Function at 0x10008cc9
Capabilities:
Accept command line arguments
Get disk size
Identify system language via api
Modify service
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079856
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1258
call fcn.100759f0
push esi
push edi
mov dword [ebp - 0x32c], 0xfffffff9
mov dword [ebp - 0xf58], 0xfffffff8
mov dword [ebp - 0xad0], 1
mov dword [ebp - 0xd64], 0xe704f3d4
mov dword [ebp - 0xd6c], 0xfffffffe
mov dword [ebp - 0xd74], 6
mov dword [ebp - 0xdcc], 1
mov dword [ebp - 0xdd4], 0
mov dword [ebp - 0xddc], 1
mov dword [ebp - 0xde4], 0xffffffff
mov dword [ebp - 0xac8], 0x9dc86695
mov dword [ebp - 0xdec], 0xf9a4d91f
mov dword [ebp - 0xad8], 9
mov dword [ebp - 0xdf4], 0xfffffff9
mov dword [ebp - 0xdfc], 0x89be67e7
mov dword [ebp - 0xe04], 0x33c8a0c0
mov dword [ebp - 0xe0c], 0xfffffffa
mov dword [ebp - 0xe14], 0x52783de7
mov dword [ebp - 0xab8], 0xffeac8e4
mov dword [ebp - 0xae0], 0
mov dword [ebp - 0xb4], 0
jmp 0x10008dce
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10008dea
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xeb4], 0xd7f825e7
jmp 0x10008dc1
mov dword [ebp - 0xb4], 0
jmp 0x10008e03
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10008e1f
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1168], 0xfffffff7
jmp 0x10008df6
mov dword [ebp - 0x32c], 2
jmp 0x10008e38
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jl 0x10009072
mov dword [ebp - 0x1bc], 0xb3b9da4d
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0xac0], 0x57257ea0
mov dword [ebp - 0xe24], 0xfffffffc
mov dword [ebp - 0x1090], 0xfffffffb
mov dword [ebp - 0x108c], 0xfffffffb
mov dword [ebp - 0x1088], 0xfffffffb
mov dword [ebp - 0x1084], 0xfffffffb
mov dword [ebp - 0xe2c], 0xfffffff6
mov dword [ebp - 0x1bc], 0
jmp 0x10008eb8
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10008ed4
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xeb4], 0x3ff82ff4
jmp 0x10008eab
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xeb4], 0
je 0x10008f86
mov dword [ebp - 0xe34], 0x135e1f6f
mov dword [ebp - 0xe3c], 0xffffffff
mov dword [ebp - 0xe44], 0x32456160
push 1
lea ecx, [ebp - 0xec4]
call fcn.100164e9
and dword [ebp - 4], 0
mov dword [ebp - 0xe4c], 0
mov dword [ebp - 0x53c], 9
mov dword [ebp - 0x234], 0
jmp 0x10008f43
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x10008f65
push dword [ebp - 0x234]
lea ecx, [ebp - 0xec4]
call fcn.10016587
mov dword [eax], 0xc2184e5a
jmp 0x10008f36
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec4]
call fcn.1001656b
jmp 0x1000906d
mov dword [ebp - 0x9a8], 0x9ce07b88
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xac0]
lea eax, [eax + ecx - 0x6ae0e500]
cmp eax, dword [ebp - 0xac8]
jg 0x10008fc3
mov dword [ebp - 0x954], 1
jmp 0x10008fca
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0x954]
jl 0x10008fe4
mov dword [ebp - 0x95c], 1
jmp 0x10008feb
and dword [ebp - 0x95c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1168]
cmp dword [ebp - 0x95c], eax
jle 0x1000900b
mov dword [ebp - 0x964], 1
jmp 0x10009012
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
sub eax, dword [ebp - 0xad8]
cmp dword [ebp - 0x1bc], eax
jg 0x10009032
mov dword [ebp - 0x94c], 1
jmp 0x10009039
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
shl eax, 2
cmp eax, 0x6ca241e2
jl 0x10009055
mov dword [ebp - 0x3f8], 1
jmp 0x1000905c
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
sub eax, 0x996d
mov dword [ebp - 0xae0], eax
jmp 0x10008e2b
mov dword [ebp - 0x2b4], 0xfffffff9
mov dword [ebp - 0xe5c], 0xfffffff8
mov dword [ebp - 0xa88], 1
mov dword [ebp - 0xe64], 0xe704f3d4
mov dword [ebp - 0xe6c], 0xfffffffe
mov dword [ebp - 0xe74], 6
mov dword [ebp - 0xe7c], 1
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0xe94], 0xffffffff
mov dword [ebp - 0x9a0], 0x9dc86695
mov dword [ebp - 0xe9c], 0xf9a4d91f
mov dword [ebp - 0x990], 9
mov dword [ebp - 0xea4], 0xfffffff9
mov dword [ebp - 0x10fc], 0x89be67e7
mov dword [ebp - 0x1104], 0x33c8a0c0
mov dword [ebp - 0x110c], 0xfffffffa
mov dword [ebp - 0x1114], 0x52783de7
mov dword [ebp - 0xab0], 0xffeac8e4
mov dword [ebp - 0xabc], 0
mov dword [ebp - 0x50], 0
jmp 0x1000914a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10009160
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xed4], 0xd7f825e7
jmp 0x10009143
mov dword [ebp - 0x50], 0
jmp 0x10009170
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10009186
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x118c], 0xfffffff7
jmp 0x10009169
mov dword [ebp - 0x2b4], 2
jmp 0x1000919f
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jl 0x100093dc
mov dword [ebp - 0x178], 0xb3b9da4d
mov dword [ebp - 0x111c], 1
mov dword [ebp - 0x9e4], 0x57257ea0
mov dword [ebp - 0x1124], 0xfffffffc
mov dword [ebp - 0x10a4], 0xfffffffb
mov dword [ebp - 0x10a0], 0xfffffffb
mov dword [ebp - 0x109c], 0xfffffffb
mov dword [ebp - 0x1098], 0xfffffffb
mov dword [ebp - 0x112c], 0xfffffff6
mov dword [ebp - 0x178], 0
jmp 0x1000921f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x1000923b
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xed4], 0x3ff82ff4
jmp 0x10009212
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed4], 0
je 0x100092f0
mov dword [ebp - 0x1128], 0x135e1f6f
mov dword [ebp - 0x1060], 0xffffffff
mov dword [ebp - 0xd80], 0x32456160
push 1
lea ecx, [ebp - 0xee4]
call fcn.100164e9
mov dword [ebp - 4], 1
mov dword [ebp - 0xeb8], 0
mov dword [ebp - 0x6b4], 9
mov dword [ebp - 0x23c], 0
jmp 0x100092ad
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x100092cf
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xee4]
call fcn.10016587
mov dword [eax], 0xc2184e5a
jmp 0x100092a0
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.1001656b
jmp 0x100093d7
mov dword [ebp - 0xae8], 0x9ce07b88
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0x9e4]
lea eax, [eax + ecx - 0x6ae0e500]
cmp eax, dword [ebp - 0x9a0]
jg 0x1000932d
mov dword [ebp - 0x400], 1
jmp 0x10009334
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0x400]
jl 0x1000934e
mov dword [ebp - 0x6b8], 1
jmp 0x10009355
and dword [ebp - 0x6b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x118c]
cmp dword [ebp - 0x6b8], eax
jle 0x10009375
mov dword [ebp - 0x408], 1
jmp 0x1000937c
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
sub eax, dword [ebp - 0x990]
cmp dword [ebp - 0x178], eax
jg 0x1000939c
mov dword [ebp - 0x810], 1
jmp 0x100093a3
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
shl eax, 2
cmp eax, 0x6ca241e2
jl 0x100093bf
mov dword [ebp - 0x410], 1
jmp 0x100093c6
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
sub eax, 0x996d
mov dword [ebp - 0xabc], eax
jmp 0x10009192
mov dword [ebp - 0x94], 0xfffffffd
mov dword [ebp - 0x244], 0xfffffffa
mov dword [ebp - 0xa74], 0xef33
mov dword [ebp - 0x2f4], 0
jmp 0x10009413
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1000942f
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x11a4], 0xcd546735
jmp 0x10009406
cmp dword [ebp - 0x94], 0x1124f01c
jg 0x1000963d
mov dword [ebp - 0x430], 0x78d8
mov dword [ebp - 0x94], 0
jmp 0x10009462
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xd
jne 0x1000949d
mov dword [ebp - 0x9b0], 0x1249
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000948f
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x244], eax
jmp 0x10009455
cmp dword [ebp - 0x430], 1
jle 0x100094b2
mov dword [ebp - 0x360], 1
jmp 0x100094b9
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x360]
mov dword [ebp + eax - 0x11a4], ecx
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x360], eax
jl 0x100094e6
mov dword [ebp - 0x6c0], 1
jmp 0x100094ed
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0xfffffffe
jne 0x10009502
mov dword [ebp - 0x418], 1
jmp 0x10009509
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x418], eax
jne 0x10009523
mov dword [ebp - 0x918], 1
jmp 0x1000952a
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x918]
jge 0x10009544
mov dword [ebp - 0x420], 1
jmp 0x1000954b
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xd714f98c
je 0x10009563
mov dword [ebp - 0x6c8], 1
jmp 0x1000956a
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x6c8]
je 0x10009584
mov dword [ebp - 0x428], 1
jmp 0x1000958b
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x428], eax
jg 0x100095a5
mov dword [ebp - 0x818], 1
jmp 0x100095ac
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x818]
jl 0x100095c6
mov dword [ebp - 0x6d0], 1
jmp 0x100095cd
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x6d0], eax
jge 0x100095e7
mov dword [ebp - 0x438], 1
jmp 0x100095ee
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 1
jne 0x10009603
mov dword [ebp - 0x8c8], 1
jmp 0x1000960a
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x8c8], 0xf6a0
jg 0x10009622
mov dword [ebp - 0x440], 1
jmp 0x10009629
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xa74]
add eax, dword [ebp - 0x440]
mov dword [ebp - 0x244], eax
jmp 0x10009655
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10009655
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 0x10c], 0x40d7f825
mov dword [ebp - 0xc14], 6
mov dword [ebp - 0xc10], 6
mov dword [ebp - 0xc0c], 6
mov dword [ebp - 0xc08], 6
lea ecx, [ebp - 0x385]
call fcn.10008b13
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0x11c4]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf14]
call fcn.10016545
mov dword [ebp - 4], 2
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x1d8], 0xf69a0165
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x10009706
push 0
push 0x588
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov dword [ebp - 0x10c], 0
jmp 0x1000971f
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1d
jne 0x10009c26
mov dword [ebp - 0xbec], 0x772304b2
mov dword [ebp - 0xbe8], 0x772304b2
mov dword [ebp - 0xbe4], 0x772304b2
mov dword [ebp - 0xbe0], 0x772304b2
lea ecx, [ebp - 0x33d]
call fcn.10008b13
push eax
lea eax, [ebp - 0xbdc]
push eax
lea eax, [ebp - 0xbec]
push eax
lea ecx, [ebp - 0x124c]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x974]
call fcn.10016545
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x448], 0x81eca6c8
push 2
lea ecx, [ebp - 0xf04]
call fcn.100164e9
mov byte [ebp - 4], 4
mov dword [ebp - 0x2bc], 0
jmp 0x100097c8
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 2
jge 0x100097ea
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xf04]
call fcn.10016587
mov dword [eax], 7
jmp 0x100097bb
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x10009814
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x20], 0
jmp 0x10009824
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10009c03
mov dword [ebp - 0x1b8], 0xa445a8cc
mov dword [ebp - 0x106c], 0x58e9d28b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10016587
cmp dword [eax], 0xec21
jne 0x10009864
mov dword [ebp - 0x6d8], 1
jmp 0x1000986b
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x448], eax
jl 0x10009894
mov dword [ebp - 0x820], 1
jmp 0x1000989b
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x820]
add eax, ecx
cmp eax, dword [ebp - 0x20]
jne 0x100098be
mov dword [ebp - 0x450], 1
jmp 0x100098c5
and dword [ebp - 0x450], 0
push 1
lea ecx, [ebp - 0x974]
call fcn.10016587
mov eax, dword [eax]
cmp eax, dword [ebp - 0x450]
jl 0x100098e8
mov dword [ebp - 0x6e0], 1
jmp 0x100098ef
and dword [ebp - 0x6e0], 0
push 1
lea ecx, [ebp - 0x974]
call fcn.10016587
mov ecx, dword [ebp - 0x6e0]
add ecx, dword [eax]
cmp ecx, 0xfffffffd
je 0x10009915
mov dword [ebp - 0x458], 1
jmp 0x1000991c
and dword [ebp - 0x458], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10016587
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10016587
mov ecx, dword [esi]
add ecx, dword [eax]
imul eax, dword [ebp - 0x458], 0x2b4b
cmp ecx, eax
je 0x10009958
mov dword [ebp - 0x958], 1
jmp 0x1000995f
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b8], 3
jmp 0x10009984
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x10009bfe
mov dword [ebp - 0x39c], 0xd28e4879
mov dword [ebp - 0x6e8], 0xa0c09020
mov dword [ebp - 0x218], 0x3de76903
mov dword [ebp - 0xce0], 0x5c8bb6af
cmp dword [ebp - 0x10c], 0
je 0x10009a1f
cmp dword [ebp - 0x20], 0
je 0x100099dd
cmp dword [ebp - 0x39c], 0
je 0x100099dd
mov dword [ebp - 0x460], 1
jmp 0x100099e4
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x6e8]
imul eax, dword [ebp - 0x218]
test eax, eax
je 0x10009a1f
mov dword [ebp - 0x468], 1
jmp 0x10009a26
and dword [ebp - 0x468], 0
push 3
lea ecx, [ebp - 0xf14]
call fcn.10016587
mov dword [eax], 0x5fcb
cmp dword [ebp - 0x468], 0x5fcb
jl 0x10009a51
mov dword [ebp - 0x470], 1
jmp 0x10009a58
and dword [ebp - 0x470], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10016587
mov dword [ebp - 0x828], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x974]
call fcn.10016587
mov ecx, dword [ebp - 0x828]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x828]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x470]
jne 0x10009aa0
mov dword [ebp - 0x6f0], 1
jmp 0x10009aa7
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d8], 3
jmp 0x10009ad8
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jl 0x10009bf9
mov dword [ebp - 0xec8], 0x1d67a3d5
push 3
lea ecx, [ebp - 0xef4]
call fcn.100164e9
mov byte [ebp - 4], 5
mov dword [ebp - 0x24c], 0
jmp 0x10009b19
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x10009b3b
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xef4]
call fcn.10016587
mov dword [eax], 0xe776e9f8
jmp 0x10009b0c
mov dword [ebp - 0x218], 3
jmp 0x10009b54
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x10009be5
push 3
lea ecx, [ebp - 0xcc8]
call fcn.100164e9
mov byte [ebp - 4], 6
mov dword [ebp - 0x314], 0
jmp 0x10009b8b
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x10009bad
push dword [ebp - 0x314]
lea ecx, [ebp - 0xcc8]
call fcn.10016587
mov dword [eax], 0x6e2e31b5
jmp 0x10009b7e
push 1
lea ecx, [ebp - 0xcc8]
call fcn.10016587
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8d0]
mov dword [ecx], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcc8]
call fcn.1001656b
jmp 0x10009b47
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xef4]
call fcn.1001656b
jmp 0x10009acb
jmp 0x10009977
jmp 0x1000981d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf04]
call fcn.1001656b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x974]
call fcn.1001656b
jmp 0x10009712
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.1001656b
mov dword [ebp - 0x324], 0xfffffff9
mov dword [ebp - 0xce8], 0xfffffff8
mov dword [ebp - 0x24], 0x915a
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x254], 0
jmp 0x10009c73
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x10009c8f
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x98c], 0xfffffffd
jmp 0x10009c66
mov dword [ebp - 0x24], 0x8ec0ae97
mov dword [ebp - 0x24], 0
jmp 0x10009ca6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10009f73
mov dword [ebp - 0x58], 0xffffffff
mov eax, 0x3061ece3
test eax, eax
je 0x10009ce3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x98c]
cmp dword [ebp - 0x58], eax
jne 0x10009ce3
cmp dword [ebp - 0x24], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x98c], 0x4bcd
je 0x10009d02
mov dword [ebp - 0x480], 1
jmp 0x10009d09
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x480], eax
jge 0x10009d2a
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x98c], 0
jne 0x10009d2a
and dword [ebp - 0x6f8], 0
jmp 0x10009d34
mov dword [ebp - 0x6f8], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x98c]
cmp eax, dword [ebp - 0x6f8]
jl 0x10009d52
mov dword [ebp - 0x488], 1
jmp 0x10009d59
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x58], 0x6eab3cf8
jge 0x10009d7a
mov dword [ebp - 0x830], 1
jmp 0x10009d81
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0xeec54165
jbe 0x10009f21
mov dword [ebp - 0xac], 1
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xcf0], eax
xor eax, eax
inc eax
cmp eax, 0xe44f
jge 0x10009dd2
mov eax, 0x37b187b3
test eax, eax
je 0x10009dd2
mov dword [ebp - 0x490], 1
jmp 0x10009dd9
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x490], eax
jne 0x10009df3
mov dword [ebp - 0x9b8], 1
jmp 0x10009dfa
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x98c]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xcf8], eax
mov eax, 0x68c2
test eax, eax
jne 0x10009e2c
xor eax, eax
jne 0x10009e2c
and dword [ebp - 0x700], 0
jmp 0x10009e36
mov dword [ebp - 0x700], 1
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x700]
jg 0x10009e4d
mov dword [ebp - 0x498], 1
jmp 0x10009e54
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 1
jb 0x10009e69
mov dword [ebp - 0x920], 1
jmp 0x10009e70
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1e0], 0
jmp 0x10009e92
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xffffffea
jg 0x10009f1f
cmp dword [ebp - 0xac], 0
je 0x10009eaa
jmp 0x10009f1f
mov dword [ebp - 0x58], 0
jmp 0x10009eba
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x10009f1a
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x10009eda
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0xac], 0
jmp 0x10009ef3
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x10009f18
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10009f16
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x10009ee6
jmp 0x10009eb3
jmp 0x10009e85
jmp 0x10009f6e
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x10009f3e
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10009f6e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x10009c9f
mov dword [ebp - 0xac4], 1
mov dword [ebp - 0x1074], 0xe704f3d4
push 4
lea ecx, [ebp - 0xf24]
call fcn.100164e9
mov dword [ebp - 4], 7
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x10b8], 0xffffffff
mov dword [ebp - 0x10b4], 0xffffffff
mov dword [ebp - 0x10b0], 0xffffffff
mov dword [ebp - 0x10ac], 0xffffffff
mov dword [ebp - 0x2c4], 0
jmp 0x10009fe6
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 4
jge 0x1000a008
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xf24]
call fcn.10016587
mov dword [eax], 4
jmp 0x10009fd9
mov dword [ebp - 0x25c], 0
jmp 0x1000a021
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jg 0x1000a076
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0x2fc], 3
jmp 0x1000a04d
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0
jl 0x1000a074
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000a072
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1000a040
jmp 0x1000a014
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf24]
call fcn.1001656b
mov dword [ebp - 0xd00], 0xfffffffe
push 3
lea ecx, [ebp - 0xf44]
call fcn.100164e9
mov dword [ebp - 4], 8
mov dword [ebp - 0x2cc], 8
mov dword [ebp - 0x708], 1
mov dword [ebp - 0x264], 0
jmp 0x1000a0d0
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x1000a0f2
push dword [ebp - 0x264]
lea ecx, [ebp - 0xf44]
call fcn.10016587
mov dword [eax], 0x7571177e
jmp 0x1000a0c3
mov dword [ebp - 0x2cc], 2
jmp 0x1000a10b
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
jl 0x1000a281
push 1
lea ecx, [ebp - 0xaf8]
call fcn.100164e9
mov byte [ebp - 4], 9
mov dword [ebp - 0xee8], 0x8f6efba1
mov dword [ebp - 0xd08], 0xfffffffa
mov dword [ebp - 0x60], 0
jmp 0x1000a14d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1000a169
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaf8]
call fcn.10016587
mov dword [eax], 0xe2c0d37a
jmp 0x1000a146
mov dword [ebp - 0x60], 0
jmp 0x1000a179
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000a18f
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x125c], 5
jmp 0x1000a172
push 0
lea ecx, [ebp - 0xaf8]
call fcn.10016587
and dword [eax], 0
jmp 0x1000a1c5
push 0
lea ecx, [ebp - 0xaf8]
call fcn.10016587
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xaf8]
call fcn.10016587
cmp dword [eax], 2
jg 0x1000a24e
mov dword [ebp - 0x107c], 2
push 1
lea ecx, [ebp - 0xf34]
call fcn.100164e9
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x26c], 0
jmp 0x1000a20b
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000a22d
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xf34]
call fcn.10016587
mov dword [eax], 0xfffffff8
jmp 0x1000a1fe
mov eax, dword [ebp - 0x708]
inc eax
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf34]
call fcn.1001656b
jmp 0x1000a1a1
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000a26d
push 0x16c0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaf8]
call fcn.1001656b
jmp 0x1000a0fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf44]
call fcn.1001656b
mov dword [ebp - 0xd10], 6
mov dword [ebp - 0xef8], 1
mov dword [ebp - 0xd18], 0
mov dword [ebp - 0x10f4], 1
mov dword [ebp - 0xd20], 0xffffffff
mov dword [ebp - 0x9c8], 0x9dc86695
mov dword [ebp - 0xf08], 0xf9a4d91f
mov dword [ebp - 0x9d0], 9
mov dword [ebp - 0xd28], 0xfffffff9
mov dword [ebp - 0x1068], 0x89be67e7
mov dword [ebp - 0xd30], 0x33c8a0c0
mov dword [ebp - 0xf18], 0xfffffffa
mov dword [ebp - 0xd38], 0x52783de7
mov dword [ebp - 0x9c0], 0xffeac8e4
mov dword [ebp - 0xa84], 0
mov dword [ebp - 0x9c], 0
jmp 0x1000a33f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000a35b
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xf54], 0xd7f825e7
jmp 0x1000a332
mov dword [ebp - 0x9c], 0
jmp 0x1000a374
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000a390
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x11bc], 0xfffffff7
jmp 0x1000a367
mov dword [ebp - 0x324], 2
jmp 0x1000a3a9
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jl 0x1000a5e6
mov dword [ebp - 0x180], 0xb3b9da4d
mov dword [ebp - 0xd7c], 1
mov dword [ebp - 0xa7c], 0x57257ea0
mov dword [ebp - 0xd40], 0xfffffffc
mov dword [ebp - 0x10cc], 0xfffffffb
mov dword [ebp - 0x10c8], 0xfffffffb
mov dword [ebp - 0x10c4], 0xfffffffb
mov dword [ebp - 0x10c0], 0xfffffffb
mov dword [ebp - 0xd84], 0xfffffff6
mov dword [ebp - 0x180], 0
jmp 0x1000a429
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x1000a445
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0xf54], 0x3ff82ff4
jmp 0x1000a41c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf54], 0
je 0x1000a4fa
mov dword [ebp - 0xd48], 0x135e1f6f
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0xd50], 0x32456160
push 1
lea ecx, [ebp - 0xf64]
call fcn.100164e9
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xd94], 0
mov dword [ebp - 0x4a8], 9
mov dword [ebp - 0x274], 0
jmp 0x1000a4b7
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x1000a4d9
push dword [ebp - 0x274]
lea ecx, [ebp - 0xf64]
call fcn.10016587
mov dword [eax], 0xc2184e5a
jmp 0x1000a4aa
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf64]
call fcn.1001656b
jmp 0x1000a5e1
mov dword [ebp - 0xae4], 0x9ce07b88
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0x9c0]
mov ecx, dword [ebp - 0xa7c]
lea eax, [eax + ecx - 0x6ae0e500]
cmp eax, dword [ebp - 0x9c8]
jg 0x1000a537
mov dword [ebp - 0x838], 1
jmp 0x1000a53e
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0xac4]
cmp eax, dword [ebp - 0x838]
jl 0x1000a558
mov dword [ebp - 0x4b0], 1
jmp 0x1000a55f
and dword [ebp - 0x4b0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x11bc]
cmp dword [ebp - 0x4b0], eax
jle 0x1000a57f
mov dword [ebp - 0x710], 1
jmp 0x1000a586
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x710]
sub eax, dword [ebp - 0x9d0]
cmp dword [ebp - 0x180], eax
jg 0x1000a5a6
mov dword [ebp - 0x4b8], 1
jmp 0x1000a5ad
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
shl eax, 2
cmp eax, 0x6ca241e2
jl 0x1000a5c9
mov dword [ebp - 0x8d8], 1
jmp 0x1000a5d0
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
sub eax, 0x996d
mov dword [ebp - 0xa84], eax
jmp 0x1000a39c
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x27c], 6
mov dword [ebp - 0x304], 0
push 1
lea ecx, [ebp - 0xb08]
call fcn.100164e9
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x948], 0xbbfad0d7
mov dword [ebp - 0x2d4], 0
jmp 0x1000a63b
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x1000a65d
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xb08]
call fcn.10016587
mov dword [eax], 0x34e1054
jmp 0x1000a62e
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000a67a
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x114], 0
je 0x1000a698
mov eax, 0x5faafe30
test eax, eax
je 0x1000a698
mov dword [ebp - 0x4e0], 1
jmp 0x1000a69f
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x27c]
mov dword [ebp - 0x304], eax
je 0x1000a6d4
cmp dword [ebp - 0x304], 0
je 0x1000a6d4
mov dword [ebp - 0x4c0], 1
jmp 0x1000a6db
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4c0], eax
jge 0x1000a6f5
mov dword [ebp - 0x718], 1
jmp 0x1000a6fc
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 5
jb 0x1000a711
mov dword [ebp - 0x4c8], 1
jmp 0x1000a718
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0xf4ea
jl 0x1000a730
mov dword [ebp - 0x840], 1
jmp 0x1000a737
and dword [ebp - 0x840], 0
imul eax, dword [ebp - 0x840], 0xfffffff8
imul eax, dword [ebp - 0x114]
cmp eax, 0xd77c
jl 0x1000a758
mov dword [ebp - 0x4d0], 1
jmp 0x1000a75f
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x4d0]
test eax, eax
je 0x1000a777
cmp dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xd9c], eax
push 0
lea ecx, [ebp - 0xb08]
call fcn.10016587
cmp dword [eax], 0xa5b7
je 0x1000a7a4
mov dword [ebp - 0x720], 1
jmp 0x1000a7ab
and dword [ebp - 0x720], 0
cmp dword [ebp - 0x720], 6
jae 0x1000a7c0
mov dword [ebp - 0x4d8], 1
jmp 0x1000a7c7
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x948]
imul eax, dword [ebp - 0x4e0]
cmp eax, 0xfffffff9
jg 0x1000a7f1
mov dword [ebp - 0x728], 1
jmp 0x1000a7f8
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0x3bd7
je 0x1000a810
mov dword [ebp - 0x4e8], 1
jmp 0x1000a817
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4e8], eax
jne 0x1000a83a
cmp dword [ebp - 0x304], 0
je 0x1000a83a
mov dword [ebp - 0x848], 1
jmp 0x1000a841
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0x6ac116e0
jne 0x1000a859
mov dword [ebp - 0x4f0], 1
jmp 0x1000a860
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0xb08]
call fcn.10016587
mov esi, dword [ebp - 0x4f0]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xb08]
call fcn.10016587
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.1001656b
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x220], 6
mov dword [ebp - 0x2dc], 0
push 1
lea ecx, [ebp - 0xb18]
call fcn.100164e9
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x510], 0xbbfad0d7
mov dword [ebp - 0x284], 0
jmp 0x1000a8e8
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1000a90a
push dword [ebp - 0x284]
lea ecx, [ebp - 0xb18]
call fcn.10016587
mov dword [eax], 0x34e1054
jmp 0x1000a8db
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1000a927
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x11c], 0
je 0x1000a945
mov eax, 0x5faafe30
test eax, eax
je 0x1000a945
mov dword [ebp - 0x740], 1
jmp 0x1000a94c
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x220]
mov dword [ebp - 0x2dc], eax
je 0x1000a981
cmp dword [ebp - 0x2dc], 0
je 0x1000a981
mov dword [ebp - 0x730], 1
jmp 0x1000a988
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x730], eax
jge 0x1000a9a2
mov dword [ebp - 0x4f8], 1
jmp 0x1000a9a9
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 5
jb 0x1000a9be
mov dword [ebp - 0x8e0], 1
jmp 0x1000a9c5
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0xf4ea
jl 0x1000a9dd
mov dword [ebp - 0x500], 1
jmp 0x1000a9e4
and dword [ebp - 0x500], 0
imul eax, dword [ebp - 0x500], 0xfffffff8
imul eax, dword [ebp - 0x11c]
cmp eax, 0xd77c
jl 0x1000aa05
mov dword [ebp - 0x738], 1
jmp 0x1000aa0c
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x738]
test eax, eax
je 0x1000aa24
cmp dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xd60], eax
push 0
lea ecx, [ebp - 0xb18]
call fcn.10016587
cmp dword [eax], 0xa5b7
je 0x1000aa51
mov dword [ebp - 0x508], 1
jmp 0x1000aa58
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 6
jae 0x1000aa6d
mov dword [ebp - 0x850], 1
jmp 0x1000aa74
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
imul eax, dword [ebp - 0x740]
cmp eax, 0xfffffff9
jg 0x1000aa9e
mov dword [ebp - 0x518], 1
jmp 0x1000aaa5
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x3bd7
je 0x1000aabd
mov dword [ebp - 0x928], 1
jmp 0x1000aac4
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x928], eax
jne 0x1000aae7
cmp dword [ebp - 0x2dc], 0
je 0x1000aae7
mov dword [ebp - 0x520], 1
jmp 0x1000aaee
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0x6ac116e0
jne 0x1000ab06
mov dword [ebp - 0x748], 1
jmp 0x1000ab0d
and dword [ebp - 0x748], 0
push 0
lea ecx, [ebp - 0xb18]
call fcn.10016587
mov esi, dword [ebp - 0x748]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xb18]
call fcn.10016587
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb18]
call fcn.1001656b
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x528], 0xdcc590f0
push 4
lea ecx, [ebp - 0xc74]
call fcn.100164e9
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x9d8], 0x12a7b09f
mov dword [ebp - 0x68], 0
jmp 0x1000ab82
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1000ab9e
push dword [ebp - 0x68]
lea ecx, [ebp - 0xc74]
call fcn.10016587
mov dword [eax], 9
jmp 0x1000ab7b
mov dword [ebp - 0x68], 0
jmp 0x1000abae
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1000abc4
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x11fc], 1
jmp 0x1000aba7
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
je 0x1000abeb
mov eax, 0x498e
test eax, eax
jne 0x1000abeb
and dword [ebp - 0x858], 0
jmp 0x1000abf5
mov dword [ebp - 0x858], 1
cmp dword [ebp - 0x858], 4
jb 0x1000ac0a
mov dword [ebp - 0x368], 1
jmp 0x1000ac11
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x530], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x530]
mov dword [ebp + eax - 0x11fc], ecx
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x530]
jl 0x1000ac4a
mov dword [ebp - 0x750], 1
jmp 0x1000ac51
and dword [ebp - 0x750], 0
push 0
lea ecx, [ebp - 0xc74]
call fcn.10016587
mov ecx, dword [ebp - 0x368]
mov dword [eax], ecx
mov eax, dword [ebp - 0x750]
sub eax, 0x78c0
cmp dword [ebp - 0x368], eax
je 0x1000ac85
mov dword [ebp - 0x538], 1
jmp 0x1000ac8c
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0xffff
jb 0x1000acaa
cmp dword [ebp - 0x28c], 0
jne 0x1000acaa
and dword [ebp - 0x8e8], 0
jmp 0x1000acb4
mov dword [ebp - 0x8e8], 1
cmp dword [ebp - 0x8e8], 0xffffffff
jge 0x1000acc9
mov dword [ebp - 0x540], 1
jmp 0x1000acd0
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0xd65f
jle 0x1000ace8
mov dword [ebp - 0x758], 1
jmp 0x1000acef
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x9d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.1001656b
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x294], 6
mov dword [ebp - 0x2e4], 0
push 1
lea ecx, [ebp - 0xb28]
call fcn.100164e9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x768], 0xbbfad0d7
mov dword [ebp - 0x31c], 0
jmp 0x1000ad5f
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x1000ad81
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xb28]
call fcn.10016587
mov dword [eax], 0x34e1054
jmp 0x1000ad52
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000ad9e
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x124], 0
je 0x1000adbc
mov eax, 0x5faafe30
test eax, eax
je 0x1000adbc
mov dword [ebp - 0x568], 1
jmp 0x1000adc3
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x294]
mov dword [ebp - 0x2e4], eax
je 0x1000adf8
cmp dword [ebp - 0x2e4], 0
je 0x1000adf8
mov dword [ebp - 0x548], 1
jmp 0x1000adff
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x548], eax
jge 0x1000ae19
mov dword [ebp - 0x860], 1
jmp 0x1000ae20
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 5
jb 0x1000ae35
mov dword [ebp - 0x550], 1
jmp 0x1000ae3c
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xf4ea
jl 0x1000ae54
mov dword [ebp - 0x760], 1
jmp 0x1000ae5b
and dword [ebp - 0x760], 0
imul eax, dword [ebp - 0x760], 0xfffffff8
imul eax, dword [ebp - 0x124]
cmp eax, 0xd77c
jl 0x1000ae7c
mov dword [ebp - 0x558], 1
jmp 0x1000ae83
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x558]
test eax, eax
je 0x1000ae9b
cmp dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xda4], eax
push 0
lea ecx, [ebp - 0xb28]
call fcn.10016587
cmp dword [eax], 0xa5b7
je 0x1000aec8
mov dword [ebp - 0x968], 1
jmp 0x1000aecf
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 6
jae 0x1000aee4
mov dword [ebp - 0x560], 1
jmp 0x1000aeeb
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
imul eax, dword [ebp - 0x568]
cmp eax, 0xfffffff9
jg 0x1000af15
mov dword [ebp - 0x868], 1
jmp 0x1000af1c
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0x3bd7
je 0x1000af34
mov dword [ebp - 0x570], 1
jmp 0x1000af3b
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x570], eax
jne 0x1000af5e
cmp dword [ebp - 0x2e4], 0
je 0x1000af5e
mov dword [ebp - 0x770], 1
jmp 0x1000af65
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0x6ac116e0
jne 0x1000af7d
mov dword [ebp - 0x578], 1
jmp 0x1000af84
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0xb28]
call fcn.10016587
mov esi, dword [ebp - 0x578]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xb28]
call fcn.10016587
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.1001656b
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x29c], 0
jmp 0x1000afd7
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1000aff3
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0xf74], 0
jmp 0x1000afca
mov dword [ebp - 0x34], 0
jmp 0x1000b003
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1000b035
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000b033
push 0
push 0
push 0x2186
push 0x3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1000affc
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jge 0x1000b049
mov dword [ebp - 0x8f0], 1
jmp 0x1000b050
and dword [ebp - 0x8f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf74]
imul eax, dword [ebp - 0x8f0]
test eax, eax
je 0x1000b087
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1000b082
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000b1f7
mov dword [ebp - 0x3c], 0xdac0faab
mov eax, 0xe58bfc4f
test eax, eax
je 0x1000b1ab
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd68], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf74]
mov dword [ebp - 0xdac], eax
cmp dword [ebp - 0x3c], 0
je 0x1000b0ce
cmp dword [ebp - 0x3c], 0
je 0x1000b0ce
mov dword [ebp - 0xb1c], 1
jmp 0x1000b0d5
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0x34], 0xadf8
jge 0x1000b0fc
mov dword [ebp - 0x580], 1
jmp 0x1000b103
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x580], eax
jl 0x1000b120
cmp dword [ebp - 0x34], 0
je 0x1000b120
mov dword [ebp - 0x778], 1
jmp 0x1000b127
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x778]
jne 0x1000b136
cmp dword [ebp - 0x3c], 0
cmp dword [ebp - 0x3c], 1
jae 0x1000b148
mov dword [ebp - 0x588], 1
jmp 0x1000b14f
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
inc eax
cmp eax, 1
jge 0x1000b167
mov dword [ebp - 0x870], 1
jmp 0x1000b16e
and dword [ebp - 0x870], 0
cmp dword [ebp - 0x870], 0x15b01d9
jle 0x1000b186
mov dword [ebp - 0x9e0], 1
jmp 0x1000b18d
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd78], eax
cmp dword [ebp - 0x34], 0x6dab
jg 0x1000b1ab
mov dword [ebp - 0x590], 1
jmp 0x1000b1b2
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1000b1f7
push 0x196f
push 0
push 0x268f
push 0x4d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x30c], 1
mov dword [ebp - 0x780], 0xdcc590f0
push 4
lea ecx, [ebp - 0xca4]
call fcn.100164e9
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xa8c], 0x12a7b09f
mov dword [ebp - 0x78], 0
jmp 0x1000b239
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1000b255
push dword [ebp - 0x78]
lea ecx, [ebp - 0xca4]
call fcn.10016587
mov dword [eax], 9
jmp 0x1000b232
mov dword [ebp - 0x78], 0
jmp 0x1000b265
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1000b27b
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x123c], 1
jmp 0x1000b25e
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 0
je 0x1000b2a2
mov eax, 0x498e
test eax, eax
jne 0x1000b2a2
and dword [ebp - 0x598], 0
jmp 0x1000b2ac
mov dword [ebp - 0x598], 1
cmp dword [ebp - 0x598], 4
jb 0x1000b2c1
mov dword [ebp - 0x3b0], 1
jmp 0x1000b2c8
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x930], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x930]
mov dword [ebp + eax - 0x123c], ecx
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x930]
jl 0x1000b301
mov dword [ebp - 0x5a0], 1
jmp 0x1000b308
and dword [ebp - 0x5a0], 0
push 0
lea ecx, [ebp - 0xca4]
call fcn.10016587
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5a0]
sub eax, 0x78c0
cmp dword [ebp - 0x3b0], eax
je 0x1000b33c
mov dword [ebp - 0x788], 1
jmp 0x1000b343
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0xffff
jb 0x1000b361
cmp dword [ebp - 0x30c], 0
jne 0x1000b361
and dword [ebp - 0x5a8], 0
jmp 0x1000b36b
mov dword [ebp - 0x5a8], 1
cmp dword [ebp - 0x5a8], 0xffffffff
jge 0x1000b380
mov dword [ebp - 0x878], 1
jmp 0x1000b387
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xd65f
jle 0x1000b39f
mov dword [ebp - 0x5b0], 1
jmp 0x1000b3a6
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0xa8c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca4]
call fcn.1001656b
mov dword [ebp - 0x12c], 0xfffffffa
mov dword [ebp - 0x370], 9
push 1
lea ecx, [ebp - 0xc8c]
call fcn.100164e9
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x70], 0
jmp 0x1000b3f9
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000b40f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x113c], 1
jmp 0x1000b3f2
mov dword [ebp - 0x70], 0
jmp 0x1000b41f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000b438
push dword [ebp - 0x70]
lea ecx, [ebp - 0xc8c]
call fcn.10016587
or dword [eax], 0xffffffff
jmp 0x1000b418
mov dword [ebp - 0x12c], 0xffffffe8
jmp 0x1000b451
cmp dword [ebp - 0x12c], 0xffffffef
jg 0x1000b7b9
mov dword [ebp - 0x3a0], 0xd3f5
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x80], 0xafa01777
mov dword [ebp - 0x1a8], 0xeec299e
mov dword [ebp - 0x9e8], 0x4426
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x1000b4b7
cmp dword [ebp - 0x80], 0
jne 0x1000b4b7
and dword [ebp - 0x790], 0
jmp 0x1000b4c1
mov dword [ebp - 0x790], 1
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x3051ebf0
jl 0x1000b4e5
mov dword [ebp - 0x5b8], 1
jmp 0x1000b4ec
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
sub eax, 0x307ecdf1
jne 0x1000b50b
mov eax, 0x2f7c
test eax, eax
jne 0x1000b50b
and dword [ebp - 0x8f8], 0
jmp 0x1000b515
mov dword [ebp - 0x8f8], 1
cmp dword [ebp - 0x8f8], 0xffffffff
je 0x1000b52a
mov dword [ebp - 0x5c0], 1
jmp 0x1000b531
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x5c0]
jle 0x1000b557
mov dword [ebp - 0x798], 1
jmp 0x1000b55e
and dword [ebp - 0x798], 0
imul eax, dword [ebp - 0x798], 0xffffffff
cmp eax, dword [ebp - 0x3a0]
jg 0x1000b579
mov dword [ebp - 0x5c8], 1
jmp 0x1000b580
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x9e8]
cmp dword [ebp - 0x5c8], eax
jg 0x1000b5a3
cmp dword [ebp - 0xd0], 0
jne 0x1000b5a3
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x370], eax
jl 0x1000b5d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.1001656b
mov dword [ebp - 0x2ec], 1
mov dword [ebp - 0x7a8], 0xdcc590f0
push 4
lea ecx, [ebp - 0xcbc]
call fcn.100164e9
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x9f8], 0x12a7b09f
mov dword [ebp - 0x44], 0
jmp 0x1000b80a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1000b826
push dword [ebp - 0x44]
lea ecx, [ebp - 0xcbc]
call fcn.10016587
mov dword [eax], 9
jmp 0x1000b803
mov dword [ebp - 0x44], 0
jmp 0x1000b836
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1000b84c
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1214], 1
jmp 0x1000b82f
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0
je 0x1000b873
mov eax, 0x498e
test eax, eax
jne 0x1000b873
and dword [ebp - 0x5e8], 0
jmp 0x1000b87d
mov dword [ebp - 0x5e8], 1
cmp dword [ebp - 0x5e8], 4
jb 0x1000b892
mov dword [ebp - 0x378], 1
jmp 0x1000b899
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x888], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x888]
mov dword [ebp + eax - 0x1214], ecx
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x888]
jl 0x1000b8d2
mov dword [ebp - 0x5f0], 1
jmp 0x1000b8d9
and dword [ebp - 0x5f0], 0
push 0
lea ecx, [ebp - 0xcbc]
call fcn.10016587
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5f0]
sub eax, 0x78c0
cmp dword [ebp - 0x378], eax
je 0x1000b90d