Function at 0x1000df75
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Delete directory
Delete file
Encrypt data using speck
Get common file path
Get graphical window text
Log keystrokes via polling
Query environment variable
Query or enumerate registry key
Suspend thread

Disassembly:
mov eax, 0x10064d27
call fcn.10064730
sub esp, 0x988
push ebx
push esi
push edi
mov dword [ebp - 0x54], 0xffffffff
xor edi, edi
mov dword [ebp - 0x48], 0x930509b9
inc edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x44], 0x55dbfe6b
mov dword [ebp - 0x54], 0xe
cmp dword [ebp - 0x54], 0xffffffea
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x6c], dl
mov dword [ebp - 0x60], ecx
jl 0x1000e086
mov esi, 0xfff9
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1000dfdd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setg dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
je 0x1000e016
mov edx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1000e018
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xfecafe8
setle al
xor ecx, ecx
cmp eax, 0xc769
mov eax, dword [ebp - 0x1c]
setge cl
sub ecx, 0xf5d1cc0c
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x67dc
setg cl
xor eax, eax
cmp ecx, 0x7baa9d70
setne al
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffea
jge 0x1000dfc4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x48], 0x3e2a
cmp dword [ebp - 0x48], 0x3f6b
jle 0x1000e0ed
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x8bc]
or eax, esi
cdq
push edx
push eax
call fcn.1000defa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e0c3
mov eax, dword [eax]
push eax
call fcn.1004f7a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8bc]
call fcn.1001b817
inc edi
cmp edi, 0x4ae9
jl 0x1000e0a7
inc esi
cmp esi, 0x320d
jl 0x1000e0a5
xor edi, edi
inc edi
mov dword [ebp - 0x38], 0x930509b9
cmp dword [ebp - 0x48], 0x3c94
jge 0x1000e108
push 0x10007670
call fcn.1004f7a6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x44], 0x55dbfe6b
mov dword [ebp - 0x54], 0xe
cmp dword [ebp - 0x54], 0xffffffea
jl 0x1000e1ee
mov esi, 0xfff9
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1000e145
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setg dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
je 0x1000e17e
mov edx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1000e180
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xfecafe8
setle al
xor ecx, ecx
cmp eax, 0xc769
mov eax, dword [ebp - 0x1c]
setge cl
sub ecx, 0xf5d1cc0c
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x67dc
setg cl
xor eax, eax
cmp ecx, 0x7baa9d70
setne al
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffea
jge 0x1000e12c
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], 0xa7f4ea14
push edi
call fcn.1001b3c7
push 4
mov dword [ebp - 0x1c], ebx
pop esi
jmp 0x1000e220
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], 0xc59cdc34
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000e20f
mov dword [ebp - 0x1c], ebx
jmp 0x1000e23d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c8]
mov dword [eax + ecx*4], 0x8a6ebbfa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000e22a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e252
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x48], eax
je 0x1000e290
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x4c8]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x4c8]
call fcn.1001b449
mov dword [ebp - 0x48], 0xac70c309
lea ecx, [ebp - 0x480]
push 2
call fcn.1001b3c7
mov dword [ebp - 0x44], 0x7b4bc662
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x14], ebx
jmp 0x1000e2fc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e2e9
mov ecx, edi
cmp dword [ebp - 0x48], ebx
jne 0x1000e30b
mov ecx, ebx
mov eax, dword [ebp - 0x480]
mov dword [eax], ecx
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e335
push 0xb77
push ebx
push 0xf8a
push 0xb1
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [ebp - 0x480]
call fcn.1001b449
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1000e3ba
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x468]
push esi
call fcn.1001b3c7
mov dword [ebp - 0x14], ebx
jmp 0x1000e37d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0x87f2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000e36a
mov dword [ebp - 0x4c], 0x2afe01bd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], ebx
jmp 0x1000e3a7
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x1000e394
lea ecx, [ebp - 0x468]
call fcn.1001b449
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jle 0x1000e356
mov dword [ebp - 0x48], 0x930509b9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x51e
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x1000e3ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], 0x3bc6e5c7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000e3dd
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x12
jge 0x1000e4a7
lea eax, [ebp - 0x4e4]
lea ecx, [ebp - 0x4d4]
movdqa xmm0, xmmword [0x1000caa0]
push ecx
push ecx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x550]
mov dword [ebp - 0x44], 0x276b87d0
push eax
movdqu xmmword [ebp - 0x4e4], xmm0
call fcn.1001b423
mov dword [ebp - 0x20], 0xf44401d1
mov dword [ebp - 0x20], 0xacee6178
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x550]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xbc]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e483
push 0x1628
push 0x2217
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
lea ecx, [ebp - 0x550]
call fcn.1001b449
inc dword [ebp - 0x14]
lea eax, [ebp - 0x4e4]
cmp dword [ebp - 0x14], 0x12
lea ecx, [ebp - 0x4d4]
jl 0x1000e40c
mov dword [ebp - 0x1c], ebx
jmp 0x1000e4ea
mov dword [ebp - 0x4c], ebx
jmp 0x1000e4c4
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e4c1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x1000e4b1
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
mov dword [ebp + eax*4 - 0xbc], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000e4ac
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 0xa8ea
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e509
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e51e
push ebx
push 0x2393
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov dword [ebp - 0x44], 0x55dbfe6b
lea ecx, [ebp - 0x170]
push esi
call fcn.1001b3c7
mov dword [ebp - 0x14], 0xfebaeef2
mov dword [ebp - 0x48], 0x208af066
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
push 3
pop esi
jge 0x1000e55f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000e54a
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1000e67f
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], 0xe2294bb4
mov dword [ebp - 0x44], 0x763c6daa
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1000e61d
mov dword [ebp - 0x24], 0x63f9e923
mov dword [ebp - 0x24], ebx
jmp 0x1000e5bf
mov dword [ebp - 0x4c], 0xd8f6efba
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x4c], ebx
jl 0x1000e5bc
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000e5b7
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
dec dword [ebp - 0x4c]
jns 0x1000e5a7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000e598
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x170]
push 3
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x170]
sub eax, 0x819d3388
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x170]
sete dl
xor ecx, ecx
pop esi
cmp dword [eax + edi*4], edx
setne cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x1c]
jns 0x1000e58c
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], esi
jg 0x1000e673
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setl dl
imul ecx, edx, 0xf0bb9a68
xor edx, edx
push 3
cmp ecx, eax
mov eax, dword [ebp - 0x170]
setge dl
xor ebx, ebx
cmp edx, dword [eax + esi*4]
mov eax, dword [ebp - 0x44]
setge bl
xor ecx, ecx
cmp ebx, eax
pop esi
setl cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jle 0x1000e625
xor ebx, ebx
dec dword [ebp - 0x14]
jns 0x1000e56b
xor edi, edi
inc edi
lea ecx, [ebp - 0x170]
call fcn.1001b449
mov dword [ebp - 0x54], 0xe
jmp 0x1000e857
push edi
lea ecx, [ebp - 0x324]
call fcn.1001b3c7
mov dword [ebp - 0x1c], ebx
jmp 0x1000e6b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x760], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000e6a7
mov dword [ebp - 0x1c], ebx
jmp 0x1000e6d2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x324]
mov dword [eax + ecx*4], 0x622ba394
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000e6bf
mov ecx, dword [ebp - 0x324]
mov dword [ecx], ebx
mov eax, dword [ecx]
inc dword [ecx]
cmp dword [ecx], 4
mov dword [ebp + eax*4 - 0x760], 0xffffffff
jl 0x1000e6df
lea ecx, [ebp - 0x324]
call fcn.1001b449
mov dword [ebp - 0x1c], 9
push 2
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], 0x7e17f759
mov dword [ebp - 0x34], 0xa8628405
mov dword [ebp - 0x14], ebx
jmp 0x1000e72b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000e71e
cmp dword [ebp - 0x44], ebx
je 0x1000e75b
mov dword [ebp - 0x14], ebx
jmp 0x1000e74b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60c], 0x43cdf98a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000e73a
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x14], eax
jmp 0x1000e7a1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], edi
jmp 0x1000e79b
mov dword [ebp - 0x30], 0xfffffffb
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x30]
neg edx
mov dword [ebp - 0x704], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jge 0x1000e767
mov dword [ebp - 0x44], 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1000e7b3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setg dl
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
je 0x1000e7ec
mov edx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1000e7ee
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xfecafe8
setle al
xor ecx, ecx
cmp eax, 0xc769
mov eax, dword [ebp - 0x1c]
setge cl
sub ecx, 0xf5d1cc0c
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x67dc
setg cl
xor eax, eax
cmp ecx, 0x7baa9d70
mov ecx, 0xfff9
setne al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffea
jge 0x1000e696
mov dword [ebp - 0x50], 0x711d
cmp dword [ebp - 0x50], 0x7411
jle 0x1000e8fe
mov dword [ebp - 0x3c], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov eax, edi
mov dword [ebp - 0x48], 0x4494
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov esi, ebx
mov ecx, esi
sar eax, cl
lea ecx, [ebp - 0x7c0]
xor eax, edi
cdq
push edx
push eax
call fcn.1000defa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e8ac
mov eax, dword [eax]
push eax
call fcn.1004f7a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7c0]
call fcn.1001b817
mov eax, dword [ebp - 0x30]
inc esi
cmp esi, 0x3ad0
jl 0x1000e88e
dec eax
dec dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
jne 0x1000e88c
mov edi, dword [ebp - 0x38]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x7bf3
jl 0x1000e87d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x5cc3
jl 0x1000e878
push 0x1435
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x50], 0x6f8f
jge 0x1000e912
push 0x10007698
call fcn.1004f7a6
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x1c], 0xa9ac70c3
mov dword [ebp - 0x28], 0xad816f93
push 3
call fcn.1001b3c7
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], 0x2be76dcb
mov dword [ebp - 0x14], ebx
jmp 0x1000e953
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1b8]
mov dword [eax + ecx*4], 0xf7626a9d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e940
mov eax, dword [ebp - 0x28]
xor edi, edi
mov eax, dword [ebp - 0x28]
inc edi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], 0xffff1d3b
mov eax, edi
cmp dword [ebp - 0x4c], ebx
jne 0x1000e984
mov eax, ebx
mov esi, dword [ebp - 0x1b8]
xor ecx, ecx
cmp eax, dword [esi + 8]
setge cl
xor eax, eax
cmp ecx, dword [esi]
setge al
xor edx, edx
cmp eax, dword [esi + 4]
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xfe8b0d19
jae 0x1000e9bf
cmp dword [ebp - 0x4c], ebx
jne 0x1000e9bf
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1b8]
mov dword [eax], edi
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec eax
jne 0x1000e9d7
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x1000e9d9
mov eax, edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], edi
jmp 0x1000ea09
mov eax, dword [ebp - 0x1b8]
cmp dword [eax], ebx
jne 0x1000ea0f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ea06
push ebx
push ebx
push 0x1d6d
push 0x1bec
call dword [sym.imp.USER32.dll_DefWindowProcA]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x33
je 0x1000e9e1
lea ecx, [ebp - 0x1b8]
call fcn.1001b449
mov eax, dword [ebp - 0x2c]
mov ecx, 0xb110c93b
mov dword [ebp - 0x2c], eax
mov edx, 0x3e63e315
mov dword [ebp - 0x14], ecx
mov esi, 0xa149cec7
mov dword [ebp - 0x20], edi
push 8
mov dword [ebp - 0x48], edx
pop eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
jmp 0x1000ea57
mov dword [ebp - 0x20], 0x59c1
mov dword [ebp - 0x20], 0xc3fbb4eb
dec dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
je 0x1000ea43
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
jmp 0x1000ea82
mov dword [ebp - 0x20], 0x59c1
mov dword [ebp - 0x20], 0xc3fbb4eb
dec dword [ebp - 0x48]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
je 0x1000ea6e
mov dword [ebp - 0x14], 0xfffffffc
mov esi, 0x46a1c17c
mov dword [ebp - 0x20], 6
mov eax, 0x1006c5cc
mov dword [ebp - 0x20], 0x9ce4562
mov dword [ebp - 0x20], 0x1bc7dcd6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
push 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], 0xfffffff5
pop esi
cmp dword [ebp - 0x14], 0xffffffe3
je 0x1000eb8a
push 2
lea ecx, [ebp - 0x33c]
call fcn.1001b3c7
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x20], 0x11738ab6
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0x48c443eb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x20], edi
push edi
call fcn.1001b3c7
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x48], 0x5e21
mov dword [ebp - 0x1c], ebx
jmp 0x1000eb43
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x33c]
mov dword [eax + ecx*4], 0x3eb9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000eb30
mov dword [ebp - 0x1c], ebx
jmp 0x1000eb5d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x42c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000eb4e
inc dword [ebp - 0x48]
lea ecx, [ebp - 0x42c]
cmp dword [ebp - 0x44], ebx
call fcn.1001b449
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.1001b449
dec dword [ebp - 0x14]
jmp 0x1000ead9
mov dword [ebp - 0x24], edi
mov eax, 0x6edad94e
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x20], 0x7a73d2d6
mov dword [ebp - 0x20], 0x8bd4dfbd
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], 0xac46ddcd
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x24], ebx
jmp 0x1000ec6b
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x20], 0xc5021c3a
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x20], 0xd95da228
mov dword [ebp - 0x14], 0x7b7f609b
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], 0x9d73df2e
mov dword [ebp - 0x20], 0x66d8ff8c
call fcn.1001b3c7
mov dword [ebp - 0x14], ebx
jmp 0x1000ec39
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4b0]
mov dword [eax + ecx*4], 0x5d177cce
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ec26
mov eax, dword [ebp - 0x4b0]
dec dword [eax]
mov dword [ebp - 0x14], ebx
jmp 0x1000ec57
cmp dword [ebp - 0x44], ebx
jne 0x1000ec5d
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jle 0x1000ec4c
lea ecx, [ebp - 0x4b0]
call fcn.1001b449
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
push 2
jle 0x1000ebdb
mov eax, 0x61928c17
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x1c], edi
call fcn.1001b3c7
mov dword [ebp - 4], 5
mov dword [ebp - 0x44], 0x22abf7c2
mov dword [ebp - 0x20], 0xbdf11caf
mov dword [ebp - 0x20], 0x8491f199
mov dword [ebp - 0x1c], ebx
jmp 0x1000ecd6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d0]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000ecc3
mov dword [ebp - 0x1c], ebx
jmp 0x1000ecee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7fc], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000ece1
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1000ed2a
mov dword [ebp - 0x14], ebx
jmp 0x1000ed16
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x778], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000ed05
mov dword [ebp - 0x770], 0x6580849f
dec dword [ebp - 0x1c]
jns 0x1000ed00
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, edi
mov eax, dword [ebp - 0x1d0]
setg cl
cmp ecx, dword [eax]
jle 0x1000ed4c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1c], eax
jne 0x1000ee56
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x20], 9
push edi
call fcn.1001b3c7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x30], 0xdeb47635
push esi
call fcn.1001b3c7
mov dword [ebp - 0x1c], ebx
jmp 0x1000edb4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5f0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000eda4
mov dword [ebp - 0x1c], ebx
jmp 0x1000edd1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x354]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000edbe
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffff
sbb eax, eax
inc eax
cmp dword [ebp - 0x48], eax
jg 0x1000ee25
mov eax, dword [ebp - 0x1d0]
mov edx, dword [eax]
mov eax, dword [ebp - 0x354]
sub edx, dword [eax]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, edi
sete cl
sub ecx, 0x8e0e
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x38], ecx
jle 0x1000ee27
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ee3e
push 0x12ef
call dword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [ebp - 0x354]
call fcn.1001b449
lea ecx, [ebp - 0x5f0]
call fcn.1001b449
jmp 0x1000ee70
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ee70
push 0xc84
push ebx
push 0xd9d
call dword [sym.imp.USER32.dll_GetWindowTextW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.1001b449
mov dword [ebp - 0x14], 0xb110c93b
mov eax, 0x61928c17
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x14], ebx
jmp 0x1000eebc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000eeab
mov dword [ebp - 0x84], ebx
jmp 0x1000eef6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000eef0
push 0x1501
push ebx
push ebx
push ebx
push ebx
push 0x102
push 0xf62
push 0x589
call dword [sym.imp.USER32.dll_ScrollWindowEx]
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], 3
jle 0x1000eec9
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x84], eax
dec eax
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x34], 0x3e63e315
mov dword [ebp - 0x20], 0xa149cec7
mov dword [ebp - 0x28], 0xd5e48d32
mov dword [ebp - 0x20], 0x325423b1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], 0xfffffffd
jl 0x1000f33b
push edi
lea ecx, [ebp - 0x130]
call fcn.1001b3c7
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x3c], edi
push edi
call fcn.1001b3c7
mov byte [ebp - 4], 8
mov dword [ebp - 0x2c], ebx
jmp 0x1000ef7e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x140], 0x5683c8fc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1000ef6d
mov dword [ebp - 0x2c], ebx
jmp 0x1000ef9c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xee7d214c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000ef89
mov dword [ebp - 0x2c], ebx
jmp 0x1000efb9
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 0x720725fc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000efa6
mov eax, dword [ebp - 0x130]
mov dword [eax], edi
cmp dword [eax], ebx
jl 0x1000f319
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x58], 0x32f1efae
mov dword [ebp - 0x2c], 0xb01197ba
mov dword [ebp - 0x68], 0xa0c2010
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], edi
jg 0x1000f30c
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x44], 0x87ea82bc
mov dword [ebp - 0x44], 0x8f15ea37
mov dword [ebp - 0x44], 0xc394a737
mov dword [ebp - 0x48], 0x4cad7069
mov dword [ebp - 0x14], 0xf2b
cmp dword [ebp - 0x14], 0xfcd
jle 0x1000f0a2
push edi
push ebx
push 0xd85
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov ecx, edi
mov esi, ebx
shl eax, cl
mov dword [ebp - 0x50], eax
mov ecx, ebx
mov dword [ebp - 0x38], 0x5069
mov dword [ebp - 0x48], ecx
sar eax, cl
mov ecx, 0x1060df18
cdq
push edx
push eax
call fcn.1001b196
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
add ecx, esi
dec dword [ebp - 0x38]
mov dword [ebp - 0x48], ecx
jne 0x1000f051
inc esi
cmp esi, 0x31b7
jl 0x1000f045
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x3a5d
jl 0x1000f03c
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x57fd
jl 0x1000f03a
push ebx
push 0x96b
push ebx
push 0xac1
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x14], 0xc9f
jge 0x1000f0e2
mov edx, 0x100076f0
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1000f0e2
mov dword [ebp - 4], 8
mov dword [ebp - 0x38], 0x7b02
cmp dword [ebp - 0x38], 0x7dba
jle 0x1000f127
mov esi, ebx
mov dword [ebp - 0x48], ebx
mov edi, esi
mov esi, 0x1e63
mov eax, edi
mov ecx, 0x1060df18
cdq
push edx
push eax
call fcn.1001b196
dec edi
dec esi
jne 0x1000f105
mov esi, dword [ebp - 0x48]
inc esi
mov dword [ebp - 0x48], esi
cmp esi, 0x305d
jl 0x1000f0fe
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x140], ecx
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x38], 0x78d7
jge 0x1000f180
mov edx, 0x10007770
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1000f180
mov dword [ebp - 4], 8
mov edi, 0xfff9
mov dword [ebp - 0x14], ebx
jmp 0x1000f2f7
push 2
lea ecx, [ebp - 0x1e8]
call fcn.1001b3c7
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x44], 0xac012777
mov dword [ebp - 0x4c], ebx
jmp 0x1000f1ce
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1e8]
mov dword [eax + ecx*4], 0xc12265e3
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jl 0x1000f1bb
mov esi, dword [ebp - 0x1e8]
mov dword [esi], 1
mov dword [ebp - 0x30], 0x3edb
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x140]
sub eax, ecx
jne 0x1000f20d
cmp dword [ebp - 0x3c], ebx
jne 0x1000f20d
mov eax, ebx
jmp 0x1000f210
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x40]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x30]
setne dl
xor eax, eax
cmp edx, 0x4102
setl al
imul ecx, dword [ebp - 0x40]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff6
setg al
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x240]
setge cl
xor edx, edx
mov dword [eax], ecx
cmp ecx, dword [esi + 4]
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1e8]
setg cl
mov edx, dword [eax]
mov eax, dword [ebp - 0x3c]
sub edx, ecx
sub edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x1c], ebx
je 0x1000f2a7
cmp dword [ebp - 0x44], ebx
jne 0x1000f299
mov eax, dword [ebp - 0x130]
cmp dword [eax], ebx
jne 0x1000f299
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x240]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
sub eax, 0xffff
neg eax
sbb eax, eax
inc eax
inc eax
jne 0x1000f2c9
cmp dword [ebp - 0x30], ebx
jne 0x1000f2c9
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1e8]
dec dword [eax]
jns 0x1000f1e0
cmp dword [ebp - 0x14], 1
jle 0x1000f194
inc dword [ebp - 0x24]
xor edi, edi
inc edi
jmp 0x1000eff0
mov eax, dword [ebp - 0x130]
dec dword [eax]
jmp 0x1000efc6
lea ecx, [ebp - 0x240]
call fcn.1001b449
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1001b449
dec dword [ebp - 0x28]
jmp 0x1000ef38
mov dword [ebp - 0x14], 8
jmp 0x1000f40b
push 3
lea ecx, [ebp - 0x444]
call fcn.1001b3c7
mov dword [ebp - 0x1c], ebx
jmp 0x1000f36c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x444]
mov dword [eax + ecx*4], 0x540d7f82
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000f359
mov dword [ebp - 0x1c], ebx
jmp 0x1000f381
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000f377
mov dword [ebp - 0x78], ebx
jmp 0x1000f39e
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x444]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 3
jl 0x1000f38b
lea ecx, [ebp - 0x444]
call fcn.1001b449
mov dword [ebp - 0x20], 0x59c1
mov dword [ebp - 0x20], 0xc3fbb4eb
mov dword [ebp - 0x20], 0xf0ea
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000f3df
push ebx
push 0xe32
push ebx
push 0xca7
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000f405
push ebx
push 0x2484
push ebx
push 0x78d
push 0x24d9
push ebx
push 0x9ac
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
dec dword [ebp - 0x34]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
je 0x1000f347
movdqa xmm0, xmmword [0x1000ca70]
lea ecx, [ebp - 0x6d8]
push ecx
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x2c], edi
push eax
push ecx
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x4c], 4
movdqu xmmword [ebp - 0x6d8], xmm0
call fcn.1001b423
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x20], 0x50d5
mov dword [ebp - 0x48], 0x1dec7435
mov dword [ebp - 0x2c], 0xffffffea
cmp dword [ebp - 0x2c], 3
jl 0x1000f689
mov dword [ebp - 0x14], 0x152c58fb
mov dword [ebp - 0x30], 0x9642
mov dword [ebp - 0x20], 0x653ffd03
mov dword [ebp - 0x34], 0xfcce
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ebx
je 0x1000f4a3
mov eax, dword [ebp - 0x2c]
mov edx, edi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
jmp 0x1000f4a5
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
add ecx, 9
cmp ecx, 0x2fafd11d
setge al
cmp dword [ebp - 0x14], eax
jl 0x1000f4c5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x1000f55c
mov dword [ebp - 0x24], 0xa6b9
xor edx, edx
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x2c]
jne 0x1000f4fb
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1000f4fd
mov eax, edi
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
sub ecx, 0x617405f8
mov esi, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
sub esi, edx
add esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp esi, eax
setle cl
test ecx, ecx
jle 0x1000f52c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x36c]
neg ecx
sub ecx, 0xfffffff9
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
pop eax
setne al
mov dword [ebp - 0x20], eax
jmp 0x1000f66a
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x40], 0x15f5
cmp dword [ebp - 0x40], 0x17ba
jle 0x1000f5ec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, edi
mov dword [ebp - 0x20], eax
mov edi, eax
mov esi, ebx
sar edi, cl
mov eax, esi
lea ecx, [ebp - 0x97c]
or eax, edi
cdq
push edx
push eax
call fcn.1000defa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f5a6
mov eax, dword [eax]
push eax
call fcn.1004f7a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x97c]
call fcn.1001b817
inc esi
cmp esi, 0x5802
jl 0x1000f58a
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x49f8
jl 0x1000f57f
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x31fa
jl 0x1000f57a
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
inc edi
cmp dword [ebp - 0x48], ebx
jne 0x1000f689
cmp dword [ebp - 0x40], 0x14b2
jge 0x1000f609
push 0x100077f0
call fcn.1004f7a6
pop ecx
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x36c]
mov dword [eax + 0xc], ecx
lea eax, [ecx + 1]
test eax, eax
je 0x1000f62c
mov dword [ebp - 0x20], 0xedc29bfb
jmp 0x1000f66a
push edi
lea ecx, [ebp - 0x24c]
call fcn.1001b3c7
mov dword [ebp - 0x14], ebx
jmp 0x1000f650
cmp dword [ebp - 0x14], edi
jl 0x1000f63d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000f67c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.1001b449
mov dword [ebp - 0x14], 0xfffffffc
mov esi, 0x46a1c17c
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], 0x9ce4562
mov dword [ebp - 0x20], 0x1bc7dcd6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x14], 0xfffffff5
jmp 0x1000f786
push 2
lea ecx, [ebp - 0x384]
call fcn.1001b3c7
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x20], 0x11738ab6
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0x48c443eb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x58], edi
push edi
call fcn.1001b3c7
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x34], 0x5e21
mov dword [ebp - 0x1c], ebx
jmp 0x1000f744
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x384]
mov dword [eax + ecx*4], 0x3eb9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000f731
mov dword [ebp - 0x1c], ebx
jmp 0x1000f75e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000f74f
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x498]
cmp dword [ebp - 0x20], ebx
call fcn.1001b449
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.1001b449
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x1000f6e0
push 3
lea ecx, [ebp - 0x45c]
call fcn.1001b3c7
push 4
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 4], 0x11
call fcn.1001b3c7
mov dword [ebp - 0x1c], ebx
jmp 0x1000f7c9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x45c]
mov dword [eax + ecx*4], 0x7571177e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000f7b6
mov dword [ebp - 0x1c], ebx
jmp 0x1000f7e3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5a4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000f7d4
mov eax, dword [ebp - 0x45c]
lea ecx, [ebp - 0x5a4]
mov dword [eax + 8], ebx
call fcn.1001b449
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.1001b449
mov dword [ebp - 0x40], 0x6710
cmp dword [ebp - 0x40], 0x67ad
jle 0x1000f869