Function at 0x1000db75
Capabilities:
Allocate thread local storage
Delete directory
Encrypt data using speck
Get disk information
Log keystrokes via polling
Modify service
Set thread local storage value

Disassembly:
mov eax, 0x100638df
call fcn.10063290
sub esp, 0x970
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 4
pop esi
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x56c]
push esi
mov byte [ebp - 0x5c], dl
call fcn.1001b2e8
xor ebx, ebx
xor edx, edx
mov dword [ebp - 4], ebx
inc edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x48], 0x6ef6f0c3
mov dword [ebp - 0x48], 0x7df2ddfd
mov dword [ebp - 0x1c], ebx
jmp 0x1000dbd4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000dbc5
mov dword [ebp - 0x1c], ebx
jmp 0x1000dbef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x97c], 0xd2e84cbf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000dbde
mov dword [ebp - 0x40], 0x44a
cmp dword [ebp - 0x40], 0x520
jle 0x1000dc63
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0x1c44
mov edi, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x24], edi
mov esi, edi
mov edi, 0x63b1
mov eax, ebx
mov ecx, 0x1060d6f8
or eax, esi
cdq
push edx
push eax
call fcn.1001b0b7
dec esi
dec edi
jne 0x1000dc20
mov edi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x3c3e
jl 0x1000dc19
mov esi, dword [ebp - 0x28]
add ebx, esi
dec dword [ebp - 0x3c]
push 0
mov dword [ebp - 0x30], ebx
pop ebx
jne 0x1000dc11
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x4016
jl 0x1000dc07
xor edx, edx
inc edx
push 3
mov dword [ebp - 0x2c], ebx
pop edi
jmp 0x1000dd41
mov dword [ebp - 0x34], 0xf6285890
mov dword [ebp - 0x30], 0x9642e40c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000dc98
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4e4], 0x197cbb40
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000dc87
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x51978e60
jl 0x1000dd1f
mov dword [ebp - 0x48], 0xfffffff9
lea ecx, [ebp - 0x480]
push edi
call fcn.1001b2e8
mov dword [ebp - 0x48], 0xf8fb6f85
mov dword [ebp - 0x24], 0x62cf9e8
mov dword [ebp - 0x18], ebx
jmp 0x1000dced
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000dcde
dec dword [ebp - 0x24]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000dd0f
push 0x11f9
push 0xe0c
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea ecx, [ebp - 0x480]
call fcn.1001b36a
xor edx, edx
inc edx
jmp 0x1000dd25
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000dd39
mov dword [ebp - 0x34], 0x1e52
cmp dword [ebp - 0x34], ebx
jne 0x1000dd3e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1000dd2a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1000dc6e
mov byte [ebp - 4], dl
cmp dword [ebp - 0x40], 0x20d
jge 0x1000dd86
mov edx, 0x10007670
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000dd86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
xor esi, esi
inc esi
call fcn.1001b36a
push 4
lea ecx, [ebp - 0x594]
call fcn.1001b2e8
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x48], 0x6ef6f0c3
push 4
mov dword [ebp - 0x48], 0x7df2ddfd
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1000ddd7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x594]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000ddc8
mov dword [ebp - 0x1c], ebx
jmp 0x1000ddf2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x95c], 0xd2e84cbf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000dde1
mov dword [ebp - 0x2c], ebx
jmp 0x1000decf
mov dword [ebp - 0x34], 0xf6285890
mov dword [ebp - 0x30], 0x9642e40c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000de29
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4d4], 0x197cbb40
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000de18
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x51978e60
jl 0x1000dead
mov dword [ebp - 0x48], 0xfffffff9
lea ecx, [ebp - 0x494]
push edi
call fcn.1001b2e8
mov dword [ebp - 0x48], 0xf8fb6f85
mov dword [ebp - 0x24], 0x62cf9e8
mov dword [ebp - 0x18], ebx
jmp 0x1000de7e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x494]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000de6f
dec dword [ebp - 0x24]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000dea0
push 0x11f9
push 0xe0c
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea ecx, [ebp - 0x494]
call fcn.1001b36a
jmp 0x1000deb3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000dec7
mov dword [ebp - 0x34], 0x1e52
cmp dword [ebp - 0x34], ebx
jne 0x1000decc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1000deb8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1000ddff
or edi, 0xffffffff
lea ecx, [ebp - 0x594]
mov dword [ebp - 4], edi
call fcn.1001b36a
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x24], 0xa3531f1
mov dword [ebp - 0x3c], 0x3eba
cmp dword [ebp - 0x3c], 0x4165
jle 0x1000df6d
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x24], 0x651a
