Function at 0x1001a852
Capabilities:
Check os version
Get disk information
Get geographical location
Get memory capacity
Read .ini file
Suspend thread
Terminate process

Disassembly:
mov eax, 0x1006ae7d
call fcn.1006a1e8
sub esp, 0x774
movdqa xmm0, xmmword [0x1000c900]
lea eax, [ebp - 0x698]
push ebx
push esi
push edi
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x6a8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 0x51], dl
movdqu xmmword [ebp - 0x6a8], xmm0
call fcn.10014105
mov edi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov esi, 0x2438
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1001a8b7
push eax
push esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1001a90d
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1001a90a
mov dword [ebp - 0x2c], 0x7e44142b
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5b8]
cmp dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x14]
jns 0x1001a8cf
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1001a8bc
lea ecx, [ebp - 0x5b8]
call fcn.100141a2
movdqa xmm0, xmmword [0x1000c900]
lea ecx, [ebp - 0x688]
push ecx
lea eax, [ebp - 0x678]
push eax
push ecx
lea ecx, [ebp - 0x518]
movdqu xmmword [ebp - 0x688], xmm0
call fcn.10014105
xor eax, eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1001a95c
push eax
push esi
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1001a9b2
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x1001a9af
mov dword [ebp - 0x2c], 0x7e44142b
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x518]
cmp dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x14]
jns 0x1001a974
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1001a961
lea ecx, [ebp - 0x518]
call fcn.100141a2
mov dword [ebp - 0x20], 0x62d5e48d
xor ecx, ecx
mov dword [ebp - 0x48], 0xcb52f506
mov dword [ebp - 0x2c], 0x8e20e6e8
mov byte [ebp - 0x39], cl
cmp byte [ebp - 0x39], cl
je 0x1001a9eb
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffec
push 0xffffffffffffffff
pop esi
jl 0x1001ab3e
mov dword [ebp - 0x24], 0x69f
lea ecx, [ebp - 0xe8]
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001aa28
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xfff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001aa15
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, 0x1eb2391c
mov eax, dword [ebp - 0x24]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xaee5
add eax, 0x787d2b73
cmp eax, 0x864b
jge 0x1001abe4
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x28], 0x4d8d955a
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x1001ab24
xor ebx, ebx
mov dword [ebp - 0x1c], 0xee91b76e
mov dword [ebp - 0x2c], 0x2d97
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
cmp dword [eax + ecx*4], ebx
jne 0x1001ab21
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0xe8]
setle bl
neg ebx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
add ebx, dword [eax + edx*4]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
cmp dword [eax + esi*4], ebx
setg cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x28]
jle 0x1001ab5c
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x1001ab15
push 0xcc
push ebx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
or esi, 0xffffffff
dec dword [ebp - 0x24]
jns 0x1001aa7f
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xe8]
call fcn.100141a2
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
jge 0x1001a9fb
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xfffffff7
push 2
pop esi
cmp dword [ebp - 0x20], ecx
je 0x1001ac45
mov dword [ebp - 0x14], ecx
jmp 0x1001ac0c
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x44], 3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x40], ebx
jne 0x1001ab78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0xc837e05a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x20], ebx
je 0x1001aba5
mov eax, dword [ebp - 0xe8]
cmp dword [eax], ebx
je 0x1001aba5
xor ecx, ecx
inc ecx
jmp 0x1001aba7
mov ecx, ebx
xor eax, eax
or esi, 0xffffffff
cmp ecx, esi
setne al
sub eax, 0x1006
cmp eax, dword [ebp - 0x2c]
jl 0x1001abc5
cmp dword [ebp - 0x20], ebx
je 0x1001abc5
xor edx, edx
inc edx
jmp 0x1001abc7
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x6983816
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
jmp 0x1001ab18
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xe8]
jmp 0x1001ab24
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c4], 0x2061
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001abfb
mov byte [ebp - 0x39], cl
cmp byte [ebp - 0x39], 0
je 0x1001ac2a
push ecx
push 0xc19
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor ecx, ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ecx
jl 0x1001ac9f
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x6c4], ecx
jne 0x1001ac9f
dec dword [ebp - 0x20]
jns 0x1001ac32
jmp 0x1001ac9f
push ebx
lea ecx, [ebp - 0x340]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001ac6b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0x94dd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001ac58
mov dword [ebp - 0x20], edx
jmp 0x1001ac8d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x340]
cmp dword [eax + ecx*4], edx
jne 0x1001ac92
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001ac75
lea ecx, [ebp - 0x340]
call fcn.100141a2
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xa
jne 0x1001ad21
or edi, 0xffffffff
mov dword [ebp - 0x14], ecx
jmp 0x1001acc1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5d0], 0x2265e3ed
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001acb0
mov byte [ebp - 0x39], cl
cmp byte [ebp - 0x39], 0
je 0x1001acd9
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp dword [ebp - 0x5c8], ecx
je 0x1001acfc
xor ecx, ecx
mov dword [ebp - 0x2c], 0xdade
mov eax, dword [ebp - 0x5c8]
cmp eax, edi
setne cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
jmp 0x1001ad12
mov dword [ebp - 0x20], ecx
jmp 0x1001ad0c
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ecx
jne 0x1001ad12
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x1001ad01
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x1001acab
mov edi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
movdqa xmm0, xmmword [0x1000c900]
lea ecx, [ebp - 0x668]
push ecx
lea eax, [ebp - 0x658]
push eax
push ecx
lea ecx, [ebp - 0x5dc]
movdqu xmmword [ebp - 0x668], xmm0
call fcn.10014105
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
jmp 0x1001ad74
cmp byte [ebp - 0x39], 0
je 0x1001ad71
push 0x2558
push 0x75b
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
mov byte [ebp - 0x39], al
jl 0x1001ad58
cmp byte [ebp - 0x39], 0
je 0x1001ad90
push 0x1e2f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x574]
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdfe936be
push esi
call fcn.100140c9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], 0x402be2ff
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 8
push esi
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], 0xb1ec6c04
mov dword [ebp - 0x18], edx
jmp 0x1001adfc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x574]
mov dword [eax + ecx*4], 0xc0c8fbfc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ade9
mov dword [ebp - 0x18], edx
jmp 0x1001ae16
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5e8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ae06
mov dword [ebp - 0x28], 0xfffffff5
cmp dword [ebp - 0x28], 0xfffffff9
jge 0x1001aede
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x40], 0x1ac3dc99
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xffffffec
jg 0x1001aec8
mov dword [ebp - 0x48], 3
xor edx, edx
mov dword [ebp - 0x2c], 0x101eb64d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x28]
jne 0x1001ae79
mov esi, eax
cmp dword [ebp - 0x40], eax
je 0x1001ae7b
mov esi, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 4
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
add eax, esi
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c], 0xfffa
cmp eax, edi
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
jle 0x1001ae46
xor edx, edx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
jl 0x1001ae2f
mov edi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x5e8]
call fcn.100141a2
lea ecx, [ebp - 0x574]
mov byte [ebp - 4], 0
call fcn.100141a2
xor eax, eax
mov dword [ebp - 0x18], 0xbac64a68
mov dword [ebp - 0x18], eax
jmp 0x1001af1e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1001af1b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jle 0x1001af09
push 3
pop esi
mov dword [ebp - 0x18], esi
jmp 0x1001af41
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1001af3e
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x17
jge 0x1001af2c
mov dword [ebp - 0x2c], 0x25c9
cmp dword [ebp - 0x2c], 0x8a6
jge 0x1001afe5
lea eax, [ebp - 0x90]
push eax
push 0x1000c288
call fcn.10050cbb
mov eax, dword [ebp - 0x90]
pop ecx
pop ecx
test eax, eax
je 0x1001afde
dec eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x21c]
push eax
push 0x1000c288
call fcn.10050cbb
mov ecx, dword [ebp - 0x21c]
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
lea eax, [ecx + 1]
sar esi, 1
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
lea eax, [ecx - 1]
imul eax, ecx
cdq
sub eax, edx
mov ecx, eax
lea eax, [esi - 1]
imul eax, esi
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
add ecx, eax
push ecx
push 0x1000c2c4
call fcn.10050eef
mov eax, dword [ebp - 0x90]
add esp, 0x10
test eax, eax
jne 0x1001af78
push 3
pop esi
dec eax
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x678]
mov byte [ebp - 0xd], 0
push ecx
lea eax, [ebp - 0x668]
xorps xmm0, xmm0
push eax
push ecx
lea ecx, [ebp - 0x6e8]
movdqu xmmword [ebp - 0x678], xmm0
call fcn.10014105
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1001b057
mov dword [ebp - 0x1c], 0xb1658084
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1001b052
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1001b04d
push 0x24ff
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1001b034
dec dword [ebp - 0x14]
jns 0x1001b025
lea ecx, [ebp - 0x6e8]
call fcn.100141a2
cmp byte [ebp - 0xd], 0
je 0x1001b169
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], 0x34d8a94b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x24ce5545
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x2d7bc352
push 0xfffffffffffffff6
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xbc4aee50
mov dword [ebp - 0x34], 0x3659ea4d
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x1c36b586
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe5
je 0x1001b160
push 2
lea ecx, [ebp - 0x634]
call fcn.100140c9
mov dword [ebp - 0x34], 0xb57a67d9
xor edx, edx
mov dword [ebp - 0x48], 0xa928
mov dword [ebp - 0x18], edx
jmp 0x1001b106
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x634]
mov dword [eax + ecx*4], 0xba2afe01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001b0f3
mov dword [ebp - 0x18], edx
jmp 0x1001b122
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c], 0xdae8c9f3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001b111
mov dword [ebp - 0x128], edx
jmp 0x1001b13b
cmp dword [ebp - 0x28], edx
jne 0x1001b143
inc dword [ebp - 0x128]
cmp dword [ebp - 0x128], ebx
jle 0x1001b130
dec dword [ebp - 0x48]
lea ecx, [ebp - 0x634]
call fcn.100141a2
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jne 0x1001b0d1
xor eax, eax
push eax
push 0x2438
push eax
call edi
xor edx, edx
or edi, 0xffffffff
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], esi
jg 0x1001b59f
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], 0x1e01b17d
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x5bbbdebf
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], 0x3c576436
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], 0x80ae7b1b
mov dword [ebp - 0x34], 0xfffe
mov dword [ebp - 0x14], 0xa9b924e1
mov dword [ebp - 0x14], edx
jmp 0x1001b1e6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x638], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001b1d9
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x28]
jne 0x1001b261
dec dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
push 5
setg bl
xor ecx, ecx
cmp ebx, eax
pop eax
setle cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0xfffffff8
setne al
xor edx, edx
sub eax, 0x731e
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setg dl
xor ebx, ebx
inc ebx
cmp edx, ebx
jg 0x1001b261
xor edx, edx
mov eax, edx
jmp 0x1001b265
mov eax, ebx
xor edx, edx
cmp eax, dword [ebp - 0x44]
je 0x1001b271
mov ecx, ebx
cmp dword [ebp - 0x20], edx
jne 0x1001b273
mov ecx, edx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x1c]
imul eax, ecx
test eax, eax
je 0x1001b2a0
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001b359
push edx
push 0xc19
push edx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1001b357
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jg 0x1001b2f6
xor ebx, ebx
push esi
lea ecx, [ebp - 0x3e8]
call fcn.100140c9
mov dword [ebp - 0x14], ebx
jmp 0x1001b2d1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3e8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b2be
mov eax, dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3e8]
mov dword [eax + 8], 0x1cd1ac8c
call fcn.100141a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001b2ad
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x40], 0xe88f
jne 0x1001b305
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
sub edx, ebx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], eax
je 0x1001b34e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x24], esi
inc ebx
cmp dword [ebp - 0x24], edx
jl 0x1001b597
mov dword [ebp - 0x34], 0x7e44142b
mov dword [ebp - 0x28], 0x4e064826
mov dword [ebp - 0x44], 0x6e9f
mov dword [ebp - 0x34], 8
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001b39d
push edx
push edx
push 0x5f2
push edx
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor edx, edx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xffffffed
jg 0x1001b4ec
push 2
lea ecx, [ebp - 0x1dc]
call fcn.100140c9
push 2
pop edx
xor ecx, ecx
mov byte [ebp - 4], dl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
inc ebx
cmp dword [ebp - 0x18], esi
jge 0x1001b3d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x498], ebx
inc dword [ebp - 0x18]
jmp 0x1001b3c5
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
jge 0x1001b3f7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001b3e1
xor ecx, ecx
mov eax, dword [ebp - 0x1dc]
mov dword [eax], edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
jg 0x1001b4be
push esi
lea ecx, [ebp - 0x358]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001b433
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b424
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0x289fff12
setl cl
xor eax, eax
cmp ecx, ebx
setge al
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jne 0x1001b462
mov eax, dword [ebp - 0x490]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x358]
cmp dword [eax], edx
je 0x1001b479
cmp dword [ebp - 0x18], edx
je 0x1001b479
mov edx, ebx
mov eax, dword [ebp - 0x1dc]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x498]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x2bf3
lea ecx, [ebp - 0x358]
setne al
add eax, 0x791f9e6a
mov dword [ebp - 0x34], eax
call fcn.100141a2
inc dword [ebp - 0x18]
push 2
pop edx
cmp dword [ebp - 0x18], edx
jle 0x1001b411
xor ecx, ecx
mov eax, dword [ebp - 0x1dc]
dec dword [eax]
jns 0x1001b3ff
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x1dc]
call fcn.100141a2
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jle 0x1001b3aa
xor ebx, ebx
inc ebx
xor edx, edx
mov dword [ebp - 0x14], 0x3342eb9
mov dword [ebp - 0x34], 0x9aed23b6
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xd1d8f8f5
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x14], 7
jmp 0x1001b558
mov dword [ebp - 0x34], 0x565e
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x44], 0x84bc
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001b552
push 0x1d5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
xor edx, edx
inc dword [ebp - 0x44]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jne 0x1001b519
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5dc]
push 0
cmp dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
pop edx
setne cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
jns 0x1001b368
inc dword [ebp - 0x30]
jmp 0x1001b171
lea ecx, [ebp - 0x5dc]
mov dword [ebp - 4], edi
call fcn.100141a2
mov dword [ebp - 0x20], 0x62d5e48d
xor ecx, ecx
mov dword [ebp - 0x44], 0xcb52f506
mov dword [ebp - 0x34], 0x8e20e6e8
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x1001b5d5
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffec
jl 0x1001b808
mov dword [ebp - 0x24], 0x69f
lea ecx, [ebp - 0xfc]
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001b60f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xfff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001b5fc
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, 0x1eb2391c
mov eax, dword [ebp - 0x24]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xaee5
add eax, 0x787d2b73
cmp eax, 0x864b
jge 0x1001b818
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x34], 0x2318
cmp dword [ebp - 0x34], 0x819
jge 0x1001b6ae
lea eax, [ebp - 0x23c]
push eax
push 0x1000c28c
call fcn.10050cbb
pop ecx
pop ecx
push 0xa
pop esi
xor edi, edi
mov ecx, edi
call fcn.1001a5f4
test al, al
je 0x1001b696
mov edx, dword [ebp - 0x23c]
mov ecx, edi
call fcn.1001a62f
cmp eax, esi
cmovl esi, eax
inc edi
cmp edi, 0x42
jl 0x1001b679
push esi
push 0x1000c2c4
call fcn.10050eef
pop ecx
xor edx, edx
or edi, 0xffffffff
pop ecx
mov dword [ebp - 0x48], 0x4d8d955a
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x1001b7ee
xor ebx, ebx
mov dword [ebp - 0x1c], 0xee91b76e
mov dword [ebp - 0x34], 0x2d97
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
cmp dword [eax + ecx*4], ebx
jne 0x1001b7eb
mov eax, dword [ebp - 0x44]
xor ebx, ebx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0xfc]
setle bl
neg ebx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
add ebx, dword [eax + edx*4]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xfc]
cmp dword [eax + esi*4], ebx
setg cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x48]
jle 0x1001b762
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001b7e2
push 0xcc
push ebx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x1001b7e2
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x4c], 3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x40], ebx
jne 0x1001b77e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0xc837e05a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x20], ebx
je 0x1001b7ab
mov eax, dword [ebp - 0xfc]
cmp dword [eax], ebx
je 0x1001b7ab
xor ecx, ecx
inc ecx
jmp 0x1001b7ad
mov ecx, ebx
xor eax, eax
cmp ecx, edi
setne al
sub eax, 0x1006
cmp eax, dword [ebp - 0x34]
jl 0x1001b7c8
cmp dword [ebp - 0x20], ebx
je 0x1001b7c8
xor edx, edx
inc edx
jmp 0x1001b7ca
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x6983816
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x24]
jns 0x1001b6c3
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xfc]
call fcn.100141a2
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
jge 0x1001b5e2
xor ecx, ecx
mov dword [ebp - 0x28], 0x8c6a53d0
mov dword [ebp - 0x28], 0xfffffffa
jmp 0x1001b85d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xfc]
jmp 0x1001b7ee
mov dword [ebp - 0x34], edi
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001b854
push 0x166f
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jge 0x1001b82c
mov dword [ebp - 0x20], 0xac64a684
mov dword [ebp - 0x14], ecx
jmp 0x1001b87d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], 0x274bf90e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001b86f
mov dword [ebp - 0x20], ecx
mov edi, 0x1065aed0
cmp dword [ebp - 0x20], 0x17
je 0x1001b92e
mov dword [ebp - 0x34], 0x1df2
cmp dword [ebp - 0x34], 0xea0
jge 0x1001b915
lea eax, [ebp - 0x120]
mov ecx, edi
push eax
call fcn.10013a74
mov esi, dword [ebp - 0x120]
test esi, esi
je 0x1001b90e
lea eax, [ebp - 0x648]
push eax
push ecx
lea eax, [ebp - 0x234]
mov ecx, edi
push eax
call fcn.10013a74
pop ecx
mov ecx, eax
call fcn.10013a74
mov ecx, dword [ebp - 0x234]
lea eax, [ecx + ecx]
push eax
push ecx
push ecx
mov ecx, 0x1065ae18
call fcn.10013d84
mov edx, 0x1000c4b0
mov ecx, eax
call fcn.10026cf8
pop ecx
mov ecx, eax
call fcn.10013d84
push eax
call fcn.10018a9c
pop ecx
dec esi
jne 0x1001b8bc
dec esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x44], 0x39924432
dec dword [ebp - 0x44]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jne 0x1001b894
xor ecx, ecx
mov dword [ebp - 0x20], ecx
push 3
pop esi
cmp dword [ebp - 0x20], ecx
jl 0x1001b9fe
mov dword [ebp - 0x28], 0x4f27d270
lea ecx, [ebp - 0x43c]
push esi
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001b96a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x43c]
mov dword [eax + ecx*4], 0x6c4a87fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b957
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], edx
jl 0x1001b9de
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x43c]
mov dword [eax], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x20]
imul edx, dword [ebp + eax*4 - 0x58], 0x4868
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
setne cl
imul eax, ecx, 0xa
sub eax, 5
jne 0x1001b9d0
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x58], ecx
jne 0x1001b9d0
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x58], ecx
je 0x1001b9d2
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], ecx
dec dword [ebp - 0x28]
jns 0x1001b977
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
mov dword [ebp + eax*4 - 0x58], ecx
lea ecx, [ebp - 0x43c]
call fcn.100141a2
dec dword [ebp - 0x20]
jns 0x1001b93d
xor ecx, ecx
mov dword [ebp - 0x18], 0x62d5e48d
mov eax, 0x256915a
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x14], ecx
jmp 0x1001ba38
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74c], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ba27
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001ba4f
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
xor ecx, ecx
mov dword [ebp - 0x1ac], 2
cmp dword [ebp - 0x1ac], ecx
jl 0x1001ba7b
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001ba73
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
dec dword [ebp - 0x1ac]
jns 0x1001ba61
mov dword [ebp - 0x2c], 0xcb52f506
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xfffffff7
cmp dword [ebp - 0x20], ecx
je 0x1001bce9
mov dword [ebp - 0x34], 0x18af
cmp dword [ebp - 0x34], 0xdda
jge 0x1001bc97
lea eax, [ebp - 0x68]
push eax
push 0x1000c288
call fcn.10050cbb
pop ecx
pop ecx
push dword [ebp - 0x68]
lea ecx, [ebp - 0x2fc]
call fcn.100140c9
xor eax, eax
mov dword [ebp - 4], esi
mov edi, eax
cmp dword [ebp - 0x68], eax
jle 0x1001baf1
mov esi, dword [ebp - 0x2fc]
push esi
push 0x1000c288
call fcn.10050cbb
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [ebp - 0x68]
jl 0x1001bad9
xor eax, eax
mov dword [ebp - 0x1f4], eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x1f4]
push eax
push ebx
call fcn.10014d48
xor edx, edx
mov byte [ebp - 4], 4
mov eax, edx
mov dword [ebp - 0x40], edx
mov ecx, edx
cmp dword [ebp - 0x68], eax
jle 0x1001bc74
mov ebx, dword [ebp - 0x78]
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x2fc]
mov esi, dword [esi + ecx*4]
sub esi, eax
test esi, esi
jle 0x1001bba2
mov ecx, edx
mov edx, ebx
sub edx, edi
sar edx, 2
test edx, edx
je 0x1001bb6b
push 9
pop eax
sub eax, dword [edi + ecx*4]
cmp esi, eax
jle 0x1001bb66
add esi, 0xfffffff7
add esi, dword [edi + ecx*4]
mov dword [edi + ecx*4], 9
inc ecx
cmp ecx, edx
jb 0x1001bb48
jmp 0x1001bb6b
add dword [edi + ecx*4], esi
xor esi, esi
test esi, esi
jle 0x1001bc26
push 9
pop eax
cmp esi, eax
lea ecx, [ebp - 0x7c]
cmovl eax, esi
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x130]
push eax
call fcn.1002676f
sub esi, dword [ebp - 0x130]
test esi, esi
jg 0x1001bb73
mov edi, dword [ebp - 0x7c]
jmp 0x1001bc23
mov eax, ebx
xor ecx, ecx
sub eax, edi
sar eax, 2
test eax, eax
je 0x1001bbc1
test esi, esi
jg 0x1001bbc1
add esi, dword [edi + ecx*4]
mov edx, ecx
and dword [edi + ecx*4], 0
inc ecx
cmp ecx, eax
jb 0x1001bbaf
lea ecx, [edx + 1]
mov dword [ebp - 0x34], ecx
cmp ecx, eax
jne 0x1001bbea
and dword [ebp - 0x1f8], 0
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x7c]
call fcn.1002676f
mov ebx, dword [ebp - 0x78]
mov edi, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x34]
sub ebx, edi
sar ebx, 2
cmp ecx, ebx
jae 0x1001bc02
mov eax, dword [edi + ecx*4]
inc eax
cmp eax, 0xa
jne 0x1001bc02
and dword [edi + ecx*4], 0
jmp 0x1001bbf3
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 1
push eax
lea ecx, [ebp - 0x7c]
call fcn.1002676f
mov edi, dword [ebp - 0x7c]
lea eax, [esi - 1]
mov dword [edi], eax
mov ebx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x40]
mov esi, ebx
mov ecx, dword [ebp - 0x2fc]
sub esi, edi
sar esi, 2
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x34], eax
jmp 0x1001bc4d
push dword [edi + esi*4]
push 0x1000c288
call fcn.10050eef
pop ecx
pop ecx
dec esi
jns 0x1001bc3e
push 0x1000c1f5
call fcn.100510c7
mov eax, dword [ebp - 0x34]
pop ecx
mov ecx, dword [ebp - 0x40]
inc ecx
push 0
mov dword [ebp - 0x40], ecx
pop edx
cmp ecx, dword [ebp - 0x68]
jl 0x1001bb2c
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x7c]
call fcn.100141a2
or eax, 0xffffffff
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 4], eax
call fcn.100141a2
push 3
xor ecx, ecx
mov edi, 0x1065aed0
pop esi
mov dword [ebp - 0x14], ecx
jmp 0x1001bcad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x700], 0x2061
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001bc9c
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001bcca
push ecx
push 0xc19
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor ecx, ecx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ecx
jl 0x1001bd43
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x700], ecx
jne 0x1001bd43
dec dword [ebp - 0x20]
jns 0x1001bcd6
jmp 0x1001bd43
push ebx
lea ecx, [ebp - 0x370]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001bd0f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x370]
mov dword [eax + ecx*4], 0x94dd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001bcfc
mov dword [ebp - 0x20], edx
jmp 0x1001bd31
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x370]
cmp dword [eax + ecx*4], edx
jne 0x1001bd36
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001bd19
lea ecx, [ebp - 0x370]
call fcn.100141a2
xor ecx, ecx
mov dword [ebp - 0x28], ecx
jmp 0x1001bdb4
mov dword [ebp - 0x14], ecx
jmp 0x1001bd5e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x568], 0x2265e3ed
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001bd4d
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001bd75
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp dword [ebp - 0x560], ecx
je 0x1001bd9b
xor ecx, ecx
mov dword [ebp - 0x34], 0xdade
mov eax, dword [ebp - 0x560]
or edx, 0xffffffff
cmp eax, edx
setne cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
jmp 0x1001bdb1
mov dword [ebp - 0x20], ecx
jmp 0x1001bdab
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ecx
jne 0x1001bdb1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x1001bda0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x1001bd48
mov dword [ebp - 0x34], 0x8e20e6e8
or edx, 0xffffffff
mov byte [ebp - 0xd], cl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], 0x350d8af8
mov dword [ebp - 0x34], 0x4bd47cdd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 0x24]
neg ecx
sub eax, ecx
mov ecx, 0x9dcee34e
sub eax, 6
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 0x5d56974e
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x18]
jg 0x1001be50
mov dword [ebp - 0x34], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x34], 0x2a1c41f3
mov dword [ebp - 0x18], eax
jmp 0x1001bf16
or eax, 0xffffffff
mov dword [ebp - 0x28], 0x7d2ae857
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x44], 0x1ffde63b
push 4
call fcn.100140c9
mov dword [ebp - 0x14], 0
jmp 0x1001be8d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 0xce61fa7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001be7a
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
mov ecx, 0x9db2213a
setge dl
sub eax, edx
sub eax, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x24]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x400]
test edx, edx
setns cl
mov dword [eax + 8], ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x400]
mov eax, dword [ebp - 0x18]
neg eax
add eax, eax
mov dword [ebp - 0x44], eax
call fcn.100141a2
xor eax, eax
cmp byte [ebp - 0xd], 0
je 0x1001bf63
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
jmp 0x1001bf40
cmp byte [ebp - 0xd], 0
je 0x1001bf3d
push 0x2558
push 0x75b
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
mov byte [ebp - 0xd], al
jl 0x1001bf24
cmp byte [ebp - 0xd], 0
je 0x1001bf5c
push 0x1e2f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xffffffec
jl 0x1001cd35
mov dword [ebp - 0x28], ebx
or eax, 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0x6123d4a1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x28], 0x8b13eca4
je 0x1001bfca
mov dword [ebp - 0x14], 0x597a61ee
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001c04a
push 0x22a0
push ecx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x1001c048
mov dword [ebp - 0x30], 0xffffffe4
cmp dword [ebp - 0x30], 0x1d
je 0x1001c04a
push ebx
lea ecx, [ebp - 0x61c]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001bff9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x61c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001bfea
mov dword [ebp - 0x28], edx
jmp 0x1001c02f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], edx
jmp 0x1001c020
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001c01d
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1001c00b
mov dword [ebp - 0x34], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1001c003
lea ecx, [ebp - 0x61c]
call fcn.100141a2
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1d
jne 0x1001bfd7
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001c05b
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor ecx, ecx
mov dword [ebp - 0x30], 0x69f
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x13dce9d
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], esi
push 2
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], ecx
jmp 0x1001c0a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x758], 0xd020bd2a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001c095
mov dword [ebp - 0x20], ecx
jmp 0x1001c0c1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x738], 0x21ec2184
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001c0b0
mov dword [ebp - 0x20], ecx
jmp 0x1001c0dc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x698], 0xb2c5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001c0cb
inc dword [ebp - 0x690]
lea ecx, [ebp - 0x110]
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 4], 5
mov dword [ebp - 0x14], edx
jmp 0x1001c115
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xfff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001c102
mov dword [ebp - 0x28], 0xd5e48d32
mov dword [ebp - 0x28], edx
jmp 0x1001c19b
mov dword [ebp - 0x1c], 0x7d214c40
mov dword [ebp - 0x14], edx
jmp 0x1001c143
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x780], 0x83c8fc55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001c132
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edx
jl 0x1001c198
push ebx
lea ecx, [ebp - 0x388]
call fcn.100140c9
mov dword [ebp - 0x14], 0
jmp 0x1001c179
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x388]
mov dword [eax + ecx*4], 0x9a971867
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001c166
mov eax, dword [ebp - 0x388]
lea ecx, [ebp - 0x388]
inc dword [eax]
call fcn.100141a2
dec dword [ebp - 0x1c]
jns 0x1001c151
xor edx, edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jle 0x1001c126
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, 0x1eb2391c
mov eax, dword [ebp - 0x30]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xaee5
add eax, 0x787d2b73
cmp eax, 0x864b
jge 0x1001cd4f
mov dword [ebp - 0x28], 0x4b1b055c
or edi, 0xffffffff
mov dword [ebp - 0x24], 0x969ac54c
mov dword [ebp - 0x44], 0x56411d7f
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], edx
xor edx, edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x57994279
mov dword [ebp - 0x34], 0x19791169
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], 0xdf15
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 9
jne 0x1001c24a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, ebx
setle cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xb
jmp 0x1001c306
push 4
lea ecx, [ebp - 0x448]
call fcn.100140c9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x580]
mov dword [ebp - 0x34], 0xadaa237f
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x1001c2a1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x448]
mov dword [eax + ecx*4], 0xebf9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001c28e
mov dword [ebp - 0x30], edx
jmp 0x1001c2bf
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x580]
mov dword [eax + ecx*4], 0xe857b1a0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1001c2ac
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x448]
cmp dword [eax + 4], edx
setge cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x580]
mov eax, dword [ebp - 0x44]
sub eax, 8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x48]
call fcn.100141a2
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 5
call fcn.100141a2
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffb
jl 0x1001c263
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x2c0]
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], edx
jmp 0x1001c33c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], 0xec2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001c329
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], edx
jg 0x1001c364
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0
jle 0x1001c349
mov eax, dword [ebp - 0x2c0]
lea ecx, [ebp - 0x2c0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
call fcn.100141a2
mov dword [ebp - 0x40], 0xfffffff8
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x2c], 0x4d8d955a
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], edx
jmp 0x1001c3b1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + ecx*4], 0xec2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001c39e
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], edx
jg 0x1001c3d9
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2d8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0
jle 0x1001c3be
mov eax, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x2d8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
call fcn.100141a2
xor ecx, ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ecx
jl 0x1001cd12
lea edi, [ebp - 0x53c]
lea esi, [ebp - 0x52c]
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x34], 0x1d14cd49
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffee
jne 0x1001c4be
push 3
lea ecx, [ebp - 0x3a0]
call fcn.100140c9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 0x34], 0x5720b963
mov dword [ebp - 0x34], 0xbd652568
push ebx
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x24], edx
jmp 0x1001c46c
cmp dword [ebp - 0x24], 3
jl 0x1001c45d
mov dword [ebp - 0x1c], 0xee91b76e
mov dword [ebp - 0x1c], 0x5872d9ee
mov dword [ebp - 0x44], 0x12df3d37
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x14], ecx
jmp 0x1001c4ec
cmp dword [ebp - 0x14], 3
jl 0x1001c4df
or edi, 0xffffffff
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x110]
call fcn.100141a2
dec dword [ebp - 0x18]
mov edi, 0x1065aed0
cmp dword [ebp - 0x18], 0xffffffec
push 0
pop ecx
jge 0x1001bf72
push 0xfffffffffffffff7
mov dword [ebp - 0x20], ebx
pop edi
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x20], ecx
je 0x1001ceef
mov dword [ebp - 0x14], ecx
jmp 0x1001ceb3
mov dword [ebp - 0x34], 0x23eb
cmp dword [ebp - 0x34], 0xf7d
jge 0x1001cdfc
call fcn.100517e4
push eax
push 0x1000c490
push 0x1000c4b4
call fcn.10051f74
add esp, 0xc
call fcn.100517e4
add eax, 0x20
push eax
push 0x1000c494
push 0x1000c4bc
call fcn.10051f74
add esp, 0xc
lea eax, [ebp - 0x4a8]
mov ecx, edi
push eax
call fcn.10013a74
jmp 0x1001cde2
mov ecx, dword [ebp - 0xd4]
lea eax, [ecx + 1]
imul eax, ecx
dec eax
push eax
lea eax, [ecx - 1]
imul eax, ecx
push ecx
mov ecx, 0x1065ae18
inc eax
push eax
call fcn.10013d84
mov edx, 0x1000c4b0
mov ecx, eax
call fcn.10026cf8
pop ecx
mov ecx, eax
call fcn.10013d84
push eax
call fcn.10018a9c
pop ecx
lea eax, [ebp - 0xd4]
mov ecx, edi
push eax
call fcn.10013a74
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1001cda6
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x2c], 0xb6feb9e9
mov dword [ebp - 0x34], 0xfff8
mov dword [ebp - 0x14], 0
jmp 0x1001ce27
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x644], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ce1a
push 0x18
pop edi
mov dword [ebp - 0x24], edi
jmp 0x1001ce77
mov dword [ebp - 0x2c], 6
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xcf33
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x644]
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jge 0x1001ce34
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x110]
cmp dword [eax], 0
je 0x1001cd0f
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x1001cd15
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x730], 0x2061
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001cea2
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001ced0
push ecx
push 0xc19
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor ecx, ecx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ecx
jl 0x1001cf49
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x730], ecx
jne 0x1001cf49
dec dword [ebp - 0x20]
jns 0x1001cedc
jmp 0x1001cf49
push ebx
lea ecx, [ebp - 0x31c]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001cf15
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x31c]
mov dword [eax + ecx*4], 0x94dd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001cf02
mov dword [ebp - 0x20], edx
jmp 0x1001cf37
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x31c]
cmp dword [eax + ecx*4], edx
jne 0x1001cf3c
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001cf1f
lea ecx, [ebp - 0x31c]
call fcn.100141a2
xor ecx, ecx
mov dword [ebp - 0x28], ecx
jmp 0x1001cfba
mov dword [ebp - 0x14], ecx
jmp 0x1001cf64
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5ac], 0x2265e3ed
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001cf53
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001cf7b
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp dword [ebp - 0x5a4], ecx
je 0x1001cfa1
xor ecx, ecx
mov dword [ebp - 0x34], 0xdade
mov eax, dword [ebp - 0x5a4]
or edx, 0xffffffff
cmp eax, edx
setne cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
jmp 0x1001cfb7
mov dword [ebp - 0x20], ecx
jmp 0x1001cfb1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ecx
jne 0x1001cfb7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x1001cfa6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x1001cf4e
mov dword [ebp - 0x28], 0x8c6a53d0
or esi, 0xffffffff
mov dword [ebp - 0x28], 0xfffffffa
cmp dword [ebp - 0x28], 4
jl 0x1001d00a
mov dword [ebp - 0x34], esi
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001cfff
push 0x166f
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x28]
jmp 0x1001cfd1
mov dword [ebp - 0x34], 0x16f8
cmp dword [ebp - 0x34], 0x98d
jge 0x1001d1f6
lea eax, [ebp - 0x80]
push eax
push 0x1000c28c
call fcn.10050cbb
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
je 0x1001d1f2
dec eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x5c]
push eax
push 0x1000c28c
call fcn.10050cbb
mov eax, dword [ebp - 0x5c]
pop ecx
pop ecx
inc eax
lea ecx, [ebp - 0x290]
push eax
call fcn.100140c9
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x13c]
mov eax, dword [ebp - 0x5c]
inc eax
push eax
call fcn.100140c9
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x5c]
inc eax
push eax
call fcn.100140c9
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], ebx
cmp ecx, ebx
jl 0x1001d0d4
mov eax, dword [ebp - 0x290]
mov edi, dword [ebp - 0x1a0]
mov ebx, dword [ebp - 0x13c]
sub edi, eax
sub ebx, eax
lea esi, [eax + 4]
push esi
push 0x1000c28c
call fcn.10050cbb
mov eax, dword [esi]
mov dword [edi + esi], eax
mov dword [ebx + esi], eax
add esi, 4
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, ecx
jle 0x1001d0ab
xor ebx, ebx
inc ebx
mov edx, ebx
cmp ecx, ebx
jl 0x1001d0f6
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ecx + edx*4 - 4]
cmp dword [ecx + edx*4], eax
cmovg eax, dword [ecx + edx*4]
mov dword [ecx + edx*4], eax
inc edx
mov ecx, dword [ebp - 0x5c]
cmp edx, ecx
jle 0x1001d0da
mov ebx, dword [ebp - 0x1a0]
lea edx, [ecx - 1]
test edx, edx
js 0x1001d117
mov eax, dword [ebx + edx*4 + 4]
cmp dword [ebx + edx*4], eax
cmovg eax, dword [ebx + edx*4]
mov dword [ebx + edx*4], eax
dec edx
jns 0x1001d103
mov ecx, dword [ebp - 0x5c]
xor esi, esi
mov byte [ebp - 0x39], 0
inc esi
lea eax, [ecx - 2]
mov edx, esi
mov dword [ebp - 0x44], edx
cmp eax, esi
jl 0x1001d1ae
lea eax, [ebx + 0xc]
mov bl, byte [ebp - 0x39]
mov dword [ebp - 0x1c], eax
test bl, bl
jne 0x1001d1ba
mov dword [ebp - 0x40], esi
mov eax, 0x3b9aca07
lea esi, [edx + 1]
lea edx, [ecx - 1]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], edx
cmp esi, edx
mov edx, dword [ebp - 0x44]
jg 0x1001d196
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x290]
cmp eax, dword [edi + esi*4]
cmovge eax, dword [edi + esi*4]
mov edi, dword [ebp - 0x13c]
cmp eax, dword [edi + edx*4]
mov edi, dword [ebp - 0x40]
jne 0x1001d17c
cmp eax, dword [ebx]
je 0x1001d25d
mov edi, dword [ebp - 0x13c]
cmp eax, dword [edi + edx*4]
jl 0x1001d193
inc esi
add ebx, 4
inc dword [ebp - 0x40]
cmp esi, dword [ebp - 0x34]
jle 0x1001d159
mov bl, byte [ebp - 0x39]
mov edx, dword [ebp - 0x2c]
lea eax, [ecx - 2]
add dword [ebp - 0x1c], 4
mov dword [ebp - 0x44], edx
push 1
pop esi
cmp edx, eax
jle 0x1001d137
test bl, bl
jne 0x1001d1ba
mov eax, 0x1000c47c
push eax
call fcn.100510c7
pop ecx
lea ecx, [ebp - 0x1a0]
call fcn.100141a2
lea ecx, [ebp - 0x13c]
call fcn.100141a2
or esi, 0xffffffff
lea ecx, [ebp - 0x290]
mov dword [ebp - 4], esi
call fcn.100141a2
mov eax, dword [ebp - 0x80]
push 1
pop ebx
test eax, eax
jne 0x1001d039
push 0xfffffffffffffff7
pop edi
dec eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0x5595
mov dword [ebp - 0x20], 0x90611bc3
mov dword [ebp - 0x18], 0x40c
mov dword [ebp - 0x40], 0xf8de905f
mov dword [ebp - 0x2c], 0x265d6326
imul eax, dword [ebp - 0x20], 0x9e07
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x1001d22e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xcc7c
jg 0x1001d302
xor ecx, ecx
mov dword [ebp - 0x14], ecx
jmp 0x1001d28f
sub ecx, edi
sub ecx, edx
push ecx
push edi
push edx
push 0x1000c4c4
call fcn.10050eef
mov ecx, dword [ebp - 0x5c]
mov bl, 1
add esp, 0x10
mov byte [ebp - 0x39], bl
jmp 0x1001d196
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x220], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001d27e
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ecx
jl 0x1001d393
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ecx
jl 0x1001d2f8
mov dword [ebp - 0x30], ecx
jmp 0x1001d2ee
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ecx
jmp 0x1001d2e6
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x220], ecx
jne 0x1001d2eb
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], ecx
jl 0x1001d2e3
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001d2de
push ecx
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor ecx, ecx
dec dword [ebp - 0x40]
jns 0x1001d2cc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1001d2b5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jle 0x1001d2ad
dec dword [ebp - 0x18]
jns 0x1001d2a8
dec dword [ebp - 0x20]
jns 0x1001d2a0
jmp 0x1001d393
mov dword [ebp - 0x48], edi
xor edx, edx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x14], edx
jmp 0x1001d320
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5fc], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001d30f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x48], 0xffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edx
je 0x1001d342
mov ecx, ebx
cmp dword [ebp - 0x44], edx
jne 0x1001d344
mov ecx, edx
xor eax, eax
cmp ecx, ebx
setge al
imul eax, eax, 0xf58a
test eax, eax
je 0x1001d35c
cmp dword [ebp - 0x44], edx
je 0x1001d35c
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x5fc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x1001d393
push 0x23f2
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x20], ecx
je 0x1001d3f1
mov dword [ebp - 0x14], ecx
jmp 0x1001d3b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6dc], 0x2061
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001d3a3
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001d3d2
push ecx
push 0xc19
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor ecx, ecx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ecx
jl 0x1001d44b
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x6dc], ecx
jne 0x1001d44b
dec dword [ebp - 0x20]
jns 0x1001d3de
jmp 0x1001d44b
push ebx
lea ecx, [ebp - 0x328]
call fcn.100140c9
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001d417
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0x94dd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001d404
mov dword [ebp - 0x20], edx
jmp 0x1001d439
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x328]
cmp dword [eax + ecx*4], edx
jne 0x1001d43e
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001d421
lea ecx, [ebp - 0x328]
call fcn.100141a2
xor ecx, ecx
mov dword [ebp - 0x28], ecx
jmp 0x1001d4ba
mov dword [ebp - 0x14], ecx
jmp 0x1001d466
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x608], 0x2265e3ed
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001d455
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x1001d47e
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp dword [ebp - 0x600], ecx
je 0x1001d4a1
xor ecx, ecx
mov dword [ebp - 0x34], 0xdade
mov eax, dword [ebp - 0x600]
cmp eax, esi
setne cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
jmp 0x1001d4b7
mov dword [ebp - 0x20], ecx
jmp 0x1001d4b1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ecx
jne 0x1001d4b7
cmp dword [ebp - 0x20], 0xd
jge 0x1001d4a6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x1001d450
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x2c], 0xb6feb9e9
mov dword [ebp - 0x34], 0xfff8
mov dword [ebp - 0x14], ecx
jmp 0x1001d4e7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001d4da
push 0x18
pop edi
mov dword [ebp - 0x18], edi
jmp 0x1001d538
mov dword [ebp - 0x2c], 6
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xcf33
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jge 0x1001d4f5
push 2
lea ecx, [ebp - 0xa4]
call fcn.100140c9
mov dword [ebp - 4], 0xd
xor edx, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], edx
jmp 0x1001d570
cmp dword [ebp - 0x14], 2
jl 0x1001d561