Function at 0x10020691
Capabilities:
Encrypt data using speck
Query or enumerate registry value

Disassembly:
mov eax, 0x10063776
call fcn.10062b10
sub esp, 0x3c0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x288]
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x84], ecx
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x50], edx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x94], ebx
push ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x90], ebx
movdqu xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x8c], ebx
call fcn.10014672
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 0x3b16
push 2
call fcn.10011569
mov byte [ebp - 4], 1
mov dword [ebp - 0x40], 0x185c
cmp dword [ebp - 0x40], 0x19dc
jle 0x10020741
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1060ba78
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1001133e
inc edi
cmp edi, 0x2d11
jl 0x1002071b
inc esi
cmp esi, 0x3a3f
jl 0x10020719
mov byte [ebp - 4], 2
cmp dword [ebp - 0x40], 0x153b
jge 0x1002075d
mov edx, 0x10008bf4
mov ecx, 0x1060ba78
call fcn.10013c65
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x10020793
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x54], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10020789
mov dword [ebp - 0x1c], ebx
jmp 0x100207b0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x230]
mov dword [eax + ecx*4], 0x526c7153
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002079d
mov esi, dword [ebp - 0x94]
mov dword [ebp - 0x40], esi
mov dword [esi], ebx
push 3
lea ecx, [ebp - 0x204]
call fcn.10011569
mov dword [ebp - 0x1c], ebx
jmp 0x100207e3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x204]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100207d3
mov dword [ebp - 0x1c], ebx
jmp 0x100207ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x304], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100207ee
mov edi, dword [ebp - 0x204]
xor ecx, ecx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x54]
imul eax, dword [esi + 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x94]
sbb esi, esi
xor edx, edx
neg esi
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x94]
setg dl
xor ecx, ecx
cmp edx, esi
mov eax, dword [eax]
setge cl
mov dword [ebp - 0x300], ecx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x54]
cmp dword [edi + 4], ecx
sete dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x54]
cmp eax, edx
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x94]
setle cl
xor edx, edx
cmp ecx, dword [eax + 4]
lea ecx, [ebp - 0x204]
mov eax, dword [esi]
setg dl
mov dword [ebp + eax*4 - 0x54], edx
call fcn.100115eb
dec dword [esi]
mov esi, dword [ebp - 0x40]
jns 0x100207c1
dec dword [ebp - 0x14]
lea ecx, [ebp - 0x230]
call fcn.100115eb
or edi, 0xffffffff
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], edi
call fcn.100115eb
mov dword [ebp - 0x24], 0xf6af1124
xor ecx, ecx
mov dword [ebp - 0x28], 0x7e40d8eb
inc ecx
mov dword [ebp - 0x38], 0xc65315fa
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x24], ebx
jmp 0x100208ef
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4c], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100208e1
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xa
je 0x10020b17
mov dword [ebp - 0x20], ecx
push ecx
lea ecx, [ebp - 0x150]
call fcn.10011569
xor esi, esi
mov dword [ebp - 4], 4
mov dword [ebp - 0x30], ebx
inc esi
jmp 0x1002092e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002091f
cmp dword [ebp - 0x20], ebx
jne 0x10020b06
mov dword [ebp - 0x20], ebx
jmp 0x10020adc
mov dword [ebp - 0x1c], 0x91e29ea4
lea ecx, [ebp - 0x1f8]
push 3
call fcn.10011569
xor edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ebx
jmp 0x10020976
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0x3fca
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10020963
mov dword [ebp - 0x1c], ebx
jmp 0x10020992
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8], 0xdf561f66
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10020981
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100209bf
push 0x18b9
push 0x37e
push 0x23dd
push 0xf16
push 0xe1e
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x1c], ebx
jmp 0x10020ac4
mov dword [ebp - 0x30], 0x68cd546
mov dword [ebp - 0x2c], 0xa4b6d8d4
cmp dword [ebp - 0x1c], ebx
je 0x100209fa
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x30], ebx
je 0x100209f1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul eax, dword [ebp - 0x4c]
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x30]
mov dword [ebp - 0xd8], edx
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jne 0x10020a2d
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
xor esi, esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea edx, [esi + 1]
sub edx, eax
mov eax, dword [ebp - 0x4c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x28], ecx
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x10020a75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x104], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10020a64
cmp dword [ebp - 0x2c], ebx
jne 0x10020a86
mov esi, edx
cmp dword [ebp - 0x38], ebx
je 0x10020a88
mov esi, ebx
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x3c]
jle 0x10020aa0
mov eax, dword [ebp - 0x1f8]
cmp dword [eax + 8], ebx
jne 0x10020aa0
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xfffffff9
setl cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x150]
setne cl
mov dword [eax], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
je 0x100209c7
lea ecx, [ebp - 0x1f8]
call fcn.100115eb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3b
je 0x10020944
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], edi
call fcn.100115eb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
push 1
pop ecx
jne 0x10020901
jmp 0x10020b14
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], edi
call fcn.100115eb
xor ecx, ecx
inc ecx
mov eax, dword [0x1060cc20]
test al, 1
jne 0x10020bad
or eax, ecx
mov dword [0x1060cc20], eax
push ebx
mov dword [ebp - 4], 5
push ebx
mov dword [0x1060cc00], ebx
mov dword [0x1060cc04], ebx
call fcn.10013b65
mov dword [0x1060cc00], eax
mov dword [0x1060cc08], ebx
mov dword [0x1060cc10], ebx
mov byte [ebp - 4], 7
mov ecx, 0x1060cc08
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x12c]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x268]
mov dword [0x1060cc1c], 0x3f800000
push eax
mov dword [0x1060cc0c], ebx
call fcn.1001393d
push 0x1006448d
mov dword [0x1060cc14], 7
mov dword [0x1060cc18], 8
call fcn.1004d825
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
jmp 0x10020bc6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x39c], 0xa2768935
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10020bb5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xffffffe3
jl 0x10020c5c
xor esi, esi
inc esi
mov dword [ebp - 0x30], 9
dec dword [ebp - 0x30]
mov dword [ebp - 0x30], 0x1d
jmp 0x10020c4d
push 3
lea ecx, [ebp - 0x1ec]
call fcn.10011569
mov dword [ebp - 0x20], ebx
jmp 0x10020c10
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10020c01
mov dword [ebp - 0x20], ebx
jmp 0x10020c2c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x128], 0xe81a7ecc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10020c1b
mov eax, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1ec]
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
call fcn.100115eb
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1b
jle 0x10020bef
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x10020bdc
imul eax, dword [ebp - 0x84], 0x2710
add eax, dword [ebp - 0x50]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], ebx
jmp 0x10020c8f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10020c8c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
jge 0x10020c77
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x24], 0x9ac70c30
push eax
call fcn.100228af
push 2
lea ecx, [ebp - 0xb8]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
call fcn.10011569
mov dword [ebp - 0x14], 0x5e3edfa8
mov dword [ebp - 0x14], 0xf7c8b166
mov dword [ebp - 0x14], 0x23edb395
mov dword [ebp - 0x14], 0xb76e1ee6
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10020cf1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xa86ba47c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10020cde
mov eax, dword [ebp - 0xb8]
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xb8]
cmp dword [ecx], eax
mov esi, dword [ecx]
mov eax, dword [ebp - 0x14]
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], edi
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setle cl
xor edx, edx
sub eax, ecx
sub eax, esi
imul eax, esi
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
sub ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb8]
setle dl
xor esi, esi
inc esi
cmp esi, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
call fcn.100115eb
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x10020e52
mov dword [ebp - 0x50], 0x3813bf58
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x50], 0xdaffa898
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x14], ebx
jmp 0x10020da8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x100c4307
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10020d9a
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
je 0x10020db8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, 0xca77
sub ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
inc eax
neg eax
mov dword [ebp - 0x50], edx
sbb eax, eax
xor edx, edx
inc eax
cmp dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x34]
shl ecx, 2
cmp ecx, eax
setge dl
cmp edx, 0x4974
jne 0x10020e23
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
test eax, eax
setg cl
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100227c2
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x100227c2
mov eax, dword [0x1060cc20]
test al, 2
jne 0x10020ee9
or eax, 2
mov dword [0x1060cc20], eax
push ebx
mov dword [ebp - 4], 8
push ebx
mov dword [0x1060cc30], ebx
mov dword [0x1060cc34], ebx
call fcn.10013b65
mov dword [0x1060cc30], eax
mov dword [0x1060cc38], ebx
mov dword [0x1060cc40], ebx
mov byte [ebp - 4], 0xa
mov ecx, 0x1060cc38
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0xf4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x218]
mov dword [0x1060cc4c], 0x3f800000
push eax
mov dword [0x1060cc3c], ebx
call fcn.1001393d
push 0x10064488
mov dword [0x1060cc44], 7
mov dword [0x1060cc48], 8
call fcn.1004d825
pop ecx
mov dword [ebp - 4], edi
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0x24], 0x24a8c6a5
mov dword [ebp - 0x24], 0x1b
jmp 0x10020f62
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bb80]
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0xe4], ebx
push eax
push ebx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe0], ebx
movdqu xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0xdc], ebx
call fcn.10014672
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x28], ebx
inc dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
call fcn.100115eb
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffea
je 0x10020f04
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10020f7c
push 0xe26
call dword [sym.imp.USER32.dll_HideCaret]
lea eax, [ebp - 0x84]
push eax
call fcn.10022911
mov ecx, dword [eax]
mov dword [ebp - 0x24], 0x8a87013d
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10020faa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3ac], 0x40d7f825
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10020f99
push 3
pop edi
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x1002100e
mov dword [ebp - 0x14], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10020fd6
push 0x115a
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], ebx
jmp 0x10021001
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10020fee
push ebx
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10020ffe
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10020fdb
dec dword [ebp - 0x24]
jns 0x10020fbb
mov ecx, dword [ebp - 0x30]
cmp byte [ebp + 0xc], 0
jne 0x1002101c
test ecx, ecx
jne 0x1002204c
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bbb0]
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0xc4], ebx
push eax
push ebx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
movdqu xmmword [ebp - 0x2e8], xmm0
mov dword [ebp - 0xbc], ebx
call fcn.10014672
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x20], 0x1bd97a8
mov dword [ebp - 0x28], 0xe426067
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x100211fc
mov dword [ebp - 0x14], ebx
jmp 0x1002108f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xf2fb5a5e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021081
mov dword [ebp - 0x1c], 0x584d
cmp dword [ebp - 0x1c], 0x5a76
jle 0x100210f5
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
cdq
idiv edi
mov dword [ebp - 0x28], ebx
mov edi, edx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1060ba78
cdq
push edx
push eax
call fcn.1001133e
inc ebx
cmp ebx, 0x717b
jl 0x100210b6
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x24], edi
push 0
pop ebx
cmp edi, 0xc3c
jl 0x100210ae
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x29fd
jl 0x100210a9
push 3
pop edi
mov byte [ebp - 0x15], bl
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x1c], 0x56f5
jge 0x10021138
mov edx, 0x10008c2c
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x10021138
mov dword [ebp - 4], 0xb
cmp byte [ebp - 0x15], 0
je 0x1002115c
push 0x2421
push 0xa2e
push ebx
push 0xf07
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x5c], ebx
jmp 0x100211eb
mov dword [ebp - 0x28], 0x7d413053
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xc36b586f
mov eax, dword [ebp - 0xc4]
sbb ecx, ecx
neg ecx
push 0
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x5c]
pop ecx
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x5c]
cmp ecx, 8
jae 0x100211c0
mov edi, esi
cmp dword [ebp - 0x28], ebx
jne 0x100211c2
mov edi, ebx
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ecx + eax*4]
imul eax, edi
cmp eax, dword [ecx + edx*4]
jle 0x100211e0
mov eax, esi
cmp dword [ebp - 0x5c], ebx
jne 0x100211e2
mov eax, ebx
push 3
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x5c]
pop edi
cmp dword [ebp - 0x5c], edi
jle 0x10021164
dec dword [ebp - 0x20]
jmp 0x10021073
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.100115eb
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x3cc]
mov ecx, dword [ebp - 0x84]
push eax
call fcn.10014b19
mov esi, eax
lea edi, [ebp - 0xd4]
pop ecx
push 2
lea ecx, [ebp - 0x1b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x8edf1feb
mov dword [ebp - 0x24], 0xfffffff8
call fcn.10011569
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0x278]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bb70]
lea ecx, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x1c], 0xfba1a4d6
push eax
mov dword [ebp - 0x28], 0xfffffffc
push ebx
movdqu xmmword [ebp - 0x288], xmm0
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
call fcn.10014672
mov byte [ebp - 4], 0xf
xor esi, esi
mov dword [ebp - 0x44], 0xbe98
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], ebx
jmp 0x100212c1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100212b2
push 4
mov dword [ebp - 0x20], ebx
pop edi
jmp 0x100212e0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x214], 0x837
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100212cf
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x28], 0xfffffff6
ja 0x100212fc
cmp dword [ebp - 0x20c], ebx
jne 0x100212fc
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x214], ebx
je 0x100213cc
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bb90]
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x278]
mov dword [ebp - 0x138], ebx
push eax
push ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x134], ebx
movdqu xmmword [ebp - 0x278], xmm0
mov dword [ebp - 0x130], ebx
call fcn.10014672
push edi
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x10
call fcn.10011569
mov dword [ebp - 0x1c], ebx
jmp 0x10021375
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x264], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10021368
mov dword [ebp - 0x1c], ebx
jmp 0x1002138f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x248]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002137f
mov dword [ebp - 0x1c], ebx
jmp 0x100213a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2b8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10021399
inc dword [ebp - 0x2ac]
lea ecx, [ebp - 0x248]
call fcn.100115eb
lea ecx, [ebp - 0x138]
call fcn.100115eb
jmp 0x10021456
mov dword [ebp - 0x20], 0x4eb9534d
mov dword [ebp - 0x28], 0x2ba2848a
mov dword [ebp - 0x14], 0xc2603458
mov dword [ebp - 0x1c], ebx
jmp 0x1002141b
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
cmp dword [eax + ecx*4 + 4], 0xcfc4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b0]
setge dl
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x24], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100213e6
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], 0xfffffff6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffffe
setne cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xf0]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.100115eb
cmp byte [ebp + 0xc], 0
je 0x10021757
cmp dword [ebp - 0xcc], 0
je 0x10021757
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x1c], 0xfebaeef2
mov dword [ebp - 0x14], 0x3b2c57e7
mov dword [ebp - 0x44], 0x31e468a0
push edi
mov dword [ebp - 0x10c], eax
call fcn.10011569
push 3
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 4], 0x11
call fcn.10011569
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xec71cb27
mov dword [ebp - 0x28], 0xc6bcfb65
mov dword [ebp - 0x20], ebx
jmp 0x100214f5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100214e2
mov dword [ebp - 0x20], ebx
jmp 0x10021512
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], 0x68593f9b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100214ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x10021526
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x1c8]
setge dl
xor ecx, ecx
test edx, edx
setne cl
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x1e0]
mov dword [eax], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, 0x88a01932
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
cmp eax, ecx
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x100215a5
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021731
push 0x1f7d
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x10021731
mov dword [ebp - 0x1c], 0xc8951bb3
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x160], 0xffffffff
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], 0x7acf
cmp dword [ebp - 0x2c], 0x7c05
jle 0x1002167d
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0x201b
mov edi, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], 0x3690
and eax, edi
lea ecx, [ebp - 0x32c]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021627
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x32c]
call fcn.10011ae9
mov eax, dword [ebp - 0x14]
dec edi
dec dword [ebp - 0x44]
jne 0x1002160d
mov edi, dword [ebp - 0x48]
inc edi
mov dword [ebp - 0x48], edi
cmp edi, 0xac0
jl 0x10021603
dec eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
jne 0x100215fe
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x4030
jl 0x100215f4
push 0xace
push 0x1cb0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 4
pop edi
cmp dword [ebp - 0x2c], 0x77c3
jge 0x10021691
push 0x10008ca0
call fcn.1004d84f
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x10021707
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffffa
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
test edx, edx
setle cl
xor edx, edx
cmp ecx, eax
setle dl
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x28], edx
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x1293cb2
cmp ecx, 0xfffffffa
setne dl
xor ecx, ecx
cmp dword [ebp - 0x28], 0xffffffff
setge cl
xor eax, eax
cmp edx, ecx
setne al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x16c]
cmp eax, 6
setg cl
mov dword [ebp - 0x28], ecx
jmp 0x10021731
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1002171b
push 0x1844
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021731
push 0x739
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea ecx, [ebp - 0x1e0]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.100115eb
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x10022049
cmp dword [ebp - 0xd4], ecx
jle 0x10022049
mov dword [ebp - 0x24], 0xc03342eb
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x576c5165
mov dword [ebp - 0x28], 0x8f6c218e
mov dword [ebp - 0x2c], 0x6b17b722
push esi
call fcn.10011569
push edi
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], 0x15
call fcn.10011569
xor edx, edx
mov byte [ebp - 4], 0x16
inc edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x20], ebx
jmp 0x100217d2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100217bf
mov dword [ebp - 0x20], ebx
jmp 0x100217ef
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0xa7209c39
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100217dc
mov dword [ebp - 0x24], 0xe
cmp dword [ebp - 0x24], 0x1b
jge 0x10021a4a
mov dword [ebp - 0x120], 0xaed2
mov dword [ebp - 0x11c], 0xaed2
mov dword [ebp - 0x118], 0xaed2
mov dword [ebp - 0x114], 0xaed2
mov dword [ebp - 0x28], 0x2263
mov dword [ebp - 0x28], 0x8cccddd
mov dword [ebp - 0x18c], 0xc7516a20
mov dword [ebp - 0x188], 0xc7516a20
mov dword [ebp - 0x184], 0xc7516a20
mov dword [ebp - 0x180], 0xc7516a20
mov dword [ebp - 0x2c], 0xbdd7770b
mov dword [ebp - 0x48], 0x53ea3a72
mov dword [ebp - 0x2c], 0x5b2b
cmp dword [ebp - 0x2c], 0x5dbb
jle 0x100218d5
mov eax, ebx
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
mov edi, ebx
mov ecx, edi
shl eax, cl
lea ecx, [ebp - 0x344]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100218a7
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x344]
call fcn.10011ae9
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, 0x5bf7
jl 0x1002188b
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x377c
jl 0x10021889
push 4
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x100218eb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2d8], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100218da
cmp dword [ebp - 0x2c], 0x5749
jge 0x10021904
push 0x10008d08
call fcn.1004d84f
pop ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x3c], 0x5b63
cmp dword [ebp - 0x3c], 0x5f1d
jle 0x10021977
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x45a
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov eax, edi
and eax, ecx
mov ecx, 0x1060ba78
xor eax, ebx
cdq
push edx
push eax
call fcn.1001133e
mov ecx, dword [ebp - 0x2c]
add ecx, esi
dec dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
jne 0x10021931
inc esi
push 0
pop ebx
cmp esi, 0x4d67
jl 0x10021922
inc edi
cmp edi, 0x1054
jl 0x10021920
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x1ccc
jl 0x1002191e
push 4
pop edi
mov eax, dword [ebp - 0x198]
dec dword [eax + 4]
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x3c], 0x5af1
jge 0x100219bd
mov edx, 0x10008d38
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x100219bd
xor edx, edx
mov dword [ebp - 4], 0x16
inc edx
cmp dword [ebp - 0x28], ebx
jne 0x100219d4
cmp dword [ebp - 0x184], ebx
je 0x100219da
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov dword [ebp - 0x2c], 0xe41b
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x2c]
cmp eax, 0x3709
mov eax, dword [ebp - 0x144]
setl cl
sub ecx, dword [eax]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10021a88
mov dword [ebp - 0x14], ebx
jmp 0x10021a22
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10021a11
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x88], ebx
je 0x10021a9a
lea ecx, [ebp - 0x198]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.100115eb
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x2c], 0xedad
mov dword [ebp - 0x20], ebx
jmp 0x10021ab3
mov dword [ebp - 0x28], 0xffff
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
inc dword [ebp - 0x24]
jmp 0x100217fb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x17c], 0x61f6656
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10021aa2
mov dword [ebp - 0x20], ebx
jmp 0x10021ace
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3bc], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10021abd
push 3
mov dword [ebp - 0x170], ebx
pop edi
jmp 0x10021b3e
mov dword [ebp - 0x24], 0x4c405b40
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x10021b38
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x10021b33
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], 0xa831eb23
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021b2b
push ebx
push 0x1d71
push 0xc46
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
inc dword [ebp - 0x2c]
dec dword [ebp - 0x14]
jns 0x10021b02
dec dword [ebp - 0x24]
jns 0x10021aed
inc dword [ebp - 0x170]
cmp dword [ebp - 0x170], edi
jle 0x10021ade
mov dword [ebp - 0x20], 0x77e8edf1
mov dword [ebp - 0x2c], 0x664fb7d4
mov dword [ebp - 0x14], ebx
jmp 0x10021b6a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x260], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021b59
cmp dword [ebp - 0x20], ebx
je 0x10021cd1
mov dword [ebp - 0x3c], 0x28e1
cmp dword [ebp - 0x3c], 0x2b1e
jle 0x10021c01
push 0xe26
call dword [sym.imp.USER32.dll_HideCaret]
xor esi, esi
mov dword [ebp - 0x38], ebx
inc esi
mov ecx, ebx
mov dword [ebp - 0x2c], 0x6b3c
mov dword [ebp - 0x14], ecx
mov edi, ebx
mov eax, edi
or eax, ecx
lea ecx, [ebp - 0x35c]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021bc3
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x35c]
call fcn.10011ae9
mov ecx, dword [ebp - 0x14]
inc edi
cmp edi, 0x1d28
jl 0x10021ba7
mov edi, dword [ebp - 0x38]
add ecx, edi
dec dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
jne 0x10021ba5
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x537c
jl 0x10021b99
push 3
pop edi
jmp 0x10021c04
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x1a4]
call fcn.10011569
cmp dword [ebp - 0x3c], 0x256a
jge 0x10021c24
push 0x10008d80
call fcn.1004d84f
pop ecx
or dword [ebp - 4], 0xffffffff
xor edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], ebx
jmp 0x10021c46
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0xf68029
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10021c33
push 2
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10021cbe
mov dword [ebp - 0x14], ebx
jmp 0x10021c65
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10021c58
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021c82
push 0x646
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor edx, edx
inc edx
mov dword [ebp - 0xac], esi
cmp dword [ebp - 0xac], ebx
jl 0x10021cbb
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x260]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
mov dword [ebp + eax*4 - 0x260], ecx
dec dword [ebp - 0xac]
jns 0x10021c90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10021c53
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x1a4]
jmp 0x10021d90
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x28], 0x840eb449
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], 0xffffffff
push 2
mov dword [ebp - 0x28], 0x8a019320
pop esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0x5b689063
mov dword [ebp - 0x28], 0xffffffff
push esi
call fcn.10011569
push edi
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], 0x1d
call fcn.10011569
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x169ff9e6
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], ebx
jmp 0x10021d5a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], 0x5ba5616d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10021d47
mov dword [ebp - 0x20], ebx
jmp 0x10021d73
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x224]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10021d64
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x224]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.100115eb
mov dword [ebp - 0x20], 0xefe0cd1b
lea ecx, [ebp - 0x23c]
push edi
call fcn.10011569
mov dword [ebp - 0x1c], ebx
jmp 0x10021dbb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10021dad
mov dword [ebp - 0x1c], ebx
jmp 0x10021dd6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x314], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10021dc5
mov dword [ebp - 0x1c], ebx
jmp 0x10021df4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 0xc7e011b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10021de1
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x68], ebx
jne 0x10021e24
mov eax, dword [ebp - 0x68]
xor edx, edx
cmp eax, 0x4b064ba
mov eax, dword [ebp - 0x68]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x6c]
jne 0x10021e24
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10021e29
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 0x68]
xor edx, edx
imul eax, eax, 9
sub ecx, eax
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x68]
cmp edx, 0xe283
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
sub edx, eax
sub edx, 0xfffe
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x71a6e483
sete cl
xor eax, eax
cmp ecx, 0x2edc
setl al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x68]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x10021eaa
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021ea7
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jg 0x10021e94
lea ecx, [ebp - 0x23c]
call fcn.100115eb
mov dword [ebp - 0x28], 0xbeaa32b1
lea ecx, [ebp - 0x1bc]
push edi
call fcn.10011569
mov dword [ebp - 0x14], ebx
jmp 0x10021ee6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], 0x7102d149
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021ed3
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + 8], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021f0e
push ebx
push esi
push 0x1d70
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
lea ecx, [ebp - 0x1bc]
call fcn.100115eb
mov ecx, dword [ebp - 0xd0]
test ecx, ecx
je 0x1002204c
cmp dword [ebp - 0xd4], 0
je 0x1002204c
call fcn.1002059b
mov dword [ebp - 0x24], 0xa5d6c05b
mov dword [ebp - 0x28], 0x320e32cf
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], ebx
jmp 0x10021f60
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x124], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10021f4f
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x2c], 0x360
cmp dword [ebp - 0x2c], 0x523
jle 0x10021fca
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov eax, edi
or eax, ecx
lea ecx, [ebp - 0x38c]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021f9b
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x38c]
call fcn.10011ae9
mov ecx, dword [ebp - 0x14]
inc edi
cmp edi, 0x4b94
jl 0x10021f7f
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x1c79
jl 0x10021f7d
push 3
pop edi
cmp byte [ebp - 0x15], 0
je 0x10021fe3
push ebx
push ebx
push 0x3d5
push 0xae
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
cmp dword [ebp - 0x2c], 0x2b6
jge 0x10021ff7
push 0x10008de4
call fcn.1004d84f
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], esi
jmp 0x10022030
mov dword [ebp - 0x14], 0xeede0b40
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x10022027
mov dword [ebp - 0x28], 0xaa6e6f7f
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x124]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jge 0x10022010
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jge 0x10022000
lea eax, [ebp - 0x84]
push eax
call fcn.10022911
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1002204c
push 3
pop edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x10022068
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002205e
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x70], 0xec75
je 0x1002218c
cmp dword [ebp - 0x70], ebx
je 0x1002218c
mov dword [ebp - 0x14], 0x589b
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x24], 0x82f
mov dword [ebp - 0x2c], 0x5a527720
mov dword [ebp - 0x1c], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100220c9
push 0x1844
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x78]
cmp eax, 0x637b
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setg dl
sub edx, 0x353e
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jg 0x10022138
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1002213a
mov eax, esi
cmp eax, dword [ebp - 0x14]
jle 0x10022142
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], ebx
je 0x10022181
cmp dword [ebp - 0x38], ebx
je 0x10022181
mov dword [ebp - 0x2c], 0xd65fe96f
inc dword [ebp - 0x2c]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100222b5
push ebx
push 0x785
push 0x119c
push 0x25dd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
jmp 0x100222b5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x100222b5
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bba0]
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x24], 0xf61ca727
push eax
mov dword [ebp - 0x2c], 9
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x3c], ebx
push ebx
movdqu xmmword [ebp - 0x2f8], xmm0
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
call fcn.10014672
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x100221f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100221e4
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x78]
cmp eax, edx
mov eax, dword [ebp - 0x58]
setge cl
imul eax, ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], ebx
je 0x10022221
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x78]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
jne 0x1002223a
cmp dword [ebp - 0x58], ebx
je 0x1002223c
mov edx, ebx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x24]
setge cl
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 6
setne al
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x730
mov eax, dword [ebp - 0x100]
setle dl
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x78]
cmp eax, edx
mov eax, dword [ebp - 0x58]
setne cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
cmp dword [ebp - 0x28], eax
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x100]
call fcn.100115eb
xor esi, esi
inc esi
lea ecx, [ebp - 0xd4]
call fcn.1001c81b
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x15c]
push esi
call fcn.10011569
mov dword [ebp - 0x14], ebx
jmp 0x100222e7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0x2ba39464
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100222d4
cmp dword [ebp - 0x1c], ebx
je 0x10022397
mov dword [ebp - 0x24], 0xadf1
mov dword [ebp - 0x28], 0xeda8ed40
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x1c], ebx
jmp 0x1002234d
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10022340
mov dword [ebp - 0x20], 0xa622a149
dec dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
jmp 0x10022338
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022335
call dword [sym.imp.USER32.dll_ReleaseCapture]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10022326
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10022317
cmp dword [ebp - 0x24], ebx
jne 0x10022352
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002230f
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub esi, 0xcf13
mov eax, dword [ebp - 0x15c]
neg esi
sbb esi, esi
add esi, 0xc593632d
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp dword [eax], ecx
setg dl
xor eax, eax
cmp esi, edx
setne al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
setle cl
xor esi, esi
mov dword [ebp - 0x2c], ecx
inc esi
jmp 0x100223ca
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100223ad
push ebx
push 0x690
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x1c], ebx
jmp 0x100223c5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0x405cefd0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100223b2
lea ecx, [ebp - 0x15c]
call fcn.100115eb
cmp dword [ebp - 0x40], 0
jne 0x100227c2
cmp dword [ebp - 0x30], 0
je 0x100227c2
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bbf0]
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0xa0], ebx
push eax
push ebx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x9c], ebx
movdqu xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x98], ebx
call fcn.10014672
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x28], 0xbee07f09
mov dword [ebp - 0x14], ebx
jmp 0x10022449
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], 0x68ec0ae9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002243b
mov dword [ebp - 0x80], ebx
cmp dword [ebp - 0x80], 0xfffffff7
jle 0x1002277c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffff4
jl 0x10022655
mov dword [ebp - 0x20], 0xf47a6d
mov dword [ebp - 0x20], 0xfffffff8
cmp dword [ebp - 0x20], 0xffffffee
jl 0x1002264d
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x1b69
cmp dword [ebp - 0x28], 0x1d6d
jle 0x100224cf
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov eax, edi
mov ecx, 0x1060ba78
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1001133e
inc ebx
cmp ebx, 0x698b
jl 0x100224a6
inc edi
push 0
pop ebx
cmp edi, 0x2edc
jl 0x100224a3
mov dword [ebp - 0x24], 8
cmp dword [ebp - 0x24], 0xffffffe4
jl 0x100225fe
mov dword [ebp - 0x44], 0x20de
cmp dword [ebp - 0x44], 0x2369
jle 0x10022586
push ebx
push 0x1375
push 0x13c8
push 0x37f
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x48], 0x79c0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0x1822
xor eax, ecx
lea ecx, [ebp - 0x374]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022541
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x374]
call fcn.10011ae9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
inc eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
jne 0x10022527
mov eax, dword [ebp - 0x3c]
add eax, edi
dec dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
jne 0x1002251d
inc edi
cmp edi, 0x61b4
jl 0x10022511
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x6b50
jl 0x1002250f
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x44], 0x1df8
jge 0x1002259d
push 0x10008e54
call fcn.1004d84f
pop ecx
mov dword [ebp - 4], 0x20
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x40]
cmp eax, 4
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
dec edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jge 0x100225d5
mov eax, esi
cmp dword [ebp - 0x40], ebx
jne 0x100225d7
mov eax, ebx
cmp eax, dword [ebp - 0x20]
jl 0x100225e3
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x100225e5
mov eax, esi
mov ecx, 0xfffa
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x24]
jmp 0x100224d6
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x28], 0x18df
jge 0x1002263b
mov edx, 0x10008e40
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x1002263b
push 3
mov dword [ebp - 4], 0x20
dec dword [ebp - 0x20]
pop edi
jmp 0x1002247d
dec dword [ebp - 0x1c]
jmp 0x10022465
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jg 0x10022771
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2c], eax
push edi
lea ecx, [ebp - 0x1d4]
call fcn.10011569
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x14], ebx
jmp 0x10022691
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10022682
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x1d4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x2c]
mov dword [edx + 8], eax
cmp eax, dword [ecx + 0xc]
jl 0x100226eb
cmp dword [ebp - 0x1c], ebx
jne 0x100226bf
mov eax, ebx
cmp dword [ebp - 0x80], ebx
je 0x100226c1
mov eax, esi
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa0]
add edx, 0x24a2dd00
imul edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
mov eax, ebx
setne cl
cmp ecx, dword [ebp - 0x80]
jge 0x100226ed
mov eax, esi
add eax, 0xf51dd87f
jne 0x100226fb
mov eax, ebx
cmp dword [ebp - 0x80], ebx
je 0x100226fd
mov eax, esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x80]
add edx, eax
mov eax, dword [ebp - 0xa0]
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x80]
neg edx
sbb edx, edx
inc edx
imul eax, edx
test eax, eax
jne 0x10022729
mov eax, dword [ebp - 0xa0]
cmp dword [eax], ebx
mov eax, ebx
je 0x1002272b
mov eax, esi
mov esi, dword [ebp - 0x1c]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xa0]
sbb eax, eax
inc eax
push 0
cmp eax, dword [ecx + edx*4]
pop edx
setne dl
xor eax, eax
add edx, 0x4938e877
cmp dword [ecx + esi*4], edx
lea ecx, [ebp - 0x1d4]
setle al
mov dword [ebp - 0x28], eax
call fcn.100115eb
inc dword [ebp - 0x1c]
push 1
pop esi
cmp dword [ebp - 0x1c], edi
jle 0x1002266a
dec dword [ebp - 0x80]
xor esi, esi
inc esi
jmp 0x10022452
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022792
push 0x1c5c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.100115eb
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x30]
call fcn.10020687
mov esi, eax
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0x110], esi
call fcn.100228af
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x110]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret