Function at 0x1001aad5
Capabilities:
Create directory
Set thread local storage value

Disassembly:
mov eax, 0x10086213
call fcn.100859c8
sub esp, 0x270
push ebx
mov dword [ebp - 0x34], 0xfffffff8
xor ebx, ebx
mov dword [ebp - 0x28], 0x5c0de450
push esi
mov dword [ebp - 0x24], 0xddbf4df7
push edi
mov dword [ebp - 0x10], 0xda3bb1d4
mov dword [ebp - 0x30], 3
push 2
mov dword [ebp - 0x20], 0x939efd91
mov dword [ebp - 0xec], edx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x1001ab36
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0xc80fc3a0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001ab28
cmp dword [ebp - 0x34], ebx
je 0x1001ab4c
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0xfffffffc
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setge dl
mov dword [ebp - 0x30], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x68]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x73980710
cmp eax, 0xe2192fe2
sbb eax, eax
neg eax
cmp dword [ebp - 0x34], eax
je 0x1001abd5
mov eax, dword [ebp - 0x68]
push 1
pop esi
cmp dword [ebp - 0x10], ebx
jne 0x1001abe4
mov edx, ebx
cmp dword [ebp - 0x6c], ebx
je 0x1001abe6
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp eax, ecx
setl dl
sub edx, 0xd145
neg edx
sbb edx, edx
xor eax, eax
inc edx
or ecx, 0xffffffff
cmp edx, ecx
setl al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x9b4e94f9
mov dword [ebp - 0x24], 0x126c7f05
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0xce35a12a
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x10], ebx
jmp 0x1001ac47
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x184], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ac36
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0xfff7
cmp eax, esi
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
neg edx
cmp edx, dword [ebp - 0x14]
jle 0x1001acb2
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001acb4
mov eax, esi
push 5
pop ecx
cmp eax, dword [ebp - 0x14]
jne 0x1001adaf
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 0xbbb531ea
mov dword [ebp - 0x20], 0x585f1c2b
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x10], ebx
jmp 0x1001ace7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001acdd
mov dword [ebp - 0x28], ebx
jmp 0x1001ada3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001ad1b
mov dword [ebp - 0x2c], ebx
jmp 0x1001ad12
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x184], 0xd4826422
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001ad01
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
je 0x1001acfc
mov eax, dword [ebp - 0x14]
xor edx, edx
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x14], ebx
jg 0x1001ad59
cmp dword [ebp - 0x24], ebx
je 0x1001ad5e
cmp dword [ebp - 0x74], ebx
jne 0x1001ad61
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x180]
xor edx, edx
mov dword [ebp - 0x24], 0x89ef
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x180]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
imul eax, edx
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jle 0x1001acf4
jmp 0x1001adbc
mov dword [ebp - 0x20], 0xca00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0xfffffff8
lea ecx, [ebp - 0xa8]
push edi
call fcn.100189bc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x14], 0xa66fe7d8
mov dword [ebp - 0x38], 0x2b5b
mov dword [ebp - 0x30], 0xfffffff7
push edi
call fcn.100189bc
mov dword [ebp - 0x14], ebx
jmp 0x1001ae0b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001adf8
mov dword [ebp - 0x14], ebx
jmp 0x1001ae26
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0x9a0165d3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ae15
mov dword [ebp - 0x14], ebx
jmp 0x1001ae43
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d8]
mov dword [eax + ecx*4], 0xc987
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ae30
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001b00a
mov dword [ebp - 0x2c], 0x772304b2
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1001afd8
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xa8]
add ecx, dword [eax + edx*4]
xor edx, edx
mov eax, dword [ebp - 0xa8]
imul ecx, dword [eax + esi*4]
cmp ecx, edi
setge dl
xor eax, eax
neg edx
cmp edx, 0xfc24489
setge al
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0xa8]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
imul edx, dword [esi + eax*4]
imul eax, edx, 0x70d2
cmp eax, 0x4879
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, dword [esi + eax*4]
mov eax, dword [ebp - 0x2c]
setl dl
imul edx, dword [esi]
sub edx, eax
jne 0x1001af15
cmp dword [ebp - 0x14], ebx
jne 0x1001af15
xor esi, esi
inc esi
mov eax, esi
jmp 0x1001af1a
xor esi, esi
mov eax, ebx
inc esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jne 0x1001af25
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x84], eax
test eax, eax
je 0x1001af47
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x84], ebx
je 0x1001af58
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 3
push 2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffff4
pop edi
cmp dword [ebp - 0x34], 7
jg 0x1001afcc
mov dword [ebp - 0x24], 0x54656e2e
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jge 0x1001afa1
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001af8f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x24], ebx
jmp 0x1001afc2
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0x56cf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001afaf
inc dword [ebp - 0x34]
jmp 0x1001af77
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
jns 0x1001ae7a
mov dword [ebp - 0x2c], ebx
jmp 0x1001affc
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x20], 0x15f74462
mov dword [ebp - 0x20], 0x85b5f732
dec dword [eax]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1001afdd
dec dword [ebp - 0x14]
jns 0x1001ae54
lea ecx, [ebp - 0x1d8]
call fcn.100191e6
or eax, 0xffffffff
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], eax
call fcn.100191e6
or eax, 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, 0xb4ef66b1
setge cl
cmp ecx, dword [ebp - 0x24]
jl 0x1001b099
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffffe
jmp 0x1001b091
mov dword [ebp - 0x24], ebx
jmp 0x1001b088
mov dword [ebp - 0x30], 0xa01c77dc
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b07f
push 0xab3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
je 0x1001b062
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jg 0x1001b05d
jmp 0x1001b0c6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b0a9
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b0c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x1c], 0x5c0de450
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xddbf4df7
xor ecx, ecx
mov dword [ebp - 0x14], 0xadae8c9f
mov dword [ebp - 0x40], 0xce55459e
mov dword [ebp - 0x28], 0xf3f7e813
mov dword [ebp - 0x2c], 0xa0246c38
mov dword [ebp - 0x30], 0x3758185f
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x20], 0xce88636e
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
sub edx, 0x2835357f
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
sub eax, 0x2e65251c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jle 0x1001b2ec
mov dword [ebp - 0x34], esi
xor edx, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x38], 0x4f90bf56
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jne 0x1001b174
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
je 0x1001b1bf
mov eax, esi
cmp dword [ebp - 0x34], ebx
jne 0x1001b1c1
mov eax, ebx
xor edx, edx
mov ecx, 0x5fec3fdd
sub ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
neg ecx
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffff7
setle cl
xor eax, eax
cmp ecx, 0x605d
setge al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0xd
jmp 0x1001b2dd
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], 0xebc5f7c0
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b22e
push ebx
push 0x167c
push ebx
push 0x71d
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x24], 0x19
jmp 0x1001b2d0
push edi
lea ecx, [ebp - 0xf8]
call fcn.100189bc
mov dword [ebp - 0x10], ebx
jmp 0x1001b25e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x2782
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b24b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], 0xde8ed5e
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xf8]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xf8]
call fcn.100191e6
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
jle 0x1001b23a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x1001b206
jmp 0x1001b399
mov dword [ebp - 0x34], 0xfb43b78c
mov dword [ebp - 0x2c], ebx
jmp 0x1001b38f
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0xa49df3c4
mov dword [ebp - 0x24], 0xe3f4d677
mov dword [ebp - 0x10], ebx
jmp 0x1001b322
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], 0x4ba75048
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b311
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0x7dc4cae1
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setne cl
or eax, 0xffffffff
neg ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x24]
or edx, 0xffffffff
cmp ecx, edx
setne al
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b38c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 7
jge 0x1001b2fb
mov dword [ebp - 0x30], 0xda3bb1d4
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x20], 3
push 0xfffffffffffffff8
mov dword [ebp - 0x34], 6
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x5b1b6fd4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x10], esi
push 4
call fcn.100189bc
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 4
jge 0x1001b3f9
or edx, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b3e4
mov dword [ebp - 0x34], 0xa
jmp 0x1001b475
mov dword [ebp - 0x20], 0x6df37d45
lea ecx, [ebp - 0x1b4]
push edi
call fcn.100189bc
mov dword [ebp - 0x10], ebx
jmp 0x1001b42d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0xc8959310
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b41a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b447
push 0x674
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x1b4]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1b4]
call fcn.100191e6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
je 0x1001b402
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x22
jle 0x1001b4bd
push 3
pop edx
cmp dword [ebp - 0x24], ebx
jne 0x1001b4bd
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
jl 0x1001b4b4
mov dword [ebp - 0x24], ebx
jmp 0x1001b4aa
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x160]
cmp dword [eax + ecx*4], ebx
jne 0x1001b4af
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x1001b499
dec dword [ebp - 0x34]
jns 0x1001b494
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x22
jg 0x1001b487
or eax, 0xffffffff
lea ecx, [ebp - 0x160]
mov dword [ebp - 4], eax
call fcn.100191e6
mov dword [ebp - 0x20], 0x939efd91
or eax, 0xffffffff
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x10], 0xff68e10d
mov dword [ebp - 0x20], 0x2377963f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x8968f25c
mov dword [ebp - 0x10], ebx
jmp 0x1001b509
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x244], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b4fc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x14]
imul eax, ecx, 0x1d93
test eax, eax
je 0x1001b53a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x5cf7fafb
cmp dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
jne 0x1001b54f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 0xa3888ad
setl cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
je 0x1001b56d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x10], ebx
jmp 0x1001b5ba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0xc80fc3a0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b5ac
cmp dword [ebp - 0x3c], ebx
je 0x1001b5d0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0xfffffffc
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setge dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x73980710
cmp eax, 0xe2192fe2
sbb eax, eax
neg eax
cmp dword [ebp - 0x3c], eax
je 0x1001b659
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x30], ebx
jne 0x1001b665
mov edx, ebx
cmp dword [ebp - 0x54], ebx
je 0x1001b667
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
push esi
sete cl
xor edx, edx
cmp eax, ecx
setl dl
sub edx, 0xd145
neg edx
sbb edx, edx
xor eax, eax
or ecx, 0xffffffff
inc edx
cmp edx, ecx
lea ecx, [ebp - 0xc0]
setl al
mov dword [ebp - 0x20], eax
call fcn.100189bc
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], ebx
jmp 0x1001b6ba
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b6a7
mov eax, dword [ebp - 0xc0]
imul eax, dword [eax], 0x5d72
sub eax, 0x5d72
test eax, eax
jg 0x1001b8bb
mov dword [ebp - 0x34], 0xd6b65720
lea ecx, [ebp - 0x210]
or eax, 0xffffffff
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x20], eax
push edi
call fcn.100189bc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001b70f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x210]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b700
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xffffffe3
jne 0x1001b8ae
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 0x13
jne 0x1001b89e
push 5
pop eax
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x1c], 0x7c914a3a
mov dword [ebp - 0x20], 0xf40bf68
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff7
je 0x1001b891
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x20], 0x40b319
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x10], ebx
jmp 0x1001b79c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 0xa061fa46
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b78b
mov dword [ebp - 0x98], ebx
cmp dword [ebp - 0x98], ebx
jg 0x1001b881
mov dword [ebp - 0x20], 0xfbf3
mov dword [ebp - 0x20], 0xeedf6679
mov dword [ebp - 0x20], 0xc8ff05c8
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], ebx
jne 0x1001b818
cmp dword [ebp - 0x34], ebx
je 0x1001b814
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
je 0x1001b7f9
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], ebx
mov eax, esi
jne 0x1001b7fb
mov eax, ebx
xor edx, edx
cmp eax, 0x5674
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x1c]
jle 0x1001b818
mov edi, ebx
jmp 0x1001b81a
mov edi, esi
mov ecx, dword [ebp - 0x98]
xor edx, edx
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], edi
sete dl
mov dword [eax + esi*4], edx
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jmp 0x1001b866
mov dword [ebp - 0x30], 0xc8d535dd
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], 0x605
cmp dword [ebp - 0x30], ebx
jne 0x1001b86c
dec dword [ebp - 0x20]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
je 0x1001b83f
inc dword [ebp - 0x98]
push 1
pop esi
cmp dword [ebp - 0x98], ebx
jle 0x1001b7b3
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff7
jne 0x1001b75d
push 5
pop eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x13
je 0x1001b73b
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
je 0x1001b721
push 2
pop edi
lea ecx, [ebp - 0x210]
call fcn.100191e6
jmp 0x1001b8ce
mov dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
or eax, 0xffffffff
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], eax
call fcn.100191e6
mov dword [ebp - 0x30], 0xfffffffe
or eax, 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0xe88b1495
mov dword [ebp - 0x28], ebx
jmp 0x1001b905
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1001b8fb
mov dword [ebp - 0x28], ebx
jmp 0x1001b91c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x154], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1001b90f
cmp dword [ebp - 0x58], ebx
jge 0x1001b92a
mov edx, ebx
je 0x1001b92c
mov edx, esi
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xff23
jge 0x1001b945
mov ecx, ebx
cmp dword [ebp - 0x58], ebx
je 0x1001b947
mov ecx, esi
xor eax, eax
cmp ecx, 0x409884cb
setne al
cmp eax, 0xecf54c3c
ja 0x1001b95c
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5c], ebx
je 0x1001ba99
mov eax, 0x5f27a412
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x40], 0xc9aa6f57
mov dword [ebp - 0x28], ebx
jmp 0x1001b99e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x250], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001b991
mov dword [ebp - 0x28], ebx
jmp 0x1001b9ba
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe0], 0x7da828c0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001b9a9
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov eax, dword [ebp - 0x58]
test eax, eax
mov eax, dword [ebp - 0xcc]
setns cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0xc4]
cmp edx, eax
mov edx, dword [ebp - 0x30]
setle cl
imul edx, ecx
xor ecx, ecx
mov dword [ebp - 0x250], edx
mov eax, dword [ebp - 0xcc]
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x30]
jl 0x1001ba0e
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001ba10
mov ecx, esi
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setne al
sub eax, 0x718b9628
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x150]
cmp eax, esi
sbb eax, eax
neg eax
cmp eax, 0xfffffffa
je 0x1001ba3c
mov edx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001ba3e
mov edx, esi
mov dword [ebp - 0xe0], edx
xor ecx, ecx
mov eax, dword [ebp - 0x150]
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp eax, edx
mov eax, dword [ebp - 0xc8]
setge cl
xor edx, edx
cmp ecx, 0x4c3d
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x1700
setne al
cmp dword [ebp - 0xc8], eax
jl 0x1001ba88
mov edx, esi
cmp dword [ebp - 0x38], ebx
jne 0x1001ba8a
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
jmp 0x1001bab8
mov dword [ebp - 0x1c], ebx
jmp 0x1001bab3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bab0
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001ba9e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001badb
push ebx
push 0xfa4
push 0xd77
push ebx
push 0x66
push 0x12e7
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 4
lea ecx, [ebp - 0x11c]
call fcn.100189bc
mov dword [ebp - 4], 3
mov dword [ebp - 0x2c], 0xb0881d
mov dword [ebp - 0x28], ebx
jmp 0x1001bb0a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001bafb
mov dword [ebp - 0x28], ebx
jmp 0x1001bb23
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x4c], 0xe1e87df2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001bb15
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], 3
jg 0x1001bc2e
push 3
lea ecx, [ebp - 0x140]
call fcn.100189bc
mov dword [ebp - 0x1c], 0x761be360
mov dword [ebp - 0x10], ebx
jmp 0x1001bb61
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0x801fc3ee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001bb4e
mov esi, dword [ebp - 0x140]
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [esi + 4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esi + 4]
cmp dword [esi + 4], 3
jle 0x1001bb70
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + 8], eax
cmp dword [ecx], 0x37c57f39
jne 0x1001bbac
cmp dword [ebp - 0x4c], ebx
je 0x1001bbac
xor edx, edx
inc edx
jmp 0x1001bbae
mov edx, ebx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov edi, dword [ebp - 0x1c]
cmp edx, eax
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
setne cl
imul edi, ecx
mov ecx, dword [ebp - 0x11c]
neg edi
sbb edi, edi
xor edx, edx
neg edi
cmp dword [ecx + eax*4], edi
setl dl
add edx, dword [ecx + esi*4]
jne 0x1001bbe0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1c], 0xd21f1eb3
jb 0x1001bc01
mov dword [ebp - 0x2c], ebx
jmp 0x1001bbf9
cmp dword [ebp - 0x4c], ebx
jne 0x1001bc10
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1001bbf1
jmp 0x1001bc10
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bc10
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea ecx, [ebp - 0x140]
call fcn.100191e6
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 3
jle 0x1001bb35
xor esi, esi
push 2
inc esi
pop edi
mov dword [ebp - 0x2c], 0xfffffff8
jmp 0x1001bc51
mov dword [ebp - 0x20], 0x8e5161e3
mov dword [ebp - 0x30], 0xfffffff7
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x1001bc37
or eax, 0xffffffff
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], eax
call fcn.100191e6
push edi
lea ecx, [ebp - 0x1e4]
call fcn.100189bc
mov dword [ebp - 0x10], 0xeef20fe6
mov dword [ebp - 0x10], ebx
jmp 0x1001bc93
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e4]
mov dword [eax + ecx*4], 0x571177e8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001bc80
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x1001bce1
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bcb4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001bcdc
mov dword [ebp - 0x20], 0x909b7928
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e4]
cmp dword [eax + ecx*4], ebx
sete dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x1c]
jns 0x1001bcbc
dec dword [ebp - 0x10]
jns 0x1001bca0
lea ecx, [ebp - 0x1e4]
call fcn.100191e6
push dword [ebp - 0xd4]
movdqa xmm0, xmmword [0x10007e60]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x80], ebx
push eax
push ebx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x7c], ebx
movdqu xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x78], ebx
call fcn.10019f4d
mov dword [ebp - 0x14], 6
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x7582ba8d
mov dword [ebp - 0x3c], eax
push 5
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x1001beea
mov dword [ebp - 0x20], 0xe8e036b6
mov dword [ebp - 0x10], ebx
jmp 0x1001bd63
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x44], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001bd55
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], 3
jg 0x1001beaf
mov edi, dword [ebp - 0x80]
mov dword [ebp - 0x30], 0xfc5c2f00
mov dword [ebp - 0x38], 0x269945c6
mov dword [ebp - 0x10], ebx
jmp 0x1001bd9c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0x87c3cb87
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001bd8b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x80]
cmp dword [eax + ecx*4], ebx
je 0x1001bdb1
cmp dword [ebp - 0x14], ebx
jne 0x1001be07
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14], 0x9b50
mov ecx, dword [ebp - 0x80]
push 0
cmp eax, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x44]
pop eax
setle al
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x80]
push 5
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x748a
xor ecx, ecx
cmp eax, 7
pop eax
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
inc ecx
sub ecx, eax
jne 0x1001be04
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x14]
cmp dword [edx + esi*4], eax
setge cl
test ecx, ecx
jle 0x1001bf16
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001be31
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
inc esi
cmp dword [ebp - 0x44], ebx
jne 0x1001be4c
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x14], 0xe2d0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x80]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax + edx*4]
jne 0x1001be66
mov ecx, esi
cmp dword [ebp - 0x38], ebx
jne 0x1001be68
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp eax, ecx
je 0x1001be78
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp eax, dword [edi + 8]
mov eax, dword [ebp - 0x38]
setge cl
imul eax, dword [ebp - 0x24]
imul eax, ecx
cmp eax, 0x83ea6de4
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jle 0x1001bd78
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x80]
cmp dword [eax + ecx*4], ebx
sete dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], ebx
je 0x1001bed5
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001bed7
mov eax, ebx
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1001bd49
push 2
pop edi
lea ecx, [ebp - 0x80]
call fcn.100191e6
mov dword [ebp - 0x14], 0x9b4e94f9
mov dword [ebp - 0x24], 0x126c7f05
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xce35a12a
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x10], ebx
jmp 0x1001bf79
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 3
jg 0x1001be31
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1001bf5a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bf55
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
dec dword [ebp - 0x10]
jns 0x1001bf35
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x1001bf26
jmp 0x1001be34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19c], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001bf68
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0xfff7
cmp eax, esi
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
neg edx
cmp edx, dword [ebp - 0x14]
jle 0x1001bfe4
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001bfe6
mov eax, esi
cmp eax, dword [ebp - 0x14]
jne 0x1001c0ee
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], 0xbbb531ea
mov dword [ebp - 0x38], 0x585f1c2b
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x10], ebx
jmp 0x1001c01d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c00c
mov dword [ebp - 0x2c], ebx
jmp 0x1001c0e2
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001c051
mov dword [ebp - 0x28], ebx
jmp 0x1001c048
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x19c], 0xd4826422
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001c037
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
je 0x1001c032
mov eax, dword [ebp - 0x14]
xor edx, edx
dec dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x14], ebx
jg 0x1001c095
cmp dword [ebp - 0x24], ebx
je 0x1001c09d
cmp dword [ebp - 0x8c], ebx
jne 0x1001c0a0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x198]
xor edx, edx
mov dword [ebp - 0x24], 0x89ef
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x198]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
imul eax, edx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jle 0x1001c02a
jmp 0x1001c0fb
mov dword [ebp - 0x20], 0xca00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x8ade19d2
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], 0x3fe662db
mov dword [ebp - 0x38], 0x725245f5
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x1c], ebx
je 0x1001c132
mov dword [ebp - 0x30], 0x7ccc8959
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp eax, 0xc2285faa
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0xdb34
jge 0x1001c16f
mov dword [ebp - 0x20], esi
inc dword [ebp - 0x20]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c1d3
push ebx
push 0x26f3
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x1001c1d3
mov dword [ebp - 0x10], 0xb5d1cb6a
mov dword [ebp - 0x30], 0x7276cc72
mov dword [ebp - 0x38], 0x1f9e6a01
cmp dword [ebp - 0x10], ebx
jne 0x1001c1c8
mov eax, dword [ebp - 0x20]
mov ecx, 0xf9034e10
sub ecx, eax
sub ecx, dword [ebp - 0x30]
imul eax, ecx, 0xffff0c70
cmp eax, esi
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
je 0x1001c1aa
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setg cl
cmp ecx, dword [ebp - 0x10]
jge 0x1001c1ca
mov eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0xfffffff8
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x10], 0x144ad72d
mov dword [ebp - 0x20], 0x4cacff8e
push esi
call fcn.100189bc
mov dword [ebp - 0x10], ebx
jmp 0x1001c213
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1cc]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c200
mov dword [ebp - 0x10], 0x7a3a
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x715f
setl cl
cmp dword [ebp - 0x1c], ecx
jne 0x1001c240
cmp dword [ebp - 0x1c], 0x4727cad7
jne 0x1001c23d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x20]
jle 0x1001c269
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c2ad
push ebx
push 0x18de
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1001c2ad
mov dword [ebp - 0x24], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x20], 0x63a5bed8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1cc]
call fcn.100191e6
push esi
lea ecx, [ebp - 0x134]
call fcn.100189bc
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], ebx
jmp 0x1001c2e3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c2d0
mov eax, dword [ebp - 0x134]
mov dword [eax], 7
push 3
lea ecx, [ebp - 0x16c]
call fcn.100189bc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001c31c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x4a2a4f40
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001c309
mov dword [ebp - 0x1c], ebx
jmp 0x1001c339
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x16c]
imul eax, dword [ecx + eax*4], 0xfffffffc
mov dword [ecx], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001c327
lea ecx, [ebp - 0x16c]
call fcn.100191e6
mov eax, dword [ebp - 0x134]
dec dword [eax]
cmp dword [eax], 0xfffffffe
jge 0x1001c2f4
or eax, 0xffffffff
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], eax
call fcn.100191e6
push edi
lea ecx, [ebp - 0xb4]
call fcn.100189bc
push 5
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x14], 0xa66fe7d8
mov dword [ebp - 0x38], 0x2b5b
mov dword [ebp - 0x20], 0xfffffff7
push edi
call fcn.100189bc
mov dword [ebp - 0x14], ebx
jmp 0x1001c3b2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001c39f
mov dword [ebp - 0x14], ebx
jmp 0x1001c3ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0x9a0165d3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001c3bc
mov dword [ebp - 0x14], ebx
jmp 0x1001c3e7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0xc987
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001c3d4
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001c5a5
mov dword [ebp - 0x2c], 0x772304b2
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1001c573
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [edx + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xb4]
add edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp - 0xb4]
imul edx, dword [eax + esi*4]
cmp edx, edi
setge cl
xor eax, eax
neg ecx
cmp ecx, 0xfc24489
setge al
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0xb4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
imul edx, dword [esi + eax*4]
imul eax, edx, 0x70d2
cmp eax, 0x4879
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, dword [esi + eax*4]
mov eax, dword [ebp - 0x2c]
setl dl
imul edx, dword [esi]
sub edx, eax
jne 0x1001c4b9
cmp dword [ebp - 0x14], ebx
jne 0x1001c4b9
xor esi, esi
inc esi
mov eax, esi
jmp 0x1001c4be
xor esi, esi
mov eax, ebx
inc esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jne 0x1001c4c9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x70], eax
test eax, eax
je 0x1001c4e5
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x70], ebx
je 0x1001c4f3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 3
push 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffff4
pop edi
cmp dword [ebp - 0x1c], 7
jg 0x1001c567
mov dword [ebp - 0x24], 0x54656e2e
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jge 0x1001c53c
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1fc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001c52a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x24], ebx
jmp 0x1001c55d
cmp dword [ebp - 0x24], edi
jl 0x1001c54a
dec dword [ebp - 0x2c]
mov edx, dword [ebp - 0x40]
jns 0x1001c41e
mov dword [ebp - 0x2c], ebx
jmp 0x1001c597
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x20], 0x15f74462
mov dword [ebp - 0x20], 0x85b5f732
dec dword [eax]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1001c578
dec dword [ebp - 0x14]
jns 0x1001c3f8
lea ecx, [ebp - 0x178]
call fcn.100191e6
or eax, 0xffffffff
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], eax
call fcn.100191e6
mov dword [ebp - 0x2c], 0x53aa
lea ecx, [ebp - 0x104]
push esi
call fcn.100189bc
mov dword [ebp - 0x38], 0xfd90
mov dword [ebp - 0x20], 0x7ee0
mov dword [ebp - 0x10], ebx
jmp 0x1001c5fa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xdc41fd9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c5e7
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
sub eax, dword [ebp - 0x2c]
inc edx
cmp eax, edx
jne 0x1001c74b
mov dword [ebp - 0x30], ebx
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jg 0x1001c7c5
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], 0xcf63547a
mov dword [ebp - 0x20], 0x102d1f73
mov dword [ebp - 0x10], ebx
jmp 0x1001c66b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], 0x972f33bc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001c65a
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001c6e2
xor ecx, ecx
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x38]
test eax, eax
setg cl
xor eax, eax
cmp ecx, 0x2ca01dc0
setg al
xor ecx, ecx
imul esi, eax, 0xfffe
mov eax, dword [ebp - 0x30]
add eax, 0x405d06f7
cmp eax, 0x75d
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, esi
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
setle cl
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
neg eax
cmp dword [ebp - 0x20], eax
je 0x1001c7bb
cmp dword [ebp - 0x30], ebx
jne 0x1001c7bb
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1001c7c0
xor esi, esi
inc esi
mov eax, esi
neg eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x104]
call fcn.100191e6
mov dword [ebp - 0x10], 0x5c0de450
or eax, 0xffffffff
mov dword [ebp - 0x28], ebx
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, 0xb4ef66b1
setge cl
cmp ecx, dword [ebp - 0x24]
jl 0x1001c84a
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffffe
jmp 0x1001c842
mov dword [ebp - 0x24], ebx
jmp 0x1001c839
cmp dword [ebp - 0x28], 0x18
jg 0x1001c80e
jmp 0x1001c877
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c85a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c877
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x1c], 0xddbf4df7
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xda3bb1d4
xor edx, edx
mov dword [ebp - 0x14], 0xadae8c9f
mov dword [ebp - 0x30], 0xce55459e
mov dword [ebp - 0x28], 0xf3f7e813
mov dword [ebp - 0x2c], 0xa0246c38
mov dword [ebp - 0x40], 0x3758185f
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x20], 0xce88636e
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
sub ecx, 0x2835357f
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
sub eax, 0x2e65251c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jle 0x1001ca9d