Function at 0x1001cd8b
Capabilities:
Accept command line arguments
Create process on windows
Encrypt data using speck
Get memory capacity
Identify system language via api
Query or enumerate registry key

Disassembly:
mov eax, 0x1005fe23
call fcn.1005f318
sub esp, 0x8e0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x364]
push 1
mov byte [ebp - 0x60], dl
call fcn.1000f8c8
lea ecx, [ebp - 0x674]
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x664]
movdqa xmm0, xmmword [0x1000bb50]
or esi, 0xffffffff
push eax
push ecx
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x4c], esi
movdqu xmmword [ebp - 0x674], xmm0
call fcn.1000f924
push 2
pop edi
push edi
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 1
call fcn.1000f8c8
xor edx, edx
mov dword [ebp - 0x3c], ebx
inc edx
jmp 0x1001ce1a
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x364]
mov dword [eax + ecx*4], 0x53b26bdd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001ce07
mov dword [ebp - 0x3c], ebx
jmp 0x1001ce35
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5d4], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001ce24
mov dword [ebp - 0x3c], ebx
jmp 0x1001ce52
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0xf944dcd6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1001ce3f
mov eax, dword [ebp - 0x364]
lea ecx, [ebp - 0x56c]
mov dword [eax], ebx
call fcn.1000f94a
lea ecx, [ebp - 0x738]
call fcn.1000f94a
lea ecx, [ebp - 0x364]
mov dword [ebp - 4], esi
call fcn.1000f94a
push 1
lea ecx, [ebp - 0x120]
call fcn.1000f8c8
lea ecx, [ebp - 0x6c4]
mov dword [ebp - 4], edi
movdqa xmm0, xmmword [0x1000bb50]
lea eax, [ebp - 0x6b4]
push ecx
push eax
push ecx
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x40], esi
movdqu xmmword [ebp - 0x6c4], xmm0
call fcn.1000f924
push edi
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 3
call fcn.1000f8c8
xor edx, edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x3c], ebx
inc edx
jmp 0x1001cef2
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x53b26bdd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001cedf
mov dword [ebp - 0x3c], ebx
jmp 0x1001cf0d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x240], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001cefc
mov dword [ebp - 0x3c], ebx
jmp 0x1001cf2a
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x478]
mov dword [eax + ecx*4], 0xf944dcd6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1001cf17
mov eax, dword [ebp - 0x120]
mov dword [eax], ebx
cmp dword [eax], 0xffffffee
jge 0x1001d06d
mov dword [ebp - 0x24], 0xfffffffb
xor ecx, ecx
mov dword [ebp - 0x34], 0x88e1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x120]
cmp dword [eax], 0x60389a9b
setg cl
mov dword [ebp - 0x240], ecx
lea eax, [ecx + 0x62a49ee1]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x120]
add ecx, dword [eax]
mov eax, dword [ebp - 0x584]
neg ecx
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x65816309
setl al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x478]
setne cl
sub ecx, 0xfe4d
add ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x24], 0x14cd
cmp dword [ebp - 0x24], 0x150b
jle 0x1001d030
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov edi, esi
mov esi, 0x3d20
mov eax, edi
lea ecx, [ebp - 0x7f4]
cdq
push edx
push eax
call fcn.1000cfb0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001cffc
mov eax, dword [eax]
push eax
call fcn.1004a046
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7f4]
call fcn.1000fc54
dec edi
dec esi
jne 0x1001cfe2
mov esi, dword [ebp - 0x40]
inc esi
mov dword [ebp - 0x40], esi
cmp esi, 0x7805
jl 0x1001cfdb
push 0xce9
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d045
push ebx
push 0xce7
call dword [sym.imp.GDI32.dll_RectVisible]
cmp dword [ebp - 0x24], 0x1395
jge 0x1001d059
push 0x10008360
call fcn.1004a046
pop ecx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x120]
dec dword [eax]
jmp 0x1001cf37
lea ecx, [ebp - 0x478]
call fcn.1000f94a
lea ecx, [ebp - 0x584]
call fcn.1000f94a
or esi, 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], esi
call fcn.1000f94a
xor eax, eax
mov dword [ebp - 0x48], 0xfffffff9
inc eax
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x20], eax
push eax
call fcn.1000f8c8
xor edx, edx
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1001d0c8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x37c]
mov dword [eax + ecx*4], 0x6aeba4d3
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001d0b5
push 7
mov dword [ebp - 0x48], ebx
pop edi
cmp dword [ebp - 0x48], 0x1c
jl 0x1001d140
mov dword [ebp - 0x50], 0x6874be76
mov dword [ebp - 0x20], 5
cmp dword [ebp - 0x20], ebx
je 0x1001d122
mov eax, dword [ebp - 0x20]
add eax, 0x3773672
cmp eax, 0x8cafa32f
ja 0x1001d0fe
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d13b
push 0x13c7
push 0x1729
call dword [sym.imp.GDI32.dll_SetROP2]
xor edx, edx
inc edx
jmp 0x1001d13b
mov dword [ebp - 0x20], ebx
jmp 0x1001d136
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x37c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001d127
inc dword [ebp - 0x48]
jmp 0x1001d0d3
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1001d176
mov dword [ebp - 0x40], 0xfffffff8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d16e
push ebx
push 0x169
push 0xbc
push 0x11aa
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
inc dword [ebp - 0x40]
dec dword [ebp - 0x20]
jns 0x1001d148
lea ecx, [ebp - 0x37c]
call fcn.1000f94a
push 1
lea ecx, [ebp - 0x108]
call fcn.1000f8c8
xor eax, eax
mov dword [ebp - 4], edi
inc eax
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x454]
push eax
call fcn.1000f8c8
xor edx, edx
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1001d1c5
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x454]
mov dword [eax + ecx*4], 0x6aeba4d3
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001d1b2
mov dword [ebp - 0x48], ebx
jmp 0x1001d234
mov dword [ebp - 0x50], 0x6874be76
mov dword [ebp - 0x20], 5
cmp dword [ebp - 0x20], ebx
je 0x1001d218
mov eax, dword [ebp - 0x20]
add eax, 0x3773672
cmp eax, 0x8cafa32f
ja 0x1001d1f4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d231
push 0x13c7
push 0x1729
call dword [sym.imp.GDI32.dll_SetROP2]
xor edx, edx
inc edx
jmp 0x1001d231
mov dword [ebp - 0x20], ebx
jmp 0x1001d22c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x454]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001d21d
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x1c
jge 0x1001d1cf
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1001d270
mov dword [ebp - 0x40], 0xfffffff8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d268
push ebx
push 0x169
push 0xbc
push 0x11aa
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
inc dword [ebp - 0x40]
dec dword [ebp - 0x20]
jns 0x1001d242
lea ecx, [ebp - 0x454]
call fcn.1000f94a
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], esi
push 2
mov dword [ebp - 0x24], 0xfffffff6
pop edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], 0xd59ff446
mov dword [ebp - 0x40], 7
push 3
mov dword [ebp - 0x50], 0xf0bd907c
mov dword [ebp - 0x2c], ebx
pop esi
jmp 0x1001d2bc
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x138], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001d2ab
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
sub ecx, 0x5a83d87e
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x134]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
imul eax, edx
cmp eax, 0x451d77f1
jg 0x1001d30f
cmp dword [ebp - 0x24], ebx
je 0x1001d30f
xor ecx, ecx
inc ecx
jmp 0x1001d311
mov ecx, ebx
mov eax, dword [ebp - 0x130]
imul eax, ecx
test eax, eax
jne 0x1001d327
cmp dword [ebp - 0x18], ebx
jne 0x1001d327
mov edx, ebx
jmp 0x1001d32a
xor edx, edx
inc edx
mov eax, dword [ebp - 0x134]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x134]
cmp edx, eax
movdqa xmm0, xmmword [0x1000bb50]
setg cl
xor eax, eax
cmp ecx, 0x2835
lea ecx, [ebp - 0x704]
push ecx
setge al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x6f4]
push eax
push ecx
lea ecx, [ebp - 0x560]
movdqu xmmword [ebp - 0x704], xmm0
call fcn.1000f924
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x28], 0x9d29
push esi
call fcn.1000f8c8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x48], 9
push esi
call fcn.1000f8c8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x694]
movdqa xmm0, xmmword [0x1000bb30]
lea eax, [ebp - 0x684]
push ecx
mov dword [ebp - 0x18], 0x8307b364
mov dword [ebp - 0x50], 0xfffffffb
push eax
mov dword [ebp - 0x40], 1
push ecx
mov dword [ebp - 0x54], 0xffffffff
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x24], 0xfffffff8
movdqu xmmword [ebp - 0x694], xmm0
call fcn.1000f924
push 3
mov dword [ebp - 0x3c], ebx
pop edx
jmp 0x1001d42d
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001d41a
mov dword [ebp - 0x3c], ebx
jmp 0x1001d44a
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28c]
mov dword [eax + ecx*4], 0x69b41dbc
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001d437
mov dword [ebp - 0x3c], ebx
jmp 0x1001d461
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5e4], ebx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1001d454
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x28], ebx
jne 0x1001d492
mov eax, dword [ebp - 0x48]
mov edx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x48]
test eax, eax
jne 0x1001d482
mov edx, ebx
mov eax, dword [ebp - 0x28c]
mov dword [eax + 8], edx
mov eax, ebx
cmp edx, dword [ebp - 0x28]
jl 0x1001d494
mov eax, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x50], eax
cmp dword [edx + 4], ebx
jne 0x1001d500
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax]
imul ecx, dword [edx]
mov eax, dword [ebp - 0x28]
add ecx, ecx
mov dword [edx], ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x5e0], ebx
cmp dword [eax + 4], ebx
setl cl
cmp ecx, dword [ebp - 0x40]
jne 0x1001d503
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x24]
cmp edx, 0x91de2fc2
sbb eax, eax
xor ecx, ecx
neg eax
cmp ecx, eax
sbb eax, eax
inc eax
test eax, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, 0x8c33
setl bl
xor edx, edx
add ebx, dword [eax]
mov eax, dword [ebp - 0x150]
imul ecx, ebx
cmp ecx, dword [eax + 8]
lea ecx, [ebp - 0x60c]
mov eax, dword [ebp - 0x60c]
setg dl
sub edx, 0xffff
neg edx
sbb edx, edx
inc edx
mov dword [eax + 4], edx
call fcn.1000f94a
lea ecx, [ebp - 0x28c]
call fcn.1000f94a
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 8
call fcn.1000f94a
push edi
lea ecx, [ebp - 0x340]
call fcn.1000f8c8
mov byte [ebp - 4], 0xb
xor ebx, ebx
mov dword [ebp - 0x28], 0xa61928c1
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 4
jge 0x1001d5d3
xor esi, esi
inc esi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8ec], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001d5c0
mov dword [ebp - 0x20], ebx
jmp 0x1001d5e9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x54c], 0xcb64b693
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001d5d8
mov dword [ebp - 0x28], ebx
jmp 0x1001d6a1
mov dword [ebp - 0x44], 0x3938
mov dword [ebp - 0x48], edi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor ebx, ebx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
add eax, 0xfffc
je 0x1001d644
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1001d69e
push 0x1997
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x1001d69e
mov dword [ebp - 0x4c], 0x77c422d5
mov dword [ebp - 0x44], ebx
jmp 0x1001d662
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1001d65f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jle 0x1001d650
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 7
jge 0x1001d69e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ebx
jmp 0x1001d68a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5d0], 9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1001d679
mov dword [ebp - 0x548], ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 7
jl 0x1001d674
dec dword [ebp - 0x28]
xor edx, edx
cmp dword [ebp - 0x28], 0xffffffe4
jne 0x1001d5f6
mov dword [ebp - 0x3c], ebx
inc edx
jmp 0x1001d6c6
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0x53b26bdd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001d6b3
mov dword [ebp - 0x48], 0x24a8c6a5
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 7
jle 0x1001d6f7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d6eb
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 7
jg 0x1001d6db
xor edx, edx
inc edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], ebx
jmp 0x1001d713
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x208], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x1001d702
mov dword [ebp - 0x3c], ebx
jmp 0x1001d730
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0xf944dcd6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1001d71d
mov eax, dword [ebp - 0x108]
mov dword [eax], ebx
cmp dword [eax], 0xffffffee
jge 0x1001da88
mov dword [ebp - 0x4c], 9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d75d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d76f
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x24], 0xbf8f0aa6
mov dword [ebp - 0x48], 0x3bd65256
push 4
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x50], 0x535dd253
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x2c], ebx
jmp 0x1001d7ae
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x188], 0xf5a9c4c8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1001d79d
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x184]
jl 0x1001d7e3
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x184], 0xd7249aae
jbe 0x1001d7df
mov eax, dword [ebp - 0x17c]
mov edx, ebx
jmp 0x1001d7e6
xor edx, edx
inc edx
mov eax, dword [ebp - 0x184]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], ebx
je 0x1001d808
cmp dword [ebp - 0x184], ebx
je 0x1001d808
xor eax, eax
inc eax
jmp 0x1001d80a
mov eax, ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x48], ebx
je 0x1001d871
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x18]
sub ecx, 0x35731705
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
dec eax
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x180]
setle bl
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, dword [ebp - 0x50]
je 0x1001d845
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], 0x18eb
mov eax, dword [ebp - 0x48]
sub eax, 0x19bd
cmp eax, 0x8ba79672
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
jne 0x1001d997
xor ebx, ebx
cmp dword [ebp - 0x48], ebx
jne 0x1001d999
mov eax, ebx
mov dword [ebp - 0x54], eax
xor ecx, ecx
mov dword [ebp - 0x24], 0x88e1
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
cmp dword [eax], 0x60389a9b
setg cl
mov dword [ebp - 0x208], ecx
lea eax, [ecx + 0x62a49ee1]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
add ecx, dword [eax]
mov eax, dword [ebp - 0x560]
neg ecx
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x65816309
setl al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x340]
setne cl
sub ecx, 0xfe4d
add ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 0xfffffff7
jl 0x1001d9d1
mov dword [ebp - 0x34], 0x41a7
cmp dword [ebp - 0x34], 0x41ea
jle 0x1001d96a
mov dword [ebp - 0x24], ebx
mov edx, ebx
mov dword [ebp - 0x40], 0x53ff
mov dword [ebp - 0x18], edx
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x106081f8
and eax, edx
cdq
push edx
push eax
call fcn.1000f7b3
mov edx, dword [ebp - 0x18]
inc edi
cmp edi, 0x1215
jl 0x1001d928
inc esi
cmp esi, 0x394d
jl 0x1001d926
mov eax, dword [ebp - 0x24]
add edx, eax
dec dword [ebp - 0x40]
mov dword [ebp - 0x18], edx
jne 0x1001d924
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x5f52
jl 0x1001d918
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001d979
call dword [sym.imp.USER32.dll_EndMenu]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x34], 0x3e28
jge 0x1001d9bd
mov edx, 0x100083a8
mov ecx, 0x106081f8
call fcn.1001125d
jmp 0x1001d9bd
xor ebx, ebx
xor eax, eax
inc eax
jmp 0x1001d873
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x2c], ebx
jne 0x1001d9d1
dec dword [ebp - 0x2c]
jmp 0x1001d8fb
mov dword [ebp - 0x40], 0x2f6
cmp dword [ebp - 0x40], 0x31c
jle 0x1001da4b
mov edx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x824]
and eax, edx
cdq
push edx
push eax
call fcn.1000cfb0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001da0a
mov eax, dword [eax]
push eax
call fcn.1004a046
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x824]
call fcn.1000fc54
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, 0xe12
jl 0x1001d9ea
inc edi
cmp edi, 0x7091
jl 0x1001d9e8
inc edx
mov dword [ebp - 0x18], edx
cmp edx, 0x2e4e
jl 0x1001d9e6
push 0x125b
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001da60
push ebx
push 0xce7
call dword [sym.imp.GDI32.dll_RectVisible]
cmp dword [ebp - 0x40], 0xffffff36
jge 0x1001da74
push 0x100083f0
call fcn.1004a046
pop ecx
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x108]
dec dword [eax]
jmp 0x1001d73d
lea ecx, [ebp - 0x340]
call fcn.1000f94a
lea ecx, [ebp - 0x560]
call fcn.1000f94a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.1000f94a
push 4
pop esi
push 2
pop edi
mov dword [ebp - 0x2c], 0x1a35ca42
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], 1
push edi
call fcn.1000f8c8
mov dword [ebp - 0x20], ebx
jmp 0x1001dae3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001dad5
mov dword [ebp - 0x20], ebx
jmp 0x1001dafc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001daed
cmp dword [ebp - 0x6c], ebx
jne 0x1001db1f
mov dword [ebp - 0x2c], 0x2daa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
cmp eax, 1
setle cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x2c], ebx
je 0x1001db68
mov edx, dword [ebp - 0x394]
cmp dword [edx + 4], ebx
je 0x1001db45
cmp dword [ebp - 0x6c], ebx
jne 0x1001db48
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [edx + 4], 0x8d36
setg cl
xor eax, eax
cmp ecx, 0x1c17854c
sete al
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
xor ebx, ebx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x70]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg bl
add eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x394]
call fcn.1000f94a
mov dword [ebp - 0x3c], 5
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x8efa
mov dword [ebp - 0x3c], esi
inc ebx
cmp dword [ebp - 0x3c], 0xffffffe9
jg 0x1001dc01
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x2c], esi
jmp 0x1001dbd6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x32c], 0x124f84b8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001dbc5
mov dword [ebp - 0x48], esi
jmp 0x1001dbf7
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x32c], edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x32c]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x1001dbe0
dec dword [ebp - 0x3c]
jmp 0x1001dbb3
mov eax, dword [ebp - 0x3c]
mov edi, 0xaf275079
mov edx, edi
xor ecx, ecx
sub edx, eax
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x3c]
jle 0x1001dc22
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jl 0x1001dc31
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x49c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0x1a35ca42
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x48], ebx
push 2
call fcn.1000f8c8
push 2
mov dword [ebp - 0x20], esi
pop edx
jmp 0x1001dc76
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x78], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001dc6c
mov dword [ebp - 0x20], esi
jmp 0x1001dc93
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x49c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001dc80
cmp dword [ebp - 0x74], esi
jne 0x1001dcb6
mov dword [ebp - 0x2c], 0x2daa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [ebp - 0x74]
cmp eax, ebx
setle cl
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x2c], esi
je 0x1001dcfe
mov edx, dword [ebp - 0x49c]
cmp dword [edx + 4], esi
je 0x1001dcdb
cmp dword [ebp - 0x74], esi
jne 0x1001dcde
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [edx + 4], 0x8d36
setg cl
xor eax, eax
cmp ecx, 0x1c17854c
sete al
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x74]
xor ebx, ebx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg bl
add eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x49c]
call fcn.1000f94a
mov esi, 0x1006687c
mov dword [ebp - 0x18], 0x68e2
xor ebx, ebx
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x18], 0x6c9a
mov dword [ebp - 0x3c], esi
jle 0x1001dda7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0x2928
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x106081f8
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000f7b3
inc edi
cmp edi, 0x7e80
jl 0x1001dd64
inc esi
push 0
pop ebx
cmp esi, 0x7300
jl 0x1001dd5f
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x24], eax
dec dword [ebp - 0x40]
jne 0x1001dd5d
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x4a9d
jl 0x1001dd53
mov edi, 0xaf275079
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x18], 0x6590
jge 0x1001ddc6
mov edx, 0x10008438
mov ecx, 0x106081f8
call fcn.1001125d
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x18], 0x8efa
mov dword [ebp - 0x30], ebx
jmp 0x1001de5b
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x2c], ebx
jmp 0x1001de2d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x30c], 0x124f84b8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1001de1c
mov dword [ebp - 0x48], ebx
jmp 0x1001de53
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x30c], 2
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x30c]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x1001de38
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe9
jle 0x1001de10
mov eax, dword [ebp - 0x30]
mov edx, edi
sub edx, eax
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x30]
jle 0x1001de7d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jl 0x1001de8c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x20], 0xca4f833f
inc eax
mov dword [ebp - 0x40], 0x556123d4
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 3
jge 0x1001def3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1c4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001dedd
xor eax, eax
inc eax
push 2
pop edi
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x1001e054
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x1001e04b
mov dword [ebp - 0x40], 0x31aa08e
mov dword [ebp - 0x18], 0x82ec
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1c4], ebx
je 0x1001e030
mov dword [ebp - 0x54], 0xffffffff
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x38], 0xfffffffb
push edi
call fcn.1000f8c8
xor edx, edx
inc edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x2c], ebx
jmp 0x1001df6e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001df5b
mov eax, dword [ebp - 0x25c]
dec dword [ebp - 0x25c]
test eax, eax
je 0x1001df92
mov eax, dword [ebp - 0x50]
mov esi, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
jne 0x1001df94
mov esi, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffffc
setle cl
xor eax, eax
cmp ecx, 4
setge al
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor ecx, ecx
cmp esi, edx
setne cl
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, dword [ebp + eax*4 - 0x1c4]
jge 0x1001dfe3
cmp dword [ebp - 0x24], ebx
jne 0x1001dfe3
mov ecx, ebx
jmp 0x1001dfe6
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1c4], ecx
jl 0x1001e002
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1c4], ebx
jne 0x1001e002
mov eax, ebx
jmp 0x1001e005
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3ac]
mov dword [eax], ecx
lea ecx, [ebp - 0x3ac]
call fcn.1000f94a
jmp 0x1001e03f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001e03f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
dec dword [ebp - 0x1c]
jns 0x1001df18
xor eax, eax
inc eax
dec dword [ebp - 0x20]
jns 0x1001df02
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1001e068
inc dword [ebp - 0x34]
dec dword [ebp - 0x20]
jns 0x1001e060
mov dword [ebp - 0x40], 0x7575
cmp dword [ebp - 0x40], 0x767b
jle 0x1001e0be
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x24]
mov eax, esi
mov ecx, 0x106081f8
cdq
idiv edi
or edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1000f7b3
inc edi
cmp edi, 0x39c6
jl 0x1001e082
inc esi
push 0
pop ebx
cmp esi, 0x7210
jl 0x1001e07d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x468b
jl 0x1001e07b
push 2
pop edi
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x40], 0x74fa
jge 0x1001e0dd
mov edx, 0x100084a4
mov ecx, 0x106081f8
call fcn.1001125d
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], 0xe91a049f
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0x19
cmp dword [ebp - 0x2c], 0xffffffea
jg 0x1001e12e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001e122
push ebx
push ebx
push 0x2225
push ebx
push 0x269e
push ebx
push 0x17f7
push 0xc42
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffea
jle 0x1001e0fb
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], 0x1a35ca42
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x20], ebx
jmp 0x1001e18a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x79c], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001e179
mov dword [ebp - 0x20], ebx
jmp 0x1001e1a5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x554], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001e194
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x4cc]
push edi
call fcn.1000f8c8
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x6a4]
movdqa xmm0, xmmword [0x1000bb60]
lea eax, [ebp - 0x694]
push ecx
mov dword [ebp - 0x28], 0xfff8
mov dword [ebp - 0x24], 0xfffffff9
push eax
mov dword [ebp - 0x44], 5
push ecx
mov dword [ebp - 0x2c], 0xdda37bb0
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x48], 0xfffffff8
movdqu xmmword [ebp - 0x6a4], xmm0
call fcn.1000f924
mov dword [ebp - 0x18], 0x3e458c45
mov dword [ebp - 0x50], 0xfffffff8
mov dword [ebp - 0x2c], ebx
jmp 0x1001e240
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x76c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001e233
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x624]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x18]
imul ecx, ecx, 7
sub ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 9
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0xa29
neg edx
mov eax, dword [ebp - 0x24]
sbb edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
neg edx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
cmp dword [ebp - 0x2c], ecx
jne 0x1001e2dd
cmp dword [ebp - 0x50], ebx
jne 0x1001e2dd
mov eax, ebx
jmp 0x1001e2e0
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
je 0x1001e2ef
cmp dword [ebp - 0x24], ebx
jne 0x1001e2ef
cmp dword [ebp - 0x2c], ebx
je 0x1001e2f9
cmp dword [ebp - 0x44], ebx
je 0x1001e2f9
xor ecx, ecx
inc ecx
jmp 0x1001e2fb
mov ecx, ebx
mov eax, dword [ebp - 0x28]
add ecx, 0x8b26de0d
xor edx, edx
cmp ecx, eax
mov eax, 0xa8f9
lea ecx, [ebp - 0x624]
setg dl
sub eax, edx
mov dword [ebp - 0x760], eax
call fcn.1000f94a
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], edi
jge 0x1001e33d
xor esi, esi
inc esi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x80], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001e32e
movdqa xmm0, xmmword [0x1000bb40]
lea ecx, [ebp - 0x6b4]
push ecx
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x28], 1
push eax
push ecx
lea ecx, [ebp - 0x72c]
movdqu xmmword [ebp - 0x6b4], xmm0
call fcn.1000f924
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x28], 0xfffffff7
jmp 0x1001e418
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1001e3af
cmp dword [ebp - 0x28], 0xffffffed
jge 0x1001e37e
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x14
call fcn.1000f94a
mov dword [ebp - 0x20], ebx
jmp 0x1001e449