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x934]
or eax, edi
cdq
push edx
push eax
call fcn.1000dafa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000df34
mov eax, dword [eax]
push eax
call fcn.1004e316
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x934]
call fcn.1001b738
inc edi
cmp edi, 0x74d7
jl 0x1000df18
dec esi
dec dword [ebp - 0x24]
jne 0x1000df16
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0xf98
jl 0x1000df0c
xor esi, esi
inc esi
or edi, 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000dfaa
mov dword [ebp - 0x40], edi
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x40]
cmp eax, 0x26f3
setg cl
neg ecx
je 0x1000df90
mov ecx, esi
cmp dword [ebp - 0x40], ebx
jne 0x1000df92
mov ecx, ebx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
jl 0x1000df72
cmp dword [ebp - 0x3c], 0x3d0c
jge 0x1000dfc4
push 0x100076b8
call fcn.1004e316
pop ecx
mov dword [ebp - 4], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000dfdb
push 0x11f8
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000dff4
push esi
push ebx
push 0x42d
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x28], 0x4e6a
cmp dword [ebp - 0x28], 0x4fe0
jle 0x1000e06f
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov dword [ebp - 0x3c], ebx
mov esi, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
lea eax, [esi + edi]
mov esi, 0x2624
mov dword [ebp - 0x34], eax
mov edi, eax
mov eax, edi
mov ecx, 0x1060d6f8
and eax, ebx
cdq
push edx
push eax
call fcn.1001b0b7
dec edi
dec esi
jne 0x1000e021
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x75ff
jl 0x1000e014
inc edi
mov dword [ebp - 0x3c], edi
push 0
pop ebx
cmp edi, 0x476c
jl 0x1000e00c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x381b
jl 0x1000e007
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
or edi, 0xffffffff
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 6
cmp dword [ebp - 0x28], 0x4e10
jge 0x1000e0b2
mov edx, 0x10007730
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000e0b2
xor esi, esi
mov dword [ebp - 4], edi
inc esi
cmp byte [ebp - 0x11], 0
je 0x1000e0c5
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x48], 8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e0ea
push 0xb63
push 0x217f
push 0x17b0
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e100
push esi
push ebx
push 0x42d
call dword [sym.imp.USER32.dll_InvalidateRect]
push 4
lea ecx, [ebp - 0x578]
call fcn.1001b2e8
mov dword [ebp - 4], 8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x420], 0x4fd9e2a8
mov dword [ebp - 0x41c], 0x4fd9e2a8
mov dword [ebp - 0x418], 0x4fd9e2a8
mov dword [ebp - 0x414], 0x4fd9e2a8
mov dword [ebp - 0x48], 0x3414
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e17a
push 0x1aaf
push ebx
push 0x1398
push 0x1fea
push 0x1303
push ebx
push 0x24ae
push 0x1349
push 0x6a9
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [ebp - 0x41c]
xor ebx, ebx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
setl bl
xor edx, edx
cmp ecx, eax
push 4
setle dl
lea ecx, [ebp - 0x224]
sub edx, ebx
neg edx
sbb edx, edx
inc edx
cmp edx, 0x9beb0647
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x13c], 0xc7747bb7
mov dword [ebp - 0x138], 0xc7747bb7
mov dword [ebp - 0x134], 0xc7747bb7
mov dword [ebp - 0x130], 0xc7747bb7
call fcn.1001b2e8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x24], 0x72c02a3
push 2
call fcn.1001b2e8
mov dword [ebp - 0x34], 0x504e
xor edi, edi
mov dword [ebp - 0x30], 0xa2e
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x1c], edi
jmp 0x1000e233
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x224]
mov dword [eax + ecx*4], 0x4ac0198a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000e220
mov dword [ebp - 0x1c], edi
jmp 0x1000e24d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000e23e
mov dword [ebp - 0x1c], edi
jmp 0x1000e269
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4a8], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000e258
mov edx, dword [ebp - 0x224]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], edx
cmp dword [edx + 8], eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x328]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x134], esi
jge 0x1000e2b5
cmp dword [ebp - 0x134], edi
je 0x1000e2b5
mov dword [ebp - 0x13c], esi
cmp dword [ebp - 0x34], edi
jne 0x1000e2c2
jmp 0x1000e2bb
mov dword [ebp - 0x13c], edi
mov edx, edi
cmp dword [ecx + 4], edi
je 0x1000e2c4
mov edx, esi
mov eax, dword [ebp - 0x30]
mov ecx, 0x59d568d5
mov esi, dword [ebp - 0x224]
sub edx, eax
mov eax, dword [ebp - 0x38]
imul edx, dword [esi + 4]
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setge dl
xor ebx, ebx
add edx, dword [ebp - 0x30]
cmp edx, dword [eax + 8]
mov eax, dword [ebp - 0x3c]
setl bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
cmp ecx, dword [esi + 4]
setl al
xor ebx, ebx
mov dword [ebp - 0x4a4], eax
test eax, eax
je 0x1000e3c4
mov dword [ebp - 0x34], 0x1f4b9efe
inc ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x38], 0xffffffe4
jmp 0x1000e3a0
mov dword [ebp - 0x2c], 0x4142
mov dword [ebp - 0x24], 0xb9fe29f1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jle 0x1000e398
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xd11e
setg cl
imul ecx, dword [ebp - 0x4a0]
test ecx, ecx
jne 0x1000e35d
mov ecx, edi
cmp dword [ebp - 0x34], edi
je 0x1000e35f
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
add eax, 0x406997b9
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, edi
cmp dword [ebp - 0x2c], edi
je 0x1000e39a
mov eax, ebx
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff8
jl 0x1000e328
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000e3dc
push ebx
push 0x52d
push 0x2462
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000e3dc
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000e3dc
push 0x175c
push 0x1d2e
call dword [sym.imp.GDI32.dll_SetLayout]
lea ecx, [ebp - 0x328]
call fcn.1001b36a
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 8
call fcn.1001b36a
xor edi, edi
inc edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x48], 0x6ef6f0c3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0xb064
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0x627e80a7
mov dword [ebp - 0x18], ebx
jmp 0x1000e42d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x510], 0xffa898cb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000e41c
mov dword [ebp - 0x1c], ebx
jmp 0x1000e461
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e45b
push 0x3e8
push 0x2061
push 0x23a0
push 0x1355
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jne 0x1000e438
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffffa
jge 0x1000e7c4
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x18], 0x49744027
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0xf93f8de9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
sete cl
sub ecx, dword [ebp - 0x504]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
sub ecx, 8
je 0x1000e4e0
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x1000e4e2
mov eax, ebx
imul eax, eax, 0xfbe6
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xd0c6
setl cl
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1000e50a
mov eax, dword [ebp - 0x504]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jne 0x1000e795
mov dword [ebp - 0xc8], 0x2e7dfe98
mov dword [ebp - 0xc4], 0x2e7dfe98
mov dword [ebp - 0xc0], 0x2e7dfe98
mov dword [ebp - 0xbc], 0x2e7dfe98
mov dword [ebp - 0x2c], 0x5dd215cd
mov dword [ebp - 0x24], 0x318e
cmp dword [ebp - 0x24], 0x34f7
jle 0x1000e5c7
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
mov eax, ecx
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x808]
cdq
push edx
push eax
call fcn.1000dafa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e591
mov eax, dword [eax]
push eax
call fcn.1004e316
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x808]
call fcn.1001b738
mov ecx, dword [ebp - 0x28]
inc esi
cmp esi, 0x10a6
jl 0x1000e56e
inc edi
cmp edi, 0x2e4b
jl 0x1000e56c
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x3113
jl 0x1000e56a
movdqa xmm0, xmmword [0x1000c6c0]
lea ecx, [ebp - 0x5c0]
push ecx
lea eax, [ebp - 0x5b0]
push eax
push ecx
lea ecx, [ebp - 0x544]
movdqu xmmword [ebp - 0x5c0], xmm0
call fcn.1001b344
cmp dword [ebp - 0x24], 0x306c
jge 0x1000e605
push 0x100077a0
call fcn.1004e316
pop ecx
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0xc0], ebx
je 0x1000e687
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x510]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc0]
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x40]
sub edx, 0x5ca4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x544]
setl cl
xor edx, edx
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0xc0]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], 0x3f35
cmp dword [ebp - 0x18], 0x4224
jle 0x1000e731
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0x67e4
mov esi, ebx
mov ebx, dword [ebp - 0x3c]
lea edi, [ebx + esi]
mov ebx, 0x462
mov eax, edi
mov ecx, 0x1060d6f8
cdq
push edx
push eax
call fcn.1001b0b7
dec edi
dec ebx
jne 0x1000e6f6
mov ebx, dword [ebp - 0x3c]
inc esi
cmp esi, 0x1f26
jl 0x1000e6ee
mov edi, dword [ebp - 0x28]
add ebx, edi
dec dword [ebp - 0x24]
push 0
mov dword [ebp - 0x3c], ebx
pop ebx
jne 0x1000e6e9
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x4d8a
jl 0x1000e6df
cmp byte [ebp - 0x11], 0
je 0x1000e740
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x18], 0x3d20
jge 0x1000e77a
mov edx, 0x10007800
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000e77a
xor edi, edi
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 8
inc edi
call fcn.1001b36a
jmp 0x1000e7bc
mov dword [ebp - 0x34], 0xdb030f3e
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e7bc
push ebx
push edi
push 0xdd4
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
dec dword [ebp - 0x1c]
jmp 0x1000e46a
mov dword [ebp - 0x48], 0x7df2ddfd
mov dword [ebp - 0x3c], 0x3bb5
cmp dword [ebp - 0x3c], 0x3f2c
jle 0x1000e86c
push ebx
push 0x6e
push ebx
push 0x64a
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
add edi, eax
mov esi, ebx
add edi, ecx
mov eax, edi
lea ecx, [ebp - 0x8b0]
or eax, esi
cdq
push edx
push eax
call fcn.1000dafa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e81f
mov eax, dword [eax]
push eax
call fcn.1004e316
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8b0]
call fcn.1001b738
inc esi
cmp esi, 0x513c
jl 0x1000e803
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
inc edi
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edi
cmp edi, 0x5a39
jl 0x1000e7fd
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x1996
jl 0x1000e7f8
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x1f61
jl 0x1000e7f3
xor edi, edi
inc edi
mov dword [ebp - 0x24], 0x29a3
cmp dword [ebp - 0x3c], 0x39fc
jge 0x1000e887
push 0x100078a0
call fcn.1004e316
pop ecx
mov dword [ebp - 4], 8
mov dword [ebp - 0x30], 0x75c1
mov dword [ebp - 0x18], 0x29ea4144
mov dword [ebp - 0x28], 0xc25fcc58
mov dword [ebp - 0x48], 0xe665969a
push 3
pop esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 0xec326874
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000e8d0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5f0], 0x238e486a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000e8bf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x3c]
je 0x1000e910
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x19fa553f
mov edx, edi
setne cl
cmp ecx, 0xf92e
jle 0x1000e912
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x5ec]
je 0x1000e951
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000e9d2
push ebx
push 0x249d
push 0x1c8c
push 0x148f
push 0x144c
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x1000e9d2
push esi
lea ecx, [ebp - 0x2cc]
call fcn.1001b2e8
mov dword [ebp - 0x34], 0xbb1e5de2
mov dword [ebp - 0x18], ebx
jmp 0x1000e97c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2cc]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000e969
mov edi, dword [ebp - 0x2cc]
xor ecx, ecx
mov eax, dword [ebp - 0x5ec]
mov esi, dword [edi + 4]
cmp eax, esi
mov eax, dword [ebp - 0x2cc]
setne cl
xor edx, edx
cmp esi, ecx
sete dl
xor ebx, ebx
add edx, dword [eax]
mov eax, dword [ebp - 0x3c]
cmp edx, esi
setne bl
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, dword [edi + 4]
lea ecx, [ebp - 0x2cc]
setl al
mov dword [ebp - 0x34], eax
call fcn.1001b36a
xor edi, edi
xor ebx, ebx
inc edi
push 4
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1000e9e9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x578]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000e9da
mov dword [ebp - 0x1c], ebx
jmp 0x1000ea04
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x96c], 0xd2e84cbf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000e9f3
push 2
lea ecx, [ebp - 0x23c]
call fcn.1001b2e8
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x28], 0xfff9
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x24], 0xce34aafb
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000ea4a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 0x55bb2c21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ea37
mov esi, dword [ebp - 0x23c]
cmp dword [esi + 4], ebx
je 0x1000eadf
mov dword [ebp - 0x3c], 0x1879
mov dword [ebp - 0x30], 0x7a73d2d6
cmp dword [esi + 4], ebx
je 0x1000ea79
mov eax, dword [ebp - 0x30]
mov eax, edi
jmp 0x1000ea7b
mov eax, ebx
inc dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
sub edx, 8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0xd162
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setne cl
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [esi + 4]
setge al
mov dword [esi + 4], eax
jmp 0x1000eb87
push 2
lea ecx, [ebp - 0x2c0]
call fcn.1001b2e8
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x34], 0xff4c90eb
mov dword [ebp - 0x18], ebx
jmp 0x1000eb12
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], 0x1aaf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000eaff
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
mov edx, dword [ebp - 0x2c0]
mov dword [ebp - 0x4c], 0x870af03f
cmp dword [eax], 0x1676492a
sete cl
xor eax, eax
sub ecx, dword [edx + 4]
cmp ecx, 0xfffffff8
setl al
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c0]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
add eax, dword [ebp - 0x24]
imul eax, dword [edx + 4]
add eax, 0x782282ac
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jne 0x1000eb77
mov eax, ebx
cmp dword [ebp - 0x30], ebx
je 0x1000eb79
mov eax, edi
lea ecx, [ebp - 0x2c0]
mov dword [esi + 4], eax
call fcn.1001b36a
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 8
call fcn.1001b36a
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 3
jg 0x10010c3e
mov dword [ebp - 0x2c], 0x6c59
cmp dword [ebp - 0x2c], 0x6e8d
jle 0x1000ec12
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x754]
or eax, edx
cdq
push edx
push eax
call fcn.1000dafa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ebdc
mov eax, dword [eax]
push eax
call fcn.1004e316
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x754]
call fcn.1001b738
mov edx, dword [ebp - 0x28]
inc esi
cmp esi, 0x5a28
jl 0x1000ebbc
inc edi
cmp edi, 0x1b65
jl 0x1000ebba
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x6b29
jl 0x1000ebb8
xor edi, edi
mov dword [ebp - 0x38], ebx
inc edi
mov dword [ebp - 0x34], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000ec30
push ebx
push 0xf55
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x38], 0xffffffe4
cmp dword [ebp - 0x38], 0xfffffff6
jge 0x1000edad
mov dword [ebp - 0x28], 0x2bda
cmp dword [ebp - 0x28], 0x2f43
jle 0x1000ecb2
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ebx
cdq
mov edi, ebx
idiv ecx
mov ecx, edx
mov dword [ebp - 0x24], ecx
mov esi, ebx
mov eax, edi
cdq
idiv esi
and edx, ecx
mov ecx, 0x1060d6f8
mov eax, edx
cdq
push edx
push eax
call fcn.1001b0b7
mov ecx, dword [ebp - 0x24]
inc esi
cmp esi, 0x920
jl 0x1000ec67
inc edi
cmp edi, 0x235e
jl 0x1000ec65
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, 0x3d04
jl 0x1000ec5b
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x4050
jl 0x1000ec56
xor edi, edi
inc edi
push 2
lea ecx, [ebp - 0x394]
call fcn.1001b2e8
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x28], 0x2814
jge 0x1000ecfc
mov edx, 0x10007964
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000ecfc
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x24], 0xd7d393e7
mov dword [ebp - 0x4c], 0xd627
mov dword [ebp - 0x18], ebx
jmp 0x1000ed30
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ed1d
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1000ed93
mov dword [ebp - 0x30], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffc
setg cl
xor edx, edx
cmp ecx, 0xa017
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setg cl
cmp ecx, edi
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp eax, ecx
sbb eax, eax
inc eax
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
jns 0x1000ed3e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x394]
cmp dword [ebp - 0x4c], ebx
call fcn.1001b36a
inc dword [ebp - 0x38]
jmp 0x1000ec37
cmp dword [ebp - 0x2c], 0x6b05
jge 0x1000edc1
push 0x100078f8
call fcn.1004e316
pop ecx
mov dword [ebp - 4], 8
mov dword [ebp - 0x4c], 0xf6285890
mov dword [ebp - 0x28], 0x316c
cmp dword [ebp - 0x28], 0x33bf
jle 0x1000ee2c
mov edx, ebx
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov ecx, edi
mov esi, ebx
mov edi, edx
shl edi, cl
mov eax, edi
mov ecx, 0x1060d6f8
or eax, esi
cdq
push edx
push eax
call fcn.1001b0b7
inc esi
cmp esi, 0x7168
jl 0x1000edf1
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x2550
jl 0x1000ede9
inc edx
mov dword [ebp - 0x30], edx
cmp edx, 0x76da
jl 0x1000ede4
xor edi, edi
inc edi
mov dword [ebp - 0x3c], 0x9642e40c
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x28], 0x2f99
jge 0x1000ee70
mov edx, 0x100079d8
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000ee70
push 2
lea ecx, [ebp - 0x334]
mov dword [ebp - 4], 8
call fcn.1001b2e8
mov dword [ebp - 0x18], 0x2667a876
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x1000eeaa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ee97
mov dword [ebp - 0x18], ebx
jmp 0x1000eec8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx*4], 0xbacd7953
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000eeb5
lea ecx, [ebp - 0x334]
call fcn.1001b36a
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x44], ebx
push ecx
lea eax, [ebp - 0x640]
mov dword [ebp - 0x1c], 0xfffffff9
push eax
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x43c]
movdqu xmmword [ebp - 0x650], xmm0
call fcn.1001b344
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], 0x614f
cmp dword [ebp - 0x1c], ebx
je 0x1000ef4b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000ef2c
push 0x7a3
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000f1b7
push ebx
push 0x689
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1000f1b7
movdqa xmm0, xmmword [0x1000c6b0]
lea ecx, [ebp - 0x610]
push ecx
lea eax, [ebp - 0x600]
push eax
push ecx
lea ecx, [ebp - 0x210]
movdqu xmmword [ebp - 0x610], xmm0
call fcn.1001b344
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x1c], 0x12
cmp dword [ebp - 0x1c], 0xffffffe7
jne 0x1000f004
mov esi, dword [ebp - 0x210]
mov edi, dword [ebp - 0x43c]
mov dword [ebp - 0x34], 0xd7c6
xor edx, edx
mov dword [ebp - 0x24], 0xd3650dfa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x210]
cmp dword [eax], ecx
setl dl
cmp edx, dword [esi + 0xc]
je 0x1000efb8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x210]
cmp dword [eax], 1
setge cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x210]
sete dl
xor ecx, ecx
sub edx, 0x757e2a0c
imul edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setl cl
mov dword [edi + 0xc], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
je 0x1000ef92
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x1000f1a9
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x48], 0x5316d004
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], ebx
jl 0x1000f1a1
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x18], ebx
jmp 0x1000f04c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8d4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000f03b
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 3
jg 0x1000f199
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], ebx
jl 0x1000f171
push 3
lea ecx, [ebp - 0x4bc]
call fcn.1001b2e8
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x20], 0x4c44
cmp dword [ebp - 0x20], 0x4c6f
jle 0x1000f0f1
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov edx, ecx
mov edi, ebx
mov ecx, eax
shl edx, cl
mov dword [ebp - 0x24], edx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x1060d6f8
xor eax, edx
cdq
push edx
push eax
call fcn.1001b0b7
mov edx, dword [ebp - 0x24]
inc esi
cmp esi, 0x591d
jl 0x1000f0aa
inc edi
cmp edi, 0x429d
jl 0x1000f0a8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x5226
jl 0x1000f09d
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x6c06
jl 0x1000f098
mov dword [ebp - 0x24], 0xfffffffb
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x20], 0x4963
jge 0x1000f132
mov edx, 0x10007a40
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000f132
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x18], ebx
jmp 0x1000f151
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4bc]
mov dword [eax + ecx*4], 0xbbbbfefa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000f13e
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x1a
call fcn.1001b36a
dec dword [ebp - 0x28]
jmp 0x1000f069
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000f191
push ebx
push ebx
push 0x10ae
push 0x1616
push 0xcc9
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
inc dword [ebp - 0x38]
jmp 0x1000f055
dec dword [ebp - 0x2c]
jmp 0x1000f026
inc dword [ebp - 0x1c]
jmp 0x1000f007
lea ecx, [ebp - 0x210]
call fcn.1001b36a
xor edi, edi
inc edi
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 8
call fcn.1001b36a
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x110]
push 4
call fcn.1001b2e8
mov dword [ebp - 0x1c], 0x6960f57a
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0x5c0c8fbf
mov dword [ebp - 0x18], ebx
jmp 0x1000f1ff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x7786
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000f1ec
mov dword [ebp - 0x1c], ebx
jmp 0x1000f35a
mov dword [ebp - 0x24], 0x6652f093
mov dword [ebp - 0x34], 0x55bb5fb4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x110]
cmp dword [ecx + eax*4], ebx
je 0x1000f2ee
mov dword [ebp - 0x30], 0xc80fc3a0
cmp dword [ebp - 0x30], ebx
jne 0x1000f267
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, edi
mov ecx, ebx
sbb eax, eax
neg eax
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x856dfc9b
je 0x1000f269
mov ecx, edi
xor eax, eax
cmp ecx, 0x14ad
setl al
cmp eax, 0x6a530863
jne 0x1000f288
mov eax, dword [ebp - 0x110]
mov esi, ebx
cmp dword [eax + 4], ebx
je 0x1000f28a
mov esi, edi
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp esi, eax
mov eax, dword [ebp - 0x110]
setge cl
imul ecx, dword [eax + edx*4]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x5ed9a924
setg cl
xor eax, eax
cmp ecx, 2
setne al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], ebx
jl 0x1000f354
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000f2e7
push 0x3fd
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [ebp - 0x2c]
jns 0x1000f2d2
jmp 0x1000f354
mov dword [ebp - 0x30], edi
cmp dword [ecx], ebx
jne 0x1000f33b
cmp dword [ebp - 0x2c], ebx
je 0x1000f2fd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
sub ecx, dword [ebp - 0x2c]
je 0x1000f328
mov ecx, dword [ebp - 0x1c]
mov edx, edi
mov eax, dword [ebp - 0x110]
cmp dword [eax + ecx*4], ebx
jne 0x1000f32a
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
mov eax, ebx
setne cl
cmp ecx, 0xfffffffd
jle 0x1000f33d
mov eax, edi
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000f354
push 0x1307
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1000f20d
lea ecx, [ebp - 0x110]
call fcn.1001b36a
push edi
lea ecx, [ebp - 0x3f4]
call fcn.1001b2e8
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x1c], ebx
jmp 0x1000f39e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], 0x97f6af11
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000f38b
mov dword [ebp - 0x28], 0x2578
cmp dword [ebp - 0x28], 0x2663
jle 0x1000f432
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edx, ecx
mov edi, ebx
mov ecx, eax
sar edx, cl
mov dword [ebp - 0x34], edx
mov esi, ebx
mov ebx, dword [ebp - 0x34]
mov eax, esi
mov ecx, 0x1060d6f8
and eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1001b0b7
inc esi
cmp esi, 0x70e6
jl 0x1000f3cd
inc edi
push 0
pop ebx
cmp edi, 0x4e5b
jl 0x1000f3c8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x7eac
jl 0x1000f3bd
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x6300
jl 0x1000f3b8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1040
push 0x3d6
push 0x265a
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor edi, edi
inc edi
mov dword [ebp - 0x1c], ebx
jmp 0x1000f448
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x73c], 0x4b4b26d8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000f437
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x28], 0x2507
jge 0x1000f48b
mov edx, 0x10007ac8
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1000f48b
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x1c], ebx
jmp 0x1000f4a8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4f4], 0xbf60
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000f497
mov eax, dword [ebp - 0x3f4]
lea ecx, [ebp - 0x3f4]
mov byte [ebp - 4], 8
mov dword [eax], ebx
call fcn.1001b36a
mov dword [ebp - 0x18], ebx
jmp 0x1000f4da
or esi, 0xffffffff
lea ecx, [ebp - 0x578]
mov dword [ebp - 4], esi
call fcn.1001b36a
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x24], 0xa3531f1
mov dword [ebp - 0x18], ebx
jmp 0x10010c9a
mov dword [ebp - 0x40], esi
xor ecx, ecx
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x40]
cmp eax, 0x26f3
setg cl
neg ecx
je 0x10010c80
mov ecx, edi
cmp dword [ebp - 0x40], ebx
jne 0x10010c82
mov ecx, ebx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
jl 0x10010c62
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10010cb4
push 0x11f8
call dword [sym.imp.USER32.dll_MessageBeep]
push 2
pop esi
mov dword [ebp - 0x40], 9
lea ecx, [ebp - 0x1a4]
push esi
call fcn.1001b2e8
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0x30], 0x51a
mov dword [ebp - 0x34], 0x468e576d
mov dword [ebp - 0x18], ebx
jmp 0x10010cf7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10010ce4
cmp dword [ebp - 0x40], ebx
je 0x10010e02
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x200]
push 4
call fcn.1001b2e8
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], ebx
jmp 0x10010d37
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x200]
mov dword [eax + ecx*4], 0x66d8ff8c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10010d24
mov eax, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x1a4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x30], 0xda0
cmp dword [eax], 0x5d764ce3
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1a4]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setg dl
xor ebx, ebx
add edx, dword [esi + 4]
cmp edx, 3
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setne cl
sub eax, ecx
mov ecx, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
sub ecx, eax
mov eax, 0x9fe9a5a1
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
lea edx, [eax + 0x364724ca]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov dword [esi + 4], edx
setne cl
xor ebx, ebx
cmp dword [ebp - 0x40], ecx
je 0x10010dcb
mov edx, edi
cmp dword [ebp - 0x24], ebx
jne 0x10010dcd
mov edx, ebx
mov eax, dword [ebp - 0x200]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x200]
setle dl
mov dword [eax + 0xc], edx
neg edx
mov dword [ebp - 0x3c], edx
call fcn.1001b36a
push 2
pop esi
jmp 0x10010e67
push esi
lea ecx, [ebp - 0x500]
call fcn.1001b2e8
mov dword [ebp - 0x48], 0x92a41536
mov dword [ebp - 0x18], ebx
jmp 0x10010e2d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x500]
mov dword [eax + ecx*4], 0xa1ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10010e1a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10010e42
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
dec dword [ebp - 0x30]
jne 0x10010e57
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x30]
cmp dword [ecx + 4], eax
mov eax, ebx
je 0x10010e59
mov eax, edi
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x34], eax
call fcn.1001b36a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a4]
call fcn.1001b36a
mov dword [ebp - 0x44], 0xb319
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x1c], ebx
push edi
call fcn.1001b2e8
xor edx, edx
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10010ea5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10010e9b
mov dword [ebp - 0x20], ebx
jmp 0x10010ec2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x290]
mov dword [eax + ecx*4], 0xc2df100
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10010eaf
cmp dword [ebp - 0x44], ebx
je 0x10010f2e
mov dword [ebp - 0x24], 0xffff
lea ecx, [ebp - 0x37c]
push edx
call fcn.1001b2e8
xor edi, edi
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x10010efa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x37c]
mov dword [eax + ecx*4], 0xad9ddcef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10010ee7
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
cmp eax, 6
mov eax, dword [ebp - 0x37c]
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x37c]
call fcn.1001b36a
jmp 0x100110e9
mov dword [ebp - 0x20], 0x58c458a9
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 0xaafe
mov dword [ebp - 0x44], ebx
jmp 0x100110be
mov dword [ebp - 0x2c], 0x9683648b
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x2c], ebx
jmp 0x10010fb5
mov dword [ebp - 0x24], 0xfffffffe
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30]
imul eax, eax, 0x865e
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10010faf
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
dec dword [ebp - 0x2c]
push 1
pop edx
cmp dword [ebp - 0x2c], 0xfffffffb
je 0x10010f61
mov dword [ebp - 0x1c], ebx
jmp 0x100110a2
push esi
lea ecx, [ebp - 0x26c]
call fcn.1001b2e8
mov dword [ebp - 0x18], ebx
jmp 0x10010fe3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x26c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10010fd4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x60], ebx
jne 0x100110ad
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
neg eax
je 0x10011007
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x33be618b
mov eax, dword [ebp - 0x26c]
setle cl
xor edx, edx
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x44]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
cmp edx, eax
mov eax, dword [ebp - 0x290]
setg cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x290]
cmp dword [eax], ecx
lea ecx, [ebp - 0x26c]
setg dl
mov dword [ebp - 0x30], edx
call fcn.1001b36a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10010fc3
jmp 0x100110b8
lea ecx, [ebp - 0x26c]
call fcn.1001b36a
inc dword [ebp - 0x44]
push 1
pop edx
cmp dword [ebp - 0x44], 0x1a
jg 0x10010f4e
mov dword [ebp - 0x20], 4
jmp 0x100110e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.1001b36a
mov dword [ebp - 0x40], 9
lea ecx, [ebp - 0x148]
push esi
call fcn.1001b2e8
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x30], 0x51a
mov dword [ebp - 0x34], 0x468e576d
mov dword [ebp - 0x18], ebx
jmp 0x10011138
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10011125
cmp dword [ebp - 0x40], ebx
je 0x100112ad
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x1e8]
push 4
call fcn.1001b2e8
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x24], 0x592
cmp dword [ebp - 0x24], 0x5c8
jle 0x100111be
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x844]
xor eax, edi
cdq
push edx
push eax
call fcn.1000dafa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011194
mov eax, dword [eax]
push eax
call fcn.1004e316
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x844]
call fcn.1001b738
inc esi
cmp esi, 0x5f2c
jl 0x10011178
inc edi
cmp edi, 0x6950
jl 0x10011176
xor edi, edi
inc edi
cmp dword [ebp - 0x24], 0x355
jge 0x100111d2
push 0x10007d64
call fcn.1004e316
pop ecx
mov dword [ebp - 0x18], ebx
jmp 0x100111ea
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e8]
mov dword [eax + ecx*4], 0x66d8ff8c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100111d7
mov eax, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x148]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x30], 0xda0
cmp dword [eax], 0x5d764ce3
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x148]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
add edx, dword [esi + 4]
cmp edx, 3
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setne cl
sub eax, ecx
mov ecx, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
sub ecx, eax
mov eax, 0x9fe9a5a1
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
lea edx, [eax + 0x364724ca]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
mov dword [esi + 4], edx
setne cl
xor ebx, ebx
cmp dword [ebp - 0x40], ecx
je 0x1001127e
push esi
lea ecx, [ebp - 0x588]
call fcn.1001b2e8
mov dword [ebp - 0x48], 0x92a41536
mov dword [ebp - 0x18], ebx
jmp 0x100112d8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x588]
mov dword [eax + ecx*4], 0xa1ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100112c5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100112ed
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
dec dword [ebp - 0x30]
jne 0x10011302
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x30]
cmp dword [ecx + 4], eax
mov eax, ebx
je 0x10011304
mov eax, edi
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x588]
call fcn.1001b36a
or esi, 0xffffffff
lea ecx, [ebp - 0x148]
mov dword [ebp - 4], esi
call fcn.1001b36a
mov dword [ebp - 0x18], 0xfff7
xor edx, edx
mov dword [ebp - 0x30], 0xc657e3b6
mov dword [ebp - 0x3c], 0xad81
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x4c], 0xfe9f4864
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x76270e7a
setg al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x30], ebx
je 0x10011386