Function at 0x1003dcfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ff79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x638
push esi
and dword [ebp - 0x214], 0
mov dword [ebp - 0x3e0], 0x2c70bb74
mov dword [ebp - 0x94], 0
jmp 0x1003dd46
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1003dd62
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x4e0], 0xc75286e8
jmp 0x1003dd39
mov byte [ebp - 0x52], 0
push 0
lea eax, [ebp - 0x52]
push eax
push 0x7366
call fcn.10040d28
add esp, 0xc
cmp dword [ebp - 0x3e0], 0
jne 0x1003dd8e
mov dword [ebp - 0x2dc], 1
jmp 0x1003dd95
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x4e0], ecx
mov dword [ebp - 0x7c], 0xbc6e5c7a
mov dword [ebp - 0xe0], 0
jmp 0x1003ddc8
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1003dde4
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x3a8], 0x136951ad
jmp 0x1003ddbb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp - 0x4e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0xfffffffb
jbe 0x1003de13
mov dword [ebp - 0x3bc], 1
jmp 0x1003de1a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x7c], 0
jmp 0x1003de33
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x24
jle 0x1003de60
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x1003de5e
push 0x2988
push 0
push 0x715a
push 0x234b
call fcn.10041307
add esp, 0x10
jmp 0x1003de2c
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x348], 0x97412df3
mov dword [ebp - 0x15c], 7
mov dword [ebp - 0x18c], 0xfffffffb
mov dword [ebp - 0xe8], 0x89fff12f
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x180], 0xe6a0122d
mov dword [ebp - 0xa0], 0
jmp 0x1003debc
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1003ded8
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x5a0], 0
jmp 0x1003deaf
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x15c]
push eax
push 0
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.10040ef7
add esp, 0x18
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x18c], eax
je 0x1003df1c
mov dword [ebp - 0x45c], 1
jmp 0x1003df23
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
sub eax, 0xc116e074
mov dword [ebp - 0x3d0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x5a0], ecx
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x3d0], eax
jg 0x1003df70
mov dword [ebp - 0x2f4], 1
jmp 0x1003df77
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x5c]
jne 0x1003df89
cmp dword [ebp - 0x184], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x5a0], 0xfd77
jne 0x1003dfa8
mov dword [ebp - 0x1c0], 1
jmp 0x1003dfaf
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1c0], eax
jge 0x1003dfc9
mov dword [ebp - 0x340], 1
jmp 0x1003dfd0
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x340]
jl 0x1003dfe7
mov dword [ebp - 0x1c8], 1
jmp 0x1003dfee
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x1c8]
test eax, eax
jle 0x1003e00b
mov dword [ebp - 0x464], 1
jmp 0x1003e012
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0xe8], eax
je 0x1003e056
mov dword [ebp - 0x1d0], 1
jmp 0x1003e05d
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0x14c], 0x14
mov byte [ebp - 0x14b], 0x33
mov byte [ebp - 0x14a], 7
mov byte [ebp - 0x149], 0x1d
mov byte [ebp - 0x148], 0xe
mov byte [ebp - 0x147], 7
mov byte [ebp - 0x146], 0x15
mov byte [ebp - 0x145], 0x19
mov byte [ebp - 0x144], 0x16
mov byte [ebp - 0x143], 1
mov byte [ebp - 0x142], 0xb
mov byte [ebp - 0x141], 0x1b
mov byte [ebp - 0x140], 0xf
mov byte [ebp - 0x13f], 0x1c
mov byte [ebp - 0x13e], 1
mov byte [ebp - 0x13d], 0x12
mov byte [ebp - 0x13c], 9
mov byte [ebp - 0x13b], 8
mov byte [ebp - 0x13a], 2
mov byte [ebp - 0x139], 9
mov byte [ebp - 0x138], 4
mov byte [ebp - 0x137], 6
mov byte [ebp - 0x136], 0xa
mov byte [ebp - 0x135], 0xe
mov byte [ebp - 0x134], 5
mov byte [ebp - 0x133], 0xd
mov byte [ebp - 0x132], 0x11
mov byte [ebp - 0x131], 0x14
mov byte [ebp - 0x130], 6
mov byte [ebp - 0x12f], 0x15
mov byte [ebp - 0x12e], 8
mov byte [ebp - 0x12d], 0xe
mov byte [ebp - 0x12c], 0
mov byte [ebp - 0x12b], 8
mov byte [ebp - 0x12a], 0xd
mov byte [ebp - 0x129], 0xf
mov byte [ebp - 0x128], 0xc
mov byte [ebp - 0x127], 3
mov byte [ebp - 0x126], 0x12
mov byte [ebp - 0x125], 0x1e
mov byte [ebp - 0x124], 0x18
mov byte [ebp - 0x123], 0xa
mov byte [ebp - 0x122], 0x27
mov byte [ebp - 0x121], 0xf1
mov byte [ebp - 0x120], 0x14
mov byte [ebp - 0x11f], 0xa4
mov byte [ebp - 0x11e], 0x98
mov byte [ebp - 0x11d], 0xe4
mov byte [ebp - 0x11c], pe_nt_image_headers32
mov byte [ebp - 0x11b], 0x7b
mov byte [ebp - 0x11a], 0x99
mov byte [ebp - 0x119], 0x6e
mov byte [ebp - 0x118], 0xdc
mov byte [ebp - 0x117], 0x95
mov byte [ebp - 0x116], 0x50
mov byte [ebp - 0x115], 0x58
mov byte [ebp - 0x114], 0x9b
mov byte [ebp - 0x113], 0x7f
mov byte [ebp - 0x112], 0x52
mov byte [ebp - 0x111], 0xf3
mov byte [ebp - 0x110], 0xbb
mov byte [ebp - 0x10f], 0xc3
mov byte [ebp - 0x10e], 0xa5
mov byte [ebp - 0x10d], 0x88
mov byte [ebp - 0x10c], 0x1d
mov byte [ebp - 0x10b], 0xdf
mov byte [ebp - 0x10a], 0xa8
mov byte [ebp - 0x109], 0x28
mov byte [ebp - 0x108], 0x3e
mov byte [ebp - 0x107], 0xfb
mov byte [ebp - 0x106], 0xc4
mov byte [ebp - 0x105], 0x2a
mov byte [ebp - 0x104], 0xa4
mov byte [ebp - 0x103], 0xb0
