Function at 0x10013ccb
Capabilities:
Encrypt data using speck
Get common file path
Get disk information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b639
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1a0c
call fcn.100668d0
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001d56f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xd7c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xd90], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd90]
movzx eax, byte [eax]
test eax, eax
je 0x1001406b
mov dword [ebp - 0x194], 5
push 2
lea ecx, [ebp - 0xa90]
call fcn.1000bc50
and dword [ebp - 4], 0
mov dword [ebp - 0xa60], 0xee67
mov dword [ebp - 0x928], 0x40c9ba5b
mov dword [ebp - 0x3c0], 0x57511ecb
mov dword [ebp - 0x7d0], 0x1fd9ab8a
mov dword [ebp - 0xcb4], 0xffffffff
mov dword [ebp - 0x27c], 0
jmp 0x10013d9e
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10013dc0
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov dword [eax], 0x551b32e2
jmp 0x10013d91
cmp dword [ebp - 0x194], 0xffff31c4
jl 0x10013de1
cmp dword [ebp - 0x194], 0
je 0x10013de1
mov dword [ebp - 0x66c], 1
jmp 0x10013de8
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x66c], eax
jge 0x10013e02
mov dword [ebp - 0xa50], 1
jmp 0x10013e09
and dword [ebp - 0xa50], 0
push 0
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax]
jle 0x10013e2c
mov dword [ebp - 0xa58], 1
jmp 0x10013e33
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0xa58], eax
jne 0x10013e4d
mov dword [ebp - 0x7c0], 1
jmp 0x10013e54
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0x7c0], eax
jle 0x10013e6e
mov dword [ebp - 0xa3c], 1
jmp 0x10013e75
and dword [ebp - 0xa3c], 0
push 0
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov ecx, dword [ebp - 0xa3c]
cmp ecx, dword [eax]
jge 0x10013e98
mov dword [ebp - 0x4fc], 1
jmp 0x10013e9f
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x4fc]
je 0x10013eb9
mov dword [ebp - 0x4f8], 1
jmp 0x10013ec0
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov ecx, dword [ebp - 0x4f8]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov eax, dword [eax]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0xfffffffe
jge 0x10013eff
mov dword [ebp - 0x500], 1
jmp 0x10013f06
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0
jne 0x10013f1b
mov dword [ebp - 0x7c8], 1
jmp 0x10013f22
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x7c8], eax
jne 0x10013f3c
mov dword [ebp - 0x508], 1
jmp 0x10013f43
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xfa5d8720
jne 0x10013f5b
mov dword [ebp - 0xa64], 1
jmp 0x10013f62
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0xb2e5
jle 0x10013f87
push 0
lea ecx, [ebp - 0xa90]
call fcn.1000bcce
mov eax, 0x9bdd86bd
test eax, eax
je 0x10013fa5
cmp dword [ebp - 0x3c0], 0
je 0x10013fa5
mov dword [ebp - 0x510], 1
jmp 0x10013fac
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x7d0], eax
imul eax, dword [ebp - 0x7d0], 0
cmp eax, 0x4c40
jl 0x10013fd2
mov dword [ebp - 0x518], 1
jmp 0x10013fd9
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0xffffffff
jge 0x10013fee
mov dword [ebp - 0x930], 1
jmp 0x10013ff5
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x194]
imul eax, dword [ebp - 0x930]
cmp eax, 0x23b1
jl 0x10014015
mov dword [ebp - 0x520], 1
jmp 0x1001401c
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0xcb4], eax
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x10014057
push 0
push 0x151b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.1000bcb2
jmp 0x1001d56d
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x50], 0x53b26bdd
mov dword [ebp - 0xd9c], 0xf5ecce35
mov dword [ebp - 0x50], 0
jmp 0x100140bc
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffa
jg 0x100142e9
mov dword [ebp - 0x1d8], 0xb999fb0
mov dword [ebp - 0x538], 0xa2c39d5b
push 1
lea ecx, [ebp - 0xfd8]
call fcn.1000bc50
mov dword [ebp - 4], 1
mov dword [ebp - 0x1fc], 0
jmp 0x10014107
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x10014123
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x1344], 0xfffffffb
jmp 0x100140fa
push 1
lea eax, [ebp - 0x1fc]
push eax
push 0x278a
push 1
lea eax, [ebp - 0xfd8]
push eax
push 0x31f9
push 0
push 0x421f
call fcn.10010fde
add esp, 0x20
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7d8]
mov dword [ebp + eax - 0x1344], ecx
cmp dword [ebp - 0x7d8], 0x307a329f
jl 0x10014181
mov dword [ebp - 0x528], 1
jmp 0x10014188
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0x24891023
jl 0x100141a9
cmp dword [ebp - 0x1d8], 0
je 0x100141a9
mov dword [ebp - 0x9e0], 1
jmp 0x100141b0
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
sub eax, dword [ebp - 0x50]
cmp eax, 1
jbe 0x100141ca
mov dword [ebp - 0x530], 1
jmp 0x100141d1
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x530]
jne 0x100141eb
mov dword [ebp - 0x7e0], 1
jmp 0x100141f2
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x538], eax
jle 0x1001421b
mov dword [ebp - 0x938], 1
jmp 0x10014222
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x938], eax
jge 0x1001423c
mov dword [ebp - 0x540], 1
jmp 0x10014243
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x540], eax
jne 0x1001425d
mov dword [ebp - 0x7e8], 1
jmp 0x10014264
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7e8], eax
je 0x1001427b
mov dword [ebp - 0x3cc], 1
jmp 0x10014282
and dword [ebp - 0x3cc], 0
push 0
lea ecx, [ebp - 0xfd8]
call fcn.1000bcce
mov ecx, dword [ebp - 0x3cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3cc]
sub eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x1d8], eax
jl 0x100142b7
mov dword [ebp - 0x548], 1
jmp 0x100142be
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0xd9c], eax
push 0
push 1
call fcn.10013a3c
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfd8]
call fcn.1000bcb2
jmp 0x100140b5
mov dword [ebp - 0xda4], 0x15d2
cmp dword [ebp - 0xda4], 0x51a
jge 0x10014594
call fcn.10052cca
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10009ba8
push 0x10009bac
call fcn.100535aa
add esp, 0xc
call fcn.10052cca
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10009bb4
push 0x10009bb8
call fcn.100535aa
add esp, 0xc
lea ecx, [ebp - 0xab4]
call fcn.1002e39e
mov dword [ebp - 4], 2
push 0x35
push 1
lea eax, [ebp - 0x141c]
push eax
call fcn.10049fa7
add esp, 0xc
mov dword [ebp - 0xdac], 2
lea eax, [ebp - 0xdac]
push eax
lea ecx, [ebp - 0xab4]
call fcn.1002e3cd
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x141c], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x141c], 0
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x141c], 1
mov dword [ebp - 0xd0], 3
jmp 0x100143c7
mov eax, dword [ebp - 0xd0]
inc eax
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x35
jge 0x10014438
mov eax, dword [ebp - 0xd0]
movzx eax, byte [ebp + eax - 0x141c]
test eax, eax
je 0x10014436
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xab4]
call fcn.1002e3cd
mov dword [ebp - 0x37c], 2
jmp 0x1001440d
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
imul eax, dword [ebp - 0xd0]
cmp eax, 0x35
jge 0x10014436
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x37c]
mov byte [ebp + eax - 0x141c], 0
jmp 0x10014400
jmp 0x100143b9
xor eax, eax
inc eax
je 0x10014585
lea eax, [ebp - 0xb4]
push eax
mov ecx, 0x1065c290
call fcn.1002df19
cmp dword [ebp - 0xb4], 0
jne 0x10014460
jmp 0x10014585
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xdb4], eax
and dword [ebp - 0x1a0], 0
jmp 0x10014489
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xab4]
call fcn.1000bcce
cvtsi2sd xmm0, dword [eax]
mov ecx, dword [ebp - 0xb4]
movsd qword [ebp - 0x12f0], xmm0
call fcn.1002f3af
movsd xmm1, qword [ebp - 0x12f0]
comisd xmm0, xmm1
jb 0x10014535
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xab4]
call fcn.1000bcce
mov ecx, eax
mov eax, dword [ebp - 0xb4]
cdq
idiv dword [ecx]
test edx, edx
jne 0x10014530
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xab4]
call fcn.1000bcce
mov ecx, eax
mov eax, dword [ebp - 0xb4]
cdq
idiv dword [ecx]
test edx, edx
jne 0x10014523
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xab4]
call fcn.1000bcce
mov ecx, eax
mov eax, dword [ebp - 0xb4]
cdq
idiv dword [ecx]
mov dword [ebp - 0xb4], eax
jmp 0x100144df
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
jmp 0x1001447c
cmp dword [ebp - 0xb4], 1
je 0x1001454b
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
push fcn.1000f2d8
push dword [ebp - 0x234]
push dword [ebp - 0xdb4]
mov ecx, 0x1065c1d8
call fcn.1002e16e
mov edx, 0x10009bc0
mov ecx, eax
call fcn.1002f3d6
mov ecx, eax
call fcn.1002e16e
mov ecx, eax
call fcn.1000bb2f
jmp 0x10014438
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab4]
call fcn.1000bcb2
mov dword [ebp - 0x384], 1
mov dword [ebp - 0x284], 0
jmp 0x100145b7
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x100145d3
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xdbc], 0x45f1dbec
jmp 0x100145aa
mov dword [ebp - 0x384], 0xfffffff1
jmp 0x100145ec
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xffffffe3
jl 0x10014627
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xdbc], 0xffffffff
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10014625
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x100145df
mov dword [ebp - 0x800], 0xffffffff
mov dword [ebp - 0x558], 0xfffffff7
mov dword [ebp - 0xdcc], 0x7e4fc228
mov dword [ebp - 0xdc4], 7
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0xb0], 0
push 4
lea ecx, [ebp - 0xdec]
call fcn.1000bc50
mov dword [ebp - 4], 3
push 4
lea ecx, [ebp - 0xddc]
call fcn.1000bc50
mov byte [ebp - 4], 4
mov dword [ebp - 0x24c], 8
mov dword [ebp - 0xe44], 3
lea eax, [ebp - 0xdec]
push eax
push 0x6530
lea eax, [ebp - 0x204]
push eax
push 0x40fa
push 0xf47
push 0
push 0x7bd6
push 1
call fcn.10010d58
add esp, 0x20
mov dword [ebp - 0x204], 0
jmp 0x100146e3
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x10014705
push dword [ebp - 0x204]
lea ecx, [ebp - 0xddc]
call fcn.1000bcce
mov dword [eax], 0x5b1b
jmp 0x100146d6
lea eax, [ebp - 0xdec]
push eax
push 1
lea eax, [ebp - 0xdc4]
push eax
push 0x3b0f
lea eax, [ebp - 0xdcc]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0xddc]
push eax
push 0
call fcn.10013690
add esp, 0x30
mov dword [ebp - 0x24c], 0
jmp 0x1001476e
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x35
je 0x10014d15
mov dword [ebp - 0x30], 0x50d5
mov dword [ebp - 0x568], 0xbc3393a3
mov dword [ebp - 0xb18], 0x6030033
mov dword [ebp - 0xce8], 9
mov dword [ebp - 0x28c], 0
jmp 0x100147b9
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xffffffed
jle 0x10014b21
mov dword [ebp - 0xa38], 0xf7cd3e5c
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0xb0], 3
jmp 0x100147f3
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x10014830
lea eax, [ebp - 0xdec]
push eax
push 0
push 0x5c9b
push 0x2cb9
push 0x44ad
lea eax, [ebp - 0xb0]
push eax
call fcn.1001e87b
add esp, 0x18
cmp dword [ebp - 0xa38], 0
je 0x1001482e
jmp 0x10014830
jmp 0x100147e6
mov dword [ebp - 0xdc0], 0x1ed4
cmp dword [ebp - 0xdc0], 0x993
jge 0x10014b00
push 0x10af36bc
push 0x10c7a850
mov ecx, 0x1065c290
call fcn.1002df19
mov ecx, eax
call fcn.1002df19
mov edx, 0x11a16654
mov ecx, 0x1065c290
call fcn.1002f380
mov edx, 0x11a160e0
mov ecx, eax
call fcn.1002f380
or dword [ebp - 0xbc], 0xffffffff
and dword [ebp - 0x20c], 0
jmp 0x1001489d
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
mov ecx, 0x11a16654
call fcn.1000c002
cmp dword [ebp - 0x20c], eax
jae 0x100148d7
push dword [ebp - 0x20c]
mov ecx, 0x11a16654
call fcn.1000d5c1
movsx eax, byte [eax]
cmp eax, 0x2a
jne 0x100148d5
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xbc], eax
jmp 0x100148d7
jmp 0x10014890
cmp dword [ebp - 0xbc], 0xffffffff
jne 0x10014903
mov edx, 0x11a160e0
mov ecx, 0x11a16654
call fcn.1002f5ad
movzx eax, al
test eax, eax
je 0x10014903
push 0x10009bc4
call fcn.10050f86
pop ecx
jmp 0x1001492d
cmp dword [ebp - 0xbc], 0xffffffff
jne 0x1001492d
mov edx, 0x11a160e0
mov ecx, 0x11a16654
call fcn.1002f5bc
movzx eax, al
test eax, eax
je 0x1001492d
push 0x10009bc8
call fcn.10050f86
pop ecx
mov ecx, 0x11a16654
call fcn.1000c002
mov esi, eax
dec esi
mov ecx, 0x11a160e0
call fcn.1000c002
cmp esi, eax
jne 0x100149d2
cmp dword [ebp - 0xbc], 0xffffffff
je 0x100149c7
push dword [ebp - 0xbc]
lea eax, [ebp - 0x118c]
push eax
lea eax, [ebp - 0x12e4]
push eax
mov ecx, 0x11a16654
call fcn.1002ded5
mov ecx, eax
call fcn.1002e79e
mov eax, dword [eax]
mov dword [ebp - 0xce0], eax
push dword [ebp - 0xce0]
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x11a16654
call fcn.1002de8b
mov edx, 0x11a160e0
mov ecx, 0x11a16654
call fcn.1002f5bc
movzx eax, al
test eax, eax
je 0x100149bc
push 0x10009bc8
call fcn.10050f86
pop ecx
jmp 0x100149c7
push 0x10009bc4
call fcn.10050f86
pop ecx
push 0x10009bc4
call fcn.10050f86
pop ecx
mov ecx, 0x11a16654
call fcn.1000c002
mov esi, eax
mov ecx, 0x11a160e0
call fcn.1000c002
cmp esi, eax
jbe 0x100149f7
push 0x10009bc4
call fcn.10050f86
pop ecx
and dword [ebp - 0x23c], 0
jmp 0x10014a0d
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xbc]
jge 0x10014a52
push dword [ebp - 0x23c]
mov ecx, 0x11a16654
call fcn.1000d5c1
movsx esi, byte [eax]
push dword [ebp - 0x23c]
mov ecx, 0x11a160e0
call fcn.1000d5c1
movsx eax, byte [eax]
cmp esi, eax
je 0x10014a50
push 0x10009bc4
call fcn.10050f86
pop ecx
jmp 0x10014a00
mov ecx, 0x11a160e0
call fcn.1000c002
mov esi, eax
mov ecx, 0x11a16654
call fcn.1000c002
sub esi, eax
inc esi
mov dword [ebp - 0xcac], esi
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0xcac]
mov dword [ebp - 0x38c], eax
jmp 0x10014aac
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
mov ecx, 0x11a160e0
call fcn.1000c002
cmp dword [ebp - 0x38c], eax
jae 0x10014af5
push dword [ebp - 0x44c]
mov ecx, 0x11a16654
call fcn.1000d5c1
movsx esi, byte [eax]
push dword [ebp - 0x38c]
mov ecx, 0x11a160e0
call fcn.1000d5c1
movsx eax, byte [eax]
cmp esi, eax
je 0x10014af3
push 0x10009bc4
call fcn.10050f86
pop ecx
jmp 0x10014a92
push 0x10009bc8
call fcn.10050f86
pop ecx
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xa38]
sub eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb10], eax
jmp 0x100147ac
push 1
lea ecx, [ebp - 0xdec]
call fcn.1000bcce
mov dword [eax], 0x256f
mov eax, 0x256f
test eax, eax
je 0x10014c93
cmp dword [ebp - 0x30], 0
jne 0x10014b59
mov eax, 0x42cc3231
test eax, eax
jne 0x10014b59
and dword [ebp - 0x9e8], 0
jmp 0x10014b63
mov dword [ebp - 0x9e8], 1
cmp dword [ebp - 0x30], 0
jne 0x10014b77
xor eax, eax
inc eax
jne 0x10014b77
and dword [ebp - 0x550], 0
jmp 0x10014b81
mov dword [ebp - 0x550], 1
cmp dword [ebp - 0x550], 0x140d
jg 0x10014bab
push 3
lea ecx, [ebp - 0xddc]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10014bab
mov dword [ebp - 0x7f0], 1
jmp 0x10014bb2
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0
jne 0x10014bbf
cmp dword [ebp - 0x30], 0
cmp dword [ebp - 0x558], 0x5de30ea3
jle 0x10014bd7
mov dword [ebp - 0x940], 1
jmp 0x10014bde
and dword [ebp - 0x940], 0
cmp dword [ebp - 0x940], 0xffffffff
je 0x10014bf3
mov dword [ebp - 0x560], 1
jmp 0x10014bfa
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x560], eax
jne 0x10014c11
mov dword [ebp - 0x7f8], 1
jmp 0x10014c18
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x9e8], eax
jle 0x10014c3e
mov dword [ebp - 0xd78], 1
jmp 0x10014c45
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1258], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1334], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1188], eax
xor eax, eax
inc eax
imul eax, eax, 0x17c9
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1268], eax
cmp dword [ebp - 0x30], 0
je 0x10014c93
mov dword [ebp - 0x570], 1
jmp 0x10014c9a
and dword [ebp - 0x570], 0
push 2
lea ecx, [ebp - 0xddc]
call fcn.1000bcce
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jge 0x10014cbd
mov dword [ebp - 0x578], 1
jmp 0x10014cc4
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x800]
cmp dword [ebp - 0x578], eax
jne 0x10014cde
mov dword [ebp - 0x948], 1
jmp 0x10014ce5
and dword [ebp - 0x948], 0
imul eax, dword [ebp - 0x948], 7
cmp eax, dword [ebp - 0x30]
jne 0x10014cfd
mov dword [ebp - 0x580], 1
jmp 0x10014d04
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0xce8], eax
jmp 0x10014761
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xddc]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdec]
call fcn.1000bcb2
mov dword [ebp - 0x68], 0x53b26bdd
mov dword [ebp - 0x5b0], 9
mov dword [ebp - 0x820], 0x10b999fb
mov dword [ebp - 0x5b8], 0xfffffffb
mov dword [ebp - 0xd8], 0x5f88e10e
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0xb28], 0xd69b45c
mov dword [ebp - 0x294], 0
jmp 0x10014d8f
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 4
jge 0x10014dab
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xed8], 0x8c7f
jmp 0x10014d82
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed8], 1
je 0x10014dc6
mov dword [ebp - 0x808], 1
jmp 0x10014dcd
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x808], eax
je 0x10014de7
mov dword [ebp - 0x588], 1
jmp 0x10014dee
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x24891023
jge 0x10014e06
mov dword [ebp - 0xa7c], 1
jmp 0x10014e0d
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xa7c]
lea eax, [eax + ecx + 0x6c4f32b7]
test eax, eax
jne 0x10014e32
xor eax, eax
inc eax
jne 0x10014e32
and dword [ebp - 0x590], 0
jmp 0x10014e3c
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x590], eax
jne 0x10014e56
mov dword [ebp - 0x810], 1
jmp 0x10014e5d
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
add eax, 0xfff8
cmp eax, 9
jbe 0x10014e79
mov dword [ebp - 0x598], 1
jmp 0x10014e80
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
add eax, 9
cmp eax, dword [ebp - 0xd8]
jle 0x10014e9d
mov dword [ebp - 0x950], 1
jmp 0x10014ea4
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0x63090707
jg 0x10014ebc
mov dword [ebp - 0x5a0], 1
jmp 0x10014ec3
and dword [ebp - 0x5a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xed8]
cmp dword [ebp - 0x5a0], eax
jl 0x10014ee3
mov dword [ebp - 0x818], 1
jmp 0x10014eea
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0xffffffff
jne 0x10014f0b
mov dword [ebp - 0x9f0], 1
jmp 0x10014f12
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x9f0], eax
je 0x10014f2c
mov dword [ebp - 0xb20], 1
jmp 0x10014f33
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1190], eax
mov eax, 0xded1
test eax, eax
je 0x10014f72
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed8], 0
je 0x10014f72
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed8], 0
je 0x10014f72
mov dword [ebp - 0xe00], 1
jmp 0x10014f79
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0xed8]
add eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xb68], 0xf5ecce35
mov dword [ebp - 0x68], 0
jmp 0x10014fd6
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xfffffffa
jg 0x10016b72
mov dword [ebp - 0x1b0], 0xb999fb0
mov dword [ebp - 0xe0], 0xd5e48d32
mov dword [ebp - 0x90], 0x91cb4e76
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0x394], 0
jmp 0x10015021
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jge 0x1001503d
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0xcf0], 0x66c1932e
jmp 0x10015014
mov dword [ebp - 0xe0], 0xffffffea
jmp 0x10015056
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffe9
jg 0x100151a5
mov dword [ebp - 0x1c8], 1
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x10a4], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0xe0]
cmp eax, 1
jg 0x100150ad
mov dword [ebp - 0x958], 1
jmp 0x100150b4
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0x958]
cmp eax, dword [ebp - 0x1c8]
jl 0x100150d4
mov dword [ebp - 0x5c0], 1
jmp 0x100150db
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
neg eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0xe0]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10015136
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x10015126
push 0
push 0x3597
push 0x569d
call fcn.1001f871
add esp, 0xc
push 0
push 0x40e1
call fcn.10025f21
pop ecx
pop ecx
jmp 0x100151a0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x90], 0
jmp 0x1001515b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x2e
jg 0x100151a0
mov dword [ebp - 0x3d4], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp + eax - 0xcf0], ecx
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1001519e
push 0
push 0
call fcn.100259e9
pop ecx
pop ecx
jmp 0x1001514e
jmp 0x10015049
mov dword [ebp - 0x90], 0x16
jmp 0x100151be
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x26
jge 0x1001520e
mov dword [ebp - 0xb30], 1
cmp dword [ebp - 0xb30], 0
je 0x100151dc
jmp 0x1001520e
mov byte [ebp - 0x17e], 0
lea eax, [ebp - 0x17e]
push eax
push 0x39da
push 1
push 0
push 0
push 0x3aab
push 0x21ed
push 0x1bab
call fcn.10021109
add esp, 0x20
jmp 0x100151b1
mov dword [ebp - 0x3a4], 0x824a8c6a
push 4
lea ecx, [ebp - 0x1204]
call fcn.1000bc50
mov dword [ebp - 4], 5
mov dword [ebp - 0x10ac], 0xcb03629a
mov dword [ebp - 0xd80], 0x229b
cmp dword [ebp - 0xd80], 0x6d2
jge 0x1001546b
mov byte [ebp - 0xf1], 1
lea eax, [ebp - 0xf1]
push eax
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x1478]
call fcn.1002f5d8
pop ecx
mov dword [ebp - 0x70], 2
and dword [ebp - 0x29c], 0
jmp 0x10015287
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x34
jge 0x1001530b
mov eax, dword [ebp - 0x70]
movzx eax, byte [ebp + eax - 0x1478]
test eax, eax
je 0x10015306
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x16a4], ecx
push dword [ebp - 0x70]
call fcn.10013b20
pop ecx
mov ecx, dword [ebp - 0x29c]
mov dword [ebp + ecx*4 - 0x1a18], eax
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x70]
mov dword [ebp - 0x39c], eax
jmp 0x100152ed
mov eax, dword [ebp - 0x39c]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x34
jge 0x10015306
mov eax, dword [ebp - 0x39c]
mov byte [ebp + eax - 0x1478], 0
jmp 0x100152de
jmp 0x10015280
xor eax, eax
inc eax
je 0x1001546b
lea eax, [ebp - 0x828]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
cmp dword [ebp - 0x828], 0
jne 0x10015335
jmp 0x1001546b
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0xe8], eax
jmp 0x10015351
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
push dword [ebp - 0xe8]
call fcn.10013b20
pop ecx
mov dword [ebp - 0xb38], eax
mov ecx, dword [ebp - 0xe8]
call fcn.1002f3af
movsd qword [ebp - 0x1040], xmm0
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1e8], eax
and dword [ebp - 0x1a8], 0
jmp 0x1001539f
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cvtsi2sd xmm0, dword [ebp + eax*4 - 0x16a4]
movsd xmm1, qword [ebp - 0x1040]
comisd xmm1, xmm0
jb 0x1001540b
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1e8]
cdq
idiv dword [ebp + ecx*4 - 0x16a4]
test edx, edx
jne 0x10015409
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x214]
add ecx, dword [ebp + eax*4 - 0x1a18]
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1e8]
cdq
idiv dword [ebp + ecx*4 - 0x16a4]
mov dword [ebp - 0x1e8], eax
jmp 0x100153bc
jmp 0x10015392
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0xe8]
jne 0x1001541e
jmp 0x10015344
cmp dword [ebp - 0x1e8], 1
je 0x1001543f
push dword [ebp - 0x1e8]
call fcn.10013b20
pop ecx
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0xb38]
cmp eax, dword [ebp - 0x214]
jne 0x10015461
push dword [ebp - 0xe8]
push 0x10009ae8
call fcn.10050dc6
pop ecx
pop ecx
jmp 0x10015466
jmp 0x10015344
jmp 0x1001530b
mov dword [ebp - 0xcf8], 0x7f8b4dfe
mov dword [ebp - 0x2a4], 0
jmp 0x1001548e
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x100154ad
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x1204]
call fcn.1000bcce
and dword [eax], 0
jmp 0x10015481
mov dword [ebp - 0x3a4], 0
jmp 0x100154c6
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xffffffed
jl 0x100154f9
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x100154f7
push 0
push 0
push 0x1ccc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100154b9
push 0
push 0
push 0x1fbd
lea eax, [ebp - 0xcf8]
push eax
push 0x3098
push 0x6761
push 1
call fcn.1002a195
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1204]
call fcn.1000bcb2
mov dword [ebp - 0x870], 0xa2c39d5b
mov dword [ebp - 0x260], 0xfffffff7
mov dword [ebp - 0xb40], 3
mov dword [ebp - 0xf18], 0x420452a2
mov dword [ebp - 0xf14], 0x420452a2
mov dword [ebp - 0xf10], 0x420452a2
mov dword [ebp - 0xf0c], 0x420452a2
lea ecx, [ebp - 0x4ad]
call fcn.1000bcdd
push eax
lea eax, [ebp - 0xf08]
push eax
lea eax, [ebp - 0xf18]
push eax
lea ecx, [ebp - 0x1384]
call fcn.1000bce0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1214]
call fcn.1000bc8c
mov dword [ebp - 4], 6
mov dword [ebp - 0xb48], 0xfffffff9
mov byte [ebp - 0xf9], 0
push 0
push 0x59fa
push 0x733
push 0x3cb
push 0x6715
lea eax, [ebp - 0xf9]
push eax
push 0
call fcn.10026dae
add esp, 0x1c
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x260], eax
jge 0x10015600
mov dword [ebp - 0x5c8], 1
jmp 0x10015607
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x5c8], eax
jne 0x10015621
mov dword [ebp - 0xa40], 1
jmp 0x10015628
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x10b4], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0xdc8], eax
push 2
lea ecx, [ebp - 0x1214]
call fcn.1000bcce
mov ecx, dword [ebp - 0xdc8]
mov dword [eax], ecx
cmp dword [ebp - 0xa40], 0x39ec
jge 0x1001566d
mov dword [ebp - 0x5d0], 1
jmp 0x10015674
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x5d0], eax
je 0x1001568e
mov dword [ebp - 0x830], 1
jmp 0x10015695
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0xb48], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1214]
call fcn.1000bcb2
push 1
lea ecx, [ebp - 0xf9c]
call fcn.1000bc50
mov dword [ebp - 4], 7
mov dword [ebp - 0x21c], 0x149febb6
mov dword [ebp - 0x244], 0x2e889ec0
mov dword [ebp - 0x5d8], 0x901516ea
mov dword [ebp - 0x2ac], 0
jmp 0x100156fb
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x10015717
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x1434], 0xfffffff9
jmp 0x100156ee
lea eax, [ebp - 0x21c]
push eax
push 0
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x5d8]
push eax
call fcn.100299da
add esp, 0x10
mov dword [ebp - 0x21c], 0
jmp 0x1001574f
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jg 0x100157f5
mov dword [ebp - 0xd00], 0x5cab4306
mov dword [ebp - 0x244], 0
jmp 0x1001577f
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jg 0x100157ba
mov dword [ebp - 0xd00], 0x49efeded
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x100157b8
push 0
push 0x187a
push 0x180c
call fcn.10023560
add esp, 0xc
jmp 0x10015772
push 0x386b
push 0x38b
push 0x1b1
lea eax, [ebp - 0x5d8]
push eax
push 0
push 0x4729
push 0x6d29
push 0x4aa1
push 0x73e5
push 0
call fcn.1000fcf4
add esp, 0x28
jmp 0x10015742
mov dword [ebp - 0x1c], 0x82a1836c
mov dword [ebp - 0x848], 0x47825498
mov dword [ebp - 0x3ac], 0
jmp 0x1001581f
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x1001583b
mov eax, dword [ebp - 0x3ac]
mov dword [ebp + eax*4 - 0xeb0], 1
jmp 0x10015812
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10015855
push 0
call fcn.10025756
pop ecx
cmp dword [ebp - 0x1c], 0
jne 0x100158d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001587f
mov dword [ebp - 0x960], 1
jmp 0x10015886
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x960], eax
jl 0x1001589d
mov dword [ebp - 0x5e0], 1
jmp 0x100158a4
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x5e0]
jle 0x100158bb
mov dword [ebp - 0x838], 1
jmp 0x100158c2
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xdfec
jge 0x100158d7
and dword [ebp - 0x5e8], 0
jmp 0x100158e1
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5e8], eax
jne 0x100158f8
mov dword [ebp - 0x9f8], 1
jmp 0x100158ff
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x9f8], eax
jge 0x10015916
mov dword [ebp - 0x5f0], 1
jmp 0x1001591d
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5f0], eax
jne 0x10015934
mov dword [ebp - 0x840], 1
jmp 0x1001593b
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x840]
jge 0x10015952
mov dword [ebp - 0x48c], 1
jmp 0x10015959
and dword [ebp - 0x48c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x48c]
mov dword [ebp + eax - 0xeb0], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x48c]
cmp eax, 0xffffffff
jbe 0x10015987
mov dword [ebp - 0xb50], 1
jmp 0x1001598e
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10cc], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x100159b7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xeb0], 0
jne 0x100159b7
and dword [ebp - 0x5f8], 0
jmp 0x100159c1
mov dword [ebp - 0x5f8], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x5f8]
je 0x100159d8
mov dword [ebp - 0x968], 1
jmp 0x100159df
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x968], eax
jl 0x100159f6
mov dword [ebp - 0x600], 1
jmp 0x100159fd
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x600]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x848], eax
jge 0x10015a4f
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x10015a4a
push 0
push 0x1a2a
push 0x1df9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x10015ad1
push 3
lea ecx, [ebp - 0xf6c]
call fcn.1000bc50
mov byte [ebp - 4], 8
push 0
push 0x4f50
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0xf6c]
push eax
call fcn.10026ae3
add esp, 0x10
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10015aaf
push 0x4f96
push 0xd18
push 0
push 0x723a
push 0
push 0x12d6
call fcn.100109e3
add esp, 0x18
push 1
lea ecx, [ebp - 0xf6c]
call fcn.1000bcce
mov dword [eax], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf6c]
call fcn.1000bcb2
mov dword [ebp - 0x224], 0
jmp 0x10015aea
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10015b06
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x135c], 0xfffffffb
jmp 0x10015add
push 0
push 0x1cb
call fcn.1001d8c8
pop ecx
pop ecx
lea eax, [ebp - 0xf9c]
push eax
push 0x6c1d
push 0x1886
push 0
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.1001110f
add esp, 0x18
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x22c], 0xf4727cad
mov dword [ebp - 0x2b4], 0x7bff44ca
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x3dc], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.1000bc50
mov byte [ebp - 4], 9
mov dword [ebp - 0x84], 0
jmp 0x10015b94
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10015bb6
push dword [ebp - 0x84]
lea ecx, [ebp - 0xe90]
call fcn.1000bcce
mov dword [eax], 0x6ea0e402
jmp 0x10015b87
mov dword [ebp - 0x84], 0
jmp 0x10015bcf
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10015beb
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xe40], 5
jmp 0x10015bc2
cmp dword [ebp - 0xf0], 0
je 0x10015dc1
cmp dword [ebp - 0xf0], 0
je 0x10015c5b
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xf0], eax
jle 0x10015c1b
mov dword [ebp - 0x608], 1
jmp 0x10015c22
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x608], eax
jg 0x10015c3c
mov dword [ebp - 0xa74], 1
jmp 0x10015c43
and dword [ebp - 0xa74], 0
cmp dword [ebp - 0xa74], 0x89c0
je 0x10015c5b
mov dword [ebp - 0x610], 1
jmp 0x10015c62
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0x610]
jne 0x10015c7e
or eax, 0xffffffff
jne 0x10015c7e
and dword [ebp - 0x850], 0
jmp 0x10015c88
mov dword [ebp - 0x850], 1
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x850], eax
jle 0x10015ca2
mov dword [ebp - 0xd88], 1
jmp 0x10015ca9
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0xf0], 0xfe3d
je 0x10015ccd
mov dword [ebp - 0x618], 1
jmp 0x10015cd4
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x22c]
imul eax, dword [ebp - 0x618]
test eax, eax
jne 0x10015cf7
cmp dword [ebp - 0x2b4], 0
jne 0x10015cf7
and dword [ebp - 0x970], 0
jmp 0x10015d01
mov dword [ebp - 0x970], 1
imul eax, dword [ebp - 0x970], 0xa925
test eax, eax
je 0x10015d2d
push 1
lea ecx, [ebp - 0xe90]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10015d2d
mov dword [ebp - 0x620], 1
jmp 0x10015d34
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x620]
cmp eax, 7
jae 0x10015d51
mov dword [ebp - 0x858], 1
jmp 0x10015d58
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0xb58]
cmp eax, dword [ebp - 0xd08]
jne 0x10015d97
mov dword [ebp - 0x628], 1
jmp 0x10015d9e
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x628], eax
jne 0x10015dc1
cmp dword [ebp - 0x258], 0
je 0x10015dc1
mov dword [ebp - 0xa00], 1
jmp 0x10015dc8
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0xfff6
jb 0x10015de0
mov dword [ebp - 0xb60], 1
jmp 0x10015de7
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x10e4], eax
cmp dword [ebp - 0x3dc], 0
jne 0x10015e0e
cmp dword [ebp - 0x258], 0
jne 0x10015e0e
and dword [ebp - 0x630], 0
jmp 0x10015e18
mov dword [ebp - 0x630], 1
mov eax, dword [ebp - 0x630]
imul eax, dword [ebp - 0x22c]
mov dword [ebp - 0x860], eax
push 0
lea ecx, [ebp - 0xe90]
call fcn.1000bcce
mov ecx, dword [ebp - 0x860]
mov dword [eax], ecx
cmp dword [ebp - 0x860], 0
jne 0x10015e62
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe40], 0
jne 0x10015e62
and dword [ebp - 0x638], 0
jmp 0x10015e6c
mov dword [ebp - 0x638], 1
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x638], eax
je 0x10015e8f
cmp dword [ebp - 0x3dc], 0
je 0x10015e8f
mov dword [ebp - 0x978], 1
jmp 0x10015e96
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xe90]
call fcn.1000bcb2
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x640], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax - 0x135c], ecx
cmp dword [ebp - 0x640], 0x307a329f
jl 0x10015ee4
mov dword [ebp - 0x868], 1
jmp 0x10015eeb
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0x24891023
jl 0x10015f0c
cmp dword [ebp - 0x1b0], 0
je 0x10015f0c
mov dword [ebp - 0x648], 1
jmp 0x10015f13
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x68]
cmp eax, 1
jbe 0x10015f2d
mov dword [ebp - 0xa4c], 1
jmp 0x10015f34
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0xa4c]
jne 0x10015f4e
mov dword [ebp - 0x650], 1
jmp 0x10015f55
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x870], eax
jle 0x10015f7e
mov dword [ebp - 0x658], 1
jmp 0x10015f85
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x658], eax
jge 0x10015f9f
mov dword [ebp - 0x980], 1
jmp 0x10015fa6
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x980], eax
jne 0x10015fc0
mov dword [ebp - 0x660], 1
jmp 0x10015fc7
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x660], eax
je 0x10015fde
mov dword [ebp - 0x454], 1
jmp 0x10015fe5
and dword [ebp - 0x454], 0
push 0
lea ecx, [ebp - 0xf9c]
call fcn.1000bcce
mov ecx, dword [ebp - 0x454]
mov dword [eax], ecx
mov eax, dword [ebp - 0x454]
sub eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x1b0], eax
jl 0x1001601a
mov dword [ebp - 0x878], 1
jmp 0x10016021
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xf8], 0
push 3
lea ecx, [ebp - 0xae4]
call fcn.1000bc50
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0x678], 0x6749
mov dword [ebp - 0x880], 0x7a9b65ca
mov dword [ebp - 0xb04], 0x2ab2
mov dword [ebp - 0xb78], 0x4b38b4b7
mov dword [ebp - 0x1f4], 0
jmp 0x10016093
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x100160af
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0xdfc], 0xfffffffb
jmp 0x10016086
push 0
push 0xbb3
lea eax, [ebp - 0xae4]
push eax
push 0x3848
push 0x6296
push 0
lea eax, [ebp - 0x1f4]
push eax
push 1
call fcn.10029a01
add esp, 0x20
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x10ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdfc], 0
jne 0x10016108
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10016123
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdfc], 0
je 0x10016123
mov dword [ebp - 0x668], 1
jmp 0x1001612a
and dword [ebp - 0x668], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdfc]
cmp eax, dword [ebp - 0x668]
jl 0x1001614b
mov dword [ebp - 0xd10], 1
jmp 0x10016152
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0xf8], 0
je 0x1001617d
mov eax, 0x635290ce
test eax, eax
je 0x1001617d
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000bcce
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000bcce
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x10fc], eax
or eax, 0xffffffff
cmp eax, 0xfffffff6
je 0x100161aa
mov dword [ebp - 0xb70], 1
jmp 0x100161b1
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1104], eax
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000bcce
mov eax, dword [eax]
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x110c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xdfc]
sub ecx, dword [ebp - 0xf8]
sub ecx, 9
cmp dword [ebp + eax - 0xdfc], ecx
jle 0x1001620f
mov dword [ebp - 0x670], 1
jmp 0x10016216
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
sub eax, dword [ebp - 0x678]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
add eax, dword [ebp - 0xb04]
cmp eax, dword [ebp - 0x678]
jle 0x10016248
mov dword [ebp - 0x988], 1
jmp 0x1001624f
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xb78], eax
cmp dword [ebp - 0xf8], 0
je 0x10016291
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x1001628f
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1c32
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100162e1
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x100162e1
push 1
push 0x698a
push 0x67fe
push 0x3c78
push 0x2c27
push 0x2720
push 0x337c
push 0x6832
push 0x4982
push 0
push 0x315a
push 0x2cba
call fcn.1001048e
add esp, 0x30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xae4]
call fcn.1000bcb2
mov byte [ebp - 0x111], 0
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x1f8], 0xfffffffb
push 3
lea ecx, [ebp - 0xea8]
call fcn.1000bc50
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x100], 0xf8abff5e
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0xb80], 1
mov dword [ebp - 0x898], 1
push 0
push 1
push 0x61ec
lea eax, [ebp - 0x1114]
push eax
push 0x5738
push 0x67ae
lea eax, [ebp - 0xea8]
push eax
push 0x15ea
push 0
call fcn.1001e488
add esp, 0x24
imul eax, dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x34], 0xea28c7ff
ja 0x10016399
mov dword [ebp - 0x680], 1
jmp 0x100163a0
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0xf32b
je 0x100163b8
mov dword [ebp - 0x888], 1
jmp 0x100163bf
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 8
jle 0x100163e0
mov dword [ebp - 0x688], 1
jmp 0x100163e7
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0xffff
ja 0x100163ff
mov dword [ebp - 0xd18], 1
jmp 0x10016406
and dword [ebp - 0xd18], 0
imul eax, dword [ebp - 0x34], 0xb756
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1124], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1134], eax
or eax, 0xffffffff
cmp eax, 6
jne 0x10016442
mov dword [ebp - 0xa84], 1
jmp 0x10016449
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0xa84]
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0xb80]
je 0x1001646a
mov dword [ebp - 0x690], 1
jmp 0x10016471
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x898]
mov ecx, dword [ebp - 0x690]
lea eax, [ecx + eax - 0x5c7656e7]
test eax, eax
jne 0x1001648f
cmp dword [ebp - 0x4ac], 0
mov eax, 0xfffc
test eax, eax
jne 0x100164aa
cmp dword [ebp - 0x100], 0
jne 0x100164aa
and dword [ebp - 0x890], 0
jmp 0x100164b4
mov dword [ebp - 0x890], 1
mov eax, dword [ebp - 0x890]
sub eax, 0x3883
js 0x100164cd
mov dword [ebp - 0x990], 1
jmp 0x100164d4
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x698], eax
push 0
lea ecx, [ebp - 0xea8]
call fcn.1000bcce
mov ecx, dword [ebp - 0x698]
mov dword [eax], ecx
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x990]
dec eax
cmp dword [ebp - 0x1f8], eax
jle 0x1001651c
mov dword [ebp - 0x6a0], 1
jmp 0x10016523
and dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x6a0], 0x4c9cadcd
jl 0x1001653b
mov dword [ebp - 0x6a8], 1
jmp 0x10016542
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x898]
cmp dword [ebp - 0x6a8], eax
jne 0x100167aa
mov dword [ebp - 0x3e4], 1
mov dword [ebp - 0x2bc], 4
mov dword [ebp - 0x8b0], 0xfffffffc
mov dword [ebp - 0x3b4], 0
jmp 0x1001658b
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 3
jge 0x100165a7
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0xf84], 0xbb5f37d7
jmp 0x1001657e
mov eax, dword [ebp - 0x3e4]
dec eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0xe89b93b3
jae 0x100165cc
mov dword [ebp - 0x6d8], 1
jmp 0x100165d3
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x113c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1144], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x114c], eax
imul eax, dword [ebp - 0x2bc], 0xf6dd
cmp eax, 0xe71c9eeb
jb 0x10016611
mov dword [ebp - 0xa10], 1
jmp 0x10016618
and dword [ebp - 0xa10], 0
cmp dword [ebp - 0xa10], 0x30bf
jl 0x10016630
mov dword [ebp - 0x6b0], 1
jmp 0x10016637
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x6b0], eax
jl 0x1001664e
mov dword [ebp - 0x8a0], 1
jmp 0x10016655
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xd1ba
jg 0x1001666d
mov dword [ebp - 0x6b8], 1
jmp 0x10016674
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 9
jne 0x10016689
mov dword [ebp - 0x998], 1
jmp 0x10016690
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
sub eax, dword [ebp - 0x4ac]
jne 0x100166b0
mov eax, 0x85f1
test eax, eax
jne 0x100166b0
and dword [ebp - 0x6c0], 0
jmp 0x100166ba
mov dword [ebp - 0x6c0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf84]
cmp dword [ebp - 0x6c0], eax
jne 0x100166db
mov dword [ebp - 0x8a8], 1
jmp 0x100166e2
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x8a8], eax
jne 0x100166fc
mov dword [ebp - 0x6c8], 1
jmp 0x10016703
and dword [ebp - 0x6c8], 0
push 1
lea ecx, [ebp - 0xea8]
call fcn.1000bcce
mov ecx, dword [ebp - 0x6c8]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x8b0]
jg 0x1001672c
mov dword [ebp - 0xa54], 1
jmp 0x10016733
and dword [ebp - 0xa54], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf84]
cmp dword [ebp - 0xa54], eax
je 0x10016754
mov dword [ebp - 0x6d0], 1
jmp 0x1001675b
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x8b0]
cmp dword [ebp - 0x100], eax
jg 0x1001677b
mov dword [ebp - 0x9a0], 1
jmp 0x10016782
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x6d8]
imul eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x100], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x100]
mov dword [ebp + eax - 0xf84], ecx
jmp 0x100167d1
mov dword [ebp - 0xdd0], 0xfffffffd
lea eax, [ebp - 0x1f8]
push eax
push 0
push 0x7517
lea eax, [ebp - 0xdd0]
push eax
call fcn.1001e45c
add esp, 0x10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xea8]
call fcn.1000bcb2
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10016b5e
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x1d0], 0xc5604491
mov dword [ebp - 0x3bc], 0
jmp 0x10016819
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jge 0x10016835
mov eax, dword [ebp - 0x3bc]
mov dword [ebp + eax*4 - 0xa9c], 0x847d
jmp 0x1001680c
mov dword [ebp - 0x60], 0
jmp 0x10016845
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jg 0x10016b4f
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0xa9c], 1
je 0x10016868
mov dword [ebp - 0x6e0], 1
jmp 0x1001686f
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x6e0], eax
jge 0x10016886
mov dword [ebp - 0x8b8], 1
jmp 0x1001688d
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1d0], eax
jge 0x100168b0
mov dword [ebp - 0xb88], 1
jmp 0x100168b7
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0xa9c]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0xa9c]
mov dword [ebp - 0x115c], eax
mov eax, 0x57440e70
test eax, eax
je 0x1001691a
mov byte [ebp - 0x18c], 0
push 0x23d8
lea eax, [ebp - 0x18c]
push eax
push 0x3a60
push 0
push 0x1048
push 0x4f03
push 0
push 0x3d1f
push 1
call fcn.1001026e
add esp, 0x24
jmp 0x10016b4a
mov dword [ebp - 0x54], 0xed55
mov dword [ebp - 0x1d0], 0
jmp 0x1001693a
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jg 0x10016b4a
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x60]
imul eax, dword [ebp + ecx*4 - 0xa9c]
test eax, eax
je 0x10016985
mov dword [ebp - 0x54], 0
jmp 0x10016969
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x10016980
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0xa9c], 0
je 0x1001697e
jmp 0x10016980
jmp 0x10016962
jmp 0x10016b45
mov dword [ebp - 0x54], 0
jmp 0x10016995
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x10016b45
mov dword [ebp - 0xb00], 0xfffffffd
mov dword [ebp - 0xafc], 0xfffffffd
mov dword [ebp - 0xaf8], 0xfffffffd
mov dword [ebp - 0xaf4], 0xfffffffd
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x100169fb
push 0
push 1
push 0x35bf
push 0x2da6
push 0x43d0
push 0x349c
push 1
call fcn.1002a195
add esp, 0x1c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb00], 2
jmp 0x10016a29
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb00]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb00], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb00], 0
jl 0x10016b40
mov dword [ebp - 0xd20], 0x1b48
cmp dword [ebp - 0xd20], 0xd91
jge 0x10016b1a
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xec8]
push eax
mov ecx, 0x1065c290
call fcn.1002e059
mov ecx, eax
call fcn.1002e059
mov ecx, eax
call fcn.1002e059
movsd xmm0, qword [ebp - 0xcc0]
xorpd xmm0, xmmword [0x1000a270]
movsd xmm1, qword [ebp - 0xcc0]
mulsd xmm1, qword [ebp - 0xcc0]
movsd xmm2, qword [0x1000a228]
mulsd xmm2, qword [ebp - 0xec8]
mulsd xmm2, qword [ebp - 0x104c]
subsd xmm1, xmm2
push ecx
push ecx
movsd qword [esp], xmm1
movsd qword [ebp - 0x1058], xmm0
call fcn.10051194
pop ecx
pop ecx
fstp qword [ebp - 0x1064]
movsd xmm0, qword [ebp - 0x1058]
addsd xmm0, qword [ebp - 0x1064]
movsd xmm1, qword [0x1000a220]
mulsd xmm1, qword [ebp - 0xec8]
divsd xmm0, xmm1
movsd qword [ebp - 0x1070], xmm0
movsd xmm1, qword [ebp - 0x1070]
mov ecx, 0x1065c1d8
call fcn.1002e280
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xb00]
mov eax, dword [ebp + eax - 0xa9c]
mov dword [ebp + ecx*4 - 0xa9c], eax
jmp 0x10016a0e
jmp 0x1001698e
jmp 0x1001692d
jmp 0x1001683e
push 0xe1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf9c]
call fcn.1000bcb2
jmp 0x10014fcf
mov dword [ebp - 0x108], 0xd5e48d32
mov dword [ebp - 0xa4], 0x91cb4e76
mov dword [ebp - 0x3ec], 0xffffffff
mov dword [ebp - 0x340], 0
jmp 0x10016ba9
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x10016bc5
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0xb90], 0x66c1932e
jmp 0x10016b9c
mov dword [ebp - 0x108], 0xffffffea
jmp 0x10016bde
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffe9
jg 0x10016d42
mov dword [ebp - 0x1b8], 1
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1174], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0x108]
cmp eax, 1
jg 0x10016c35
mov dword [ebp - 0x6e8], 1
jmp 0x10016c3c
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x6e8]
cmp eax, dword [ebp - 0x1b8]
jl 0x10016c5c
mov dword [ebp - 0xa18], 1
jmp 0x10016c63
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
neg eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x108]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10016cd3
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x10016cae
push 0x4e88
push 0
push 0x216e
call fcn.100203e6
add esp, 0xc
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10016cd1
push 0x4ce2
push 1
push 0
call fcn.100103d6
add esp, 0xc
jmp 0x10016d3d
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0xa4], 0
jmp 0x10016cf8
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x2e
jg 0x10016d3d
mov dword [ebp - 0x3ec], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp + eax - 0xb90], ecx
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x10016d3b
push 0
push 1
call fcn.100259e9
pop ecx
pop ecx
jmp 0x10016ceb
jmp 0x10016bd1
mov dword [ebp - 0xa4], 0x16
jmp 0x10016d5b
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x26
jge 0x10016da1
mov dword [ebp - 0xd98], 1
cmp dword [ebp - 0xd98], 0
je 0x10016d79
jmp 0x10016da1
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10016d9f
push 0
push 0x163a
push 0x42f3
call fcn.100249f0
add esp, 0xc
jmp 0x10016d4e
mov eax, dword [ebp - 0xb98]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x6f0], 0x42c7
mov dword [ebp - 0xba0], 0xf8067e3
mov dword [ebp - 0xba8], 4
mov dword [ebp - 0xd30], 0x441791e6
push 3
lea ecx, [ebp - 0xfb4]
call fcn.1000bc50
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xd28], 0xbb1300ca
mov dword [ebp - 0xe10], 0x2967684a
mov dword [ebp - 0x117c], 0
push 0x5d10
push 0x61b7
push 0
lea eax, [ebp - 0xfb4]
push eax
push 0x7a6e
push 0
push 0x5979
push 0x6bfd
push 0x29ff
lea eax, [ebp - 0x1184]
push eax
call fcn.10025fa6
add esp, 0x28
push 0
push 0x313
lea eax, [ebp - 0x6f0]
push eax
push 0
push 0x4887
push 0x5ed1
push 1
push 0x561a
call fcn.10010fde
add esp, 0x20
lea eax, [ebp - 0xd28]
push eax
push 0
push 0x544c
lea eax, [ebp - 0xfb4]
push eax
push 0
lea eax, [ebp - 0xba0]
push eax
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0xba8]
push eax
lea eax, [ebp - 0xd30]
push eax
push 1
push 0x5288
push 0x4478
push 0x51c5
call fcn.1000feb5
add esp, 0x38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfb4]
call fcn.1000bcb2
mov dword [ebp - 0xbb8], 0xfffffff7
mov dword [ebp - 0xda0], 3
mov dword [ebp - 0xf04], 0x420452a2
mov dword [ebp - 0xf00], 0x420452a2
mov dword [ebp - 0xefc], 0x420452a2
mov dword [ebp - 0xef8], 0x420452a2
lea ecx, [ebp - 0x4b5]
call fcn.1000bcdd
push eax
lea eax, [ebp - 0xef4]
push eax
lea eax, [ebp - 0xf04]
push eax
lea ecx, [ebp - 0x13d4]
call fcn.1000bce0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1224]
call fcn.1000bc8c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xbb0], 0xfffffff9
mov byte [ebp - 0xc1], 0
lea eax, [ebp - 0xc1]
push eax
push 0x7050
push 0
push 1
call fcn.10010e72
add esp, 0x10
push 0x5b30
lea eax, [ebp - 0xbb0]
push eax
push 0
push 0x3a27
lea eax, [ebp - 0xda0]
push eax
push 1
push 0x312d
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0x1224]
push eax
push 0x56d8
call fcn.10025fa6
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1224]
call fcn.1000bcb2
mov dword [ebp - 0x8c], 0xb5052061
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x380], 0xc9d5fac1
mov dword [ebp - 0x2c8], 0x4e76ab2a
mov dword [ebp - 0x3fc], 0xffffffff
mov dword [ebp - 0x45c], 5
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x380], eax
jne 0x10017033
mov dword [ebp - 0x8c0], 1
jmp 0x1001703a
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x8c0]
cmp dword [ebp - 0x8c], eax
jl 0x1001705a
mov dword [ebp - 0x6f8], 1
jmp 0x10017061
and dword [ebp - 0x6f8], 0
imul eax, dword [ebp - 0x6f8], 0xfffffff8
mov dword [ebp - 0x2c8], eax
imul eax, dword [ebp - 0x2c8], 0xffff
cmp eax, dword [ebp - 0x8c]
jl 0x1001708c
mov dword [ebp - 0x9a8], 1
jmp 0x10017093
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0x6568
jne 0x100170ab
mov dword [ebp - 0x700], 1
jmp 0x100170b2
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x380], 0
je 0x100170dc
cmp dword [ebp - 0x45c], 0
je 0x100170dc
mov dword [ebp - 0x8c8], 1
jmp 0x100170e3
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x8c8], 0x551b32e2
jl 0x10017104
cmp dword [ebp - 0x45c], 0
je 0x10017104
mov dword [ebp - 0xd38], 1
jmp 0x1001710b
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1194], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x45c]
jle 0x10017137
mov dword [ebp - 0x708], 1
jmp 0x1001713e
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xfffffff9
jl 0x10017153
mov dword [ebp - 0xa80], 1
jmp 0x1001715a
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xfffffffc
jg 0x1001717b
mov dword [ebp - 0x710], 1
jmp 0x10017182
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x710]
add eax, dword [ebp - 0x380]
mov dword [ebp - 0x2d0], eax
je 0x1001728d
mov dword [ebp - 0x8d0], 0x72fa5d87
mov dword [ebp - 0xbc0], 0x23ee
cmp dword [ebp - 0xbc0], 0x9d2
jge 0x1001726b
and dword [ebp - 0x348], 0
and dword [ebp - 0x3f4], 0
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x348]
push eax
push 0x10009ae0
call fcn.10050bab
add esp, 0xc
cmp dword [ebp - 0x348], 0
je 0x10017209
cmp dword [ebp - 0x3f4], 0
jne 0x10017216
cmp dword [ebp - 0x348], 1
jle 0x10017216
push 0x10009bcc
call fcn.10050f86
pop ecx
jmp 0x1001726b
mov eax, dword [ebp - 0x3f4]
add eax, 0x30
push eax
push 0x10009bd8
call fcn.10050dc6
pop ecx
pop ecx
mov dword [ebp - 0x494], 1
jmp 0x10017245
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x348]
jge 0x10017260
push 0x10009bdc
call fcn.10050dc6
pop ecx
jmp 0x10017238
push 0x10009be0
call fcn.10050dc6
pop ecx
mov dword [ebp - 0xde0], 0xfc1c5751
mov dword [ebp - 0x8d0], 0x41022496
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xde0], eax
jmp 0x100172dd
mov dword [ebp - 0xbc8], 0xe5f58cdc
push 1
lea eax, [ebp - 0xbc8]
push eax
push 0x6975
lea eax, [ebp - 0x3fc]
push eax
push 0x6512
push 0
push 0x2663
call fcn.10013942
add esp, 0x1c
mov byte [ebp - 0x141], 0
push 0x73e4
push 0
lea eax, [ebp - 0x141]
push eax
call fcn.10024895
add esp, 0xc
mov dword [ebp - 0x118], 0xd5e48d32
mov dword [ebp - 0x2e0], 0x7f0a
mov dword [ebp - 0x3a0], 1
mov dword [ebp - 0x464], 0x95aa
mov dword [ebp - 0xbd0], 0x6660
mov dword [ebp - 0x4bc], 0xfffffff6
mov dword [ebp - 0xda8], 0xf2fd
mov dword [ebp - 0x9b8], 0
push 2
lea ecx, [ebp - 0xfcc]
call fcn.1000bc50
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x20], 0
jmp 0x10017351
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10017367
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xef0], 4
jmp 0x1001734a
mov dword [ebp - 0x20], 0
jmp 0x10017377
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1001738d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x404], 6
jmp 0x10017370
mov dword [ebp - 0x20], 0
jmp 0x1001739d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100173b3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xccc], 0xfffffffd
jmp 0x10017396
push 0
lea eax, [ebp - 0xfcc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100210e0
add esp, 0xc
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x2e0], eax
jge 0x100173ef
mov dword [ebp - 0xd40], 1
jmp 0x100173f6
and dword [ebp - 0xd40], 0
cmp dword [ebp - 0x3a0], 0
jne 0x100174cb
imul eax, dword [ebp - 0x2e0], 0x6cc7
cmp eax, dword [ebp - 0x3a0]
jge 0x10017421
mov dword [ebp - 0x718], 1
jmp 0x10017428
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 1
jl 0x1001743d
mov dword [ebp - 0x2d8], 1
jmp 0x10017444
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp + eax - 0xef0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp + eax - 0x404], ecx
mov eax, dword [ebp - 0x2d8]
dec eax
je 0x1001748f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x404], 0
je 0x1001748f
mov dword [ebp - 0x9b0], 1
jmp 0x10017496
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x9b0]
sub eax, 0x83e7
cmp eax, 1
je 0x100174b2
mov dword [ebp - 0x720], 1
jmp 0x100174b9
and dword [ebp - 0x720], 0
cmp dword [ebp - 0x720], 0xfffffff7
jge 0x100174cb
and dword [ebp - 0x8d8], 0
jmp 0x100174d5
mov dword [ebp - 0x8d8], 1
mov eax, dword [ebp - 0x2e0]
sub eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x3a0]
jne 0x100174f5
mov dword [ebp - 0x728], 1
jmp 0x100174fc
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
sub eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xa20], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa20]
mov dword [ebp + eax - 0xccc], ecx
cmp dword [ebp - 0xa20], 0x1ac0
jle 0x10017539
mov dword [ebp - 0x730], 1
jmp 0x10017540
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x730], eax
jg 0x10017567
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x404], 0
jne 0x10017567
and dword [ebp - 0x8e0], 0
jmp 0x10017571
mov dword [ebp - 0x8e0], 1
mov eax, dword [ebp - 0xbd0]
cmp dword [ebp - 0x8e0], eax
jl 0x1001758b
mov dword [ebp - 0x738], 1
jmp 0x10017592
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
neg eax
mov ecx, dword [ebp - 0xda8]
lea eax, [eax + ecx - 0x1494fb38]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x119c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xef0], 0x58e469ad
jle 0x100175e4
mov dword [ebp - 0x740], 1
jmp 0x100175eb
and dword [ebp - 0x740], 0
push 0
lea ecx, [ebp - 0xfcc]
call fcn.1000bcce
mov ecx, dword [ebp - 0x740]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x11a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xccc], 0x6d9de360
jg 0x1001762b
mov dword [ebp - 0x8e8], 1
jmp 0x10017632
and dword [ebp - 0x8e8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8e8]
mov dword [ebp + eax - 0xccc], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfcc]
call fcn.1000bcb2
mov dword [ebp - 0x7c], 0x91cb4e76
mov dword [ebp - 0x474], 0xffffffff
mov dword [ebp - 0x1f0], 0x5020f89b
mov dword [ebp - 0x350], 0
jmp 0x10017688
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x100176a4
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x1374], 0x85f70ad6
jmp 0x1001767b
mov byte [ebp - 0x17b], 0
push 0x1ca8
push 0x60f5
push 0
push 0
push 0x19ee
push 0x7a30
lea eax, [ebp - 0x17b]
push eax
call fcn.1001d9e7
add esp, 0x1c
mov dword [ebp - 0x1f0], 0
jmp 0x100176eb
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x10017707
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x1374], 1
jmp 0x100176de
mov dword [ebp - 0xe30], 5
push 2
lea ecx, [ebp - 0x1014]
call fcn.1000bc50
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xbd8], 0xee67
mov dword [ebp - 0xd48], 0x40c9ba5b
mov dword [ebp - 0xbe0], 0x57511ecb
mov dword [ebp - 0xbe8], 0x1fd9ab8a
mov dword [ebp - 0xd50], 0xffffffff
mov dword [ebp - 0x2e8], 0
jmp 0x10017770
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jge 0x10017792
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x1014]
call fcn.1000bcce
mov dword [eax], 0x551b32e2
jmp 0x10017763
push 0x65f3
lea eax, [ebp - 0xbd8]
push eax
push 0xebb
push 0x24a2
push 0
lea eax, [ebp - 0xd48]
push eax
lea eax, [ebp - 0xbe0]
push eax
lea eax, [ebp - 0xe30]
push eax
push 0x46d3
push 0
push 0x4939
lea eax, [ebp - 0xbe8]
push eax
push 0x4063
lea eax, [ebp - 0x1014]
push eax
push 0x7457
lea eax, [ebp - 0xd50]
push eax
push 1
call fcn.1001df93
add esp, 0x44
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x10017811
push 0
push 0
call fcn.10013a90
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1014]
call fcn.1000bcb2
mov dword [ebp - 0x388], 0
jmp 0x10017839
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jge 0x10017855
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0xc20], 0x66c1932e
jmp 0x1001782c
mov dword [ebp - 0x1e0], 0x490c4d8e
push 3
lea ecx, [ebp - 0xff0]
call fcn.1000bc50
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x74], 0
jmp 0x10017883
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10017899
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x40c], 0xdf75
jmp 0x1001787c
mov dword [ebp - 0x74], 0
jmp 0x100178a9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x100178c2
push dword [ebp - 0x74]
lea ecx, [ebp - 0xff0]
call fcn.1000bcce
or dword [eax], 0xffffffff
jmp 0x100178a2
mov dword [ebp - 0x1e0], 0
jmp 0x100178db
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x10017af7
mov dword [ebp - 0x110], 1
mov dword [ebp - 0xbf0], 0xe6e836ea
mov dword [ebp - 0x110], 0x2e31d83
cmp dword [ebp - 0x110], 0
je 0x10017931
mov byte [ebp - 0x139], 0
push 0
push 0x71d9
lea eax, [ebp - 0x139]
push eax
call fcn.10029861
add esp, 0xc
jmp 0x10017af2
mov dword [ebp - 0x46c], 7
mov dword [ebp - 0x760], 6
cmp dword [ebp - 0x110], 0
jne 0x100179db
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x46c], eax
jne 0x1001796c
mov dword [ebp - 0x748], 1
jmp 0x10017973
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 1
jne 0x10017988
mov dword [ebp - 0xa5c], 1
jmp 0x1001798f
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0xa5c], eax
jl 0x100179a9
mov dword [ebp - 0x750], 1
jmp 0x100179b0
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40c]
imul eax, dword [ebp - 0x750]
cmp eax, 0xfffffffa
jg 0x100179db
cmp dword [ebp - 0x1e0], 0
jne 0x100179db
and dword [ebp - 0x8f0], 0
jmp 0x100179e5
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x8f0]
imul eax, eax, 0x5f4e
mov dword [ebp - 0x760], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40c], 0xfcb8f1fe
jne 0x10017a1d
mov dword [ebp - 0x758], 1
jmp 0x10017a24
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0xbf0]
cmp dword [ebp - 0x758], eax
jge 0x10017a3e
mov dword [ebp - 0x9c0], 1
jmp 0x10017a45
and dword [ebp - 0x9c0], 0
cmp dword [ebp - 0x9c0], 2
jb 0x10017a63
cmp dword [ebp - 0x760], 0
je 0x10017a63
mov dword [ebp - 0xdb0], 1
jmp 0x10017a6a
and dword [ebp - 0xdb0], 0
imul eax, dword [ebp - 0x110], 7
test eax, eax
jne 0x10017a8e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40c], 0
jne 0x10017a8e
and dword [ebp - 0x768], 0
jmp 0x10017a98
mov dword [ebp - 0x768], 1
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x8f8], eax
push 0
lea ecx, [ebp - 0xff0]
call fcn.1000bcce
mov ecx, dword [ebp - 0x8f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8f8]
cmp eax, dword [ebp - 0x768]
jle 0x10017ad3
mov dword [ebp - 0xa28], 1
jmp 0x10017ada
and dword [ebp - 0xa28], 0
imul eax, dword [ebp - 0xa28], 0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x46c], 0
je 0x10017af2
jmp 0x10017af7
jmp 0x100178ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff0]
call fcn.1000bcb2
mov dword [ebp - 0x118], 0xffffffea
jmp 0x10017b1f
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffe9
jg 0x10018b4b
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0x11ac], 6
mov dword [ebp - 0x11b4], 0
mov dword [ebp - 0x11bc], 0x8da8e97e
mov dword [ebp - 0x11c4], 1
mov dword [ebp - 0x11cc], 0x8c66f5a9
push 4
lea ecx, [ebp - 0x1234]
call fcn.1000bc50
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x770], 0xfffffffb
mov dword [ebp - 0xbf8], 0x3bd6
mov dword [ebp - 0x2f0], 0
jmp 0x10017bb3
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x10017bd5
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x1234]
call fcn.1000bcce
mov dword [eax], 0xc891c553
jmp 0x10017ba6
mov eax, dword [ebp - 0x770]
dec eax
mov dword [ebp - 0x770], eax
push 0
push 0x6d4
lea eax, [ebp - 0xbf8]
push eax
push 0x1ada
call fcn.1001e7c4
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1234]
call fcn.1000bcb2
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11e4], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x11ec], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0x118]
cmp eax, 1
jg 0x10017c49
mov dword [ebp - 0x900], 1
jmp 0x10017c50
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x900]
cmp eax, dword [ebp - 0x1c0]
jl 0x10017c70
mov dword [ebp - 0x778], 1
jmp 0x10017c77
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
neg eax
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x118]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10018311
mov dword [ebp - 0x358], 0xd313dd33
mov dword [ebp - 0x11f4], 0xdb7b2415
push 1
lea ecx, [ebp - 0x1264]
call fcn.1000bc50
mov dword [ebp - 4], 0x12
push 0x837
push 1
lea eax, [ebp - 0x12e8]
push eax
push 0x70f1
push 1
push 0x3457
push 0x3495
push 0x7b6f
push 0xefc
push 0x5f78
push 0
push 0x71d5
lea eax, [ebp - 0x1264]
push eax
push 0x2655
call fcn.1000feb5
add esp, 0x38
mov dword [ebp - 0x358], 6
jmp 0x10017d2a
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x1c
jg 0x10018016
mov dword [ebp - 0x2f8], 0xfe01bd97
mov dword [ebp - 0x12f4], 1
mov dword [ebp - 0x12fc], 0x6e700d62
mov dword [ebp - 0x360], 0xc6076fda
mov dword [ebp - 0x1304], 8
mov dword [ebp - 0x130c], 1
push 3
lea ecx, [ebp - 0x1254]
call fcn.1000bc50
mov byte [ebp - 4], 0x13
push 3
lea ecx, [ebp - 0x1244]
call fcn.1000bc50
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x1254]
push eax
push 0
push 0x5a11
call fcn.10029fd0
add esp, 0x10
lea eax, [ebp - 0xd58]
push eax
push 0x6984
push 0x78e2
push 0x6e49
push 1
push 0x3f0a
push 0x726f
push 0x7610
lea eax, [ebp - 0x1244]
push eax
push 0
call fcn.1000fcf4
add esp, 0x28
mov dword [ebp - 0x2f8], 0x12
jmp 0x10017e03
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xfffffffa
jge 0x10017ff3
push 3
lea ecx, [ebp - 0xf48]
call fcn.1000bc50
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x3b0], 0x35c5735
mov dword [ebp - 0x1314], 0
mov dword [ebp - 0xc00], 0
push 0x19c8
push 1
push 0x4103
push 0x1da0
push 0
push 0x3f2c
push 0x7d37
push 0x6d5
push 0x6a9e
push 0x3d3a
push 1
lea eax, [ebp - 0xf48]
push eax
push 0x30b9
lea eax, [ebp - 0x200]
push eax
call fcn.1000feb5
add esp, 0x38
mov dword [ebp - 0x200], 0
jmp 0x10017ea1
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x10017ebd
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x13c4], 0
jmp 0x10017e94
mov dword [ebp - 0x3b0], 0
jmp 0x10017ed6
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jg 0x10017f66
mov dword [ebp - 0xdf0], 0x92f644a
mov dword [ebp - 0x300], 0
jmp 0x10017f06
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x10017f22
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x13a4], 0x1d52aa0a
jmp 0x10017ef9
lea eax, [ebp - 0xc00]
push eax
push 0
push 0x68d4
lea eax, [ebp - 0xdf0]
push eax
push 0
push 0x434b
push 0x3931
push 0x2cd0
lea eax, [ebp - 0xf48]
push eax
push 0x7e88
push 0x3a40
call fcn.100252ca
add esp, 0x2c
jmp 0x10017ec9
mov dword [ebp - 0x360], 0
jmp 0x10017f7f
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xfffffffd
je 0x10017fdf
push 1
lea ecx, [ebp - 0xffc]
call fcn.1000bc50
mov byte [ebp - 4], 0x16
push 0x620
push 0x1cbe
lea eax, [ebp - 0xffc]
push eax
push 0
lea eax, [ebp - 0x131c]
push eax
call fcn.10027b7d
add esp, 0x14
push 0
lea ecx, [ebp - 0xffc]
call fcn.1000bcce
mov dword [eax], 2
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xffc]
call fcn.1000bcb2
jmp 0x10017f72
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xf48]
call fcn.1000bcb2
jmp 0x10017df6
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1244]
call fcn.1000bcb2
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1254]
call fcn.1000bcb2
jmp 0x10017d1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1264]
call fcn.1000bcb2
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x100181d6
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x910], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x10018064
cmp dword [ebp - 0x18], 0
je 0x10018064
mov dword [ebp - 0xa78], 1
jmp 0x1001806b
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx + 1]
cmp eax, dword [ebp - 0x18]
jg 0x10018086
mov dword [ebp - 0x9c8], 1
jmp 0x1001808d
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x9c8], eax
jne 0x100180a4
mov dword [ebp - 0x780], 1
jmp 0x100180ab
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x780], eax
jg 0x100180c2
mov dword [ebp - 0x908], 1
jmp 0x100180c9
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x908], eax
jge 0x100180e0
mov dword [ebp - 0x788], 1
jmp 0x100180e7
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x788]
cmp dword [ebp - 0xa78], eax
jl 0x10018105
mov dword [ebp - 0x790], 1
jmp 0x1001810c
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x790], eax
je 0x1001812a
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1001812a
mov dword [ebp - 0xc08], 1
jmp 0x10018131
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1338], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1300], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0x910]
sub eax, dword [ebp - 0x18]
je 0x10018188
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10018186
push 0
push 0x77f8
push 1
call fcn.10011315
add esp, 0xc
jmp 0x100181ce
mov dword [ebp - 0xd60], 0xffffffff
mov dword [ebp - 0x18], 1
jmp 0x100181a2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x14
jg 0x100181c4
mov byte [ebp - 0x149], 0
lea eax, [ebp - 0x149]
push eax
push 1
push 0
call fcn.1001058b
add esp, 0xc
jmp 0x1001819b
mov dword [ebp - 0xd60], 1
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [ebp - 0x414], 0xfffffffb
mov dword [ebp - 0x390], 0xfffffff9
mov dword [ebp - 0x7a0], 0
mov dword [ebp - 0xc10], 0
mov dword [ebp - 0x1198], 0xd2466e9f
mov dword [ebp - 0x1050], 0xfffffff7
mov dword [ebp - 0x1278], 0x93e623b4
mov dword [ebp - 0xdb8], 1
mov dword [ebp - 0x308], 0
jmp 0x1001823f
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1001825b
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x13ac], 0x7a5eafb5
jmp 0x10018232
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x11a0], eax
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x390], eax
jge 0x10018299
mov dword [ebp - 0x798], 1
jmp 0x100182a0
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x7a0]
add eax, dword [ebp - 0x798]
cmp eax, 0xfffffff7
jne 0x100182bd
mov dword [ebp - 0x9d0], 1
jmp 0x100182c4
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
sub eax, dword [ebp - 0x414]
add eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xc10], eax
push 0
lea eax, [ebp - 0xdb8]
push eax
call fcn.1002055e
pop ecx
pop ecx
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x1001830c
push 0
push 0x30b3
call fcn.10029d12
pop ecx
pop ecx
jmp 0x10018b46
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x474]
push eax
push 0x3b8e
push 0
push 0x444a
call fcn.10025291
add esp, 0x14
mov dword [ebp - 0x5c], 9
mov dword [ebp - 0x208], 0xfffffff9
mov dword [ebp - 0x1068], 0x458c458a
mov dword [ebp - 0x5c], 0
jmp 0x1001835e
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff1
je 0x10018542
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x310], 0
jmp 0x1001838b
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x100183a7
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x49c], 5
jmp 0x1001837e
cmp dword [ebp - 0x5c], 0
je 0x1001845b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1310], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1074], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x49c]
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0x5c]
je 0x100183f1
mov dword [ebp - 0x918], 1
jmp 0x100183f8
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x918]
cmp eax, 0x11c3fc02
je 0x10018414
mov dword [ebp - 0x7a8], 1
jmp 0x1001841b
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x11a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x41c], 0
je 0x1001845b
mov dword [ebp - 0xa30], 1
jmp 0x10018462
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0xa30]
jle 0x10018479
mov dword [ebp - 0x7b0], 1
jmp 0x10018480
and dword [ebp - 0x7b0], 0
cmp dword [ebp - 0x7b0], 0x1c1d
jg 0x10018498
mov dword [ebp - 0x920], 1
jmp 0x1001849f
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x208], 0
jmp 0x100184c4
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jl 0x1001853d
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x368], 0
jmp 0x100184f0
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x1001850c
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0xd68], 0x11de2a90
jmp 0x100184e3
push 0x2ed2
lea eax, [ebp - 0xc18]
push eax
push 0
push 0x3426
call fcn.1001e61c
add esp, 0x10
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd68], 0xfffffffd
jmp 0x100184b7
jmp 0x10018357
mov dword [ebp - 0x7c], 0
jmp 0x10018552
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x2e
jg 0x10018b46
mov dword [ebp - 0x474], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x474]
mov dword [ebp + eax - 0xc20], ecx
mov dword [ebp - 0x64], 0xde19d29b
mov dword [ebp - 0x120], 0x600d5493
mov dword [ebp - 0x1024], 0xa0122d80
mov dword [ebp - 0x1020], 0xa0122d80
mov dword [ebp - 0x101c], 0xa0122d80
mov dword [ebp - 0x1018], 0xa0122d80
mov dword [ebp - 0xe20], 0x2399
cmp dword [ebp - 0xe20], 0x9be
jge 0x10018877
lea eax, [ebp - 0xd70]
push eax
lea eax, [ebp - 0xc28]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0x100099fc
call fcn.10050bab
add esp, 0x10
and dword [ebp - 0x424], 0
jmp 0x10018604
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0xc28]
jge 0x10018661
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x7b8]
push eax
push 0x10009ae0
call fcn.10050bab
add esp, 0xc
lea eax, [ebp - 0x9d8]
push eax
imul ecx, dword [ebp - 0x7b8], 0xc
add ecx, 0x11a15908
call fcn.1002e3cd
lea eax, [ebp - 0x7b8]
push eax
imul ecx, dword [ebp - 0x9d8], 0xc
add ecx, 0x11a15908
call fcn.1002e3cd
jmp 0x100185f7
push 0xa6
push 1
push 0x10c7aa90
call fcn.10049fa7
add esp, 0xc
and dword [ebp - 0x4b4], 0
jmp 0x1001868b
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
cmp eax, dword [ebp - 0xd70]
jge 0x10018712
lea eax, [ebp - 0x42c]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x42c]
mov byte [eax + 0x10c7aa90], 0
imul ecx, dword [ebp - 0x42c], 0xc
add ecx, 0x11a15908
call fcn.1000fb99
dec eax
mov dword [ebp - 0x318], eax
jmp 0x100186e1
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
jl 0x1001870d
push dword [ebp - 0x318]
imul ecx, dword [ebp - 0x42c], 0xc
add ecx, 0x11a15908
call fcn.1000bcce
mov eax, dword [eax]
mov byte [eax + 0x10c7aa90], 0
jmp 0x100186d4
jmp 0x1001867e
mov dword [ebp - 0x210], 1
jmp 0x1001872b
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x47c]
jg 0x1001874e
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x210]
mov dword [eax*4 + 0x10c7a5b0], ecx
jmp 0x1001871e
mov dword [ebp - 0xb8], 1
jmp 0x10018767
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x47c]
jg 0x1001880e
mov eax, dword [ebp - 0xb8]
movzx eax, byte [eax + 0x10c7aa90]
test eax, eax
je 0x10018809
imul ecx, dword [ebp - 0xb8], 0xc
add ecx, 0x11a15908
call fcn.1000fb99
dec eax
mov dword [ebp - 0x218], eax
jmp 0x100187b2
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x10018809
push dword [ebp - 0x218]
imul ecx, dword [ebp - 0xb8], 0xc
add ecx, 0x11a15908
call fcn.1000bcce
mov eax, dword [eax]
movzx eax, byte [eax + 0x10c7aa90]
test eax, eax
je 0x10018807
push dword [ebp - 0x218]
imul ecx, dword [ebp - 0xb8], 0xc
add ecx, 0x11a15908
call fcn.1000bcce
push dword [eax]
push dword [ebp - 0xb8]
call fcn.10013b8a
pop ecx
pop ecx
jmp 0x100187a5
jmp 0x1001875a
and dword [ebp - 0x434], 0
mov dword [ebp - 0x3a8], 1
jmp 0x1001882e
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
cmp eax, dword [ebp - 0x47c]
jg 0x10018865
push dword [ebp - 0x3a8]
call fcn.10013b52
pop ecx
mov esi, eax
push 1
call fcn.10013b52
pop ecx
cmp esi, eax
je 0x10018863
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
jmp 0x10018821
push dword [ebp - 0x434]
push 0x10009ae8
call fcn.10050dc6
pop ecx
pop ecx
mov dword [ebp - 0x320], 0
jmp 0x10018890
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x100188ac
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0xe6c], 0
jmp 0x10018883
mov dword [ebp - 0x64], 0
jmp 0x100188bc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x10018a5d
mov dword [ebp - 0x4f0], 0xfffffffe
mov dword [ebp - 0x128], 0xd2466e9f
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xe6c]
mov dword [ebp - 0x1288], eax
xor eax, eax
inc eax
je 0x1001893f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe6c], 0
jne 0x10018920
mov dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4f0], eax
jne 0x10018920
and dword [ebp - 0x4f4], 0
jmp 0x1001892a
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x1001894f
push 9
pop eax
test eax, eax
jne 0x1001894f
and dword [ebp - 0xc30], 0
jmp 0x10018959
mov dword [ebp - 0xc30], 1
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xe6c]
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xe6c]
mov dword [ebp - 0x11b0], eax
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x64], eax
jne 0x10018988
cmp dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x120], eax
jge 0x1001899f
mov dword [ebp - 0x4ec], 1
jmp 0x100189a6
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x120], 2
jmp 0x100189cb
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x10018a58
mov dword [ebp - 0x370], 0
jmp 0x100189f1
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 2
jge 0x10018a0d
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x107c], 0x276cc72b
jmp 0x100189e4
mov dword [ebp - 0x128], 2
jmp 0x10018a26
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x10018a42
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x107c], 0x78ef8a6e
jmp 0x10018a19
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1024], 0
jmp 0x100189be
jmp 0x100188b5
mov byte [ebp - 0x151], 0
push 0x506b
push 0
lea eax, [ebp - 0x151]
push eax
push 0x2da3
call fcn.100231d2
add esp, 0x10
mov byte [ebp - 0x159], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0xcdc], 1
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0x220], 0xfffffff9
jmp 0x10018abd
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffee
jne 0x10018b28
mov dword [ebp - 0xc40], 1
mov dword [ebp - 0xcd8], 0
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0xc40]
push eax
push 0
call fcn.10020a56
add esp, 0x18
mov byte [ebp - 0x185], 0
lea eax, [ebp - 0x185]
push eax
push 0
push 0x4bf1
push 0
call fcn.10020578
add esp, 0x10
jmp 0x10018ab0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10018b41
push 0x753f
push 0
call fcn.100204cc
pop ecx
pop ecx
jmp 0x1001854b
jmp 0x10017b12
mov dword [ebp - 0x3c], 0x14b7
mov dword [ebp - 0x534], 0xffffffff
mov dword [ebp - 0xc48], 0x9b65cab4
push 3
lea ecx, [ebp - 0xf60]
call fcn.1000bc50
mov dword [ebp - 4], 0x17
push 2
lea ecx, [ebp - 0xfc0]
call fcn.1000bc50
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x9c], 0
jmp 0x10018ba4
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10018bc6
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xf60]
call fcn.1000bcce
mov dword [eax], 0xfffffffc
jmp 0x10018b97
mov dword [ebp - 0x9c], 0
jmp 0x10018bdf
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10018c01
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xfc0]
call fcn.1000bcce
mov dword [eax], 0x7b6c411e
jmp 0x10018bd2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x12f8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1098], eax
cmp dword [ebp - 0x3c], 0xa40f2fda
jbe 0x10018c31
mov dword [ebp - 0x504], 1
jmp 0x10018c38
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xfffffffb
jge 0x10018c4d
mov dword [ebp - 0x50c], 1
jmp 0x10018c54
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x50c], eax
je 0x10018c6b
mov dword [ebp - 0x514], 1
jmp 0x10018c72
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x2eaa
jg 0x10018c8a
mov dword [ebp - 0x51c], 1
jmp 0x10018c91
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x51c], eax
jl 0x10018cae
cmp dword [ebp - 0x3c], 0
je 0x10018cae
mov dword [ebp - 0x524], 1
jmp 0x10018cb5
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x524], eax
jle 0x10018ccc
mov dword [ebp - 0x52c], 1
jmp 0x10018cd3
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xfffffffc
jbe 0x10018ce8
mov dword [ebp - 0xce4], 1
jmp 0x10018cef
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x534], eax
push 0x6f0a
push 0
lea eax, [ebp - 0xc48]
push eax
push 0x758
push 1
lea eax, [ebp - 0xf60]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x36bd
push 0x944
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.100252ca
add esp, 0x2c
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xfc0]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf60]
call fcn.1000bcb2
mov dword [ebp - 0x7c], 0x16
jmp 0x10018d6f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x26
jge 0x1001954f
mov dword [ebp - 0xcec], 0x3b4e1a36
mov dword [ebp - 0xc58], 0xffffffff
mov dword [ebp - 0xcfc], 1
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0xc50], 0xa233712
mov dword [ebp - 0xc60], 0xffffffff
lea eax, [ebp - 0xcec]
push eax
push 0
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0xc58]
push eax
push 0
lea eax, [ebp - 0xcfc]
push eax
push 0x7496
push 0x2180
lea eax, [ebp - 0xc60]
push eax
call fcn.1002731b
add esp, 0x28
mov dword [ebp - 0xd04], 1
cmp dword [ebp - 0xd04], 0
je 0x10018e0d
jmp 0x1001954f
mov dword [ebp - 0x1034], 0xfffffffe
mov dword [ebp - 0x1030], 0xfffffffe
mov dword [ebp - 0x102c], 0xfffffffe
mov dword [ebp - 0x1028], 0xfffffffe
mov dword [ebp - 0x328], 0x1c1ec2db
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0xc68], 0x21afa9b6
mov dword [ebp - 0x328], 0
jmp 0x10018e6c
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jg 0x10018f3c
mov dword [ebp - 0x398], 0
jmp 0x10018e92
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 4
jge 0x10018eae
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0xee8], 0x39ed080c
jmp 0x10018e85
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xee8], 0
jmp 0x10018edc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xee8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xee8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xee8], 3
jg 0x10018f37
xor eax, eax
jne 0x10018f1f
mov dword [ebp - 0x53c], 0x98764276
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xee8]
mov eax, dword [ebp + eax*4 - 0x1034]
cmp eax, dword [ebp - 0x53c]
jl 0x10018f1f
and dword [ebp - 0x544], 0
jmp 0x10018f29
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xc68], eax
jmp 0x10018ec1
jmp 0x10018e5f
mov byte [ebp - 0x161], 0
push 4
lea ecx, [ebp - 0x270]
call fcn.1000bc50
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xd14], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x10018f7a
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x10018f96
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x4e4], 9
jmp 0x10018f6d
push 1
push 0x1d3a
push 0x4c5c
push 0
push 0x67c8
lea eax, [ebp - 0x270]
push eax
push 1
lea eax, [ebp - 0x228]
push eax
call fcn.10010fde
add esp, 0x20
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
and dword [eax], 0
jmp 0x10018ff7
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x54c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
cmp dword [eax], 3
jg 0x100192e3
mov dword [ebp - 0x4a4], 5
mov dword [ebp - 0x58c], 0x440e708b
push 3
lea ecx, [ebp - 0x1008]
call fcn.1000bc50
mov byte [ebp - 4], 0x1a
push 0x2194
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x10a0]
push eax
push 0
push 0x253d
call fcn.10025650
add esp, 0x14
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x4e4], 0
jne 0x1001908f
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x4e4], 0
jne 0x1001908f
and dword [ebp - 0x57c], 0
jmp 0x10019099
mov dword [ebp - 0x57c], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e4], 0
jne 0x100190cb
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x4e4], 0
jne 0x100190cb
and dword [ebp - 0xd0c], 0
jmp 0x100190d5
mov dword [ebp - 0xd0c], 1
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x4e4], 0xfffffffa
je 0x100190fa
mov dword [ebp - 0x554], 1
jmp 0x10019101
and dword [ebp - 0x554], 0
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x4e4]
cmp dword [ebp - 0x554], eax
jne 0x1001912b
mov dword [ebp - 0x55c], 1
jmp 0x10019132
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp eax, dword [ebp - 0x55c]
jl 0x10019152
mov eax, 0x80f8
test eax, eax
je 0x10019169
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x4e4], 0
mov eax, 0x284868fd
test eax, eax
je 0x1001918e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x1001918e
mov dword [ebp - 0x564], 1
jmp 0x10019195
and dword [ebp - 0x564], 0
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x4e4]
cmp dword [ebp - 0x564], eax
jle 0x100191bf
mov dword [ebp - 0xc70], 1
jmp 0x100191c6
and dword [ebp - 0xc70], 0
mov eax, 0x5ec56044
add eax, 0xe924f63a
mov dword [ebp - 0x4a4], eax
imul eax, dword [ebp - 0x4a4], 0x2ad0
test eax, eax
jne 0x100191ff
cmp dword [ebp - 0x4a4], 0
jne 0x100191ff
cmp dword [ebp - 0x58c], 0
jne 0x100191ff
and dword [ebp - 0x43c], 0
jmp 0x10019209
mov dword [ebp - 0x43c], 1
push 2
lea ecx, [ebp - 0x1008]
call fcn.1000bcce
mov ecx, dword [ebp - 0x43c]
mov dword [eax], ecx
cmp dword [ebp - 0x43c], 0
je 0x10019243
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4e4], 0
je 0x10019243
mov dword [ebp - 0x56c], 1
jmp 0x1001924a
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e4]
add eax, dword [ebp - 0x56c]
cmp eax, 6
jl 0x1001926e
mov dword [ebp - 0x574], 1
jmp 0x10019275
and dword [ebp - 0x574], 0
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov esi, dword [ebp - 0x574]
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x270]
call fcn.1000bcce
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x4e4]
jg 0x100192af
mov dword [ebp - 0x584], 1
jmp 0x100192b6
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x57c]
imul eax, dword [ebp - 0x584]
sub eax, dword [ebp - 0x58c]
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1008]
call fcn.1000bcb2
jmp 0x10018fd3
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x10019321
push 0x656a
push 0x5efa
push 0x500d
push 1
push 0xefa
push 0x394d
push 0
push 0x294f
push 1
call fcn.1001026e
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.1000bcb2
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1001954a
mov dword [ebp - 0x1298], 1
mov dword [ebp - 0x10a8], 0x67a876e6
mov dword [ebp - 0x11c0], 0x53644469
mov dword [ebp - 0x10b0], 0xf25cbd94
mov dword [ebp - 0x1320], 0x7161ab6e
mov dword [ebp - 0x10b8], 0x813f1a07
mov dword [ebp - 0x11c8], 0x7e67329
mov dword [ebp - 0x10c0], 0xfffffff6
push 1
lea ecx, [ebp - 0x1274]
call fcn.1000bc50
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xc78], 0x1f07
cmp dword [ebp - 0xc78], 0x4f3
jge 0x100194a3
lea eax, [ebp - 0xd1c]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
and dword [ebp - 0x198], 0
and dword [ebp - 0x484], 0
jmp 0x100193ed
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0xd1c]
jge 0x100194a3
lea eax, [ebp - 0x130]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x130]
and eax, 0x80000001
jns 0x10019424
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1001944d
cmp dword [ebp - 0x198], 0
jl 0x1001944d
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
jmp 0x10019486
mov eax, dword [ebp - 0x130]
and eax, 0x80000001
jns 0x1001945f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10019486
cmp dword [ebp - 0x198], 0
jge 0x10019486
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x130]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x100099ec
call fcn.10050dc6
pop ecx
pop ecx
jmp 0x100193e0
mov dword [ebp - 0x12a8], 1
push 0x779e
push 0x3067
lea eax, [ebp - 0x1274]
push eax
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.10026876
add esp, 0x14
mov dword [ebp - 0x6c], 0
jmp 0x100194dc
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x100194f2
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1428], 0xffffffff
jmp 0x100194d5
mov dword [ebp - 0x6c], 0
jmp 0x10019502
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10019518
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xeb8], 1
jmp 0x100194fb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xeb8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xeb8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1274]
call fcn.1000bcb2
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x10018d68
mov dword [ebp - 0x10c8], 0xaf43
push 0x30a9
push 0
push 0x23f6
push 0x7842
push 0x4ca4
push 0x5519
push 0x1120
call fcn.1001ffb3
add esp, 0x1c
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1001959d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp dword [ebp - 0x4a0], 0
jle 0x1001d56d
push 1
lea ecx, [ebp - 0xe0c]
call fcn.1000bc50
mov dword [ebp - 4], 0x1c
push 1
lea ecx, [ebp - 0xaa8]
call fcn.1000bc50
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x230], 0
jmp 0x100195f2
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x10019614
push dword [ebp - 0x230]
lea ecx, [ebp - 0xe0c]
call fcn.1000bcce
mov dword [eax], 0x5d6c05ba
jmp 0x100195e5
lea eax, [ebp - 0xaa8]
push eax
push 0x6c9c
push 1
lea eax, [ebp - 0x230]
push eax
push 0
push 0x5f84
call fcn.100109e3
add esp, 0x18
push 0
lea ecx, [ebp - 0xe0c]
call fcn.1000bcce
and dword [eax], 0
jmp 0x1001966e
push 0
lea ecx, [ebp - 0xe0c]
call fcn.1000bcce
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x594]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe0c]
call fcn.1000bcce
cmp dword [eax], 0x1a
jl 0x1001995f
mov dword [ebp - 0x138], 0x9598aaf0
mov dword [ebp - 0x58], 0x1e1c5a3d
mov dword [ebp - 0x330], 0
jmp 0x100196ae
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x100196ca
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x4d4], 6
jmp 0x100196a1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4d4], 0
jmp 0x100196f5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4d4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x4d4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4d4], 0
jl 0x1001985a
mov dword [ebp - 0xc80], 0x46b43d27
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x10019732
push 0x3237
push 0
call fcn.100275b8
pop ecx
pop ecx
mov dword [ebp - 0x138], 0x8108531d
cmp dword [ebp - 0x138], 1
je 0x10019751
mov dword [ebp - 0x59c], 1
jmp 0x10019758
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4d4]
cmp dword [ebp - 0x59c], eax
je 0x10019778
mov dword [ebp - 0x5a4], 1
jmp 0x1001977f
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 7
jge 0x10019794
mov dword [ebp - 0x5ac], 1
jmp 0x1001979b
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x4d4]
lea ecx, [ebp - 0xaa8]
call fcn.1000bcce
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5ac]
jle 0x100197c8
mov dword [ebp - 0x5b4], 1
jmp 0x100197cf
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x140], eax
jge 0x100197ef
mov dword [ebp - 0x5bc], 1
jmp 0x100197f6
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x5bc]
je 0x10019827
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x4d4]
lea ecx, [ebp - 0xaa8]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10019827
cmp dword [ebp - 0xc80], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x4d4]
lea ecx, [ebp - 0xaa8]
call fcn.1000bcce
mov esi, dword [eax]
add esi, 0x1ba6b42b
push 0
lea ecx, [ebp - 0xaa8]
call fcn.1000bcce
mov dword [eax], esi
jmp 0x100196dc
mov dword [ebp - 0x138], 0
jmp 0x10019873
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jg 0x1001995a
mov dword [ebp - 0x58], 0
jmp 0x10019890
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1001991b
mov dword [ebp - 0x140], 0
jmp 0x100198b3
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jg 0x10019916
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0x4d4], 0
je 0x100198ce
jmp 0x10019916
push 0x2e
push 0
push 0x2c51
push 0x1537
push 1
lea eax, [ebp - 0x140]
push eax
push 0x1c7f
lea eax, [ebp - 0xaa8]
push eax
push 0x2ef0
push 0x3ce3
push 0
push 0x32e1
push 0x111e
push 0x14fb
call fcn.1002023d
add esp, 0x38
jmp 0x100198a6
jmp 0x10019889
mov dword [ebp - 0x58], 2
jmp 0x1001992b
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x10019955
mov byte [ebp - 0xc3], 0
push 0x7356
lea eax, [ebp - 0xc3]
push eax
push 0
push 0xd10
call fcn.10020d30
add esp, 0x10
jmp 0x10019924
jmp 0x10019866
jmp 0x1001964a
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xaa8]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.1000bcb2
mov dword [ebp - 0xd24], 1
mov dword [ebp - 0xc90], 0xfffffffd
mov dword [ebp - 0xd44], 0x2086bd08
mov dword [ebp - 0xd3c], 0x3e58bfc4
mov dword [ebp - 0xc98], 0x3d9b9503
push 4
lea ecx, [ebp - 0xf78]
call fcn.1000bc50
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xd2c], 5
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0xca8], 7
mov dword [ebp - 0xd34], 0xb39e2240
mov dword [ebp - 0xca0], 0
lea eax, [ebp - 0xf78]
push eax
push 0x16b7
lea eax, [ebp - 0x11d0]
push eax
push 0
call fcn.1002a173
add esp, 0x10
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10019a2c
push 0
call fcn.1002104b
pop ecx
lea eax, [ebp - 0xd24]
push eax
push 0x666c
lea eax, [ebp - 0xc88]
push eax
push 0
lea eax, [ebp - 0xd2c]
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xd34]
push eax
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0xf78]
push eax
push 0
push 0x739b
lea eax, [ebp - 0xca8]
push eax
call fcn.1001ef85
add esp, 0x3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.1000bcb2
mov dword [ebp - 0x44], 0x42c7
mov dword [ebp - 0xd4c], 0x1b9a
cmp dword [ebp - 0xd4c], 0x9dc
jge 0x10019cf9
lea eax, [ebp - 0x444]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
mov dword [ebp - 0x10d0], 0xb
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x444]
dec eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0xcb0], 0
je 0x10019cf9
push 0x10009bc8
call fcn.10050f86
pop ecx
mov byte [ebp - 0xc7], 1
lea eax, [ebp - 0xc7]
push eax
push 0xb
lea ecx, [ebp - 0x1330]
call fcn.1000bcf4
mov dword [ebp - 4], 0x1f
lea eax, [ebp - 0x238]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
push dword [ebp - 0x238]
lea ecx, [ebp - 0xe9c]
call fcn.1000bc50
mov byte [ebp - 4], 0x20
and dword [ebp - 0x378], 0
jmp 0x10019b6d
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x238]
jge 0x10019b9b
push dword [ebp - 0x378]
lea ecx, [ebp - 0xe9c]
call fcn.1000bcce
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
jmp 0x10019b60
and dword [ebp - 0x3c4], 0
mov dword [ebp - 0x19c], 1
jmp 0x10019bbb
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xb
jge 0x10019ccb
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x238]
jge 0x10019ccb
mov byte [ebp - 0x35], 1
and dword [ebp - 0x338], 0
jmp 0x10019bf4
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x238]
jge 0x10019c44
push dword [ebp - 0x338]
lea ecx, [ebp - 0xe9c]
call fcn.1000bcce
mov eax, dword [eax]
add eax, dword [ebp - 0x19c]
push eax
lea eax, [ebp - 0x13bc]
push eax
lea ecx, [ebp - 0x1330]
call fcn.1000bd3b
mov ecx, eax
call fcn.1000bd7f
movzx eax, al
test eax, eax
jne 0x10019c42
mov byte [ebp - 0x35], 0
jmp 0x10019c44
jmp 0x10019be7
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10019cc6
push dword [ebp - 0x19c]
push 0x100099f4
call fcn.10050dc6
pop ecx
pop ecx
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
and dword [ebp - 0x3b8], 0
jmp 0x10019c81
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x238]
jge 0x10019cc6
push 0
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0xe9c]
call fcn.1000bcce
mov eax, dword [eax]
add eax, dword [ebp - 0x19c]
push eax
lea eax, [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x1330]
call fcn.1000bd3b
mov ecx, eax
call fcn.1000bd5a
jmp 0x10019c74
jmp 0x10019bae
push 0x10009955
call fcn.10050f86
pop ecx
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xe9c]
call fcn.1000c2c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1330]
call fcn.1000bd32
jmp 0x10019adc
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x80], 0
jmp 0x10019d1d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x10019d33
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1284], 0xa8c6a53d
jmp 0x10019d16
mov dword [ebp - 0x80], 0
jmp 0x10019d43
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x10019d59
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1368], 0
jmp 0x10019d3c
mov dword [ebp - 0x88], 2
jmp 0x10019d72
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10019ed4
mov dword [ebp - 0x148], 0xffff
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x12cc], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x10d8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1368], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1284], 0
jg 0x10019dce
mov dword [ebp - 0x5c4], 1
jmp 0x10019dd5
and dword [ebp - 0x5c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c4]
sub ecx, dword [ebp - 0x148]
imul ecx, dword [ebp - 0x148]
cmp dword [ebp + eax - 0x1284], ecx
jle 0x10019e03
mov dword [ebp - 0x5cc], 1
jmp 0x10019e0a
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x5cc], eax
jl 0x10019e26
xor eax, eax
inc eax
jne 0x10019e26
and dword [ebp - 0x5d4], 0
jmp 0x10019e30
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x5d4], eax
jge 0x10019e4a
mov dword [ebp - 0x5dc], 1
jmp 0x10019e51
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
inc eax
jne 0x10019e66
mov dword [ebp - 0x5e4], 1
jmp 0x10019e6d
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x148]
neg eax
cmp eax, dword [ebp - 0x5e4]
jge 0x10019e89
mov dword [ebp - 0x5ec], 1
jmp 0x10019e90
and dword [ebp - 0x5ec], 0
imul eax, dword [ebp - 0x5ec], 0x9740
cmp eax, dword [ebp - 0x148]
jle 0x10019eae
mov dword [ebp - 0x5f4], 1
jmp 0x10019eb5
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
je 0x10019ecf
jmp 0x10019d65
jmp 0x10019d65
mov dword [ebp - 0x88], 0
jmp 0x10019eed
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x10019fba
push 3
lea ecx, [ebp - 0xe84]
call fcn.1000bc50
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x2c0], 0
jmp 0x10019f27
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
jge 0x10019f49
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xe84]
call fcn.1000bcce
mov dword [eax], 1
jmp 0x10019f1a
mov byte [ebp - 0xc9], 0
push 0x681a
push 0
push 0x58f3
push 0x7eab
push 0x5e92
push 1
push 0x49ea
push 0x3b27
lea eax, [ebp - 0xc9]
push eax
push 0x3f60
call fcn.1002731b
add esp, 0x28
push 0
lea ecx, [ebp - 0xe84]
call fcn.1000bcce
mov esi, eax
push 2
lea ecx, [ebp - 0xe84]
call fcn.1000bcce
mov ecx, dword [esi]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe84]
call fcn.1000bcb2
jmp 0x10019ee0
mov dword [ebp - 0x734], 0xf8067e3
mov dword [ebp - 0x3f0], 4
mov dword [ebp - 0x11d8], 0xcf5720e8
mov dword [ebp - 0x64c], 0xf94f3783
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x4e8], 0x11accbad
push 1
lea ecx, [ebp - 0xe60]
call fcn.1000bc50
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x2cc], 0x9dbea522
mov dword [ebp - 0x614], 0xfffffff9
mov dword [ebp - 0x634], 0x16aac895
mov dword [ebp - 0xcb8], 3
push 4
lea ecx, [ebp - 0xf24]
call fcn.1000bc50
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x28], 0
jmp 0x1001a053
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001a06f
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe60]
call fcn.1000bcce
mov dword [eax], 0x8cb4c23a
jmp 0x1001a04c
mov dword [ebp - 0x28], 0
jmp 0x1001a07f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001a095
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd5c], 0xd35da2a
jmp 0x1001a078
mov dword [ebp - 0x28], 0
jmp 0x1001a0a5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1001a0c1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf24]
call fcn.1000bcce
mov dword [eax], 0x9cbc21b0
jmp 0x1001a09e
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x604], eax
push 0
lea ecx, [ebp - 0xe60]
call fcn.1000bcce
mov ecx, dword [ebp - 0x604]
mov dword [eax], ecx
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0x604], eax
jne 0x1001a109
mov dword [ebp - 0x60c], 1
jmp 0x1001a110
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x2c4]
cmp eax, dword [ebp - 0x60c]
jne 0x1001a13c
push 0
lea ecx, [ebp - 0xe60]
call fcn.1000bcce
cmp dword [eax], 0
je 0x1001a13c
mov dword [ebp - 0x644], 1
jmp 0x1001a143
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x634], 0
je 0x1001a161
cmp dword [ebp - 0x2c4], 0
je 0x1001a161
mov dword [ebp - 0x61c], 1
jmp 0x1001a168
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0x61c], eax
jl 0x1001a182
mov dword [ebp - 0x624], 1
jmp 0x1001a189
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0
jae 0x1001a19e
mov dword [ebp - 0xd54], 1
jmp 0x1001a1a5
and dword [ebp - 0xd54], 0
cmp dword [ebp - 0x4e8], 3
jne 0x1001a1ba
mov dword [ebp - 0x62c], 1
jmp 0x1001a1c1
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0xcb8], eax
push 3
lea ecx, [ebp - 0xf24]
call fcn.1000bcce
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c8]
mov eax, dword [eax]
sub eax, dword [ebp - 0x634]
imul eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x63c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x63c]
mov dword [ebp + eax - 0xd5c], ecx
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x63c], eax
jne 0x1001a239
mov dword [ebp - 0x654], 1
jmp 0x1001a240
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x64c]
cmp eax, dword [ebp - 0x654]
jle 0x1001a266
mov dword [ebp - 0x65c], 1
jmp 0x1001a26d
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x2cc]
imul eax, dword [ebp - 0x65c]
cmp eax, 0x69dd
je 0x1001a28d
mov dword [ebp - 0x664], 1
jmp 0x1001a294
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x4e8], eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xf24]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.1000bcb2
mov dword [ebp - 0x3f8], 0x441791e6
push 3
lea ecx, [ebp - 0xfe4]
call fcn.1000bc50
mov dword [ebp - 4], 0x24
mov dword [ebp - 0xcc4], 0xffffffff
push 1
push 1
push 0x22eb
push 0x3067
lea eax, [ebp - 0xcc4]
push eax
push 0x1533
push 0x1b5
push 0x38c
push 0
call fcn.1001e488
add esp, 0x24
mov dword [ebp - 0x744], 0xbb1300ca
mov dword [ebp - 0xd64], 0x15fb
cmp dword [ebp - 0xd64], 0xfcb
jge 0x1001a47b
lea eax, [ebp - 0x3d0]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0xac0]
call fcn.1000bc50
mov byte [ebp - 4], 0x25
and dword [ebp - 0x2d4], 0
jmp 0x1001a376
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x3d0]
jge 0x1001a3a4
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xac0]
call fcn.1000bcce
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
jmp 0x1001a369
push 1
lea ecx, [ebp - 0xac0]
call fcn.1000bcce
mov esi, eax
push 0
lea ecx, [ebp - 0xac0]
call fcn.1000bcce
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x674], ecx
mov byte [ebp - 0x3d], 1
mov dword [ebp - 0x240], 1
jmp 0x1001a3e7
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x3d0]
jge 0x1001a42f
push dword [ebp - 0x240]
lea ecx, [ebp - 0xac0]
call fcn.1000bcce
mov esi, eax
mov eax, dword [ebp - 0x240]
dec eax
push eax
lea ecx, [ebp - 0xac0]
call fcn.1000bcce
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x674]
je 0x1001a42d
mov byte [ebp - 0x3d], 0
jmp 0x1001a42f
jmp 0x1001a3da
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1001a445
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x67c], eax
jmp 0x1001a44c
and dword [ebp - 0x67c], 0
lea ecx, [ebp - 0xac0]
call fcn.1002e50d
mov eax, dword [eax]
add eax, dword [ebp - 0x67c]
push eax
push 0x100099ec
call fcn.10050dc6
pop ecx
pop ecx
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xac0]
call fcn.1000c2c6
mov dword [ebp - 0xb3c], 0x2967684a
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x12b8], 0x4e2d
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1001a4b8
push 0x13b4
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1001a4d5
push 0
push 1
call fcn.10013a90
pop ecx
pop ecx
mov dword [ebp - 0x684], 6
mov dword [ebp - 0x3d8], 0x3fcb50bf
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xd74], 1
mov dword [ebp - 0xd6c], 0xffffffff
mov dword [ebp - 0x10e8], 0x35b263d1
mov dword [ebp - 0x11e0], 0xffffffff
mov dword [ebp - 0xb14], 5
mov dword [ebp - 0x10f0], 0x5b14f4e7
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x684]
push eax
push 1
push 0
push 0xa83
push 0x7883
push 0x5920
call fcn.1001d9e7
add esp, 0x1c
cmp dword [ebp - 0x684], 0
je 0x1001a5d0
mov dword [ebp - 0x12d0], 0xffffffff
mov dword [ebp - 0x10f8], 0xe164caf
mov dword [ebp - 0x11e8], 0xfffffffd
mov dword [ebp - 0x68c], 0xe57f6cc9
mov dword [ebp - 0x2dc], 0
jmp 0x1001a5a2
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1001a5be
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x138c], 0xfffffffc
jmp 0x1001a595
mov eax, dword [ebp - 0x68c]
dec eax
mov dword [ebp - 0x68c], eax
jmp 0x1001a6e8
mov dword [ebp - 0xb08], 0xcb302aff
push 2
lea ecx, [ebp - 0xf90]
call fcn.1000bc50
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x694], 0x9339b884
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0x2e4], 0
jmp 0x1001a618
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x1001a63a
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xf90]
call fcn.1000bcce
mov dword [eax], 9
jmp 0x1001a60b
push 0x2562
push 0x4a97
push 0
call fcn.10024947
add esp, 0xc
push 1
lea ecx, [ebp - 0xf90]
call fcn.1000bcce
mov dword [eax], 1
mov dword [ebp - 0x694], 1
mov eax, dword [ebp - 0x694]
neg eax
cmp eax, dword [ebp - 0x3d8]
je 0x1001a687
mov dword [ebp - 0xcd0], 1
jmp 0x1001a68e
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x1100], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0xd74], eax
jg 0x1001a6c0
mov dword [ebp - 0xcf4], 1
jmp 0x1001a6c7
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xb08]
add eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb14], eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xf90]
call fcn.1000bcb2
mov dword [ebp - 0x2ec], 0
jmp 0x1001a701
jmp 0x1001d583
push 0x607c
push 0x5f98
push 0
call fcn.1001dab0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret