Function at 0x10020205
Capabilities:
Create pipe
Create thread
Get common file path
Get keyboard layout
Parse pe header
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov eax, 0x10089345
call fcn.10088158
mov eax, 0x138c
call fcn.10084160
push ebx
push esi
push edi
mov dword [ebp - 0x44], 0xffffffff
push 0xfffffffffffffff6
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x60], ecx
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 7
push 5
pop eax
mov dword [ebp - 0x40], 0xe7374489
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
push 3
mov dword [ebp - 0x10], eax
pop esi
mov byte [ebp - 0x69], dl
cmp dword [ebp - 0x10], esi
jge 0x1002026e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x114c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002025a
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002027f
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0x44]
mov ecx, 0xffff
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor edi, edi
inc eax
inc edi
cmp eax, ecx
jbe 0x100202c5
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100202c7
mov edx, edi
jmp 0x100202c9
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov ebx, 0x12b57e8b
push 5
setle cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov ecx, 0xaee51190
setge dl
mov dword [ebp - 0x1148], edx
mov eax, dword [ebp - 0x30]
add eax, edx
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov ecx, ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub ecx, eax
imul ecx, dword [ebp - 0x30]
pop eax
push 2
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xa04]
mov dword [ebp - 0x34], eax
pop eax
mov dword [ebp - 0x50], 0xffffffff
push eax
call fcn.10010227
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10020358
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10020340
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10020386
push ecx
pop edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa04]
call fcn.1001026e
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10020365
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xd
jne 0x10020400
jmp 0x10020399
xor eax, eax
mov dword [ebp - 0x10], 0x457102d1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100203b2
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
mov dword [ebp - 0x10], 0xffffffe3
cmp dword [ebp - 0x10], edi
jge 0x100203f1
jmp 0x100203c2
xor eax, eax
push eax
lea ecx, [ebp - 0xa04]
call fcn.1001026e
mov dword [eax], 0x33c63384
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x100203e9
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100203c0
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], 0xd
je 0x10020397
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.10010269
mov dword [ebp - 0x54], 0x44696a48
xor eax, eax
mov dword [ebp - 0x28], edi
push 4
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0x88f4f368
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10020452
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf44], 0x2bd7b1c2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002043a
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10020460
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x18], 0x5c68ec0a
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100204ab
push 5
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xed0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10020499
mov dword [ebp - 0x18], 0xffffffe7
cmp dword [ebp - 0x18], 0xffffffe9
je 0x100206b1
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x4ac]
call fcn.10010227
push edi
lea ecx, [ebp - 0x688]
mov dword [ebp - 4], edi
call fcn.10010227
push 2
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 0x34], 0xffffffff
push ebx
call fcn.10010227
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x24], 0xf5b50694
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10020525
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4ac]
call fcn.1001026e
mov dword [eax], 0xe75cb554
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10020507
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002054b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x688]
call fcn.1001026e
mov dword [eax], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002052d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10020563
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7d0]
call fcn.1001026e
mov dword [eax], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10020550
push 2
pop eax
push eax
lea ecx, [ebp - 0x4ac]
call fcn.1001026e
mov esi, eax
lea ecx, [ebp - 0x688]
xor eax, eax
push eax
call fcn.1001026e
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4ac]
setg bl
xor eax, eax
push eax
call fcn.1001026e
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ebx, 0xffff
setg dl
xor ecx, ecx
cmp edx, edi
setle cl
cmp ebx, ecx
sbb eax, eax
inc eax
sub eax, dword [esi]
je 0x100205d4
push edi
lea ecx, [ebp - 0x4ac]
call fcn.1001026e
cmp dword [eax], 0
je 0x100205d4
mov eax, edi
jmp 0x100205d6
xor eax, eax
cmp eax, dword [ebp - 0x34]
jg 0x100205de
mov eax, dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0x688]
push eax
call fcn.1001026e
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4ac]
xor eax, eax
push eax
call fcn.1001026e
cmp dword [eax], ebx
jb 0x10020608
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1002060b
mov eax, dword [ebp - 0x18]
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x7d0]
call fcn.1001026e
mov ecx, dword [ebp - 0x34]
xor edx, edx
test ecx, ecx
setg dl
imul ecx, edx, 0xa88f
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.1001026e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x688]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1001026e
push ebx
lea ecx, [ebp - 0x7d0]
mov esi, dword [eax]
sub esi, 0x2c67
call fcn.1001026e
lea ecx, [ebp - 0x7d0]
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x24], eax
call fcn.10010269
lea ecx, [ebp - 0x688]
call fcn.10010269
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.10010269
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jne 0x100204bc
push 3
mov ebx, 0x12b57e8b
pop esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xec8]
mov eax, dword [ebp - 0xec4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xec8]
neg eax
push esi
sbb eax, eax
inc eax
add eax, esi
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 2
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x974]
mov dword [ebp - 0x28], eax
call fcn.10010227
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0xa4d0
mov dword [ebp - 0x3c], 0x2a727599
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10020732
push dword [ebp - 0x10]
lea ecx, [ebp - 0x974]
call fcn.1001026e
mov dword [eax], 0xe9d05ba7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10020714
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10020748
push eax
push 0x1138
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 2
pop eax
push eax
lea ecx, [ebp - 0x974]
call fcn.1001026e
push 2
lea ecx, [ebp - 0x974]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
pop eax
push eax
call fcn.1001026e
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x974]
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 4
pop esi
push esi
lea ecx, [ebp - 0xb9c]
call fcn.10010227
push 5
pop eax
mov dword [ebp - 4], eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xfffffffb
jg 0x10020897
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
cmp eax, 0xa82a
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
add eax, ecx
jne 0x10020822
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10020853
cmp dword [ebp - 0x34], eax
je 0x10020853
mov dword [ebp - 0x24], 0x62f63069
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002084e
push 0x24fb
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [ebp - 0x24]
jmp 0x10020888
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x1002086c
push eax
push 0x1829
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002088a
push eax
push eax
push 0x1586
push 0x23c
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffb
jle 0x100207c6
mov dword [ebp - 0x24], 0x7e673292
xor eax, eax
mov dword [ebp - 0x34], 0x9737e0d1
mov dword [ebp - 0x10], eax
jmp 0x100208bd
push dword [ebp - 0x10]
call fcn.1001026e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xb9c]
cmp dword [ebp - 0x10], esi
jl 0x100208ac
mov esi, dword [ebp - 0x54]
xor eax, eax
inc eax
push eax
call fcn.1001026e
lea ecx, [ebp - 0xb9c]
mov dword [eax], esi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 5
pop eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xa1c]
mov dword [ebp - 0x54], 0xffffffff
xor eax, eax
push 4
mov dword [ebp - 0x3c], esi
pop esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
push esi
call fcn.10010227
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50], 0x7e673292
mov dword [ebp - 0x34], 0x9737e0d1
mov dword [ebp - 0x10], eax
jmp 0x1002095d
push dword [ebp - 0x10]
call fcn.1001026e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xa1c]
cmp dword [ebp - 0x10], esi
jl 0x1002094c
mov esi, dword [ebp - 0x3c]
xor eax, eax
inc eax
push eax
call fcn.1001026e
lea ecx, [ebp - 0xa1c]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 5
pop eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xc8c]
mov dword [ebp - 0x54], 0xffffffff
xor eax, eax
push 4
mov dword [ebp - 0x3c], esi
pop esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
push esi
call fcn.10010227
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x50], 0x7e673292
mov dword [ebp - 0x34], 0x9737e0d1
mov dword [ebp - 0x10], eax
jmp 0x100209fe
push dword [ebp - 0x10]
call fcn.1001026e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xc8c]
cmp dword [ebp - 0x10], esi
jl 0x100209ed
mov esi, dword [ebp - 0x3c]
xor eax, eax
inc eax
push eax
call fcn.1001026e
lea ecx, [ebp - 0xc8c]
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10020a68
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x770], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10020a54
xor eax, eax
xor esi, esi
mov dword [ebp - 0x76c], eax
inc esi
cmp dword [ebp - 0x76c], 0xfffffff8
jg 0x10020b24
push esi
lea ecx, [ebp - 0xdd0]
call fcn.10010227
push 8
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10020abb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdd0]
call fcn.1001026e
mov dword [eax], 0x683c8fc5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10020a9d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10020afd
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10020ad5
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10020af8
push eax
push 0x1339
push eax
push eax
push 0x1850
push 0x1f45
call dword [sym.imp.USER32.dll_ToAsciiEx]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10020ac3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd0]
call fcn.10010269
dec dword [ebp - 0x76c]
cmp dword [ebp - 0x76c], 0xfffffff8
jle 0x10020a7e
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], 0xe7374489
push 5
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10020b70
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1194], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10020b58
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10020b81
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0x44]
mov edx, 0xffff
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
cmp eax, edx
jbe 0x10020bc4
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10020bc6
mov edx, esi
jmp 0x10020bc8
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
push 5
setle cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov ecx, 0xaee51190
setge dl
mov dword [ebp - 0x1190], edx
mov eax, dword [ebp - 0x30]
add eax, edx
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
lea ecx, [ebp - 0xa34]
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub ebx, eax
imul ebx, dword [ebp - 0x30]
pop eax
push 2
mov dword [ebp - 0x24], ebx
pop ebx
mov dword [ebp - 0x34], eax
push ebx
call fcn.10010227
xor eax, eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10020c4d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10020c35
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10020c73
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa34]
call fcn.1001026e
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10020c55
xor eax, eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xd
jne 0x10020ced
jmp 0x10020c86
xor eax, eax
mov dword [ebp - 0x10], 0x457102d1
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10020c9f
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
mov dword [ebp - 0x10], 0xffffffe3
cmp dword [ebp - 0x10], esi
jge 0x10020cde
jmp 0x10020caf
xor eax, eax
push eax
lea ecx, [ebp - 0xa34]
call fcn.1001026e
mov dword [eax], 0x33c63384
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10020cd6
push 0x1e40
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10020cad
inc dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], 0xd
je 0x10020c84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.10010269
mov dword [ebp - 0x50], 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], esi
push 4
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x54], 0x88f4f368
mov dword [ebp - 0x4c], 0xfffffff6
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x10020d42
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xff0], 0x2bd7b1c2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10020d2a
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10020d50
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xff0]
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x54], 0x44696a48
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x18], 0x5c68ec0a
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10020da2
push 5
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xeec], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10020d90
mov dword [ebp - 0x18], 0xffffffe7
cmp dword [ebp - 0x18], 0xffffffe9
je 0x10020fae
push ebx
lea ecx, [ebp - 0x44c]
call fcn.10010227
push esi
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], 0xa
call fcn.10010227
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x98c]
mov dword [ebp - 0x34], 0xffffffff
push ebx
call fcn.10010227
mov byte [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x24], 0xf5b50694
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10020e1c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x44c]
call fcn.1001026e
mov dword [eax], 0xe75cb554
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10020dfe
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10020e42
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6a0]
call fcn.1001026e
mov dword [eax], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10020e24
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10020e5a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x98c]
call fcn.1001026e
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10020e47
push 2
pop eax
push eax
lea ecx, [ebp - 0x44c]
call fcn.1001026e
mov esi, eax
lea ecx, [ebp - 0x6a0]
xor eax, eax
push eax
call fcn.1001026e
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x44c]
setg bl
xor eax, eax
push eax
call fcn.1001026e
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov eax, 0xffff
setg dl
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp edx, ebx
setle cl
cmp eax, ecx
sbb eax, eax
inc eax
sub eax, dword [esi]
je 0x10020ece
push ebx
lea ecx, [ebp - 0x44c]
call fcn.1001026e
cmp dword [eax], 0
je 0x10020ece
mov eax, ebx
jmp 0x10020ed0
xor eax, eax
cmp eax, dword [ebp - 0x34]
jg 0x10020ed8
mov eax, dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0x6a0]
push eax
call fcn.1001026e
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x44c]
xor eax, eax
push eax
call fcn.1001026e
mov edx, 0xffff
cmp dword [eax], edx
jb 0x10020f07
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10020f0a
mov eax, dword [ebp - 0x18]
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x98c]
call fcn.1001026e
mov ecx, dword [ebp - 0x34]
xor edx, edx
test ecx, ecx
setg dl
imul ecx, edx, 0xa88f
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.1001026e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x6a0]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.1001026e
push ebx
lea ecx, [ebp - 0x98c]
mov esi, dword [eax]
sub esi, 0x2c67
call fcn.1001026e
lea ecx, [ebp - 0x98c]
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x24], eax
call fcn.10010269
lea ecx, [ebp - 0x6a0]
call fcn.10010269
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.10010269
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
push 1
pop esi
push 3
pop ebx
jne 0x10020db3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xee4]
mov eax, dword [ebp - 0xee0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xee4]
neg eax
push ebx
sbb eax, eax
inc eax
add eax, ebx
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 2
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x920]
mov dword [ebp - 0x38], eax
call fcn.10010227
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x24], 0xa4d0
mov dword [ebp - 0x3c], 0x2a727599
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10021030
push dword [ebp - 0x10]
lea ecx, [ebp - 0x920]
call fcn.1001026e
mov dword [eax], 0xe9d05ba7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10021012
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10021046
push eax
push 0x1138
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 2
pop eax
push eax
lea ecx, [ebp - 0x920]
call fcn.1001026e
push 2
lea ecx, [ebp - 0x920]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
pop eax
push eax
call fcn.1001026e
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x920]
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 4
pop eax
push eax
lea ecx, [ebp - 0xa4c]
call fcn.10010227
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xfffffffb
jg 0x10021190
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
cmp eax, 0xa82a
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
add eax, ecx
jne 0x1002111b
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1002114c
cmp dword [ebp - 0x34], eax
je 0x1002114c
mov dword [ebp - 0x24], 0x62f63069
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10021147
push 0x24fb
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [ebp - 0x24]
jmp 0x10021181
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10021165
push eax
push 0x1829
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10021183
push eax
push eax
push 0x1586
push 0x23c
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffb
jle 0x100210bf
mov dword [ebp - 0x30], 0x7e673292
xor eax, eax
mov dword [ebp - 0x40], 0x9737e0d1
mov dword [ebp - 0x20], 0x1a049fe3
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], 0xffffffe5
cmp dword [ebp - 0x20], 0x1d
jl 0x1002126a
mov esi, 0xffff
mov dword [ebp - 0x3c], esi
xor ecx, ecx
mov dword [ebp - 0x10], 0x5db2b058
mov dword [ebp - 0x34], 0xfffffff7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, edx
setl cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub eax, ecx
sub eax, dword [ebp - 0x28]
imul ecx, eax, 0x162d
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setle dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jge 0x100211ca
xor esi, esi
inc esi
mov dword [ebp - 0x28], 0x40d7f825
mov dword [ebp - 0x24], 0x772304b2
mov dword [ebp - 0x28], 0xffffffe5
cmp dword [ebp - 0x28], 0xfffffffc
jge 0x100212f0
push 4
pop esi
push esi
lea ecx, [ebp - 0xbb4]
call fcn.10010227
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100212c0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbb4]
call fcn.1001026e
mov dword [eax], 0x3ff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100212a2
xor eax, eax
push eax
lea ecx, [ebp - 0xbb4]
call fcn.1001026e
lea ecx, [ebp - 0xbb4]
dec dword [eax]
mov dword [ebp - 0x24], 0x59951ea6
mov byte [ebp - 4], 0xe
call fcn.10010269
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffc
jl 0x10021288
xor esi, esi
inc esi
xor eax, eax
mov dword [ebp - 0x10], eax
push 4
pop eax
cmp dword [ebp - 0x10], eax
jge 0x1002131e
push eax
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa4c]
call fcn.1001026e
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100212ff
xor esi, esi
inc esi
push 2
pop eax
push eax
lea ecx, [ebp - 0x568]
call fcn.10010227
xor eax, eax
mov byte [ebp - 4], 0x10
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1002135c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x568]
call fcn.1001026e
push 2
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1002133e
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.1001026e
and dword [eax], 0
jmp 0x10021452
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffeb
jl 0x10021444
push esi
lea ecx, [ebp - 0x55c]
call fcn.10010227
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100213ba
push dword [ebp - 0x10]
lea ecx, [ebp - 0x55c]
call fcn.1001026e
mov dword [eax], 0x3690f1d8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002139c
xor eax, eax
push eax
lea ecx, [ebp - 0x55c]
call fcn.1001026e
mov dword [eax], 9
jmp 0x10021413
mov dword [ebp - 0x10], 0x5e4b7834
mov dword [ebp - 0x10], 0xffffffe2
cmp dword [ebp - 0x10], 0xfffffffc
jl 0x10021403
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x100213fa
push 0xefa
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
jge 0x100213e4
xor eax, eax
lea ecx, [ebp - 0x55c]
push eax
call fcn.1001026e
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x55c]
push eax
call fcn.1001026e
cmp dword [eax], 0x15
jge 0x100213ce
lea ecx, [ebp - 0x55c]
mov byte [ebp - 4], 0x10
call fcn.10010269
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffeb
jge 0x10021382
xor eax, eax
push eax
lea ecx, [ebp - 0x568]
call fcn.1001026e
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x568]
push eax
call fcn.1001026e
cmp dword [eax], 0xc
jle 0x10021370
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xe
call fcn.10010269
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0xa4c]
xor eax, eax
inc eax
push eax
call fcn.1001026e
lea ecx, [ebp - 0xa4c]
mov dword [eax], esi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 5
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], 0x2c5b641b
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x54], 0x6de6
mov dword [ebp - 0x3c], 0xe50714ba
mov dword [ebp - 0x24], 0x6d56a426
mov dword [ebp - 0x3c], 0x971cf717
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x1002150b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x324], 0x83bc1b0f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100214fa
mov eax, dword [ebp - 0x31c]
xor edx, edx
xor eax, eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x31c]
setl bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
setge cl
imul ecx, dword [ebp - 0x30]
neg ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10021560
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x324], 0xffff
test eax, eax
je 0x1002157f
xor eax, eax
cmp dword [ebp - 0x31c], eax
je 0x10021581
xor esi, esi
inc esi
mov eax, esi
jmp 0x10021584
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x54]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
je 0x100215bf
mov ecx, esi
cmp dword [ebp - 0x30], eax
jne 0x100215c1
mov ecx, eax
mov eax, dword [ebp - 0x31c]
add eax, 0xffffe6fc
add eax, ecx
mov ecx, dword [ebp - 0x30]
add ecx, eax
mov dword [ebp - 0x24], ecx
push 5
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], 0x2c5b641b
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x54], 0x6de6
mov dword [ebp - 0x3c], 0xe50714ba
mov dword [ebp - 0x24], 0x6d56a426
mov dword [ebp - 0x3c], 0x971cf717
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x10021625
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x354], 0x83bc1b0f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10021614
mov eax, dword [ebp - 0x34c]
xor edx, edx
xor eax, eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x34c]
setl bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
setge cl
imul ecx, dword [ebp - 0x30]
neg ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1002167b
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x354], 0xffff
test eax, eax
je 0x10021697
xor eax, eax
cmp dword [ebp - 0x34c], eax
je 0x10021699
mov eax, esi
jmp 0x10021699
xor eax, eax
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x350]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x350]
sub edx, eax
mov eax, dword [ebp - 0x54]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
je 0x100216d4
mov ecx, esi
cmp dword [ebp - 0x30], eax
jne 0x100216d6
mov ecx, eax
mov eax, dword [ebp - 0x34c]
add eax, 0xffffe6fc
add eax, ecx
mov ecx, dword [ebp - 0x30]
add ecx, eax
xor eax, eax
mov dword [ebp - 0x24], ecx
mov ecx, 0xffff
mov dword [ebp - 0x28], 0xdfe4d9ed
mov dword [ebp - 0x40], 0x1289
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x7f4a1d2d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0xb281
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x54], 0x48fb8aaa
push 3
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x1002174b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c4], 0xbf58
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10021733
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002176e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd2c], 0xc44d9964
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10021756
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10021784
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ac], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10021773
mov eax, dword [ebp - 0x40]
xor edx, edx
add eax, 0xdfddae9
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c4]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
imul eax, ecx, 0xfffffff8
sub eax, dword [ebp - 0x4c4]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffff8
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0x4c4]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4bc]
sete cl
xor edx, edx
cmp ecx, 0xfffffff6
setne dl
sub edx, eax
cmp edx, dword [ebp - 0x4c0]
jne 0x10021801
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10021803
mov eax, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1002181f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0x839bf5bf
setne cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x1ac]
cmp eax, 0xf58a
mov eax, dword [ebp - 0x1ac]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
inc ecx
cmp ecx, 0x7e942faf
je 0x10021872
mov eax, dword [ebp - 0xd2c]
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x3c], 0x58b0
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10021897
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1ac]
jne 0x100218ab
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xd2c]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c4]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x50ed
setge dl
imul edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xd2c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 7
je 0x10021930
mov eax, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1002193c
cmp dword [ebp - 0x20], eax
je 0x1002193e
mov eax, esi
mov dword [ebp - 0x20], eax
xor eax, eax
push 5
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], 0x2c5b641b
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x54], 0x6de6
mov dword [ebp - 0x3c], 0xe50714ba
mov dword [ebp - 0x24], 0x6d56a426
mov dword [ebp - 0x3c], 0x971cf717
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x10021990
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x33c], 0x83bc1b0f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1002197f
mov eax, dword [ebp - 0x334]
xor edx, edx
xor eax, eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x334]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x334]
setl bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
setge cl
imul ecx, dword [ebp - 0x30]
neg ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x100219e5
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x33c], 0xffff
test eax, eax
je 0x10021a04
xor eax, eax
cmp dword [ebp - 0x334], eax
je 0x10021a06
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10021a09
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x334]
mov eax, dword [ebp - 0x338]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x338]
sub edx, eax
mov eax, dword [ebp - 0x54]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
je 0x10021a44
mov ecx, ebx
cmp dword [ebp - 0x30], eax
jne 0x10021a46
mov ecx, eax
mov eax, dword [ebp - 0x334]
add eax, 0xffffe6fc
add eax, ecx
mov ecx, dword [ebp - 0x30]
add ecx, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0x1c], 0x5595
mov dword [ebp - 0x34], 0x40c3f30
mov dword [ebp - 0x3c], 0xabebf3b8
push ebx
call fcn.10010227
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x3c], 0x633933b8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x121f2059
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10021ab8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcb0]
call fcn.1001026e
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10021a9e
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10021acd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd68], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10021ac0
cmp dword [ebp - 0x1c], 0xfff7
sbb eax, eax
neg eax
neg eax
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
sub edx, 0x1ee4
neg edx
sbb edx, edx
add edx, 0xea3383bd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xcb0]
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
dec esi
call fcn.1001026e
mov dword [eax], esi
lea eax, [esi + 0x8bbe]
test eax, eax
jne 0x10021b2b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd68], eax
add eax, 0xc653dda
cmp eax, 7
setg cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xcb0]
or dword [ebp - 4], 0xffffffff
call fcn.10010269
push 4
pop eax
mov dword [ebp - 0x3c], 0xc6578637
mov dword [ebp - 0x24], eax
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10021bab
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10021b93
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10021bc4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x540], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10021bb3
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x298]
sub eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x540]
neg eax
push 0xfffffffffffffffa
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x540]
cmp ecx, eax
mov eax, dword [ebp - 0x53c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x298]
setne cl
add eax, ecx
mov ecx, dword [ebp - 0x298]
add ecx, eax
cmp ecx, 0x816f93bd
pop ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x298]
mov eax, dword [ebp - 0x29c]
sub ecx, eax
mov eax, dword [ebp - 0x53c]
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x298]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x298], ecx
mov ecx, 0xffff
mov dword [ebp - 0x28], 0xdfe4d9ed
mov dword [ebp - 0x40], 0x1289
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x7f4a1d2d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0xb281
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x54], 0x48fb8aaa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10021cbc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x464], 0xbf58
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10021ca4
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10021cdf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd0c], 0xc44d9964
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10021cc7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10021cf5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10021ce4
mov eax, dword [ebp - 0x40]
xor edx, edx
add eax, 0xdfddae9
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x464]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
imul eax, ecx, 0xfffffff8
sub eax, dword [ebp - 0x464]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffff8
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x464]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x45c]
sete cl
xor edx, edx
cmp ecx, 0xfffffff6
setne dl
sub edx, eax
cmp edx, dword [ebp - 0x460]
jne 0x10021d72
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10021d74
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10021d90
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0x839bf5bf
setne cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x1b4]
cmp eax, 0xf58a
mov eax, dword [ebp - 0x1b4]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
inc ecx
cmp ecx, 0x7e942faf
je 0x10021de3
mov eax, dword [ebp - 0xd0c]
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x3c], 0x58b0
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x10021e08
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1b4]
jne 0x10021e1c
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xd0c]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x464]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x50ed
setge dl
imul edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xd0c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 7
je 0x10021ea1
mov eax, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10021ead
cmp dword [ebp - 0x20], eax
je 0x10021eaf
mov eax, ebx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x40], 0xfe0a8eac
push ebx
call fcn.10010227
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x54], 0x6cc9ca31
mov dword [ebp - 0x3c], 0x6c8cac31
mov dword [ebp - 0x3c], 0x59f451db
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10021f09
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4dc]
call fcn.1001026e
mov dword [eax], 0x1fe77dd6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10021eeb
xor eax, eax
mov dword [ebp - 0x40], eax
mov ecx, 0x1e948708
jmp 0x1002203f
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 0x3e4], ecx
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0x2a1efe0c
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], eax
jl 0x1002203c
push 6
pop ebx
mov dword [ebp - 0x50], 0x7535
mov dword [ebp - 0x3c], 0xed7c3b7c
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10021f77
push 0x143c
push 0x137
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
xor eax, eax
push eax
lea ecx, [ebp - 0x4dc]
call fcn.1001026e
lea ecx, [ebp - 0x4dc]
mov eax, dword [eax]
add eax, 0x43cc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x3e8]
call fcn.1001026e
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x4dc]
call fcn.1001026e
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x4dc]
setl dl
xor eax, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x3c], eax
push eax
call fcn.1001026e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x54]
setne dl
add eax, dword [ebp - 0x40]
imul edx, edx, 0x194cad9e
xor ecx, ecx
sub edx, 8
cmp eax, edx
setge cl
cmp ebx, ecx
lea ecx, [ebp - 0x4dc]
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3e8]
call fcn.1001026e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
push 0
cmp dword [eax], ecx
setl dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0xd793
imul eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x3e8]
pop eax
jns 0x10021f4d
xor ebx, ebx
mov ecx, 0x1e948708
inc ebx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x15
jge 0x10021f16
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002205f
push eax
push 0x1894
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.10010269
mov dword [ebp - 0x30], 0x125d16df
lea ecx, [ebp - 0x7e8]
mov dword [ebp - 0x10], 0xee327439
mov dword [ebp - 0x38], 0xb6968939
mov dword [ebp - 0x24], 0x4caa8e55
push esi
call fcn.10010227
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x18], 0x57392715
mov dword [ebp - 0x10], eax
jmp 0x100220be
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7e8]
call fcn.1001026e
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100220ab
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
push 2
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [ebp - 0x10], 0x2830
mov eax, dword [ebp - 0x30]
cmp eax, 0x2a67f8b4
mov esi, dword [ebp - 0x10]
setl cl
pop eax
add esi, ecx
lea ecx, [ebp - 0x7e8]
push eax
call fcn.1001026e
xor edx, edx
push 3
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
cmp esi, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
pop esi
setle cl
cmp ecx, 0xa137b189
push 0xfffffffffffffff9
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
pop eax
jl 0x100221c0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x7e8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x18]
call fcn.1001026e
xor edx, edx
mov dword [eax], esi
imul eax, dword [ebp - 0x10], 0xd7e8ee4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
xor ebx, ebx
cmp esi, edx
setle bl
neg ebx
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, ebx
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0xffffffe4
jmp 0x100221ac
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xb
je 0x100221a3
dec dword [ebp - 0x18]
push 0xfffffffffffffff9
pop eax
jns 0x10022141
xor ebx, ebx
push 3
inc ebx
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e8]
call fcn.10010269
push 5
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], 0xd1e1e87d
mov dword [ebp - 0x34], 0x8846b51f
mov dword [ebp - 0x24], 0x33d73c12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10022208
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x914], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100221f4
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10022224
push 0x12c3
push 0x2011
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10022359
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0xde8]
push esi
call fcn.10010227
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x3c], 0x64e48c0c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10022276
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c0], 0xdf39f3c5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1002225e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1002229e
push 5
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xde8]
call fcn.1001026e
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10022281
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x18], 0xfffc
je 0x100222b1
mov ecx, ebx
cmp dword [ebp - 0x910], eax
jne 0x100222b3
mov ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x914], ecx
mov ecx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, dword [ebp - 0x18]
jge 0x100222de
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x914], 0
jne 0x100222de
xor eax, eax
jmp 0x100222e0
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
sub edx, 0x36ae3d46
imul edx, dword [ebp - 0x18]
sub edx, 7
je 0x10022302
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
add eax, 0xfffc
je 0x1002230f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c0]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xde8]
dec dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.10010269
dec dword [ebp - 0x18]
jns 0x10022233
xor eax, eax
mov dword [ebp - 0x34], 0x2c5b641b
mov dword [ebp - 0x4c], 0x24039b64
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10022379
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x1002238b
call edi
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
movdqa xmm0, xmmword [0x10009dc0]
lea eax, [ebp - 0xff0]
mov dword [ebp - 0x4c], 0xbbf9acf2
lea ecx, [ebp - 0x1278]
mov dword [ebp - 0x4c], 0x3a34c865
or edi, 0xffffffff
mov dword [ebp - 0x4c], 0x85ed0657
mov dword [ebp - 0x4c], edi
push eax
mov dword [ebp - 0x24], 0xfffffff8
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x4c], 0x17473468
push eax
movdqu xmmword [ebp - 0x1000], xmm0
call fcn.1001e86c
lea ecx, [ebp - 0x1a7]
mov esi, eax
call fcn.100103d2
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1164]
push dword [esi]
call fcn.1001e846
mov dword [ebp - 0x4c], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x4c], 0x6ff609d7
mov dword [ebp - 0x4c], eax
push 0xfffffffffffffffb
mov dword [ebp - 0x4c], 0xc280563a
pop esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10022444
push 6
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x740], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10022430
xor eax, eax
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x10022454
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
dec dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x740]
cmp eax, 0x7fd1e814
setl cl
xor eax, eax
cmp ecx, ebx
setle al
xor ecx, ecx
cmp eax, 0x283a
setge cl
sub ecx, 0xbeaa32b1
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1164]
call fcn.10010269
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x30], 0x6444696a
mov dword [ebp - 0x3c], 0xfffb
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
jmp 0x100224c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x388], 0x91e66c61
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100224b2
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov esi, 0xe34ef9de
mov eax, dword [ebp - 0x30]
mov edi, 0x1c33c017
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x30]
cmp edx, eax
push 5
sete cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x30]
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
push ebx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x30]
jg 0x100225fb
lea ecx, [ebp - 0x730]
call fcn.10010227
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1002254b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x730]
call fcn.1001026e
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10022530
xor eax, eax
push eax
lea ecx, [ebp - 0x730]
call fcn.1001026e
mov edx, dword [ebp - 0x384]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
sub eax, ecx
jne 0x1002257c
cmp dword [ebp - 0x380], eax
je 0x1002257e
mov ecx, ebx
jmp 0x10022580
xor eax, eax
mov ecx, eax
mov eax, edi
sub eax, ecx
je 0x1002259d
xor eax, eax
lea ecx, [ebp - 0x730]
push eax
call fcn.1001026e
cmp dword [eax], 0
je 0x1002259d
mov ecx, ebx
jmp 0x100225a1
xor eax, eax
mov ecx, eax
mov eax, 0xffff
sub eax, ecx
cmp dword [ebp - 0x380], eax
jne 0x100225c9
xor eax, eax
lea ecx, [ebp - 0x730]
push eax
call fcn.1001026e
cmp dword [eax], 0
jne 0x100225c9
xor eax, eax
mov ecx, eax
jmp 0x100225cb
mov ecx, ebx
xor eax, eax
cmp ecx, 0x795c380a
lea ecx, [ebp - 0x730]
setg al
sub eax, dword [ebp - 0x384]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x380], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
jmp 0x10022744
or edi, 0xffffffff
lea ecx, [ebp - 0xa64]
mov dword [ebp - 0x40], edi
call fcn.10010227
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x9bc], esi
mov dword [ebp - 0x9b8], esi
mov dword [ebp - 0x9b4], esi
mov dword [ebp - 0x9b0], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10022655
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa64]
call fcn.1001026e
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002263b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10022667
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6e4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002265a
mov dword [ebp - 0x3c], 3
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x40]
cmp eax, ebx
setl cl
xor edx, edx
cmp ecx, ebx
setg dl
xor eax, eax
cmp edx, edi
mov dword [ebp - 0x380], edx
sete al
imul eax, eax, 0xfffd
test eax, eax
jne 0x100226a9
mov ecx, eax
cmp dword [ebp - 0x384], eax
je 0x100226ab
mov ecx, ebx
mov eax, dword [ebp - 0x40]
imul eax, ecx
cmp eax, dword [ebp - 0x10]
jg 0x100226c4
xor eax, eax
cmp dword [ebp - 0x9b4], eax
je 0x100226c6
mov edi, ebx
jmp 0x100226c8
xor eax, eax
mov edi, eax
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0xa64]
push eax
call fcn.1001026e
xor edx, edx
mov dword [eax], esi
mov dword [ebp - 0x9bc], edi
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setge dl
xor ecx, ecx
imul eax, edx, 0xfffe
cmp eax, 0x8f18e0d
setg cl
xor eax, eax
cmp esi, ecx
sete al
xor ecx, ecx
cmp eax, 0x1edbcc77
setg cl
xor eax, eax
sub ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x24]
cmp ecx, 0xffffffff
lea ecx, [ebp - 0xa64]
setg al
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x3c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10010269
mov edi, 0x1c33c017
mov dword [ebp - 0x1c], 0x6de6
lea ecx, [ebp - 0x1f0]
push 3
call fcn.10010227
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x82f80c34
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x7a1245c8
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x34], 0xfff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100227ab
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1f0]
call fcn.1001026e
mov dword [eax], 0xbbca6318
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002278c
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x100227c4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1384], 0x11bc383c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100227b3
push 2
pop eax
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1001026e
push 2
lea ecx, [ebp - 0x1f0]
and dword [eax], 0
pop eax
push eax
call fcn.1001026e
cmp dword [eax], 0x13
jle 0x10022822
push 2
pop ebx
mov dword [ebp - 0x24], 0xe90a624c
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1002281f
push 2
pop eax
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1001026e
cmp dword [eax], 0
jne 0x10022845