Function at 0x1001679e
Capabilities:
Check for time delay via queryperformancecounter
Create pipe
Create thread
Get common file path
Get geographical location
Get keyboard layout
Get memory capacity
Get session user name
Parse pe header
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov eax, 0x1007c0d6
call fcn.1007b070
mov eax, 0x1374
call fcn.10077820
push ebx
push esi
push edi
mov dword [ebp - 0x30], 0xb9f9b319
xor eax, eax
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], 0x704dcf74
mov dword [ebp - 0x2c], 0xaa9320af
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x58], ecx
jge 0x100167fa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1128], 0x30c1abdd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100167e1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xc
push 1
pop ebx
jge 0x10016c40
mov dword [ebp - 0x1c], 0xf1bf506e
lea ecx, [ebp - 0x2a8]
push 2
call fcn.10012997
xor eax, eax
lea ecx, [ebp - 0x12dc]
mov dword [ebp - 4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xf78]
push eax
lea eax, [ebp - 0xf88]
push eax
movdqu xmmword [ebp - 0xf88], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x318]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x588]
push dword [esi]
call fcn.100129f6
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffe
push 2
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x10016897
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2a8]
call fcn.10012a38
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001687c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1a
je 0x10016b65
push edi
lea ecx, [ebp - 0xc8]
call fcn.10012997
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x54], 0x820b275c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100168ec
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc8]
call fcn.10012a38
mov dword [eax], 0x693e9323
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100168cd
xor eax, eax
push eax
lea ecx, [ebp - 0xc8]
call fcn.10012a38
lea ecx, [ebp - 0xc8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10012a38
jmp 0x10016b37
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10016939
push eax
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
push eax
lea ecx, [ebp - 0xc8]
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xc8]
push eax
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001698c
xor eax, eax
lea ecx, [ebp - 0xc8]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xc8]
push eax
call fcn.10012a38
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0xc8]
mov edi, eax
call fcn.10012a38
mov esi, eax
lea ecx, [ebp - 0xc8]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, 0xc51938d1
setle dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi]
setne cl
xor edi, edi
inc edi
xor ebx, ebx
cmp ecx, edi
lea ecx, [ebp - 0x2a8]
push edi
setge bl
call fcn.10012a38
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x588]
call fcn.10012a38
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xc8]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
xor ecx, ecx
cmp esi, 0xfe905687
setne cl
cmp ecx, dword [eax]
jle 0x10016a69
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10016a6b
mov eax, edi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc8]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xc8]
setge bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0xc8]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov byte [ebp - 0x35], al
cmp ecx, 7
jl 0x10016aea
cmp byte [ebp - 0x35], al
je 0x10016b18
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x10016b16
cmp byte [ebp - 0x35], al
je 0x10016af8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
push eax
lea ecx, [ebp - 0xc8]
call fcn.10012a38
lea ecx, [ebp - 0x2a8]
push dword [eax]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10016b41
xor eax, eax
push eax
lea ecx, [ebp - 0xc8]
call fcn.10012a38
lea ecx, [ebp - 0xc8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10012a38
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jle 0x1001690e
jmp 0x10016b44
xor ebx, ebx
inc ebx
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], bl
call fcn.10012a1c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
push 2
pop edi
jne 0x100168a4
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x588]
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ecx, dword [eax]
setl dl
imul eax, edx, 0xfffc
test eax, eax
je 0x10016b9e
push 3
lea ecx, [ebp - 0x588]
call fcn.10012a38
cmp dword [eax], 0
je 0x10016b9e
mov edx, ebx
jmp 0x10016ba2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
push edi
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x588]
mov eax, dword [ebp - 0x2c]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10016bdb
cmp dword [ebp - 0x30], eax
je 0x10016bdd
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x10016bf9
mov eax, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x588]
call fcn.10012a38
xor ecx, ecx
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x1124], ecx
lea ecx, [ebp - 0x588]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.10012a1c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xc
jl 0x1001680a
push 0xfffffffffffffff8
xor eax, eax
pop esi
jmp 0x10016c43
push 2
pop edi
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10016c6a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10016c52
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10016c8f
push 0xe08
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0x11c], eax
jmp 0x10016cae
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10016ca8
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], 0xe
jle 0x10016c97
mov dword [ebp - 0x18], 0xb9b55bb2
mov dword [ebp - 0x18], eax
jmp 0x10016d2f
mov dword [ebp - 0x20], 0xfe5e81a7
mov dword [ebp - 0x34], 0xf3ac9d73
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10016cef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa14], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10016cda
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10016d24
cmp dword [ebp - 0x20], eax
jne 0x10016d1f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa14]
mov ecx, dword [ebp - 0xa14]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0xa14]
add eax, ecx
cmp eax, dword [ebp - 0x18]
jl 0x10016d1d
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10016d26
mov eax, ebx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x10016cc3
mov dword [ebp - 0x48], 0xb9f9b319
lea ecx, [ebp - 0xb28]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], 0x704dcf74
mov dword [ebp - 0x2c], 0xaa9320af
push edi
call fcn.10012997
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x1c], 0xabecba2a
mov dword [ebp - 0x20], 0xb57a67d9
mov dword [ebp - 0x54], 0x46cd5fec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10016d9d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb28]
call fcn.10012a38
mov dword [eax], 0xdd33a4a9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10016d7f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10016db3
push dword [ebp - 0x1c]
call fcn.10012a38
mov dword [eax], 7
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xb28]
cmp dword [ebp - 0x1c], edi
jl 0x10016da2
inc dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0xd68]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xceafd94f
mov dword [ebp - 0x34], 0x6dd8d130
mov dword [ebp - 0x34], 0x93e9323d
mov dword [ebp - 0x34], 0x6923607a
push ebx
call fcn.10012997
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10016e2c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd68]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10016e11
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10016e42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x49c], 0x82ca9683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10016e31
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xd68]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x49c]
or dword [ebp - 4], eax
call fcn.10012a1c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10016e85
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1140], 0x30c1abdd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10016e6c
xor eax, eax
mov dword [ebp - 0x48], eax
mov ecx, 0xffff
cmp dword [ebp - 0x48], 0xc
jge 0x1001782a
mov dword [ebp - 0x1c], 0xf1bf506e
mov dword [ebp - 0x44], 0xe033c22
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10016ec7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7bc], 0x31713b91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10016eae
xor eax, eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 7
jne 0x10016fa6
jmp 0x10016ede
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0xcbed562b
mov dword [ebp - 0x34], 0x2ca3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10016f0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78], 0x7d8e6e83
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10016ef7
xor eax, eax
mov dword [ebp - 0x78], 0xf
cmp dword [ebp - 0x78], 0xfffffffb
jne 0x10016f90
jmp 0x10016f1d
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x20], 0xe2bf35dd
cmp dword [ebp - 0x78], eax
jne 0x10016f33
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x10016f35
mov esi, ebx
mov eax, dword [ebp - 0x78]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x78]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x78]
setne cl
imul eax, esi
neg ecx
imul eax, eax, 0xbec0
sub ecx, eax
mov eax, dword [ebp - 0x54]
sub ecx, eax
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10016f8b
dec dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0xfffffffb
je 0x10016f1b
mov ecx, 0xffff
inc dword [ebp - 0x7b4]
cmp dword [ebp - 0x7b4], 7
je 0x10016edc
push 0xfffffffffffffff8
pop esi
push edi
lea ecx, [ebp - 0x200]
call fcn.10012997
mov dword [ebp - 4], 5
lea eax, [ebp - 0x1038]
movdqa xmm0, xmmword [0x10007c30]
lea ecx, [ebp - 0x12ec]
push eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x98ba832a
mov dword [ebp - 0x30], esi
push eax
movdqu xmmword [ebp - 0x1048], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2fa]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11b8]
push dword [esi]
call fcn.100129f6
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jne 0x100172a3
push 3
lea ecx, [ebp - 0x2cc]
call fcn.10012997
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10017062
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2cc]
call fcn.10012a38
mov dword [eax], 0x3695
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10017043
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x10017270
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], 0xe2499e68
mov dword [ebp - 0x4c], eax
jmp 0x10017264
mov dword [ebp - 0x3c], 0xd72276b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], eax
jmp 0x100170bb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100170ae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x788], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10017096
xor eax, eax
mov dword [ebp - 0x788], 3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jle 0x1001708e
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x10017261
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x100171fa
jmp 0x100170df
xor eax, eax
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x10017106
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10017101
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x100170ee
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2cc]
call fcn.10012a38
cmp dword [eax], 0
je 0x10017156
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7b187b35
setl cl
sub ecx, dword [ebp - 0x4c]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffc
setg al
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10017158
mov esi, ebx
jmp 0x1001715a
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2cc]
call fcn.10012a38
push dword [ebp - 0x4c]
xor ebx, ebx
lea ecx, [ebp - 0x2cc]
cmp dword [eax], esi
setl bl
call fcn.10012a38
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
cmp ecx, 0x88ff7673
lea ecx, [ebp - 0x2cc]
sbb esi, esi
xor ebx, ebx
inc ebx
neg esi
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x18]
mov edi, eax
xor eax, eax
add ecx, esi
cmp ecx, 0x2d6273d5
mov ecx, dword [ebp - 0x18]
setg al
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, dword [edi]
setg al
cmp eax, 0xfffffffd
jbe 0x100171df
push ebx
lea ecx, [ebp - 0x2cc]
call fcn.10012a38
cmp dword [eax], 0
jne 0x100171df
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100171e8
jmp 0x100171e1
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100171e8
mov eax, ebx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x30]
push 2
pop ecx
cmp dword [ebp - 0x30], ecx
jle 0x100170dd
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2cc]
push ebx
call fcn.10012a38
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x2cc]
push 2
sub esi, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
setne dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x3c]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
add ecx, 0xd230
je 0x1001724c
cmp dword [ebp - 0x30], eax
je 0x1001724c
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1001724f
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
pop eax
push 2
pop ecx
jns 0x100170cc
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x1001707f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1001706d
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10012a38
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 6
call fcn.10012a1c
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x10017020
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100172d9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jl 0x100172d9
xor eax, eax
mov edx, eax
jmp 0x100172db
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x18]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x18]
sub edx, 0x5b3a
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x11b8]
mov byte [ebp - 4], 5
call fcn.10012a1c
lea eax, [ebp - 0xf98]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xfa8]
push eax
lea ecx, [ebp - 0x130c]
movdqu xmmword [ebp - 0xfa8], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2b9]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x600]
push dword [esi]
call fcn.100129f6
push 8
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10017393
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xee8], 0x64a6847d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001737a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100173c3
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x100173c0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xee8], 0
jne 0x100173be
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100173a8
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10017398
mov dword [ebp - 0x18], 0xffffffed
jmp 0x1001744a
mov dword [ebp - 0x1c], 0x7d2703d9
mov dword [ebp - 0x1c], 0x85c9e53
cmp dword [ebp - 0x18], eax
jne 0x100173ec
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10017403
mov edx, ebx
cmp dword [ebp - 0x1c], eax
je 0x10017403
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0x1c]
jg 0x10017401
mov ecx, ebx
jmp 0x10017405
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x30a4ccfd
push 0
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xee0]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xb72b
setl al
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x10
jle 0x100173d2
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1001747e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x200]
call fcn.10012a38
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10017462
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1001773e
push 2
lea ecx, [ebp - 0xb0]
call fcn.10012997
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x54], 0x820b275c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100174cf
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb0]
call fcn.10012a38
mov dword [eax], 0x693e9323
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100174b0
xor eax, eax
push eax
lea ecx, [ebp - 0xb0]
call fcn.10012a38
lea ecx, [ebp - 0xb0]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10012a38
jmp 0x1001771a
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x1001751c
push eax
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
push eax
lea ecx, [ebp - 0xb0]
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xb0]
push eax
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x200]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001756f
xor eax, eax
lea ecx, [ebp - 0xb0]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xb0]
push eax
call fcn.10012a38
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xb0]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0xb0]
mov edi, eax
call fcn.10012a38
mov esi, eax
lea ecx, [ebp - 0xb0]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, 0xc51938d1
setle dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi]
setne cl
xor edi, edi
inc edi
xor ebx, ebx
cmp ecx, edi
lea ecx, [ebp - 0x200]
push edi
setge bl
call fcn.10012a38
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x600]
call fcn.10012a38
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xb0]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
xor ecx, ecx
cmp esi, 0xfe905687
setne cl
cmp ecx, dword [eax]
jle 0x1001764c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1001764e
mov eax, edi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xb0]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb0]
setge bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0xb0]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov byte [ebp - 0x35], al
cmp ecx, 7
jl 0x100176cd
cmp byte [ebp - 0x35], al
je 0x100176fb
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100176f9
cmp byte [ebp - 0x35], al
je 0x100176db
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
push eax
lea ecx, [ebp - 0xb0]
call fcn.10012a38
lea ecx, [ebp - 0x200]
push dword [eax]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10017724
xor eax, eax
push eax
lea ecx, [ebp - 0xb0]
call fcn.10012a38
lea ecx, [ebp - 0xb0]
inc dword [eax]
xor eax, eax
push eax
call fcn.10012a38
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jle 0x100174f1
jmp 0x10017727
xor ebx, ebx
inc ebx
dec dword [ebp - 0x50]
lea ecx, [ebp - 0xb0]
push 8
pop eax
mov byte [ebp - 4], al
call fcn.10012a1c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jne 0x10017486
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x600]
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, dword [eax]
setl dl
imul eax, edx, 0xfffc
test eax, eax
je 0x10017781
push 3
lea ecx, [ebp - 0x600]
call fcn.10012a38
cmp dword [eax], 0
je 0x10017781
mov edx, ebx
jmp 0x10017785
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
push 2
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x600]
mov eax, dword [ebp - 0x2c]
pop edi
push edi
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x200]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100177c1
cmp dword [ebp - 0x48], eax
je 0x100177c3
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x100177df
mov eax, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x600]
call fcn.10012a38
xor ecx, ecx
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x113c], ecx
lea ecx, [ebp - 0x600]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x200]
call fcn.10012a1c
inc dword [ebp - 0x48]
mov ecx, 0xffff
cmp dword [ebp - 0x48], 0xc
push 0
pop eax
push 0xfffffffffffffff8
pop esi
jl 0x10016e97
mov dword [ebp - 0x28], 0x3b4e1a36
mov dword [ebp - 0x1c], 0xf13e13a6
mov dword [ebp - 0x44], 0x16501874
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x28], 0x14
jmp 0x10017857
cmp dword [ebp - 0x28], eax
jne 0x1001785d
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
jg 0x1001784f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jl 0x100179de
mov dword [ebp - 0x2c], 0x3c15
lea ecx, [ebp - 0x9f0]
push 4
call fcn.10012997
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], eax
jmp 0x100178a5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9f0]
call fcn.10012a38
mov dword [eax], 0xfcfbce00
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1001788e
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x2c]
jle 0x10017952
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x9f0]
inc dword [ebp - 0x10]
xor eax, eax
mov esi, dword [ebp - 0x10]
push eax
call fcn.10012a38
xor edx, edx
push 0xfffffffffffffff8
mov dword [eax], esi
mov dword [ebp - 0x44], 0x3598
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, 0x62b5
pop esi
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x13ed
setle cl
mov dword [ebp - 0x50], ecx
jmp 0x100179c0
mov dword [ebp - 0x24], 0xf162c80f
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x402ad923
setge cl
inc ecx
je 0x10017970
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10017972
mov eax, ebx
mov dword [ebp - 0x1c], 6
xor edx, edx
mov ecx, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setg dl
xor eax, eax
cmp edx, 0xffffffff
setle al
sub ecx, eax
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
add ebx, edx
cmp ebx, eax
setne cl
mov dword [ebp - 0x24], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.10012a1c
dec dword [ebp - 0x28]
push 1
pop ebx
cmp dword [ebp - 0x28], esi
jge 0x10017869
mov eax, 0x8c176b0f
lea ecx, [ebp - 0xbd0]
mov dword [ebp - 0x38c], eax
push 3
mov dword [ebp - 0x388], eax
pop esi
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x10], esi
push ebx
call fcn.10012997
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x40], 0xbc1846e9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10017a40
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbd0]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10017a25
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10017a60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1200], 0x8e0ea626
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10017a48
xor eax, eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xd
jle 0x10017c00
jmp 0x10017a77
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 0x49e3
mov dword [ebp - 0x40], 0xc2c102d1
mov dword [ebp - 0x40], 0xab2bd68e
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], eax
jmp 0x10017aa9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10017a9b
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xbd0]
mov esi, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [ebp - 0x5c]
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x388]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x384]
setle bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
cmp ecx, 5
setg al
xor ecx, ecx
sub eax, 9
cmp eax, 0x6f0d
setge cl
xor eax, eax
cmp esi, ecx
setne al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x388]
mov eax, dword [ebp - 0x388]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
je 0x10017b38
xor eax, eax
cmp dword [ebp - 0x5c], eax
je 0x10017b3a
lea edx, [eax + 1]
jmp 0x10017b3c
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
imul ecx, ecx, 0xdbfe
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setg dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
mov dword [ebp - 0x11f8], ebx
neg ebx
mov eax, dword [ebp - 0x5c]
cmp ebx, eax
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
setge cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x40]
sub edx, eax
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x40], eax
jl 0x10017bad
mov eax, dword [ebp - 0x384]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38c]
add ecx, 0x21409db2
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 1
setg dl
xor ecx, ecx
cmp edx, 0x5a47
pop ebx
setge cl
add eax, 0x11f0
add eax, ecx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x384]
cmp dword [ebp - 0x384], 0xd
push 3
pop esi
jg 0x10017a75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd0]
call fcn.10012a1c
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x28], 0xb9f9b319
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0x704dcf74
push esi
call fcn.10012997
mov dword [ebp - 4], 0xc
mov eax, 0xffff
mov dword [ebp - 0x40], 0x6c0e2632
mov dword [ebp - 0x2c], 0xfbde
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10017c6a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1158], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10017c56
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10017c80
push dword [ebp - 0x18]
call fcn.10012a38
mov dword [eax], 0x1897a4a
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x260]
cmp dword [ebp - 0x18], esi
jl 0x10017c6f
push ebx
call fcn.10012a38
mov dword [eax], edi
jmp 0x10017cb4
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10017ca6
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
dec dword [eax]
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
cmp dword [eax], 0
jge 0x10017c95
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
cmp dword [eax], 0
je 0x10017d29
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x260]
xor eax, eax
push eax
call fcn.10012a38
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x260]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x260]
call fcn.10012a38
mov eax, dword [ebp - 0x1150]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x260]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x2c], 0xaa9320af
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
jmp 0x10017d6a
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10017d67
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x10017d4f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10017d90
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1170], 0x30c1abdd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10017d78
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc
jge 0x1001892a
jmp 0x10017da1
xor eax, eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10017dc8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10017db0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10017ded
push 0xe08
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0xf4], eax
jmp 0x10017e0c
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10017e06
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], 0xe
jle 0x10017df5
mov dword [ebp - 0x24], 0xf1bf506e
mov dword [ebp - 0x18], 0xb9b55bb2
mov dword [ebp - 0x18], eax
jmp 0x10017e92
mov dword [ebp - 0x20], 0xfe5e81a7
mov dword [ebp - 0x34], 0xf3ac9d73
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10017e52
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa08], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10017e3e
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10017e87
cmp dword [ebp - 0x20], eax
jne 0x10017e82
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa08]
mov ecx, dword [ebp - 0xa08]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0xa08]
add eax, ecx
cmp eax, dword [ebp - 0x18]
jl 0x10017e80
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10017e89
mov eax, ebx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x10017e28
push edi
lea ecx, [ebp - 0x218]
call fcn.10012997
lea eax, [ebp - 0x1098]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x10a8]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x12ac]
movdqu xmmword [ebp - 0x10a8], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2bd]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5a0]
push dword [esi]
call fcn.100129f6
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x1c], eax
jmp 0x10017f13
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.10012a38
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017eff
push edi
lea ecx, [ebp - 0xb40]
call fcn.10012997
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x1c], 0xabecba2a
mov dword [ebp - 0x20], 0xb57a67d9
mov dword [ebp - 0x40], 0x46cd5fec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10017f65
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb40]
call fcn.10012a38
mov dword [eax], 0xdd33a4a9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017f47
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10017f7b
push dword [ebp - 0x1c]
call fcn.10012a38
mov dword [eax], 7
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xb40]
cmp dword [ebp - 0x1c], edi
jl 0x10017f6a
inc dword [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.10012a1c
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
je 0x100187bf
push edi
lea ecx, [ebp - 0xbc]
call fcn.10012997
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x10], 0xe033c22
push 3
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x10017fe4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x674], 0x31713b91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017fcc
xor eax, eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 7
jne 0x100180c5
mov ecx, 0xffff
jmp 0x10018000
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0xcbed562b
mov dword [ebp - 0x34], 0x2ca3
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1001802e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70], 0x7d8e6e83
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10018019
xor eax, eax
mov dword [ebp - 0x70], 0xf
cmp dword [ebp - 0x70], 0xfffffffb
jne 0x100180b2
jmp 0x1001803f
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], 0xe2bf35dd
cmp dword [ebp - 0x70], eax
jne 0x10018055
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x10018057
mov esi, ebx
mov eax, dword [ebp - 0x70]
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x70]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x70]
setne cl
imul eax, esi
neg ecx
imul eax, eax, 0xbec0
sub ecx, eax
mov eax, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100180ad
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0xfffffffb
je 0x1001803d
mov ecx, 0xffff
inc dword [ebp - 0x66c]
cmp dword [ebp - 0x66c], 7
je 0x10017ffe
movdqa xmm0, xmmword [0x10007c30]
lea ecx, [ebp - 0x131c]
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x40], 0x820b275c
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x48], 0x98ba832a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0xfb8]
push eax
lea eax, [ebp - 0xfc8]
push eax
movdqu xmmword [ebp - 0xfc8], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x359]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11d0]
push dword [esi]
call fcn.100129f6
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jne 0x100183b5
push edi
lea ecx, [ebp - 0x2dc]
call fcn.10012997
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10018175
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2dc]
call fcn.10012a38
mov dword [eax], 0x3695
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10018157
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10018382
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0xe2499e68
mov dword [ebp - 0x4c], eax
jmp 0x10018376
mov dword [ebp - 0x3c], 0xd72276b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], eax
jmp 0x100181ca
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100181c1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64c], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100181a9
xor eax, eax
mov dword [ebp - 0x64c], edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jle 0x100181a1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x10018373
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x10018309
jmp 0x100181ee
xor eax, eax
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10018215
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10018210
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100181fd
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2dc]
call fcn.10012a38
cmp dword [eax], 0
je 0x10018265
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7b187b35
setl cl
sub ecx, dword [ebp - 0x4c]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffc
setg al
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10018267
mov esi, ebx
jmp 0x10018269
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2dc]
call fcn.10012a38
push dword [ebp - 0x4c]
xor ebx, ebx
lea ecx, [ebp - 0x2dc]
cmp dword [eax], esi
setl bl
call fcn.10012a38
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
cmp ecx, 0x88ff7673
lea ecx, [ebp - 0x2dc]
sbb esi, esi
xor ebx, ebx
inc ebx
neg esi
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x18]
mov edi, eax
xor eax, eax
add ecx, esi
cmp ecx, 0x2d6273d5
mov ecx, dword [ebp - 0x18]
setg al
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, dword [edi]
setg al
cmp eax, 0xfffffffd
jbe 0x100182ee
push ebx
lea ecx, [ebp - 0x2dc]
call fcn.10012a38
cmp dword [eax], 0
jne 0x100182ee
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100182f7
jmp 0x100182f0
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100182f7
mov eax, ebx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x30]
push 2
pop ecx
cmp dword [ebp - 0x30], ecx
jle 0x100181ec
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2dc]
push ebx
call fcn.10012a38
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x2dc]
push 2
sub esi, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp esi, ecx
setne dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x3c]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
add ecx, 0xd230
je 0x1001835b
cmp dword [ebp - 0x30], eax
je 0x1001835b
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1001835e
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
pop eax
push 2
pop ecx
jns 0x100181db
push 3
pop edi
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x10018192
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10018180
push eax
lea ecx, [ebp - 0x2dc]
call fcn.10012a38
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x11
call fcn.10012a1c
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x10018136
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x100183eb
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jl 0x100183eb
xor eax, eax
mov edx, eax
jmp 0x100183ed
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x18]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x18]
sub edx, 0x5b3a
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x11d0]
mov byte [ebp - 4], 0x10
call fcn.10012a1c
push 8
mov dword [ebp - 0x18], 0xfffffff6
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001845e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd7c], 0x64a6847d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018446
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1001848e
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1001848b
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xd7c], 0
jne 0x10018489
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10018473
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10018463
mov dword [ebp - 0x18], 0xffffffed
jmp 0x10018515
mov dword [ebp - 0x1c], 0x7d2703d9
mov dword [ebp - 0x1c], 0x85c9e53
cmp dword [ebp - 0x18], eax
jne 0x100184b7
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x100184ce
mov edx, ebx
cmp dword [ebp - 0x1c], eax
je 0x100184ce
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0x1c]
jg 0x100184cc
mov ecx, ebx
jmp 0x100184d0
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x30a4ccfd
push 0
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd74]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xb72b
setl al
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x10
jle 0x1001849d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10018545
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbc]
call fcn.10012a38
mov dword [eax], 0x693e9323
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10018526
xor eax, eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10012a38
lea ecx, [ebp - 0xbc]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10012a38
jmp 0x10018790
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10018592
push eax
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xbc]
push eax
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x218]
call fcn.10012a38
cmp dword [eax], 0
je 0x100185e5
xor eax, eax
lea ecx, [ebp - 0xbc]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xbc]
push eax
call fcn.10012a38
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0xbc]
mov edi, eax
call fcn.10012a38
mov esi, eax
lea ecx, [ebp - 0xbc]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, 0xc51938d1
setle dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi]
setne cl
xor edi, edi
inc edi
xor ebx, ebx
cmp ecx, edi
lea ecx, [ebp - 0x218]
push edi
setge bl
call fcn.10012a38
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x5a0]
call fcn.10012a38
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xbc]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
xor ecx, ecx
cmp esi, 0xfe905687
setne cl
cmp ecx, dword [eax]
jle 0x100186c2
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100186c4
mov eax, edi
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xbc]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xbc]
setge bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0xbc]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov byte [ebp - 0x35], al
cmp ecx, 7
jl 0x10018743
cmp byte [ebp - 0x35], al
je 0x10018771
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1001876f
cmp byte [ebp - 0x35], al
je 0x10018751
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10012a38
lea ecx, [ebp - 0x218]
push dword [eax]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001879a
xor eax, eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10012a38
lea ecx, [ebp - 0xbc]
inc dword [eax]
xor eax, eax
push eax
call fcn.10012a38
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jle 0x10018567
jmp 0x1001879d
xor ebx, ebx
inc ebx
dec dword [ebp - 0x50]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xe
call fcn.10012a1c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
push 2
pop edi
jne 0x10017fa1
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0xe7c]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xceafd94f
mov dword [ebp - 0x34], 0x6dd8d130
mov dword [ebp - 0x34], 0x93e9323d
mov dword [ebp - 0x34], 0x6923607a
push ebx
call fcn.10012997
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1001881e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe7c]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10018803
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10018834
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x454], 0x82ca9683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10018823
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xe7c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x454]
mov byte [ebp - 4], 0xe
call fcn.10012a1c
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x5a0]
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x54]
xor edx, edx
push 3
pop esi
cmp ecx, dword [eax]
setl dl
imul eax, edx, 0xfffc
test eax, eax
je 0x1001888f
push esi
lea ecx, [ebp - 0x5a0]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001888f
mov edx, ebx
jmp 0x10018893
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x44]
cmp edx, eax
push edi
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x5a0]
mov eax, dword [ebp - 0x2c]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x218]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100188cc
cmp dword [ebp - 0x28], eax
je 0x100188ce
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x100188ea
mov eax, dword [ebp - 0x24]
push edi
lea ecx, [ebp - 0x5a0]
call fcn.10012a38
xor ecx, ecx
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x116c], ecx
lea ecx, [ebp - 0x5a0]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.10012a1c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jl 0x10017d9f
mov eax, 0x8c176b0f
lea ecx, [ebp - 0xa20]
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x44], esi
push ebx
call fcn.10012997
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x40], 0xbc1846e9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10018989
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa20]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001896e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100189a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1230], 0x8e0ea626
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10018991
xor eax, eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xd
jle 0x10018b49
jmp 0x100189c0
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], 0x49e3
mov dword [ebp - 0x40], 0xc2c102d1
mov dword [ebp - 0x40], 0xab2bd68e
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x10], eax
jmp 0x100189f2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100189e4
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0xa20]
mov esi, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [ebp - 0x68]
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x3a8]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x3a4]
setle bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
cmp ecx, 5
setg al
xor ecx, ecx
sub eax, 9
cmp eax, 0x6f0d
setge cl
xor eax, eax
cmp esi, ecx
setne al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x3a8]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
je 0x10018a81
xor eax, eax
cmp dword [ebp - 0x68], eax
je 0x10018a83
lea edx, [eax + 1]
jmp 0x10018a85
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
imul ecx, ecx, 0xdbfe
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setg dl
xor ebx, ebx
cmp edx, eax
setl bl
xor ecx, ecx
mov dword [ebp - 0x1228], ebx
neg ebx
mov eax, dword [ebp - 0x68]
cmp ebx, eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
setge cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x68]
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
sub edx, eax
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x68]
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x40], eax
jl 0x10018af6
mov eax, dword [ebp - 0x3a4]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3ac]
add ecx, 0x21409db2
cmp ecx, eax
mov eax, dword [ebp - 0x44]
push 1
setg dl
xor ecx, ecx
cmp edx, 0x5a47
pop ebx
setge cl
add eax, 0x11f0
add eax, ecx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x3a4]
cmp dword [ebp - 0x3a4], 0xd
push 3
pop esi
jg 0x100189be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.10012a1c
mov dword [ebp - 0x24], 0xb9f9b319
lea ecx, [ebp - 0x290]
push esi
call fcn.10012997
mov dword [ebp - 4], 0x15
mov eax, 0xffff
mov dword [ebp - 0x40], 0x6c0e2632
mov dword [ebp - 0x2c], 0xfbde
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10018ba6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1188], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10018b92
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10018bbc
push dword [ebp - 0x18]
call fcn.10012a38
mov dword [eax], 0x1897a4a
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x290]
cmp dword [ebp - 0x18], esi
jl 0x10018bab
push ebx
call fcn.10012a38
mov dword [eax], edi
jmp 0x10018bf0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x10018be2
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
dec dword [eax]
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
cmp dword [eax], 0
jge 0x10018bd1
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
cmp dword [eax], 0
je 0x10018c65
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x290]
xor eax, eax
push eax
call fcn.10012a38
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x290]
call fcn.10012a38
mov eax, dword [ebp - 0x1180]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x290]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
jmp 0x10018ca5
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10018ca2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x10018c8a
mov dword [ebp - 0x34], 0x704dcf74
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10018cd9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10018cc1
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10018cfe
push 0xe08
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0x104], eax
jmp 0x10018d1d
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10018d17
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [ebp - 0x104]
cmp dword [ebp - 0x104], 0xe
jle 0x10018d06
mov dword [ebp - 0x2c], 0xaa9320af
mov dword [ebp - 0x18], 0xb9b55bb2
mov dword [ebp - 0x18], eax
jmp 0x10018da3
mov dword [ebp - 0x20], 0xfe5e81a7
mov dword [ebp - 0x40], 0xf3ac9d73
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018d63
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc48], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018d4f
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10018d98
cmp dword [ebp - 0x20], eax
jne 0x10018d93
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc48]
mov ecx, dword [ebp - 0xc48]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0xc48]
add eax, ecx
cmp eax, dword [ebp - 0x18]
jl 0x10018d91
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10018d9a
mov eax, ebx
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x10018d39
push edi
lea ecx, [ebp - 0xa38]
call fcn.10012997
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x1c], 0xabecba2a
mov dword [ebp - 0x20], 0xb57a67d9
mov dword [ebp - 0x40], 0x46cd5fec
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10018df9
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa38]
call fcn.10012a38
mov dword [eax], 0xdd33a4a9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018ddb
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10018e0f
push dword [ebp - 0x1c]
call fcn.10012a38
mov dword [eax], 7
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xa38]
cmp dword [ebp - 0x1c], edi
jl 0x10018dfe
inc dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xceafd94f
mov dword [ebp - 0x40], 0x6dd8d130
mov dword [ebp - 0x40], 0x93e9323d
mov dword [ebp - 0x40], 0x6923607a
push ebx
call fcn.10012997
xor eax, eax
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10018e88
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd94]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10018e6d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10018e9e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x470], 0x82ca9683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10018e8d
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x470]
or dword [ebp - 4], eax
call fcn.10012a1c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018edf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x111c], 0x30c1abdd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018ec7
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc
jge 0x1001b535
jmp 0x10018ef0
xor eax, eax
mov dword [ebp - 0x44], 0xe033c22
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018f17
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x744], 0x31713b91
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018eff
xor eax, eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 7
jne 0x10018ff8
mov ecx, 0xffff
jmp 0x10018f33
movdqa xmm0, xmmword [0x10007c30]
lea ecx, [ebp - 0x132c]
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x4c], 0xf1bf506e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x48], 0x98ba832a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1068]
push eax
movdqu xmmword [ebp - 0x1068], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2fb]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11e8]
push dword [esi]
call fcn.100129f6
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jne 0x100192f2
push 3
lea ecx, [ebp - 0x2ec]
call fcn.10012997
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100190ae
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2ec]
call fcn.10012a38
mov dword [eax], 0x3695
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001908f
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x100192bc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0xe2499e68
mov dword [ebp - 0x4c], eax
jmp 0x100192b0
mov dword [ebp - 0x3c], 0xd72276b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], eax
jmp 0x10019107
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100190fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x738], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100190e2
xor eax, eax
mov dword [ebp - 0x738], 3
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jle 0x100190da
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x100192ad
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jg 0x10019246
jmp 0x1001912b
xor eax, eax
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
jl 0x10019152
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1001914d
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x1001913a
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2ec]
call fcn.10012a38
cmp dword [eax], 0
je 0x100191a2
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7b187b35
setl cl
sub ecx, dword [ebp - 0x4c]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffc
setg al
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100191a4
mov esi, ebx
jmp 0x100191a6
xor eax, eax
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2ec]
call fcn.10012a38
push dword [ebp - 0x4c]
xor ebx, ebx
lea ecx, [ebp - 0x2ec]
cmp dword [eax], esi
setl bl
call fcn.10012a38
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
cmp ecx, 0x88ff7673
lea ecx, [ebp - 0x2ec]
sbb esi, esi
xor ebx, ebx
inc ebx
neg esi
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x18]
mov edi, eax
xor eax, eax
add ecx, esi
cmp ecx, 0x2d6273d5
mov ecx, dword [ebp - 0x18]
setg al
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, dword [edi]
setg al
cmp eax, 0xfffffffd
jbe 0x1001922b
push ebx
lea ecx, [ebp - 0x2ec]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001922b
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10019234
jmp 0x1001922d
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10019234
mov eax, ebx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x30]
push 2
pop ecx
cmp dword [ebp - 0x30], ecx
jle 0x10019129
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2ec]
push ebx
call fcn.10012a38
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x2ec]
push 2
sub esi, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp esi, ecx
setne dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x3c]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
add ecx, 0xd230
je 0x10019298
cmp dword [ebp - 0x30], eax
je 0x10019298
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1001929b
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
pop eax
push 2
pop ecx
jns 0x10019118
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x100190cb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x100190b9
push eax
lea ecx, [ebp - 0x2ec]
call fcn.10012a38
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 4], 0x18
call fcn.10012a1c
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x1001906c
push 2
xor eax, eax
pop edi
cmp dword [ebp - 0x48], eax
jne 0x10019328
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x30]
jl 0x10019328
xor eax, eax
mov edx, eax
jmp 0x1001932a
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x18]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x18]
sub edx, 0x5b3a
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x11e8]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
push edi
lea ecx, [ebp - 0x230]
call fcn.10012997
push 8
mov dword [ebp - 4], 0x1a
pop eax
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], eax
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x100193b1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf24], 0x64a6847d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10019399
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x100193e2
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jg 0x100193df
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xf24], 0
jne 0x100193dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x100193c8
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x100193b9
mov dword [ebp - 0x18], 0xffffffed
jmp 0x10019468
mov dword [ebp - 0x1c], 0x7d2703d9
mov dword [ebp - 0x1c], 0x85c9e53
cmp dword [ebp - 0x18], eax
jne 0x1001940a
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10019421
mov edx, ebx
cmp dword [ebp - 0x1c], eax
je 0x10019421
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0x1c]
jg 0x1001941f
mov ecx, ebx
jmp 0x10019423
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x30a4ccfd
push 0
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xb72b
setl al
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x10
jle 0x100193f0
lea eax, [ebp - 0xfd8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0xfe8]
push eax
lea ecx, [ebp - 0x1254]
movdqu xmmword [ebp - 0xfe8], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2ba]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5b8]
push dword [esi]
call fcn.100129f6
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xe94]
mov dword [ebp - 0x2c], 0xfffffffe
push 4
call fcn.10012997
push edi
lea ecx, [ebp - 0xdac]
mov byte [ebp - 4], 0x1c
call fcn.10012997
mov byte [ebp - 4], 0x1d
mov eax, 0x8d72a67f
mov dword [ebp - 0x480], eax
or esi, 0xffffffff
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
xor eax, eax
mov dword [ebp - 0x20], 0x9974082
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x40], 0x3d2ae456
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10019533
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe94]
call fcn.10012a38
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019518
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10019559
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdac]
call fcn.10012a38
mov dword [eax], 0x1d69f428
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001953b
xor eax, eax
dec dword [ebp - 0x40]
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1001956d
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [ebp - 0xdac]
call fcn.10012a1c
lea ecx, [ebp - 0xe94]
mov byte [ebp - 4], 0x1b
call fcn.10012a1c
push ebx
lea ecx, [ebp - 0xb58]
call fcn.10012997
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x1c], 0xca4f833f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100195c7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb58]
call fcn.10012a38
mov ecx, 0xffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100195a8
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x100195e9
push 0x231
push 0x17e1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100195ff
push dword [ebp - 0x1c]
call fcn.10012a38
mov dword [eax], 0x50bf
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xb58]
cmp dword [ebp - 0x1c], ebx
jl 0x100195ee
mov byte [ebp - 4], 0x1b
call fcn.10012a1c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10019639
push dword [ebp - 0x10]
lea ecx, [ebp - 0x230]
call fcn.10012a38
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001961e
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x48], eax
jmp 0x10019681
mov dword [ebp - 0x1c], 0x59e57ad9
mov dword [ebp - 0x1c], 0xffffffe4
jmp 0x10019678
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x10019670
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1001967e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jle 0x10019658
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x10019648
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1a
je 0x1001b384
jmp 0x100196a4
push 4
lea ecx, [ebp - 0x430]
call fcn.10012997
push 4
lea ecx, [ebp - 0xa50]
mov byte [ebp - 4], 0x1f
call fcn.10012997
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x48], 0xf1939ef
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x100196f1
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x308], 0x62fd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x100196d8
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10019719
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x430]
call fcn.10012a38
mov dword [eax], 0xf57a7c2
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x100196fa
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10019741
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xa50]
call fcn.10012a38
mov dword [eax], 0x14ad38dc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x10019722
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x1001976a
push 0x1ae5
push 0x12d8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
push eax
lea ecx, [ebp - 0x430]
call fcn.10012a38
lea ecx, [ebp - 0x430]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10012a38
cmp dword [eax], ebx
jg 0x100199a1
mov dword [ebp - 0x30], ebx
xor eax, eax
mov dword [ebp - 0x20], 0xcc80fc3a
mov dword [ebp - 0x40], 0xfb66febf
mov dword [ebp - 0x1c], 0xbfc75daa
mov dword [ebp - 0x7e4], 0x3829
mov dword [ebp - 0x7e0], 0x3829
mov dword [ebp - 0x7dc], 0x3829
mov dword [ebp - 0x7d8], 0x3829
mov dword [ebp - 0x40], 0x6da8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100197fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xedc], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100197e1
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x1001992f
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0xdc4]
mov dword [ebp - 0x50], 0x9cb0befc
mov dword [ebp - 0x50], ebx
push ebx
call fcn.10012997
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x10], eax
jmp 0x10019841
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdc4]
call fcn.10012a38
mov dword [eax], 0x36be856d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001982a
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x430]
mov eax, dword [ebp + eax*4 - 0x308]
xor eax, eax
push eax
call fcn.10012a38
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x308]
mov eax, dword [ebp - 0x7e0]
dec dword [ebp - 0x7e0]
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x30]
jne 0x100198d5
dec dword [ebp - 0x40]
je 0x100198cc
cmp dword [ebp - 0xed8], eax
je 0x10019894
mov edx, ebx
cmp dword [ebp - 0x1c], eax
jne 0x10019896
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x308]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xfe2ccf58
setne al
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
je 0x100198cc
xor eax, eax
add eax, 0xb6c5af15
je 0x100198d7
mov eax, ebx
xor edx, edx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
push 2
setg cl
xor edx, edx
cmp ecx, 0x32e8
lea ecx, [ebp - 0xa50]
mov esi, dword [ebp + eax*4 - 0x308]
setle dl
sub esi, edx
call fcn.10012a38
lea ecx, [ebp - 0xdc4]
mov dword [eax], esi
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 0x20
call fcn.10012a1c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10019806
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1001997a
push eax
lea ecx, [ebp - 0x430]
call fcn.10012a38
lea ecx, [ebp - 0x430]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x308]
xor eax, eax
push eax
call fcn.10012a38
push 0
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x308]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], edi
jle 0x10019937
push eax
lea ecx, [ebp - 0x430]
call fcn.10012a38
lea ecx, [ebp - 0x430]
inc dword [eax]
xor eax, eax
push eax
call fcn.10012a38
cmp dword [eax], ebx
jle 0x1001978f
or esi, 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.10012a1c
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x1b
call fcn.10012a1c
push 2
lea ecx, [ebp - 0xd4]
call fcn.10012997
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xefc]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0xceafd94f
mov dword [ebp - 0x40], 0x6dd8d130
mov dword [ebp - 0x40], 0x93e9323d
mov dword [ebp - 0x40], 0x6923607a
push ebx
call fcn.10012997
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10019a23
push dword [ebp - 0x18]
lea ecx, [ebp - 0xefc]
call fcn.10012a38
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10019a08
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10019a39
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x484], 0x82ca9683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10019a28
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xefc]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x484]
mov byte [ebp - 4], 0x22
call fcn.10012a1c
mov dword [ebp - 0x44], 0xfffffffe
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xc08901f2
mov dword [ebp - 0x20], 0xf603fa75
mov dword [ebp - 0x20], 0x654fddd3
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10019aa0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1344], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10019a8c
xor eax, eax
inc dword [ebp - 0x40]
push 8
mov dword [ebp - 0x40], 0x820b275c
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jmp 0x10019ac6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11a0], 0x29ed
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10019ab5
mov dword [ebp - 0x18], 0xb
cmp dword [ebp - 0x18], 0x1b
jge 0x10019b31
movdqa xmm0, xmmword [0x10007c50]
lea eax, [ebp - 0xff8]
push eax
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1264]
movdqu xmmword [ebp - 0x1008], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2ed]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xec4]
push dword [esi]
call fcn.100129f6
xor eax, eax
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001b3f1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5e8], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b3d9
xor eax, eax
mov dword [ebp - 0x5e0], eax
jmp 0x1001b445
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x10], eax
jmp 0x1001b416
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef0], 0x161ab6ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b405
mov dword [ebp - 0xeec], 0xf25cbd94
lea ecx, [ebp - 0xec4]
push dword [ebp - 0x5e0]
call fcn.10012a38
push 0
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x5e0]
pop eax
cmp dword [ebp - 0x5e0], edi
jle 0x1001b3f9
lea ecx, [ebp - 0xec4]
mov byte [ebp - 4], 0x1b
call fcn.10012a1c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x5b8]
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, dword [eax]
setl dl
imul eax, edx, 0xfffc
test eax, eax
je 0x1001b494
push edi
lea ecx, [ebp - 0x5b8]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001b494
mov edx, ebx
jmp 0x1001b498
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
push 2
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x5b8]
mov eax, dword [ebp - 0x2c]
pop edi
push edi
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x230]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1001b4d4
cmp dword [ebp - 0x24], eax
je 0x1001b4d6
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x1001b4f2
mov eax, dword [ebp - 0x4c]
push edi
lea ecx, [ebp - 0x5b8]
call fcn.10012a38
xor ecx, ecx
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x1118], ecx
lea ecx, [ebp - 0x5b8]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10012a1c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
push 3
pop esi
jl 0x10018eee
mov edi, 0xe1757117
lea ecx, [ebp - 0x754]
mov dword [ebp - 0x1c], edi
push 2
call fcn.10012997
mov dword [ebp - 4], 0x37
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001b582
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x754]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b562
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x1001b6c7
mov edi, 0xffff
jmp 0x1001b598
xor eax, eax
mov dword [ebp - 0x24], 0xe1e2c0d3
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001b6a5
jmp 0x1001b5b5
xor eax, eax
mov dword [ebp - 0x18], 0x23e64f14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1001b5f0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x754]
call fcn.10012a38
push dword [ebp - 0x18]
lea ecx, [ebp - 0x754]
mov esi, eax
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001b5c4
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1001b5fc
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1001b5fe
mov edx, ebx
mov dword [ebp - 0x48], 0x7f08
xor ecx, ecx
mov eax, dword [ebp - 0x48]
add eax, 0xfff6
cmp eax, 0x6c064155
setne cl
add ecx, edx
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
sub ecx, 0x819d
jne 0x1001b630
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1001b632
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x1001b63c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001b66d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001b69c
push eax
push 0x14ad
push 0x115a
push eax
push 0x1535
push 0x1a9d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1001b69c
mov dword [ebp - 0x18], eax
jmp 0x1001b697
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], eax
jl 0x1001b694
push dword [ebp - 0x24]
lea ecx, [ebp - 0x754]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001b692
dec dword [ebp - 0x48]
jns 0x1001b67a
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001b672
dec dword [ebp - 0x24]
jns 0x1001b5b3
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1001b596
mov edi, 0xe1757117
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x754]
call fcn.10012a1c
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x6bc]
push 2
call fcn.10012997
mov dword [ebp - 4], 0x38
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001b71e
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6bc]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b6fe
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x1001b863
mov edi, 0xffff
jmp 0x1001b734
xor eax, eax
mov dword [ebp - 0x24], 0xe1e2c0d3
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001b841
jmp 0x1001b751
xor eax, eax
mov dword [ebp - 0x18], 0x23e64f14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1001b78c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6bc]
call fcn.10012a38
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6bc]
mov esi, eax
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001b760
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1001b798
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1001b79a
mov edx, ebx
mov dword [ebp - 0x48], 0x7f08
xor ecx, ecx
mov eax, dword [ebp - 0x48]
add eax, 0xfff6
cmp eax, 0x6c064155
setne cl
add ecx, edx
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
sub ecx, 0x819d
jne 0x1001b7cc
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1001b7ce
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x1001b7d8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001b809
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001b838
push eax
push 0x14ad
push 0x115a
push eax
push 0x1535
push 0x1a9d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1001b838
mov dword [ebp - 0x18], eax
jmp 0x1001b833
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], eax
jl 0x1001b830
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6bc]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001b82e
dec dword [ebp - 0x48]
jns 0x1001b816
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001b80e
dec dword [ebp - 0x24]
jns 0x1001b74f
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1001b732
mov edi, 0xe1757117
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6bc]
call fcn.10012a1c
push 2
lea ecx, [ebp - 0x1d0]
call fcn.10012997
mov dword [ebp - 4], 0x39
xor eax, eax
mov dword [ebp - 0x24], 0x56915a13
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x50], 0xe5fef407
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001b8d3
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1d0]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b8b3
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001ba6e
mov dword [ebp - 0x1c], 0xfffffff6
lea ecx, [ebp - 0x80c]
push ebx
call fcn.10012997
mov byte [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x34], 0x6b59229a
mov dword [ebp - 0x10], eax
jmp 0x1001b91b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x80c]
call fcn.10012a38
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001b904
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1d0]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001ba63
mov dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x1c], 7
jge 0x1001ba49
push 8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1d0]
xor eax, eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1d0]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0x80c]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1d0]
and dword [eax], 0
xor eax, eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x24]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x1d0]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10012a38
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x1d0]
setl bl
xor eax, eax
push eax
call fcn.10012a38
push 0
lea ecx, [ebp - 0x1d0]
cmp ebx, dword [eax]
pop ebx
sete bl
xor eax, eax
inc eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1d0]
sub ebx, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x40]
xor edx, edx
add ecx, ebx
mov esi, eax
cmp ecx, 0x43e5
mov ecx, dword [ebp - 0x1c]
setge dl
xor eax, eax
cmp edx, 0x35211521
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1d0]
setne dl
imul eax, dword [esi]
add edx, 0x698d
xor ebx, ebx
cmp eax, edx
setg bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1d0]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10012a38
push 1
mov dword [eax], ebx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
pop ebx
jl 0x1001b948
lea ecx, [ebp - 0x80c]
mov byte [ebp - 4], 0x39
call fcn.10012a1c
dec dword [ebp - 0x24]
jns 0x1001b8df
jmp 0x1001ba6e
lea ecx, [ebp - 0x80c]
call fcn.10012a1c
inc dword [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x7a8]
push 2
call fcn.10012997
mov dword [ebp - 4], 0x3b
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001bac8
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7a8]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001baa8
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe8
jle 0x1001bc0d
mov edi, 0xffff
jmp 0x1001bade
xor eax, eax
mov dword [ebp - 0x24], 0xe1e2c0d3
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001bbeb
jmp 0x1001bafb
xor eax, eax
mov dword [ebp - 0x18], 0x23e64f14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x1001bb36
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7a8]
call fcn.10012a38
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7a8]
mov esi, eax
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001bb0a
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1001bb42
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1001bb44
mov edx, ebx
mov dword [ebp - 0x48], 0x7f08
xor ecx, ecx
mov eax, dword [ebp - 0x48]
add eax, 0xfff6
cmp eax, 0x6c064155
setne cl
add ecx, edx
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
sub ecx, 0x819d
jne 0x1001bb76
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1001bb78
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x1001bb82
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1001bbb3
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001bbe2
push eax
push 0x14ad
push 0x115a
push eax
push 0x1535
push 0x1a9d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1001bbe2
mov dword [ebp - 0x18], eax
jmp 0x1001bbdd
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], eax
jl 0x1001bbda
push dword [ebp - 0x24]
lea ecx, [ebp - 0x7a8]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001bbd8
dec dword [ebp - 0x48]
jns 0x1001bbc0
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001bbb8
dec dword [ebp - 0x24]
jns 0x1001baf9
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1001badc
mov edi, 0xe1757117
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a8]
call fcn.10012a1c
push 2
lea ecx, [ebp - 0x278]
call fcn.10012997
mov dword [ebp - 4], 0x3c
xor eax, eax
mov dword [ebp - 0x24], 0x56915a13
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x20], ebx
push 0xfffffffffffffffb
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x50], 0xe5fef407
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001bc7c
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001bc5c
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001be16
mov dword [ebp - 0x1c], 0xfffffff6
lea ecx, [ebp - 0x824]
push ebx
call fcn.10012997
mov byte [ebp - 4], 0x3d
xor eax, eax
mov dword [ebp - 0x34], 0x6b59229a
mov dword [ebp - 0x10], eax
jmp 0x1001bcc0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x824]
call fcn.10012a38
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001bcad
push dword [ebp - 0x24]
lea ecx, [ebp - 0x278]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001be0b
mov dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x1c], 7
jge 0x1001bdf1
push 8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x278]
xor eax, eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x278]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0x824]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x278]
and dword [eax], 0
xor eax, eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x24]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x278]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10012a38
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x278]
setl bl
xor eax, eax
push eax
call fcn.10012a38
push 0
lea ecx, [ebp - 0x278]
cmp ebx, dword [eax]
pop ebx
sete bl
xor eax, eax
inc eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x278]
sub ebx, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x40]
xor edx, edx
add ecx, ebx
mov esi, eax
cmp ecx, 0x43e5
mov ecx, dword [ebp - 0x1c]
setge dl
xor eax, eax
cmp edx, 0x35211521
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x278]
setne dl
imul eax, dword [esi]
add edx, 0x698d
xor ebx, ebx
cmp eax, edx
setg bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x278]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10012a38
push 1
mov dword [eax], ebx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
pop ebx
jl 0x1001bced
push 0xfffffffffffffffb
pop esi
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 0x3c
call fcn.10012a1c
dec dword [ebp - 0x24]
jns 0x1001bc88
jmp 0x1001be16
lea ecx, [ebp - 0x824]
call fcn.10012a1c
inc dword [ebp - 0x50]
lea ecx, [ebp - 0x278]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x10], 0x48bbca63
xor eax, eax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001be61
push 0x1570
push 0x26
push 0x1e53
push 0x893
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x10], 0xe
jmp 0x1001be91
mov dword [ebp - 0x20], 0x1265ab3e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001be8e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff3
jg 0x1001be6a
push 2
lea ecx, [ebp - 0x248]
call fcn.10012997
mov dword [ebp - 4], 0x3e
xor eax, eax
mov dword [ebp - 0x24], 0x56915a13
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x50], 0xe5fef407
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001bef4
push 8
pop edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x248]
call fcn.10012a38
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001bed4
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1001c08e
mov dword [ebp - 0x1c], 0xfffffff6
lea ecx, [ebp - 0x83c]
push ebx
call fcn.10012997
mov byte [ebp - 4], 0x3f
xor eax, eax
mov dword [ebp - 0x34], 0x6b59229a
mov dword [ebp - 0x10], eax
jmp 0x1001bf38
push dword [ebp - 0x10]
lea ecx, [ebp - 0x83c]
call fcn.10012a38
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001bf25
push dword [ebp - 0x24]
lea ecx, [ebp - 0x248]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001c083
mov dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x1c], 7
jge 0x1001c069
push 8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x248]
xor eax, eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x248]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0x83c]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x248]
and dword [eax], 0
xor eax, eax
mov dword [ebp - 0x40], eax
push dword [ebp - 0x24]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x248]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10012a38
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
inc ecx
cmp dword [eax], ecx
lea ecx, [ebp - 0x248]
setl bl
xor eax, eax
push eax
call fcn.10012a38
push 0
lea ecx, [ebp - 0x248]
cmp ebx, dword [eax]
pop ebx
sete bl
xor eax, eax
inc eax
push eax
call fcn.10012a38
push dword [ebp - 0x24]
lea ecx, [ebp - 0x248]
sub ebx, dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x40]
xor edx, edx
add ecx, ebx
mov esi, eax
cmp ecx, 0x43e5
mov ecx, dword [ebp - 0x1c]
setge dl
xor eax, eax
cmp edx, 0x35211521
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x248]
setne dl
imul eax, dword [esi]
add edx, 0x698d
xor ebx, ebx
cmp eax, edx
setg bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x248]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.10012a38
push 1
mov dword [eax], ebx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
pop ebx
jl 0x1001bf65
push 0xfffffffffffffffb
pop esi
lea ecx, [ebp - 0x83c]
mov byte [ebp - 4], 0x3e
call fcn.10012a1c
dec dword [ebp - 0x24]
jns 0x1001bf00
jmp 0x1001c08e
lea ecx, [ebp - 0x83c]
call fcn.10012a1c
inc dword [ebp - 0x50]
lea ecx, [ebp - 0x248]
or dword [ebp - 4], 0xffffffff
call fcn.10012a1c
mov dword [ebp - 0x24], 0xb9f9b319
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x50], 0x704dcf74
mov dword [ebp - 0x2c], 0xaa9320af
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001c0df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1134], 0x30c1abdd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001c0c6
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc
jge 0x1001c520
mov dword [ebp - 0x1c], 0xf1bf506e
lea ecx, [ebp - 0x1dc]
push 2
call fcn.10012997
lea eax, [ebp - 0x1078]
mov dword [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x1088]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1244]
movdqu xmmword [ebp - 0x1088], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x319]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x618]
push dword [esi]
call fcn.100129f6
mov byte [ebp - 4], 0x41
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001c17b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1dc]
call fcn.10012a38
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c15f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1001c439
push 2
lea ecx, [ebp - 0xec]
call fcn.10012997
mov byte [ebp - 4], 0x42
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x34], 0x820b275c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001c1cc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.10012a38
mov dword [eax], 0x693e9323
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c1ad
xor eax, eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10012a38
lea ecx, [ebp - 0xec]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10012a38
jmp 0x1001c417
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001c219
push eax
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x1dc]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001c26c
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
xor eax, eax
lea ecx, [ebp - 0xec]
push eax
call fcn.10012a38
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0xec]
mov edi, eax
call fcn.10012a38
mov esi, eax
lea ecx, [ebp - 0xec]
xor eax, eax
push eax
call fcn.10012a38
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, 0xc51938d1
setle dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi]
setne cl
xor edi, edi
inc edi
xor ebx, ebx
cmp ecx, edi
lea ecx, [ebp - 0x1dc]
push edi
setge bl
call fcn.10012a38
xor ecx, ecx
push 2
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x618]
call fcn.10012a38
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0xec]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
xor ecx, ecx
cmp esi, 0xfe905687
setne cl
cmp ecx, dword [eax]
jle 0x1001c349
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1001c34b
mov eax, edi
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xec]
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xec]
setge bl
xor eax, eax
push eax
call fcn.10012a38
lea ecx, [ebp - 0xec]
mov esi, dword [eax]
xor eax, eax
push eax
add esi, ebx
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
xor edx, edx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov byte [ebp - 0x11], al
cmp ecx, 7
jl 0x1001c3ca
cmp byte [ebp - 0x11], al
je 0x1001c3f8
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1001c3f6
cmp byte [ebp - 0x11], al
je 0x1001c3d8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10012a38
lea ecx, [ebp - 0x1dc]
push dword [eax]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001c421
xor eax, eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10012a38
lea ecx, [ebp - 0xec]
inc dword [eax]
xor eax, eax
push eax
call fcn.10012a38
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jle 0x1001c1ee
jmp 0x1001c424
xor ebx, ebx
inc ebx
dec dword [ebp - 0x40]
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x41
call fcn.10012a1c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jne 0x1001c183
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x618]
push ebx
call fcn.10012a38
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, dword [eax]
setl dl
imul eax, edx, 0xfffc
test eax, eax
je 0x1001c47c
push 3
lea ecx, [ebp - 0x618]
call fcn.10012a38
cmp dword [eax], 0
je 0x1001c47c
mov edx, ebx
jmp 0x1001c480
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
push 2
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x618]
mov eax, dword [ebp - 0x2c]
call fcn.10012a38
push ebx
lea ecx, [ebp - 0x1dc]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1001c4ba
cmp dword [ebp - 0x24], eax
je 0x1001c4bc
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x1001c4d8
mov eax, dword [ebp - 0x1c]
push 2
lea ecx, [ebp - 0x618]
call fcn.10012a38
xor ecx, ecx
cmp dword [eax], ebx
setle cl
mov dword [ebp - 0x1130], ecx
lea ecx, [ebp - 0x618]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.10012a1c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
jl 0x1001c0ec
xor eax, eax
mov edi, 0xe1757117
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], 0xf
jmp 0x1001c54e
cmp byte [ebp - 0x11], 0
je 0x1001c54b
push 0x9af
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
mov byte [ebp - 0x11], al
je 0x1001c537
cmp byte [ebp - 0x11], 0
je 0x1001c56b
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1001c595
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001c57d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1001c5ba
push 0xe08
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov dword [ebp - 0x108], eax
jmp 0x1001c5d9
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1001c5d3
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [ebp - 0x108]
cmp dword [ebp - 0x108], 0xe
jle 0x1001c5c2
push 2
lea ecx, [ebp - 0x704]
call fcn.10012997
mov dword [ebp - 4], 0x43
xor eax, eax
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], eax
jmp 0x1001c6cf
mov dword [ebp - 0x1c], 0x713a473e
lea ecx, [ebp - 0xa98]
push ebx
call fcn.10012997
xor eax, eax
mov byte [ebp - 4], 0x44
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1001c643
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa98]
call fcn.10012a38
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001c628
xor eax, eax
mov dword [ebp - 0x1c], 0x17
jmp 0x1001c692
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 0x1c], eax
jne 0x1001c698
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1001c68f
mov dword [ebp - 0x20], 0xc7dcd66a
lea ecx, [ebp - 0xa98]
push dword [ebp - 0x10]
call fcn.10012a38
xor eax, eax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1001c688
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
dec dword [ebp - 0x10]
jns 0x1001c660
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jge 0x1001c64c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1001c6bd
push 0xeaf
push 0x1f38
push eax
push eax
push 0x246
push 0x25d5
call dword [sym.imp.USER32.dll_ToUnicode]
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], 0x43
call fcn.10012a1c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 9
jne 0x1001c607
movdqa xmm0, xmmword [0x10007c60]
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x20], ebx
push eax
lea ecx, [ebp - 0x12fc]
movdqu xmmword [ebp - 0x1028], xmm0
call fcn.10012a4a
lea ecx, [ebp - 0x2ff]
mov esi, eax
call fcn.10012a47
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6d4]
push dword [esi]
call fcn.100129f6
mov byte [ebp - 4], 0x45
xor eax, eax
mov dword [ebp - 0x10], 0x3c576436
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], 0xf224b34d
mov dword [ebp - 0x20], 0x84d75f05
mov dword [ebp - 0x20], 9
push 2
mov dword [ebp - 0x3c], eax
pop ecx
cmp dword [ebp - 0x3c], ecx
jge 0x1001c76f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1a0], 0xac204e2d
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x1001c757
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1001c78d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x114c], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jl 0x1001c778
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ecx
jge 0x1001c7ad
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x968], 0xb766
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jl 0x1001c795
xor eax, eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffe7
jge 0x1001c960
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0xe3e45bbb
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x1001c867
mov dword [ebp - 0x1c], 0x8ee41b66
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1001c80b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6d4]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1001c80b
dec dword [ebp - 0x1c]
jns 0x1001c7f3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6d4]
call fcn.10012a38
xor eax, eax
cmp dword [ebp - 0x1a0], eax
jne 0x1001c82a
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x1001c82c
mov ecx, ebx
imul eax, dword [ebp - 0x28], 0xfff8
xor edx, edx
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
pop eax
setg dl
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x28]
jns 0x1001c7dd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1001c94d
mov dword [ebp - 0x2c], 0xfffffff7
lea ecx, [ebp - 0x6d4]
push 3
call fcn.10012a38
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x114c], edx
mov eax, dword [ebp - 0x2c]
imul eax, edx
cmp eax, 0xffffffff
setg cl
xor eax, eax
add ecx, dword [ebp - 0x28]
cmp ecx, 0xffff
setne al
cmp dword [ebp - 0x10], eax
jg 0x1001c8cd
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1001c8cf
mov eax, ebx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x6d4]
mov eax, dword [ebp - 0x10]
push ebx
call fcn.10012a38
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, esi
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1a0]
setl bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x28]
cmp ebx, eax
setg cl
imul eax, ecx, 0xfff8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add eax, 0xcec458af
add eax, ecx
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
jne 0x1001cb04
inc dword [ebp - 0x1c]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x1c], ebx
jle 0x1001c873
dec dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], 0xffffffe7
jl 0x1001c7c3
dec dword [ebp - 0x968]
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 0x43
call fcn.10012a1c
mov dword [ebp - 0x4c], 0xfff7
lea ecx, [ebp - 0x764]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], 0xffffffff
push 4
call fcn.10012997
mov byte [ebp - 4], 0x46
xor eax, eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1001c9cb
push dword [ebp - 0x28]
lea ecx, [ebp - 0x764]
call fcn.10012a38
mov dword [eax], 0x219909d0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001c9ac
xor eax, eax
push 2
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x1001c9ee
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x46c], 0xad21
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1001c9d6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1001ca0e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x980], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1001c9f6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1001ca2e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x65c], 0x8e584094
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1001ca16
cmp dword [ebp - 0x18], eax
jne 0x1001ca40
push 0x1f82
call dword [sym.imp.KERNEL32.dll_ExitProcess]