mov byte [ebp - 0x102], 0x73
mov byte [ebp - 0x101], 0xac
mov byte [ebp - 0x100], 0x99
mov byte [ebp - 0xff], 0x6b
mov byte [ebp - 0xfe], 0xd0
mov byte [ebp - 0xfd], 0xe7
mov byte [ebp - 0xfc], 0x8c
mov byte [ebp - 0xfb], 0x51
mov byte [ebp - 0xfa], 0x13
mov byte [ebp - 0xf9], 0xd
mov byte [ebp - 0xf8], 0x19
mov byte [ebp - 0xf7], 0xe
mov byte [ebp - 0xf6], 0x17
mov byte [ebp - 0xf5], 2
mov byte [ebp - 0xf4], 3
mov byte [ebp - 0xf3], 0x1c
mov byte [ebp - 0xf2], 0x10
mov byte [ebp - 0xf1], 0x15
mov dword [ebp - 0x20], 0xe17c
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x378], 0x4fc37f20
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x3e8], 5
mov dword [ebp - 0x424], 0x19b20e95
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x550], eax
mov eax, 0x9986
sub eax, dword [ebp - 0x20]
add eax, 0xbdeb
je 0x1003e356
cmp dword [ebp - 0x20], 0
je 0x1003e356
mov dword [ebp - 0x350], 1
jmp 0x1003e35d
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x350]
cmp eax, 0xa22e
jg 0x1003e37a
mov dword [ebp - 0x1d8], 1
jmp 0x1003e381
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1d8]
add eax, 0xfff8
imul eax, eax, 0x2cc9
cmp eax, dword [ebp - 0x20]
jl 0x1003e3a3
mov dword [ebp - 0x358], 1
jmp 0x1003e3aa
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0xc5764361
jb 0x1003e3c2
mov dword [ebp - 0x46c], 1
jmp 0x1003e3c9
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x20], 0xc3a0
jg 0x1003e3e7
mov dword [ebp - 0x1e0], 1
jmp 0x1003e3ee
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0xadfb1af9
jb 0x1003e409
cmp dword [ebp - 0x20], 0
jne 0x1003e409
and dword [ebp - 0x360], 0
jmp 0x1003e413
mov dword [ebp - 0x360], 1
cmp dword [ebp - 0x360], 1
jne 0x1003e428
mov dword [ebp - 0x1e8], 1
jmp 0x1003e42f
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1003e49e
mov dword [ebp - 0x368], 0x6a5b5cf0
mov dword [ebp - 0xa8], 0
jmp 0x1003e461
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1003e47d
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x4ec], 0x2079
jmp 0x1003e454
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4ec]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x2c], eax
jmp 0x1003e776
mov dword [ebp - 0x48c], 0x6cdee94c
mov dword [ebp - 0x488], 0x6cdee94c
mov dword [ebp - 0x484], 0x6cdee94c
mov dword [ebp - 0x480], 0x6cdee94c
mov dword [ebp - 0x3f0], 0xa9b924e1
mov dword [ebp - 0xf0], 0
jmp 0x1003e4e9
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1003e505
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x5ac], 0x5f053d0c
jmp 0x1003e4dc
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x1003e527
push 0
push 0
push 0x1d28
push 0x1095
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x2c], 0xffffffec
jmp 0x1003e537
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffa
jg 0x1003e776
mov dword [ebp - 0x1f8], 0x4b6d700d
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xdc], 0
jmp 0x1003e56b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x1003e587
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x448], 0xfffffffb
jmp 0x1003e55e
mov dword [ebp - 0x20], 0xc
jmp 0x1003e597
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff2
jle 0x1003e6d0
mov dword [ebp - 0x74], 0x6e3268dd
mov dword [ebp - 0x74], 0
jmp 0x1003e5b8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x1003e5da
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x1003e5d8
push 0x393f
push 0
call fcn.10040c01
pop ecx
pop ecx
jmp 0x1003e5b1
cmp dword [ebp - 0x74], 0
jne 0x1003e699
imul eax, dword [ebp - 0x2c], 0xb82
sub eax, 4
cmp eax, 1
jge 0x1003e5ff
mov dword [ebp - 0x1f0], 1
jmp 0x1003e606
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0xffffffff
jle 0x1003e621
mov eax, 0x3adcfec7
test eax, eax
jne 0x1003e621
and dword [ebp - 0x370], 0
jmp 0x1003e62b
mov dword [ebp - 0x370], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
cmp eax, dword [ebp - 0x370]
jle 0x1003e64c
mov dword [ebp - 0x474], 1
jmp 0x1003e653
and dword [ebp - 0x474], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x448]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x1003e699
cmp dword [ebp - 0x64], 0
jne 0x1003e699
and dword [ebp - 0x200], 0
jmp 0x1003e6a3
mov dword [ebp - 0x200], 1
cmp dword [ebp - 0x200], 0xfffffffb
jne 0x1003e6b8
mov dword [ebp - 0x380], 1
jmp 0x1003e6bf
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x208], eax
jmp 0x1003e590
cmp dword [ebp - 0x3e8], 0
je 0x1003e6ee
cmp dword [ebp - 0x424], 0
je 0x1003e6ee
mov dword [ebp - 0x444], 1
jmp 0x1003e6f5
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x208], 0xffff
ja 0x1003e716
mov dword [ebp - 0x388], 1
jmp 0x1003e71d
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0x64]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x48c]
jle 0x1003e741
mov dword [ebp - 0x168], 1
jmp 0x1003e748
and dword [ebp - 0x168], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp + eax - 0x5ac], ecx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x168]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3f0], eax
jmp 0x1003e530
push 0xfef
push 0
call fcn.1004092e
pop ecx
pop ecx
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x14c]
or eax, 0x46
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x14c]
and ecx, 0x46
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x14c]
mov byte [ebp + ecx - 0x4b8], al
mov dword [ebp - 0x18], 2
and dword [ebp - 0x78], 0
jmp 0x1003e7d2
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5c
jae 0x1003f54f
mov dword [ebp - 0xd4], 3
mov dword [ebp - 0x440], 0x105a
mov dword [ebp - 0x234], 0xbda73a15
mov dword [ebp - 0xb4], 0
jmp 0x1003e813
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1003e82f
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xbc], 1
jmp 0x1003e806
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x1003e849
push 0x52ca
push 0
call fcn.1003dcb6
pop ecx
pop ecx
mov dword [ebp - 0xd4], 0
jmp 0x1003e862
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xfffffffd
jg 0x1003eab9
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x210], 0x4aee
mov dword [ebp - 0x30], 0
jmp 0x1003e893
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1003e8a9
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x600], 0
jmp 0x1003e88c
mov dword [ebp - 0x30], 0
jmp 0x1003e8b9
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1003e8cf
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x49c], 0xffffffff
jmp 0x1003e8b2
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x190]
dec ecx
mov dword [ebp - 0x190], ecx
test eax, eax
je 0x1003e9b0
mov eax, 0x246c
test eax, eax
je 0x1003e916
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1003e916
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
je 0x1003e916
mov dword [ebp - 0x390], 1
jmp 0x1003e91d
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x440], eax
jne 0x1003e947
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x49c], 0
je 0x1003e947
mov dword [ebp - 0x3f8], 1
jmp 0x1003e94e
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x570], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xbc]
add ecx, dword [ebp - 0x390]
cmp dword [ebp + eax - 0x49c], ecx
je 0x1003e988
mov dword [ebp - 0x218], 1
jmp 0x1003e98f
and dword [ebp - 0x218], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x600]
cmp dword [ebp - 0x218], eax
je 0x1003e9b0
mov dword [ebp - 0x398], 1
jmp 0x1003e9b7
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0x1d77f172
je 0x1003e9cf
mov dword [ebp - 0x3a0], 1
jmp 0x1003e9d6
and dword [ebp - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp + eax - 0xbc], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x49c], 0
je 0x1003ea6c
cmp dword [ebp - 0x234], 0
jl 0x1003ea0e
mov dword [ebp - 0x224], 1
jmp 0x1003ea15
and dword [ebp - 0x224], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x49c], 1
ja 0x1003ea31
mov dword [ebp - 0x394], 1
jmp 0x1003ea38
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x394]
jl 0x1003ea52
mov dword [ebp - 0x170], 1
jmp 0x1003ea59
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x170]
mov dword [ebp + eax - 0xbc], ecx
mov eax, 0x71d0
imul eax, eax, 0
cmp eax, 6
jae 0x1003ea85
mov dword [ebp - 0x22c], 1
jmp 0x1003ea8c
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
jne 0x1003eaa1
mov dword [ebp - 0x2fc], 1
jmp 0x1003eaa8
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x234], eax
jmp 0x1003e855
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x14c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x1003ec09
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x14c]
inc eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x8c], 0xf6af1124
mov dword [ebp - 0x8c], 0
jmp 0x1003eb06
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffffa
je 0x1003ebc3
mov dword [ebp - 0xc4], 0xd3f46721
mov dword [ebp - 0xd8], 0
jmp 0x1003eb36
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1003eb52
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x5b8], 0xfa75c19c
jmp 0x1003eb29
mov dword [ebp - 0xc4], 2
jmp 0x1003eb6b
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1003ebad
mov dword [ebp - 0x6c], 0xfffffffd
mov dword [ebp - 0x6c], 2
jmp 0x1003eb8b
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x1003ebab
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x5b8], ecx
cmp dword [ebp - 0x6c], 0
je 0x1003eba9
jmp 0x1003ebab
jmp 0x1003eb84
jmp 0x1003eb5e
mov byte [ebp - 0x50], 0
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.10040c6f
pop ecx
pop ecx
jmp 0x1003eaf9
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x14c]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x55c], 2
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x1003ebf6
push 0
call fcn.1003dc8e
pop ecx
push 0
push 0x7ca1
call fcn.100408aa
pop ecx
pop ecx
jmp 0x1003e7ca
mov dword [ebp - 0x28], 0x1f94964a
mov dword [ebp - 0x24], 0x7921
mov dword [ebp - 0xcc], 0x509b955
mov dword [ebp - 0x14], 0x99e1f953
mov dword [ebp - 0x60], 0xa9d707d8
mov dword [ebp - 0x454], 1
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x1003ec5c
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 4
jge 0x1003ec78
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x1a4], 0x54668dac
jmp 0x1003ec4f
mov eax, dword [ebp - 0x24]
dec eax
sub eax, dword [ebp - 0x28]
neg eax
jne 0x1003ec92
cmp dword [ebp - 0x28], 0
jne 0x1003ec92
and dword [ebp - 0x364], 0
jmp 0x1003ec9c
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x364], eax
jle 0x1003ecb3
mov dword [ebp - 0x23c], 1
jmp 0x1003ecba
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x23c], eax
jge 0x1003ecd1
mov dword [ebp - 0x304], 1
jmp 0x1003ecd8
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x304], eax
jge 0x1003ecef
mov dword [ebp - 0x244], 1
jmp 0x1003ecf6
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0x2522
jl 0x1003ed0e
mov dword [ebp - 0x3b0], 1
jmp 0x1003ed15
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3b0]
jg 0x1003ed2c
mov dword [ebp - 0x24c], 1
jmp 0x1003ed33
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24c], eax
jg 0x1003ed4a
mov dword [ebp - 0x30c], 1
jmp 0x1003ed51
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x30c], eax
jne 0x1003ed68
mov dword [ebp - 0x254], 1
jmp 0x1003ed6f
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x254], eax
jge 0x1003ed86
mov dword [ebp - 0x36c], 1
jmp 0x1003ed8d
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x36c], eax
jne 0x1003eda4
mov dword [ebp - 0x188], 1
jmp 0x1003edab
and dword [ebp - 0x188], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x188]
mov dword [ebp + eax - 0x1a4], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x188]
jl 0x1003eddb
mov eax, 0x63e91cb6
test eax, eax
jne 0x1003eddb
and dword [ebp - 0x25c], 0
jmp 0x1003ede5
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x1003ee0c
mov eax, 0x385d06f
test eax, eax
jne 0x1003ee0c
and dword [ebp - 0x44c], 0
jmp 0x1003ee16
mov dword [ebp - 0x44c], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1a4], 0x1caf
je 0x1003ee3e
mov dword [ebp - 0x314], 1
jmp 0x1003ee45
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
jge 0x1003ee62
mov dword [ebp - 0x264], 1
jmp 0x1003ee69
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
inc eax
inc eax
cmp eax, dword [ebp - 0x28]
jne 0x1003ee88
cmp dword [ebp - 0x14], 0
je 0x1003ee88
mov dword [ebp - 0x400], 1
jmp 0x1003ee8f
and dword [ebp - 0x400], 0
imul eax, dword [ebp - 0x28], 0x67d
add eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
jl 0x1003eeaa
mov dword [ebp - 0x39c], 1
jmp 0x1003eeb1
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x24], 0
jmp 0x1003eeca
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jl 0x1003f4bf
mov dword [ebp - 0x194], 0x880e
mov dword [ebp - 0xac], 7
mov dword [ebp - 0x84], 0xca0f9639
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x1003ef14
push 0
push 0
push 0x1d28
push 0x1095
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x14], 0
jmp 0x1003ef24
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1003f4ba
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x160], 6
mov dword [ebp - 0x410], 0xb88b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x60], 0
jne 0x1003ef6e
mov dword [ebp - 0x26c], 1
jmp 0x1003ef75
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x26c], eax
je 0x1003ef8f
mov dword [ebp - 0x31c], 1
jmp 0x1003ef96
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x31c], eax
jle 0x1003efb0
mov dword [ebp - 0x274], 1
jmp 0x1003efb7
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp dword [ebp - 0x274], eax
jge 0x1003efd5
mov dword [ebp - 0x374], 1
jmp 0x1003efdc
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp dword [ebp - 0x374], eax
je 0x1003effa
mov dword [ebp - 0x27c], 1
jmp 0x1003f001
and dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 0x4bcb
jge 0x1003f019
mov dword [ebp - 0x324], 1
jmp 0x1003f020
and dword [ebp - 0x324], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1a4]
imul eax, dword [ebp - 0x324]
test eax, eax
jne 0x1003f04a
mov eax, 0x90942075
test eax, eax
jne 0x1003f04a
and dword [ebp - 0x284], 0
jmp 0x1003f054
mov dword [ebp - 0x284], 1
cmp dword [ebp - 0x284], 0xfffffff9
jne 0x1003f069
mov dword [ebp - 0x3b4], 1
jmp 0x1003f070
and dword [ebp - 0x3b4], 0
imul eax, dword [ebp - 0x3b4], 0
cmp eax, dword [ebp - 0x194]
jge 0x1003f091
cmp dword [ebp - 0xac], 0
jne 0x1003f091
and dword [ebp - 0x28c], 0
jmp 0x1003f09b
mov dword [ebp - 0x28c], 1
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x28c], eax
jle 0x1003f0b5
mov dword [ebp - 0x32c], 1
jmp 0x1003f0bc
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0x22c2
jge 0x1003f0d4
mov dword [ebp - 0x294], 1
jmp 0x1003f0db
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp dword [ebp - 0x294], eax
jl 0x1003f204
mov dword [ebp - 0x408], 0xd870
mov eax, dword [ebp - 0x408]
dec eax
je 0x1003f16d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp dword [ebp - 0x60], eax
jl 0x1003f129
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1a4], 0
jne 0x1003f129
and dword [ebp - 0x37c], 0
jmp 0x1003f133
mov dword [ebp - 0x37c], 1
mov eax, 0x6174ed7b
sub eax, dword [ebp - 0x37c]
cmp eax, 0xda298b23
jbe 0x1003f151
mov dword [ebp - 0x29c], 1
jmp 0x1003f158
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0xffffffff
ja 0x1003f16d
mov dword [ebp - 0x334], 1
jmp 0x1003f174
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0xfbba
jge 0x1003f18c
mov dword [ebp - 0x178], 1
jmp 0x1003f193
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x1a4], ecx
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x178], eax
jne 0x1003f1bd
mov dword [ebp - 0x2a4], 1
jmp 0x1003f1c4
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x2a4], eax
je 0x1003f1e4
cmp dword [ebp - 0xb0], 0
jne 0x1003f1e4
and dword [ebp - 0x3a4], 0
jmp 0x1003f1ee
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x3a4]
add eax, 0x1179
mov dword [ebp - 0x2bc], eax
jmp 0x1003f2c6
mov dword [ebp - 0xe4], 0
jmp 0x1003f21d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 4
jge 0x1003f239
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x620], 0x74211fa8
jmp 0x1003f210
cmp dword [ebp - 0x194], 0
je 0x1003f257
cmp dword [ebp - 0xac], 0
je 0x1003f257
mov dword [ebp - 0x460], 1
jmp 0x1003f25e
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x160]
add eax, 3
cmp dword [ebp - 0x60], eax
jne 0x1003f284
mov dword [ebp - 0x2ac], 1
jmp 0x1003f28b
and dword [ebp - 0x2ac], 0
imul eax, dword [ebp - 0x2ac], 0x98f9
cmp eax, 3
je 0x1003f2a6
mov dword [ebp - 0x33c], 1
jmp 0x1003f2ad
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x33c]
sub ecx, dword [ebp + eax - 0x620]
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x84]
jl 0x1003f2e7
mov dword [ebp - 0x2b4], 1
jmp 0x1003f2ee
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0
jle 0x1003f303
mov dword [ebp - 0x384], 1
jmp 0x1003f30a
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x4d0], eax
or eax, 0xffffffff
add eax, 0xf2706978
jne 0x1003f342
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1003f342
and dword [ebp - 0x344], 0
jmp 0x1003f34c
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp eax, dword [ebp - 0x344]
jne 0x1003f36a
mov dword [ebp - 0x2c4], 1
jmp 0x1003f371
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x2c4], eax
jge 0x1003f38b
mov dword [ebp - 0x3b8], 1
jmp 0x1003f392
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3b8], eax
jl 0x1003f3b2
cmp dword [ebp - 0xac], 0
je 0x1003f3b2
mov dword [ebp - 0x2cc], 1
jmp 0x1003f3b9
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 1
jge 0x1003f3ce
mov dword [ebp - 0x34c], 1
jmp 0x1003f3d5
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 0x8187ea63
jbe 0x1003f3f1
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1003f3f1
and dword [ebp - 0x2d4], 0
jmp 0x1003f3fb
mov dword [ebp - 0x2d4], 1
cmp dword [ebp - 0x2d4], 4
jne 0x1003f410
mov dword [ebp - 0x38c], 1
jmp 0x1003f417
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0xc19daac0
jbe 0x1003f42f
mov dword [ebp - 0x1b8], 1
jmp 0x1003f436
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp eax, dword [ebp - 0xb0]
jl 0x1003f460
mov dword [ebp - 0x354], 1
jmp 0x1003f467
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x354], eax
jl 0x1003f481
mov dword [ebp - 0x2e4], 1
jmp 0x1003f488
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x2e4], eax
jg 0x1003f4a2
mov dword [ebp - 0x3ac], 1
jmp 0x1003f4a9
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x410], eax
jmp 0x1003ef1d
jmp 0x1003eec3
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x14b]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x78]
movzx ecx, byte [ebp + ecx - 0x14e]
movsx ecx, byte [ebp + ecx - 0x4b8]
add eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x14b]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x78]
movzx edx, byte [ebp + edx - 0x14e]
movsx edx, byte [ebp + edx - 0x4b8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x14b]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x78]
movzx edx, byte [ebp + edx - 0x14e]
movsx edx, byte [ebp + edx - 0x4b8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x14c]
mov byte [ebp + ecx - 0x4b8], al
push 0
call fcn.1004096a
pop ecx
and dword [ebp - 0x78], 0
jmp 0x1003e7ca
mov dword [ebp - 0x80], 0xcb457102
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x4d8], 0x42b48371
mov dword [ebp - 0x4f4], 0x9acf2579
mov dword [ebp - 0x4bc], 0xa40f2fda
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x10], 0
jmp 0x1003f598
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003f5ae
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5e8], 0xb3c692be
jmp 0x1003f591
mov dword [ebp - 0x10], 0
jmp 0x1003f5be
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003f5d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4f0], 0xffffffff
jmp 0x1003f5b7
mov dword [ebp - 0x10], 0
jmp 0x1003f5e4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003f5fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x504], 9
jmp 0x1003f5dd
mov dword [ebp - 0x10], 0
jmp 0x1003f60a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003f620
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x47c], 0xffff
jmp 0x1003f603
mov dword [ebp - 0x80], 0
jmp 0x1003f630
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jg 0x1003f719
mov dword [ebp - 0x50c], 4
mov dword [ebp - 0x54c], 0x2eaa29c1
mov dword [ebp - 0x500], 0xfffffffe
mov dword [ebp - 0x574], 0x585ed065
mov dword [ebp - 0x508], 0x81479b69
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x510], 0xa0c8d467
mov dword [ebp - 0x56c], 0xffffffff
mov dword [ebp - 0x518], 0xc00eadd5
mov dword [ebp - 0x534], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x1003f6ae
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1003f6c4
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x644], 0xfffffff6
jmp 0x1003f6a7
mov dword [ebp - 0x44], 0
jmp 0x1003f6d4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1003f6ea
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x5f0], 0x8770ce40
jmp 0x1003f6cd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x47c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x47c], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x5e8], 0
je 0x1003f714
jmp 0x1003f719
jmp 0x1003f629
xor eax, eax
inc eax
imul eax, eax, 0x1a
mov byte [ebp + eax - 0x4b8], 0
mov dword [ebp - 0x164], 0xfffffff8
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0xb8], 0
jmp 0x1003f754
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1003f770
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x158], 0x13923cc
jmp 0x1003f747
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1003f784
push 1
call fcn.1003dc8e
pop ecx
mov eax, 0x8d40
test eax, eax
je 0x1003f989
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
jne 0x1003f7ac
mov dword [ebp - 0x230], 1
jmp 0x1003f7b3
and dword [ebp - 0x230], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x158], 0x6ebf4d39
jl 0x1003f7d1
mov dword [ebp - 0x2ec], 1
jmp 0x1003f7d8
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0xfff7
jne 0x1003f7f4
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1003f7f4
and dword [ebp - 0x450], 0
jmp 0x1003f7fe
mov dword [ebp - 0x450], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x520], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x158]
cmp dword [ebp + eax - 0x158], ecx
je 0x1003f836
mov dword [ebp - 0x35c], 1
jmp 0x1003f83d
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 1
jbe 0x1003f852
mov dword [ebp - 0x21c], 1
jmp 0x1003f859
and dword [ebp - 0x21c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp - 0x21c], eax
jne 0x1003f87a
mov dword [ebp - 0x418], 1
jmp 0x1003f881
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x538], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1003f8b1
or eax, 0xffffffff
jne 0x1003f8b1
and dword [ebp - 0x220], 0
jmp 0x1003f8bb
mov dword [ebp - 0x220], 1
cmp dword [ebp - 0x220], 0x2085
je 0x1003f8d3
mov dword [ebp - 0x228], 1
jmp 0x1003f8da
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xfffffff8
je 0x1003f8ef
mov dword [ebp - 0x238], 1
jmp 0x1003f8f6
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x238]
jge 0x1003f914
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1003f92b
mov eax, 0x8d7d
test eax, eax
jne 0x1003f92b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x530], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x158], 0x1639956a
jg 0x1003f95b
mov dword [ebp - 0x16c], 1
jmp 0x1003f962
and dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x16c]
mov dword [ebp + eax - 0x158], ecx
cmp dword [ebp - 0x16c], 0
je 0x1003f989
mov dword [ebp - 0x240], 1
jmp 0x1003f990
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x5d0]
call fcn.10022e4c
and dword [ebp - 4], 0
and dword [ebp - 0xc8], 0
jmp 0x1003f9c8
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x1b
jae 0x1003fa69
mov dword [ebp - 0x420], 0xab659d56
mov dword [ebp - 0xc0], 0
jmp 0x1003f9f8
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1003fa14
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x540], 0x6834504c
jmp 0x1003f9eb
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x1003fa40
push 0
push 0x72ca
push 0x6f86
push 0x17
push 0x1c95
push 0x5ceb
call fcn.10040dba
add esp, 0x18
push 0x65e9
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.10040672
add esp, 0xc
mov eax, dword [ebp - 0xc8]
mov byte [ebp + eax - 0x4b8], 0
jmp 0x1003f9bb
push 0x10007f56
lea ecx, [ebp - 0x590]
call fcn.10022e4c
mov byte [ebp - 4], 1
mov dword [ebp - 0x68], 0xd313dd33
mov dword [ebp - 0x3cc], 0xffff
mov dword [ebp - 0x3c8], 0xffff
mov dword [ebp - 0x3c4], 0xffff
mov dword [ebp - 0x3c0], 0xffff
mov dword [ebp - 0x38], 0
jmp 0x1003fabc
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1003fad2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x52c], 0xfffffffd
jmp 0x1003fab5
mov dword [ebp - 0x38], 0
jmp 0x1003fae2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1003faf8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x430], 7
jmp 0x1003fadb
mov dword [ebp - 0x68], 0
jmp 0x1003fb08
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffe2
jge 0x1003fda3
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x258], 0x1fcc1031
mov dword [ebp - 0x1c], 3
jmp 0x1003fb33
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1003fd8c
mov dword [ebp - 0x458], 0xfffffffd
mov eax, 0x700d
test eax, eax
je 0x1003fc2b
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x248], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x248]
mov dword [ebp + eax - 0x52c], ecx
cmp dword [ebp - 0x248], 8
jge 0x1003fb8e
mov dword [ebp - 0x250], 1
jmp 0x1003fb95
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x1003fbb6
mov dword [ebp - 0x260], 1
jmp 0x1003fbbd
and dword [ebp - 0x260], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x1c]
imul ecx, dword [ebp + edx*4 - 0x3cc]
cmp dword [ebp + eax - 0x3cc], ecx
jge 0x1003fbec
mov dword [ebp - 0x268], 1
jmp 0x1003fbf3
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x268], eax
je 0x1003fc0a
mov dword [ebp - 0x270], 1
jmp 0x1003fc11
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
add eax, 0x4433ac25
mov ecx, dword [ebp - 0x1c]
imul eax, dword [ebp + ecx*4 - 0x3cc]
test eax, eax
jne 0x1003fc41
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x3cc], 0
jne 0x1003fc41
and dword [ebp - 0x278], 0
jmp 0x1003fc4b
mov dword [ebp - 0x278], 1
cmp dword [ebp - 0x278], 0xffffffff
je 0x1003fc60
mov dword [ebp - 0x280], 1
jmp 0x1003fc67
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0x28f0
jl 0x1003fc7f
mov dword [ebp - 0x288], 1
jmp 0x1003fc86
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xc4e7
jne 0x1003fc9e
mov dword [ebp - 0x290], 1
jmp 0x1003fca5
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x290]
je 0x1003fcbc
mov dword [ebp - 0x298], 1
jmp 0x1003fcc3
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3cc]
cmp dword [ebp - 0x298], eax
jg 0x1003fce1
mov dword [ebp - 0x2a0], 1
jmp 0x1003fce8
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3cc]
cmp dword [ebp - 0x2a0], eax
jg 0x1003fd06
mov dword [ebp - 0x2a8], 1
jmp 0x1003fd0d
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3cc]
cmp eax, dword [ebp - 0x2a8]
jne 0x1003fd2b
mov dword [ebp - 0x2b0], 1
jmp 0x1003fd32
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3cc]
add eax, dword [ebp - 0x2b0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x430], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 0x185f
jle 0x1003fd6e
mov dword [ebp - 0x2b8], 1
jmp 0x1003fd75
and dword [ebp - 0x2b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp + eax - 0x52c], ecx
jmp 0x1003fb2c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 0
je 0x1003fd9e
jmp 0x1003fda3
jmp 0x1003fb01
lea ecx, [ebp - 0x590]
call fcn.1001701e
cmp eax, dword [ebp + 0xc]
je 0x100400ed
mov dword [ebp - 0x40], 0
jmp 0x1003fdc7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1003fddd
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x428], 0x57fd
jmp 0x1003fdc0
mov dword [ebp - 0x40], 0
jmp 0x1003fded
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003fe03
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3dc], 0xf5c184c5
jmp 0x1003fde6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3dc], 0
jmp 0x1003fe31
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3dc], 1
jge 0x1003fe5b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp + eax*4 - 0x428], 0
jmp 0x1003fe16
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3dc], 3
jge 0x1003fe76
mov dword [ebp - 0x2c0], 1
jmp 0x1003fe7d
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3dc], eax
call fcn.10066f77
mov esi, eax
lea ecx, [ebp - 0x5d0]
call fcn.1001701e
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov dword [ebp - 0x3ec], edx
mov dword [ebp - 0x34], 0xdc4b4e12
mov dword [ebp - 0x48], 0xae77ab39
mov dword [ebp - 0x468], 0xdae9
mov dword [ebp - 0x3e4], 0xff5452fa
mov dword [ebp - 0xd0], 0
jmp 0x1003feec
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x1003ff08
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x610], 0xfffffffa
jmp 0x1003fedf
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
je 0x1004001f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x10040013
mov eax, 0xfff6
test eax, eax
je 0x1003ff5f
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jge 0x1003ff41
mov dword [ebp - 0x2c8], 1
jmp 0x1003ff48
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c8], eax
jne 0x1003ff5f
mov dword [ebp - 0x2d0], 1
jmp 0x1003ff66
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2d0], eax
jg 0x1003ff7d
mov dword [ebp - 0x2d8], 1
jmp 0x1003ff84
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x2d8]
je 0x1003ffa1
cmp dword [ebp - 0x48], 0
je 0x1003ffa1
mov dword [ebp - 0x2e0], 1
jmp 0x1003ffa8
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2e0], eax
je 0x1003ffbf
mov dword [ebp - 0x2e8], 1
jmp 0x1003ffc6
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0x355fff83
jge 0x1003ffde
mov dword [ebp - 0x2f0], 1
jmp 0x1003ffe5
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x2f0]
je 0x10040005
cmp dword [ebp - 0x468], 0
je 0x10040005
mov dword [ebp - 0x434], 1
jmp 0x1004000c
and dword [ebp - 0x434], 0
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1004001f
mov dword [ebp - 0x2f8], 1
jmp 0x10040026
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x34], 0
jmp 0x10040042
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x26
jl 0x10040098
mov dword [ebp - 0x300], 0
cmp dword [ebp - 0x34], 1
je 0x10040076
mov eax, 0xed76
test eax, eax
je 0x10040076
cmp dword [ebp - 0x300], 0
je 0x10040076
mov dword [ebp - 0x308], 1
jmp 0x1004007d
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x300]
sub eax, dword [ebp - 0x308]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x610], eax
jmp 0x1004003b
push 1
push dword [ebp - 0x3ec]
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x5d0]
call fcn.10046521
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x3fc]
lea ecx, [ebp - 0x590]
call fcn.10022e7b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x638]
call fcn.10016bf9
jmp 0x1003fda3
mov dword [ebp - 0x58], 0x3e13a6c9
mov dword [ebp - 0x88], 0x457a23a
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x10040118
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x1004012e
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1b4], 0
jmp 0x10040111
mov dword [ebp - 0x3c], 0
jmp 0x1004013e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10040154
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5dc], 0xfffffff8
jmp 0x10040137
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x10040171
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1b4], 0
jmp 0x1004019c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1b4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b4], 0xffffffed
jle 0x10040624
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x1cc], 0x7778e10a
mov dword [ebp - 0x98], 0
jmp 0x100401d9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x100401f5
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x90], 0
jmp 0x100401cc
cmp dword [ebp - 0x70], 0x72ca3c0b
jne 0x1004020a
mov dword [ebp - 0x320], 1
jmp 0x10040211
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffb
je 0x10040235
mov dword [ebp - 0x310], 1
jmp 0x1004023c
and dword [ebp - 0x310], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1b4]
cmp dword [ebp - 0x310], eax
jne 0x1004025d
mov dword [ebp - 0x318], 1
jmp 0x10040264
and dword [ebp - 0x318], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1b4]
add eax, dword [ebp - 0x318]
cmp eax, 0xadf1adb2
jae 0x1004028a
mov dword [ebp - 0x328], 1
jmp 0x10040291
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x320]
imul eax, dword [ebp - 0x328]
test eax, eax
jne 0x100402bb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1b4], 0
jne 0x100402bb
and dword [ebp - 0x330], 0
jmp 0x100402c5
mov dword [ebp - 0x330], 1
cmp dword [ebp - 0x330], 1
jg 0x100402da
mov dword [ebp - 0x338], 1
jmp 0x100402e1
and dword [ebp - 0x338], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b4]
cmp dword [ebp - 0x338], eax
jl 0x1004030b
mov byte [ebp - 0x4a], 0
lea eax, [ebp - 0x4a]
push eax
push 1
call fcn.1003dcb6
pop ecx
pop ecx
jmp 0x1004042b
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x9c], 0x41b87000
mov dword [ebp - 0x1bc], 0xfffffffe
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1bc], eax
jge 0x10040343
mov dword [ebp - 0x1c4], 1
jmp 0x1004034a
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
sub eax, 0xdf78
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1b4]
jg 0x10040381
cmp dword [ebp - 0x9c], 0
jne 0x10040381
and dword [ebp - 0x1d4], 0
jmp 0x1004038b
mov dword [ebp - 0x1d4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b4]
cmp eax, dword [ebp - 0x1d4]
jne 0x100403ab
mov dword [ebp - 0x1dc], 1
jmp 0x100403b2
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1dc], eax
jl 0x100403cc
mov dword [ebp - 0x1e4], 1
jmp 0x100403d3
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x58], eax
je 0x100403f6
mov dword [ebp - 0x1ec], 1
jmp 0x100403fd
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x70]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x1b4]
imul eax, eax, 0x3b03
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x90], eax
mov dword [ebp - 0x88], 8
jmp 0x10040444
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1a
jl 0x1004061f
mov dword [ebp - 0x17c], 0xb60f
mov dword [ebp - 0xa4], 0
jmp 0x10040474
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10040490
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x43c], 0x7da9fc5c
jmp 0x10040467
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x100404bc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x100404bc
mov dword [ebp - 0x1f4], 1
jmp 0x100404c3
and dword [ebp - 0x1f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
imul eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x58], eax
jg 0x100404e8
mov dword [ebp - 0x1fc], 1
jmp 0x100404ef
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x10040513
mov eax, 0x93c3
test eax, eax
je 0x10040513
mov dword [ebp - 0x204], 1
jmp 0x1004051a
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x43c]
cmp dword [ebp - 0x204], eax
jge 0x1004053b
mov dword [ebp - 0x20c], 1
jmp 0x10040542
and dword [ebp - 0x20c], 0
imul eax, dword [ebp - 0x20c], 0x3c66
test eax, eax
jne 0x1004055e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x43c], 0
push 5
pop eax
test eax, eax
je 0x10040581
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x10040581
mov dword [ebp - 0x174], 1
jmp 0x10040588
and dword [ebp - 0x174], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0x5dc], ecx
mov eax, dword [ebp - 0x174]
add eax, 0x161e4171
mov ecx, dword [ebp - 0x17c]
add ecx, eax
mov dword [ebp - 0x404], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x40c]
jl 0x100405e4
mov dword [ebp - 0x414], 1
jmp 0x100405eb
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b4]
mov dword [ebp - 0x53c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x43c]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x41c], 0xfffffff7
jmp 0x10040437
jmp 0x10040183
lea eax, [ebp - 0x590]
push eax
mov ecx, dword [ebp + 8]
call fcn.10016ba0
mov eax, dword [ebp - 0x214]
or eax, 1
mov dword [ebp - 0x214], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x590]
call fcn.10016bf9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.10016bf9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret