Function at 0x10008d2d
Capabilities:
Accept command line arguments
Connect pipe
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get geographical location
Get memory capacity
Parse pe header
Query or enumerate registry key
Set thread local storage value

Disassembly:
mov eax, 0x100840f2
call fcn.10083320
mov eax, 0x16cc
call fcn.1007fad0
xor eax, eax
mov byte [ebp - 0x61], dl
inc eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], eax
push ebx
mov dword [ebp - 0x6c0], eax
or ebx, 0xffffffff
mov dword [ebp - 0x6bc], eax
xor eax, eax
push esi
mov dword [ebp - 0x2c], ebx
push edi
mov dword [ebp - 0x14], 0xbda73a15
mov dword [ebp - 0x34], 8
push 3
mov dword [ebp - 0x2c], eax
pop edi
cmp dword [ebp - 0x2c], edi
jg 0x10008e76
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008da2
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10008dbc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jl 0x10008dbc
inc eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setge bl
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x6c8], esi
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x10008e27
xor eax, eax
cmp dword [ebp - 0x6c0], eax
je 0x10008e29
lea ecx, [eax + 1]
jmp 0x10008e2b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x10008e4c
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x6c0]
cmp eax, 0xc0e4
push 0
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
pop eax
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x2c], edi
jle 0x10008d8a
or ebx, ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x10008ed3
mov dword [ebp - 0x14], eax
jmp 0x10008eca
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10008ec7
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008eaa
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008ec2
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10008e93
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x10008e84
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x10008e7f
xor esi, esi
inc esi
mov dword [ebp - 0x6f8], esi
mov dword [ebp - 0x6f4], esi
mov dword [ebp - 0x6f0], esi
mov dword [ebp - 0x6ec], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], 0xbda73a15
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jg 0x10008fff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10008f28
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10008f45
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x14]
jl 0x10008f43
mov eax, esi
jmp 0x10008f45
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x38]
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x6f8], esi
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge bl
xor edx, edx
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x10008fad
xor eax, eax
cmp dword [ebp - 0x6f0], eax
je 0x10008faf
lea ecx, [eax + 1]
jmp 0x10008fb1
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x10008fd2
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x6f0]
cmp eax, 0xc0e4
push 0
pop eax
setl cl
push 1
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
pop esi
push 0xffffffffffffffff
pop ebx
cmp dword [ebp - 0x2c], edi
jle 0x10008f10
or ebx, ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1000905c
mov dword [ebp - 0x14], eax
jmp 0x10009053
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], eax
jl 0x10009050
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009033
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000904b
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1000901c
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x1000900d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x10009008
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x34], 0x49d585ed
mov dword [ebp - 0x48], 0x9a5a40f2
mov dword [ebp - 0x30], 0xa519d814
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], 0x70ce404d
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], ebx
push 2
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x100090b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe88], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100090a2
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov edi, 0xfffff77f
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe88]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, esi
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setge cl
sub eax, ecx
add eax, dword [ebp - 0x38]
jne 0x1000912d
cmp dword [ebp - 0x50], eax
jne 0x1000912f
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x9f11
sub eax, dword [ebp - 0x54]
je 0x1000913b
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000913d
lea edx, [eax + 1]
jmp 0x1000913f
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000910a
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000910c
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub edx, eax
xor eax, eax
cmp ecx, edx
setle al
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0x825e7a66
mov dword [ebp - 0x2c], 0x13d
mov dword [ebp - 0x34], 0x54efd0e6
dec dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], 0x14
jl 0x1000942d
mov dword [ebp - 0x14], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x1c], 0x7d38c461
mov dword [ebp - 0x14], eax
push 2
pop esi
cmp dword [ebp - 0x14], ebx
jge 0x100091b0
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2bc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000919c
jmp 0x100091b3
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jl 0x1000933c
mov dword [ebp - 0x48], eax
push 7
pop ecx
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x938], ecx
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x3c], 0x12f69a01
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffef
jne 0x10009314
xor edi, edi
movdqa xmm0, xmmword [0x10007a80]
lea eax, [ebp - 0x11bc]
push eax
lea eax, [ebp - 0x11cc]
push eax
lea ecx, [ebp - 0x1500]
movdqu xmmword [ebp - 0x11cc], xmm0
call fcn.10025515
lea ecx, [ebp - 0x1e4]
mov esi, eax
call fcn.10008d2a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa44]
push dword [esi]
call fcn.100254d7
mov dword [ebp - 4], edi
xor ecx, ecx
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x2c]
cmp eax, 0x129b45e8
setle cl
cmp ecx, 0xfffa
jbe 0x1000927e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x934], edx
mov eax, dword [ebp - 0x48]
cmp edx, eax
push ebx
setle cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xa44]
mov eax, dword [ebp - 0x3c]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x2bc]
sub eax, 0x578
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.10025506
push ebx
lea ecx, [ebp - 0xa44]
call fcn.10025506
xor ecx, ecx
imul edx, dword [eax], 7
mov eax, dword [ebp - 0x2bc]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10025501
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x10009215
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10009418
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009332
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10009320
jmp 0x10009418
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009360
xor edi, edi
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x924], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000934c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jg 0x100093e1
mov dword [ebp - 0x30], 0xd727ab81
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0x8cafaca8
mov esi, dword [ebp - 0x920]
mov ecx, dword [ebp - 0x30]
dec esi
mov eax, dword [ebp - 0x2bc]
neg esi
push 1
sbb esi, esi
neg ecx
xor ebx, ebx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge bl
sub esi, eax
add esi, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x30]
add ebx, 0x3430537
mov eax, dword [ebp - 0x30]
cmp ebx, esi
pop ebx
setle dl
add eax, edx
xor edx, edx
add ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
jle 0x10009369
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x10009412
mov dword [ebp - 0x1c], ecx
jmp 0x10009409
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x10009400
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jl 0x100093f4
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jg 0x100093eb
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff4
jl 0x100093e6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
push 2
pop ebx
jge 0x1000917e
mov edi, 0xfffff77f
xor eax, eax
or ebx, 0xffffffff
inc eax
mov ecx, 0xbda73a15
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x72c], eax
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1000957c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100094a2
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100094bc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jl 0x100094bc
inc eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setge bl
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x738], esi
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x10009527
xor eax, eax
cmp dword [ebp - 0x730], eax
je 0x10009529
lea ecx, [eax + 1]
jmp 0x1000952b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edi, edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edi
jne 0x1000954c
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x730]
cmp eax, 0xc0e4
push 0
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
push 0xffffffffffffffff
pop ebx
jle 0x1000948a
mov edi, 0xfffff77f
or ebx, ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x100095dd
mov dword [ebp - 0x14], eax
jmp 0x100095d4
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x100095d1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100095b4
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100095cc
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1000959d
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x1000958a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x10009585
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x100096e8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000960e
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10009628
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jl 0x10009628
inc eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setge bl
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x6d8], esi
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x10009693
xor eax, eax
cmp dword [ebp - 0x6d0], eax
je 0x10009695
lea ecx, [eax + 1]
jmp 0x10009697
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edi, edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edi
jne 0x100096b8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x6d0]
cmp eax, 0xc0e4
push 0
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
push 0xffffffffffffffff
pop ebx
jle 0x100095f6
mov edi, 0xfffff77f
or ebx, ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x10009749
mov dword [ebp - 0x14], eax
jmp 0x10009740
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1000973d
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009720
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009738
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10009709
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x100096f6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x100096f1
mov ecx, 0xffff
xor edx, edx
mov dword [ebp - 0x1c], ecx
inc edx
mov dword [ebp - 0x30], 0x462ccd20
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], 0x2e71
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10009795
xor edi, edi
inc edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x290], 0xa90ef874
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10009778
mov edi, 0xfffff77f
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x100097be
xor edi, edi
inc edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x588], 0x1a0197cb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100097a3
mov edi, 0xfffff77f
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100097eb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], ecx
jne 0x10009803
cmp dword [ebp - 0x290], eax
je 0x10009812
cmp dword [ebp - 0x290], eax
je 0x10009812
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10009815
xor ecx, ecx
inc ecx
add eax, 0x3da550e8
cmp eax, dword [ebp - 0x30]
jle 0x1000982a
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000982c
mov eax, ecx
jmp 0x1000982c
xor eax, eax
mov dword [ebp - 0x588], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xfffffffe
inc eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], 0x49d585ed
mov dword [ebp - 0x48], 0x9a5a40f2
mov dword [ebp - 0x30], 0xa519d814
push 9
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x70ce404d
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x10009888
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdf0], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009877
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
inc edx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdf0]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, edx
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setge cl
sub eax, ecx
add eax, dword [ebp - 0x38]
jne 0x10009900
cmp dword [ebp - 0x50], eax
jne 0x10009902
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x9f11
sub eax, dword [ebp - 0x54]
je 0x1000990e
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10009910
lea edx, [eax + 1]
jmp 0x10009912
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100098dd
xor eax, eax
lea edx, [eax + 1]
jmp 0x100098df
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub edx, eax
xor eax, eax
push ebx
cmp ecx, edx
lea ecx, [ebp - 0xa08]
setle al
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x19ac196a
mov dword [ebp - 0x14], 0x9570
call fcn.10025495
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000996a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x95c], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009952
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009994
push 2
xor ebx, ebx
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa08]
call fcn.10025506
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009977
xor esi, esi
inc esi
jmp 0x10009996
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add ecx, 0x5c6f8b8a
cmp ecx, eax
setl dl
mov dword [ebp - 0x958], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, 0x2c6e
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jne 0x10009aa0
mov dword [ebp - 0x14], 0xffffffe8
cmp dword [ebp - 0x14], 0x31
jg 0x10009a1e
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009a15
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x31
jle 0x10009a03
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0xa08]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x1c], 0x6de713a4
xor eax, eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009a62
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15e4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009a4a
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10009b02
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
or eax, 0xffffffff
sub eax, ecx
add eax, dword [ebp - 0x1c]
jne 0x10009b00
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10009b05
mov dword [ebp - 0x30], 0x46e74a6e
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x34], 0x280bfe73
or eax, 0xffffffff
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x8214d2fc
push 3
mov dword [ebp - 0x34], 0x14ba09a1
pop esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10025506
inc dword [eax]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x958], eax
jmp 0x10009a21
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10009b1e
mov dword [ebp - 0x48], 0xc7747bb7
dec dword [ebp - 0x48]
jmp 0x10009ba7
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0xffffffe9
cmp dword [ebp - 0x2c], esi
jle 0x10009b93
push 2
pop ebx
mov dword [ebp - 0x10], 0xde661fbc
cmp dword [ebp - 0x10], eax
jne 0x10009b90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10009b88
mov dword [ebp - 0x28], 0x9eb818f8
cmp dword [ebp - 0x2c], eax
jne 0x10009b77
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp eax, 7
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 4
jge 0x10009b74
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x10009b4b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jg 0x10009b37
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], eax
jmp 0x10009ba1
mov dword [ebp - 0x48], ebx
dec dword [ebp - 0x48]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jg 0x10009b98
mov dword [ebp - 0x728], ebx
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0x720], ebx
mov dword [ebp - 0x71c], ebx
mov dword [ebp - 0x14], 0xb26bdde0
mov dword [ebp - 0x14], eax
jmp 0x10009be5
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009bdd
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009beb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jne 0x10009bcb
or eax, 0xffffffff
lea ecx, [ebp - 0xc78]
mov dword [ebp - 0x1c], eax
push esi
call fcn.10025495
push 2
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009c27
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc78]
call fcn.10025506
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009c0d
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009c38
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push ebx
lea ecx, [ebp - 0xc78]
call fcn.10025506
or esi, 0xffffffff
lea ecx, [ebp - 0xc78]
mov dword [ebp - 4], esi
mov dword [eax], 0xec0ae971
call fcn.10025501
mov dword [ebp - 0x24], 0xbda73a15
mov dword [ebp - 0x10], 0x825e7a66
mov dword [ebp - 0x2c], 0x13d
mov dword [ebp - 0x34], 0x54efd0e6
dec dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], 0x14
jl 0x10009f3c
push 2
pop esi
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x1c], 0x7d38c461
mov dword [ebp - 0x14], eax
jmp 0x10009cb3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x360], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009ca6
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x35c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jl 0x10009e43
mov dword [ebp - 0x48], eax
push 7
pop ecx
mov dword [ebp - 0x954], ecx
mov dword [ebp - 0x950], ecx
mov dword [ebp - 0x94c], ecx
mov dword [ebp - 0x948], ecx
mov dword [ebp - 0x3c], 0x12f69a01
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffef
jne 0x10009e1b
movdqa xmm0, xmmword [0x10007a80]
lea eax, [ebp - 0x12dc]
push eax
lea eax, [ebp - 0x12ec]
push eax
lea ecx, [ebp - 0x1480]
movdqu xmmword [ebp - 0x12ec], xmm0
call fcn.10025515
lea ecx, [ebp - 0x1bf]
mov esi, eax
call fcn.10008d2a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa20]
push dword [esi]
call fcn.100254d7
mov dword [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x2c]
cmp eax, 0x129b45e8
setle cl
cmp ecx, 0xfffa
jbe 0x10009d85
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x94c], edx
mov eax, dword [ebp - 0x48]
cmp edx, eax
push ebx
setle cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0xa20]
mov eax, dword [ebp - 0x3c]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x360]
sub eax, 0x578
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.10025506
push ebx
lea ecx, [ebp - 0xa20]
call fcn.10025506
xor ecx, ecx
imul edx, dword [eax], 7
mov eax, dword [ebp - 0x360]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], edi
call fcn.10025501
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x10009d18
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10009f27
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009e39
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10009e27
jmp 0x10009f27
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009e69
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009e51
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jg 0x10009eed
mov dword [ebp - 0x30], 0xd727ab81
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0x8cafaca8
mov esi, dword [ebp - 0x908]
mov ecx, dword [ebp - 0x30]
dec esi
mov eax, dword [ebp - 0x360]
neg esi
push 1
sbb esi, esi
neg ecx
xor ebx, ebx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge bl
sub esi, eax
add esi, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x30]
add ebx, 0x3430537
mov eax, dword [ebp - 0x30]
cmp ebx, esi
pop ebx
setle dl
add eax, edx
xor edx, edx
add ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
jle 0x10009e72
push 2
xor eax, eax
or ecx, 0xffffffff
pop esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff4
jge 0x10009f24
mov dword [ebp - 0x1c], ecx
jmp 0x10009f19
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x10009f10
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jl 0x10009f04
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jg 0x10009efb
dec dword [ebp - 0x10]
jmp 0x10009ef0
or edi, 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jge 0x10009c91
mov edi, 0xfffff77f
or esi, 0xffffffff
mov dword [ebp - 0x34], 8
xor eax, eax
inc eax
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], eax
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], 0xbda73a15
mov dword [ebp - 0x34], 8
push 3
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], ebx
jg 0x1000a074
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10009f98
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10009fb2
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jl 0x10009fb2
inc eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setge bl
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x6e8], esi
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000a01d
xor eax, eax
cmp dword [ebp - 0x6e0], eax
je 0x1000a01f
lea ecx, [eax + 1]
jmp 0x1000a021
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edi, edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edi
jne 0x1000a042
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x6e0]
cmp eax, 0xc0e4
push 3
pop ebx
setl cl
push 0
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
pop eax
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x2c], ebx
jle 0x10009f80
mov edi, 0xfffff77f
or esi, esi
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1000a0d1
mov dword [ebp - 0x14], eax
jmp 0x1000a0c8
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1000a0c5
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a0a8
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a0c0
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1000a091
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x1000a082
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x1000a07d
mov dword [ebp - 0x14], 0xe971
lea ecx, [ebp - 0xbb8]
push ebx
call fcn.10025495
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x34], 0x5bf2d3f5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000a11b
push dword [ebp - 0x24]
lea ecx, [ebp - 0xbb8]
call fcn.10025506
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000a101
xor eax, eax
push eax
lea ecx, [ebp - 0xbb8]
call fcn.10025506
mov ecx, dword [ebp - 0x14]
push 2
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1000a224
xor edi, edi
inc edi
jmp 0x1000a144
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x6ce4a6f4
mov dword [ebp - 0x34], 0xa53061ec
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x4431fada
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x7779a7b4
mov dword [ebp - 0x34], 0x85dc1b6e
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1168]
push edi
call fcn.10025495
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x48], 0x67dbf129
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1000a1c6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1168]
call fcn.10025506
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000a1ab
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000a1e6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1510], 0x261718bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000a1ce
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000a1fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe20], 0x93cc9d6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000a1eb
dec dword [ebp - 0x48]
lea ecx, [ebp - 0x1168]
mov byte [ebp - 4], 4
call fcn.10025501
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000a142
mov edi, 0xfffff77f
or eax, 0xffffffff
lea ecx, [ebp - 0xbb8]
mov dword [ebp - 4], eax
call fcn.10025501
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1000a9bc
xor edi, edi
inc edi
push ebx
lea ecx, [ebp - 0xa38]
call fcn.10025495
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a288
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa38]
call fcn.10025506
mov dword [eax], 0xff0ea75c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a26a
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a29a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000a2de
mov dword [ebp - 0x28], 0xbbef7d65
push dword [ebp - 0x14]
call fcn.10025506
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax]
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a2db
push eax
push 0x1052
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
inc dword [ebp - 0x14]
lea ecx, [ebp - 0xa38]
cmp dword [ebp - 0x14], esi
jle 0x1000a29f
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10025501
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x42c7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xf27779e4
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xcbd72f54
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a338
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1678], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a323
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000a34e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe9c], 0xa2b52f10
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a33d
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], ecx
xor eax, eax
mov dword [ebp - 0x34], 0x455d89f
mov dword [ebp - 0x34], 0x32f8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000a392
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6a8], 0xcb0b9d62
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000a374
xor edi, edi
xor eax, eax
inc edi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a3a9
push eax
push 0xe47
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0xe9c], 0xd177
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
cmp eax, 0xd177
jge 0x1000a3c4
mov eax, edi
jmp 0x1000a3c9
xor edi, edi
mov eax, edi
inc edi
mov dword [ebp - 0x6a8], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1000a3e2
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a415
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8ec], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a3fd
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a435
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x8ec], 0xfffffffc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a41d
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x1000a4f6
or edi, 0xffffffff
mov dword [ebp - 0x30], 0xee327439
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x10], 0x10e6b6cd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, edi
sbb ecx, ecx
xor eax, eax
neg ecx
add ecx, esi
cmp ecx, 5
setle al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0xaa81
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8e4]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8e8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8e4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1000a444
xor edi, edi
xor eax, eax
inc edi
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x50], 0x7d37
mov dword [ebp - 0x54], 0xe117
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000a546
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d4], 0x13638ecf
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1000a528
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a566
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd38], 0xb722ba7b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a54e
xor eax, eax
mov dword [ebp - 0x10], 0x19
jmp 0x1000a5cd
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000a5a1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x16c8], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000a588
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000a5c7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0x23b6182e
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1000a5a9
xor edi, edi
xor eax, eax
inc edi
dec dword [ebp - 0x48]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jl 0x1000a56f
cmp dword [ebp - 0x1d4], eax
je 0x1000a5f4
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd38]
mov eax, dword [ebp - 0xd30]
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000a5f6
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x10]
cmp ecx, 0xe41b
setl al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd38]
setg cl
xor edx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
xor ebx, ebx
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1d4]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl bl
sub ebx, 0xedb553a8
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setl cl
imul eax, ecx, 0x95c4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0xf928
neg eax
sbb eax, eax
or ebx, 0xffffffff
inc eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x15], al
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], 0x60b0ceaf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000a6af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1490], 0xf9b3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000a697
xor eax, eax
xor edi, edi
mov dword [ebp - 0x14], eax
inc edi
jmp 0x1000a6e0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1000a6dd
push eax
push 0x750
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1000a6b7
cmp byte [ebp - 0x15], 0
je 0x1000a87e
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x704], edi
mov dword [ebp - 0x700], edi
mov dword [ebp - 0x6fc], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], 0xbda73a15
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1000a811
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000a73d
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000a75a
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x14]
jl 0x1000a758
mov eax, edi
jmp 0x1000a75a
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg ecx
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x38]
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x708], esi
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge bl
xor edx, edx
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x2c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000a7c1
xor eax, eax
cmp dword [ebp - 0x700], eax
je 0x1000a7c3
mov ecx, edi
jmp 0x1000a7c5
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x1000a7e6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x700]
cmp eax, 0xc0e4
push 0
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
pop eax
push 0xffffffffffffffff
pop ebx
jle 0x1000a725
or ebx, ebx
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x1000a872
mov dword [ebp - 0x14], eax
jmp 0x1000a869
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1000a866
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000a849
push 0x1135
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000a861
push eax
push 0x15e
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1000a832
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jle 0x1000a81f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x1000a81a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x34], 0x2e0cf572
lea ecx, [ebp - 0xe38]
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x34], 0x7831e42a
mov dword [ebp - 0x48], 0xcbad86e5
mov dword [ebp - 0x34], eax
push 4
call fcn.10025495
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
jmp 0x1000a8ca
push dword [ebp - 0x14]
call fcn.10025506
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0xe38]
jl 0x1000a8b9
inc dword [ebp - 0x48]
inc dword [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.10025501
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a903
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x24]
jl 0x1000a901
mov eax, edi
jmp 0x1000a903
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x38]
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x728], esi
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor edx, edx
cmp ebx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [ebp - 0x1c]
cmp esi, edx
setne al
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000a96a
xor eax, eax
cmp dword [ebp - 0x720], eax
je 0x1000a96c
mov ecx, edi
jmp 0x1000a96e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x1000a98f
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x720]
cmp eax, 0xc0e4
push 3
setl cl
pop ebx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x1c]
push 2
pop esi
cmp dword [ebp - 0x1c], ebx
jle 0x1000a246
mov edi, 0xfffff77f
push ebx
lea ecx, [ebp - 0xe50]
call fcn.10025495
push 9
pop eax
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a9ff
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe50]
call fcn.10025506
mov dword [eax], 0xc93b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a9e1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1000aad4
xor esi, esi
push 2
inc esi
pop edi
push esi
lea ecx, [ebp - 0x1078]
call fcn.10025495
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa50]
mov dword [ebp - 0x34], 0xe008fb0b
push ebx
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000aa60
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1078]
call fcn.10025506
mov dword [eax], 0x13e13a6c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000aa42
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000aa72
push dword [ebp - 0x10]
call fcn.10025506
mov dword [eax], esi
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xa50]
cmp dword [ebp - 0x10], ebx
jl 0x1000aa65
push esi
call fcn.10025506
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1000aaa5
push 0x1d60
push eax
push 0x172e
push 0x19f9
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [ebp - 0xa50]
call fcn.10025501
push 9
pop eax
lea ecx, [ebp - 0x1078]
mov byte [ebp - 4], al
call fcn.10025501
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1000aa11
mov edi, 0xfffff77f
jmp 0x1000aad7
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0xe50]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x1c], 0xffffffe4
or ecx, 0xffffffff
cmp dword [ebp - 0x1c], ecx
je 0x1000b79a
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0xa68]
push ebx
call fcn.10025495
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000ab39
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa68]
call fcn.10025506
mov dword [eax], 0x57e71f09
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000ab1b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000ac5b
push 2
pop edi
push edi
lea ecx, [ebp - 0x510]
call fcn.10025495
push esi
lea ecx, [ebp - 0xbd0]
mov byte [ebp - 4], 0xd
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000ab8c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x510]
call fcn.10025506
mov dword [eax], 0x20fe6e32
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000ab6e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000aba8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbd0]
call fcn.10025506
mov dword [eax], 0x989d221e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000ab91
push esi
lea ecx, [ebp - 0x510]
call fcn.10025506
xor edi, edi
mov dword [eax], edi
jmp 0x1000ac13
mov dword [ebp - 0x48], 0x7928fbc7
lea ecx, [ebp - 0xbd0]
mov dword [ebp - 0x28], 0xee4e9120
push edi
call fcn.10025506
imul edx, dword [ebp - 0x48], 0xd63a
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
push edi
cmp ecx, edx
lea ecx, [ebp - 0xa68]
setg al
add eax, dword [ebp - 0x14]
mov dword [esi], eax
call fcn.10025506
mov ecx, dword [ebp - 0x28]
xor esi, esi
inc esi
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0x510]
call fcn.10025506
inc dword [eax]
push esi
lea ecx, [ebp - 0x510]
call fcn.10025506
cmp dword [eax], 0x1c
je 0x1000abbf
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1000ac3e
push eax
push eax
push 0x17d6
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea ecx, [ebp - 0xbd0]
call fcn.10025501
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 0xc
call fcn.10025501
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jle 0x1000ab41
or eax, 0xffffffff
lea ecx, [ebp - 0xa68]
mov dword [ebp - 4], eax
call fcn.10025501
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffed
jg 0x1000b786
push 2
pop edi
jmp 0x1000ac8c
xor eax, eax
mov dword [ebp - 0x48], 0xb4e1265a
mov dword [ebp - 0x4c], 0x418a5273
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], eax
jmp 0x1000acc1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x32c], 0x14b58e17
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000acb0
mov eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0x328]
jne 0x1000acdd
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], 0xfffffff8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x328], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1000ad27
push 0x2619
push eax
push 0x24fb
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x4c], 8
lea ecx, [ebp - 0x8b0]
push esi
call fcn.10025495
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x28], 0x15912491
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000ad77
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8b0]
call fcn.10025506
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000ad59
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1000ada5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8b0]
call fcn.10025506
lea ecx, [ebp - 0x8b0]
mov dword [eax], esi
mov dword [ebp - 0x28], esi
push dword [ebp - 0x14]
call fcn.10025506
dec dword [ebp - 0x14]
jns 0x1000ad7f
or eax, 0xffffffff
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x4c], ebx
xor eax, eax
cmp dword [ebp - 0x4c], eax
jl 0x1000b779
push 4
lea ecx, [ebp - 0x1a4]
call fcn.10025495
mov dword [ebp - 4], 0x10
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x79c4185a
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000ae08
xor edi, edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000adf1
push 2
xor eax, eax
pop edi
mov dword [ebp - 0x10], eax
jmp 0x1000ae1e
push dword [ebp - 0x10]
call fcn.10025506
mov dword [eax], 0x42c70bb7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x1a4]
jl 0x1000ae0d
push ebx
call fcn.10025506
xor ebx, ebx
lea ecx, [ebp - 0x1a4]
push 3
mov dword [eax], ebx
call fcn.10025506
cmp dword [eax], ebx
jl 0x1000afbf
xor eax, eax
mov dword [ebp - 0x14], 0xf55e00fe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1000aee3
push 4
lea ecx, [ebp - 0xc90]
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000ae97
xor edi, edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc90]
call fcn.10025506
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000ae7c
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1a4]
push 3
call fcn.10025506
push 3
lea ecx, [ebp - 0xc90]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x90], 0xe3cf9575
sbb esi, esi
inc esi
call fcn.10025506
lea ecx, [ebp - 0xc90]
mov byte [ebp - 4], 0x10
mov dword [eax], esi
call fcn.10025501
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x1000ae5e
push 2
mov dword [ebp - 0x2c], eax
pop edi
cmp dword [ebp - 0x2c], eax
jg 0x1000af9a
push edi
lea ecx, [ebp - 0xa80]
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
jmp 0x1000af23
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa80]
call fcn.10025506
mov dword [eax], 0x734cb441
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000af0c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1a4]
push 3
mov eax, dword [ebp + eax*4 - 0x90]
call fcn.10025506
push 3
lea ecx, [ebp - 0x1a4]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x90]
call fcn.10025506
xor ebx, ebx
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
lea ecx, [ebp - 0xa80]
setge bl
xor eax, eax
push eax
call fcn.10025506
lea ecx, [ebp - 0xa80]
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x10
call fcn.10025501
inc dword [ebp - 0x2c]
xor eax, eax
jmp 0x1000aee9
push 3
lea ecx, [ebp - 0x1a4]
call fcn.10025506
push 3
lea ecx, [ebp - 0x1a4]
dec dword [eax]
call fcn.10025506
cmp dword [eax], 0
jge 0x1000ae49
mov dword [ebp - 0x2c], 0x17
jmp 0x1000b065
mov dword [ebp - 0x14], 0x9118158f
mov dword [ebp - 0x28], 0x86de1f17
mov dword [ebp - 0x50], 0x6a6d983a
push 3
call fcn.10025506
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
mov esi, dword [ebp - 0x14]
push 3
call fcn.10025506
push 3
lea ecx, [ebp - 0x1a4]
mov dword [eax], esi
call fcn.10025506
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, dword [eax]
setg dl
xor eax, eax
add edx, 0x5a955069
je 0x1000b027
cmp dword [ebp - 0x14], eax
je 0x1000b027
lea edx, [eax + 1]
jmp 0x1000b029
mov edx, eax
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
setne dl
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
jl 0x1000b059
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff5
lea ecx, [ebp - 0x1a4]
jl 0x1000afcb
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10025501
push edi
lea ecx, [ebp - 0x504]
call fcn.10025495
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000b0c4
xor edi, edi
inc edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x504]
call fcn.10025506
push 2
mov dword [eax], edi
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000b0a7
jmp 0x1000b0c7
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x504]
call fcn.10025506
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1000b0f1
mov dword [ebp - 0x28], 0xf402
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x28]
push edi
mov dword [ebp - 0x50], eax
call fcn.10025506
dec dword [eax]
push edi
lea ecx, [ebp - 0x504]
call fcn.10025506
lea ecx, [ebp - 0x504]
cmp dword [eax], 0xfffffffe
je 0x1000b0d9
mov dword [ebp - 4], esi
call fcn.10025501
mov byte [ebp - 0x41], bl
lea ecx, [ebp - 0xe68]
push 4
call fcn.10025495
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x30], 0x532fe223
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000b158
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe68]
call fcn.10025506
mov dword [eax], 0xb9b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b139
xor eax, eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1000b1eb
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x11fc]
push eax
lea eax, [ebp - 0x120c]
push eax
lea ecx, [ebp - 0x1520]
movdqu xmmword [ebp - 0x120c], xmm0
call fcn.10025515
lea ecx, [ebp - 0x1b1]
mov esi, eax
call fcn.10008d2a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1120]
push dword [esi]
call fcn.100254d7
push 3
lea ecx, [ebp - 0x1120]
mov byte [ebp - 4], 0x15
call fcn.10025506
and dword [eax], 0
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1000b1d4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea ecx, [ebp - 0x1120]
mov byte [ebp - 4], 0x14
call fcn.10025501
dec dword [ebp - 0x30]
jns 0x1000b168
or esi, 0xffffffff
lea ecx, [ebp - 0xe68]
mov dword [ebp - 4], esi
call fcn.10025501
cmp byte [ebp - 0x41], 0
je 0x1000b32a
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x754]
push 3
call fcn.10025495
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x76c]
mov dword [ebp - 0x38], 0xd9ee
push edi
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000b25b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x754]
call fcn.10025506
mov dword [eax], 0x4fc2285f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000b23c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000b281
push dword [ebp - 0x10]
lea ecx, [ebp - 0x76c]
call fcn.10025506
mov dword [eax], 0xcc895931
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b263
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x1000b2b9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000b29d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000b2b6
push edi
push 0x1034
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
je 0x1000b28a
dec dword [ebp - 0x38]
lea ecx, [ebp - 0x754]
mov eax, dword [ebp - 0x38]
push edi
call fcn.10025506
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x76c]
xor ebx, ebx
push ebx
call fcn.10025506
push ebx
lea ecx, [ebp - 0x76c]
mov esi, eax
call fcn.10025506
push ebx
mov ecx, dword [eax]
mov dword [esi], ecx
lea ecx, [ebp - 0x754]
call fcn.10025506
or esi, 0xffffffff
lea ecx, [ebp - 0x76c]
mov dword [eax], esi
call fcn.10025501
lea ecx, [ebp - 0x754]
mov dword [ebp - 4], esi
call fcn.10025501
push 0x1135
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x3fc]
call fcn.10025495
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b36b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3fc]
call fcn.10025506
mov dword [eax], 0x8ec0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b34d
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1000b3a4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000b38e
push eax
push 0x4de
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000b39f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1000b376
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3fc]
mov eax, dword [ebp - 0x10]
push esi
call fcn.10025506
push edi
lea ecx, [ebp - 0x3fc]
call fcn.10025506
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3fc]
xor eax, eax
push eax
call fcn.10025506
push esi
lea ecx, [ebp - 0x3fc]
call fcn.10025506
push edi
lea ecx, [ebp - 0x3fc]
mov esi, dword [eax]
add esi, 0x66941fc9
call fcn.10025506
mov edx, dword [ebp - 0x10]
xor ecx, ecx
imul edx, esi
add edx, 0x629c4ddb
cmp dword [eax], edx
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x3fc]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x2c], 0xfffffffa
lea ecx, [ebp - 0x784]
push ebx
call fcn.10025495
push 2
pop esi
push esi
lea ecx, [ebp - 0x3c0]
mov dword [ebp - 4], 0x19
call fcn.10025495
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x48], 0x54981c58
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000b47d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x784]
call fcn.10025506
mov dword [eax], 0x3700168a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000b45f
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
cmp dword [ebp - 0x10], esi
jge 0x1000b49c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3c0]
call fcn.10025506
mov dword [eax], edi
inc dword [ebp - 0x10]
jmp 0x1000b482
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x784]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
xor eax, eax
inc eax
push eax
call fcn.10025506
push edi
lea ecx, [ebp - 0x3c0]
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
call fcn.10025506
push edi
lea ecx, [ebp - 0x3c0]
call fcn.10025506
xor ebx, ebx
lea ecx, [ebp - 0x3c0]
push edi
cmp dword [eax], edi
setne bl
call fcn.10025506
neg ebx
lea ecx, [ebp - 0x3c0]
push edi
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
call fcn.10025506
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jle 0x1000b528
xor eax, eax
lea ecx, [ebp - 0x784]
inc eax
push eax
call fcn.10025506
cmp dword [eax], edi
jne 0x1000b528
xor eax, eax
mov esi, eax
jmp 0x1000b52d
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.10025506
xor ecx, ecx
cmp esi, dword [eax]
setge cl
xor esi, esi
add ecx, 0x7be2
inc esi
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x3c0]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], esi
call fcn.10025501
or edi, 0xffffffff
lea ecx, [ebp - 0x784]
mov dword [ebp - 4], edi
call fcn.10025501
xor eax, eax
mov ecx, 0xffff
mov byte [ebp - 0x15], al
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0x462ccd20
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], 0x2e71
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000b5af
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x298], 0xa90ef874
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b597
mov dword [ebp - 0x10], eax
jmp 0x1000b5c5
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffed
jle 0x1000ac8a
inc dword [ebp - 0x1c]
or ecx, 0xffffffff
cmp dword [ebp - 0x1c], ecx
jne 0x1000aafb
mov edi, 0xfffff77f
mov edx, 0xffff
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x462ccd20
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 0x2e71
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000b7d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x304], 0xa90ef874
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b7c0
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000b7ee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x69c], 0x1a0197cb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b7dd
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b820
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], edx
jne 0x1000b838
cmp dword [ebp - 0x304], eax
je 0x1000b842
cmp dword [ebp - 0x304], eax
je 0x1000b842
mov eax, esi
add eax, 0x3da550e8
cmp eax, dword [ebp - 0x30]
jle 0x1000b857
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b859
mov eax, esi
jmp 0x1000b859
xor eax, eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x34], 0x49d585ed
mov dword [ebp - 0x48], 0x9a5a40f2
mov dword [ebp - 0x30], 0xa519d814
push 9
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], 0x70ce404d
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x50], ecx
push 2
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x1000b8b2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe04], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b8a1
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe04]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, esi
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setge cl
sub eax, ecx
add eax, dword [ebp - 0x38]
jne 0x1000b906
cmp dword [ebp - 0x50], eax
je 0x1000b90f
jmp 0x1000b908
xor eax, eax
mov edx, esi
cmp dword [ebp - 0x30], eax
jne 0x1000b911
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x9f11
sub eax, dword [ebp - 0x54]
je 0x1000b931
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000b933
mov edx, esi
jmp 0x1000b935
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub edx, eax
xor eax, eax
push ebx
cmp ecx, edx
lea ecx, [ebp - 0xbe8]
setle al
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x19ac196a
mov dword [ebp - 0x14], 0x9570
call fcn.10025495
xor eax, eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000b98e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9bc], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000b976
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000b9b8
push 2
xor ebx, ebx
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbe8]
call fcn.10025506
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b99b
xor esi, esi
inc esi
jmp 0x1000b9ba
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add ecx, 0x5c6f8b8a
cmp ecx, eax
setl dl
mov dword [ebp - 0x9b8], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, 0x2c6e
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jne 0x1000ba40
mov dword [ebp - 0x14], 0xffffffe8
cmp dword [ebp - 0x14], 0x31
jg 0x1000ba9c
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000ba35
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x31
jle 0x1000ba23
jmp 0x1000ba9c
mov dword [ebp - 0x30], 0x46e74a6e
lea ecx, [ebp - 0xbe8]
mov dword [ebp - 0x34], 0x280bfe73
or eax, 0xffffffff
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x8214d2fc
mov dword [ebp - 0x34], 0x14ba09a1
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 3
mov eax, dword [ebp - 0x30]
push ebx
call fcn.10025506
inc dword [eax]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x9b8], eax
or eax, 0xffffffff
lea ecx, [ebp - 0xbe8]
mov dword [ebp - 4], eax
call fcn.10025501
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xa98]
call fcn.10025495
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x14], 0x7a7c2039
mov dword [ebp - 0x34], 0xc75d
mov dword [ebp - 0x34], 0xf997ec53
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000bb00
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa98]
call fcn.10025506
mov dword [eax], 0x862fd41e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000bae2
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1000bc1a
or edi, 0xffffffff
push 4
lea ecx, [ebp - 0xe80]
call fcn.10025495
lea eax, [ebp - 0x135c]
mov byte [ebp - 4], 0x1f
movdqa xmm0, xmmword [0x10007a90]
lea ecx, [ebp - 0x14a0]
push eax
lea eax, [ebp - 0x136c]
push eax
movdqu xmmword [ebp - 0x136c], xmm0
call fcn.10025515
lea ecx, [ebp - 0x1c1]
mov esi, eax
call fcn.10008d2a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1090]
push dword [esi]
call fcn.100254d7
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1000bb91
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe80]
call fcn.10025506
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1000bb76
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000bba9
push eax
push eax
push 0xe68
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa98]
call fcn.10025506
xor esi, esi
xor eax, eax
inc esi
cmp dword [ebp - 0x14], eax
jne 0x1000bbcf
push esi
lea ecx, [ebp - 0x1090]
call fcn.10025506
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000bbf2
push 0x157f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
lea ecx, [ebp - 0x1090]
call fcn.10025501
lea ecx, [ebp - 0xe80]
mov byte [ebp - 4], 0x1e
call fcn.10025501
dec dword [ebp - 0x14]
jns 0x1000bb0f
mov edi, 0xfffff77f
or eax, 0xffffffff
lea ecx, [ebp - 0xa98]
mov dword [ebp - 4], eax
call fcn.10025501
mov ecx, 0x7eede0b4
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xd74], ecx
mov dword [ebp - 0xd70], ecx
mov dword [ebp - 0xd6c], ecx
mov dword [ebp - 0xd68], ecx
or ecx, 0xffffffff
push 3
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000bc88
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1000bc83
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd74], 0x8d3c891c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1000bc6a
xor eax, eax
inc dword [ebp - 0x14]
jmp 0x1000bc59
mov eax, dword [ebp - 0x14]
mov edx, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x462ccd20
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 0x2e71
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000bcd2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x28c], 0xa90ef874
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000bcba
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000bce8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x578], 0x1a0197cb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000bcd7
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000bd1a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], edx
jne 0x1000bd32
cmp dword [ebp - 0x28c], eax
je 0x1000bd3c
cmp dword [ebp - 0x28c], eax
je 0x1000bd3c
mov eax, esi
add eax, 0x3da550e8
cmp eax, dword [ebp - 0x30]
jle 0x1000bd51
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000bd53
mov eax, esi
jmp 0x1000bd53
xor eax, eax
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xcf0]
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x54], 0xd1454bcd
mov dword [ebp - 0x28], 7
push ebx
call fcn.10025495
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x48], 0x50b7f45
mov dword [ebp - 0x3c], ebx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000bdb3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], 0x68ec0ae9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000bd9b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000bdd9
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcf0]
call fcn.10025506
mov dword [eax], 0xafa01777
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000bdbb
xor eax, eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xffffffeb
jge 0x1000bf2b
or edi, 0xffffffff
mov dword [ebp - 0x24], 0x6cce57bf
lea ecx, [ebp - 0xe94]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x50], 0x1b9849b7
mov dword [ebp - 0x34], 0xab3cf813
mov dword [ebp - 0x34], 0xec352115
mov dword [ebp - 0x34], edi
push ebx
call fcn.10025495
push 9
mov byte [ebp - 4], 0x23
xor eax, eax
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000be4e
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe94]
call fcn.10025506
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000be31
push 9
xor eax, eax
pop ecx
mov dword [ebp - 0x24], 0xfffffffe
cmp dword [ebp - 0x24], ebx
jl 0x1000bef1
jmp 0x1000be62
xor eax, eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1198]
mov dword [ebp - 0x34], 0x76b87d0f
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x61ece30
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x7d393e75
mov dword [ebp - 0x34], 0x80eec299
mov dword [ebp - 0x34], 0x3d5943e2
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x7c869b7d
mov dword [ebp - 0x34], 0x9a275ff4
push esi
call fcn.10025495
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x14], eax
jmp 0x1000becb
push dword [ebp - 0x14]
call fcn.10025506
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x1198]
cmp dword [ebp - 0x14], esi
jl 0x1000beba
inc dword [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.10025501
inc dword [ebp - 0x24]
push 9
pop ecx
cmp dword [ebp - 0x24], ebx
jge 0x1000be60
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000beff
cmp dword [ebp - 0x50], eax
je 0x1000beff
mov eax, esi
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xe94]
mov byte [ebp - 4], 0x22
call fcn.10025501
dec dword [ebp - 0x100]
cmp dword [ebp - 0x100], 0xffffffeb
jl 0x1000bdef
mov edi, 0xfffff77f
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000bf3a
cmp dword [ebp - 0x100], eax
jne 0x1000bf3a
mov esi, eax
push 2
pop eax
push eax
lea ecx, [ebp - 0xcf0]
call fcn.10025506
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xfc]
setle dl
xor ecx, ecx
cmp eax, 7
mov eax, dword [ebp - 0x100]
setle cl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xcf0]
mov eax, dword [ebp - 0x48]
inc eax
neg eax
sbb eax, eax
or ebx, 0xffffffff
inc eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 4], ebx
call fcn.10025501
push 2
pop esi
push esi
lea ecx, [ebp - 0x638]
call fcn.10025495
mov dword [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x14], 0x57976326
mov dword [ebp - 0x3c], 0x15aa9614
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x28], ebx
xor ebx, ebx
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [ebp - 0x14], esi
jge 0x1000bff4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x638]
call fcn.10025506
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000bfda
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1000c0a5
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], 0xc2377963
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1000c096
mov dword [ebp - 0x28], 0xe401d933
lea ecx, [ebp - 0x638]
push dword [ebp - 0x1c]
call fcn.10025506
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x638]
mov esi, eax
call fcn.10025506
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000c071
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x638]
push dword [ebp - 0x1c]
call fcn.10025506
xor ecx, ecx
cmp dword [eax], 0x91ba8027
mov eax, dword [ebp - 0x28]
sete cl
imul eax, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000c016
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1000c000
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x10], 0xa439beb0
mov eax, 0x265a
mov dword [ebp - 0x540], eax
or ecx, 0xffffffff
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x534], eax
xor eax, eax
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], ecx
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x38], 0x49690b28
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], 0xad942a26
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000c12e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x348], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000c11a
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1000c27c
mov dword [ebp - 0x48], 7
lea ecx, [ebp - 0xab0]
push esi
call fcn.10025495
xor eax, eax
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c173
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x91c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c15b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c199
push dword [ebp - 0x10]
lea ecx, [ebp - 0xab0]
call fcn.10025506
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c17b
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jg 0x1000c269
jmp 0x1000c1ac
xor eax, eax
mov dword [ebp - 0x28], 0xbf3b8cff
cmp dword [ebp - 0x10], eax
je 0x1000c1cc
mov eax, dword [ebp - 0x528]
cmp eax, dword [ebp - 0x530]
jl 0x1000c1ca
mov eax, ebx
jmp 0x1000c1cc
xor eax, eax
xor ecx, ecx
cmp eax, 0x32d7af2c
mov eax, dword [ebp - 0x918]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x918]
setg dl
sub eax, edx
neg eax
sbb eax, eax
add eax, 4
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x3582f80c
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x540]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
imul edx, dword [ebp + eax*4 - 0x540]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x540]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0xffff
mov dword [ebp - 0x344], ecx
lea ecx, [ebp - 0xab0]
setne al
xor edi, edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push edi
call fcn.10025506
mov dword [eax], ebx
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1000c1aa
mov edi, 0xfffff77f
or eax, 0xffffffff
lea ecx, [ebp - 0xab0]
mov dword [ebp - 4], eax
call fcn.10025501
jmp 0x1000c2ca
mov dword [ebp - 0x34], 0xe80a7c6d
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 0x2f23d37f
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], 0xdb62b2fa
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x14], eax
jmp 0x1000c2bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xffc], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000c2ae
inc dword [ebp - 0x38]
push 3
pop esi
mov eax, dword [ebp - 0x348]
xor ecx, ecx
mov eax, dword [ebp - 0x344]
test eax, eax
mov eax, dword [ebp - 0x10]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x540]
setg dl
sub edx, eax
xor eax, eax
cmp edx, dword [ebp - 0x534]
jle 0x1000c303
mov ecx, ebx
cmp dword [ebp - 0x528], eax
jne 0x1000c305
mov ecx, eax
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x528]
push esi
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x528]
mov eax, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0x348]
cmp ecx, eax
lea ecx, [ebp - 0xea8]
setg dl
mov dword [ebp - 0x348], edx
mov dword [ebp - 0x38], 0xfffffffe
call fcn.10025495
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0x10a8]
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], ebx
push 4
call fcn.10025495
mov byte [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c3a8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xea8]
call fcn.10025506
mov dword [eax], 0x6579
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c38a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000c3ce
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10a8]
call fcn.10025506
push 4
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000c3b1
xor eax, eax
inc dword [ebp - 0x48]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000c3e1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
lea ecx, [ebp - 0x10a8]
call fcn.10025501
or eax, 0xffffffff
lea ecx, [ebp - 0xea8]
mov dword [ebp - 4], eax
call fcn.10025501
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x874]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x48], 0x1023f126
push 4
call fcn.10025495
xor eax, eax
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c43f
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4d4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c42b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000c467
push dword [ebp - 0x10]
lea ecx, [ebp - 0x874]
call fcn.10025506
mov dword [eax], 0x5ecc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000c448
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1000c4ba