Function at 0x1002369f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbac
push esi
push edi
mov dword [ebp - 0x254], 0x8e56f9b2
mov dword [ebp - 0x600], 0x16210b99
mov dword [ebp - 0x110], 0xf4326038
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x210], 0xbff5ecce
mov dword [ebp - 0x158], 0x2ef7e291
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x730], 0xfffffff6
mov dword [ebp - 0x5f0], 0x160c6370
mov dword [ebp - 0x2e8], 0x9f13
mov dword [ebp - 0x740], 9
mov dword [ebp - 0x210], 0xffffffff
cmp dword [ebp - 0x210], 1
jne 0x10023749
mov dword [ebp - 0x6b4], 1
jmp 0x10023750
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x6b4], eax
jge 0x1002376a
mov dword [ebp - 0x680], 1
jmp 0x10023771
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
neg eax
cmp eax, dword [ebp - 0x80]
jge 0x1002378a
mov dword [ebp - 0x688], 1
jmp 0x10023791
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x688]
je 0x100237be
cmp dword [ebp - 0x80], 0
je 0x100237be
mov dword [ebp - 0x690], 1
jmp 0x100237c5
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xfb8eb5ea
jne 0x100237dd
mov dword [ebp - 0x698], 1
jmp 0x100237e4
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 4
jne 0x100237f9
mov dword [ebp - 0x6a0], 1
jmp 0x10023800
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x6a0], eax
jne 0x10023817
mov dword [ebp - 0x710], 1
jmp 0x1002381e
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0x158], 0
je 0x10023848
cmp dword [ebp - 0x158], 0
je 0x10023848
mov dword [ebp - 0x6a8], 1
jmp 0x1002384f
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x6a8], eax
jg 0x10023861
cmp dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x210], eax
jg 0x10023884
mov dword [ebp - 0x6b0], 1
jmp 0x1002388b
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x6b0]
add eax, dword [ebp - 0x148]
jne 0x100238a8
mov dword [ebp - 0x6b8], 1
jmp 0x100238af
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
neg eax
jne 0x100238cb
cmp dword [ebp - 0x148], 0
jne 0x100238cb
and dword [ebp - 0x6c0], 0
jmp 0x100238d5
mov dword [ebp - 0x6c0], 1
cmp dword [ebp - 0x6c0], 0xcda6
jg 0x100238ed
mov dword [ebp - 0x6e4], 1
jmp 0x100238f4
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x110], eax
jl 0x10023920
mov dword [ebp - 0x6ec], 1
jmp 0x10023927
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x730]
add eax, dword [ebp - 0x6ec]
je 0x1002394a
mov eax, 0x3bbb
test eax, eax
je 0x1002394a
mov dword [ebp - 0x6f4], 1
jmp 0x10023951
and dword [ebp - 0x6f4], 0
imul eax, dword [ebp - 0x6f4], 0xfffd
sub eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x5f0]
cmp eax, dword [ebp - 0x5f0]
jge 0x1002397b
mov dword [ebp - 0x738], 1
jmp 0x10023982
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x80], eax
jne 0x100239ae
mov eax, 0xffff
test eax, eax
je 0x100239ae
mov dword [ebp - 0x5f8], 1
jmp 0x100239b5
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x5f8], eax
jne 0x100239cf
mov dword [ebp - 0x2f0], 1
jmp 0x100239d6
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x2f0], eax
je 0x100239f0
mov dword [ebp - 0x2f8], 1
jmp 0x100239f7
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
imul eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x210], 0xc5acc8e1
mov dword [ebp - 0x278], 0x8e56f9b2
mov dword [ebp - 0x340], 0x16210b99
mov dword [ebp - 0x13c], 0xf4326038
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x218], 0xbff5ecce
mov dword [ebp - 0x150], 0x2ef7e291
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x750], 0xfffffff6
mov dword [ebp - 0x330], 0x160c6370
mov dword [ebp - 0x640], 0x9f13
mov dword [ebp - 0x760], 9
mov dword [ebp - 0x218], 0xffffffff
cmp dword [ebp - 0x218], 1
jne 0x10023ab7
mov dword [ebp - 0x608], 1
jmp 0x10023abe
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x608], eax
jge 0x10023ad8
mov dword [ebp - 0x300], 1
jmp 0x10023adf
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
neg eax
cmp eax, dword [ebp - 0x58]
jge 0x10023af8
mov dword [ebp - 0x610], 1
jmp 0x10023aff
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0x610]
je 0x10023b2c
cmp dword [ebp - 0x58], 0
je 0x10023b2c
mov dword [ebp - 0x308], 1
jmp 0x10023b33
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xfb8eb5ea
jne 0x10023b4b
mov dword [ebp - 0x618], 1
jmp 0x10023b52
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 4
jne 0x10023b67
mov dword [ebp - 0x310], 1
jmp 0x10023b6e
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x310], eax
jne 0x10023b85
mov dword [ebp - 0x748], 1
jmp 0x10023b8c
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xad0], eax
cmp dword [ebp - 0x150], 0
je 0x10023bb6
cmp dword [ebp - 0x150], 0
je 0x10023bb6
mov dword [ebp - 0x620], 1
jmp 0x10023bbd
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x620], eax
jg 0x10023bcf
cmp dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x218], eax
jg 0x10023bf2
mov dword [ebp - 0x318], 1
jmp 0x10023bf9
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x11c]
jne 0x10023c16
mov dword [ebp - 0x628], 1
jmp 0x10023c1d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
neg eax
jne 0x10023c39
cmp dword [ebp - 0x11c], 0
jne 0x10023c39
and dword [ebp - 0x320], 0
jmp 0x10023c43
mov dword [ebp - 0x320], 1
cmp dword [ebp - 0x320], 0xcda6
jg 0x10023c5b
mov dword [ebp - 0x630], 1
jmp 0x10023c62
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x13c], eax
jl 0x10023c8e
mov dword [ebp - 0x328], 1
jmp 0x10023c95
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x750]
add eax, dword [ebp - 0x328]
je 0x10023cb8
mov eax, 0x3bbb
test eax, eax
je 0x10023cb8
mov dword [ebp - 0x638], 1
jmp 0x10023cbf
and dword [ebp - 0x638], 0
imul eax, dword [ebp - 0x638], 0xfffd
sub eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x330]
jge 0x10023ce9
mov dword [ebp - 0x758], 1
jmp 0x10023cf0
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0x58], eax
jne 0x10023d1c
mov eax, 0xffff
test eax, eax
je 0x10023d1c
mov dword [ebp - 0x338], 1
jmp 0x10023d23
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x338], eax
jne 0x10023d3d
mov dword [ebp - 0x648], 1
jmp 0x10023d44
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x648], eax
je 0x10023d5e
mov dword [ebp - 0x650], 1
jmp 0x10023d65
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x650]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x218], 0xc5acc8e1
mov dword [ebp - 0x134], 0x25d1
mov dword [ebp - 0xc8], 1
push 3
lea ecx, [ebp - 0x8bc]
call fcn.1000a48a
and dword [ebp - 4], 0
mov dword [ebp - 0x22c], 0
jmp 0x10023dd9
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10023dfb
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x8bc]
call fcn.1000a502
mov dword [eax], 5
jmp 0x10023dcc
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x134]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x134], 0
jmp 0x10023e26
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xe
je 0x10023e9d
mov dword [ebp - 0xc8], 0
jmp 0x10023e48
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x10023e98
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x8bc]
call fcn.1000a502
cmp dword [eax], 0xcb61d225
je 0x10023e76
mov dword [ebp - 0x348], 1
jmp 0x10023e7d
and dword [ebp - 0x348], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x8bc]
call fcn.1000a502
mov ecx, dword [ebp - 0x348]
mov dword [eax], ecx
jmp 0x10023e3b
jmp 0x10023e19
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8bc]
call fcn.1000a4e6
mov dword [ebp - 0x15c], 5
mov dword [ebp - 0x15c], 0xfffffff9
jmp 0x10023ecf
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffe5
jl 0x10023f83
mov dword [ebp - 0x768], 0x2a4f
push 4
lea ecx, [ebp - 0x994]
call fcn.1000a48a
mov dword [ebp - 4], 1
mov dword [ebp - 0x220], 0
jmp 0x10023f13
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x10023f35
push dword [ebp - 0x220]
lea ecx, [ebp - 0x994]
call fcn.1000a502
mov dword [eax], 8
jmp 0x10023f06
cmp dword [ebp - 0x768], 0
je 0x10023f53
cmp dword [ebp - 0x15c], 0
je 0x10023f53
mov dword [ebp - 0x658], 1
jmp 0x10023f5a
and dword [ebp - 0x658], 0
push 3
lea ecx, [ebp - 0x994]
call fcn.1000a502
mov ecx, dword [ebp - 0x658]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x994]
call fcn.1000a4e6
jmp 0x10023ec2
mov dword [ebp - 0x258], 0x8e56f9b2
mov dword [ebp - 0x61c], 0x16210b99
mov dword [ebp - 0x124], 0xf4326038
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x1c8], 0xbff5ecce
mov dword [ebp - 0x154], 0x2ef7e291
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x778], 0xfffffff6
mov dword [ebp - 0x684], 0x160c6370
mov dword [ebp - 0x394], 0x9f13
mov dword [ebp - 0x8a0], 9
mov dword [ebp - 0x1c8], 0xffffffff
cmp dword [ebp - 0x1c8], 1
jne 0x10024010
mov dword [ebp - 0x350], 1
jmp 0x10024017
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x350], eax
jge 0x10024031
mov dword [ebp - 0x660], 1
jmp 0x10024038
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
neg eax
cmp eax, dword [ebp - 0x98]
jge 0x10024054
mov dword [ebp - 0x358], 1
jmp 0x1002405b
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x358]
je 0x1002408b
cmp dword [ebp - 0x98], 0
je 0x1002408b
mov dword [ebp - 0x668], 1
jmp 0x10024092
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0xfb8eb5ea
jne 0x100240aa
mov dword [ebp - 0x360], 1
jmp 0x100240b1
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 4
jne 0x100240c6
mov dword [ebp - 0x670], 1
jmp 0x100240cd
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x670], eax
jne 0x100240e7
mov dword [ebp - 0x770], 1
jmp 0x100240ee
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xa40], eax
cmp dword [ebp - 0x154], 0
je 0x10024118
cmp dword [ebp - 0x154], 0
je 0x10024118
mov dword [ebp - 0x678], 1
jmp 0x1002411f
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x678], eax
jg 0x10024134
cmp dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1c8], eax
jg 0x1002415a
mov dword [ebp - 0x534], 1
jmp 0x10024161
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x534]
add eax, dword [ebp - 0x144]
jne 0x10024181
mov dword [ebp - 0x37c], 1
jmp 0x10024188
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
neg eax
jne 0x100241a4
cmp dword [ebp - 0x144], 0
jne 0x100241a4
and dword [ebp - 0x614], 0
jmp 0x100241ae
mov dword [ebp - 0x614], 1
cmp dword [ebp - 0x614], 0xcda6
jg 0x100241c6
mov dword [ebp - 0x384], 1
jmp 0x100241cd
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x124], eax
jl 0x100241ff
mov dword [ebp - 0x53c], 1
jmp 0x10024206
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x778]
add eax, dword [ebp - 0x53c]
je 0x10024229
mov eax, 0x3bbb
test eax, eax
je 0x10024229
mov dword [ebp - 0x38c], 1
jmp 0x10024230
and dword [ebp - 0x38c], 0
imul eax, dword [ebp - 0x38c], 0xfffd
sub eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x684]
cmp eax, dword [ebp - 0x684]
jge 0x1002425a
mov dword [ebp - 0x780], 1
jmp 0x10024261
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x98], eax
jne 0x10024290
mov eax, 0xffff
test eax, eax
je 0x10024290
mov dword [ebp - 0x544], 1
jmp 0x10024297
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x544], eax
jne 0x100242b1
mov dword [ebp - 0x39c], 1
jmp 0x100242b8
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x39c], eax
je 0x100242d2
mov dword [ebp - 0x3a4], 1
jmp 0x100242d9
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
imul eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x1c8], 0xc5acc8e1
mov dword [ebp - 0x8a8], 0xffffffff
xor eax, eax
inc eax
sub eax, dword [ebp - 0x8a8]
je 0x10024345
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10024343
push 0
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1002436b
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1002436b
push 0
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x12c], 0x25d1
mov dword [ebp - 0xd0], 1
push 3
lea ecx, [ebp - 0x8e0]
call fcn.1000a48a
mov dword [ebp - 4], 2
mov dword [ebp - 0x190], 0
jmp 0x100243ac
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x100243ce
push dword [ebp - 0x190]
lea ecx, [ebp - 0x8e0]
call fcn.1000a502
mov dword [eax], 5
jmp 0x1002439f
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x12c], 0
jmp 0x100243f9
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xe
je 0x10024470
mov dword [ebp - 0xd0], 0
jmp 0x1002441b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jg 0x1002446b
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x8e0]
call fcn.1000a502
cmp dword [eax], 0xcb61d225
je 0x10024449
mov dword [ebp - 0x54c], 1
jmp 0x10024450
and dword [ebp - 0x54c], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x8e0]
call fcn.1000a502
mov ecx, dword [ebp - 0x54c]
mov dword [eax], ecx
jmp 0x1002440e
jmp 0x100243ec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8e0]
call fcn.1000a4e6
push 1
lea ecx, [ebp - 0x790]
call fcn.1000a48a
mov dword [ebp - 4], 3
mov dword [ebp - 0x1d0], 0
jmp 0x100244ac
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x100244ce
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x790]
call fcn.1000a502
mov dword [eax], 0xfffffff7
jmp 0x1002449f
push 0
lea ecx, [ebp - 0x790]
call fcn.1000a502
and dword [eax], 0
jmp 0x10024504
push 0
lea ecx, [ebp - 0x790]
call fcn.1000a502
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x790]
call fcn.1000a502
cmp dword [eax], 0x12
jge 0x10024543
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10024541
push 0x188c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x100244e0
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10024579
push 0
push 0xea4
push 0
push 0x2608
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x790]
call fcn.1000a4e6
push 3
lea ecx, [ebp - 0x244]
call fcn.1000a48a
mov dword [ebp - 4], 4
mov dword [ebp - 0x38], 0xf89b546
mov dword [ebp - 0x6bc], 0xc18ab9c2
mov dword [ebp - 0x114], 0xb28787d6
push 4
lea ecx, [ebp - 0x988]
call fcn.1000a48a
mov byte [ebp - 4], 5
mov dword [ebp - 0x3d4], 0x5036ffe6
mov dword [ebp - 0x2c], 0
jmp 0x100245e2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100245fe
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x244]
call fcn.1000a502
mov dword [eax], 0xf70ad6f2
jmp 0x100245db
mov dword [ebp - 0x2c], 0
jmp 0x1002460e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10024624
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x55c], 0xa33a4d1b
jmp 0x10024607
mov dword [ebp - 0x2c], 0
jmp 0x10024634
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10024650
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x988]
call fcn.1000a502
mov dword [eax], 0xfffffff8
jmp 0x1002462d
mov dword [ebp - 0x38], 2
jmp 0x10024660
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1002498b
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x83c], 0x1210cbed
mov dword [ebp - 0xb04], 0x197cbb40
mov dword [ebp - 0x198], 0
jmp 0x100246a1
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x100246bd
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x894], 1
jmp 0x10024694
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
cmp dword [eax], 0
je 0x100246d5
jmp 0x1002498b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
mov dword [ebp - 0x6bc], 1
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x55c], ecx
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xcd20
jge 0x10024753
cmp dword [ebp - 0xd8], 0
je 0x10024753
mov dword [ebp - 0x554], 1
jmp 0x1002475a
and dword [ebp - 0x554], 0
push 1
lea ecx, [ebp - 0x244]
call fcn.1000a502
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jg 0x1002477d
mov dword [ebp - 0x3bc], 1
jmp 0x10024784
and dword [ebp - 0x3bc], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
mov eax, dword [eax]
add eax, dword [ebp - 0x3bc]
cmp eax, 0xcc5c6a3f
jb 0x100247ad
mov dword [ebp - 0x624], 1
jmp 0x100247b4
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0xffffffff
ja 0x100247c9
mov dword [ebp - 0x3c4], 1
jmp 0x100247d0
and dword [ebp - 0x3c4], 0
mov esi, dword [ebp - 0x3c4]
sub esi, 0x712c
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
cmp esi, dword [eax]
je 0x100247fa
mov dword [ebp - 0x8b0], 1
jmp 0x10024801
and dword [ebp - 0x8b0], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x55c]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x244]
call fcn.1000a502
add esi, dword [eax]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x244]
call fcn.1000a502
imul esi, dword [eax]
cmp esi, dword [ebp - 0x83c]
jg 0x10024861
mov dword [ebp - 0x3cc], 1
jmp 0x10024868
and dword [ebp - 0x3cc], 0
push 0
lea ecx, [ebp - 0x244]
call fcn.1000a502
mov ecx, dword [ebp - 0x3cc]
cmp ecx, dword [eax]
jge 0x1002488b
mov dword [ebp - 0x68c], 1
jmp 0x10024892
and dword [ebp - 0x68c], 0
push 3
lea ecx, [ebp - 0x988]
call fcn.1000a502
mov ecx, dword [ebp - 0x68c]
sub ecx, dword [eax]
je 0x1002490b
mov dword [ebp - 0xa50], 0xe84cbf77
mov dword [ebp - 0xaf0], 0xffffffff
mov dword [ebp - 0xa58], 8
mov dword [ebp - 0x1d8], 0
jmp 0x100248e0
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x100248fc
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xb98], 0x552ad14c
jmp 0x100248d3
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
jmp 0x10024986
mov dword [ebp - 0x114], 0
jmp 0x10024924
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffe2
jle 0x10024986
mov dword [ebp - 0xd8], 0xd
jmp 0x10024946
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xf
jg 0x10024972
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10024970
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
jmp 0x10024939
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x894], 0
je 0x10024984
jmp 0x10024986
jmp 0x10024917
jmp 0x10024659
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x988]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.1000a4e6
mov dword [ebp - 0x728], 0xffffffff
xor eax, eax
inc eax
sub eax, dword [ebp - 0x728]
je 0x100249df
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x100249dd
push 0
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10024a05
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10024a05
push 0
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x844], 0x9aa810d2
mov dword [ebp - 0x62c], 0xfffffff8
push 4
lea ecx, [ebp - 0x9a0]
call fcn.1000a48a
mov dword [ebp - 4], 6
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x71c], 0x9d01078
mov dword [ebp - 0x4c], 0
jmp 0x10024a51
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10024a67
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa9c], 0x7b1891f7
jmp 0x10024a4a
mov dword [ebp - 0x4c], 0
jmp 0x10024a77
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x10024a93
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x9a0]
call fcn.1000a502
mov dword [eax], 0xc93ee327
jmp 0x10024a70
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x10024ab1
push 0x6b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa9c]
cmp eax, dword [ebp - 0x25c]
jle 0x10024adf
mov dword [ebp - 0x564], 1
jmp 0x10024ae6
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x71c]
cmp dword [ebp - 0x564], eax
jne 0x10024b47
push 3
lea ecx, [ebp - 0x9a0]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10024b1f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa9c], 0
jne 0x10024b1f
and dword [ebp - 0x3dc], 0
jmp 0x10024b29
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
jne 0x10024b47
and dword [ebp - 0x3e4], 0
jmp 0x10024b51
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x844], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.1000a4e6
mov dword [ebp - 0x118], 0x25d1
mov dword [ebp - 0xe0], 1
push 3
lea ecx, [ebp - 0x8f8]
call fcn.1000a48a
mov dword [ebp - 4], 7
mov dword [ebp - 0x1a0], 0
jmp 0x10024bad
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10024bcf
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x8f8]
call fcn.1000a502
mov dword [eax], 5
jmp 0x10024ba0
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x118]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x118], 0
jmp 0x10024bfa
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xe
je 0x10024c71
mov dword [ebp - 0xe0], 0
jmp 0x10024c1c
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jg 0x10024c6c
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x8f8]
call fcn.1000a502
cmp dword [eax], 0xcb61d225
je 0x10024c4a
mov dword [ebp - 0x56c], 1
jmp 0x10024c51
and dword [ebp - 0x56c], 0
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x8f8]
call fcn.1000a502
mov ecx, dword [ebp - 0x56c]
mov dword [eax], ecx
jmp 0x10024c0f
jmp 0x10024bed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f8]
call fcn.1000a4e6
push 2
lea ecx, [ebp - 0x174]
call fcn.1000a48a
mov dword [ebp - 4], 8
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x1e0], 0
jmp 0x10024cb4
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x10024cd6
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov dword [eax], 3
jmp 0x10024ca7
mov dword [ebp - 0x18], 0
jmp 0x10024ce6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10024f4c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, 0x7e08a110
sub ecx, dword [eax]
jne 0x10024d13
mov dword [ebp - 0x57c], 1
jmp 0x10024d1a
and dword [ebp - 0x57c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
cmp dword [eax], 0x64f9
je 0x10024d3c
mov dword [ebp - 0x3ec], 1
jmp 0x10024d43
and dword [ebp - 0x3ec], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, dword [ebp - 0x3ec]
cmp ecx, dword [eax]
jne 0x10024d67
mov dword [ebp - 0x6f0], 1
jmp 0x10024d6e
and dword [ebp - 0x6f0], 0
push 1
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, dword [ebp - 0x6f0]
cmp ecx, dword [eax]
jge 0x10024d91
mov dword [ebp - 0x3f4], 1
jmp 0x10024d98
and dword [ebp - 0x3f4], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, dword [ebp - 0x3f4]
cmp ecx, dword [eax]
jl 0x10024dbc
mov dword [ebp - 0x574], 1
jmp 0x10024dc3
and dword [ebp - 0x574], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov esi, dword [ebp - 0x574]
add esi, dword [eax]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x174]
call fcn.1000a502
cmp esi, dword [eax]
jg 0x10024e07
mov dword [ebp - 0x3fc], 1
jmp 0x10024e0e
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x3fc]
jne 0x10024e35
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10024e35
and dword [ebp - 0x634], 0
jmp 0x10024e3f
mov dword [ebp - 0x634], 1
mov eax, dword [ebp - 0x634]
sub eax, 0x6077be49
je 0x10024e6b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
cmp dword [eax], 0
je 0x10024e6b
mov dword [ebp - 0x404], 1
jmp 0x10024e72
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xde9e
jle 0x10024e8a
mov dword [ebp - 0x40c], 1
jmp 0x10024e91
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x57c]
cmp eax, dword [ebp - 0x40c]
je 0x10024eab
mov dword [ebp - 0x694], 1
jmp 0x10024eb2
and dword [ebp - 0x694], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, dword [ebp - 0x694]
cmp ecx, dword [eax]
jle 0x10024ed6
mov dword [ebp - 0x414], 1
jmp 0x10024edd
and dword [ebp - 0x414], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov ecx, dword [ebp - 0x414]
cmp ecx, dword [eax]
jne 0x10024f01
mov dword [ebp - 0x724], 1
jmp 0x10024f08
and dword [ebp - 0x724], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
cmp dword [eax], 9
jb 0x10024f27
mov dword [ebp - 0x584], 1
jmp 0x10024f2e
and dword [ebp - 0x584], 0
mov esi, dword [ebp - 0x584]
sub esi, 3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.1000a502
mov dword [eax], esi
jmp 0x10024cdf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.1000a4e6
push 1
lea ecx, [ebp - 0x7a0]
call fcn.1000a48a
mov dword [ebp - 4], 9
mov dword [ebp - 0x1a8], 0
jmp 0x10024f88
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x10024faa
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x7a0]
call fcn.1000a502
mov dword [eax], 0xfffffff7
jmp 0x10024f7b
push 0
lea ecx, [ebp - 0x7a0]
call fcn.1000a502
and dword [eax], 0
jmp 0x10024fe0
push 0
lea ecx, [ebp - 0x7a0]
call fcn.1000a502
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x41c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7a0]
call fcn.1000a502
cmp dword [eax], 0x12
jge 0x1002501f
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1002501d
push 0x188c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x10024fbc
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x10025055
push 0
push 0xea4
push 0
push 0x2608
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a0]
call fcn.1000a4e6
push 4
lea ecx, [ebp - 0x910]
call fcn.1000a48a
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x87c], 0x39924432
mov dword [ebp - 0x88], 0
jmp 0x1002509b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x100250bd
push dword [ebp - 0x88]
lea ecx, [ebp - 0x910]
call fcn.1000a502
mov dword [eax], 1
jmp 0x1002508e
mov dword [ebp - 0x88], 0
jmp 0x100250d6
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x100250f2
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x72c], 0x74bf
jmp 0x100250c9
push 3
lea ecx, [ebp - 0x910]
call fcn.1000a502
mov esi, eax
push 3
lea ecx, [ebp - 0x910]
call fcn.1000a502
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10025120
mov dword [ebp - 0x63c], 1
jmp 0x10025127
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x87c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x72c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x910]
call fcn.1000a4e6
push 3
lea ecx, [ebp - 0x250]
call fcn.1000a48a
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x3c], 0xf89b546
mov dword [ebp - 0x424], 0xc18ab9c2
mov dword [ebp - 0x120], 0xb28787d6
push 4
lea ecx, [ebp - 0x9b8]
call fcn.1000a48a
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x59c], 0x5036ffe6
mov dword [ebp - 0x24], 0
jmp 0x100251ad
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100251c9
push dword [ebp - 0x24]
lea ecx, [ebp - 0x250]
call fcn.1000a502
mov dword [eax], 0xf70ad6f2
jmp 0x100251a6
mov dword [ebp - 0x24], 0
jmp 0x100251d9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x100251ef
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x43c], 0xa33a4d1b
jmp 0x100251d2
mov dword [ebp - 0x24], 0
jmp 0x100251ff
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002521b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9b8]
call fcn.1000a502
mov dword [eax], 0xfffffff8
jmp 0x100251f8
mov dword [ebp - 0x3c], 2
jmp 0x1002522b
cmp dword [ebp - 0x3c], 0
jl 0x10025556
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x734], 0x1210cbed
mov dword [ebp - 0xb14], 0x197cbb40
mov dword [ebp - 0x1e8], 0
jmp 0x1002526c
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x10025288
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x8a4], 1
jmp 0x1002525f
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
cmp dword [eax], 0
je 0x100252a0
jmp 0x10025556
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x58c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58c]
mov dword [ebp + eax - 0x43c], ecx
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xcd20
jge 0x1002531e
cmp dword [ebp - 0xe8], 0
je 0x1002531e
mov dword [ebp - 0x42c], 1
jmp 0x10025325
and dword [ebp - 0x42c], 0
push 1
lea ecx, [ebp - 0x250]
call fcn.1000a502
mov ecx, dword [ebp - 0x42c]
cmp ecx, dword [eax]
jg 0x10025348
mov dword [ebp - 0x6c4], 1
jmp 0x1002534f
and dword [ebp - 0x6c4], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
mov eax, dword [eax]
add eax, dword [ebp - 0x6c4]
cmp eax, 0xcc5c6a3f
jb 0x10025378
mov dword [ebp - 0x434], 1
jmp 0x1002537f
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xffffffff
ja 0x10025394
mov dword [ebp - 0x594], 1
jmp 0x1002539b
and dword [ebp - 0x594], 0
mov esi, dword [ebp - 0x594]
sub esi, 0x712c
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
cmp esi, dword [eax]
je 0x100253c5
mov dword [ebp - 0x84c], 1
jmp 0x100253cc
and dword [ebp - 0x84c], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x43c]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x250]
call fcn.1000a502
add esi, dword [eax]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x250]
call fcn.1000a502
imul esi, dword [eax]
cmp esi, dword [ebp - 0x734]
jg 0x1002542c
mov dword [ebp - 0x644], 1
jmp 0x10025433
and dword [ebp - 0x644], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.1000a502
mov ecx, dword [ebp - 0x644]
cmp ecx, dword [eax]
jge 0x10025456
mov dword [ebp - 0x444], 1
jmp 0x1002545d
and dword [ebp - 0x444], 0
push 3
lea ecx, [ebp - 0x9b8]
call fcn.1000a502
mov ecx, dword [ebp - 0x444]
sub ecx, dword [eax]
je 0x100254d6
mov dword [ebp - 0xa60], 0xe84cbf77
mov dword [ebp - 0xb00], 0xffffffff
mov dword [ebp - 0xa68], 8
mov dword [ebp - 0x1b0], 0
jmp 0x100254ab
mov dword [ebp - 0x120], 0
jmp 0x100254ef
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x9b8]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.1000a4e6
push 2
lea ecx, [ebp - 0x7b0]
call fcn.1000a48a
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x128], 0
push 3
lea ecx, [ebp - 0x9d0]
call fcn.1000a48a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x68], 0
jmp 0x100255b3
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x100255cf
push dword [ebp - 0x68]
lea ecx, [ebp - 0x7b0]
call fcn.1000a502
mov dword [eax], 0xfffffff8
jmp 0x100255ac
mov dword [ebp - 0x68], 0
jmp 0x100255df
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x100255fb
push dword [ebp - 0x68]
lea ecx, [ebp - 0x9d0]
call fcn.1000a502
mov dword [eax], 0x9d19ac19
jmp 0x100255d8
mov dword [ebp - 0x128], 1
jmp 0x10025614
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x1002566a
push dword [ebp - 0x128]
lea ecx, [ebp - 0x7b0]
call fcn.1000a502
mov esi, eax
push dword [ebp - 0x128]
lea ecx, [ebp - 0x7b0]
call fcn.1000a502
mov esi, dword [esi]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x9d0]
call fcn.1000a502
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x7b0]
call fcn.1000a502
cmp dword [eax], 0
je 0x10025668
jmp 0x10025607
jmp 0x10025607
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x10025698
push 0
push 0x195
push 0x2ec
push 0x1d34
push 0x65b
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x9d0]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b0]
call fcn.1000a4e6
mov dword [ebp - 0x73c], 0xffffffff
xor eax, eax
inc eax
sub eax, dword [ebp - 0x73c]
je 0x100256ec
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x100256ea
push 0
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10025712
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10025712
push 0
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x744], 0x9aa810d2
mov dword [ebp - 0x454], 0xfffffff8
push 4
lea ecx, [ebp - 0x934]
call fcn.1000a48a
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x854], 0x9d01078
mov dword [ebp - 0xa8], 0
jmp 0x10025767
cmp dword [ebp - 0xa8], 3
jge 0x10025783
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xaac], 0x7b1891f7
jmp 0x1002575a
mov dword [ebp - 0xa8], 0
jmp 0x1002579c