Function at 0x1001d1a0
Capabilities:
Extract resource via kernel32 functions
Get disk information
Get file system object information
Query environment variable

Disassembly:
mov eax, 0x1008cd6c
call fcn.1008c840
sub esp, 0x284
push ebx
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x34], 0x6de6
push 3
mov dword [ebp - 0x20], 0x3ae50714
mov dword [ebp - 0x100], edx
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001d1ee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c8], 0xfffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001d1dd
mov dword [ebp - 0x10], ebx
jmp 0x1001d209
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x290], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001d1f8
mov dword [ebp - 0x18], 0xfffffff0
cmp dword [ebp - 0x18], 0xffffffe8
push 1
pop edx
jl 0x1001d2c1
mov dword [ebp - 0x14], 0x4d2e
xor ecx, ecx
mov dword [ebp - 0x2c], 0x4adca1a1
mov dword [ebp - 0x30], 0xfe2cf45
mov dword [ebp - 0x20], 0xfffffff9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c8]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0x1c8]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c8], 0x172ddb74
jge 0x1001d281
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x14]
jne 0x1001d299
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001d29b
mov eax, edx
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
push 1
setg dl
mov dword [ebp - 0x290], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
pop edx
jge 0x1001d222
mov dword [ebp - 0x28], 0xdf75dcec
mov dword [ebp - 0x28], 0x13
jmp 0x1001d3bf
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
jmp 0x1001d2ea
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x48], 0x394a2a4f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1001d2dc
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 7
je 0x1001d3bc
xor esi, esi
inc esi
mov dword [ebp - 0x2c], 0x71c097bc
lea ecx, [ebp - 0x1ec]
push 4
call fcn.1001b10b
mov dword [ebp - 0x24], ebx
jmp 0x1001d32b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1001d318
mov eax, dword [ebp - 0x2c]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x28]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x48]
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x1001d35e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
mov edx, dword [ebp - 0x1ec]
jne 0x1001d37e
mov eax, ebx
cmp dword [edx], ebx
je 0x1001d380
mov eax, esi
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [edx + 4]
setl cl
mov dword [edx + 0xc], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1001d3a1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea ecx, [ebp - 0x1ec]
call fcn.1001b9cb
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 7
jne 0x1001d2ff
xor edx, edx
inc edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jle 0x1001d2d4
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x8c], 0x6de6
mov dword [ebp - 0x10], 0xbac64a68
push 2
call fcn.1001b10b
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x30], 0x8f3b1ad3
mov dword [ebp - 0x24], ebx
jmp 0x1001d40c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001d3fd
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
jmp 0x1001d584
mov dword [ebp - 0x2c], 0xac8ef34e
mov dword [ebp - 0x20], 0x6a83cd0c
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x24], ebx
jmp 0x1001d445
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5c], 0xe6da504
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1001d437
mov dword [ebp - 0x5c], ebx
jmp 0x1001d578
mov dword [ebp - 0x18], 0x86bd085c
mov dword [ebp - 0x34], 0x539aea1d
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1001d575
mov dword [ebp - 0x28], 0x315362d
mov dword [ebp - 0x28], ebx
jmp 0x1001d4ac
mov dword [ebp - 0x14], 0x26f3f17e
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1001d4a9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1001d4a1
push 0x1f56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
dec dword [ebp - 0x14]
jns 0x1001d487
xor edx, edx
inc edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1001d478
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + eax*4], edx
jle 0x1001d4dc
mov eax, edx
cmp dword [ecx + 4], ebx
jne 0x1001d4de
mov eax, ebx
neg eax
xor edx, edx
cmp eax, 6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
setne dl
add edx, 9
imul edx, eax
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x18], ebx
je 0x1001d511
cmp dword [ebp - 0x2c], ebx
je 0x1001d511
xor esi, esi
lea eax, [esi + 1]
jmp 0x1001d513
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
push 1
setl cl
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
test eax, eax
pop edx
sets cl
xor eax, eax
cmp ecx, 0x7051
setg al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, 0xc525ac89
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x18]
jns 0x1001d46c
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edx
jle 0x1001d452
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x1001d41d
mov edx, dword [ebp - 0x11c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp dword [edx + 4], eax
sete cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x11c]
call fcn.1001b9cb
xor esi, esi
mov dword [ebp - 0x20], 0x3ae50714
inc esi
lea ecx, [ebp - 0x1b0]
push esi
call fcn.1001b10b
mov dword [ebp - 0x24], ebx
jmp 0x1001d5db
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x3ae35568
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1001d5c8
mov eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1b0]
mov dword [eax], 0xfffffffe
call fcn.1001b9cb
push 3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001d610
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], 0xfffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001d5ff
mov dword [ebp - 0x10], ebx
jmp 0x1001d62b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x284], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001d61a
push esi
lea ecx, [ebp - 0x74]
call fcn.1001b10b
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0x7374489b
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], 0xf141
mov dword [ebp - 0x24], ebx
jmp 0x1001d668
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 0x9d19
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1001d658
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
setle cl
inc ecx
cmp ecx, 0xfffffffc
jne 0x1001d692
cmp dword [ebp - 0x18], ebx
je 0x1001d692
xor esi, esi
lea edx, [esi + 1]
jmp 0x1001d694
mov edx, ebx
mov eax, dword [ebp - 0x74]
xor ecx, ecx
cmp edx, dword [eax]
setle cl
imul eax, ecx, 0xfffc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setl cl
xor edx, edx
cmp ecx, 0x7420
setl dl
xor ecx, ecx
cmp dword [eax], edx
setne cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
inc eax
cmp eax, 2
setne cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001d807
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x94fc7bc0
push 3
mov dword [ebp - 0x20], 0x3d9d76c1
mov dword [ebp - 0x24], ebx
pop ecx
jmp 0x1001d72d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x278], 0x771bf393
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001d71c
mov dword [ebp - 0x14], 0xabc1
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x74]
cmp dword [edx + esi*4], eax
setge cl
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [eax + edx*4]
xor eax, eax
mov edx, dword [ebp - 0x74]
cmp ecx, dword [edx + esi*4]
setle al
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [edx + edi*4]
jne 0x1001d789
mov edi, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001d78b
mov edi, ecx
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x74]
mov ecx, dword [edx + eax*4]
imul ecx, edi
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [edx + esi*4]
setl al
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x74]
cmp eax, dword [edx + esi*4]
setle cl
xor esi, esi
mov dword [ebp - 0x20], ecx
inc esi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
cmp esi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x274], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x10]
jns 0x1001d703
or edi, 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.1001b9cb
mov dword [ebp - 0x3c], 0xfffffff0
jmp 0x1001dc8d
mov dword [ebp - 0x10], 0xbac64a68
lea ecx, [ebp - 0xe4]
call fcn.1001b10b
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x30], 0x8f3b1ad3
mov dword [ebp - 0x24], ebx
jmp 0x1001d84f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001d840
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
jmp 0x1001d9c7
mov dword [ebp - 0x2c], 0xac8ef34e
mov dword [ebp - 0x20], 0x6a83cd0c
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x24], ebx
jmp 0x1001d888
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], 0xe6da504
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1001d87a
mov dword [ebp - 0x60], ebx
jmp 0x1001d9bb
mov dword [ebp - 0x18], 0x86bd085c
mov dword [ebp - 0x24], 0x539aea1d
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1001d9b8
mov dword [ebp - 0x28], 0x315362d
mov dword [ebp - 0x28], ebx
jmp 0x1001d8ef
mov dword [ebp - 0x14], 0x26f3f17e
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1001d8ec
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1001d8e4
push 0x1f56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
dec dword [ebp - 0x14]
jns 0x1001d8ca
xor edx, edx
inc edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1001d8bb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xe4]
cmp dword [ecx + eax*4], edx
jle 0x1001d91f
mov eax, edx
cmp dword [ecx + 4], ebx
jne 0x1001d921
mov eax, ebx
neg eax
xor edx, edx
cmp eax, 6
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
setne dl
add edx, 9
imul edx, eax
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x18], ebx
je 0x1001d954
cmp dword [ebp - 0x2c], ebx
je 0x1001d954
xor esi, esi
lea eax, [esi + 1]
jmp 0x1001d956
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
push 1
setl cl
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
test eax, eax
pop edx
sets cl
xor eax, eax
cmp ecx, 0x7051
setg al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, 0xc525ac89
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x18]
jns 0x1001d8af
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], edx
jle 0x1001d895
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x1001d860
mov edx, dword [ebp - 0xe4]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp dword [edx + 4], eax
sete cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xe4]
call fcn.1001b9cb
mov dword [ebp - 0x14], 0x4d2e
mov dword [ebp - 0x2c], 0x4adca1a1
mov dword [ebp - 0x30], 0xfe2cf45
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 0x6de6
push 3
mov dword [ebp - 0x20], 0x3ae50714
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001da2f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x180], 0xfffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001da1e
mov dword [ebp - 0x10], ebx
jmp 0x1001da4a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x248], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001da39
xor esi, esi
mov dword [ebp - 0x18], 0xfffffff0
inc esi
cmp dword [ebp - 0x18], 0xffffffe8
jl 0x1001db02
mov dword [ebp - 0x34], 0x4d2e
xor ecx, ecx
mov dword [ebp - 0x2c], 0x4adca1a1
mov dword [ebp - 0x30], 0xfe2cf45
mov dword [ebp - 0x20], 0xfffffff9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0x180]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x180], 0x172ddb74
jge 0x1001dac2
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x34]
jne 0x1001dada
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001dadc
mov eax, esi
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
mov dword [ebp - 0x248], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jge 0x1001da63
push 3
pop ecx
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
jmp 0x1001dc0a
mov dword [ebp - 0x18], 0x92f6
mov dword [ebp - 0x2c], 0x67d92612
cmp dword [ebp - 0x28], ebx
je 0x1001dbb4
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x24], ebx
jmp 0x1001db47
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1e0], 0x2fb5a5ef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001db36
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x1d8]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
push 8
setne cl
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
pop ecx
setle dl
sub eax, edx
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1d8]
je 0x1001db98
mov ecx, esi
cmp dword [ebp - 0x18], ebx
jne 0x1001db9a
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x1001dba6
mov eax, dword [ebp - 0x18]
jmp 0x1001dbfc
mov dword [ebp - 0x20], 0xfff6
cmp dword [ebp - 0x20], ebx
jne 0x1001dc14
jmp 0x1001dbff
mov dword [ebp - 0x2c], 0xd77f1724
mov dword [ebp - 0x20], 0x807220b7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1001dbd7
push 0x23f3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffd
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x1001dc14
inc dword [ebp - 0x28]
push 3
pop ecx
cmp dword [ebp - 0x28], 0xb
jge 0x1001db13
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x198]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0x198]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x198], 0x172ddb74
jge 0x1001dc57
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x14]
jne 0x1001dc72
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x1001dc74
mov eax, esi
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
mov dword [ebp - 0x284], edx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe8
push 2
jge 0x1001d81b
mov dword [ebp - 0x38], 0xfa86
lea ecx, [ebp - 0xf0]
call fcn.1001b10b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0x9ad59e57
mov dword [ebp - 0x14], 0x5f6f594a
mov dword [ebp - 0x84], 0x5c9828a5
mov dword [ebp - 0x20], 0x502d4801
mov dword [ebp - 0x64], 0x66298a20
mov dword [ebp - 0x40], 0xaa55
mov dword [ebp - 0x10], ebx
jmp 0x1001dcf3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0x204e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001dce0
push 3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001dd12
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001dd01
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001dfd8
jmp 0x1001dd2b
push 3
pop ecx
mov dword [ebp - 0x28], 0xfffffffc
push ecx
mov dword [ebp - 0x30], 0xcf687292
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x2c], ebx
call fcn.1001b10b
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x10], ebx
jmp 0x1001dd64
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0xd700d1a0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001dd53
push 3
mov dword [ebp - 0x10], ebx
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1001dd8f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0x20bab1f3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001dd74
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x18], ebx
jne 0x1001dfca
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
jl 0x1001dfb1
mov dword [ebp - 0x3c], 0xd0811fc8
lea ecx, [ebp - 0xd8]
push edx
call fcn.1001b10b
push 3
mov dword [ebp - 0x24], 0x494fb389
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001ddd9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xa77b69c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001ddc6
mov dword [ebp - 0x10], ebx
jmp 0x1001ddf0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001dde3
cmp dword [ebp - 0x28], ebx
je 0x1001de2a
cmp dword [ebp - 0x3c], ebx
je 0x1001de0b
cmp dword [ebp - 0x18], ebx
je 0x1001de0b
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1001de10
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [ebp - 0xa4]
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x3c]
add eax, ecx
je 0x1001de2a
mov edx, esi
jmp 0x1001de2f
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0xd8]
setl dl
mov dword [eax + 8], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x128], ebx
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb4]
setg cl
mov dword [ebp - 0x110], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0x3c]
jne 0x1001dea6
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xd8]
cmp dword [eax + 4], ebx
je 0x1001dec2
cmp dword [ebp - 0x30], ebx
jne 0x1001dfa6
cmp dword [ebp - 0x3c], ebx
jmp 0x1001df8e
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x1001df8e
mov esi, dword [ebp - 0xb4]
mov dword [ebp - 0x2c], 0xc764
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0xf0]
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [eax]
mov eax, dword [ebp - 0x128]
cmp ecx, 0xe19c
mov ecx, dword [ebp - 0xa8]
setg dl
imul eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0xb4]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x30]
setl dl
mov dword [ebp - 0x8c], edx
xor edx, edx
cmp dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x12c], ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, edi
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
mov eax, dword [esi + 4]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x24]
jns 0x1001ded7
lea ecx, [ebp - 0xd8]
call fcn.1001b9cb
dec dword [ebp - 0x28]
js 0x1001dfb1
push 3
pop edx
jmp 0x1001dda4
lea ecx, [ebp - 0xd8]
call fcn.1001b9cb
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.1001b9cb
dec dword [ebp - 0x18]
jns 0x1001dd28
jmp 0x1001dfd5
lea ecx, [ebp - 0xb4]
call fcn.1001b9cb
xor esi, esi
inc esi
mov ecx, dword [ebp - 0xf0]
cmp dword [ecx + 4], ebx
je 0x1001e02e
cmp dword [ebp - 0x84], ebx
jne 0x1001e007
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp dword [ecx + 4], eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xf0]
cmp edx, dword [eax]
mov eax, esi
setg cl
cmp ecx, 0xfff8
jbe 0x1001e030
mov eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], edi
call fcn.1001b9cb
push esi
lea ecx, [ebp - 0x150]
call fcn.1001b10b
push 2
pop esi
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x28], edi
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0xe2e4ed38
mov dword [ebp - 0x24], 0x860bc23c
mov dword [ebp - 0x14], ebx
jmp 0x1001e07d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0x4caa8e55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001e06f
cmp dword [ebp - 0x28], ecx
jne 0x1001e08e
mov eax, ecx
cmp dword [ebp - 0x28], ebx
jne 0x1001e090
mov eax, ebx
mov dword [ebp - 0x68], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
test eax, eax
setle cl
xor edx, edx
cmp ecx, 0x17be
setne dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [ebp - 0x28], ecx
jg 0x1001e0f7
cmp dword [ebp - 0x68], ebx
jne 0x1001e0f7
xor edi, edi
mov edx, ebx
inc edi
jmp 0x1001e0fc
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1001e13f
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001e13c
mov dword [ebp - 0x18], ebx
jmp 0x1001e132
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001e124
dec dword [ebp - 0x10]
jns 0x1001e11f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1001e10e
mov dword [ebp - 0x40], 9
lea ecx, [ebp - 0x9c]
push esi
call fcn.1001b10b
push 3
pop eax
push eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], al
call fcn.1001b10b
push 3
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001e189
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x138], 0x6af1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001e178
mov dword [ebp - 0x10], ebx
jmp 0x1001e1a6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001e193
mov dword [ebp - 0x10], ebx
jmp 0x1001e1c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0xec326874
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001e1b0
mov dword [ebp - 0x10], ebx
jmp 0x1001e1de
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x120], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001e1cd
mov eax, dword [ebp - 0x9c]
mov dword [eax], ebx
mov eax, dword [eax]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x40], 7
mov eax, dword [ebp + eax*4 - 0x138]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x9c]
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
add edx, 0xd860ad1d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x18], ebx
jmp 0x1001e26b
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
cmp edx, eax
setl cl
mov dword [ebp - 0x120], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x9c]
jle 0x1001e243
inc dword [eax]
cmp dword [eax], esi
jle 0x1001e1eb
lea ecx, [ebp - 0x1f8]
call fcn.1001b9cb
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
call fcn.1001b9cb
mov dword [ebp - 0x14], ebx
jmp 0x1001e2b2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001e29f
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0xffffffff
push 3
mov dword [ebp - 0x40], 0x6548aab5
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1001e2e1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x210], 0x7e6aa165
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001e2d0
mov dword [ebp - 0x10], ebx
jmp 0x1001e308
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e305
push 0x183e
push 0x2085
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001e2eb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x24], 0xffff
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e408
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xffffffea
cmp dword [ebp - 0x18], eax
jle 0x1001e3e8
mov dword [ebp - 0x20], 0x51ebf0dd
xor edx, edx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x40], 0xfa01
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, 0x6cce
setle dl
xor ecx, ecx
cmp edx, 0xbc6e
setl cl
sub eax, ecx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e3df
push 0x25e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jg 0x1001e36a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e3f8
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push ebx
push ebx
push 0x1336
push ebx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push esi
lea ecx, [ebp - 0x21c]
call fcn.1001b10b
mov dword [ebp - 0x14], 0x76f5020f
mov dword [ebp - 0x14], ebx
jmp 0x1001e42f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001e420
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e443
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001e477
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e46f
push 0x18e1
push 0xe25
push ebx
push 0xfb4
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
jns 0x1001e44f
lea ecx, [ebp - 0x21c]
call fcn.1001b9cb
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x150]
or dword [ebp - 4], 0xffffffff
call fcn.1001b9cb
mov dword [ebp - 0x18], 0x8e64e6dc
lea ecx, [ebp - 0x144]
push edi
call fcn.1001b10b
push esi
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], 4
call fcn.1001b10b
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], ebx
jmp 0x1001e4e0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001e4cd
push 3
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001e4fc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001e4ed
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x1001e50c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x144]
mov dword [eax], 0xc257
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x1001e52f
mov eax, dword [ebp - 0x144]
mov ecx, edi
cmp dword [eax], ebx
jne 0x1001e531
mov ecx, ebx
mov eax, dword [ebp - 0x168]
mov dword [eax + 8], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x168]
call fcn.1001b9cb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001b9cb
push dword [ebp - 0x88]
movdqa xmm0, xmmword [0x10009850]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x10], 0x72226312
push eax
mov dword [ebp - 0x30], 0x4cb8
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
push ebx
movdqu xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call fcn.1001c75f
mov dword [ebp - 0x20], 0xf953
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 0xe01afec1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
cmp edi, eax
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
add eax, 0x565e
add eax, edx
xor ecx, ecx
cmp eax, esi
setl cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1001e680