Function at 0x1003f3e9
Capabilities:
Accept command line arguments
Get common file path
Set registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100699fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x724
push esi
push edi
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x18], 0
jmp 0x1003f42d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003f443
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3a8], 0
jmp 0x1003f426
mov dword [ebp - 0x18], 0
jmp 0x1003f453
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003f469
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
jmp 0x1003f44c
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp + ecx - 0x3a8], eax
mov dword [ebp - 0x15c], 0
jmp 0x1003f49c
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xd
jge 0x1003f8b2
mov dword [ebp - 0x4e4], 0xc8748afa
mov dword [ebp - 0x4e0], 0xc8748afa
mov dword [ebp - 0x4dc], 0xc8748afa
mov dword [ebp - 0x4d8], 0xc8748afa
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x560], 0xe780ca9f
mov dword [ebp - 0x568], 0x214a9bac
mov dword [ebp - 0x570], 0x9e95d1c5
mov dword [ebp - 0x578], 0
mov dword [ebp - 0xcc], 9
mov dword [ebp - 0xc8], 0xc4b7c700
mov dword [ebp - 0x580], 0xffffffff
push 1
lea ecx, [ebp - 0x4bc]
call fcn.10029e7b
and dword [ebp - 4], 0
mov dword [ebp - 0x464], 0xf230988a
mov dword [ebp - 0x1c], 0
jmp 0x1003f556
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003f572
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4bc]
call fcn.10029f5b
mov dword [eax], 0xfffffffe
jmp 0x1003f54f
mov dword [ebp - 0x1c], 0
jmp 0x1003f582
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003f598
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6fc], 0xefaadad2
jmp 0x1003f57b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x16c], eax
mov dword [ebp - 0xc8], 0
jmp 0x1003f5cc
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1003f89e
mov dword [ebp - 0x37c], 0x525036ff
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x598], 0x1d319d7f
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x198], 1
mov dword [ebp - 0xbc], 0
jmp 0x1003f62e
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1003f64a
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x5a4], 0x6b93dced
jmp 0x1003f621
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
sub eax, 0xeabf11f
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4e4]
je 0x1003f677
mov dword [ebp - 0x248], 1
jmp 0x1003f67e
and dword [ebp - 0x248], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10029f5b
mov ecx, dword [ebp - 0x248]
mov dword [eax], ecx
mov dword [ebp - 0xcc], 0xfffffffe
jmp 0x1003f6ac
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff3
jl 0x1003f899
mov dword [ebp - 0x178], 1
mov dword [ebp - 0x1cc], 0xb566e66b
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x400], 0x5555d5df
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1003f6f3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4e4]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
jne 0x1003f72d
mov dword [ebp - 0x380], 1
jmp 0x1003f734
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x380], eax
jge 0x1003f74e
mov dword [ebp - 0x468], 1
jmp 0x1003f755
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x400]
cmp dword [ebp - 0x37c], eax
jg 0x1003f7a1
mov dword [ebp - 0x45c], 1
jmp 0x1003f7a8
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0xd0], eax
jl 0x1003f7e6
mov dword [ebp - 0x378], 1
jmp 0x1003f7ed
and dword [ebp - 0x378], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10029f5b
mov ecx, dword [ebp - 0x378]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x178]
jne 0x1003f817
mov dword [ebp - 0x47c], 1
jmp 0x1003f81e
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp - 0x610], eax
mov eax, 0x2fc30845
add eax, 0x50e41321
cmp eax, dword [ebp - 0x1cc]
jle 0x1003f84f
mov dword [ebp - 0x2b4], 1
jmp 0x1003f856
and dword [ebp - 0x2b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6fc]
add eax, dword [ebp - 0x2b4]
cmp eax, 5
jne 0x1003f87a
mov dword [ebp - 0x1d4], 1
jmp 0x1003f881
and dword [ebp - 0x1d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp + eax - 0x3a8], ecx
jmp 0x1003f69f
jmp 0x1003f5bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.10029f30
jmp 0x1003f48f
mov dword [ebp - 0x484], 0x2501
cmp dword [ebp - 0x484], 0xeb7
jge 0x1003f9fc
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x100082dc
call fcn.1004f9f0
add esp, 0xc
movsd xmm0, qword [0x10008758]
movsd qword [ebp - 0x40c], xmm0
and dword [ebp - 0xd8], 0
and dword [ebp - 0xe0], 0
and dword [ebp - 0x13c], 0
and dword [ebp - 0x154], 0
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x100082dc
call fcn.1004f9f0
add esp, 0xc
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
je 0x1003f9c6
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0x100082dc
call fcn.1004f9f0
add esp, 0xc
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0xd8]
imul ecx, eax
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0xe0]
imul eax, edx
add ecx, eax
call fcn.1002e3d4
addsd xmm0, qword [ebp - 0x40c]
movsd qword [ebp - 0x40c], xmm0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xe0], eax
jmp 0x1003f92e
mov dword [ebp - 0x618], 0x32
cvtsi2sd xmm0, dword [ebp - 0x3f0]
mulsd xmm0, qword [ebp - 0x40c]
divsd xmm0, qword [0x10008798]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x100084e0
call fcn.1004fd81
add esp, 0xc
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x14c], 1
mov dword [ebp - 0x20], 0
jmp 0x1003fa20
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1003fa36
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3a0], 0
jmp 0x1003fa19
mov dword [ebp - 0x20], 0
jmp 0x1003fa46
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1003fa5c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x180], 0xffffffff
jmp 0x1003fa3f
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp + ecx - 0x3a0], eax
mov dword [ebp - 0x144], 0
jmp 0x1003fa8f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xd
jge 0x1003fea8
mov dword [ebp - 0x4fc], 0xc8748afa
mov dword [ebp - 0x4f8], 0xc8748afa
mov dword [ebp - 0x4f4], 0xc8748afa
mov dword [ebp - 0x4f0], 0xc8748afa
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x628], 0xe780ca9f
mov dword [ebp - 0x630], 0x214a9bac
mov dword [ebp - 0x638], 0x9e95d1c5
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0xf0], 9
mov dword [ebp - 0xe8], 0xc4b7c700
mov dword [ebp - 0x6d0], 0xffffffff
push 1
lea ecx, [ebp - 0x4b0]
call fcn.10029e7b
mov dword [ebp - 4], 1
mov dword [ebp - 0x478], 0xf230988a
mov dword [ebp - 0x24], 0
jmp 0x1003fb4c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1003fb68
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4b0]
call fcn.10029f5b
mov dword [eax], 0xfffffffe
jmp 0x1003fb45
mov dword [ebp - 0x24], 0
jmp 0x1003fb78
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003fb8e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x720], 0xefaadad2
jmp 0x1003fb71
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x180]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x180], eax
mov dword [ebp - 0xe8], 0
jmp 0x1003fbc2
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x1003fe94
mov dword [ebp - 0x2bc], 0x525036ff
mov dword [ebp - 0x6d8], 0xffffffff
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x6e8], 0x1d319d7f
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x164], 0
jmp 0x1003fc24
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x1003fc40
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x5b0], 0x6b93dced
jmp 0x1003fc17
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x180]
sub eax, 0xeabf11f
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4fc]
je 0x1003fc6d
mov dword [ebp - 0x328], 1
jmp 0x1003fc74
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0x4b0]
call fcn.10029f5b
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
mov dword [ebp - 0xf0], 0xfffffffe
jmp 0x1003fca2
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff3
jl 0x1003fe8f
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x32c], 0xb566e66b
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x450], 0x5555d5df
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1003fce9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4fc]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
jne 0x1003fd23
mov dword [ebp - 0x1dc], 1
jmp 0x1003fd2a
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x1dc], eax
jge 0x1003fd44
mov dword [ebp - 0x3d0], 1
jmp 0x1003fd4b
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b0]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x450]
cmp dword [ebp - 0x2bc], eax
jg 0x1003fd97
mov dword [ebp - 0x3dc], 1
jmp 0x1003fd9e
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x14c], eax
jl 0x1003fddc
mov dword [ebp - 0x1e4], 1
jmp 0x1003fde3
and dword [ebp - 0x1e4], 0
push 0
lea ecx, [ebp - 0x4b0]
call fcn.10029f5b
mov ecx, dword [ebp - 0x1e4]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x188]
jne 0x1003fe0d
mov dword [ebp - 0x3ec], 1
jmp 0x1003fe14
and dword [ebp - 0x3ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp - 0x62c], eax
mov eax, 0x2fc30845
add eax, 0x50e41321
cmp eax, dword [ebp - 0x32c]
jle 0x1003fe45
mov dword [ebp - 0x1ec], 1
jmp 0x1003fe4c
and dword [ebp - 0x1ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x720]
add eax, dword [ebp - 0x1ec]
cmp eax, 5
jne 0x1003fe70
mov dword [ebp - 0x2c4], 1
jmp 0x1003fe77
and dword [ebp - 0x2c4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp + eax - 0x3a0], ecx
jmp 0x1003fc95
jmp 0x1003fbb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b0]
call fcn.10029f30
jmp 0x1003fa82
mov dword [ebp - 0x4a4], 0x2481
cmp dword [ebp - 0x4a4], 0x6d7
jge 0x10040093
push 0x1200d618
push 0x1200d608
push 0x100084e8
call fcn.1004f9f0
add esp, 0xc
mov eax, dword [0x1200d608]
add eax, 1
mov ecx, dword [0x1200d60c]
adc ecx, 0
push eax
mov ecx, 0x1200d718
call fcn.1004307d
xorpd xmm0, xmm0
movlpd qword [ebp - 0x5bc], xmm0
lea eax, [ebp - 0x5bc]
push eax
mov eax, dword [0x1200d618]
add eax, 1
mov ecx, dword [0x1200d61c]
adc ecx, 0
push eax
lea ecx, [ebp - 0x714]
call fcn.1002a241
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x460], eax
mov dword [ebp - 4], 2
push dword [ebp - 0x460]
mov eax, dword [0x1200d608]
add eax, 1
mov ecx, dword [0x1200d60c]
adc ecx, 0
push eax
mov ecx, 0x1200d724
call fcn.100430e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x714]
call fcn.10029f30
xorpd xmm0, xmm0
movlpd qword [0x1200d610], xmm0
and dword [ebp - 0x170], 0
jmp 0x1003ff91
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
cdq
mov ecx, dword [0x1200d608]
sub ecx, 1
mov esi, dword [0x1200d60c]
sbb esi, 0
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], esi
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x420]
jg 0x1004006a
jl 0x1003ffe8
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x424]
jae 0x1004006a
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0x100081b0
call fcn.1004f9f0
add esp, 0xc
mov eax, dword [ebp - 0x368]
cdq
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], edx
lea eax, [ebp - 0x4c4]
push eax
push dword [ebp - 0x1f4]
mov ecx, 0x1200d718
call fcn.1002a234
mov ecx, eax
call fcn.100431b9
mov eax, dword [ebp - 0x1f4]
cdq
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4e8], edx
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp - 0x368]
mov ecx, 0x1200d718
call fcn.1002a234
mov ecx, eax
call fcn.100431b9
jmp 0x1003ff84
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 1
call fcn.1003f1e5
add esp, 0x10
push dword [0x1200d614]
push dword [0x1200d610]
push 0x10008314
call fcn.1004fd81
add esp, 0xc
movzx eax, byte [0x1200d748]
test eax, eax
je 0x100400b1
mov esi, 0x1065a650
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100423c2
push 1
lea ecx, [ebp - 0x534]
call fcn.10029e7b
mov dword [ebp - 4], 3
mov dword [ebp - 0xf8], 0
jmp 0x100400de
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x10040100
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x534]
call fcn.10029f5b
mov dword [eax], 0xffff
jmp 0x100400d1
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10040114
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
lea ecx, [ebp - 0x534]
call fcn.10029f5b
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1fc]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x534]
call fcn.10029f30
push 1
lea ecx, [ebp - 0x528]
call fcn.10029e7b
mov dword [ebp - 4], 4
mov dword [ebp - 0x134], 0
jmp 0x10040174
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x10040196
push dword [ebp - 0x134]
lea ecx, [ebp - 0x528]
call fcn.10029f5b
mov dword [eax], 0xffff
jmp 0x10040167
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x100401aa
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
lea ecx, [ebp - 0x528]
call fcn.10029f5b
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2cc]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.10029f30
mov dword [ebp - 0x574], 0x1065a650
mov dword [ebp - 0x28], 0xb77278fa
mov dword [ebp - 0x174], 0x7609fa85
mov dword [ebp - 0x100], 0
jmp 0x10040211
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1004022d
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x398], 0
jmp 0x10040204
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x398], 0
je 0x10040258
cmp dword [ebp - 0x28], 0
je 0x10040258
mov dword [ebp - 0x204], 1
jmp 0x1004025f
and dword [ebp - 0x204], 0
cmp dword [ebp - 0x204], 0x93d0b548
jae 0x10040277
mov dword [ebp - 0x334], 1
jmp 0x1004027e
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x398]
cmp eax, dword [ebp - 0x334]
je 0x1004029f
mov dword [ebp - 0x20c], 1
jmp 0x100402a6
and dword [ebp - 0x20c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x398]
cmp dword [ebp - 0x20c], eax
jg 0x100402d7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x398], 0
je 0x100402d7
mov dword [ebp - 0x2d4], 1
jmp 0x100402de
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0xffffffff
jae 0x100402f3
mov dword [ebp - 0x214], 1
jmp 0x100402fa
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x174]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x398], eax
jne 0x10040327
mov dword [ebp - 0x364], 1
jmp 0x1004032e
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0xe10e
jge 0x10040346
mov dword [ebp - 0x21c], 1
jmp 0x1004034d
and dword [ebp - 0x21c], 0
imul eax, dword [ebp - 0x21c], 0x3494
test eax, eax
je 0x10040376
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x398], 0
je 0x10040376
mov dword [ebp - 0x2dc], 1
jmp 0x1004037d
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x26c7f05f
jl 0x10040390
cmp dword [ebp - 0x174], 0
cmp dword [ebp - 0x174], 0
je 0x100403be
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x100403bc
push 0
push 0x6b3
push 0x20b6
push 0x146f
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
jmp 0x10040403
mov dword [ebp - 0x28], 0
jmp 0x100403ce
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x17
je 0x10040403
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10040401
push 0x17dc
push 0
push 0x80
push 0xea1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100403c7
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp + eax - 0x398], ecx
mov dword [ebp - 0x57c], 0x1065a654
push 1
lea ecx, [ebp - 0x1bc]
call fcn.10029e7b
mov dword [ebp - 4], 5
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x138], 0
jmp 0x1004045e
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x10040480
push dword [ebp - 0x138]
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
mov dword [eax], 0x97f6af11
jmp 0x10040451
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
and dword [eax], 0
jmp 0x100404b6
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x224]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
cmp dword [eax], 2
jge 0x1004069b
mov dword [ebp - 0x108], 0
jmp 0x100404e5
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x10040501
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x648], 0x8cd54673
jmp 0x100404d8
cmp dword [ebp - 0xa4], 9
je 0x10040516
mov dword [ebp - 0x33c], 1
jmp 0x1004051d
and dword [ebp - 0x33c], 0
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
imul ecx, dword [ebp - 0x33c], 0xfff8
cmp dword [eax], ecx
jl 0x10040544
mov dword [ebp - 0x22c], 1
jmp 0x1004054b
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
sub eax, 0x92e6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x648]
jne 0x10040571
mov dword [ebp - 0x2e4], 1
jmp 0x10040578
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0x684593f6
jne 0x1004059d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x648], 0
jne 0x1004059d
and dword [ebp - 0x234], 0
jmp 0x100405a7
mov dword [ebp - 0x234], 1
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x234]
sub eax, dword [ebp - 0xa4]
cmp eax, 0x68993dd6
jle 0x100405cd
mov dword [ebp - 0x374], 1
jmp 0x100405d4
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0xc0a9
jne 0x100405ec
mov dword [ebp - 0x23c], 1
jmp 0x100405f3
and dword [ebp - 0x23c], 0
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
mov esi, eax
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
mov esi, dword [esi]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10029f5b
mov eax, dword [eax]
imul eax, dword [ebp - 0x23c]
cmp esi, eax
jge 0x1004063a
mov dword [ebp - 0x2ec], 1
jmp 0x10040641
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x2ec], eax
jg 0x1004065b
mov dword [ebp - 0x244], 1
jmp 0x10040662
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0xffffffff
jne 0x10040677
mov dword [ebp - 0x344], 1
jmp 0x1004067e
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x24c], eax
jmp 0x10040492
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1bc]
call fcn.10029f30
mov dword [ebp - 0x30], 0xb77278fa
mov dword [ebp - 0x17c], 0x7609fa85
mov dword [ebp - 0x140], 0
jmp 0x100406d4
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x100406f0
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x38c], 0
jmp 0x100406c7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x634], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
je 0x1004071b
cmp dword [ebp - 0x30], 0
je 0x1004071b
mov dword [ebp - 0x2f4], 1
jmp 0x10040722
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0x93d0b548
jae 0x1004073a
mov dword [ebp - 0x254], 1
jmp 0x10040741
and dword [ebp - 0x254], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x38c]
cmp eax, dword [ebp - 0x254]
je 0x10040762
mov dword [ebp - 0x36c], 1
jmp 0x10040769
and dword [ebp - 0x36c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x38c]
cmp dword [ebp - 0x36c], eax
jg 0x1004079a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x38c], 0
je 0x1004079a
mov dword [ebp - 0x25c], 1
jmp 0x100407a1
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0xffffffff
jae 0x100407b6
mov dword [ebp - 0x2fc], 1
jmp 0x100407bd
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x17c]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x38c], eax
jne 0x100407ea
mov dword [ebp - 0x264], 1
jmp 0x100407f1
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0xe10e
jge 0x10040809
mov dword [ebp - 0x34c], 1
jmp 0x10040810
and dword [ebp - 0x34c], 0
imul eax, dword [ebp - 0x34c], 0x3494
test eax, eax
je 0x10040839
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x38c], 0
je 0x10040839
mov dword [ebp - 0x26c], 1
jmp 0x10040840
and dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 0x26c7f05f
jl 0x10040853
cmp dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0
je 0x10040881
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x1004087f
push 0
push 0x6b3
push 0x20b6
push 0x146f
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
jmp 0x100408c0
mov dword [ebp - 0x30], 0
jmp 0x10040891
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x17
je 0x100408c0
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x100408be
push 0x17dc
push 0
push 0x80
push 0xea1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1004088a
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp + eax - 0x38c], ecx
mov byte [0x1200d748], 1
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x35c], 0x971867b8
mov dword [ebp - 0x110], 0
jmp 0x10040904
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x10040920
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x658], 0xfffb
jmp 0x100408f7
mov dword [ebp - 0xac], 2
jmp 0x10040939
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x10040a52
push 1
lea ecx, [ebp - 0x3c0]
call fcn.10029e7b
mov dword [ebp - 4], 6
mov dword [ebp - 0x148], 0
jmp 0x10040973
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x10040995
push dword [ebp - 0x148]
lea ecx, [ebp - 0x3c0]
call fcn.10029f5b
mov dword [eax], 1
jmp 0x10040966
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10029f5b
mov dword [eax], 2
jmp 0x100409ce
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10029f5b
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x304]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10029f5b
cmp dword [eax], 0
jl 0x10040a3e
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x658]
mov dword [ebp - 0x584], eax
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10029f5b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x658], 0xc370
jle 0x10040a1b
mov dword [ebp - 0x274], 1
jmp 0x10040a22
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x10040a39
jmp 0x10040a3e
jmp 0x100409aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.10029f30
jmp 0x1004092c
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x10040a7e
push 0
push 0x1a9a
push 0x143c
push 0
push 0xef6
push 0x1636
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10029e7b
mov dword [ebp - 4], 7
mov dword [ebp - 0x3fc], 0x18c5
cmp dword [ebp - 0x3fc], 0xdf3
jge 0x10040b20
lea eax, [ebp - 0x27c]
push eax
mov ecx, 0x1065acf0
call fcn.10029710
cmp dword [ebp - 0x27c], 0
jle 0x10040adf
push fcn.1002e156
mov edx, 0x100084f4
mov ecx, 0x1065ac38
call fcn.1002e1d1
mov ecx, eax
call fcn.10029b29
jmp 0x10040b20
cmp dword [ebp - 0x27c], 0
jge 0x10040b05
push fcn.1002e156
mov edx, 0x10008500
mov ecx, 0x1065ac38
call fcn.1002e1d1
mov ecx, eax
call fcn.10029b29
jmp 0x10040b20
push fcn.1002e156
mov edx, 0x1000850c
mov ecx, 0x1065ac38
call fcn.1002e1d1
mov ecx, eax
call fcn.10029b29
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x118], 0
jmp 0x10040b4d
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x10040b6f
push dword [ebp - 0x118]
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
mov dword [eax], 0x97f6af11
jmp 0x10040b40
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
and dword [eax], 0
jmp 0x10040ba5
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
cmp dword [eax], 2
jge 0x10040d8a
mov dword [ebp - 0x150], 0
jmp 0x10040bd4
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x10040bf0
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x668], 0x8cd54673
jmp 0x10040bc7
cmp dword [ebp - 0xb4], 9
je 0x10040c05
mov dword [ebp - 0x284], 1
jmp 0x10040c0c
and dword [ebp - 0x284], 0
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
imul ecx, dword [ebp - 0x284], 0xfff8
cmp dword [eax], ecx
jl 0x10040c33
mov dword [ebp - 0x354], 1
jmp 0x10040c3a
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
sub eax, 0x92e6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x668]
jne 0x10040c60
mov dword [ebp - 0x28c], 1
jmp 0x10040c67
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0x684593f6
jne 0x10040c8c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x668], 0
jne 0x10040c8c
and dword [ebp - 0x314], 0
jmp 0x10040c96
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0xb4]
cmp eax, 0x68993dd6
jle 0x10040cbc
mov dword [ebp - 0x294], 1
jmp 0x10040cc3
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0xc0a9
jne 0x10040cdb
mov dword [ebp - 0x360], 1
jmp 0x10040ce2
and dword [ebp - 0x360], 0
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
mov esi, eax
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
mov esi, dword [esi]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x1b0]
call fcn.10029f5b
mov eax, dword [eax]
imul eax, dword [ebp - 0x360]
cmp esi, eax
jge 0x10040d29
mov dword [ebp - 0x29c], 1
jmp 0x10040d30
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x29c], eax
jg 0x10040d4a
mov dword [ebp - 0x31c], 1
jmp 0x10040d51
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0xffffffff
jne 0x10040d66
mov dword [ebp - 0x2a4], 1
jmp 0x10040d6d
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x324], eax
jmp 0x10040b81
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.10029f30
push 3
lea ecx, [ebp - 0x678]
call fcn.10029e7b
mov dword [ebp - 4], 8
mov dword [ebp - 0x120], 0
jmp 0x10040dc6
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x10040de8
push dword [ebp - 0x120]
lea ecx, [ebp - 0x678]
call fcn.10029f5b
mov dword [eax], 0xb3c692be
jmp 0x10040db9
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x10040dfc
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x10040e17
push 0
push 0x735
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x678]
call fcn.10029f30
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x1065a440
mov dword [ebp - 0x310], eax
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x1c8], 0x971867b8
mov dword [ebp - 0x158], 0
jmp 0x10040e67
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x10040e83
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x688], 0xfffb
jmp 0x10040e5a
mov dword [ebp - 0xa8], 2
jmp 0x10040e9c
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10040fb5
push 1
lea ecx, [ebp - 0x3b4]
call fcn.10029e7b
mov dword [ebp - 4], 9
mov dword [ebp - 0x128], 0
jmp 0x10040ed6
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x10040ef8
push dword [ebp - 0x128]
lea ecx, [ebp - 0x3b4]
call fcn.10029f5b
mov dword [eax], 1
jmp 0x10040ec9
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10029f5b
mov dword [eax], 2
jmp 0x10040f31
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10029f5b
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10029f5b
cmp dword [eax], 0
jl 0x10040fa1
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x688]
mov dword [ebp - 0x6d4], eax
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10029f5b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x688], 0xc370
jle 0x10040f7e
mov dword [ebp - 0x1c4], 1
jmp 0x10040f85
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
je 0x10040f9c
jmp 0x10040fa1
jmp 0x10040f0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10029f30
jmp 0x10040e8f
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x10040fe1
push 0
push 0x1a9a
push 0x143c
push 0
push 0xef6
push 0x1636
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0xc0], 0xfff7
mov dword [ebp - 0x428], 0xfffffffc
mov dword [ebp - 0x41c], 0xfe9f4864
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x44], 0xffffffea
jmp 0x10041020
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1004137f
mov dword [ebp - 0x88], 0xaa9ac70c
mov dword [ebp - 0x51c], 0x3b6f
mov dword [ebp - 0x518], 0x3b6f
mov dword [ebp - 0x514], 0x3b6f
mov dword [ebp - 0x510], 0x3b6f
mov dword [ebp - 0x1e8], 0x70e7ad53
mov dword [ebp - 0x88], 0
jmp 0x1004107f
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffea
jl 0x1004137a
mov dword [ebp - 0x130], 0xfffffffa
mov dword [ebp - 0xa0], 0xfffffff8
cmp dword [ebp - 0x130], 0
je 0x100410be
cmp dword [ebp - 0x88], 0
je 0x100410be
mov dword [ebp - 0x480], 1
jmp 0x100410c5
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xc0], eax
je 0x100410e8
mov dword [ebp - 0x1d0], 1
jmp 0x100410ef
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0
je 0x10041104
mov dword [ebp - 0x404], 1
jmp 0x1004110b
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x558], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x51c], 0xfffffffb
ja 0x10041133
mov dword [ebp - 0x3c4], 1
jmp 0x1004113a
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x594], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x51c], 0x1fc65786
jne 0x10041165
mov dword [ebp - 0x1d8], 1
jmp 0x1004116c
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0xc0], 0
je 0x10041239
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x160], 0
jmp 0x100411bb
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x100411d7
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x59c], 0
jmp 0x100411ae
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xfffffffa
jmp 0x100411ee
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x29
jge 0x10041234
mov dword [ebp - 0x64c], 0xdf39281c
mov dword [ebp - 0x5a8], 0x314b8123
mov dword [ebp - 0x6e4], 0xfffffffe
mov dword [ebp - 0x5b4], 0x9b95520
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa0], eax
jmp 0x100411e7
jmp 0x10041375
mov dword [ebp - 0x168], 0xb7bfbc35
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x410]
jne 0x100412c8
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jbe 0x1004127e
mov dword [ebp - 0x1f0], 1
jmp 0x10041285
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0
jne 0x100412a0
cmp dword [ebp - 0xa0], 0
jne 0x100412a0
and dword [ebp - 0x438], 0
jmp 0x100412aa
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x168], 0
jne 0x100412c8
and dword [ebp - 0x1f8], 0
jmp 0x100412d2
mov dword [ebp - 0x1f8], 1
cmp dword [ebp - 0x1f8], 0
jbe 0x100412e7
mov dword [ebp - 0x43c], 1
jmp 0x100412ee
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x168], 0
je 0x10041318
cmp dword [ebp - 0xc0], 0
je 0x10041318
mov dword [ebp - 0x200], 1
jmp 0x1004131f
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 0xffffffff
jge 0x10041334
mov dword [ebp - 0x208], 1
jmp 0x1004133b
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x208], eax
jne 0x10041352
mov dword [ebp - 0x210], 1
jmp 0x10041359
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0xa0], eax
jmp 0x10041072
jmp 0x10041019
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x1065a440
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xc4], 0
jmp 0x100413ba
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x100413d6
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x554], 0x2abac89d
jmp 0x100413ad
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x10041419
mov dword [ebp - 0x14], 3
jmp 0x100413f3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x34
jle 0x10041414
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10041412
push 0
push 0x25f8
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100413ec
jmp 0x1004163f
mov dword [ebp - 0xb0], 0x8d0d3f7b
mov dword [ebp - 0x184], 0xc774
mov dword [ebp - 0x4c], 0xe9973063
cmp dword [ebp - 0xb0], 0
jne 0x10041503
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x14], eax
jne 0x10041458
mov dword [ebp - 0x218], 1
jmp 0x1004145f
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x218]
jge 0x10041485
mov dword [ebp - 0x220], 1
jmp 0x1004148c
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x94], eax
xor eax, eax
sub eax, 0x167c28ca
mov ecx, dword [ebp - 0x220]
sub ecx, eax
jne 0x100414b8
cmp dword [ebp - 0x14], 0
jne 0x100414b8
and dword [ebp - 0x228], 0
jmp 0x100414c2
mov dword [ebp - 0x228], 1
cmp dword [ebp - 0x228], 1
jg 0x100414e0
mov eax, 0xffff
test eax, eax
je 0x100414e0
mov dword [ebp - 0x230], 1
jmp 0x100414e7
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
add eax, 0x79ae
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x10041503
and dword [ebp - 0x238], 0
jmp 0x1004150d
mov dword [ebp - 0x238], 1
cmp dword [ebp - 0x238], 0x72c02a3
jne 0x10041525
mov dword [ebp - 0x240], 1
jmp 0x1004152c
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x240], eax
jne 0x10041543
mov dword [ebp - 0x1c0], 1
jmp 0x1004154a
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0
jmp 0x10041563
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1004163f
mov dword [ebp - 0x94], 3
jmp 0x10041586
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10041630
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x554]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x250], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x250]
mov dword [ebp + eax - 0x554], ecx
cmp dword [ebp - 0x250], 0
je 0x100415e1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x554], 0
je 0x100415e1
mov dword [ebp - 0x258], 1
jmp 0x100415e8
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
neg eax
je 0x10041606
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x10041604
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x1004162b
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x10041618
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x554], ecx
jmp 0x10041579
mov dword [ebp - 0xb0], 0
jmp 0x1004155c
mov eax, dword [ebp - 0x310]
mov dword [0x1065a650], eax
push 3
lea ecx, [ebp - 0x698]
call fcn.10029e7b
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xd4], 0
jmp 0x10041677
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x10041699
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x698]
call fcn.10029f5b
mov dword [eax], 0xb3c692be
jmp 0x1004166a
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x100416ad
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x444], 0x25bc
cmp dword [ebp - 0x444], 0x108b
jge 0x100418b1
mov dword [ebp - 0x6c4], 0xb3
lea eax, [ebp - 0x18c]
push eax
push 0x10008114
call fcn.1004f9f0
pop ecx
pop ecx
mov byte [ebp - 0x45], 0
lea eax, [ebp - 0x45]
push eax
push 0xb3
lea ecx, [ebp - 0x5d4]
call fcn.1002a133
mov byte [ebp - 4], 0xb
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x4a0]
call fcn.10029e7b
mov byte [ebp - 4], 0xc
and dword [ebp - 0xdc], 0
jmp 0x1004172b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x18c]
jge 0x10041759
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x4a0]
call fcn.10029f5b
push eax
push 0x10008114
call fcn.1004f9f0
pop ecx
pop ecx
jmp 0x1004171e
lea ecx, [ebp - 0x494]
call fcn.10029e6e
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x9c], eax
jmp 0x10041784
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10041816
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4a0]
call fcn.10029f5b
push dword [eax]
lea eax, [ebp - 0x728]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1002a1b4
mov ecx, eax
call fcn.1002a1f8
movzx eax, al
test eax, eax
je 0x100417c6
jmp 0x10041777
push 1
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4a0]
call fcn.10029f5b
push dword [eax]
lea eax, [ebp - 0x730]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.1002a1b4
mov ecx, eax
call fcn.1002a1d3
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4a0]
call fcn.10029f5b
push eax
lea ecx, [ebp - 0x494]
call fcn.10029faa
jmp 0x10041777
lea ecx, [ebp - 0x494]
call fcn.10029f52
push eax
push 0x10008130
call fcn.1004fd81
pop ecx
pop ecx
lea ecx, [ebp - 0x494]
call fcn.10029f52
dec eax
mov dword [ebp - 0xe4], eax
jmp 0x1004184f
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x10041879
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x494]
call fcn.10029f5b
push dword [eax]
push 0x100081a0
call fcn.1004fd81
pop ecx
pop ecx
jmp 0x10041842
push 0x1000807d
call fcn.100500e1
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x494]
call fcn.10029f30
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4a0]
call fcn.10029f30
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5d4]
call fcn.1002a194
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x100418cc
push 0
push 0x735
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x698]
call fcn.10029f30
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x100418fe
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x18
jge 0x1004192b
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10041929
push 0
push 0
push 0x80f
push 0x1a6a
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x100418f1
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10041944
push 0x8e6
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x19c]
mov dword [0x1065a654], eax
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x44c], 0x924b5411
mov dword [ebp - 0x280], 0xfffe
mov dword [ebp - 0x50c], 0xb5e49576
mov dword [ebp - 0x508], 0xb5e49576
mov dword [ebp - 0x504], 0xb5e49576
mov dword [ebp - 0x500], 0xb5e49576
mov dword [ebp - 0x194], 0xd485
mov dword [ebp - 0xf4], 0
jmp 0x100419bc
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x100419d8
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x430], 0xa117
jmp 0x100419af
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x5c], eax
jne 0x100419f2
mov dword [ebp - 0x434], 1
jmp 0x100419f9
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 0x5c], 0x5b05
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x2c]
cmp eax, 0x40874b28
jge 0x10041a22
mov dword [ebp - 0x260], 1
jmp 0x10041a29
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
sub eax, dword [ebp - 0x2c]
cmp eax, 0xab227d37
jbe 0x10041a4e
cmp dword [ebp - 0x44c], 0
je 0x10041a4e
mov dword [ebp - 0x268], 1
jmp 0x10041a55
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x268], eax
je 0x10041a6f
mov dword [ebp - 0x270], 1
jmp 0x10041a76
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 1
jne 0x10041a8b
mov dword [ebp - 0x278], 1
jmp 0x10041a92
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x278]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x50c], eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x2c], eax
jne 0x10041b49
mov dword [ebp - 0x66c], 0xec58f553
mov dword [ebp - 0x5e4], 6
push 1
lea ecx, [ebp - 0x6a8]
call fcn.10029e7b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xfc], 0
jmp 0x10041af8
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x10041b1a
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x6a8]
call fcn.10029f5b
mov dword [eax], 0xfffffff6
jmp 0x10041aeb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x430]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x430], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a8]
call fcn.10029f30
jmp 0x10041d0e
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x288], 0x2039ce85
mov dword [ebp - 0x104], 0
jmp 0x10041b73
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x10041b8f
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x708], 0x7df39f3c
jmp 0x10041b66
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10041ba5
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x5ec], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x50c], 0xfffffffb
mov eax, dword [ebp - 0x2c]
sub eax, 5
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x430]
sub ecx, eax
imul ecx, dword [ebp - 0x54]
mov dword [ebp - 0x288], ecx
mov eax, dword [ebp - 0x288]
sub eax, dword [ebp - 0x5c]
jne 0x10041c0d
mov eax, 0xfffc
test eax, eax
jne 0x10041c0d
cmp dword [ebp - 0x54], 0
jne 0x10041c0d
and dword [ebp - 0x290], 0
jmp 0x10041c17
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x290], eax
jne 0x10041c2e
mov dword [ebp - 0x454], 1
jmp 0x10041c35
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x54]
neg eax
cmp eax, 0x3f2a
jge 0x10041c56
mov dword [ebp - 0x298], 1
jmp 0x10041c5d
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x298], eax
jg 0x10041c74
mov dword [ebp - 0x2a8], 1
jmp 0x10041c7b
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2a0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax - 0x708], ecx
mov eax, dword [ebp - 0x2a0]
neg eax
cmp eax, dword [ebp - 0x2a8]
jg 0x10041cb2
mov dword [ebp - 0x2b0], 1
jmp 0x10041cb9
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xffffffff
jge 0x10041cd7
cmp dword [ebp - 0x194], 0
je 0x10041cd7
mov dword [ebp - 0x2b8], 1
jmp 0x10041cde
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x2b8], eax
jge 0x10041cfb
cmp dword [ebp - 0x194], 0
jne 0x10041cfb
and dword [ebp - 0x2c0], 0
jmp 0x10041d05
mov dword [ebp - 0x2c0], 1
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10041d27
push 0x1905
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x6c], 0xfffffff7
mov dword [ebp - 0x124], 0xfff7
mov dword [ebp - 0x3e0], 0xfffffffc
mov dword [ebp - 0x3c8], 0xfe9f4864
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x6c], 0xffffffea
jmp 0x10041d66
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x100420c5
mov dword [ebp - 0x90], 0xaa9ac70c
mov dword [ebp - 0x4d4], 0x3b6f
mov dword [ebp - 0x4d0], 0x3b6f
mov dword [ebp - 0x4cc], 0x3b6f
mov dword [ebp - 0x4c8], 0x3b6f
mov dword [ebp - 0x2e0], 0x70e7ad53
mov dword [ebp - 0x90], 0
jmp 0x10041dc5
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffea
jl 0x100420c0
mov dword [ebp - 0x114], 0xfffffffa
mov dword [ebp - 0x98], 0xfffffff8
cmp dword [ebp - 0x114], 0
je 0x10041e04
cmp dword [ebp - 0x90], 0
je 0x10041e04
mov dword [ebp - 0x440], 1
jmp 0x10041e0b
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x124], eax
je 0x10041e2e
mov dword [ebp - 0x2c8], 1
jmp 0x10041e35
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x10041e4a
mov dword [ebp - 0x470], 1
jmp 0x10041e51
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x6cc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4d4], 0xfffffffb
ja 0x10041e79
mov dword [ebp - 0x448], 1
jmp 0x10041e80
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x5fc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4d4], 0x1fc65786
jne 0x10041eab
mov dword [ebp - 0x2d0], 1
jmp 0x10041eb2
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x124], 0
je 0x10041f7f
mov dword [ebp - 0x64], 3
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x10c], 0
jmp 0x10041f01
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10041f1d
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x604], 0
jmp 0x10041ef4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x64], 0xfffffffa
jmp 0x10041f34
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x29
jge 0x10041f7a
mov dword [ebp - 0x6ec], 0xdf39281c
mov dword [ebp - 0x60c], 0x314b8123
mov dword [ebp - 0x69c], 0xfffffffe
mov dword [ebp - 0x614], 0x9b95520
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], eax
jmp 0x10041f2d
jmp 0x100420bb
mov dword [ebp - 0x11c], 0xb7bfbc35
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x488]
jne 0x1004200e
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jbe 0x10041fc4
mov dword [ebp - 0x2e8], 1
jmp 0x10041fcb
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0
jne 0x10041fe6
cmp dword [ebp - 0x98], 0
jne 0x10041fe6
and dword [ebp - 0x3cc], 0
jmp 0x10041ff0
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x11c], 0
jne 0x1004200e
and dword [ebp - 0x2f0], 0
jmp 0x10042018
mov dword [ebp - 0x2f0], 1
cmp dword [ebp - 0x2f0], 0
jbe 0x1004202d
mov dword [ebp - 0x3d8], 1
jmp 0x10042034
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x11c], 0
je 0x1004205e
cmp dword [ebp - 0x124], 0
je 0x1004205e
mov dword [ebp - 0x2f8], 1
jmp 0x10042065
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0xffffffff
jge 0x1004207a
mov dword [ebp - 0x300], 1
jmp 0x10042081
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x300], eax
jne 0x10042098
mov dword [ebp - 0x308], 1
jmp 0x1004209f
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x6c]
mov dword [ebp - 0x98], eax
jmp 0x10041db8
jmp 0x10041d5f
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x310]
mov ecx, dword [eax + ecx]
call fcn.1003f1a4
mov dword [ebp - 0x3e8], eax
push dword [ebp - 0x19c]
mov edx, 0x1065a3ec
mov ecx, dword [ebp - 0x3e8]
call fcn.1003f1b0
pop ecx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x12c], 0
jmp 0x1004212f
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 4
jge 0x1004214b
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x544], 0x2abac89d
jmp 0x10042122
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x1004218e
mov dword [ebp - 0x10], 3
jmp 0x10042168
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x34
jle 0x10042189
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10042187
push 0
push 0x25f8
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10042161
jmp 0x100423b4
mov dword [ebp - 0xb8], 0x8d0d3f7b
mov dword [ebp - 0x1a4], 0xc774
mov dword [ebp - 0x74], 0xe9973063
cmp dword [ebp - 0xb8], 0
jne 0x10042278
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x10], eax
jne 0x100421cd
mov dword [ebp - 0x318], 1
jmp 0x100421d4
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x318]
jge 0x100421fa
mov dword [ebp - 0x320], 1
jmp 0x10042201
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x8c], eax
xor eax, eax
sub eax, 0x167c28ca
mov ecx, dword [ebp - 0x320]
sub ecx, eax
jne 0x1004222d
cmp dword [ebp - 0x10], 0
jne 0x1004222d
and dword [ebp - 0x330], 0
jmp 0x10042237
mov dword [ebp - 0x330], 1
cmp dword [ebp - 0x330], 1
jg 0x10042255
mov eax, 0xffff
test eax, eax
je 0x10042255
mov dword [ebp - 0x338], 1
jmp 0x1004225c
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
add eax, 0x79ae
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10042278
and dword [ebp - 0x340], 0
jmp 0x10042282
mov dword [ebp - 0x340], 1
cmp dword [ebp - 0x340], 0x72c02a3
jne 0x1004229a
mov dword [ebp - 0x348], 1
jmp 0x100422a1
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x348], eax
jne 0x100422b8
mov dword [ebp - 0x350], 1
jmp 0x100422bf
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x74], 0
jmp 0x100422d8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x100423b4
mov dword [ebp - 0x8c], 3
jmp 0x100422fb
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x100423a5
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x544]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x358], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x544], ecx
cmp dword [ebp - 0x358], 0
je 0x10042356
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x544], 0
je 0x10042356
mov dword [ebp - 0x370], 1
jmp 0x1004235d
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
neg eax
je 0x1004237b
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x10042379
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x100423a0
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x1004238d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x544], ecx
jmp 0x100422ee
mov dword [ebp - 0xb8], 0
jmp 0x100422d1
mov esi, 0x1065a650
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret