Function at 0x100391fa
Capabilities:
Get common file path
Get disk information
Get geographical location
Query or enumerate registry value

Disassembly:
mov eax, 0x10077a5c
call fcn.10076754
sub esp, 0x1dc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 3
pop edi
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x100]
push edi
mov byte [ebp - 0x4c], dl
call fcn.10025cee
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x1003923f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xfdf99ff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003922c
mov dword [ebp - 0x18], ebx
jmp 0x10039257
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], 0x32667a87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10039249
mov dword [ebp - 0x68], ebx
jmp 0x10039270
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], edi
jl 0x10039261
lea ecx, [ebp - 0x100]
call fcn.10025d50
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x3c], 0x9c3997b0
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x40], 0x4f4cc511
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xb0ce
mov dword [ebp - 0x3c], 0xe548e01a
mov dword [ebp - 0x30], 0x771b7056
cmp dword [ebp - 0x18], ebx
je 0x1003931b
imul eax, dword [ebp - 0x18], 0x1c77
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0xffff970a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x100392fe
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setg dl
cmp edx, 0xfffffff8
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jle 0x1003931b
xor edx, edx
inc edx
jmp 0x1003931d
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10039362
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
mov dword [ebp - 0x18], 0x831713b9
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10039385
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x194], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039378
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jge 0x10039447
push edi
lea ecx, [ebp - 0xe8]
call fcn.10025cee
mov dword [ebp - 0x3c], 0x67101392
mov dword [ebp - 0x20], ebx
jmp 0x100393c1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0x8462751c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100393ae
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100393d7
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov edx, dword [ebp - 0xe8]
xor ecx, ecx
inc ecx
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x61bab593
mov dword [ebp - 0x3c], 0x92085949
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
jl 0x1003942e
mov dword [ebp - 0x3c], 0xdc2a
mov dword [ebp - 0x30], 0xd7582ba8
inc dword [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x80e033c2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x28]
jns 0x100393f9
dec dword [edx + 8]
jns 0x100393e3
lea ecx, [ebp - 0xe8]
call fcn.10025d50
dec dword [ebp - 0x18]
js 0x10039396
mov eax, dword [ebp + 8]
mov ecx, dword [0x1007e8cc]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x44], 0xad3b3152
mov dword [ebp - 0x3c], ecx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
cmp dword [ebp - 0x30], ebx
je 0x10039480
mov dword [ebp - 0x30], 0x546158d3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
jmp 0x10039494
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10039494
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov ecx, dword [ebp - 0x3c]
cmp byte [ebp - 0x4c], bl
je 0x100396fb
cmp ecx, 1
jne 0x100396fb
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], ebx
jmp 0x1003950c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 0xffffffe4
jmp 0x10039503
push 1
lea ecx, [ebp - 0x124]
call fcn.10025cee
mov dword [ebp - 0x20], ebx
jmp 0x100394e7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0xb401
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x100394d4
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x124]
dec dword [eax]
call fcn.10025d50
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xe
jge 0x100394c2
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jge 0x100394b2
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], 0x91a049fe
mov dword [ebp - 0x2c], 0x4b1b055c
push 4
mov dword [ebp - 0x2c], 0x591b68de
pop ecx
mov dword [ebp - 0x30], ebx
mov dword [eax + 8], ecx
mov dword [ebp - 0x20], ebx
jmp 0x1003955d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x15c], 0x7ef5d870
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1003954c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10039571
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0x38], ebx
jmp 0x100396c8
push 4
pop esi
push esi
lea ecx, [ebp - 0xbc]
call fcn.10025cee
push esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], ebx
call fcn.10025cee
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x18], ebx
jmp 0x100395b5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xcd50997
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100395a2
mov dword [ebp - 0x18], ebx
jmp 0x100395d2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100395bf
inc dword [ebp - 0x150]
mov esi, dword [ebp - 0x150]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ecx + 0xc], edx
mov edx, dword [ebp - 0x24]
setl al
xor ecx, ecx
cmp eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x28]
setg cl
xor eax, eax
cmp ecx, dword [edx + 0xc]
setg al
xor ecx, ecx
cmp eax, dword [edx + 8]
mov edx, dword [ebp - 0x30]
setne cl
xor eax, eax
add edx, ecx
add edx, esi
mov esi, dword [ebp - 0x24]
cmp dword [esi + 0xc], ebx
sete al
cmp eax, edx
jg 0x10039650
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039642
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp dword [esi + 0xc], ebx
jne 0x100396d4
push 2
pop esi
jmp 0x100396ab
push 2
pop esi
push esi
lea ecx, [ebp - 0xf4]
call fcn.10025cee
mov dword [ebp - 0x20], ebx
jmp 0x10039677
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xab56
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039664
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 4], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100396a0
push ebx
push 0x111
call dword [sym.imp.GDI32.dll_SetLayout]
lea ecx, [ebp - 0xf4]
call fcn.10025d50
lea ecx, [ebp - 0xa4]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10025d50
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12
jne 0x10039579
jmp 0x100396f1
lea ecx, [ebp - 0xa4]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10025d50
push 2
pop esi
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x1007e8cc
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x48], eax
jge 0x1003a4f2
push 1
lea ecx, [ebp - 0x14c]
call fcn.10025cee
push 1
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], esi
call fcn.10025cee
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1003973f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003972c
mov dword [ebp - 0x18], ebx
jmp 0x1003975c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0xb4ffb87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039749
mov eax, dword [ebp - 0xb0]
mov dword [eax], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003977d
push 0x2548
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039797
push 0x681
push 0x64a
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov eax, dword [ebp - 0xb0]
inc dword [eax]
cmp dword [eax], 0
jle 0x10039769
lea ecx, [ebp - 0xb0]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.10025d50
mov dword [ebp - 0x1c], esi
mov eax, 0x1007e8d0
push 0xfffffffffffffffa
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x58], eax
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x5b0bb8bf
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x1f050678
mov dword [ebp - 0x24], 0xefbde283
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xbb66efe0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ebx
jmp 0x1003981a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a0], 0x3ae5d5ec
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10039809
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x1003982a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x64b5c6f8
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x11
jge 0x10039a1b
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x2c], 0x53f0d3ec
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x44], 0x15f1
cmp dword [ebp - 0x44], 0x190d
jle 0x100398f0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0x38d9
mov esi, dword [ebp - 0x24]
mov ecx, ebx
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov eax, esi
cdq
idiv ecx
mov ecx, 0x106205d8
or edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10025bd9
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x77bb
jl 0x100398a0
mov esi, dword [ebp - 0x54]
add dword [ebp - 0x24], esi
dec dword [ebp - 0x1c]
push 0
pop ebx
jne 0x10039895
inc esi
mov dword [ebp - 0x54], esi
cmp esi, 0x24a2
jl 0x1003988b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x62c5
jl 0x10039888
push 2
pop esi
mov dword [ebp - 0x30], 0x247f
cmp dword [ebp - 0x30], 0xf1e
jge 0x1003990d
push ecx
call fcn.1003eeba
push eax
call fcn.1002986c
pop ecx
mov dword [ebp - 4], edi
cmp dword [ebp - 0x44], 0x1332
jge 0x10039928
mov edx, 0x10008ff0
mov ecx, 0x106205d8
call fcn.100294ba
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0xd4]
call fcn.10025cee
mov dword [ebp - 0x44], 0xffff
xor edx, edx
mov dword [ebp - 0x30], 0xd45e
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1003998a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x160], 0x280bfe73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039979
mov dword [ebp - 0x18], ebx
jmp 0x100399a7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10039994
dec dword [ebp - 0x44]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x10039a05
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x24]
push 1
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0xd4]
setne dl
xor ecx, ecx
cmp edx, 0xfcf4
pop edx
setne cl
add ecx, dword [eax + edi*4]
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x1c]
jns 0x100399b7
push 2
pop esi
lea ecx, [ebp - 0xd4]
call fcn.10025d50
inc dword [ebp - 0x20]
push 3
pop edi
jmp 0x10039849
mov ecx, dword [ebp - 0x34]
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp eax, dword [ebp - 0x48]
jge 0x10039fc5
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x54], 9
cmp dword [ebp - 0x28], ebx
je 0x10039b1b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x1b
jne 0x10039b63
push 1
lea ecx, [ebp - 0x88]
call fcn.10025cee
xor edx, edx
mov dword [ebp - 4], 5
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10039a7b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], 0x7a00
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10039a68
mov dword [ebp - 0x44], 0x37a
cmp dword [ebp - 0x44], 0x720
jle 0x10039adf
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov ecx, esi
shl eax, cl
lea ecx, [ebp - 0x1d0]
cdq
push edx
push eax
call fcn.1000b1a5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039ab3
mov eax, dword [eax]
push eax
call fcn.1005e68c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1d0]
call fcn.100261a2
mov eax, dword [ebp - 0x24]
inc esi
cmp esi, 0x9e7
jl 0x10039a97
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x65cb
jl 0x10039a95
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x44], 0x269
jge 0x10039afe
push 0x10009088
call fcn.1005e68c
pop ecx
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x88]
or dword [ebp - 4], 0xffffffff
call fcn.10025d50
inc dword [ebp - 0x28]
jmp 0x10039a42
mov dword [ebp - 0x20], ebx
jmp 0x10039b31
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdc], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039b20
cmp dword [ebp - 0x54], 0x5047
jg 0x10039b59
cmp dword [ebp - 0x28], 0x6f44
jl 0x10039b59
cmp dword [ebp - 0xdc], 0xfff6
jbe 0x10039b59
xor eax, eax
inc eax
jmp 0x10039b5b
mov eax, ebx
mov dword [ebp - 0xdc], eax
jmp 0x10039b69
mov ecx, dword [ebp - 0x34]
push 2
pop esi
mov eax, dword [ecx]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], ecx
push esi
mov eax, dword [ecx]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x378f1e0c
mov dword [ebp - 0x58], eax
call fcn.10025cee
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x20], ebx
jmp 0x10039baa
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039b97
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x10039bc7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10039bc7
mov eax, ebx
jmp 0x10039bca
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x10039bd5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10039c37
mov dword [ebp - 0x18], ebx
jmp 0x10039c2c
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x10039c23
mov dword [ebp - 0x2c], 0xbdb88dcf
cmp dword [ebp - 0x2c], ebx
jne 0x10039c29
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039c20
push 0x2366
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jg 0x10039bfd
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jne 0x10039bf4
jmp 0x10039cd7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0xb8a442f2
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x50], 0xfffffffc
mov eax, dword [ebp - 0x24]
sub eax, 8
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xa8d6
cmp eax, 0x35d5
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x24]
jne 0x10039c88
cmp dword [ebp - 0x1c], ebx
jne 0x10039c88
mov ecx, ebx
jmp 0x10039c8b
xor ecx, ecx
inc ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x118]
mov dword [eax], edx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, 0xffff
setg cl
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setle cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffff7
setle cl
imul eax, ecx, 3
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x118]
call fcn.10025d50
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x98]
add dword [ebp - 0x34], eax
push 4
call fcn.10025cee
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x24], 0x31ea0627
mov dword [ebp - 0x28], 0xd7d2
push edi
call fcn.10025cee
mov dword [ebp - 0x44], 0xffffffff
push 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x10039d37
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10039d28
mov dword [ebp - 0x1c], ebx
jmp 0x10039d54
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0x62cc684c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10039d41
mov dword [ebp - 0x1c], ebx
jmp 0x10039d6f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x168], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10039d5e
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x130]
or dword [esi + 4], 0xffffffff
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x98]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x24], 1
cmp ecx, dword [eax + 8]
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
setle dl
imul eax, edx
cmp ecx, eax
sbb eax, eax
inc eax
cmp dword [esi + 4], eax
jg 0x10039dc3
cmp dword [ebp - 0x24], ebx
jne 0x10039dc3
mov ecx, ebx
jmp 0x10039dc6
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x98]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x168], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [esi + 4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x130]
setge dl
mov dword [ebp - 0x2c], edx
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10025d50
cmp dword [ebp - 0x58], 0
jne 0x10039e26
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0x37400631
mov dword [ebp - 0x2c], 0x8b0d193e
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x10039e62
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x180], 0xec995f76
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10039e51
push 2
mov dword [ebp - 0x20], ebx
pop esi
cmp dword [ebp - 0x20], 0xffffffe6
jg 0x10039fb3
push esi
lea ecx, [ebp - 0x10c]
call fcn.10025cee
mov dword [ebp - 0x1c], 0xab6dad81
mov eax, 0x70e7ad53
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x50], 0xb0cf5aa0
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x18], 0xc35cf455
mov dword [ebp - 0x24], ebx
jmp 0x10039ed0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10039ec1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
dec dword [eax + 4]
jne 0x10039f08
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x2c]
dec eax
imul ecx, eax
sub ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x38]
jg 0x10039f08
mov ecx, ebx
jmp 0x10039f0b
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x8cdb
setl al
neg eax
cmp eax, 0xfff9
jne 0x10039f28
cmp dword [ebp - 0x1c], ebx
jne 0x10039f28
mov eax, ebx
jmp 0x10039f2b
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jg 0x10039f62
mov dword [ebp - 0x38], ebx
jmp 0x10039f5a
mov dword [ebp - 0x28], 0x1d
jmp 0x10039f51
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039f4e
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffec
jne 0x10039f3e
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffc
jge 0x10039f35
jmp 0x10039fa0
mov dword [ebp - 0x1c], ebx
jmp 0x10039f9b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039f7a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov dword [ebp - 0x18], ebx
jmp 0x10039f93
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10039f90
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10039f7f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10039f67
lea ecx, [ebp - 0x10c]
call fcn.10025d50
dec dword [ebp - 0x20]
jmp 0x10039e6d
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
inc eax
jmp 0x10039a20
mov eax, dword [ecx]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0x622b6078
mov dword [ebp - 0x30], 0x5a9390df
mov dword [ebp - 0x48], 0x12ef314d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 0xa8d6e859
mov dword [ebp - 0x24], 0xd909cc0f
mov dword [ebp - 0x24], 0xd4d3380d
mov dword [ebp - 0x30], 0x3c62ed5b
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
jmp 0x1003a01e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x174], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003a011
cmp dword [ebp - 0x1c], ebx
je 0x1003a06a
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
neg eax
jne 0x1003a04f
cmp dword [ebp - 0x1c], ebx
je 0x1003a052
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x8627
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
je 0x1003a07f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x18]
cmp eax, 4
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x20]
jle 0x1003a0ba
cmp dword [ebp - 0x24], ebx
jne 0x1003a0ba
mov edx, ebx
jmp 0x1003a0bd
xor edx, edx
inc edx
mov eax, dword [ebp - 0x170]
xor ecx, ecx
cmp edx, eax
push esi
sete cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xc7f2bac4
lea ecx, [ebp - 0x7c]
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [eax]
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x58], eax
call fcn.10025cee
push 9
pop edi
mov dword [ebp - 4], edi
xor edx, edx
mov dword [ebp - 0x30], 0x993911e7
inc edx
mov dword [ebp - 0x48], 0x5d33
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], ebx
jmp 0x1003a133
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003a123
cmp dword [ebp - 0x1c], ebx
jne 0x1003a1c5
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xffffffff
setg cl
add ecx, 0xffffd80b
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x1c]
cmp ecx, 0xffffffff
setle al
imul eax, dword [ebp - 0x1c]
cmp eax, 0x819d3388
jb 0x1003a178
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x1c]
cmp ecx, 0x951b
setle al
sub eax, dword [ebp - 0x1c]
jne 0x1003a195
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xfab8af86
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
imul eax, ecx, 0xba56
inc edx
mov ecx, ebx
test eax, eax
je 0x1003a1c7
mov ecx, edx
xor eax, eax
cmp ecx, edi
setl al
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x1003a287
mov dword [ebp - 0x24], 0x6a4a
inc dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
jg 0x1003a369
mov dword [ebp - 0x2c], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
neg esi
mov dword [ebp - 0x30], 0xfffffff8
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
sbb esi, esi
mov eax, dword [ebp - 0x7c]
neg esi
xor edx, edx
cmp esi, dword [eax + ecx*4]
mov eax, dword [ebp - 0x30]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x7c]
setne cl
imul ecx, dword [eax + edi*4]
xor eax, eax
cmp ecx, 0x3d4f39ab
setge al
cmp dword [ebp - 0x24], eax
jle 0x1003a240
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x1c]
xor esi, esi
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x7c]
inc esi
cmp dword [eax + ecx*4], esi
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xe6de11d6
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x48]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1003a1f1
jmp 0x1003a36c
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x48], 0x1025
cmp dword [ebp - 0x48], 0x109a
jle 0x1003a34a
push 0x1074
push 0x1979
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
mov ecx, ebx
xor esi, esi
mov dword [ebp - 0x24], ecx
inc esi
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
add eax, ecx
mov dword [ebp - 0x2c], ebx
and eax, edi
mov edi, ebx
mov dword [ebp - 0x50], eax
xor eax, edi
lea ecx, [ebp - 0x1b8]
cdq
push edx
push eax
call fcn.1000b1a5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a2eb
mov eax, dword [eax]
push eax
call fcn.1005e68c
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1b8]
call fcn.100261a2
mov eax, dword [ebp - 0x50]
inc edi
cmp edi, 0x49b3
jl 0x1003a2d1
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
inc edi
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
cmp edi, 0x12f4
jl 0x1003a2c5
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x4fd0
jl 0x1003a2c0
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x5686
jl 0x1003a2bb
push 0x1dac
push 0x26b5
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x1003a34d
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x48], 0xebf
jge 0x1003a36c
push 0x100090d8
call fcn.1005e68c
pop ecx
jmp 0x1003a36c
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.10025d50
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x40]
add ecx, edi
mov dword [ebp - 0x48], 0x6287
cmp dword [ebp - 0x48], 0x639b
mov dword [ebp - 0x34], ecx
jle 0x1003a408
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, edi
mov dword [ebp - 0x2c], ebx
sar eax, cl
mov edi, ebx
mov dword [ebp - 0x50], eax
mov ecx, edi
shl eax, cl
lea ecx, [ebp - 0x1e8]
cdq
push edx
push eax
call fcn.1000b1a5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a3c5
mov eax, dword [eax]
push eax
call fcn.1005e68c
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1e8]
call fcn.100261a2
mov eax, dword [ebp - 0x50]
inc edi
cmp edi, 0x6329
jl 0x1003a3a9
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x44ef
jl 0x1003a39d
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x20cd
jl 0x1003a398
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x40]
cmp dword [ebp - 0x58], 0
jne 0x1003a4d7
cmp byte [ebp - 0x4c], 0
je 0x1003a429
cmp dword [ebp - 0x3c], esi
jne 0x1003a429
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
lea eax, [eax + edi*4]
add dword [edx + 8], eax
mov eax, dword [ecx]
add ecx, edi
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add ecx, edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x34], ecx
call fcn.100599a4
pop ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], ebx
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.1003f2ec
mov eax, dword [ebp - 0x28]
mov edi, ebx
mov ecx, dword [ebp - 0x64]
test eax, eax
jle 0x1003a4b8
mov eax, edi
and eax, 0x80000001
jns 0x1003a481
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, edi
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x50]
jmp 0x1003a496
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x28]
cmp word [ecx + edx*2], bx
jne 0x1003a493
mov eax, dword [ebp - 0x34]
mov word [ecx + edx*2], si
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x30]
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x28]
cmp edi, eax
jl 0x1003a473
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x30]
mov dword [edx + 4], eax
test ecx, ecx
je 0x1003a4d7
push ecx
call fcn.1005e7f7
pop ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
cmp dword [ebp - 0x48], 0x601d
jge 0x1003a4eb
push 0x100090f8
call fcn.1005e68c
pop ecx
or dword [ebp - 4], 0xffffffff
push 3
pop edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1003a50f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18c], 4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003a4fe
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1003a5d8
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 2
jg 0x1003a5cf
push edi
lea ecx, [ebp - 0xc8]
call fcn.10025cee
mov dword [ebp - 0x24], ebx
jmp 0x1003a558
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003a549
mov edi, dword [ebp - 0xc8]
mov dword [edi + 4], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003a57b
push 0x14a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
inc dword [edi + 4]
cmp dword [edi + 4], 2
jle 0x1003a566
mov eax, dword [ebp - 0x18]
xor edx, edx
mov esi, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x18c]
cmp eax, 0x6f65e790
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp dword [esi + 8], eax
setne cl
sub ecx, edx
add ecx, 0x6b471dfd
mov dword [edi + 4], ecx
lea ecx, [ebp - 0xc8]
call fcn.10025d50
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
push 3
pop edi
jle 0x1003a538
dec dword [ebp - 0x18]
jns 0x1003a524
mov dword [ebp - 0x18], ebx
jmp 0x1003a60c
mov dword [ebp - 0x2c], 0x9753
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003a603
push ebx
push 0x20f6
push 0x1bd8
push 0x1eaf
call dword [sym.imp.GDI32.dll_SetPixel]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jle 0x1003a5dd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret