Function at 0x1001665b
Capabilities:
Create thread
Get file attributes
Log keystrokes via polling
Query environment variable

Disassembly:
mov eax, 0x1006719c
call fcn.10066518
sub esp, 0x80c
push ebx
push esi
push edi
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x454]
push 2
mov byte [ebp - 0x45], dl
call fcn.10010424
mov esi, 0x6d4f2887
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], ebx
jmp 0x100166a3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x454]
mov dword [eax + ecx*4], 0xd4e06482
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10016690
mov eax, dword [ebp - 0x454]
push 0x1d
pop edi
mov dword [eax], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x100166bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jg 0x100166b9
lea ecx, [ebp - 0x454]
call fcn.100111ea
push 2
lea ecx, [ebp - 0x46c]
call fcn.10010424
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x2e91a049
mov dword [ebp - 0x18], 0xaf86
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0xfffffffc
cmp dword [ebp - 0x1c], 0xfffffff1
jle 0x100167d4
push 2
lea ecx, [ebp - 0x374]
call fcn.10010424
mov dword [ebp - 0x28], 0x732a
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], ebx
jmp 0x10016733
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0xa39ed080
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10016720
mov eax, dword [ebp - 0x374]
xor edx, edx
cmp dword [eax], ebx
mov esi, dword [eax]
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp esi, ecx
sete dl
xor eax, eax
test edx, edx
setns al
cmp eax, 0xedf6b3e7
sbb ecx, ecx
neg ecx
add ecx, 2
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
setne al
xor ecx, ecx
cmp eax, 0x56411d7f
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x374]
cmp dword [ecx], eax
setl dl
mov dword [ecx], edx
lea ecx, [ebp - 0x374]
call fcn.100111ea
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
push 0xffffffffffffffff
pop esi
jg 0x10016704
or esi, esi
mov dword [ebp - 0x1c], ebx
jmp 0x100167ec
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], 0xd4e06482
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100167d9
mov eax, dword [ebp - 0x46c]
mov dword [eax], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10016802
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jg 0x100167ff
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], esi
call fcn.100111ea
xor eax, eax
lea ecx, [ebp - 0x584]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push 2
call fcn.10010424
xor eax, eax
lea ecx, [ebp - 0x64c]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], esi
push eax
call fcn.10010424
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], ebx
jmp 0x10016862
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x584]
mov dword [eax + ecx*4], 0x32e26595
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001684f
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1001687f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016870
mov dword [ebp - 0x2c], 0xffffffeb
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x100168e4
push edx
lea ecx, [ebp - 0x484]
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x100168b8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], 0x665683c8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100168a5
mov eax, dword [ebp - 0x484]
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 2
mov dword [eax], 0xfffffff9
call fcn.100111ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
push 1
pop edx
jg 0x10016891
mov dword [ebp - 0x2c], ebx
jmp 0x10016923
mov dword [ebp - 0x28], 0xbf5e4d8d
mov dword [ebp - 0x28], 0x940c9ba5
mov dword [ebp - 0x28], 0xc1c57511
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], ebx
jmp 0x10016917
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x79c], 0x19c2b2e5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10016906
inc dword [ebp - 0x34]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x100168e9
lea ecx, [ebp - 0x64c]
call fcn.100111ea
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], esi
call fcn.100111ea
push 2
lea ecx, [ebp - 0x590]
call fcn.10010424
mov dword [ebp - 0x18], 0x13638ecf
mov dword [ebp - 0x1c], ebx
jmp 0x1001696d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x590]
mov dword [eax + ecx*4], 0x342eb90d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001695a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10016982
call dword [sym.imp.KERNEL32.dll_GetACP]
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jl 0x100169a2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001699d
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [ebp - 0x18]
jns 0x1001698d
lea ecx, [ebp - 0x590]
call fcn.100111ea
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 0xcde30eca
push 3
cmp dword [ebp - 0x10], ebx
je 0x10016a8f
mov dword [ebp - 0x24], 0x38ab659d
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x3ae4c7ba
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0x1a83acdd
pop ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffea
jle 0x10016b19
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], ecx
je 0x10016a71
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov eax, ecx
cmp dword [ebp - 0x10], ecx
je 0x10016a14
mov eax, edx
imul eax, eax, 0xd6db
xor edx, edx
cmp eax, 0x3063d62a
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
setle dl
add eax, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0x6ced
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
xor ecx, ecx
inc edx
cmp eax, dword [ebp - 0x24]
jl 0x10016a78
mov eax, ecx
cmp dword [ebp - 0x20], ecx
je 0x10016a7a
mov eax, edx
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
jg 0x100169f7
jmp 0x10016b19
mov dword [ebp - 0x20], 0xcb407cb0
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x2c], 0x1e8e103c
pop ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0x452e2cc7
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10016aca
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x10016acf
cmp dword [ebp - 0x18], eax
je 0x10016ad6
xor eax, eax
lea edx, [eax + 1]
jmp 0x10016ad8
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x65e139a5
jle 0x10016af8
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
jne 0x10016afa
xor edx, edx
mov eax, ecx
inc edx
jmp 0x10016aff
xor ecx, ecx
xor edx, edx
inc edx
mov eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jne 0x10016b14
mov eax, ecx
cmp dword [ebp - 0x1c], ecx
je 0x10016b16
mov eax, edx
mov dword [ebp - 0x28], eax
push 2
lea ecx, [ebp - 0x4cc]
call fcn.10010424
mov dword [ebp - 4], 4
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov edi, 0x100091b8
mov dword [ebp - 0x28], 0x14ad
cmp dword [ebp - 0x28], 0x439
jge 0x10016c1c
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x124]
push eax
push 0x1084b4a8
push 0x100091ac
call fcn.1004d47b
add esp, 0x10
call fcn.10016258
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x124], eax
jle 0x10016bb7
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0x10009040
call fcn.1004d47b
mov edx, dword [ebp - 0xb4]
add esp, 0xc
mov ecx, dword [ebp - 0xb8]
lea edx, [edx - 1]
lea ecx, [ecx - 1]
call fcn.10016278
inc esi
cmp esi, dword [ebp - 0x124]
jl 0x10016b7c
call fcn.100162ab
xor ecx, ecx
mov esi, ecx
cmp dword [ebp - 0x13c], ecx
jle 0x10016c19
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0x10009040
call fcn.1004d47b
mov ecx, dword [ebp - 0xb8]
add esp, 0xc
mov edx, dword [ebp - 0xb4]
mov eax, dword [ecx*4 + 0x10844d3c]
cmp eax, dword [edx*4 + 0x10844d3c]
jge 0x10016c03
push edx
push ecx
jmp 0x10016c05
push ecx
push edx
push edi
call fcn.1004d6af
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x13c]
jl 0x10016bc8
xor ecx, ecx
or esi, 0xffffffff
xor edx, edx
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x1c], ecx
inc edx
jmp 0x10016c39
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10016c2b
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ecx
jg 0x10016e63
lea edi, [ebp - 0x640]
lea eax, [ebp - 0x630]
movdqa xmm0, xmmword [0x10009650]
push ecx
push eax
mov dword [ebp - 0x20], 0xfffffffd
lea ecx, [ebp - 0x49c]
push edi
movdqu xmmword [ebp - 0x640], xmm0
call fcn.10010460
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x34], 0x923f2b63
push 4
call fcn.10010424
push ebx
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 6
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10016cb9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10016caa
xor esi, esi
mov dword [ebp - 0x10], edx
inc esi
cmp dword [ebp - 0x10], ebx
jge 0x10016cdb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2cc]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
jmp 0x10016cc5
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x40], edx
jge 0x10016d4c
mov dword [ebp - 0x28], 0x556123d4
mov dword [ebp - 0x20], edx
jmp 0x10016d3f
mov dword [ebp - 0x18], 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40], ecx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x10016d3c
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x40], edx
jne 0x10016d3c
dec dword [ebp - 0x18]
jns 0x10016d2e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10016d11
cmp dword [ebp - 0x28], edx
jmp 0x10016e27
mov dword [ebp - 0x20], 0x6a9c
xor ecx, ecx
mov dword [ebp - 0x34], 0xf16ce65c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, esi
mov eax, dword [ebp - 0x49c]
setle cl
xor edx, edx
cmp ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0x1cea0262
jne 0x10016d8a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, 0x9209a488
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xd683
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x40]
imul eax, edx
cmp eax, 0xfff6
mov eax, dword [ebp - 0x2d8]
setne cl
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x40]
imul eax, ecx
cmp eax, dword [ebp - 0x20]
je 0x10016e10
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x40], 0
je 0x10016e10
xor eax, eax
lea edx, [eax + 1]
jmp 0x10016e14
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2cc]
sete cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x2cc]
call fcn.100111ea
lea ecx, [ebp - 0x2d8]
call fcn.100111ea
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 4
call fcn.100111ea
inc dword [ebp - 0x24]
lea eax, [ebp - 0x630]
xor ecx, ecx
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x24], ecx
jle 0x10016c56
mov dword [ebp - 0x24], ecx
jmp 0x10016e82
mov dword [ebp - 0x2c], ecx
jmp 0x10016e7a
mov dword [ebp - 0x34], 0x7c2130be
dec dword [ebp - 0x34]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10016e6d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
je 0x10016e68
mov dword [ebp - 0x1c], 0x6d4f2887
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x2e91a049
mov dword [ebp - 0x18], 0xaf86
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0xfffffffc
cmp dword [ebp - 0x1c], 0xfffffff1
jle 0x10016f86
xor edi, edi
push 2
lea ecx, [ebp - 0x2e4]
call fcn.10010424
mov dword [ebp - 0x28], 0x732a
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], edi
jmp 0x10016ee5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2e4]
mov dword [eax + ecx*4], 0xa39ed080
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10016ed2
mov eax, dword [ebp - 0x2e4]
xor edx, edx
cmp dword [eax], edi
mov esi, dword [eax]
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp esi, ecx
sete dl
xor eax, eax
test edx, edx
setns al
cmp eax, 0xedf6b3e7
sbb ecx, ecx
neg ecx
add ecx, 2
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp esi, ecx
setne al
xor ecx, ecx
cmp eax, 0x56411d7f
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2e4]
cmp dword [ecx], eax
setl dl
mov dword [ecx], edx
lea ecx, [ebp - 0x2e4]
call fcn.100111ea
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
push 0xffffffffffffffff
pop esi
jg 0x10016eb6
xor ecx, ecx
mov eax, 0x4039b642
mov esi, 0xfff7
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x20], 0xbc75286e
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jg 0x1001707c
xor eax, eax
mov dword [ebp - 0x1c], ecx
inc eax
lea ecx, [ebp - 0x4b4]
push eax
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10016fee
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4b4]
mov dword [eax + ecx*4], 0x1de6fc60
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10016fdb
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], dl
je 0x10017018
push edx
push 0x17
push 0x1c32
push 0x1abe
push 0x10c3
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor edx, edx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jl 0x10017062
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x278], edx
je 0x10017051
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x278]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x278]
mov eax, dword [ebp - 0x278]
mov eax, dword [ebp - 0x18]
cmp esi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x1c]
jns 0x10017020
lea ecx, [ebp - 0x4b4]
call fcn.100111ea
inc dword [ebp - 0x20]
push 0
pop ecx
cmp dword [ebp - 0x20], ebx
jle 0x10016fc2
mov dword [ebp - 0x28], 0x1d6e
cmp dword [ebp - 0x28], 0xdca
push 7
pop esi
jge 0x100171d8
lea eax, [ebp - 0x50]
mov byte [ebp - 0x50], cl
push eax
push 0x99
lea ecx, [ebp - 0x3a8]
call fcn.100108ec
xor eax, eax
mov edi, eax
mov eax, edi
cdq
idiv ebx
test edx, edx
je 0x1001711e
mov eax, edi
cdq
idiv esi
test edx, edx
je 0x1001711e
cmp edi, ebx
jl 0x100170ed
lea eax, [edi - 3]
push eax
lea eax, [ebp - 0x784]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.1001096d
xor ecx, ecx
push 7
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
test dword [esi], edx
pop esi
jne 0x1001711e
cmp edi, esi
jl 0x1001711a
lea eax, [edi - 7]
push eax
lea eax, [ebp - 0x794]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.1001096d
xor ecx, ecx
push 7
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
test dword [esi], edx
pop esi
jne 0x1001711e
xor eax, eax
jmp 0x10017121
xor eax, eax
inc eax
push eax
push ecx
push edi
lea eax, [ebp - 0x7a4]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.1001096d
pop ecx
mov ecx, eax
call fcn.1001098c
inc edi
cmp edi, 0x99
jl 0x100170ae
lea eax, [ebp - 0x88]
push eax
push 0x1000903c
call fcn.1004d47b
mov eax, dword [ebp - 0x88]
pop ecx
pop ecx
test eax, eax
je 0x100171c6
mov edi, 0x10009088
dec eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x208]
push eax
push 0x1000903c
call fcn.1004d47b
pop ecx
pop ecx
push dword [ebp - 0x208]
lea eax, [ebp - 0x7b4]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.1001096d
xor ecx, ecx
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
mov eax, 0x1000908c
test dword [esi], edx
cmove eax, edi
push eax
call fcn.1004d8b7
mov eax, dword [ebp - 0x88]
pop ecx
test eax, eax
jne 0x1001716d
dec eax
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x88], eax
call fcn.1001094d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100171f1
push 0xa80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10017209
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4cc]
mov dword [eax + ecx*4], 0xd4e06482
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100171f6
mov dword [ebp - 0x20], 0x633efc07
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x2c], 0xadb2
mov dword [ebp - 0x18], 0xfffffffd
push ebx
call fcn.10010424
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10017258
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2fc]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10017244
mov dword [ebp - 0x28], 0x175b
cmp dword [ebp - 0x28], 0x5b1
jge 0x100172d7
push 0x10844e3c
push 0x10658bf4
push 0x1084107c
push 0x100091ac
call fcn.1004d47b
mov edi, dword [0x1084107c]
add esp, 0x10
mov eax, edi
cdq
idiv dword [0x10658bf4]
lea esi, [eax + 1]
imul esi, dword [0x10658bf4]
cmp esi, dword [0x10844e3c]
jg 0x100172cc
mov eax, esi
sub eax, edi
push eax
push 0x100091c0
call fcn.1004d6af
add esi, dword [0x10658bf4]
pop ecx
pop ecx
cmp esi, dword [0x10844e3c]
jg 0x100172d7
mov edi, dword [0x1084107c]
jmp 0x100172a5
push 0x100091c4
call fcn.1004d8b7
pop ecx
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
cmp dword [ebp - 0x18], edx
jne 0x100172fc
cmp dword [ebp - 0x2c], edx
jne 0x100172fc
cmp dword [ebp - 0x18], edx
jne 0x100172fc
mov eax, edx
jmp 0x100172ff
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x20]
add ecx, 2
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 0x20]
inc ecx
sub eax, ecx
je 0x1001736e
mov dword [ebp - 0x34], 0x55d5
mov dword [ebp - 0x2c], edx
jmp 0x10017336
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2fc]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10017323
cmp dword [ebp - 0x20], edx
je 0x10017357
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
imul eax, dword [ebp - 0x2c]
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x34]
je 0x10017357
mov edx, ecx
mov eax, dword [ebp - 0x2fc]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x34]
sete cl
sub ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x10017387
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], dl
je 0x10017387
push 0x199e
push 0x1449
push edx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
lea ecx, [ebp - 0x2fc]
call fcn.100111ea
mov eax, dword [ebp - 0x4cc]
xor ecx, ecx
mov dword [eax], ecx
mov dword [ebp - 0x1c], ecx
jmp 0x100173a4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jg 0x100173a1
or eax, 0xffffffff
lea ecx, [ebp - 0x4cc]
mov dword [ebp - 4], eax
call fcn.100111ea
xor eax, eax
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x28], eax
mov esi, 0xc90a35f3
inc eax
mov edi, 0xf402e31d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0x3a11c157
push 2
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10017402
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c0]
mov dword [eax + ecx*4], 0xad72d767
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100173ef
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jge 0x10017425
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5a8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10017413
inc dword [ebp - 0x5a0]
lea ecx, [ebp - 0x5c0]
call fcn.100111ea
xor eax, eax
lea ecx, [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push 2
call fcn.10010424
or ecx, 0xffffffff
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
inc eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x5d8]
push eax
call fcn.10010424
xor edx, edx
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], edx
jmp 0x1001748c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5f0]
mov dword [eax + ecx*4], 0x32e26595
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017479
mov dword [ebp - 0x10], edx
jmp 0x100174a6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5d8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10017497
mov dword [ebp - 0x2c], 0xffffffeb
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x10017512
push eax
lea ecx, [ebp - 0x4e4]
call fcn.10010424
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
jmp 0x100174e4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4e4]
mov dword [eax + ecx*4], 0x665683c8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100174d1
mov eax, dword [ebp - 0x4e4]
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], 0xb
mov dword [eax], 0xfffffff9
call fcn.100111ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
push 1
pop eax
jg 0x100174bb
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x2c], edx
inc ecx
jmp 0x10017554
mov dword [ebp - 0x28], 0xbf5e4d8d
mov dword [ebp - 0x28], 0x940c9ba5
mov dword [ebp - 0x28], 0xc1c57511
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], edx
jmp 0x10017548
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c4], 0x19c2b2e5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10017537
inc dword [ebp - 0x34]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1001751a
lea ecx, [ebp - 0x5d8]
call fcn.100111ea
or eax, 0xffffffff
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 4], eax
call fcn.100111ea
mov dword [ebp - 0x2c], 0x70ad6f2e
xor edx, edx
mov dword [ebp - 0x28], 0xf8d19c92
inc edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x28], 0x5b8b78a
mov dword [ebp - 0x28], 0x7008b15e
mov dword [ebp - 0x1c], ecx
jmp 0x100175af
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x630], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1001759e
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], cl
je 0x100175c8
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor edx, edx
xor ecx, ecx
inc edx
push 9
pop eax
mov dword [ebp - 0x2c], eax
jmp 0x1001762c
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x28], 0xe6d058a8
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xfffffffd
je 0x10017629
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0x6f8c7b5c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0x309642e4
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x1001761a
mov dword [ebp - 0x34], 4
dec dword [ebp - 0x34]
dec dword [ebp - 0x30]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jne 0x1001760a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jne 0x100175ea
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x14
jge 0x100175d0
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x694]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0x3a11c157
push 2
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x1001766c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x694]
mov dword [eax + ecx*4], 0xad72d767
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017659
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jge 0x1001768f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x608], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1001767d
inc dword [ebp - 0x600]
lea ecx, [ebp - 0x694]
call fcn.100111ea
xor eax, eax
lea ecx, [ebp - 0x178]
inc eax
push eax
call fcn.10010424
mov dword [ebp - 4], 0xd
xor edx, edx
mov dword [ebp - 0x10], 0x3838a1f9
mov dword [ebp - 0x18], edx
push 8
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x53c], edx
mov dword [ebp - 0x538], edx
mov dword [ebp - 0x534], edx
mov dword [ebp - 0x530], edx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x1c], edx
jmp 0x10017702
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x100176ef
mov dword [ebp - 0x10], edx
jmp 0x10017804
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 7
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x10017736
push 0x14af
push edx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], 0xfffffffb
jg 0x10017755
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x178]
cmp dword [eax + ecx*4], edx
je 0x10017755
xor eax, eax
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x18]
sub ecx, 0x6721f7d9
add ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
sub eax, 0x6a9d
jne 0x10017789
cmp dword [ebp - 0x18], eax
jne 0x10017789
mov edx, eax
jmp 0x1001778e
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0x281c1d99
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
add edx, 0xfe9f
je 0x100177bb
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + esi*4]
setle cl
xor eax, eax
cmp ecx, 0xdb5cabfc
jne 0x100177e3
cmp dword [ebp - 0x1c], eax
je 0x100177e3
lea esi, [eax + 1]
jmp 0x100177e5
mov esi, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x178]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx + edx*4]
sub eax, esi
mov dword [ebp - 0x530], eax
inc dword [ebp - 0x10]
xor edx, edx
cmp dword [ebp - 0x10], edx
jle 0x10017712
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x10017981
mov dword [ebp - 0x28], 0x165d
cmp dword [ebp - 0x28], 0x10bb
jge 0x10017964
lea eax, [ebp - 0x78]
push eax
push 0x10009094
call fcn.1004d47b
pop ecx
pop ecx
push dword [ebp - 0x78]
lea ecx, [ebp - 0x614]
call fcn.1002183b
xor edx, edx
mov byte [ebp - 4], 0xe
mov edi, edx
mov ebx, dword [ebp - 0x614]
cmp dword [ebp - 0x78], edx
jle 0x10017878
mov esi, ebx
mov edx, esi
mov ecx, 0x10657b50
call fcn.10021ef5
inc edi
add esi, 0x18
cmp edi, dword [ebp - 0x78]
jl 0x10017861
xor edx, edx
mov edi, dword [ebp - 0x78]
xor eax, eax
mov dword [ebp - 0x28], edx
lea ecx, [eax + 1]
mov byte [ebp - 0x11], cl
test edi, edi
jle 0x1001793e
lea eax, [ebx - 0x18]
mov ebx, edx
test cl, cl
je 0x1001793e
xor ecx, ecx
test ebx, ebx
jle 0x100178b7
cmp dword [eax + 0x14], 0x10
jb 0x100178ab
mov esi, dword [eax]
jmp 0x100178ad
mov esi, eax
cmp byte [edx + esi], 0x6f
push 1
pop esi
cmove ecx, esi
lea esi, [edi - 1]
cmp ebx, esi
jge 0x100178d3
cmp dword [eax + 0x44], 0x10
jb 0x100178c9
mov esi, dword [eax + 0x30]
jmp 0x100178cc
lea esi, [eax + 0x30]
cmp byte [edx + esi], 0x6f
jne 0x100178d3
inc ecx
test edx, edx
jle 0x100178ed
cmp dword [eax + 0x2c], 0x10
jb 0x100178e2
mov esi, dword [eax + 0x18]
jmp 0x100178e5
lea esi, [eax + 0x18]
cmp byte [edx + esi - 1], 0x6f
jne 0x100178ed
inc ecx
lea esi, [edi - 1]
cmp edx, esi
jge 0x1001790a
cmp dword [eax + 0x2c], 0x10
jb 0x100178ff
mov esi, dword [eax + 0x18]
jmp 0x10017902
lea esi, [eax + 0x18]
cmp byte [edx + esi + 1], 0x6f
jne 0x1001790a
inc ecx
and ecx, 0x80000001
jns 0x10017917
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
jg 0x1001792b
inc edx
cmp edx, edi
jl 0x1001789b
mov cl, byte [ebp - 0x11]
xor edx, edx
jmp 0x10017932
xor edx, edx
mov cl, dl
mov byte [ebp - 0x11], cl
inc ebx
add eax, 0x18
cmp ebx, edi
jl 0x10017893
test cl, cl
mov eax, 0x1000908c
mov ecx, 0x10009088
cmove eax, ecx
push eax
call fcn.1004d8b7
pop ecx
lea ecx, [ebp - 0x614]
call fcn.10021b4c
push 3
pop ebx
xor edx, edx
push edx
push 0xce6
push 0x7d0
push 0xc7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
or esi, 0xffffffff
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], esi
call fcn.100111ea
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0x8e56f9b2
push 7
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x99fb023e
mov dword [ebp - 0x28], 0x5dae5a60
mov dword [ebp - 0x28], 0x7f37c04c
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0x5d9b4e94
mov dword [ebp - 0x30], eax
mov eax, 0x4a8fe243
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x30], 0xf0599606
mov dword [ebp - 0x1c], ecx
jmp 0x10017a19
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x180], 0xf23e93d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10017a08
dec dword [ebp - 0x1cc]
mov ecx, edx
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x28]
sub ecx, eax
sub ecx, dword [ebp - 0x34]
neg ecx
push 4
sbb ecx, ecx
inc ecx
cmp ecx, edx
mov ecx, 0x97b2c3cc
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
inc eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x1c], 0xf5540d7f
call fcn.10010424
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0x2c593c86
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 4
jge 0x10017acb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x314]
mov dword [eax + ecx*4], 0xdce9d05b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10017aaf
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], edx
jmp 0x10017b95
mov dword [ebp - 0x2c], 0xb3b9da4d
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edx
jl 0x10017b92
mov dword [ebp - 0x20], edx
jmp 0x10017af8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x290], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10017aeb
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x314]
cmp dword [eax + ecx*4], edx
jne 0x10017b41
mov edx, dword [ebp - 0x2c]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x314]
push 3
cmp dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x2c]
setl bl
sub ebx, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ebx
sbb ebx, ebx
neg ebx
xor edx, edx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x290]
pop ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jg 0x10017b89
imul eax, dword [ebp - 0x10], 0x5cd1
test eax, eax
jne 0x10017b66
cmp dword [ebp - 0x10], 0x5fcb4448
jge 0x10017b68
mov edx, ecx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
push 0
sete cl
sub ecx, 0x3dab180f
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x20]
pop edx
push 1
pop ecx
cmp dword [ebp - 0x20], ebx
jle 0x10017b52
dec dword [ebp - 0x2c]
jns 0x10017ae6
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jg 0x10017ad3
lea ecx, [ebp - 0x314]
call fcn.100111ea
push 2
lea ecx, [ebp - 0x6bc]
call fcn.10010424
mov dword [ebp - 4], 0xf
mov eax, 0x198fe831
mov dword [ebp - 0x2c], 0xb743d837
xor ecx, ecx
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x10], ecx
jmp 0x10017bfa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x28c], 0x82062403
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10017be9
mov dword [ebp - 0x10], ecx
jmp 0x10017c16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x120], 0xc7c6f1fd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017c05
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ecx
jl 0x10017ded
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jg 0x10017da8
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp + eax*4 - 0x28c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge dl
imul edi, edx
xor edx, edx
mov dword [ebp - 0x11c], edi
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0x28c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
add esi, edx
cmp esi, edi
jg 0x10017c97
xor eax, eax
cmp dword [ebp - 0x284], eax
jne 0x10017c97
mov ecx, eax
jmp 0x10017c9c
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x1a
cmp dword [ebp - 0x20], 0xffffffe6
jne 0x10017d9a
push ebx
lea ecx, [ebp - 0x32c]
call fcn.10010424
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
jmp 0x10017cdf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x32c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10017ccc
mov dword [ebp - 0x34], 0xd953
xor ecx, ecx
mov eax, dword [ebp - 0x284]
imul eax, dword [ebp - 0x34]
cmp eax, 0x2967
mov eax, dword [ebp - 0x32c]
setle cl
imul ecx, dword [eax + 4]
mov eax, dword [ebp - 0x24]
add eax, ecx
jne 0x10017d18
cmp dword [ebp - 0x120], edx
je 0x10017d1d
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x32c]
setl cl
xor edx, edx
cmp ecx, 0xf2b7
setl dl
xor ecx, ecx
cmp edx, dword [eax + 8]
mov eax, dword [ebp - 0x11c]
setle cl
xor edx, edx
test ecx, ecx
sets dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x28c]
cmp eax, 0x8cb6
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0x32c]
setge al
mov dword [ebp - 0x28], eax
call fcn.100111ea
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
push 3
pop ebx
je 0x10017cb6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10017c49
xor ecx, ecx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ecx
jl 0x10017de1
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x28c]
mov eax, dword [ebp - 0x11c]
cmp ecx, eax
setg dl
xor eax, eax
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x28c], ecx
dec dword [ebp - 0x24]
jns 0x10017db0
xor ecx, ecx
dec dword [ebp - 0x2c]
jns 0x10017c28
or esi, 0xffffffff
inc dword [ebp - 0x3b0]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0x29000d4e
mov dword [ebp - 0x1c], ecx
jmp 0x10017e15
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7d4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10017e08
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jl 0x10017e4d
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x10017e45
push ecx
push 0x204c
push ecx
push ecx
push 0x2225
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
dec dword [ebp - 0x18]
jns 0x10017e26
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x620]
call fcn.10010424
mov byte [ebp - 4], 0x10
xor edx, edx
mov dword [ebp - 0x28], 0x49fe387f
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], dl
je 0x10017e77
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x10017e8f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10017ea7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6bc]
mov dword [eax + ecx*4], 0x32e26595
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017e94
mov dword [ebp - 0x10], edx
jmp 0x10017ec1
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10017eb2