Function at 0x1003a12a
Capabilities:
Connect pipe
Encrypt data using speck
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065dcc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x8a8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0
je 0x1003a17b
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1003a179
push 0x1a6c
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1003a18f
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x1003a18f
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x118], 1
push 1
lea ecx, [ebp - 0x670]
call fcn.10009c88
and dword [ebp - 4], 0
mov dword [ebp - 0x60c], 0xe0369bd6
mov dword [ebp - 0x1d0], 0
jmp 0x1003a1cd
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1003a1ef
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x670]
call fcn.10009d00
mov dword [eax], 0xf89b5461
jmp 0x1003a1c0
mov dword [ebp - 0x504], 0x288e
mov dword [ebp - 0x614], 0x100088c8
cmp dword [ebp - 0x504], 0x2936
jle 0x1003a2bd
and dword [ebp - 0x1a4], 0
jmp 0x1003a229
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x4f25
jge 0x1003a2bd
and dword [ebp - 0x1d4], 0
jmp 0x1003a24f
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0x7be
jge 0x1003a2b8
and dword [ebp - 0x110], 0
jmp 0x1003a271
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x4ff3
jge 0x1003a2b6
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x110]
sar eax, cl
or eax, dword [ebp - 0x1a4]
cdq
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x588], edx
push dword [ebp - 0x588]
push dword [ebp - 0x58c]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x1003a264
jmp 0x1003a242
jmp 0x1003a21c
mov dword [ebp - 0x118], 0xffffffe2
jmp 0x1003a2d6
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff6
jg 0x1003a35d
mov dword [ebp - 0xac], 0xfffffffd
mov dword [ebp - 0xac], 0
jmp 0x1003a302
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1003a34e
push dword [ebp - 0xac]
lea ecx, [ebp - 0x670]
call fcn.10009d00
cmp dword [eax], 0xafd11d96
jb 0x1003a330
mov dword [ebp - 0x3d0], 1
jmp 0x1003a337
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x670]
call fcn.10009d00
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
jmp 0x1003a2f5
mov dword [ebp - 0x60c], 0x86f8c7b5
jmp 0x1003a2c9
mov byte [ebp - 4], 1
cmp dword [ebp - 0x504], 0x265d
jge 0x1003a37d
mov edx, dword [ebp - 0x614]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x1003a399
and dword [ebp - 4], 0
jmp 0x1003a3a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x670]
call fcn.10009ce4
cmp dword [0x1060e080], 0
jne 0x1003d2fa
mov dword [ebp - 0x1c4], 0x2e91a049
mov dword [ebp - 0x1c4], 4
jmp 0x1003a3e2
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x15
jle 0x1003a464
mov dword [ebp - 0x9c], 0x14768c0a
mov dword [ebp - 0x120], 0
jmp 0x1003a40e
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x1003a42a
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x61c], 2
jmp 0x1003a401
mov dword [ebp - 0x9c], 0
jmp 0x1003a443
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1003a45f
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x61c], 0x9ed080c1
jmp 0x1003a436
jmp 0x1003a3d5
mov dword [ebp - 0x624], 0xfffffffa
push 3
lea ecx, [ebp - 0x53c]
call fcn.10009c88
mov dword [ebp - 4], 3
mov dword [ebp - 0x62c], 1
mov dword [ebp - 0x128], 0xdb85613
mov dword [ebp - 0x50c], 6
mov dword [ebp - 0x1ac], 0
jmp 0x1003a4b9
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x1003a4d8
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x53c]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x1003a4ac
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x624]
add eax, dword [ebp - 0x62c]
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0xfffffff6
je 0x1003a512
mov dword [ebp - 0x514], 1
jmp 0x1003a519
and dword [ebp - 0x514], 0
mov esi, dword [ebp - 0x128]
push 1
lea ecx, [ebp - 0x53c]
call fcn.10009d00
mov ecx, dword [ebp - 0x514]
sub ecx, dword [eax]
cmp ecx, esi
jg 0x1003a544
mov dword [ebp - 0x530], 1
jmp 0x1003a54b
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0x3187
jg 0x1003a563
mov dword [ebp - 0x52c], 1
jmp 0x1003a56a
and dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0x53c]
call fcn.10009d00
mov esi, dword [eax]
sub esi, dword [ebp - 0x52c]
push 1
lea ecx, [ebp - 0x53c]
call fcn.10009d00
cmp esi, dword [eax]
jl 0x1003a59c
mov dword [ebp - 0x664], 1
jmp 0x1003a5a3
and dword [ebp - 0x664], 0
mov eax, 0x7e0f
cmp eax, 0xbe2d
jl 0x1003a5bb
mov dword [ebp - 0x4f0], 1
jmp 0x1003a5c2
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0x62b000c
jg 0x1003a5da
mov dword [ebp - 0x25c], 1
jmp 0x1003a5e1
and dword [ebp - 0x25c], 0
push 0
lea ecx, [ebp - 0x53c]
call fcn.10009d00
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [eax]
jge 0x1003a604
mov dword [ebp - 0x47c], 1
jmp 0x1003a60b
and dword [ebp - 0x47c], 0
push 0
lea ecx, [ebp - 0x53c]
call fcn.10009d00
mov ecx, dword [ebp - 0x47c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x53c]
call fcn.10009ce4
mov byte [ebp - 0xdc], 1
mov byte [ebp - 0xdb], 0x2a
mov byte [ebp - 0xda], 6
mov byte [ebp - 0xd9], 0x56
mov byte [ebp - 0xd8], 4
mov byte [ebp - 0xd7], 0x1a
mov byte [ebp - 0xd6], 0xb0
mov byte [ebp - 0xd5], 0xa8
mov byte [ebp - 0xd4], 0x60
mov byte [ebp - 0xd3], 3
mov byte [ebp - 0xd2], 0x5d
mov byte [ebp - 0xd1], 4
mov byte [ebp - 0xd0], 0xb
mov byte [ebp - 0xcf], 7
mov byte [ebp - 0xce], 0x57
mov byte [ebp - 0xcd], 0xa
mov byte [ebp - 0xcc], 0x5e
mov byte [ebp - 0xcb], 0
mov byte [ebp - 0xca], 0x27
mov byte [ebp - 0xc9], 2
mov byte [ebp - 0xc8], 0x39
mov byte [ebp - 0xc7], 8
mov byte [ebp - 0xc6], 0x5c
mov byte [ebp - 0xc5], 5
mov byte [ebp - 0xc4], 0x42
mov byte [ebp - 0xc3], 0xb
mov byte [ebp - 0xc2], 0
mov byte [ebp - 0xc1], 9
mov byte [ebp - 0xc0], 8
mov dword [ebp - 0x64], 5
mov dword [ebp - 0x64], 0
jmp 0x1003a711
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff8
jle 0x1003a791
mov dword [ebp - 0x264], 0x90a6
mov dword [ebp - 0x108], 0
jmp 0x1003a73a
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1003a756
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x728], 1
jmp 0x1003a72d
mov dword [ebp - 0x264], 0x47dc4b4e
mov eax, dword [ebp - 0x264]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x728], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x728]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x728], eax
jmp 0x1003a70a
mov dword [ebp - 0x64], 0xffffffe6
jmp 0x1003a7a1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffef
jl 0x1003a7bf
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x1003a7bd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x1003a79a
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xdc]
and eax, 0x4f
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xdc]
or ecx, 0x4f
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xdc]
mov word [ebp + eax*2 - 0x768], cx
mov dword [ebp - 0x28], 2
and dword [ebp - 0x158], 0
jmp 0x1003a811
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1d
jae 0x1003b13f
mov dword [ebp - 0x7d0], 0xfffffffc
push 1
lea ecx, [ebp - 0x800]
call fcn.10009c88
mov dword [ebp - 4], 4
push 3
lea ecx, [ebp - 0x710]
call fcn.10009c88
mov byte [ebp - 4], 5
mov dword [ebp - 0x5c], 0
jmp 0x1003a85a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1003a876
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x800]
call fcn.10009d00
mov dword [eax], 2
jmp 0x1003a853
mov dword [ebp - 0x5c], 0
jmp 0x1003a886
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1003a8a2
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x710]
call fcn.10009d00
mov dword [eax], 0xc6338430
jmp 0x1003a87f
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1003a8c0
push 0
push 0x1787
push 0xa7d
call dword [sym.imp.GDI32.dll_CreatePen]
push 2
lea ecx, [ebp - 0x710]
call fcn.10009d00
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x484]
mov dword [ecx], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x710]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x800]
call fcn.10009ce4
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xdc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1003b0d2
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0xdc]
inc eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0xb4], 0xfffffffb
mov dword [ebp - 0x814], 5
mov dword [ebp - 0x7a8], 0xcbcef054
push 1
lea ecx, [ebp - 0x694]
call fcn.10009c88
mov dword [ebp - 4], 6
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x50], 0
jmp 0x1003a97b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1003a991
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x6b4], 0xf9b3
jmp 0x1003a974
mov dword [ebp - 0x50], 0
jmp 0x1003a9a1
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1003a9bd
push dword [ebp - 0x50]
lea ecx, [ebp - 0x694]
call fcn.10009d00
mov dword [eax], 0x22cb3a3f
jmp 0x1003a99a
mov dword [ebp - 0xb4], 0
jmp 0x1003a9d6
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x1003acd2
mov dword [ebp - 0x26c], 0xdf2
mov dword [ebp - 0x648], 0x10008938
cmp dword [ebp - 0x26c], 0xf9c
jle 0x1003ab01
and dword [ebp - 0x180], 0
jmp 0x1003aa1d
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x6fda
jge 0x1003aae2
and dword [ebp - 0x130], 0
jmp 0x1003aa43
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x6eb7
jge 0x1003aadd
and dword [ebp - 0x17c], 0
jmp 0x1003aa69
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x70be
jge 0x1003aad8
and dword [ebp - 0x138], 0
jmp 0x1003aa8b
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x4f42
jge 0x1003aad6
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp - 0x17c]
sub ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x180]
sar eax, cl
cdq
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], edx
push dword [ebp - 0x594]
push dword [ebp - 0x598]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x1003aa7e
jmp 0x1003aa5c
jmp 0x1003aa36
jmp 0x1003aa10
push 0x183f
push 0x10b
push 0x1e0e
push 0x1b9c
push 0x219
call dword [sym.imp.GDI32.dll_Rectangle]
mov dword [ebp - 0x48c], 1
mov byte [ebp - 4], 7
cmp dword [ebp - 0x26c], 0xba6
jge 0x1003ab2b
mov edx, dword [ebp - 0x648]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x1003ab47
mov dword [ebp - 4], 6
jmp 0x1003ab57
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x140], 0
jmp 0x1003ab7a
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x1003ab96
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x22c], 0xffffffff
jmp 0x1003ab6d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22c], 0
jne 0x1003ac17
push 0
lea ecx, [ebp - 0x694]
call fcn.10009d00
mov eax, dword [eax]
sub eax, 0xa
mov dword [ebp - 0x48c], eax
je 0x1003abd3
push 3
pop eax
test eax, eax
je 0x1003abd3
mov dword [ebp - 0x274], 1
jmp 0x1003abda
and dword [ebp - 0x274], 0
push 0
lea ecx, [ebp - 0x694]
call fcn.10009d00
mov ecx, dword [ebp - 0x274]
cmp ecx, dword [eax]
jne 0x1003abfd
mov dword [ebp - 0x660], 1
jmp 0x1003ac04
and dword [ebp - 0x660], 0
or eax, 0xffffffff
cmp eax, 0x686a
jne 0x1003ac17
and dword [ebp - 0x494], 0
jmp 0x1003ac21
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x27c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ebp + ecx*4 - 0x6b4]
sub ecx, dword [ebp - 0x1f4]
imul ecx, dword [ebp + eax - 0x22c]
cmp ecx, dword [ebp - 0x27c]
jle 0x1003ac6f
mov dword [ebp - 0x49c], 1
jmp 0x1003ac76
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6b4]
cmp dword [ebp - 0x49c], eax
je 0x1003ac97
mov dword [ebp - 0x284], 1
jmp 0x1003ac9e
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0xfffffff7
je 0x1003acb3
mov dword [ebp - 0x4a4], 1
jmp 0x1003acba
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp + eax - 0x22c], ecx
jmp 0x1003a9c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x694]
call fcn.10009ce4
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0xdc]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x84], 0x69fdf99f
mov dword [ebp - 0x6ec], 6
mov dword [ebp - 0x6e8], 6
mov dword [ebp - 0x6e4], 6
mov dword [ebp - 0x6e0], 6
lea ecx, [ebp - 0x219]
call fcn.10009e64
push eax
lea eax, [ebp - 0x6dc]
push eax
lea eax, [ebp - 0x6ec]
push eax
lea ecx, [ebp - 0x870]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x548]
call fcn.100147e3
mov dword [ebp - 4], 9
mov dword [ebp - 0x4ac], 0x1362
mov dword [ebp - 0x864], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1003ad91
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x10
jle 0x1003b0be
mov dword [ebp - 0x250], 0x5cbd9454
mov dword [ebp - 0x24c], 0x5cbd9454
mov dword [ebp - 0x248], 0x5cbd9454
mov dword [ebp - 0x244], 0x5cbd9454
mov dword [ebp - 0x198], 2
mov dword [ebp - 0x28c], 0x2ecc
mov dword [ebp - 0x564], 0x100089a4
cmp dword [ebp - 0x28c], 0x30f4
jle 0x1003aed1
and dword [ebp - 0x150], 0
jmp 0x1003ae0a
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x1b9c
jge 0x1003aed1
and dword [ebp - 0x188], 0
jmp 0x1003ae30
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x3428
jge 0x1003aecc
and dword [ebp - 0x148], 0
jmp 0x1003ae56
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x2dec
jge 0x1003aec7
and dword [ebp - 0x190], 0
jmp 0x1003ae78
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x3858
jge 0x1003aec5
mov eax, dword [ebp - 0x188]
cdq
idiv dword [ebp - 0x148]
imul edx, dword [ebp - 0x190]
xor edx, dword [ebp - 0x150]
mov eax, edx
cdq
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5a0], edx
push dword [ebp - 0x5a0]
push dword [ebp - 0x5a4]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x1003ae6b
jmp 0x1003ae49
jmp 0x1003ae23
jmp 0x1003adfd
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x250], 0
jmp 0x1003aeff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x250]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x250], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x250], 3
jg 0x1003af47
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x250]
lea ecx, [ebp - 0x548]
call fcn.10009d00
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x250]
lea ecx, [ebp - 0x548]
call fcn.10009d00
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003aee4
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x28c], 0x2e29
jge 0x1003af67
mov edx, dword [ebp - 0x564]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x1003af83
mov dword [ebp - 4], 9
jmp 0x1003af93
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x824], eax
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x4ac]
push 0
lea ecx, [ebp - 0x548]
call fcn.10009d00
sub edi, dword [eax]
cmp edi, esi
jle 0x1003afd6
mov dword [ebp - 0x294], 1
jmp 0x1003afdd
and dword [ebp - 0x294], 0
imul eax, dword [ebp - 0x84], 0xfffffffe
cmp eax, dword [ebp - 0x294]
jg 0x1003aff8
mov dword [ebp - 0x580], 1
jmp 0x1003afff
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x7b8], eax
push 1
lea ecx, [ebp - 0x548]
call fcn.10009d00
cmp dword [ebp - 0x198], 0
je 0x1003b041
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x250], 0
je 0x1003b041
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x250], 0
jne 0x1003b053
cmp dword [ebp - 0x198], 0
jne 0x1003b053
and dword [ebp - 0x4b4], 0
jmp 0x1003b05d
mov dword [ebp - 0x4b4], 1
push 1
lea ecx, [ebp - 0x548]
call fcn.10009d00
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x1003b080
mov dword [ebp - 0x29c], 1
jmp 0x1003b087
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0x142b622b
jg 0x1003b09f
mov dword [ebp - 0x4bc], 1
jmp 0x1003b0a6
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4bc]
mov dword [ebp + eax - 0x250], ecx
jmp 0x1003ad84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x548]
call fcn.10009ce4
jmp 0x1003a809
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x158]
movzx eax, byte [ebp + eax - 0xde]
movzx eax, word [ebp + eax*2 - 0x768]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0xdb]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x158]
movzx eax, byte [ebp + eax - 0xde]
movzx eax, word [ebp + eax*2 - 0x768]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0xdb]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0xdc]
mov word [ebp + eax*2 - 0x768], dx
and dword [ebp - 0x158], 0
jmp 0x1003a809
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x768], cx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x4a8], 0x5bea
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x1a0], 0
jmp 0x1003b18d
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1003b1a9
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x1e0], 0xc93b4e1a
jmp 0x1003b180
mov dword [ebp - 0x18], 0
jmp 0x1003b1b9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1003b4b5
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x234], 0xfffffff7
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1e0], 0x5d2d9150
jle 0x1003b1f3
mov dword [ebp - 0x4c4], 1
jmp 0x1003b1fa
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x18]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1e0]
imul ecx, dword [ebp + eax*4 - 0x1e0]
cmp ecx, 0xfffffffa
je 0x1003b223
mov dword [ebp - 0x2a4], 1
jmp 0x1003b22a
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x2a4], eax
je 0x1003b248
mov dword [ebp - 0x2ac], 1
jmp 0x1003b24f
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x2ac]
jne 0x1003b27f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1e0], 0
jne 0x1003b27f
and dword [ebp - 0x4cc], 0
jmp 0x1003b289
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x4cc], eax
je 0x1003b2a3
mov dword [ebp - 0x2b4], 1
jmp 0x1003b2aa
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0x1676
jne 0x1003b2c2
mov dword [ebp - 0x4d4], 1
jmp 0x1003b2c9
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x4d4], eax
jge 0x1003b2e7
mov dword [ebp - 0x2bc], 1
jmp 0x1003b2ee
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x2bc], eax
jle 0x1003b30c
mov dword [ebp - 0x4dc], 1
jmp 0x1003b313
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0x4071e994
jge 0x1003b32b
mov dword [ebp - 0x2c4], 1
jmp 0x1003b332
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 1
je 0x1003b347
mov dword [ebp - 0x4e4], 1
jmp 0x1003b34e
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4e4], eax
jne 0x1003b365
mov dword [ebp - 0x2cc], 1
jmp 0x1003b36c
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0xff846c8
jne 0x1003b384
mov dword [ebp - 0x658], 1
jmp 0x1003b38b
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1e0]
mov dword [ebp - 0x84c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1e0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e0], 0x256cd219
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xbc]
jle 0x1003b3e3
mov dword [ebp - 0x4ec], 1
jmp 0x1003b3ea
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x234]
cmp eax, 0x39f4802d
jg 0x1003b415
mov dword [ebp - 0x2d4], 1
jmp 0x1003b41c
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x2d4], eax
jle 0x1003b436
mov dword [ebp - 0x4f4], 1
jmp 0x1003b43d
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xbc]
je 0x1003b463
mov dword [ebp - 0x4fc], 1
jmp 0x1003b46a
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x4fc]
je 0x1003b481
mov dword [ebp - 0x2e0], 1
jmp 0x1003b488
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0xfffffff8
jne 0x1003b49d
mov dword [ebp - 0x410], 1
jmp 0x1003b4a4
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x234], eax
jmp 0x1003b1b2
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1e0]
cmp ecx, dword [ebp + eax - 0x1e0]
jle 0x1003b4dd
mov dword [ebp - 0x2e8], 1
jmp 0x1003b4e4
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0x2e8]
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x4a8]
jne 0x1003b50a
mov dword [ebp - 0x2f0], 1
jmp 0x1003b511
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0
jle 0x1003b526
mov dword [ebp - 0x418], 1
jmp 0x1003b52d
and dword [ebp - 0x418], 0
imul eax, dword [ebp - 0x418], 0x5c2d
cmp eax, dword [ebp - 0xbc]
jle 0x1003b54b
mov dword [ebp - 0x2f8], 1
jmp 0x1003b552
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
add eax, dword [ebp - 0x2f8]
je 0x1003b573
mov dword [ebp - 0x518], 1
jmp 0x1003b57a
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0x8b8]
call fcn.1004712f
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x618], eax
mov dword [ebp - 4], 0xc
push dword [ebp - 0x618]
call fcn.10036b43
pop ecx
mov dword [ebp - 0x344], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.10014687
mov dword [ebp - 0x160], 8
mov dword [ebp - 0x160], 0
jmp 0x1003b5f5
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xb
jge 0x1003b639
mov dword [ebp - 0x94], 0xeede0b40
mov dword [ebp - 0x94], 0xfffffff2
jmp 0x1003b621
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xb
jl 0x1003b637
cmp dword [ebp - 0x94], 0
je 0x1003b635
jmp 0x1003b637
jmp 0x1003b614
jmp 0x1003b5e8
and dword [ebp - 0x1a8], 0
jmp 0x1003b64f
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xd
jae 0x1003b66a
xor eax, eax
mov ecx, dword [ebp - 0x1a8]
mov word [ebp + ecx*2 - 0x768], ax
jmp 0x1003b642
cmp dword [ebp - 0x344], 0
je 0x1003d2fa
mov dword [ebp - 0x6c], 0xb9f9b319
mov dword [ebp - 0xb8], 0xfffffffb
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x6c], 0
jmp 0x1003b6a2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x1a
jg 0x1003b972
mov dword [ebp - 0x8c], 0xc6f1bf50
mov dword [ebp - 0x178], 0xb3a3fc4b
mov dword [ebp - 0x300], 0x64e2
mov dword [ebp - 0x574], 0x100089f0
cmp dword [ebp - 0x300], 0x6580
jle 0x1003b7e3
push 0
push 0x1cc1
push 0xaa9
push 0xb3e
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
and dword [ebp - 0x170], 0
jmp 0x1003b711
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x52f
jge 0x1003b7d7
and dword [ebp - 0x1b8], 0
jmp 0x1003b737
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x4320
jge 0x1003b7d2
and dword [ebp - 0x168], 0
jmp 0x1003b75d
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x6093
jge 0x1003b7cd
and dword [ebp - 0x1b0], 0
jmp 0x1003b77f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x39d6
jge 0x1003b7cb
mov eax, dword [ebp - 0x168]
xor eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x170]
imul ecx, dword [ebp - 0x1b8]
or eax, ecx
cdq
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5ac], edx
push dword [ebp - 0x5ac]
push dword [ebp - 0x5b0]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x1003b772
jmp 0x1003b750
jmp 0x1003b72a
jmp 0x1003b704
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 0x57c], 0xffffffff
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x300], 0x6419
jge 0x1003b810
mov edx, dword [ebp - 0x574]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x1003b82c
or dword [ebp - 4], 0xffffffff
jmp 0x1003b836
mov dword [ebp - 0x8c], 8
jmp 0x1003b84f
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffec
jle 0x1003b93c
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x620], 1
mov eax, dword [ebp - 0x650]
cmp eax, dword [ebp - 0x6c]
jge 0x1003b887
mov dword [ebp - 0x420], 1
jmp 0x1003b88e
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x420]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x6c], 0xffffffff
jb 0x1003b8c8
mov dword [ebp - 0x308], 1
jmp 0x1003b8cf
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0xb8]
jne 0x1003b8fe
cmp dword [ebp - 0x178], 0
je 0x1003b8fe
mov dword [ebp - 0x4b0], 1
jmp 0x1003b905
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0x233fd52a
jl 0x1003b918
cmp dword [ebp - 0x178], 0
cmp dword [ebp - 0x6c], 0
jge 0x1003b925
cmp dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x220]
mov dword [ebp - 0x620], eax
jmp 0x1003b842
cmp dword [ebp - 0xb8], 0
je 0x1003b95a
cmp dword [ebp - 0x8c], 0
je 0x1003b95a
mov dword [ebp - 0x310], 1
jmp 0x1003b961
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x8c], eax
jmp 0x1003b69b
mov byte [ebp - 0xf8], 7
mov byte [ebp - 0xf7], 0x93
mov byte [ebp - 0xf6], 8
mov byte [ebp - 0xf5], 0x25
mov byte [ebp - 0xf4], 9
mov byte [ebp - 0xf3], 0
mov byte [ebp - 0xf2], 4
mov byte [ebp - 0xf1], 0x16
mov byte [ebp - 0xf0], 5
mov byte [ebp - 0xef], 0x1d
mov byte [ebp - 0xee], 1
mov byte [ebp - 0xed], 0xa
mov byte [ebp - 0xec], 3
mov byte [ebp - 0xeb], 0x35
mov byte [ebp - 0xea], 0xa
mov byte [ebp - 0xe9], 0x22
mov byte [ebp - 0xe8], 2
mov byte [ebp - 0xe7], 6
mov byte [ebp - 0xe6], 0xb
mov byte [ebp - 0xe5], 0x11
mov byte [ebp - 0xe4], 0xd
mov byte [ebp - 0xe3], 0x16
mov byte [ebp - 0xe2], 6
mov byte [ebp - 0xe1], 0x10
mov byte [ebp - 0xe0], 0xc
mov byte [ebp - 0xdf], 0x10
mov byte [ebp - 0xde], 0
mov byte [ebp - 0xdd], 0x34
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xf8]
and eax, 0xd2
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xf8]
or ecx, 0xd2
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xf8]
mov byte [ebp + eax - 0x558], cl
mov dword [ebp - 0x40], 0xdd688769
mov dword [ebp - 0x68], 0x3b7c
mov dword [ebp - 0x428], 0x996
mov dword [ebp - 0x584], 0x10008a60
cmp dword [ebp - 0x428], 0xa7a
jle 0x1003bb82
and dword [ebp - 0x1c0], 0
jmp 0x1003babc
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x5e73
jge 0x1003bb82
and dword [ebp - 0x1c8], 0
jmp 0x1003bae2
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x2f4e
jge 0x1003bb7d
and dword [ebp - 0x184], 0
jmp 0x1003bb08
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x16f9
jge 0x1003bb78
and dword [ebp - 0x1b4], 0
jmp 0x1003bb2a
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x7d39
jge 0x1003bb76
mov eax, dword [ebp - 0x1c0]
cdq
idiv dword [ebp - 0x1c8]
add edx, dword [ebp - 0x184]
add edx, dword [ebp - 0x1b4]
mov eax, edx
cdq
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], edx
push dword [ebp - 0x5b8]
push dword [ebp - 0x5bc]
mov ecx, 0x1060cf38
call fcn.100144da
jmp 0x1003bb1d
jmp 0x1003bafb
jmp 0x1003bad5
jmp 0x1003baaf
mov dword [ebp - 0x4f8], 0xe469209a
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x428], 0x6e5
jge 0x1003bbaf
mov edx, dword [ebp - 0x584]
mov ecx, 0x1060cf38
call fcn.10016dcb
jmp 0x1003bbcb
or dword [ebp - 4], 0xffffffff
jmp 0x1003bbd5
mov dword [ebp - 0x340], 0xacb2d505
mov dword [ebp - 0x348], 0x996fd0fe
push 4
lea ecx, [ebp - 0x6f8]
call fcn.10009c88
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x5d0], 1
mov dword [ebp - 0x18c], 0
jmp 0x1003bc34
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x1003bc56
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x6f8]
call fcn.10009d00
mov dword [eax], 0xb56bf5ee
jmp 0x1003bc27
cmp dword [ebp - 0x40], 0
je 0x1003bddb
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x68], 0x9403132d
ja 0x1003bc7e
mov dword [ebp - 0x318], 1
jmp 0x1003bc85
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x4f8]
lea eax, [ecx + eax + 1]
cmp eax, 1
ja 0x1003bcaf
mov dword [ebp - 0x320], 1
jmp 0x1003bcb6
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x320], eax
jg 0x1003bccd
mov dword [ebp - 0x430], 1
jmp 0x1003bcd4
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x430], eax
je 0x1003bcee
cmp dword [ebp - 0x68], 0
jne 0x1003bcee
and dword [ebp - 0x328], 0
jmp 0x1003bcf8
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], 0xfffffffb
jle 0x1003bd0d
mov dword [ebp - 0x4b8], 1
jmp 0x1003bd14
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x4b8], eax
je 0x1003bd2b
mov dword [ebp - 0x330], 1
jmp 0x1003bd32
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x40]
jge 0x1003bd4d
mov dword [ebp - 0x438], 1
jmp 0x1003bd54
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x438]
cmp dword [ebp - 0x40], eax
jne 0x1003bd6f
mov dword [ebp - 0x338], 1
jmp 0x1003bd76
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x46983c17
jg 0x1003bd8e
mov dword [ebp - 0x520], 1
jmp 0x1003bd95
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
je 0x1003bdb6
mov dword [ebp - 0x440], 1
jmp 0x1003bdbd
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
jne 0x1003bddb
and dword [ebp - 0x200], 0
jmp 0x1003bde5
mov dword [ebp - 0x200], 1
push 1
lea ecx, [ebp - 0x6f8]
call fcn.10009d00
mov ecx, dword [ebp - 0x200]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x200], eax
jl 0x1003be14
mov dword [ebp - 0x4c0], 1
jmp 0x1003be1b
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x4c0], eax
jg 0x1003be32
mov dword [ebp - 0x350], 1
jmp 0x1003be39
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x3c94
jne 0x1003be5d
mov dword [ebp - 0x448], 1
jmp 0x1003be64
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x448], eax
jne 0x1003be7b
mov dword [ebp - 0x358], 1
jmp 0x1003be82
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
sub eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
cmp eax, 6
jbe 0x1003bea0
mov dword [ebp - 0x500], 1
jmp 0x1003bea7
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x500], eax
jle 0x1003bebe
mov dword [ebp - 0x360], 1
jmp 0x1003bec5
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x360], eax
jne 0x1003bedf
mov dword [ebp - 0x450], 1
jmp 0x1003bee6
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x450]
jl 0x1003befd
mov dword [ebp - 0x368], 1
jmp 0x1003bf04
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0x760b
jg 0x1003bf1c
mov dword [ebp - 0x4c8], 1
jmp 0x1003bf23
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x4c8], eax
jg 0x1003bf3d
mov dword [ebp - 0x370], 1
jmp 0x1003bf44
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x1cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f8]
call fcn.10009ce4
mov dword [ebp - 0x34], 2
and dword [ebp - 0x208], 0
jmp 0x1003bf83
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1c
jae 0x1003c0c6
mov dword [ebp - 0x1bc], 0x24ec2e0c
mov dword [ebp - 0x458], 0x4c23afc3
mov dword [ebp - 0x194], 0
jmp 0x1003bfba
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x1003bfd6
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x5d4], 0x425a80e3
jmp 0x1003bfad
mov dword [ebp - 0x1bc], 0xffffffe7
jmp 0x1003bfef
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x11
jne 0x1003c023
mov dword [ebp - 0x590], 0xcbad86e5
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5d4], eax
jmp 0x1003bfe2
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1003c039
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x208]
movzx eax, byte [ebp + eax - 0xfa]
movsx eax, byte [ebp + eax - 0x558]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0xf7]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x208]
movzx eax, byte [ebp + eax - 0xfa]
movsx eax, byte [ebp + eax - 0x558]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0xf7]
and edx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x208]
movzx eax, byte [ebp + eax - 0xfa]
movsx eax, byte [ebp + eax - 0x558]
mov esi, dword [ebp - 0x34]
movzx ebx, byte [ebp + esi - 0xf7]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0xf8]
mov byte [ebp + eax - 0x558], bl
jmp 0x1003bf7b
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x3c], 0xf9c25b05
mov dword [ebp - 0x88], 0xfffffff7
mov dword [ebp - 0x6d8], 0xbd4856cd
mov dword [ebp - 0x6d4], 0xbd4856cd
mov dword [ebp - 0x6d0], 0xbd4856cd
mov dword [ebp - 0x6cc], 0xbd4856cd
lea ecx, [ebp - 0x221]
call fcn.10009e64
push eax
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x888]
call fcn.10014809
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x104]
call fcn.100147e3
mov dword [ebp - 4], 0x12
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x1003c16a
push 0x2454
push 0x1475
push 0x2470
call dword [sym.imp.GDI32.dll_LineTo]
cmp dword [ebp - 0x58], 0
je 0x1003c250
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x528], 0xffffffff
cmp dword [ebp - 0x58], 0
jne 0x1003c19d
cmp dword [ebp - 0x58], 0
je 0x1003c19d
and dword [ebp - 0x378], 0
jmp 0x1003c1a7
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x378]
jge 0x1003c1c5
mov dword [ebp - 0x380], 1
jmp 0x1003c1cc
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
je 0x1003c22c
mov eax, 0x9576
test eax, eax
je 0x1003c22c
mov dword [ebp - 0x460], 1
jmp 0x1003c233
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x380]
sub eax, dword [ebp - 0x460]
sub eax, dword [ebp - 0x388]
mov dword [ebp - 0x88], eax
jmp 0x1003c54c
mov dword [ebp - 0x44], 0x33f2a6ad
mov dword [ebp - 0x5a8], 0x1d005767
mov dword [ebp - 0x1c], 0
jmp 0x1003c271
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1003c54c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003c3a6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
cmp dword [eax], 0x4938
jge 0x1003c2b4
mov dword [ebp - 0x4d0], 1
jmp 0x1003c2bb
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x4d0]
jge 0x1003c2d2
mov dword [ebp - 0x390], 1
jmp 0x1003c2d9
and dword [ebp - 0x390], 0
push 0
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov ecx, dword [ebp - 0x390]
cmp ecx, dword [eax]
jle 0x1003c2fc
mov dword [ebp - 0x59c], 1
jmp 0x1003c303
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x1c], 0
jne 0x1003c31d
cmp dword [ebp - 0x44], 0
jne 0x1003c31d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov esi, 0xc0f1fa6f
sub esi, 0x5cc9e520
sub esi, dword [ebp - 0x44]
push 0
lea ecx, [ebp - 0x104]
call fcn.10009d00
sub esi, dword [eax]
jne 0x1003c349
xor eax, eax
jne 0x1003c349
and dword [ebp - 0x468], 0
jmp 0x1003c353
mov dword [ebp - 0x468], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov ecx, dword [ebp - 0x468]
imul ecx, dword [eax]
cmp ecx, 0x763964e4
jg 0x1003c37e
mov dword [ebp - 0x398], 1
jmp 0x1003c385
and dword [ebp - 0x398], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov ecx, dword [ebp - 0x398]
cmp ecx, dword [eax]
je 0x1003c3a6
and dword [ebp - 0x5dc], 0
jmp 0x1003c3b0
mov dword [ebp - 0x5dc], 1
push 0
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x88]
jne 0x1003c3d4
mov dword [ebp - 0x508], 1
jmp 0x1003c3db
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x508], eax
jge 0x1003c3f2
mov dword [ebp - 0x3a0], 1
jmp 0x1003c3f9
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0x39ce
jge 0x1003c411
mov dword [ebp - 0x470], 1
jmp 0x1003c418
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xaf7b
jle 0x1003c43d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov dword [eax], 0x32dc1b2d
jmp 0x1003c547
mov dword [ebp - 0x3c], 0xffffffec
jmp 0x1003c44d
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffea
jne 0x1003c547
mov dword [ebp - 0x88], 0x1a
jmp 0x1003c470
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x17
jne 0x1003c542
mov dword [ebp - 0x44], 0
jmp 0x1003c48d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1003c4cb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov dword [eax], 0x19116590
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003c486
mov dword [ebp - 0x58], 0
jmp 0x1003c4db
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x1003c53d
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1003c501
push 0
push 0x7ff
push 0x11ab
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov dword [ebp - 0x3a8], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x104]
call fcn.10009d00
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3a8]
mov eax, dword [eax]
mov dword [ebp - 0x5a8], eax
jmp 0x1003c4d4
jmp 0x1003c463
jmp 0x1003c446
jmp 0x1003c26a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.10009ce4
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x558], 0
push 4
lea ecx, [ebp - 0x1f0]
call fcn.10009c88
mov dword [ebp - 4], 0x13
push 2
lea ecx, [ebp - 0x71c]
call fcn.10009c88
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x5b4], 0xffffffff
mov dword [ebp - 0x48], 0
jmp 0x1003c5a8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1003c5c4
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov dword [eax], 0xfffd
jmp 0x1003c5a1
mov dword [ebp - 0x48], 0
jmp 0x1003c5d4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1003c5f0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x71c]
call fcn.10009d00
mov dword [eax], 7
jmp 0x1003c5cd
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x1003c614
push 0x13e9
push 0
push 0
push 0
push 0
push 0x17a9
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003c6fe
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
push 0
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov esi, eax
push 0
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov edi, dword [eax]
sub edi, dword [esi]
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
cmp dword [eax], edi
jle 0x1003c681
mov dword [ebp - 0x4d8], 1
jmp 0x1003c688
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0x573
jg 0x1003c6a0
mov dword [ebp - 0x5e4], 1
jmp 0x1003c6a7
and dword [ebp - 0x5e4], 0
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov esi, eax
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1003c6e2
mov dword [ebp - 0x3b0], 1
jmp 0x1003c6e9
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0xffff
jne 0x1003c6fe
and dword [ebp - 0x228], 0
jmp 0x1003c708
mov dword [ebp - 0x228], 1
push 1
lea ecx, [ebp - 0x71c]
call fcn.10009d00
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10009d00
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
je 0x1003c740
mov dword [ebp - 0x478], 1
jmp 0x1003c747
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x71c]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.10009ce4
lea eax, [ebp - 0x558]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.10047154
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x38], 0x3825
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x78c], 0x7785
mov dword [ebp - 0x19c], 0
jmp 0x1003c7c5
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x1003c7e1
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x810], 1
jmp 0x1003c7b8
cmp dword [ebp - 0x2c], 0
jne 0x1003c8b3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x794], eax
imul eax, dword [ebp - 0x2c], 0xffffffff
test eax, eax
jne 0x1003c80e
mov eax, 0x7e813a3d
test eax, eax
jne 0x1003c80e
and dword [ebp - 0x3b8], 0
jmp 0x1003c818
mov dword [ebp - 0x3b8], 1
imul eax, dword [ebp - 0x3b8], 0xd6
test eax, eax
jne 0x1003c835
cmp dword [ebp - 0x2c], 0
jne 0x1003c835
and dword [ebp - 0x524], 0
jmp 0x1003c83f
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x524]
jge 0x1003c859
cmp dword [ebp - 0x38], 0
jne 0x1003c859
and dword [ebp - 0x5ec], 0
jmp 0x1003c863
mov dword [ebp - 0x5ec], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x2c], 7
jle 0x1003c87e
mov dword [ebp - 0x3c0], 1
jmp 0x1003c885
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0xca70051
je 0x1003c89d
mov dword [ebp - 0x480], 1
jmp 0x1003c8a4
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x480], eax
je 0x1003cb59
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x5f4], 5
mov dword [ebp - 0x5cc], 0xfffffffc
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1003c8fd
push 0
push 0
push 0x43b
push 0x133a
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
cmp dword [ebp - 0x38], 0
je 0x1003cb22
cmp dword [ebp - 0x38], 0
je 0x1003c922
cmp dword [ebp - 0x98], 0
je 0x1003c922
mov dword [ebp - 0x5c0], 1
jmp 0x1003c929
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x2c]
jne 0x1003c94f
cmp dword [ebp - 0x38], 0
jne 0x1003c94f
and dword [ebp - 0x3c8], 0
jmp 0x1003c959
mov dword [ebp - 0x3c8], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3c8], eax
jg 0x1003c970
mov dword [ebp - 0x4e0], 1
jmp 0x1003c977
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0x2c9d
jge 0x1003c98f
mov dword [ebp - 0x254], 1
jmp 0x1003c996
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x254]
jge 0x1003c9b0
mov dword [ebp - 0x488], 1
jmp 0x1003c9b7
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x488]
jle 0x1003c9ce
mov dword [ebp - 0x3d8], 1
jmp 0x1003c9d5
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3d8], eax
jge 0x1003c9ef
mov dword [ebp - 0x510], 1
jmp 0x1003c9f6
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0x9227
jle 0x1003ca0e
mov dword [ebp - 0x3e0], 1
jmp 0x1003ca15
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3e0], eax
jg 0x1003ca2c
mov dword [ebp - 0x210], 1
jmp 0x1003ca33
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x210]
mov dword [ebp + eax - 0x810], ecx
cmp dword [ebp - 0x210], 0
jne 0x1003ca61
cmp dword [ebp - 0x238], 0
jne 0x1003ca61
and dword [ebp - 0x490], 0
jmp 0x1003ca6b
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x490]
je 0x1003ca88
cmp dword [ebp - 0x2c], 0
je 0x1003ca88
mov dword [ebp - 0x3e8], 1
jmp 0x1003ca8f
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3e8], eax
jge 0x1003cab3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x810], 0
jne 0x1003cab3
and dword [ebp - 0x4e8], 0
jmp 0x1003cabd
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x5f4]
add eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x238]
jne 0x1003cae3
cmp dword [ebp - 0x238], 0
jne 0x1003cae3
and dword [ebp - 0x3f0], 0
jmp 0x1003caed
mov dword [ebp - 0x3f0], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3f0], eax
je 0x1003cb04
mov dword [ebp - 0x498], 1
jmp 0x1003cb0b
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x498], eax
jge 0x1003cb22
mov dword [ebp - 0x3f8], 1
jmp 0x1003cb29
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0x3245e346
jle 0x1003cb41
mov dword [ebp - 0x51c], 1
jmp 0x1003cb48
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x5cc], eax
jmp 0x1003cee8
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x7b4], 0xb36fe085
mov dword [ebp - 0x5e0], 1
mov dword [ebp - 0x7bc], 0
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x7c4], 0xdd4f9520
mov dword [ebp - 0x76c], 0x4c35c241
mov dword [ebp - 0x5fc], 0x226d
cmp dword [ebp - 0x5fc], 0xaab
jge 0x1003cd1b
lea ecx, [ebp - 0x74c]
call fcn.100144a9
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x74c]
mov ecx, 0x1060d058
call fcn.10047800
lea ecx, [ebp - 0x74c]
call fcn.10009e1c
cmp eax, 7
jae 0x1003cc03
push 0x100319c7
mov edx, 0x10008af0
mov ecx, 0x1060cf38
call fcn.10016dcb
mov ecx, eax
call fcn.1002fbeb
and dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x74c]
call fcn.10009e1c
dec eax
mov dword [ebp - 0xa0], eax
jmp 0x1003cc2b
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1003cc73
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x74c]
call fcn.10015b7d
movsx eax, byte [eax]
cmp eax, 0x30
jne 0x1003cc71
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x1e4], 6
jne 0x1003cc71
jmp 0x1003cc73
jmp 0x1003cc1e
cmp dword [ebp - 0x1e4], 6
jge 0x1003cc97
push 0x100319c7
mov edx, 0x10008af0
mov ecx, 0x1060cf38
call fcn.10016dcb
mov ecx, eax
call fcn.1002fbeb
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x10c], eax
jmp 0x1003ccb2
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jle 0x1003ccf1
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x74c]
call fcn.10015b7d
movsx eax, byte [eax]
cmp eax, 0x31
jne 0x1003ccef
push 0x100319c7
mov edx, 0x10008af4
mov ecx, 0x1060cf38
call fcn.10016dcb
mov ecx, eax
call fcn.1002fbeb
jmp 0x1003cca5
push 0x100319c7
mov edx, 0x10008af0
mov ecx, 0x1060cf38
call fcn.10016dcb
mov ecx, eax
call fcn.1002fbeb
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x74c]
call fcn.10009c7e
mov dword [ebp - 0x7e8], 0x1f00bb6e
push 1
lea ecx, [ebp - 0x830]
call fcn.10009c88
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x7f0], 0xd5a0a0de
mov dword [ebp - 0x838], 4
mov dword [ebp - 0x840], 0xa0ede8b3
mov dword [ebp - 0x848], 0xffffffff
mov dword [ebp - 0x850], 0xfffffffd
mov dword [ebp - 0x858], 0x9958a82
mov dword [ebp - 0x860], 0xffffffff
mov dword [ebp - 0x868], 0xfc6c
mov dword [ebp - 0x7d8], 0xce4ac03
mov dword [ebp - 0x5d8], 0xc01a0776
mov dword [ebp - 0x7ec], 0x9de470d1
mov dword [ebp - 0x114], 0xca208381
push 3
lea ecx, [ebp - 0x820]
call fcn.10009c88
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x60], 0
jmp 0x1003cdcf
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1003cdeb
push dword [ebp - 0x60]
lea ecx, [ebp - 0x830]
call fcn.10009d00
mov dword [eax], 0x16cb
jmp 0x1003cdc8
mov dword [ebp - 0x60], 0
jmp 0x1003cdfb
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1003ce17
push dword [ebp - 0x60]
lea ecx, [ebp - 0x820]
call fcn.10009d00
mov dword [eax], 0x3ea3fee2
jmp 0x1003cdf4
mov eax, dword [ebp - 0x400]
dec eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x114], 0xa
jmp 0x1003ce3d
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffec
jle 0x1003ceca
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x83c], eax
mov eax, 0xa49d
sub eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x628], eax
jne 0x1003ce8b
mov dword [ebp - 0x4a0], 1
jmp 0x1003ce92
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0x11c]
jl 0x1003ceb2
mov dword [ebp - 0x408], 1
jmp 0x1003ceb9
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x5e0], eax
jmp 0x1003ce30
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x820]
call fcn.10009ce4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x830]
call fcn.10009ce4
and dword [ebp - 0x124], 0
jmp 0x1003cefe
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xf
jae 0x1003cf17
mov eax, dword [ebp - 0x124]
mov byte [ebp + eax - 0x558], 0
jmp 0x1003cef1
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x304], 0xfffffff9
mov dword [ebp - 0x780], 0xffffffff
push 1
lea ecx, [ebp - 0x63c]
call fcn.10009c88
mov byte [ebp - 4], 0x19
push 3
lea ecx, [ebp - 0x688]
call fcn.10009c88
mov byte [ebp - 4], 0x1a
push 2
lea ecx, [ebp - 0x6ac]
call fcn.10009c88
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x7f4], 0x8f0e43da
mov dword [ebp - 0x218], 0xffff
mov dword [ebp - 0x644], 0xa5b821bf
mov dword [ebp - 0x5e8], 0x5fe6
mov dword [ebp - 0x230], 0x1936efe4
mov dword [ebp - 0x14], 0
jmp 0x1003cfaa
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003cfc6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x63c]
call fcn.10009d00
mov dword [eax], 0xfffffff7
jmp 0x1003cfa3
mov dword [ebp - 0x14], 0
jmp 0x1003cfd6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003cfec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c8], 0x3418eb0b
jmp 0x1003cfcf
mov dword [ebp - 0x14], 0
jmp 0x1003cffc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003d018
push dword [ebp - 0x14]
lea ecx, [ebp - 0x688]
call fcn.10009d00
mov dword [eax], 2
jmp 0x1003cff5
mov dword [ebp - 0x14], 0
jmp 0x1003d028
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003d044
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6ac]
call fcn.10009d00
mov dword [eax], 0x9edb9cc5
jmp 0x1003d021
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x644], 0xb4f50f89
jae 0x1003d068
mov dword [ebp - 0x2d8], 1
jmp 0x1003d06f
and dword [ebp - 0x2d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x2d8], eax
je 0x1003d090
mov dword [ebp - 0x2dc], 1
jmp 0x1003d097
and dword [ebp - 0x2dc], 0
push 1
lea ecx, [ebp - 0x6ac]
call fcn.10009d00
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [eax]
jne 0x1003d0c9
push 0
lea ecx, [ebp - 0x688]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003d0c9
and dword [ebp - 0x2e4], 0
jmp 0x1003d0d3
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x2e4]
jge 0x1003d0fa
mov dword [ebp - 0x2ec], 1
jmp 0x1003d101
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x2ec], eax
jl 0x1003d11b
mov dword [ebp - 0x2f4], 1
jmp 0x1003d122
and dword [ebp - 0x2f4], 0
push 0
lea ecx, [ebp - 0x688]
call fcn.10009d00
mov ecx, dword [ebp - 0x2f4]
cmp ecx, dword [eax]
jge 0x1003d145
mov dword [ebp - 0x2fc], 1
jmp 0x1003d14c
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x304], eax
mov esi, dword [ebp - 0x304]
push 0
lea ecx, [ebp - 0x63c]
call fcn.10009d00
cmp esi, dword [eax]
jg 0x1003d17b
mov dword [ebp - 0x30c], 1
jmp 0x1003d182
and dword [ebp - 0x30c], 0
push 0
lea ecx, [ebp - 0x63c]
call fcn.10009d00
mov ecx, dword [ebp - 0x30c]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1003d1b7
push 1
lea ecx, [ebp - 0x6ac]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003d1b7
and dword [ebp - 0x314], 0
jmp 0x1003d1c1
mov dword [ebp - 0x314], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x314]
sub ecx, dword [ebp - 0x230]
cmp ecx, dword [ebp + eax - 0x5c8]
jg 0x1003d1e8
mov dword [ebp - 0x31c], 1
jmp 0x1003d1ef
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
add eax, 0xae8ce1f6
mov dword [ebp - 0x324], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x5c8], ecx
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
sub eax, 4
mov ecx, dword [ebp - 0x12c]
imul ecx, eax
cmp ecx, 0xfffffff8
jg 0x1003d242
mov dword [ebp - 0x32c], 1
jmp 0x1003d249
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x32c]
jg 0x1003d263
mov dword [ebp - 0x334], 1
jmp 0x1003d26a
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x334]
jl 0x1003d284
mov dword [ebp - 0x33c], 1
jmp 0x1003d28b
and dword [ebp - 0x33c], 0
push 0
lea ecx, [ebp - 0x63c]
call fcn.10009d00
mov ecx, dword [ebp - 0x33c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6ac]
call fcn.10009ce4
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x688]
call fcn.10009ce4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x63c]
call fcn.10009ce4
push 1
push 0
lea eax, [ebp - 0x8a0]
push eax
push dword [ebp - 0x344]
call fcn.1003e086
add esp, 0x10
mov dword [0x1060e080], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call fcn.10014750
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x134], 0
jmp 0x1003d31a
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x1003d336
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x6bc], 0xb1cecb45
jmp 0x1003d30d
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x70], 0
jmp 0x1003d34d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1003d383
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x1003d36a
push 0xaab
call dword [sym.imp.GDI32.dll_SaveDC]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6bc]
mov ecx, dword [ebp - 0x70]
mov dword [ebp + ecx*4 - 0x6bc], eax
jmp 0x1003d346
cmp dword [0x1060e080], 0
je 0x1003e073
mov dword [ebp - 0x90], 0x60477862
mov dword [ebp - 0x630], 0xffffffff
mov dword [ebp - 0x54], 0xc8f0d071
mov dword [ebp - 0x14c], 0xc9b996a5
mov dword [ebp - 0x13c], 0
jmp 0x1003d3ce
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x1003d3ea
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x880], 0x7f28
jmp 0x1003d3c1
mov dword [ebp - 0x90], 0xfffffffb
jmp 0x1003d403
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x16
je 0x1003d668
mov dword [ebp - 0x36c], 0xfffffff6
mov dword [ebp - 0x34c], 0x3ba20b95
mov dword [ebp - 0xa8], 0
push 1
lea ecx, [ebp - 0x6a0]
call fcn.10009c88
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x1f8], 0xffffffff
mov dword [ebp - 0x394], 0xc79ebef9
mov dword [ebp - 0x144], 0
jmp 0x1003d46f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1003d48e
push dword [ebp - 0x144]
lea ecx, [ebp - 0x6a0]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x1003d462
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0xa8]
jge 0x1003d4c6
mov dword [ebp - 0x354], 1
jmp 0x1003d4cd
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0xfffffff7
jae 0x1003d53b
cmp dword [ebp - 0x90], 0xebfb2c41
jne 0x1003d4ee
mov dword [ebp - 0x35c], 1
jmp 0x1003d4f5
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
dec eax
jne 0x1003d519
push 0
lea ecx, [ebp - 0x6a0]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003d519
and dword [ebp - 0x364], 0
jmp 0x1003d523
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x36c]
cmp eax, dword [ebp - 0xa8]
xor eax, eax
cmp eax, 0x6c1d
jge 0x1003d550
mov dword [ebp - 0x374], 1
jmp 0x1003d557
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x1003d632
push 0
lea ecx, [ebp - 0x6a0]
call fcn.10009d00
cmp dword [eax], 0
jne 0x1003d632
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x64c], 0xa9ef8169
push 7
pop eax
test eax, eax
je 0x1003d61d
cmp dword [ebp - 0xa8], 0
jne 0x1003d5d6
cmp dword [ebp - 0x5f0], 0
jne 0x1003d5c6
cmp dword [ebp - 0x90], 0
push 4
pop eax
test eax, eax
jne 0x1003d5d6
and dword [ebp - 0x37c], 0
jmp 0x1003d5e0
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1f8], eax
je 0x1003d5fd
mov dword [ebp - 0x384], 1
jmp 0x1003d604
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
sub eax, 0x4c63
je 0x1003d61d
mov dword [ebp - 0x38c], 1
jmp 0x1003d624
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x64c], eax
jmp 0x1003d63f
mov eax, dword [ebp - 0x394]
dec eax
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a0]
call fcn.10009ce4
jmp 0x1003d3f6
mov dword [ebp - 0x54], 0
jmp 0x1003d678
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1003d68e
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x880], 5
jmp 0x1003d671
mov eax, dword [ebp + 8]
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x20], 0xc68ec0ae
mov dword [ebp - 0x3f4], 0xb187b35f
mov dword [ebp - 0x3fc], 0x887c5c6a
mov dword [ebp - 0x154], 0
jmp 0x1003d6cb
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x1003d6e7
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x7cc], 0xf44401d1
jmp 0x1003d6be
mov dword [ebp - 0x20], 0x1d
jmp 0x1003d6f7
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff3
jge 0x1003d935
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x640], 0x1ece3051
mov dword [ebp - 0x1fc], 0x9cd4431f
mov dword [ebp - 0x790], 0
push 2
lea ecx, [ebp - 0x734]
call fcn.10009c88
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x5f8], 0x3d5943e2
mov dword [ebp - 0x15c], 0
jmp 0x1003d760
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1003d782
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x734]
call fcn.10009d00
mov dword [eax], 0xb445acee
jmp 0x1003d753
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x804], eax
push 0
lea ecx, [ebp - 0x734]
call fcn.10009d00
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x39c]
mov dword [ecx], eax
cmp dword [ebp - 0x5f8], 0
jne 0x1003d809
cmp dword [ebp - 0x3a4], 0
jne 0x1003d7d0
mov dword [ebp - 0x3ac], 1
jmp 0x1003d7d7
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3ac]
jne 0x1003d7ee
mov dword [ebp - 0x3b4], 1
jmp 0x1003d7f5
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3b4], eax
jl 0x1003d809
and dword [ebp - 0x3bc], 0
jmp 0x1003d813
mov dword [ebp - 0x3bc], 1
mov eax, dword [ebp - 0x3bc]
neg eax
cmp eax, dword [ebp - 0x1fc]
jl 0x1003d82f
mov dword [ebp - 0x3c4], 1
jmp 0x1003d836
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x3cc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax - 0x7cc], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3cc], eax
jle 0x1003d86f
mov dword [ebp - 0x3d4], 1
jmp 0x1003d876
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3d4], eax
jge 0x1003d88d
mov dword [ebp - 0x3dc], 1
jmp 0x1003d894
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x372585fa
jg 0x1003d8ac
mov dword [ebp - 0x3e4], 1
jmp 0x1003d8b3
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3e4], eax
je 0x1003d8ca
mov dword [ebp - 0x3ec], 1
jmp 0x1003d8d1
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
je 0x1003d90e
xor eax, eax
je 0x1003d90e
mov dword [ebp - 0x404], 1
jmp 0x1003d915
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x640], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x734]
call fcn.10009ce4
jmp 0x1003d6f0
mov dword [ebp - 0x20], 0
jmp 0x1003d945
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe9
jge 0x1003d97c
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1003d961
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1003d97a
push 0
push 0x181a
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x1003d93e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x24], 0xc68ec0ae
mov dword [ebp - 0x464], 0xb187b35f
mov dword [ebp - 0x46c], 0x887c5c6a
mov dword [ebp - 0x164], 0
jmp 0x1003d9d1
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x1003d9ed
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x7e0], 0xf44401d1
jmp 0x1003d9c4
mov dword [ebp - 0x24], 0x1d
jmp 0x1003d9fd
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff3
jge 0x1003dc3b
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x65c], 0x1ece3051
mov dword [ebp - 0x204], 0x9cd4431f
mov dword [ebp - 0x798], 0
push 2
lea ecx, [ebp - 0x704]
call fcn.10009c88
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x608], 0x3d5943e2
mov dword [ebp - 0x16c], 0
jmp 0x1003da66
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x1003da88
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x704]
call fcn.10009d00
mov dword [eax], 0xb445acee
jmp 0x1003da59
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x844], eax
push 0
lea ecx, [ebp - 0x704]
call fcn.10009d00
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x40c]
mov dword [ecx], eax
cmp dword [ebp - 0x608], 0
jne 0x1003db0f
cmp dword [ebp - 0x414], 0
jne 0x1003dad6
mov dword [ebp - 0x41c], 1
jmp 0x1003dadd
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x41c]
jne 0x1003daf4
mov dword [ebp - 0x424], 1
jmp 0x1003dafb
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x424], eax
jl 0x1003db0f
and dword [ebp - 0x42c], 0
jmp 0x1003db19
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x42c]
neg eax
cmp eax, dword [ebp - 0x204]
jl 0x1003db35
mov dword [ebp - 0x434], 1
jmp 0x1003db3c
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x43c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax - 0x7e0], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x43c], eax
jle 0x1003db75
mov dword [ebp - 0x444], 1
jmp 0x1003db7c
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x444], eax
jge 0x1003db93
mov dword [ebp - 0x44c], 1
jmp 0x1003db9a
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0x372585fa
jg 0x1003dbb2
mov dword [ebp - 0x454], 1
jmp 0x1003dbb9
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x454], eax
je 0x1003dbd0
mov dword [ebp - 0x45c], 1
jmp 0x1003dbd7
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
je 0x1003dc14
xor eax, eax
je 0x1003dc14
mov dword [ebp - 0x474], 1
jmp 0x1003dc1b
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x65c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call fcn.10009ce4
jmp 0x1003d9f6
mov dword [ebp - 0x24], 0
jmp 0x1003dc4b
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe9
jge 0x1003dc82
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1003dc67
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1003dc80
push 0
push 0x181a
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x1003dc44
push dword [ebp - 0x610]
push dword [ebp - 0x560]
call dword [0x1060e080]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x30], 0x97f6af11
mov dword [ebp - 0x30], 0
jmp 0x1003dcb1
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x16
jg 0x1003e06b
mov dword [ebp - 0x2a0], 0x25fcc58a
push 2
lea ecx, [ebp - 0x67c]
call fcn.10009c88
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x260], 6
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x214], 0xfffffff8
mov dword [ebp - 0x570], 0xde2caeab
mov dword [ebp - 0x4c], 0
jmp 0x1003dd1b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1003dd34
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x67c]
call fcn.10009d00
or dword [eax], 0xffffffff
jmp 0x1003dd14
mov dword [ebp - 0x4c], 0
jmp 0x1003dd44
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1003dd5a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6c4], 0x9a31c0a9
jmp 0x1003dd3d
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x174], 0x837
jne 0x1003dd87
cmp dword [ebp - 0x174], 0
je 0x1003dd87
mov dword [ebp - 0x258], 1
jmp 0x1003dd8e
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x258], eax
je 0x1003dda0
cmp dword [ebp - 0x30], 0
mov eax, dword [ebp - 0xb0]
neg eax
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x174]
jge 0x1003ddc8
mov dword [ebp - 0x268], 1
jmp 0x1003ddcf
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x268]
jne 0x1003ddf5
mov dword [ebp - 0x20c], 1
jmp 0x1003ddfc
and dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20c]
mov dword [ebp + eax - 0x6c4], ecx
cmp dword [ebp - 0x20c], 0xffffffff
jge 0x1003de24
mov dword [ebp - 0x270], 1
jmp 0x1003de2b
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0xf9c32812
jae 0x1003de43
mov dword [ebp - 0x278], 1
jmp 0x1003de4a
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x278]
cmp eax, 0xfffffff9
jne 0x1003de64
mov dword [ebp - 0x280], 1
jmp 0x1003de6b
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x280]
jl 0x1003de85
mov dword [ebp - 0x288], 1
jmp 0x1003de8c
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x288], eax
jl 0x1003dea3
mov dword [ebp - 0x290], 1
jmp 0x1003deaa
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x290], eax
je 0x1003dec4
cmp dword [ebp - 0x30], 0
jne 0x1003dec4
and dword [ebp - 0x568], 0
jmp 0x1003dece
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x570], 0xa2c6eb81
jae 0x1003dee6
mov dword [ebp - 0x298], 1
jmp 0x1003deed
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x298]
jle 0x1003df04
mov dword [ebp - 0x2b0], 1
jmp 0x1003df0b
and dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2a0], 0x7b04
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a8], eax
push 1
lea ecx, [ebp - 0x67c]
call fcn.10009d00
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x2b0]
jle 0x1003df50
mov dword [ebp - 0x2b8], 1
jmp 0x1003df57
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
sub eax, 0x47f9
cmp eax, dword [ebp - 0xb0]
jg 0x1003df76
mov dword [ebp - 0x2c0], 1
jmp 0x1003df7d
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0x66d9
je 0x1003df95
mov dword [ebp - 0x2c8], 1
jmp 0x1003df9c
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0xffff
jb 0x1003dfb4
mov dword [ebp - 0x2d0], 1
jmp 0x1003dfbb
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0
je 0x1003dffc
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x1003dfe0
push 0x18e7
push 0x33f
call dword [sym.imp.GDI32.dll_SetROP2]
cmp dword [ebp - 0x214], 0
je 0x1003dffa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.10009ce4
jmp 0x1003e06b
jmp 0x1003e046
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x1003e046
push 0
push 0x9b8
push 0
push 0
push 0x1571
push 0x1efb
push 0xb70
push 0x1131
push 0x20fd
push 0xa52
push 0xa01
push 0x171f
push 0x476
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6c4], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.10009ce4
jmp 0x1003dcaa
mov eax, dword [ebp - 0x578]
jmp 0x1003e075
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret