Function at 0x10041a81
Capabilities:
Create pipe
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e307
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x10c4
call fcn.1007a600
push esi
push edi
mov dword [ebp - 0xb64], 0x7f6af112
mov dword [ebp - 0xb60], 0x7f6af112
mov dword [ebp - 0xb5c], 0x7f6af112
mov dword [ebp - 0xb58], 0x7f6af112
mov dword [ebp - 0xda0], 0x54fddd3f
mov dword [ebp - 0x1004], 0xfffffff9
mov dword [ebp - 0x1000], 0xfffffff9
mov dword [ebp - 0xffc], 0xfffffff9
mov dword [ebp - 0xff8], 0xfffffff9
mov dword [ebp - 0xd94], 0xfffffffa
mov dword [ebp - 0xd9c], 0x2d71
mov dword [ebp - 0xda4], 0x76fbfcc0
mov dword [ebp - 0x908], 0x5a74
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb64], 0
jmp 0x10041b55
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb64]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb64], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb64], 7
jg 0x10041b7e
mov dword [ebp - 0x4b0], 0x91e29ea4
mov eax, dword [ebp - 0x4b0]
dec eax
mov dword [ebp - 0x4b0], eax
jmp 0x10041b3a
mov eax, dword [ebp - 0x908]
dec eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0xb78], 0x7f6af112
mov dword [ebp - 0xb74], 0x7f6af112
mov dword [ebp - 0xb70], 0x7f6af112
mov dword [ebp - 0xb6c], 0x7f6af112
mov dword [ebp - 0xdec], 0x54fddd3f
mov dword [ebp - 0x1018], 0xfffffff9
mov dword [ebp - 0x1014], 0xfffffff9
mov dword [ebp - 0x1010], 0xfffffff9
mov dword [ebp - 0x100c], 0xfffffff9
mov dword [ebp - 0xdf4], 0xfffffffa
mov dword [ebp - 0xdfc], 0x2d71
mov dword [ebp - 0xe04], 0x76fbfcc0
mov dword [ebp - 0x3dc], 0x5a74
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb78], 0
jmp 0x10041c3b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb78]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb78], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb78], 7
jg 0x10041c64
mov dword [ebp - 0x8fc], 0x91e29ea4
mov eax, dword [ebp - 0x8fc]
dec eax
mov dword [ebp - 0x8fc], eax
jmp 0x10041c20
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
push 2
lea ecx, [ebp - 0x9f8]
call fcn.10024520
and dword [ebp - 4], 0
mov dword [ebp - 0xe0c], 0xedfa
mov dword [ebp - 0x74], 0
jmp 0x10041c9c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10041cb2
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1078], 0x85f70ad6
jmp 0x10041c95
mov dword [ebp - 0x74], 0
jmp 0x10041cc2
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10041cde
push dword [ebp - 0x74]
lea ecx, [ebp - 0x9f8]
call fcn.1002458d
mov dword [eax], 0x20f89b54
jmp 0x10041cbb
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1002458d
and dword [eax], 0
jmp 0x10041d14
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1002458d
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1002458d
cmp dword [eax], 2
jg 0x10041ff4
mov dword [ebp - 0x190], 9
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x10041d55
push 0
push 0
push 0xf14
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov dword [ebp - 0x190], 2
jmp 0x10041d6e
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x10041fef
mov dword [ebp - 0x1f4], 0xd962ee6d
push 3
lea ecx, [ebp - 0xcb8]
call fcn.10024520
mov byte [ebp - 4], 1
mov dword [ebp - 0x2a4], 0
jmp 0x10041daf
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x10041dd1
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xcb8]
call fcn.1002458d
mov dword [eax], 0xa9f8d19c
jmp 0x10041da2
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x10041deb
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0x1f4], 2
jmp 0x10041e04
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x10041fdb
mov dword [ebp - 0x1c8], 5
mov dword [ebp - 0x1c8], 2
jmp 0x10041e34
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x10041fd6
mov dword [ebp - 0x120], 0x3631e19e
mov dword [ebp - 0x7c4], 0x17a68fa
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x120], 0
jmp 0x10041e7b
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jg 0x10041fd1
mov dword [ebp - 0x174], 0xfffffffb
mov dword [ebp - 0x8d8], 0xe11914cc
mov dword [ebp - 0x174], 2
jmp 0x10041eb5
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x10041fbf
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp + eax*4 - 0x1078], 0
jne 0x10041ee4
cmp dword [ebp - 0x174], 0
jne 0x10041ee4
and dword [ebp - 0x8e8], 0
jmp 0x10041eee
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8d8], 0x3b15a8d
cmp dword [ebp - 0x8d8], 1
jne 0x10041f16
cmp dword [ebp - 0x190], 0
je 0x10041f16
mov dword [ebp - 0x3cc], 1
jmp 0x10041f1d
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 7
jge 0x10041f32
mov dword [ebp - 0x8e0], 1
jmp 0x10041f39
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x8e0], eax
je 0x10041f53
mov dword [ebp - 0x3d4], 1
jmp 0x10041f5a
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x8e60
jle 0x10041f78
cmp dword [ebp - 0x120], 0
jne 0x10041f78
and dword [ebp - 0x8f0], 0
jmp 0x10041f82
mov dword [ebp - 0x8f0], 1
mov esi, dword [ebp - 0x8e8]
add esi, dword [ebp - 0x8f0]
push 1
lea ecx, [ebp - 0xcb8]
call fcn.1002458d
mov dword [eax], esi
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10041fba
push 0x1d7f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x10041ea8
mov eax, dword [ebp - 0x7c4]
dec eax
mov dword [ebp - 0x7c4], eax
jmp 0x10041e6e
jmp 0x10041e27
jmp 0x10041df7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcb8]
call fcn.10024588
jmp 0x10041d61
jmp 0x10041cf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f8]
call fcn.10024588
mov dword [ebp - 0xb98], 0x7f6af112
mov dword [ebp - 0xb94], 0x7f6af112
mov dword [ebp - 0xb90], 0x7f6af112
mov dword [ebp - 0xb8c], 0x7f6af112
mov dword [ebp - 0xe14], 0xffffffff
mov dword [ebp - 0xe1c], 0x8a6b950b
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0x26c], 0
jmp 0x10042062
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1004207e
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1b8], 0xc75b57fd
jmp 0x10042055
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b8], 0
jmp 0x100420ac
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b8], 0xffffffef
je 0x10042157
mov dword [ebp - 0x924], 0xfffffffb
mov dword [ebp - 0x102c], 0xfffffff8
mov dword [ebp - 0x1028], 0xfffffff8
mov dword [ebp - 0x1024], 0xfffffff8
mov dword [ebp - 0x1020], 0xfffffff8
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b8], 0
je 0x1004213c
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1004213a
push 0
push 0x13e9
push 0
push 0x1980
push 0x13df
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x10042152
mov dword [ebp - 0x9e0], 0xaf42
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0x9e0], eax
jmp 0x10042091
mov dword [ebp - 0xe24], 0x54fddd3f
mov dword [ebp - 0xc0], 0xfffffffc
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x1fc], 0
jmp 0x1004218b
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x100421a7
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x198], 0x2799ac78
jmp 0x1004217e
mov dword [ebp - 0xc0], 0
jmp 0x100421c0
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x10042437
mov dword [ebp - 0x54], 0xf38c0887
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x198], 0
je 0x1004223c
mov dword [ebp - 0x2c4], 0xc7555b7c
mov dword [ebp - 0x9e8], 4
mov dword [ebp - 0x2c4], 0
jmp 0x10042211
mov eax, dword [ebp - 0x2c4]
dec eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jl 0x10042237
mov dword [ebp - 0xe2c], 0x5f0b
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x9e8], 1
jmp 0x10042204
jmp 0x100423c9
mov dword [ebp - 0x274], 0xfffffffd
push 2
lea ecx, [ebp - 0xcf4]
call fcn.10024520
mov dword [ebp - 4], 2
mov dword [ebp - 0x204], 0
jmp 0x10042273
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x10042292
push dword [ebp - 0x204]
lea ecx, [ebp - 0xcf4]
call fcn.1002458d
or dword [eax], 0xffffffff
jmp 0x10042266
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x274]
jne 0x100422c8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0x274], 0xfbde283b
ja 0x100422c8
and dword [ebp - 0x67c], 0
jmp 0x100422d2
mov dword [ebp - 0x67c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp eax, dword [ebp - 0x67c]
jge 0x100422f3
mov dword [ebp - 0x3ec], 1
jmp 0x100422fa
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x274]
imul eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0xc0]
jg 0x1004231b
mov dword [ebp - 0x86c], 1
jmp 0x10042322
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x54], 0
jmp 0x1004233b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x100423ba
mov dword [ebp - 0x3f4], 0xbfe7
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0xe3c], eax
cmp dword [ebp - 0x3f4], 0
jne 0x1004236f
cmp dword [ebp - 0x64], 0
jne 0x1004236f
and dword [ebp - 0x684], 0
jmp 0x10042379
mov dword [ebp - 0x684], 1
cmp dword [ebp - 0x684], 0xffffffff
je 0x1004238e
mov dword [ebp - 0x3fc], 1
jmp 0x10042395
and dword [ebp - 0x3fc], 0
push 0
lea ecx, [ebp - 0xcf4]
call fcn.1002458d
mov ecx, dword [ebp - 0x3fc]
mov dword [eax], ecx
cmp dword [ebp - 0xc0], 0
je 0x100423b5
jmp 0x100423ba
jmp 0x10042334
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf4]
call fcn.10024588
mov dword [ebp - 0x54], 0
jmp 0x100423d9
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10042432
mov dword [ebp - 0x64], 0
jmp 0x100423ef
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x10042406
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x198], 0
je 0x10042404
jmp 0x10042406
jmp 0x100423e8
mov dword [ebp - 0x64], 0
jmp 0x10042416
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x10042430
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x198], 0
je 0x1004242e
jmp 0x10042430
jmp 0x1004240f
jmp 0x100423d2
jmp 0x100421b3
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10042458
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov dword [ebp - 0x1040], 0xfffffff9
mov dword [ebp - 0x103c], 0xfffffff9
mov dword [ebp - 0x1038], 0xfffffff9
mov dword [ebp - 0x1034], 0xfffffff9
mov dword [ebp - 0xe44], 0xfffffffa
mov dword [ebp - 0xe4c], 0x2d71
mov dword [ebp - 0xe54], 0x76fbfcc0
mov dword [ebp - 0x404], 0x5a74
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb98], 0
jmp 0x100424d6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb98]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb98], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb98], 7
jg 0x100424ff
mov dword [ebp - 0x7cc], 0x91e29ea4
mov eax, dword [ebp - 0x7cc]
dec eax
mov dword [ebp - 0x7cc], eax
jmp 0x100424bb
mov eax, dword [ebp - 0x404]
dec eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x20c], 0x4a8c6a53
mov dword [ebp - 0xb40], 0xfffffff9
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10042546
push 0
push 0x1d0e
push 0x20f3
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x20c], 0
jmp 0x1004255f
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffff6
jge 0x100425c4
mov dword [ebp - 0x2ac], 0
jmp 0x10042581
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x1004259d
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xf4c], 0xffffffff
jmp 0x10042574
mov dword [ebp - 0xb40], 9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf4c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf4c], eax
jmp 0x10042552
mov dword [ebp - 0x214], 0x4a8c6a53
mov dword [ebp - 0xb48], 0xfffffff9
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x100425fe
push 0
push 0x1d0e
push 0x20f3
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x214], 0
jmp 0x10042617
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xfffffff6
jge 0x1004267c
mov dword [ebp - 0x27c], 0
jmp 0x10042639
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x10042655
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0xf5c], 0xffffffff
jmp 0x1004262c
mov dword [ebp - 0xb48], 9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf5c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf5c], eax
jmp 0x1004260a
mov dword [ebp - 0x21c], 0x4a8c6a53
mov dword [ebp - 0xb50], 0xfffffff9
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x100426b6
push 0
push 0x1d0e
push 0x20f3
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x21c], 0
jmp 0x100426cf
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xfffffff6
jge 0x10042734
mov dword [ebp - 0x2d4], 0
jmp 0x100426f1
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1004270d
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xf6c], 0xffffffff
jmp 0x100426e4
mov dword [ebp - 0xb50], 9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf6c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf6c], eax
jmp 0x100426c2
mov dword [ebp - 0xcc], 0x76820624
push 3
lea ecx, [ebp - 0xa08]
call fcn.10024520
mov dword [ebp - 4], 3
mov dword [ebp - 0x224], 0
jmp 0x1004276b
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1004278d
push dword [ebp - 0x224]
lea ecx, [ebp - 0xa08]
call fcn.1002458d
mov dword [eax], 0x60d2f38d
jmp 0x1004275e
mov dword [ebp - 0xcc], 0xd
jmp 0x100427a6
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x17
jl 0x100427d9
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x100427d7
push 0x178a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10042799
cmp dword [ebp - 0xcc], 0
je 0x100427f3
xor eax, eax
inc eax
je 0x100427f3
mov dword [ebp - 0x68c], 1
jmp 0x100427fa
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0
jg 0x1004280f
mov dword [ebp - 0x2f4], 1
jmp 0x10042816
and dword [ebp - 0x2f4], 0
push 2
lea ecx, [ebp - 0xa08]
call fcn.1002458d
mov ecx, dword [ebp - 0x2f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0xcc]
cmp eax, 0xfffffff9
jl 0x10042848
mov dword [ebp - 0x984], 1
jmp 0x1004284f
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe5c], eax
push 2
lea ecx, [ebp - 0xa08]
call fcn.1002458d
push 2
lea ecx, [ebp - 0xa08]
call fcn.1002458d
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0xcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa08]
call fcn.10024588
mov dword [ebp - 0xdc], 0x76820624
push 3
lea ecx, [ebp - 0xa18]
call fcn.10024520
mov dword [ebp - 4], 4
mov dword [ebp - 0x284], 0
jmp 0x100428c8
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x100428ea
push dword [ebp - 0x284]
lea ecx, [ebp - 0xa18]
call fcn.1002458d
mov dword [eax], 0x60d2f38d
jmp 0x100428bb
mov dword [ebp - 0xdc], 0xd
jmp 0x10042903
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x17
jl 0x10042936
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x10042934
push 0x178a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x100428f6
cmp dword [ebp - 0xdc], 0
je 0x10042950
xor eax, eax
inc eax
je 0x10042950
mov dword [ebp - 0x40c], 1
jmp 0x10042957
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0
jg 0x1004296c
mov dword [ebp - 0x364], 1
jmp 0x10042973
and dword [ebp - 0x364], 0
push 2
lea ecx, [ebp - 0xa18]
call fcn.1002458d
mov ecx, dword [ebp - 0x364]
mov dword [eax], ecx
mov eax, dword [ebp - 0x364]
sub eax, dword [ebp - 0xdc]
cmp eax, 0xfffffff9
jl 0x100429a5
mov dword [ebp - 0x930], 1
jmp 0x100429ac
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe64], eax
push 2
lea ecx, [ebp - 0xa18]
call fcn.1002458d
push 2
lea ecx, [ebp - 0xa18]
call fcn.1002458d
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0xdc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa18]
call fcn.10024588
push 3
lea ecx, [ebp - 0xbb8]
call fcn.10024520
mov dword [ebp - 4], 5
mov dword [ebp - 0x7c], 0x394643cd
mov dword [ebp - 0xa9c], 0x25189d9e
mov dword [ebp - 0xe6c], 0xafa0b2b0
mov dword [ebp - 0xe74], 0x875f
mov dword [ebp - 0xa0], 0
jmp 0x10042a40
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10042a62
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xbb8]
call fcn.1002458d
mov dword [eax], 0xc93b
jmp 0x10042a33
mov dword [ebp - 0xa0], 0
jmp 0x10042a7b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10042a97
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x938], 0x457a23a
jmp 0x10042a6e
mov dword [ebp - 0x7c], 0
jmp 0x10042aa7
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x10042d36
mov dword [ebp - 0x69c], 0xcd49
mov dword [ebp - 0x128], 0x1874da8
mov dword [ebp - 0xe7c], 0xfffffffd
mov dword [ebp - 0x6a4], 0xd3b0
mov dword [ebp - 0x22c], 0
jmp 0x10042af2
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x10042b0e
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x434], 0x47f59ec1
jmp 0x10042ae5
cmp dword [ebp - 0x69c], 0
je 0x10042b55
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x128], eax
jne 0x10042b37
mov dword [ebp - 0x900], 1
jmp 0x10042b3e
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x900], eax
jg 0x10042b55
mov dword [ebp - 0x414], 1
jmp 0x10042b5c
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
add eax, 0x87a7
je 0x10042b7e
mov eax, 0x2e77e815
test eax, eax
je 0x10042b7e
mov dword [ebp - 0x694], 1
jmp 0x10042b85
and dword [ebp - 0x694], 0
imul eax, dword [ebp - 0x694], 0x5ebd
test eax, eax
je 0x10042bab
cmp dword [ebp - 0x7c], 0
je 0x10042bab
cmp dword [ebp - 0x7c], 0
je 0x10042bab
mov dword [ebp - 0x41c], 1
jmp 0x10042bb2
and dword [ebp - 0x41c], 0
push 1
lea ecx, [ebp - 0xbb8]
call fcn.1002458d
mov ecx, dword [ebp - 0x41c]
imul ecx, dword [eax]
mov dword [ebp - 0x7d4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7d4]
mov dword [ebp + eax - 0x434], ecx
imul eax, dword [ebp - 0x7d4], 0xcec7
test eax, eax
je 0x10042c04
mov eax, 0xd580
test eax, eax
je 0x10042c04
mov dword [ebp - 0x424], 1
jmp 0x10042c0b
and dword [ebp - 0x424], 0
push 2
lea ecx, [ebp - 0xbb8]
call fcn.1002458d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x424]
jne 0x10042c2e
mov dword [ebp - 0x42c], 1
jmp 0x10042c35
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x42c], eax
jne 0x10042c4f
mov dword [ebp - 0x874], 1
jmp 0x10042c56
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0x128], 0
jmp 0x10042c7b
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jg 0x10042d31
mov dword [ebp - 0xe84], 0x40f213ed
mov dword [ebp - 0xe8c], 0xa0435e45
mov dword [ebp - 0xe94], 0x6c8c
mov dword [ebp - 0xc5c], 0xcf162c80
mov dword [ebp - 0xc58], 0xcf162c80
mov dword [ebp - 0xc54], 0xcf162c80
mov dword [ebp - 0xc50], 0xcf162c80
lea ecx, [ebp - 0x2ef]
call fcn.10008f5a
push eax
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0xc5c]
push eax
lea ecx, [ebp - 0x10b0]
call fcn.1002459c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1090]
call fcn.10024562
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x434], 0x78b15b45
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
lea ecx, [ebp - 0x1090]
call fcn.10024588
jmp 0x10042c6e
jmp 0x10042aa0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x938], 0xe161e417
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb8]
call fcn.10024588
mov dword [ebp - 0xd4], 0x76820624
push 3
lea ecx, [ebp - 0xa28]
call fcn.10024520
mov dword [ebp - 4], 6
mov dword [ebp - 0x2b4], 0
jmp 0x10042d8d
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 3
jge 0x10042daf
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xa28]
call fcn.1002458d
mov dword [eax], 0x60d2f38d
jmp 0x10042d80
mov dword [ebp - 0xd4], 0xd
jmp 0x10042dc8
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x17
jl 0x10042dfb
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10042df9
push 0x178a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10042dbb
cmp dword [ebp - 0xd4], 0
je 0x10042e15
xor eax, eax
inc eax
je 0x10042e15
mov dword [ebp - 0x43c], 1
jmp 0x10042e1c
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0
jg 0x10042e31
mov dword [ebp - 0x2fc], 1
jmp 0x10042e38
and dword [ebp - 0x2fc], 0
push 2
lea ecx, [ebp - 0xa28]
call fcn.1002458d
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0xd4]
cmp eax, 0xfffffff9
jl 0x10042e6a
mov dword [ebp - 0xb3c], 1
jmp 0x10042e71
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xe9c], eax
push 2
lea ecx, [ebp - 0xa28]
call fcn.1002458d
push 2
lea ecx, [ebp - 0xa28]
call fcn.1002458d
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0xd4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.10024588
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x234], 0xfffffff2
jmp 0x10042ed6
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xfffffff8
jge 0x10042f0b
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10042f09
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x10042ec9
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x10042f25
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0x40], 0xfffa
mov dword [ebp - 0x23c], 0x19716e28
mov dword [ebp - 0x28c], 9
mov dword [ebp - 0x304], 0x5fef4072
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x454], 0xde726f2c
mov dword [ebp - 0x30c], 0xfff8
push 1
lea ecx, [ebp - 0xa38]
call fcn.10024520
mov dword [ebp - 4], 7
mov dword [ebp - 0x384], 0xd85d5fca
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x98c], 0xfffffff8
mov dword [ebp - 0x474], 0x7898a801
mov dword [ebp - 0xea4], 0xfffffffc
mov dword [ebp - 0xeac], 1
mov dword [ebp - 0x484], 0xffff
mov dword [ebp - 0x1c], 0
jmp 0x10042fd2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10042fe8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x47c], 1
jmp 0x10042fcb
mov dword [ebp - 0x1c], 0
jmp 0x10042ff8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10043014
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa38]
call fcn.1002458d
mov dword [eax], 0xfffc
jmp 0x10042ff1
mov dword [ebp - 0x1c], 0
jmp 0x10043024
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004303a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdb0], 1
jmp 0x1004301d
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
je 0x1004304e
mov dword [ebp - 0x7dc], 1
jmp 0x10043055
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
sub eax, dword [ebp - 0x40]
xor ecx, ecx
sub ecx, eax
cmp ecx, 0x44fa3fda
jl 0x10043076
mov dword [ebp - 0x444], 1
jmp 0x1004307d
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x1004309e
mov dword [ebp - 0x940], 1
jmp 0x100430a5
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0xebc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xec4], eax
cmp dword [ebp - 0x28c], 1
jge 0x100430de
cmp dword [ebp - 0x28c], 0
jne 0x100430de
and dword [ebp - 0x6ac], 0
jmp 0x100430e8
mov dword [ebp - 0x6ac], 1
cmp dword [ebp - 0x6ac], 0x27eed050
jl 0x10043100
mov dword [ebp - 0x44c], 1
jmp 0x10043107
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x304]
cmp eax, 0xcc9d
jge 0x10043126
mov dword [ebp - 0x8c4], 1
jmp 0x1004312d
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xefc], eax
mov dword [ebp - 0x454], 7
mov eax, dword [ebp - 0x454]
imul eax, dword [ebp - 0x40]
test eax, eax
je 0x100431ab
cmp dword [ebp - 0x40], 0
je 0x100431ab
mov dword [ebp - 0x6b4], 1
jmp 0x100431b2
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x6b4], eax
jge 0x100431cf
cmp dword [ebp - 0x40], 0
jne 0x100431cf
and dword [ebp - 0x45c], 0
jmp 0x100431d9
mov dword [ebp - 0x45c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x45c]
mov dword [ebp + eax - 0x47c], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf04], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xf0c], eax
push 0
lea ecx, [ebp - 0xa38]
call fcn.1002458d
mov eax, dword [eax]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
add eax, dword [ebp - 0x7e4]
cmp eax, dword [ebp - 0x7e4]
jl 0x10043236
mov dword [ebp - 0x464], 1
jmp 0x1004323d
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0xa38]
call fcn.1002458d
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax]
jl 0x10043260
mov dword [ebp - 0x6bc], 1
jmp 0x10043267
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
sub eax, dword [ebp - 0x304]
cmp eax, 0xfff6
jae 0x10043286
mov dword [ebp - 0x46c], 1
jmp 0x1004328d
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0x46c], eax
jl 0x100432a7
mov dword [ebp - 0x87c], 1
jmp 0x100432ae
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jne 0x100432d1
or eax, 0xffffffff
jne 0x100432d1
and dword [ebp - 0x6c4], 0
jmp 0x100432db
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x6c4], eax
jg 0x100432f0
cmp dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x47c], 0x53bc
jge 0x1004330f
mov dword [ebp - 0x7ec], 1
jmp 0x10043316
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0xfffffff7
jle 0x10043334
cmp dword [ebp - 0x23c], 0
je 0x10043334
mov dword [ebp - 0x948], 1
jmp 0x1004333b
and dword [ebp - 0x948], 0
push 0
lea ecx, [ebp - 0xa38]
call fcn.1002458d
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xf14], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30c]
mov dword [ebp + eax - 0xdb0], ecx
mov eax, dword [ebp - 0x484]
dec eax
mov dword [ebp - 0x484], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa38]
call fcn.10024588
movzx eax, byte [0x1067086c]
test eax, eax
je 0x100433a1
mov esi, 0x1066ee74
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100494b8
push 1
lea ecx, [ebp - 0xa48]
call fcn.10024520
mov dword [ebp - 4], 8
push 3
lea ecx, [ebp - 0xc0c]
call fcn.10024520
mov byte [ebp - 4], 9
mov dword [ebp - 0xf1c], 0
mov dword [ebp - 0x998], 0xfffffffc
mov dword [ebp - 0x2c], 0
jmp 0x100433ea
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10043406
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa48]
call fcn.1002458d
mov dword [eax], 0x5d6c05ba
jmp 0x100433e3
mov dword [ebp - 0x2c], 0
jmp 0x10043416
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1004342c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x950], 0
jmp 0x1004340f
mov dword [ebp - 0x2c], 0
jmp 0x1004343c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10043458
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc0c]
call fcn.1002458d
mov dword [eax], 0xd7249aae
jmp 0x10043435
push 0
lea ecx, [ebp - 0xa48]
call fcn.1002458d
and dword [eax], 0
jmp 0x1004348e
push 0
lea ecx, [ebp - 0xa48]
call fcn.1002458d
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa48]
call fcn.1002458d
cmp dword [eax], 2
je 0x10043591
mov dword [ebp - 0x990], 0xfffffff6
mov dword [ebp - 0x6d4], 0xc4c8d3c8
mov dword [ebp - 0x48c], 0x97e7c14a
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x48c], 1
cmp dword [ebp - 0x48c], 0x53b1dab5
jle 0x100434f0
mov dword [ebp - 0x8ec], 1
jmp 0x100434f7
and dword [ebp - 0x8ec], 0
cmp dword [ebp - 0x8ec], 0x4c821046
jg 0x10043515
mov eax, 0xdd93ba6a
test eax, eax
jne 0x10043515
and dword [ebp - 0x494], 0
jmp 0x1004351f
mov dword [ebp - 0x494], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x950], 0x17b8
push 2
lea ecx, [ebp - 0xc0c]
call fcn.1002458d
mov dword [eax], 0x17b8
mov eax, dword [ebp - 0x494]
inc eax
mov ecx, 0x17b8
sub ecx, eax
mov eax, dword [ebp - 0x6d4]
sub eax, ecx
je 0x10043579
push 2
lea ecx, [ebp - 0xc0c]
call fcn.1002458d
cmp dword [eax], 0
je 0x10043579
mov dword [ebp - 0x49c], 1
jmp 0x10043580
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x998], eax
jmp 0x1004346a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc0c]
call fcn.10024588
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.10024588
push 3
lea ecx, [ebp - 0xbf4]
call fcn.10024520
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x84], 0x394643cd
mov dword [ebp - 0x958], 0x25189d9e
mov dword [ebp - 0xf24], 0xafa0b2b0
mov dword [ebp - 0xf2c], 0x875f
mov dword [ebp - 0xa4], 0
jmp 0x10043604
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10043626
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xbf4]
call fcn.1002458d
mov dword [eax], 0xc93b
jmp 0x100435f7
mov dword [ebp - 0xa4], 0
jmp 0x1004363f
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1004365b
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x9a0], 0x457a23a
jmp 0x10043632
mov dword [ebp - 0x84], 0
jmp 0x10043674
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x10043915
mov dword [ebp - 0x6e4], 0xcd49
mov dword [ebp - 0x130], 0x1874da8
mov dword [ebp - 0xf34], 0xfffffffd
mov dword [ebp - 0x6ec], 0xd3b0
mov dword [ebp - 0x2cc], 0
jmp 0x100436c2
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x100436de
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x4c4], 0x47f59ec1
jmp 0x100436b5
cmp dword [ebp - 0x6e4], 0
je 0x1004372e
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x130], eax
jne 0x1004370d
mov dword [ebp - 0x7f4], 1
jmp 0x10043714
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x7f4], eax
jg 0x1004372e
mov dword [ebp - 0x4a4], 1
jmp 0x10043735
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
add eax, 0x87a7
je 0x10043757
mov eax, 0x2e77e815
test eax, eax
je 0x10043757
mov dword [ebp - 0x6dc], 1
jmp 0x1004375e
and dword [ebp - 0x6dc], 0
imul eax, dword [ebp - 0x6dc], 0x5ebd
test eax, eax
je 0x1004378a
cmp dword [ebp - 0x84], 0
je 0x1004378a
cmp dword [ebp - 0x84], 0
je 0x1004378a
mov dword [ebp - 0x4ac], 1
jmp 0x10043791
and dword [ebp - 0x4ac], 0
push 1
lea ecx, [ebp - 0xbf4]
call fcn.1002458d
mov ecx, dword [ebp - 0x4ac]
imul ecx, dword [eax]
mov dword [ebp - 0x884], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x884]
mov dword [ebp + eax - 0x4c4], ecx
imul eax, dword [ebp - 0x884], 0xcec7
test eax, eax
je 0x100437e3
mov eax, 0xd580
test eax, eax
je 0x100437e3
mov dword [ebp - 0x4b4], 1
jmp 0x100437ea
and dword [ebp - 0x4b4], 0
push 2
lea ecx, [ebp - 0xbf4]
call fcn.1002458d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4b4]
jne 0x1004380d
mov dword [ebp - 0x4bc], 1
jmp 0x10043814
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x6e4]
cmp dword [ebp - 0x4bc], eax
jne 0x1004382e
mov dword [ebp - 0x7fc], 1
jmp 0x10043835
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x130], 0
jmp 0x1004385a
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jg 0x10043910
mov dword [ebp - 0xf3c], 0x40f213ed
mov dword [ebp - 0xfb0], 0xa0435e45
mov dword [ebp - 0xfb8], 0x6c8c
mov dword [ebp - 0xc84], 0xcf162c80
mov dword [ebp - 0xc80], 0xcf162c80
mov dword [ebp - 0xc7c], 0xcf162c80
mov dword [ebp - 0xc78], 0xcf162c80
lea ecx, [ebp - 0x339]
call fcn.10008f5a
push eax
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0xc84]
push eax
lea ecx, [ebp - 0x10c8]
call fcn.1002459c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10a8]
call fcn.10024562
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x4c4], 0x78b15b45
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
lea ecx, [ebp - 0x10a8]
call fcn.10024588
jmp 0x1004384d
jmp 0x10043667
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9a0], 0xe161e417
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf4]
call fcn.10024588
push 3
lea ecx, [ebp - 0xbc4]
call fcn.10024520
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x8c], 0x394643cd
mov dword [ebp - 0x960], 0x25189d9e
mov dword [ebp - 0xfc0], 0xafa0b2b0
mov dword [ebp - 0xfc8], 0x875f
mov dword [ebp - 0x6c], 0
jmp 0x10043981
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1004399d
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xbc4]
call fcn.1002458d
mov dword [eax], 0xc93b
jmp 0x1004397a
mov dword [ebp - 0x6c], 0
jmp 0x100439ad
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x100439c3
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x9a8], 0x457a23a
jmp 0x100439a6
mov dword [ebp - 0x8c], 0
jmp 0x100439dc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x10043c7d
mov dword [ebp - 0x4e4], 0xcd49
mov dword [ebp - 0x138], 0x1874da8
mov dword [ebp - 0xfd0], 0xfffffffd
mov dword [ebp - 0x4f4], 0xd3b0
mov dword [ebp - 0x244], 0
jmp 0x10043a2a
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x10043a46
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x88c], 0x47f59ec1
jmp 0x10043a1d
cmp dword [ebp - 0x4e4], 0
je 0x10043a96
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x138], eax
jne 0x10043a75
mov dword [ebp - 0x4cc], 1
jmp 0x10043a7c
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x4cc], eax
jg 0x10043a96
mov dword [ebp - 0x8cc], 1
jmp 0x10043a9d
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x8cc]
add eax, 0x87a7
je 0x10043abf
mov eax, 0x2e77e815
test eax, eax
je 0x10043abf
mov dword [ebp - 0x4d4], 1
jmp 0x10043ac6
and dword [ebp - 0x4d4], 0
imul eax, dword [ebp - 0x4d4], 0x5ebd
test eax, eax
je 0x10043af2
cmp dword [ebp - 0x8c], 0
je 0x10043af2
cmp dword [ebp - 0x8c], 0
je 0x10043af2
mov dword [ebp - 0x6f4], 1
jmp 0x10043af9
and dword [ebp - 0x6f4], 0
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1002458d
mov ecx, dword [ebp - 0x6f4]
imul ecx, dword [eax]
mov dword [ebp - 0x4dc], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0x88c], ecx
imul eax, dword [ebp - 0x4dc], 0xcec7
test eax, eax
je 0x10043b4b
mov eax, 0xd580
test eax, eax
je 0x10043b4b
mov dword [ebp - 0x804], 1
jmp 0x10043b52
and dword [ebp - 0x804], 0
push 2
lea ecx, [ebp - 0xbc4]
call fcn.1002458d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x804]
jne 0x10043b75
mov dword [ebp - 0x6fc], 1
jmp 0x10043b7c
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x6fc], eax
jne 0x10043b96
mov dword [ebp - 0x4ec], 1
jmp 0x10043b9d
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x138], 0
jmp 0x10043bc2
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jg 0x10043c78
mov dword [ebp - 0xfd8], 0x40f213ed
mov dword [ebp - 0xfe0], 0xa0435e45
mov dword [ebp - 0xfe8], 0x6c8c
mov dword [ebp - 0xcac], 0xcf162c80
mov dword [ebp - 0xca8], 0xcf162c80
mov dword [ebp - 0xca4], 0xcf162c80
mov dword [ebp - 0xca0], 0xcf162c80
lea ecx, [ebp - 0x2e1]
call fcn.10008f5a
push eax
lea eax, [ebp - 0xc9c]
push eax
lea eax, [ebp - 0xcac]
push eax
lea ecx, [ebp - 0x10b8]
call fcn.1002459c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x109c]
call fcn.10024562
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x88c], 0x78b15b45
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
lea ecx, [ebp - 0x109c]
call fcn.10024588
jmp 0x10043bb5
jmp 0x100439cf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9a8], 0xe161e417
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc4]
call fcn.10024588
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xac], 0
jmp 0x10043cc7
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x10043ce3
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x184], 0xe3556834
jmp 0x10043cba
mov dword [ebp - 0xac], 0
jmp 0x10043cfc
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x10043d18
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x2bc], 0xdbc1c234
jmp 0x10043cef
mov dword [ebp - 0x10], 0
jmp 0x10043d28
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10043f0b
mov dword [ebp - 0x50c], 0x6d2e8588
push 3
lea ecx, [ebp - 0xbd0]
call fcn.10024520
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x294], 0
jmp 0x10043d69
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x10043d8b
push dword [ebp - 0x294]
lea ecx, [ebp - 0xbd0]
call fcn.1002458d
mov dword [eax], 0xb583dc0e
jmp 0x10043d5c
cmp dword [ebp - 0x10], 0xfffa
jb 0x10043da0
mov dword [ebp - 0x704], 1
jmp 0x10043da7
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0xbd0]
call fcn.1002458d
mov ecx, dword [ebp - 0x704]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp + eax*4 - 0x184], ecx
push 1
lea ecx, [ebp - 0xbd0]
call fcn.1002458d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4fc]
jle 0x10043e02
mov dword [ebp - 0x80c], 1
jmp 0x10043e09
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc4], eax
jg 0x10043e2c
mov dword [ebp - 0x504], 1
jmp 0x10043e33
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
add eax, 4
cmp eax, dword [ebp - 0x50c]
jge 0x10043e50
mov dword [ebp - 0x70c], 1
jmp 0x10043e57
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x70c]
mov dword [ebp - 0x904], 1
jmp 0x10043e73
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x904]
jl 0x10043e8d
mov dword [ebp - 0x514], 1
jmp 0x10043e94
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x514], eax
jge 0x10043eab
mov dword [ebp - 0x714], 1
jmp 0x10043eb2
and dword [ebp - 0x714], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x714]
mov dword [ebp + eax - 0x2bc], ecx
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x10043ef7
push 0
push 0x1496
push 0x1950
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd0]
call fcn.10024588
jmp 0x10043d21
mov dword [ebp - 0xc4], 0
jmp 0x10043f24
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x100441d9
mov dword [ebp - 0xbac], 0xefe8e60a
mov dword [ebp - 0xba8], 0xefe8e60a
mov dword [ebp - 0xba4], 0xefe8e60a
mov dword [ebp - 0xba0], 0xefe8e60a
mov dword [ebp - 0x10], 0
jmp 0x10043f69
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x100441d4
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x1d8], 0
jmp 0x10043f96
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jg 0x100441a5
mov dword [ebp - 0x16c], 0x4c7ba3f3
mov dword [ebp - 0x16c], 0
jmp 0x10043fc6
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jg 0x10044031
mov dword [ebp - 0x24c], 0x67f6a191
mov dword [ebp - 0x24c], 0
jmp 0x10043ff2
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jg 0x1004402f
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1004402d
push 0
push 0xb27
push 0x53b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x10043fe5
jmp 0x10043fb9
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2bc], 0
jne 0x10044186
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2bc]
cmp dword [ebp + eax - 0x184], ecx
jl 0x1004406a
mov dword [ebp - 0x51c], 1
jmp 0x10044071
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x51c], eax
jl 0x1004409a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbac], 0
je 0x1004409a
mov dword [ebp - 0x814], 1
jmp 0x100440a1
and dword [ebp - 0x814], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xbac]
imul eax, dword [ebp - 0x814]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x100440cf
cmp dword [ebp - 0x16c], 0
jne 0x100440cf
and dword [ebp - 0x524], 0
jmp 0x100440d9
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x184]
add eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0x16c]
jle 0x10044102
or eax, 0xffffffff
jne 0x10044102
and dword [ebp - 0x71c], 0
jmp 0x1004410c
mov dword [ebp - 0x71c], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbac]
cmp eax, dword [ebp - 0x71c]
jl 0x1004412c
mov dword [ebp - 0x52c], 1
jmp 0x10044133
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 1
jge 0x10044148
mov dword [ebp - 0x968], 1
jmp 0x1004414f
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x184]
push 4
pop ecx
imul ecx, ecx, 0
imul ecx, dword [ebp + ecx - 0xbac], 0x8c32
imul eax, ecx
test eax, eax
jne 0x10044186
and dword [ebp - 0x894], 0
jmp 0x10044190
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0x2bc], ecx
jmp 0x10043f89
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x100441cf
push 0xb0f
push 0
push 0
push 0
push 0x620
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10043f62
jmp 0x10043f17
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x254], 0xfffffff2
jmp 0x100441fc
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xfffffff8
jge 0x10044231
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1004422f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x100441ef
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1004424b
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0x9b0], 0xc3718654
push 1
lea ecx, [ebp - 0xa68]
call fcn.10024520
mov dword [ebp - 4], 0xd
push 3
lea ecx, [ebp - 0xa58]
call fcn.10024520
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x53c], 0xffffffff
mov dword [ebp - 0x9b8], 0x6718e503
mov dword [ebp - 0x94], 0
jmp 0x100442a7
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x100442c9
push dword [ebp - 0x94]
lea ecx, [ebp - 0xa68]
call fcn.1002458d
mov dword [eax], 0xd416db6
jmp 0x1004429a
mov dword [ebp - 0x94], 0
jmp 0x100442e2
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10044301
push dword [ebp - 0x94]
lea ecx, [ebp - 0xa58]
call fcn.1002458d
and dword [eax], 0
jmp 0x100442d5
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1004432c
push 0x46f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp dword [ebp - 0x9b0], 0
jne 0x10044341
mov dword [ebp - 0x34c], 1
jmp 0x10044348
and dword [ebp - 0x34c], 0
push 0
lea ecx, [ebp - 0xa68]
call fcn.1002458d
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
cmp dword [ebp - 0x34c], 0
jne 0x1004441e
push 0
lea ecx, [ebp - 0xa68]
call fcn.1002458d
cmp dword [eax], 0
jne 0x10044388
mov dword [ebp - 0x970], 1
jmp 0x1004438f
and dword [ebp - 0x970], 0
push 0
lea ecx, [ebp - 0xa58]
call fcn.1002458d
cmp dword [eax], 0
je 0x100443b6
mov eax, 0xdb97
test eax, eax
je 0x100443b6
mov dword [ebp - 0x534], 1
jmp 0x100443bd
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xfffb
je 0x100443d5
mov dword [ebp - 0x724], 1
jmp 0x100443dc
and dword [ebp - 0x724], 0
push 2
lea ecx, [ebp - 0xa58]
call fcn.1002458d
mov ecx, dword [ebp - 0x724]
add ecx, dword [eax]
mov dword [ebp - 0x53c], ecx
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x105c], eax
push 0
lea ecx, [ebp - 0xa68]
call fcn.1002458d
cmp dword [eax], 0
jne 0x1004441e
and dword [ebp - 0x81c], 0
jmp 0x10044428
mov dword [ebp - 0x81c], 1
cmp dword [ebp - 0x81c], 0xfff8
jbe 0x10044440
mov dword [ebp - 0x544], 1
jmp 0x10044447
and dword [ebp - 0x544], 0
push 1
lea ecx, [ebp - 0xa58]
call fcn.1002458d
mov ecx, dword [ebp - 0x544]
imul ecx, dword [eax]
add ecx, 0x3a79
mov dword [ebp - 0x9b8], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa58]
call fcn.10024588
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10024588
mov dword [ebp - 0x1064], 0x1066ee74
mov dword [ebp - 0x3c], 0xfffa
mov dword [ebp - 0x25c], 0x19716e28
mov dword [ebp - 0x29c], 9
mov dword [ebp - 0x36c], 0x5fef4072
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x55c], 0xde726f2c
mov dword [ebp - 0x354], 0xfff8
push 1
lea ecx, [ebp - 0xa78]
call fcn.10024520
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x31c], 0xd85d5fca
mov dword [ebp - 0x73c], 1
mov dword [ebp - 0x9c0], 0xfffffff8
mov dword [ebp - 0x57c], 0x7898a801
mov dword [ebp - 0x106c], 0xfffffffc
mov dword [ebp - 0xfe4], 1
mov dword [ebp - 0x58c], 0xffff
mov dword [ebp - 0x20], 0
jmp 0x1004453e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10044554
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x584], 1
jmp 0x10044537
mov dword [ebp - 0x20], 0
jmp 0x10044564
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10044580
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa78]
call fcn.1002458d
mov dword [eax], 0xfffc
jmp 0x1004455d
mov dword [ebp - 0x20], 0
jmp 0x10044590
cmp dword [ebp - 0x20], 2
jge 0x100445a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdbc], 1
jmp 0x10044589
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
je 0x100445ba
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret