Function at 0x1001d1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008275f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
mov dword [ebp - 0x274], 0x97e780ca
mov dword [ebp - 0x374], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x11c], 0x3631e19e
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x18], 0
jmp 0x1001d23d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001d253
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0], 0xfffffffc
jmp 0x1001d236
mov dword [ebp - 0x18], 0
jmp 0x1001d263
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001d279
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x23c], 0x58bdfadf
jmp 0x1001d25c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
add eax, dword [ebp - 0xbc]
je 0x1001d300
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xe0], 0
jb 0x1001d2c9
mov dword [ebp - 0x158], 1
jmp 0x1001d2d0
and dword [ebp - 0x158], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
add eax, dword [ebp - 0x158]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x23c]
test eax, eax
je 0x1001d300
mov dword [ebp - 0x218], 1
jmp 0x1001d307
and dword [ebp - 0x218], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x218]
add ecx, 0x2fc4eb
cmp dword [ebp + eax - 0xe0], ecx
jge 0x1001d33b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x23c], 0
jne 0x1001d33b
and dword [ebp - 0x2c4], 0
jmp 0x1001d345
mov dword [ebp - 0x2c4], 1
cmp dword [ebp - 0x10], 0
jne 0x1001d35b
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001d35b
and dword [ebp - 0x224], 0
jmp 0x1001d365
mov dword [ebp - 0x224], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe0]
cmp dword [ebp - 0x224], eax
jne 0x1001d385
mov dword [ebp - 0x1f4], 1
jmp 0x1001d38c
and dword [ebp - 0x1f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp + eax - 0x23c], ecx
mov dword [ebp - 0x10], 0
jmp 0x1001d3af
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1001d523
mov dword [ebp - 0x21c], 0x289ed5b6
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x1001d3dd
push 0x95e
push 0
call fcn.100201c4
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe0]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x23c]
cmp dword [ebp + eax*4 - 0xe0], ecx
je 0x1001d40f
mov dword [ebp - 0x210], 1
jmp 0x1001d416
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe0]
cmp dword [ebp - 0x210], eax
jle 0x1001d434
mov dword [ebp - 0x1b4], 1
jmp 0x1001d43b
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe0]
add eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0xe0]
jge 0x1001d463
mov dword [ebp - 0x114], 1
jmp 0x1001d46a
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x114], eax
jg 0x1001d481
mov dword [ebp - 0x1ac], 1
jmp 0x1001d488
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 7
jae 0x1001d4b5
mov dword [ebp - 0x124], 1
jmp 0x1001d4bc
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x23c]
add eax, dword [ebp - 0x124]
je 0x1001d4e3
mov eax, 0x52ad14ca
test eax, eax
je 0x1001d4e3
mov dword [ebp - 0x12c], 1
jmp 0x1001d4ea
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x12c]
jge 0x1001d504
mov dword [ebp - 0x1fc], 1
jmp 0x1001d50b
and dword [ebp - 0x1fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + eax - 0x23c], ecx
jmp 0x1001d3a8
push 2
lea ecx, [ebp - 0x2d0]
call fcn.10018cbc
and dword [ebp - 4], 0
mov dword [ebp - 0x48], 0xdf2f4a8b
push 0x3e7f
lea eax, [ebp - 0x2d0]
push eax
push 0x7247
lea eax, [ebp - 0x388]
push eax
push 0x16be
push 1
push 0x1eb7
call fcn.1001cf6b
add esp, 0x1c
mov dword [ebp - 0x48], 0
jmp 0x1001d577
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x1001d5a9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2d0]
call fcn.10018d20
cmp dword [eax], 0
je 0x1001d592
jmp 0x1001d5a9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2d0]
call fcn.10018d20
cmp dword [eax], 0
je 0x1001d5a7
jmp 0x1001d5a9
jmp 0x1001d570
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.10018d1b
lea eax, [ebp - 0x220]
push eax
push 0x78a
push 0x56e2
push 0
call fcn.1001d168
add esp, 0x10
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0xb4], 0
jmp 0x1001d5fa
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x1001d616
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x104], 0xe57ad95e
jmp 0x1001d5ed
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x104], 0xc204e2db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x104]
cmp eax, 0xfffffff7
je 0x1001d653
mov dword [ebp - 0x134], 1
jmp 0x1001d65a
and dword [ebp - 0x134], 0
imul eax, dword [ebp - 0x134], 0x6baf
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x104]
jl 0x1001d829
mov dword [ebp - 0xd4], 0x361a
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x1cc], 0x6a5b5cf0
mov dword [ebp - 0xa0], 0
jmp 0x1001d6b1
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001d6cd
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x364], 0xcadfb1af
jmp 0x1001d6a4
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x28], 0xffff
mov eax, dword [ebp - 0x28]
neg eax
mov ecx, dword [ebp - 0xd4]
sub ecx, eax
mov dword [ebp - 0x1bc], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp + eax - 0x364], ecx
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1bc], eax
je 0x1001d720
mov dword [ebp - 0x13c], 1
jmp 0x1001d727
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
imul eax, dword [ebp - 0x13c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x104]
je 0x1001d755
mov dword [ebp - 0x228], 1
jmp 0x1001d75c
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xb90f
jne 0x1001d774
mov dword [ebp - 0x144], 1
jmp 0x1001d77b
and dword [ebp - 0x144], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x144], eax
jle 0x1001d79c
mov dword [ebp - 0x1c4], 1
jmp 0x1001d7a3
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x14c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x14c], eax
je 0x1001d7d0
mov dword [ebp - 0x204], 1
jmp 0x1001d7d7
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
imul eax, dword [ebp - 0x204]
cmp eax, 0xffff
jae 0x1001d7fe
mov dword [ebp - 0x154], 1
jmp 0x1001d805
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1cc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp + eax - 0x104], ecx
jmp 0x1001db25
mov dword [ebp - 0xa8], 0xdee94ccb
mov dword [ebp - 0x78], 0x5e3970c0
mov dword [ebp - 0x90], 0x744fa755
cmp dword [ebp - 0xa8], 0xfff9
je 0x1001d85c
mov dword [ebp - 0x15c], 1
jmp 0x1001d863
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x15c], eax
jle 0x1001d880
mov eax, 0xdcfe
test eax, eax
jne 0x1001d880
and dword [ebp - 0xc8], 0
jmp 0x1001d88a
mov dword [ebp - 0xc8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp + eax - 0x104], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xc8], eax
jg 0x1001d8b4
mov dword [ebp - 0x230], 1
jmp 0x1001d8bb
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x28]
neg eax
cmp eax, dword [ebp - 0x90]
jne 0x1001d8e0
mov dword [ebp - 0x27c], 1
jmp 0x1001d8e7
and dword [ebp - 0x27c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x28], eax
jl 0x1001d905
mov dword [ebp - 0x164], 1
jmp 0x1001d90c
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0
ja 0x1001d921
mov dword [ebp - 0x1d4], 1
jmp 0x1001d928
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x1d4], eax
jg 0x1001d93f
mov dword [ebp - 0x16c], 1
jmp 0x1001d946
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x16c], eax
je 0x1001d95d
mov dword [ebp - 0x20c], 1
jmp 0x1001d964
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
sub eax, 0xd0294e
cmp eax, dword [ebp - 0x6c]
jg 0x1001d980
mov dword [ebp - 0x174], 1
jmp 0x1001d987
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jae 0x1001d9a2
mov dword [ebp - 0x284], 1
jmp 0x1001d9a9
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x6c]
je 0x1001d9cc
mov dword [ebp - 0x1dc], 1
jmp 0x1001d9d3
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x1dc]
jle 0x1001d9ed
mov dword [ebp - 0x28c], 1
jmp 0x1001d9f4
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x6c], 0
je 0x1001db05
mov dword [ebp - 0x88], 0
jmp 0x1001da17
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1001da33
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x324], 0x6abe
jmp 0x1001da0a
cmp dword [ebp - 0xa8], 0
je 0x1001daec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0x4b5a
jle 0x1001da5f
mov dword [ebp - 0x22c], 1
jmp 0x1001da66
and dword [ebp - 0x22c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x324]
mov dword [ebp - 0x3a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
cmp dword [ebp + eax - 0x324], ecx
je 0x1001da96
mov dword [ebp - 0x294], 1
jmp 0x1001da9d
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3a8], eax
mov eax, 0x6db78960
test eax, eax
ja 0x1001dabb
mov dword [ebp - 0x17c], 1
jmp 0x1001dac2
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x17c]
test eax, eax
jne 0x1001dae5
cmp dword [ebp - 0x78], 0
je 0x1001dae5
mov dword [ebp - 0x184], 1
jmp 0x1001daec
and dword [ebp - 0x184], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x324], 0xaf71
mov dword [ebp - 0x90], eax
jmp 0x1001db25
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x1001db25
push 1
push 0x5b48
push 0x2303
call fcn.1001d049
add esp, 0xc
cmp dword [ebp - 0x220], 0
je 0x1001ebe4
mov dword [ebp - 0x3b0], 0x47dfa860
mov dword [ebp - 0x3b8], 0xffffffff
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3c8], 1
mov dword [ebp - 0xb0], 2
mov dword [ebp - 0x3d0], 0
push 3
lea ecx, [ebp - 0x318]
call fcn.10018cbc
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], 0xca420452
push 0x5a94
lea eax, [ebp - 0x3d8]
push eax
push 0
lea eax, [ebp - 0x318]
push eax
push 0x638a
call fcn.1001ff19
add esp, 0x14
push 0
push 0x4197
push 0x14dd
lea eax, [ebp - 0x50]
push eax
push 0xdec
call fcn.1002076c
add esp, 0x14
mov dword [ebp - 0x50], 0
jmp 0x1001dbd8
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1001dc37
mov dword [ebp - 0xb0], 2
jmp 0x1001dbf7
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1001dc35
push dword [ebp - 0x50]
lea ecx, [ebp - 0x318]
call fcn.10018d20
cmp dword [eax], 0
je 0x1001dc15
jmp 0x1001dc35
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1001dc33
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001dbea
jmp 0x1001dbd1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x318]
call fcn.10018d1b
push dword [ebp + 8]
lea ecx, [ebp - 0x33c]
call fcn.10018a71
mov dword [ebp - 4], 2
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x3e0], 0xfffffffa
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x400], 0x5e3d1aa1
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x3f8], 0xffffffff
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x3bc], 0x99da9727
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x3e4], 0x4d8142c7
mov dword [ebp - 0x2a0], 0x67c8
mov dword [ebp - 0x20], 0
jmp 0x1001dcd9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001dcef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x260], 8
jmp 0x1001dcd2
mov dword [ebp - 0x20], 0
jmp 0x1001dcff
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1001dd15
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x420], 0xbbfad0d7
jmp 0x1001dcf8
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1001dd2f
push 1
push 0x525f
call fcn.1001d0b2
pop ecx
pop ecx
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x260], 0
jmp 0x1001dd5a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x260]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x260], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x260], 0x17
jl 0x1001df23
mov dword [ebp - 0xe4], 0x3ccd2466
mov dword [ebp - 0xb8], 0
jmp 0x1001dd90
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1001dda9
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x64], 0xe1d925b0
jmp 0x1001dd83
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x64], 0
jmp 0x1001ddce
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x64], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0xfffffff1
jg 0x1001df08
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], 0
jmp 0x1001ddf6
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffec
jne 0x1001df03
mov dword [ebp - 0x19c], 0xf5b1b6fd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x260], 0
je 0x1001de1e
jmp 0x1001df03
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0x19c], eax
jl 0x1001de3e
mov dword [ebp - 0x1e4], 1
jmp 0x1001de45
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xe4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp eax, dword [ebp - 0xe4]
jg 0x1001de6f
mov dword [ebp - 0x264], 1
jmp 0x1001de76
and dword [ebp - 0x264], 0
mov dword [ebp - 0x18c], 0x5fe4
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c4], eax
xor eax, eax
inc eax
je 0x1001deaf
cmp dword [ebp - 0xe4], 0
je 0x1001deaf
mov dword [ebp - 0x214], 1
jmp 0x1001deb6
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x214]
jle 0x1001decd
mov dword [ebp - 0x194], 1
jmp 0x1001ded4
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x194], eax
jne 0x1001deeb
mov dword [ebp - 0x1ec], 1
jmp 0x1001def2
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x19c], eax
jmp 0x1001ddef
jmp 0x1001ddb9
push 0x4831
lea eax, [ebp - 0x2a0]
push eax
push 0
call fcn.1001f78a
add esp, 0xc
jmp 0x1001dd41
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x33c]
call fcn.1001928f
push dword [eax]
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x33c]
call fcn.100192a3
push dword [eax]
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x33c]
call fcn.1001928f
push dword [eax]
mov edx, 0x1001c8f5
lea ecx, [ebp - 0x3cc]
call fcn.1002898c
add esp, 0xc
mov eax, dword [ebp - 0x220]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 0x1a4], eax
and dword [ebp - 0xcc], 0
mov dword [ebp - 0x9c], 0xf6af1124
mov dword [ebp - 0x9c], 0
jmp 0x1001dfae
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffee
jg 0x1001dfea
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x1001dfd1
push 0x1fdc
push 0
call fcn.1001f27c
pop ecx
pop ecx
mov byte [ebp - 0x39], 0
push 0
push 0x74a9
lea eax, [ebp - 0x39]
push eax
call fcn.1001ef91
add esp, 0xc
jmp 0x1001dfa1
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
jmp 0x1001e008
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x1a4]
je 0x1001ebd5
mov dword [ebp - 0x4c], 0x6579763
mov dword [ebp - 0x14], 0x94543beb
cmp dword [ebp - 0x4c], 0
je 0x1001e14d
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x1001e04c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x18
jle 0x1001e14b
mov dword [ebp - 0x26c], 0xd89e1771
push 3
lea ecx, [ebp - 0x30c]
call fcn.10018cbc
mov byte [ebp - 4], 3
mov dword [ebp - 0xac], 0
jmp 0x1001e08a
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1001e0ac
push dword [ebp - 0xac]
lea ecx, [ebp - 0x30c]
call fcn.10018d20
mov dword [eax], 9
jmp 0x1001e07d
mov dword [ebp - 0x14], 0x4696a485
mov dword [ebp - 0x14], 0
jmp 0x1001e0c3
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff8
jg 0x1001e137
mov dword [ebp - 0x74], 0xa0734f09
mov dword [ebp - 0x74], 0
jmp 0x1001e0e0
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff8
je 0x1001e135
mov dword [ebp - 0x2b8], 0x6887e0
mov dword [ebp - 0x270], 0x888a
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.1001f5b7
add esp, 0x24
jmp 0x1001e0d9
jmp 0x1001e0bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30c]
call fcn.10018d1b
jmp 0x1001e045
jmp 0x1001e199
mov dword [ebp - 0x7c], 0
jmp 0x1001e15d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1001e173
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2b0], 0
jmp 0x1001e156
mov dword [ebp - 0x14], 0
jmp 0x1001e183
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1001e199
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2b0], 2
jmp 0x1001e17c
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x54], 0
jmp 0x1001e1c6
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffb
jl 0x1001e4a9
push 2
lea ecx, [ebp - 0x254]
call fcn.10018cbc
mov byte [ebp - 4], 4
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10018cbc
mov byte [ebp - 4], 5
lea eax, [ebp - 0x254]
push eax
push 1
lea eax, [ebp - 0x5c]
push eax
call fcn.1001d0e4
add esp, 0xc
mov dword [ebp - 0x5c], 0
jmp 0x1001e217
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1001e230
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2f4]
call fcn.10018d20
and dword [eax], 0
jmp 0x1001e210
push 1
lea ecx, [ebp - 0x254]
call fcn.10018d20
and dword [eax], 0
jmp 0x1001e266
push 1
lea ecx, [ebp - 0x254]
call fcn.10018d20
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x254]
call fcn.10018d20
cmp dword [eax], 4
jle 0x1001e486
mov dword [ebp - 0x38], 0x9949dfcf
mov dword [ebp - 0x280], 9
mov dword [ebp - 0x110], 1
push 3
lea ecx, [ebp - 0x2dc]
call fcn.10018cbc
mov byte [ebp - 4], 6
push 0
lea eax, [ebp - 0x2dc]
push eax
push 0x17c7
lea eax, [ebp - 0x394]
push eax
call fcn.1001fd46
add esp, 0x10
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x1001e2e7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x38], 0
jmp 0x1001e2f7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
jge 0x1001e472
mov dword [ebp - 0x40], 0x8abc106e
mov dword [ebp - 0x2a4], 0xffffffff
cmp dword [ebp - 0x38], 0
je 0x1001e31d
jmp 0x1001e472
mov dword [ebp - 0x40], 2
jmp 0x1001e32d
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001e46d
mov dword [ebp - 0x288], 0x1f3403ca
mov dword [ebp - 0x29c], 0xd574417f
push 0
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.1001f9ce
add esp, 0x2c
push 1
lea ecx, [ebp - 0x254]
call fcn.10018d20
cmp dword [eax], 0
jne 0x1001e434
push 2
lea ecx, [ebp - 0x2dc]
call fcn.10018d20
cmp dword [eax], 0x4f5c6f0d
jg 0x1001e3c9
mov dword [ebp - 0x118], 1
jmp 0x1001e3d0
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x118]
neg ecx
cmp eax, ecx
jle 0x1001e3f2
mov dword [ebp - 0x120], 1
jmp 0x1001e3f9
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x120], eax
jle 0x1001e416
cmp dword [ebp - 0x2a4], 0
jne 0x1001e416
and dword [ebp - 0x128], 0
jmp 0x1001e420
mov dword [ebp - 0x128], 1
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x128]
jl 0x1001e434
and dword [ebp - 0x130], 0
jmp 0x1001e43e
mov dword [ebp - 0x130], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x130], eax
jge 0x1001e455
mov dword [ebp - 0x138], 1
jmp 0x1001e45c
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
jmp 0x1001e326
jmp 0x1001e2f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2dc]
call fcn.10018d1b
jmp 0x1001e242
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2f4]
call fcn.10018d1b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x254]
call fcn.10018d1b
jmp 0x1001e1bf
mov eax, dword [ebp - 0xcc]
push dword [eax + 0x28]
lea ecx, [ebp - 0x354]
call fcn.100285bd
mov byte [ebp - 4], 7
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x354]
call fcn.1001928f
push dword [eax]
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x354]
call fcn.100192a3
push dword [eax]
lea eax, [ebp - 0x3d4]
push eax
lea ecx, [ebp - 0x354]
call fcn.1001928f
push dword [eax]
mov edx, 0x1001c8f5
lea ecx, [ebp - 0x3a4]
call fcn.1002898c
add esp, 0xc
mov dword [ebp - 0x150], 0x8e5ccc90
push 3
lea ecx, [ebp - 0x2e8]
call fcn.10018cbc
mov byte [ebp - 4], 8
mov dword [ebp - 0x290], 0xa4bedcc5
mov dword [ebp - 0x298], 0xfffffffc
push 0x1085
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x2e8]
push eax
push 1
call fcn.1001d168
add esp, 0x10
mov dword [ebp - 0x60], 0
jmp 0x1001e569
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1001e57f
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2ac], 0xfffffffe
jmp 0x1001e562
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x3f0], eax
push 0
lea ecx, [ebp - 0x2e8]
call fcn.10018d20
cmp dword [eax], 0
jne 0x1001e5b8
push 0
lea ecx, [ebp - 0x2e8]
call fcn.10018d20
cmp dword [eax], 0
jne 0x1001e5b8
and dword [ebp - 0x148], 0
jmp 0x1001e5c2
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x148], eax
jle 0x1001e5dc
mov dword [ebp - 0x108], 1
jmp 0x1001e5e3
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x108]
je 0x1001e5fd
mov dword [ebp - 0xd0], 1
jmp 0x1001e604
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x2ac], ecx
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2e8]
call fcn.10018d1b
lea edx, [ebp - 0x354]
lea ecx, [ebp - 0x33c]
call fcn.100289f5
movzx eax, al
test eax, eax
je 0x1001ebc1
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x94], 0
jmp 0x1001e675
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1001e691
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xf4], 0xe57ad95e
jmp 0x1001e668
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf4], 0xc204e2db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0xf4]
cmp eax, 0xfffffff7
je 0x1001e6ce
mov dword [ebp - 0x160], 1
jmp 0x1001e6d5
and dword [ebp - 0x160], 0
imul eax, dword [ebp - 0x160], 0x6baf
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0xf4]
jl 0x1001e8a4
mov dword [ebp - 0xc0], 0x361a
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x1a8], 0x6a5b5cf0
mov dword [ebp - 0x98], 0
jmp 0x1001e72c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1001e748
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x370], 0xcadfb1af
jmp 0x1001e71f
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x24], 0xffff
mov eax, dword [ebp - 0x24]
neg eax
mov ecx, dword [ebp - 0xc0]
sub ecx, eax
mov dword [ebp - 0x168], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp + eax - 0x370], ecx
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x168], eax
je 0x1001e79b
mov dword [ebp - 0x170], 1
jmp 0x1001e7a2
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
imul eax, dword [ebp - 0x170]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xf4]
je 0x1001e7d0
mov dword [ebp - 0x178], 1
jmp 0x1001e7d7
and dword [ebp - 0x178], 0
cmp dword [ebp - 0x178], 0xb90f
jne 0x1001e7ef
mov dword [ebp - 0x180], 1
jmp 0x1001e7f6
and dword [ebp - 0x180], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x180], eax
jle 0x1001e817
mov dword [ebp - 0x188], 1
jmp 0x1001e81e
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x190], eax
je 0x1001e84b
mov dword [ebp - 0x198], 1
jmp 0x1001e852
and dword [ebp - 0x198], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
imul eax, dword [ebp - 0x198]
cmp eax, 0xffff
jae 0x1001e879
mov dword [ebp - 0x1a0], 1
jmp 0x1001e880
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp + eax - 0xf4], ecx
jmp 0x1001eb82
mov dword [ebp - 0x84], 0xdee94ccb
mov dword [ebp - 0x68], 0x5e3970c0
mov dword [ebp - 0x8c], 0x744fa755
cmp dword [ebp - 0x84], 0xfff9
je 0x1001e8d7
mov dword [ebp - 0x1b0], 1
jmp 0x1001e8de
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1b0], eax
jle 0x1001e8fb
mov eax, 0xdcfe
test eax, eax
jne 0x1001e8fb
and dword [ebp - 0xc4], 0
jmp 0x1001e905
mov dword [ebp - 0xc4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc4]
mov dword [ebp + eax - 0xf4], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xc4], eax
jg 0x1001e92f
mov dword [ebp - 0x1b8], 1
jmp 0x1001e936
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x24]
neg eax
cmp eax, dword [ebp - 0x8c]
jne 0x1001e95b
mov dword [ebp - 0x2b4], 1
jmp 0x1001e962
and dword [ebp - 0x2b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x24], eax
jl 0x1001e980
mov dword [ebp - 0x1c0], 1
jmp 0x1001e987
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0
ja 0x1001e99c
mov dword [ebp - 0x1c8], 1
jmp 0x1001e9a3
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1c8], eax
jg 0x1001e9ba
mov dword [ebp - 0x1d0], 1
jmp 0x1001e9c1
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x1d0], eax
je 0x1001e9d8
mov dword [ebp - 0x1d8], 1
jmp 0x1001e9df
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1d8]
sub eax, 0xd0294e
cmp eax, dword [ebp - 0x58]
jg 0x1001e9fb
mov dword [ebp - 0x1e0], 1
jmp 0x1001ea02
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jae 0x1001ea1d
mov dword [ebp - 0x2bc], 1
jmp 0x1001ea24
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
je 0x1001ea47
mov dword [ebp - 0x1e8], 1
jmp 0x1001ea4e
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x1e8]
jle 0x1001ea68
mov dword [ebp - 0x2c0], 1
jmp 0x1001ea6f
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x58], 0
je 0x1001eb71
mov dword [ebp - 0x80], 0
jmp 0x1001ea89
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1001ea9f
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x300], 0x6abe
jmp 0x1001ea82
cmp dword [ebp - 0x84], 0
je 0x1001eb58
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0x4b5a
jle 0x1001eacb
mov dword [ebp - 0x1f8], 1
jmp 0x1001ead2
and dword [ebp - 0x1f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x300]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68]
cmp dword [ebp + eax - 0x300], ecx
je 0x1001eb02
mov dword [ebp - 0x2a8], 1
jmp 0x1001eb09
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x35c], eax
mov eax, 0x6db78960
test eax, eax
ja 0x1001eb27
mov dword [ebp - 0x1f0], 1
jmp 0x1001eb2e
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x1f0]
test eax, eax
jne 0x1001eb51
cmp dword [ebp - 0x68], 0
je 0x1001eb51
mov dword [ebp - 0x200], 1
jmp 0x1001eb58
and dword [ebp - 0x200], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x300], 0xaf71
mov dword [ebp - 0x8c], eax
jmp 0x1001eb82
mov byte [ebp - 0x2a], 0
lea eax, [ebp - 0x2a]
push eax
push 0
call fcn.1001fe36
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx + eax + 0x10]
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x354]
call fcn.10018af6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.10018af6
mov eax, dword [ebp - 0x268]
jmp 0x1001eced
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x354]
call fcn.10018af6
jmp 0x1001dffa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.10018af6
push 3
lea ecx, [ebp - 0x248]
call fcn.10018cbc
mov dword [ebp - 4], 9
mov dword [ebp - 0x1c], 0
jmp 0x1001ec08
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1001ec1e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x410], 0xc93b4e1
jmp 0x1001ec01
mov dword [ebp - 0x1c], 0
jmp 0x1001ec2e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001ec4a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x248]
call fcn.10018d20
mov dword [eax], 0x4643cdf9
jmp 0x1001ec27
push 0
lea ecx, [ebp - 0x248]
call fcn.10018d20
and dword [eax], 0
jmp 0x1001ec80
push 0
lea ecx, [ebp - 0x248]
call fcn.10018d20
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x208]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.10018d20
cmp dword [eax], 3
jg 0x1001ecdc
mov dword [ebp - 0x70], 0xfbb4ebb0
mov dword [ebp - 0x70], 0
jmp 0x1001eca9
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1001ecbf
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x410], 0x8ce3e63e
jmp 0x1001eca2
push 0
lea ecx, [ebp - 0x248]
call fcn.10018d20
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x410], 0
je 0x1001ecda
jmp 0x1001ecdc
jmp 0x1001ec5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10018d1b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret