - 0x97c], 0xc2f5
mov dword [ebp - 0x3bc], 0x99e1f953
mov dword [ebp - 0x8bc], 0xe7baa9d7
cmp dword [ebp - 0x1ac], 0
je 0x10008d26
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xcaf1e2cd
ja 0x10008ccc
mov dword [ebp - 0x750], 1
jmp 0x10008cd3
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 1
jae 0x10008cf4
mov dword [ebp - 0x758], 1
jmp 0x10008cfb
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
sub eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x138], eax
mov eax, 0xacb314b8
sub eax, dword [ebp - 0x138]
je 0x10008d26
mov dword [ebp - 0x3c4], 1
jmp 0x10008d2d
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0xac]
jne 0x10008d4d
mov dword [ebp - 0x760], 1
jmp 0x10008d54
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x760]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xaa4], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xf8], eax
jmp 0x10008ea7
mov dword [ebp - 0x770], 0xece01153
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x3cc], 1
mov dword [ebp - 0x9bc], 0
mov dword [ebp - 0x984], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
add eax, 0x702b6816
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x9bc]
cmp dword [ebp - 0x3cc], eax
jge 0x10008dee
mov dword [ebp - 0x3d4], 1
jmp 0x10008df5
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
sub eax, dword [ebp - 0x3d4]
cmp dword [ebp - 0x8c4], eax
jl 0x10008e21
mov dword [ebp - 0x3dc], 1
jmp 0x10008e28
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x770]
mov ecx, dword [ebp - 0x3dc]
sub ecx, 0x24e2
imul eax, ecx
test eax, eax
jne 0x10008e69
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaa4], 0
jne 0x10008e69
cmp dword [ebp - 0x984], 0
jne 0x10008e69
and dword [ebp - 0x778], 0
jmp 0x10008e73
mov dword [ebp - 0x778], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaa4]
cmp dword [ebp - 0x778], eax
je 0x10008e94
mov dword [ebp - 0x780], 1
jmp 0x10008e9b
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x138], eax
jmp 0x10008b67
mov dword [ebp - 0x8dc], 0xffffffff
mov dword [ebp - 0x98c], 0xfffffff7
mov dword [ebp - 0x8d4], 0xc96c7979
mov dword [ebp - 0x234], 8
mov dword [ebp - 0x280], 7
mov dword [ebp - 0x9c4], 0x68906353
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0x420], 0xbff1eb7e
mov dword [ebp - 0x3f8], 0xfc4b664f
mov dword [ebp - 0x20], 0
jmp 0x10008f16
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10008f2c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x79c], 0
jmp 0x10008f0f
mov dword [ebp - 0x20], 0
jmp 0x10008f3c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10008f52
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xde4], 0x196ee4e9
jmp 0x10008f35
mov dword [ebp - 0x20], 0
jmp 0x10008f62
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10008f78
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc38], 0xd46d2320
jmp 0x10008f5b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8cc]
cmp dword [ebp + eax - 0x79c], ecx
je 0x10008f99
mov dword [ebp - 0x414], 1
jmp 0x10008fa0
and dword [ebp - 0x414], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x420]
cmp dword [ebp + eax - 0x79c], ecx
jle 0x10008fc1
mov dword [ebp - 0x424], 1
jmp 0x10008fc8
and dword [ebp - 0x424], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x79c]
add eax, dword [ebp - 0x424]
cmp dword [ebp - 0x414], eax
je 0x10008fef
mov dword [ebp - 0x3f0], 1
jmp 0x10008ff6
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x9c4]
cmp eax, dword [ebp - 0x3f0]
jg 0x10009010
mov dword [ebp - 0x5c8], 1
jmp 0x10009017
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x5c8], eax
jg 0x10009031
mov dword [ebp - 0x72c], 1
jmp 0x10009038
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x72c], eax
jge 0x10009052
mov dword [ebp - 0x400], 1
jmp 0x10009059
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x8d4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc38]
cmp dword [ebp + eax - 0x79c], ecx
je 0x1000908c
mov dword [ebp - 0x5d0], 1
jmp 0x10009093
and dword [ebp - 0x5d0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc38]
cmp dword [ebp - 0x5d0], eax
je 0x100090b3
mov dword [ebp - 0x408], 1
jmp 0x100090ba
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x408], eax
jge 0x100090d4
mov dword [ebp - 0x6bc], 1
jmp 0x100090db
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x6bc]
jg 0x10009102
mov dword [ebp - 0x410], 1
jmp 0x10009109
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
neg eax
cmp eax, dword [ebp - 0x234]
jl 0x10009125
mov dword [ebp - 0x5d8], 1
jmp 0x1000912c
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x418], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x418]
mov dword [ebp + eax - 0xde4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x79c]
cmp dword [ebp - 0x418], eax
jle 0x10009178
mov dword [ebp - 0x784], 1
jmp 0x1000917f
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0
je 0x10009194
mov dword [ebp - 0x5e0], 1
jmp 0x1000919b
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x5e0], eax
jle 0x100091b5
mov dword [ebp - 0x428], 1
jmp 0x100091bc
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0xeef20fe6
jae 0x100091d4
mov dword [ebp - 0x6c4], 1
jmp 0x100091db
and dword [ebp - 0x6c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc38]
cmp dword [ebp - 0x6c4], eax
jne 0x100091fb
mov dword [ebp - 0x430], 1
jmp 0x10009202
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0xb4], 0x1928c176
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x158], 5
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x9cc], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x10009259
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x10009275
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0xa44], 0xb4763523
jmp 0x1000924c
mov dword [ebp - 0xb4], 0xfffffffa
jmp 0x1000928e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x1d
je 0x100095c6
mov dword [ebp - 0x148], 0xd193
mov dword [ebp - 0x150], 4
mov dword [ebp - 0x9d4], 0xbbc1846e
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xdc4], eax
cmp dword [ebp - 0xb4], 0
je 0x1000931d
cmp dword [ebp - 0x148], 1
jae 0x100092f0
mov dword [ebp - 0x5e8], 1
jmp 0x100092f7
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
sub eax, 8
neg eax
imul eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0xb4]
je 0x1000931d
mov dword [ebp - 0x438], 1
jmp 0x10009324
and dword [ebp - 0x438], 0
imul eax, dword [ebp - 0x438], 0x3718
cmp eax, dword [ebp - 0x158]
jl 0x10009342
mov dword [ebp - 0x734], 1
jmp 0x10009349
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x734]
cmp eax, dword [ebp - 0xb4]
jge 0x10009369
mov dword [ebp - 0x440], 1
jmp 0x10009370
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x440], eax
jle 0x10009387
mov eax, 0x7d96711d
test eax, eax
je 0x1000938e
cmp dword [ebp - 0x23c], 0
cmp dword [ebp - 0x150], 0
je 0x100094a4
mov dword [ebp - 0x8e4], 0xc2f5
mov dword [ebp - 0x448], 0x99e1f953
mov dword [ebp - 0x994], 0xe7baa9d7
cmp dword [ebp - 0x148], 0
je 0x10009440
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xcaf1e2cd
ja 0x100093e6
mov dword [ebp - 0x5f0], 1
jmp 0x100093ed
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 1
jae 0x1000940e
mov dword [ebp - 0x6cc], 1
jmp 0x10009415
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
sub eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x158], eax
mov eax, 0xacb314b8
sub eax, dword [ebp - 0x158]
je 0x10009440
mov dword [ebp - 0x450], 1
jmp 0x10009447
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x450]
cmp eax, dword [ebp - 0xb4]
jne 0x10009467
mov dword [ebp - 0x5f8], 1
jmp 0x1000946e
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0x5f8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa44], eax
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x100], eax
jmp 0x100095c1
mov dword [ebp - 0x600], 0xece01153
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x8f4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa44]
add eax, 0x702b6816
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x8ec]
cmp dword [ebp - 0x458], eax
jge 0x10009508
mov dword [ebp - 0x460], 1
jmp 0x1000950f
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
sub eax, dword [ebp - 0x460]
cmp dword [ebp - 0x9d4], eax
jl 0x1000953b
mov dword [ebp - 0x468], 1
jmp 0x10009542
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x600]
mov ecx, dword [ebp - 0x468]
sub ecx, 0x24e2
imul eax, ecx
test eax, eax
jne 0x10009583
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa44], 0
jne 0x10009583
cmp dword [ebp - 0x8f4], 0
jne 0x10009583
and dword [ebp - 0x6d4], 0
jmp 0x1000958d
mov dword [ebp - 0x6d4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa44]
cmp dword [ebp - 0x6d4], eax
je 0x100095ae
mov dword [ebp - 0x470], 1
jmp 0x100095b5
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x158], eax
jmp 0x10009281
mov dword [ebp - 0x160], 0xfffffffc
mov dword [ebp - 0x160], 0
jmp 0x100095e9
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x17
jne 0x10009643
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x168], 0
jmp 0x10009615
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xc
jg 0x10009641
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000963f
push 0
push 0
push 0xbe1
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x10009608
jmp 0x100095dc
movzx eax, byte [0x1065c63c]
test eax, eax
je 0x10009661
mov esi, 0x100712e8
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000d712
mov dword [ebp - 0xaf0], 5
mov dword [ebp - 0xaec], 5
mov dword [ebp - 0xae8], 5
mov dword [ebp - 0xae4], 5
lea ecx, [ebp - 0x2c2]
call fcn.10006dcf
push eax
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0xe9c]
call fcn.10013ee1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x82c]
call fcn.10013e90
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xbc], 0xfffffff6
mov dword [ebp - 0x9dc], 0xa2910a83
mov dword [ebp - 0xbc], 0
jmp 0x100096f2
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x10009881
mov dword [ebp - 0x244], 0x504dbf0c
mov dword [ebp - 0x24c], 7
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
cmp dword [eax], 0x826a056e
jb 0x10009749
mov dword [ebp - 0x608], 1
jmp 0x10009750
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xdcc], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
mov ecx, dword [ebp - 0xbc]
cmp dword [eax], ecx
jg 0x1000978f
mov dword [ebp - 0x99c], 1
jmp 0x10009796
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x244], eax
je 0x100097bc
mov dword [ebp - 0x8fc], 1
jmp 0x100097c3
and dword [ebp - 0x8fc], 0
push 3
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
push 1
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
push 3
lea ecx, [ebp - 0x82c]
call fcn.10013ed2
mov eax, 0xa43b
cmp eax, 7
jg 0x10009800
mov dword [ebp - 0x478], 1
jmp 0x10009807
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0x8f21009d
jne 0x1000981f
mov dword [ebp - 0x73c], 1
jmp 0x10009826
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0xb593
jne 0x1000983e
mov dword [ebp - 0x480], 1
jmp 0x10009845
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
add eax, 0xa8d7
cmp eax, dword [ebp - 0x24c]
jl 0x10009866
or eax, 0xffffffff
jne 0x10009866
and dword [ebp - 0x610], 0
jmp 0x10009870
mov dword [ebp - 0x610], 1
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x9dc], eax
jmp 0x100096e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.10013eb6
mov dword [ebp - 0xcf4], 0x100712e8
mov dword [ebp - 0xb18], 8
mov dword [ebp - 0xb14], 8
mov dword [ebp - 0xb10], 8
mov dword [ebp - 0xb0c], 8
lea ecx, [ebp - 0x28d]
call fcn.10006dcf
push eax
lea eax, [ebp - 0xb08]
push eax
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0xe84]
call fcn.10013ee1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa5c]
call fcn.10013e90
mov dword [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0xc50]
call fcn.10013e31
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x12c], 0
jmp 0x10009928
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x1000994a
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xc50]
call fcn.10013ed2
mov dword [eax], 0x2491e29e
jmp 0x1000991b
push 0
lea ecx, [ebp - 0xa5c]
call fcn.10013ed2
and dword [eax], 0
jmp 0x10009980
push 0
lea ecx, [ebp - 0xa5c]
call fcn.10013ed2
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x488]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa5c]
call fcn.10013ed2
cmp dword [eax], 0xfffffff2
jle 0x10009a40
push 2
lea ecx, [ebp - 0xa8c]
call fcn.10013e31
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x170], 0
jmp 0x100099c0
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x100099e2
push dword [ebp - 0x170]
lea ecx, [ebp - 0xa8c]
call fcn.10013ed2
mov dword [eax], 0x19c5a654
jmp 0x100099b3
push 0
lea ecx, [ebp - 0xc50]
call fcn.10013ed2
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x6dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6dc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10013ed2
cmp dword [eax], 0
je 0x10009a2c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa8c]
call fcn.10013eb6
jmp 0x1000995c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa8c]
call fcn.10013eb6
jmp 0x1000995c
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc50]
call fcn.10013eb6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa5c]
call fcn.10013eb6
mov dword [ebp - 0x878], 0xffb871c7
mov dword [ebp - 0x874], 0xffb871c7
mov dword [ebp - 0x870], 0xffb871c7
mov dword [ebp - 0x86c], 0xffb871c7
mov dword [ebp - 0x8c], 0x3250e6da
mov dword [ebp - 0x904], 7
mov dword [ebp - 0x620], 0xc9b780f8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x878], 0x64a6847d
mov dword [ebp - 0x8c], 0
jmp 0x10009ace
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x10009c16
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x878], 0
je 0x10009bea
xor eax, eax
inc eax
je 0x10009b09
cmp dword [ebp - 0x904], 0
je 0x10009b09
mov dword [ebp - 0x490], 1
jmp 0x10009b10
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0xffffffff
jg 0x10009b25
mov dword [ebp - 0x618], 1
jmp 0x10009b2c
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0x39e2
jge 0x10009b44
mov dword [ebp - 0x498], 1
jmp 0x10009b4b
and dword [ebp - 0x498], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x498]
lea ecx, [edx + ecx - 0x3e294c41]
cmp dword [ebp + eax - 0x878], ecx
jle 0x10009b79
mov dword [ebp - 0x794], 1
jmp 0x10009b80
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xffff
jae 0x10009b98
mov dword [ebp - 0x4a0], 1
jmp 0x10009b9f
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x878]
cmp eax, dword [ebp - 0x4a0]
jge 0x10009bc9
cmp dword [ebp - 0x8c], 0
je 0x10009bc9
mov dword [ebp - 0x4a8], 1
jmp 0x10009bd0
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0x4a8], eax
jl 0x10009bea
mov dword [ebp - 0x6e4], 1
jmp 0x10009bf1
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x878]
add eax, dword [ebp - 0x6e4]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + ecx*4 - 0x878], eax
jmp 0x10009ac1
mov dword [ebp - 0xb40], 5
mov dword [ebp - 0xb3c], 5
mov dword [ebp - 0xb38], 5
mov dword [ebp - 0xb34], 5
lea ecx, [ebp - 0x255]
call fcn.10006dcf
push eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0xb40]
push eax
lea ecx, [ebp - 0xe54]
call fcn.10013ee1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7e4]
call fcn.10013e90
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xc4], 0xfffffff6
mov dword [ebp - 0x9e4], 0xa2910a83
mov dword [ebp - 0xc4], 0
jmp 0x10009ca7
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x10009e36
mov dword [ebp - 0x254], 0x504dbf0c
mov dword [ebp - 0x25c], 7
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
cmp dword [eax], 0x826a056e
jb 0x10009cfe
mov dword [ebp - 0x4b0], 1
jmp 0x10009d05
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0xcd0], eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
mov ecx, dword [ebp - 0xc4]
cmp dword [eax], ecx
jg 0x10009d44
mov dword [ebp - 0x9a4], 1
jmp 0x10009d4b
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x254], eax
je 0x10009d71
mov dword [ebp - 0x90c], 1
jmp 0x10009d78
and dword [ebp - 0x90c], 0
push 3
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
push 1
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
push 3
lea ecx, [ebp - 0x7e4]
call fcn.10013ed2
mov eax, 0xa43b
cmp eax, 7
jg 0x10009db5
mov dword [ebp - 0x628], 1
jmp 0x10009dbc
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0x8f21009d
jne 0x10009dd4
mov dword [ebp - 0x4b8], 1
jmp 0x10009ddb
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xb593
jne 0x10009df3
mov dword [ebp - 0x744], 1
jmp 0x10009dfa
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
add eax, 0xa8d7
cmp eax, dword [ebp - 0x25c]
jl 0x10009e1b
or eax, 0xffffffff
jne 0x10009e1b
and dword [ebp - 0x4c0], 0
jmp 0x10009e25
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x9e4], eax
jmp 0x10009c9a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e4]
call fcn.10013eb6
mov dword [ebp - 0x90], 0xfffffff7
push 2
lea ecx, [ebp - 0xdb8]
call fcn.10013e31
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x78], 0
jmp 0x10009e73
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10009e89
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xea8], 1
jmp 0x10009e6c
mov dword [ebp - 0x78], 0
jmp 0x10009e99
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10009eb5
push dword [ebp - 0x78]
lea ecx, [ebp - 0xdb8]
call fcn.10013ed2
mov dword [eax], 0xb6182eac
jmp 0x10009e92
mov dword [ebp - 0x90], 2
jmp 0x10009ece
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10009ef0
mov dword [ebp - 0x630], 0x8cccddd
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
jmp 0x10009ec1
cmp dword [ebp - 0x90], 0
je 0x10009f68
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10009f13
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov dword [ebp - 0x90], 0xffffffef
jmp 0x10009f2c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff8
jl 0x10009f66
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10009f64
push 0x22d6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
jmp 0x10009f1f
jmp 0x10009f91
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x10009f91
push 0x264f
push 0x1122
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb8]
call fcn.10013eb6
mov dword [ebp - 0x924], 0xffffffff
mov dword [ebp - 0x9ec], 0xfffffff7
mov dword [ebp - 0x91c], 0xc96c7979
mov dword [ebp - 0x26c], 8
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x9ac], 0x68906353
mov dword [ebp - 0x914], 1
mov dword [ebp - 0x500], 0xbff1eb7e
mov dword [ebp - 0x4d8], 0xfc4b664f
mov dword [ebp - 0x24], 0
jmp 0x1000a00a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000a020
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7a8], 0
jmp 0x1000a003
mov dword [ebp - 0x24], 0
jmp 0x1000a030
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000a046
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdfc], 0x196ee4e9
jmp 0x1000a029
mov dword [ebp - 0x24], 0
jmp 0x1000a056
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000a06c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc68], 0xd46d2320
jmp 0x1000a04f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x914]
cmp dword [ebp + eax - 0x7a8], ecx
je 0x1000a08d
mov dword [ebp - 0x6ec], 1
jmp 0x1000a094
and dword [ebp - 0x6ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x500]
cmp dword [ebp + eax - 0x7a8], ecx
jle 0x1000a0b5
mov dword [ebp - 0x4c8], 1
jmp 0x1000a0bc
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
add eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x6ec], eax
je 0x1000a0e3
mov dword [ebp - 0x4d0], 1
jmp 0x1000a0ea
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x9ac]
cmp eax, dword [ebp - 0x4d0]
jg 0x1000a104
mov dword [ebp - 0x638], 1
jmp 0x1000a10b
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x638], eax
jg 0x1000a125
mov dword [ebp - 0x774], 1
jmp 0x1000a12c
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x774], eax
jge 0x1000a146
mov dword [ebp - 0x4e0], 1
jmp 0x1000a14d
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x91c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc68]
cmp dword [ebp + eax - 0x7a8], ecx
je 0x1000a180
mov dword [ebp - 0x640], 1
jmp 0x1000a187
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc68]
cmp dword [ebp - 0x640], eax
je 0x1000a1a7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret