Function at 0x10040141
Capabilities:
Check os version
Encode data using xor
Encrypt data using speck

Disassembly:
mov eax, 0x1005eedc
call fcn.1005dc70
sub esp, 0x2b4
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x50], ecx
inc edi
push edi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x40], edx
call fcn.10011d78
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x30], 0xc0c7fd57
mov dword [ebp - 0x20], ebx
jmp 0x1004019e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0x6192
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004018b
mov dword [ebp - 0x18], ebx
jmp 0x100401c9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100401c6
push ebx
push 0x12bd
push 0x2ba
push 0x160f
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100401a8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
add ecx, dword [eax]
cmp ecx, 0xfffffffc
jle 0x10040217
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10040219
mov eax, edi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x30], eax
call fcn.10011dfa
mov eax, dword [0x10607f10]
test al, 1
jne 0x100402ba
or eax, edi
mov dword [0x10607f10], eax
push ebx
mov dword [ebp - 4], ebx
push ebx
mov dword [0x10607f40], ebx
mov dword [0x10607f44], ebx
call fcn.10014374
mov dword [0x10607f40], eax
mov dword [0x10607f48], ebx
mov dword [0x10607f50], ebx
mov byte [ebp - 4], 2
mov ecx, 0x10607f48
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x218]
mov dword [0x10607f5c], 0x3f800000
push eax
mov dword [0x10607f4c], ebx
call fcn.1001414c
push 0x1005f21e
mov dword [0x10607f54], 7
mov dword [0x10607f58], 8
call fcn.10048995
or dword [ebp - 4], 0xffffffff
pop ecx
push 2
pop esi
mov dword [ebp - 0x14], 0x99ac7894
lea ecx, [ebp - 0x184]
push 4
call fcn.10011d78
push 3
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x20], ebx
jmp 0x100402f6
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0xb57e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100402e3
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edx
jg 0x100403d8
mov dword [ebp - 0x18], 0xac196a16
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x184]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x18], ebx
jmp 0x100403c0
push esi
lea ecx, [ebp - 0x1c0]
call fcn.10011d78
mov dword [ebp - 0x20], ebx
jmp 0x10040357
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x8ae5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10040344
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1004036c
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x30], eax
cmp dword [eax + 4], ebx
je 0x100403a2
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x30]
setge dl
xor eax, eax
cmp edx, dword [ecx + 4]
mov ecx, edi
setge al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x18]
jne 0x100403a4
mov ecx, ebx
xor eax, eax
cmp ecx, 0xc5b6
lea ecx, [ebp - 0x1c0]
setle al
mov dword [ebp - 0x30], eax
call fcn.10011dfa
inc dword [ebp - 0x18]
push 3
pop eax
cmp dword [ebp - 0x18], eax
jle 0x10040333
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1004030b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
call fcn.10011dfa
imul eax, dword [ebp - 0x50], 0x2710
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
call fcn.10042118
push 3
lea ecx, [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10011d78
push 3
mov dword [ebp - 0x18], 0xcdf98a59
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10040431
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0x4e1a3622
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1004041e
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100404a6
mov dword [ebp - 0x24], 0xb44cf59
mov dword [ebp - 0x14], 0xd40a1650
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
push 0
cmp dword [ecx + edx*4], ebx
pop ecx
setne cl
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1004049c
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x10040499
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x108]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x14]
jns 0x10040482
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1004047a
dec dword [ebp - 0x18]
jns 0x1004043e
lea ecx, [ebp - 0x108]
call fcn.10011dfa
cmp dword [ebp - 0x34], 0
je 0x1004097b
push 3
lea ecx, [ebp - 0xb8]
call fcn.10011d78
mov dword [ebp - 4], 4
lea eax, [ebp - 0x234]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bf20]
lea ecx, [ebp - 0xac]
push eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x14], 0xffffffff
push eax
push ebx
movdqu xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call fcn.10014e81
push 3
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10040534
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0x77862fd4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10040521
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1004066e
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x38], 0xffffffff
push edi
call fcn.10011d78
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], ebx
jmp 0x1004057e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004056f
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x100405d2
mov ebx, dword [ebp - 0xac]
mov dword [ebp - 0x40], 0xba20b95a
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x14]
neg edi
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb8]
sbb edi, edi
mov edx, dword [ebp - 0xb8]
inc edi
push 2
mov eax, dword [eax + ecx*4]
xor ecx, ecx
cmp eax, edi
mov dword [edx + esi*4], eax
pop esi
setle cl
mov dword [ebx + 0xc], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10040591
xor edi, edi
xor ebx, ebx
inc edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
cmp dword [eax + ecx*4], ebx
je 0x10040621
push edi
lea ecx, [ebp - 0x190]
call fcn.10011d78
mov dword [ebp - 0x20], ebx
jmp 0x10040604
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0x184dcc80
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100405f1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x190]
mov dword [eax], ecx
lea ecx, [ebp - 0x190]
call fcn.10011dfa
jmp 0x10040656
mov dword [ebp - 0x38], 0xc41a
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1004064b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x154], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1004063e
dec dword [ebp - 0x154]
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 5
call fcn.10011dfa
dec dword [ebp - 0x14]
jns 0x10040545
lea ecx, [ebp - 0xac]
call fcn.10011dfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.10011dfa
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], 0x90611bc3
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2c], 0x57d4
cmp dword [ebp - 0x2c], 0x5869
mov dword [ebp - 0x74], eax
jle 0x100406e7
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x40], ebx
mov eax, ebx
mov ecx, 0x10606d98
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10011b50
inc ebx
cmp ebx, 0x1b99
jl 0x100406b3
inc edi
push 0
pop ebx
cmp edi, 0x3e54
jl 0x100406b0
inc esi
cmp esi, 0x5fac
jl 0x100406ae
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0x9f32f520
mov dword [ebp - 4], 7
cmp dword [ebp - 0x2c], 0x5659
jge 0x1004070d
mov edx, 0x1000ba44
mov ecx, 0x10606d98
call fcn.10014461
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10040749
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0x1265ab3e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1004073b
mov dword [ebp - 0x18], ebx
jmp 0x10040761
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], 0x80c3414b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10040753
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
add eax, edx
cmp eax, 0x4d9e
mov eax, dword [ebp - 0x48]
push 0
setl cl
imul edx, ecx, 0xffff
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
sete cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
setns dl
cmp eax, ecx
push 0
pop eax
setge al
imul eax, edx
neg eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x40], eax
sete cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x44], 0x5d67
cmp dword [ebp - 0x44], 0x5dc0
jle 0x10040840
mov esi, ebx
mov eax, esi
mov dword [ebp - 0x3c], 0x2216
mov dword [ebp - 0x2c], eax
mov edi, eax
mov ebx, 0x5f68
mov eax, edi
mov ecx, 0x10606d98
cdq
push edx
push eax
call fcn.10011b50
dec edi
dec ebx
jne 0x10040815
mov eax, dword [ebp - 0x2c]
dec eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
jne 0x1004080e
inc esi
cmp esi, 0x4d86
jl 0x10040802
xor edi, edi
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 9
cmp dword [ebp - 0x44], 0x5ad7
jge 0x10040880
mov edx, 0x1000ba70
mov ecx, 0x10606d98
call fcn.10014461
jmp 0x10040880
xor edx, edx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x58b0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
setle dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
dec edx
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0x48]
setge cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ebx
jmp 0x10040971
mov dword [ebp - 0x40], 0xbd9f019d
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
sub edx, 0x56e035d6
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10040919
jmp 0x1004202e
mov dword [ebp - 0x14], 0x638
cmp dword [ebp - 0x14], 0x7df
jle 0x100409f9
mov dword [ebp - 0x24], ebx
mov ecx, ebx
mov dword [ebp - 0x20], 0x7494
mov dword [ebp - 0x44], ecx
mov eax, ecx
mov dword [ebp - 0x3c], 0x3b41
mov dword [ebp - 0x2c], eax
cdq
lea ecx, [ebp - 0x280]
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100409be
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x280]
call fcn.100122f8
mov eax, dword [ebp - 0x2c]
dec eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
jne 0x100409a6
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
add ecx, eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x44], ecx
jne 0x1004099a
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x4f9
jl 0x1004098e
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x14], 0x32b
jge 0x10040a14
push 0x1000bae8
call fcn.100489bf
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x24], ebx
push 3
call fcn.10011d78
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x18], ebx
jmp 0x10040a45
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10040a34
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10040a65
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x19c]
mov dword [eax + ecx*4], 0xd9cd4431
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10040a52
mov dword [ebp - 0x18], 0x1b3f
cmp dword [ebp - 0x18], 0x1d2a
jle 0x10040b08
push 0x24a9
push ebx
push 0x25f6
push 0x1950
push ebx
push 0x1441
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x44], ebx
cdq
idiv ecx
mov dword [ebp - 0x3c], 0x5862
mov eax, edx
mov dword [ebp - 0x2c], eax
cdq
lea ecx, [ebp - 0x268]
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10040acb
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x268]
call fcn.100122f8
mov eax, dword [ebp - 0x2c]
dec eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
jne 0x10040ab3
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x44], ecx
cmp ecx, 0x1bd0
jl 0x10040aa4
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x1246
jl 0x10040a9f
mov dword [ebp - 0x20], 6
cmp dword [ebp - 0x20], 0xffffffec
jle 0x10040b71
mov edi, dword [ebp - 0x19c]
mov dword [ebp - 0x14], 0x53bc
xor edx, edx
mov dword [ebp - 0x30], 0xa530
mov dword [ebp - 0x14c], ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x148]
jne 0x10040b47
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x51e
setg al
mov dword [edi + 4], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
jg 0x10040b1b
xor edi, edi
inc edi
cmp dword [ebp - 0x18], 0x1836
jge 0x10040b85
push 0x1000bb40
call fcn.100489bf
pop ecx
mov dword [ebp - 0x24], ebx
jmp 0x10040b9d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10040b9a
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xd
jle 0x10040b8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.10011dfa
mov eax, dword [0x10607f10]
test al, 2
jne 0x10040c49
or eax, esi
mov dword [0x10607f10], eax
push ebx
mov dword [ebp - 4], 0x10
push ebx
mov dword [0x10607f20], ebx
mov dword [0x10607f24], ebx
call fcn.10014374
mov dword [0x10607f20], eax
mov dword [0x10607f28], ebx
mov dword [0x10607f30], ebx
mov byte [ebp - 4], 0x12
mov ecx, 0x10607f28
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xd0]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1fc]
mov dword [0x10607f3c], 0x3f800000
push eax
mov dword [0x10607f2c], ebx
call fcn.1001414c
push 0x1005f219
mov dword [0x10607f34], 7
mov dword [0x10607f38], 8
call fcn.10048995
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
lea ecx, [ebp - 0x138]
call fcn.10011d78
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x14], 0xffffffff
push edi
call fcn.10011d78
push 2
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x10040c8e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10040c7b
mov dword [ebp - 0x28], ebx
jmp 0x10040ca6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10040c98
mov dword [ebp - 0x28], ebx
jmp 0x10040cc3
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1cc]
mov dword [eax + ecx*4], 0x54ba4fda
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10040cb0
mov dword [ebp - 0x14], 0x87223b1c
mov eax, dword [ebp - 0x14]
push 2
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x14], ebx
pop esi
cmp dword [ebp - 0x14], 0x1b
je 0x10040e59
mov dword [ebp - 0x28], 0xdfcc86f8
mov dword [ebp - 0x3c], 0x2c0a
cmp dword [ebp - 0x3c], 0x2c3e
jle 0x10040d57
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
shl eax, cl
lea ecx, [ebp - 0x2b0]
cdq
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10040d26
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2b0]
call fcn.100122f8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x349
jl 0x10040d0c
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x3a59
jl 0x10040d07
mov dword [ebp - 0x38], 0x1ebdc590
cmp dword [ebp - 0x3c], 0x29e4
jge 0x10040d72
push 0x1000bb58
call fcn.100489bf
pop ecx
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x20], ebx
jmp 0x10040d8f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x204], 0x17f72684
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10040d7e
mov dword [ebp - 0x28], ebx
jmp 0x10040da9
mov dword [ebp - 0x30], 0xdd4d14b7
mov dword [ebp - 0x5c], edi
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
je 0x10040d99
mov edx, dword [ebp - 0x28]
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x28]
jl 0x10040de3
mov eax, dword [ebp - 0x138]
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x5c], eax
sete cl
cmp ecx, dword [ebp - 0x28]
mov ecx, ebx
je 0x10040de5
mov ecx, edi
mov eax, dword [ebp - 0x1cc]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x28]
cmp eax, 0x92e0
mov eax, dword [ebp - 0x138]
setle cl
xor edx, edx
cmp ecx, dword [eax + 4]
setne dl
dec edx
je 0x10040e39
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10040e51
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x10040e51
mov dword [ebp - 0x2c], 0x4a037a76
mov dword [ebp - 0x28], ebx
jmp 0x10040e4b
inc dword [ebp - 0x2c]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jle 0x10040e45
inc dword [ebp - 0x14]
jmp 0x10040cdb
lea ecx, [ebp - 0x1cc]
call fcn.10011dfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10011dfa
xorps xmm0, xmm0
lea ecx, [ebp - 0x120]
movdqu xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x14], edi
push esi
call fcn.10011d78
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0xfff6
mov dword [ebp - 0x20], ebx
jmp 0x10040ebc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x6e87
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10040ea9
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xfffffffc
jle 0x10040f34
push 3
pop esi
push esi
lea ecx, [ebp - 0x1b4]
call fcn.10011d78
mov dword [ebp - 0x20], ebx
jmp 0x10040ef1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0xfe1ca2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10040ede
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x30], eax
mov dword [eax + 8], ebx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10040f18
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov eax, dword [ebp - 0x30]
inc dword [eax + 8]
cmp dword [eax + 8], edi
jle 0x10040f02
lea ecx, [ebp - 0x1b4]
call fcn.10011dfa
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jg 0x10040ecd
mov esi, dword [ebp - 0x120]
xor ecx, ecx
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x120]
sete dl
xor ecx, ecx
cmp dword [eax], 0xb060
setne cl
sub ecx, edx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x8a277ebd
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esi + 4]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xfffffffb
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
call fcn.10011dfa
lea eax, [ebp - 0x50]
push eax
call fcn.1004217a
mov esi, dword [eax]
mov dword [ebp - 0x14], 0x6cc9ca31
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x30], 2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
mov dword [ebp - 0x20], esi
je 0x10040fe1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 9
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
mov eax, edi
cmp eax, dword [ebp - 0x14]
jle 0x1004101c
cmp dword [ebp - 0x18], ebx
jne 0x1004101f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0x21dd
setg cl
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, 0xffff
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov dl, byte [ebp + 0xc]
setle cl
mov dword [ebp - 0x30], ecx
test dl, dl
jne 0x1004105d
test esi, esi
jne 0x1004185d
mov dword [ebp - 0x24], 0xf4288a13
mov dword [ebp - 0x3c], 0x168aa2
push 3
mov dword [ebp - 0x2c], 0x92e3f915
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1004108b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x250], 0x1f782a18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1004107a
mov dword [ebp - 0x18], ebx
jmp 0x100410a6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10041095
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0xc8], ebx
push eax
call fcn.10035ed4
mov esi, eax
lea edi, [ebp - 0xa0]
pop ecx
push 2
lea ecx, [ebp - 0xf0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
mov dword [ebp - 0x14], edi
call fcn.10011d78
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0xfff6
mov dword [ebp - 0x24], ebx
jmp 0x10041137
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0x6e87
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10041124
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xfffffffc
jle 0x100411b0
push 3
pop esi
push esi
lea ecx, [ebp - 0x160]
call fcn.10011d78
mov dword [ebp - 0x24], ebx
jmp 0x1004116d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xfe1ca2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1004115a
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x30], eax
mov dword [eax + 8], ebx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041194
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov eax, dword [ebp - 0x30]
inc dword [eax + 8]
cmp dword [eax + 8], edi
jle 0x1004117e
lea ecx, [ebp - 0x160]
call fcn.10011dfa
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jg 0x10041149
mov esi, dword [ebp - 0xf0]
xor ecx, ecx
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf0]
sete dl
xor ecx, ecx
cmp dword [eax], 0xb060
setne cl
sub ecx, edx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x8a277ebd
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esi + 4]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
or esi, 0xffffffff
imul eax, ecx, 0xfffffffb
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], esi
call fcn.10011dfa
cmp byte [ebp + 0xc], 0
je 0x1004135e
cmp dword [ebp - 0x98], 0
je 0x1004135e
mov dword [ebp - 0x14], 5
lea ecx, [ebp - 0xfc]
push 3
call fcn.10011d78
mov dword [ebp - 0x3c], 0xeb9e9d60
mov dword [ebp - 0x2c], 0x20348f4a
push 3
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], ebx
pop edx
jmp 0x1004127f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0x278fa8f9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1004126c
cmp dword [ebp - 0x14], ebx
jne 0x1004129b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax + 8], ecx
mov eax, ebx
test ecx, ecx
je 0x1004129d
mov eax, edi
mov ecx, dword [ebp - 0x14]
add ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setle dl
sub edx, 0xd15de05d
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, 9
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xfc]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xfc]
call fcn.10011dfa
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x14], ebx
je 0x1004131f
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041355
push ebx
push 0x1fee
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x10041355
mov dword [ebp - 0x24], ebx
jmp 0x10041335
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd8], 0xfff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10041324
mov dword [ebp - 0x14], ebx
jmp 0x10041350
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd8], 0x2604
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1004133f
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x1004185d
cmp dword [ebp - 0xa0], ecx
jle 0x1004185d
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x18], 0xb3e713e1
mov dword [ebp - 0x30], 0x411d7fea
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xa5d732ad
mov dword [ebp - 0x38], 0xf4a7d2ae
mov dword [ebp - 0x38], 0xa0949511
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x2c], 0xda87b8b0
mov dword [ebp - 0x38], edi
push 2
mov dword [ebp - 0x3c], 0x85c2
mov dword [ebp - 0x24], ebx
pop esi
jmp 0x10041474
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x44], ebx
push esi
call fcn.10011d78
mov dword [ebp - 0x14], ebx
jmp 0x100413fc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100413ed
mov dword [ebp - 0x14], ebx
jmp 0x10041460
mov dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x14]
neg eax
jne 0x1004143b
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
je 0x10041434
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
cmp dword [ebp - 0x44], ebx
je 0x1004143d
mov ecx, edi
mov eax, dword [ebp - 0x44]
imul eax, ecx
test eax, eax
jne 0x1004144c
cmp dword [ebp - 0x44], ebx
je 0x10041453
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x10041455
mov ecx, ebx
mov eax, dword [ebp - 0x1a8]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jle 0x10041406
lea ecx, [ebp - 0x1a8]
call fcn.10011dfa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
je 0x100413d6
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
jne 0x10041497
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x10041499
mov edx, edi
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, edx
cmp eax, ecx
jg 0x100414b7
mov eax, edi
cmp dword [ebp - 0x38], ebx
jne 0x100414b9
mov eax, ebx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x18], 0xf5a9c4c8
mov dword [ebp - 0x2c], 0x4a754320
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x14], 0xcd49598a
push esi
call fcn.10011d78
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1ec], edi
mov dword [ebp - 0x1e8], edi
mov dword [ebp - 0x1e4], edi
mov dword [ebp - 0x1e0], edi
mov dword [ebp - 0x24], ebx
jmp 0x10041521
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x27fa3dfa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1004150e
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1004153b
push ebx
push 0x1a71
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xc821
setne cl
cmp ecx, 0x6712
jl 0x10041553
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], ebx
je 0x1004155f
mov edx, edi
cmp dword [ebp - 0x14], ebx
jne 0x10041561
mov edx, ebx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
add ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax + 4], ecx
mov eax, edi
inc dword [ebp - 0x2c]
cmp ecx, edx
cmovne eax, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x1004158d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xca8c98aa
setne al
xor edx, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
lea ecx, [ebp - 0x178]
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1ec], edi
call fcn.10011dfa
mov dword [ebp - 0x28], 0xaf43b7c7
mov dword [ebp - 0x38], 0xa3d7f191
cmp dword [ebp - 0x28], ebx
je 0x100416cc
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x3c], 0x5b78
cmp dword [ebp - 0x3c], 0x5dcf
jle 0x1004166f
push 0xe27
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, esi
mov dword [ebp - 0x38], eax
mov esi, eax
mov edi, ebx
sar esi, cl
mov dword [ebp - 0x38], ebx
lea eax, [ebx + edi]
mov ecx, 0x10606d98
xor eax, esi
cdq
push edx
push eax
call fcn.10011b50
inc ebx
cmp ebx, 0x10e7
jl 0x10041628
inc edi
push 0
pop ebx
cmp edi, 0x261b
jl 0x10041625
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x56b9
jl 0x1004161a
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x6568
jl 0x10041615
xor edi, edi
inc edi
cmp byte [ebp - 0x19], 0
je 0x1004167c
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x3c], 0x57d1
jge 0x1004169b
mov edx, 0x1000bb88
mov ecx, 0x10606d98
call fcn.10014461
or dword [ebp - 4], 0xffffffff
jmp 0x1004175b
mov dword [ebp - 0x30], 0xfff7
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x10041705
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100416f2
push edi
push ebx
push 0xf39
call dword [sym.imp.GDI32.dll_SelectPalette]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041702
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x100416dc
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
push 0xfffffffffffffffc
setle dl
imul edx, dword [ebp - 0x28]
pop esi
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub esi, edx
cmp eax, esi
setle cl
imul ecx, ecx, 0xfa3d
cmp dword [ebp - 0x30], 0xe6f7fbf2
sbb eax, eax
xor edx, edx
neg eax
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x9c], 0
mov dword [ebp - 0x28], eax
je 0x1004185d
mov dword [ebp - 0x14], 0xa2c7c8a6
lea ecx, [ebp - 0x114]
push edi
call fcn.10011d78
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x20], ebx
jmp 0x100417ad
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0x6ae49a2f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004179a
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 5
setg al
cmp dword [ebp - 0x14], eax
jge 0x10041822
cmp dword [ebp - 0x14], 0xf4f3
jl 0x100417d8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x114]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, 0x955a
setne cl
imul ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x10041814
mov eax, dword [ebp - 0x114]
cmp dword [eax], ebx
mov eax, ebx
je 0x10041816
mov eax, edi
cmp eax, edi
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, edi
jne 0x10041824
mov eax, ebx
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x114]
setge dl
mov dword [ebp - 0x38], edx
call fcn.10011dfa
mov ecx, dword [ebp - 0x9c]
call fcn.100400f0
mov esi, eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x20], esi
call fcn.1004217a
mov dword [eax], esi
lea ecx, [ebp - 0xa0]
call fcn.1003c0c5
mov dword [ebp - 0x2c], 0x4516
cmp dword [ebp - 0x2c], 0x4798
jle 0x100418a0
mov esi, ebx
mov edi, esi
mov ebx, 0x14ef
mov eax, edi
mov ecx, 0x10606d98
cdq
push edx
push eax
call fcn.10011b50
dec edi
dec ebx
jne 0x10041881
inc esi
cmp esi, 0x284e
jl 0x1004187a
xor edi, edi
inc edi
push 2
lea ecx, [ebp - 0xc4]
call fcn.10011d78
mov dword [ebp - 4], 0x1b
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x24], 0x9b996a53
mov eax, 0xb64d07dd
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], eax
mov eax, 0x38299fa9
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
push 4
call fcn.10011d78
mov dword [ebp - 0x30], 0xfffe
mov dword [ebp - 0x38], 0xd9132e88
mov dword [ebp - 0x18], ebx
jmp 0x10041928
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10041915
mov dword [ebp - 0x18], ebx
jmp 0x10041943
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10041933
mov ecx, dword [ebp - 0xc4]
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ecx + 4], ebx
setne al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1d0], edx
mov esi, dword [eax]
xor eax, eax
cmp edx, 0xc75d
setne al
xor ecx, ecx
add eax, 0x8bbd188
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, edx
setne al
imul eax, eax, 7
sub eax, esi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x12c]
cmp dword [eax], ebx
je 0x100419e0
mov eax, dword [ebp - 0x90]
xor ecx, ecx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
cmp eax, 0xffff
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, edi
setg cl
sub ecx, 0x77e2
jne 0x100419e2
mov eax, ebx
xor edx, edx
cmp eax, 0x2ccf
mov eax, dword [ebp - 0xc4]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
mov edx, dword [ebp - 0x38]
setl cl
cmp ecx, dword [edx + 4]
jl 0x10041a0d
mov eax, dword [ebp - 0x12c]
mov esi, ebx
cmp dword [eax], ebx
je 0x10041a0f
mov esi, edi
mov eax, dword [ebp - 0x90]
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, dword [edx + 4]
setg al
xor ecx, ecx
cmp eax, 0x456014ef
setge cl
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x12c]
call fcn.10011dfa
lea ecx, [ebp - 0xc4]
call fcn.10011dfa
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x2c], 0x4270
jge 0x10041a6c
mov edx, 0x1000bc18
mov ecx, 0x10606d98
call fcn.10014461
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
push 3
pop esi
jne 0x10041ec7
test eax, eax
je 0x10041ec7
push 4
lea ecx, [ebp - 0x68]
call fcn.10011d78
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x28], 0x6fe7d8a8
mov dword [ebp - 0x14], 0x110c
mov dword [ebp - 0x2c], 0x46e1
mov dword [ebp - 0x38], 0xefc6e20b
mov dword [ebp - 0x34], ebx
jmp 0x10041aef
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10041adf
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], esi
jg 0x10041c54
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x38], eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bf00]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x80], ebx
push eax
push ebx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x7c], ebx
movdqu xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x78], ebx
call fcn.10014e81
mov dword [ebp - 0x18], edi
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x68]
mov ecx, dword [eax + ecx*4]
mov eax, 0x57ea
mov dword [edx + esi*4], ecx
sub eax, ecx
mov esi, dword [ebp - 0x80]
cmp eax, dword [esi + 8]
jle 0x10041b65
mov eax, dword [ebp - 0x18]
mov eax, edi
jmp 0x10041b67
mov eax, ebx
xor ecx, ecx
cmp eax, 0xfffffff6
setg cl
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
add edx, 9
cmp edx, dword [esi + 8]
mov edx, dword [ebp - 0x38]
setge cl
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp dword [edx + 8], eax
mov eax, dword [ebp - 0x14]
sete cl
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
cmp dword [eax + ecx*4], ebx
je 0x10041be6
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0x1c
jmp 0x10041bde
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xffffffe9
jmp 0x10041bd5
inc dword [ebp - 0x30]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jne 0x10041bcf
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
je 0x10041bc3
jmp 0x10041c3d
mov dword [ebp - 0x18], 0x1d
jmp 0x10041c21
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10041c19
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041c0f
push 0x1966
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x30], 0x437ffeac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x10041bfb
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
je 0x10041bef
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041c3d
push ebx
push 0x91c
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
lea ecx, [ebp - 0x80]
call fcn.10011dfa
inc dword [ebp - 0x28]
push 3
pop esi
cmp dword [ebp - 0x28], esi
jle 0x10041b07
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, 0xfffffffb
jb 0x10041c6d
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x14], ebx
je 0x10041c70
mov dword [ebp - 0x30], edi
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
setl cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x68]
or dword [ebp - 4], 0xffffffff
call fcn.10011dfa
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
call fcn.10040137
mov dword [ebp - 0x14], 0xd29be1d9
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x34], ebx
jmp 0x10041cc9
mov ecx, dword [ebp - 0x34]
mov dword [ebp + ecx*4 - 0x144], 0x648261f9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10041cb8
push 2
mov dword [ebp - 0x14], ebx
pop esi
cmp dword [ebp - 0x14], esi
jg 0x10041eb0
mov dword [ebp - 0x24], 0x72d9ee1c
xor edx, edx
mov dword [ebp - 0x20], 0xcf4c59cd
mov dword [ebp - 0x20], 0xdf3d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setle dl
push 3
pop ecx
cmp ecx, eax
sbb eax, eax
add eax, 0x47169b96
sub edx, eax
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x24]
je 0x10041e07
mov dword [ebp - 0x20], 0x5990
cmp dword [ebp - 0x20], 0x59d8
jle 0x10041db7
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov ecx, eax
mov dword [ebp - 0x44], 0x40ba
mov dword [ebp - 0x3c], ecx
mov eax, ecx
mov dword [ebp - 0x30], 0x6f89
mov dword [ebp - 0x40], eax
cdq
lea ecx, [ebp - 0x298]
push edx
push eax
call fcn.1000d3ae
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10041d6e
mov eax, dword [eax]
push eax
call fcn.100489bf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x298]
call fcn.100122f8
mov eax, dword [ebp - 0x40]
inc eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
jne 0x10041d56
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
add ecx, eax
dec dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
jne 0x10041d4a
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x5abb
mov eax, dword [ebp - 0x2c]
jl 0x10041d3e
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x5c21
jl 0x10041d3b
cmp dword [ebp - 0x20], 0x58ad
jge 0x10041dcb
push 0x1000bc54
call fcn.100489bf
pop ecx
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x14]
imul edx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x144]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
mov dword [ebp + eax*4 - 0x144], edx
jmp 0x10041ea8
push esi
lea ecx, [ebp - 0x16c]
call fcn.10011d78
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], ebx
jmp 0x10041e2e
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10041e1b
mov eax, dword [ebp - 0x16c]
xor ecx, ecx
cmp dword [eax + 4], ebx
setne cl
imul eax, ecx, 0x800f
cmp eax, 0x4d81
jge 0x10041e55
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x10041e57
mov eax, ebx
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], edx
xor edx, edx
cmp dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
imul eax, ecx, 0xa750
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x40], eax
call fcn.10011dfa
inc dword [ebp - 0x14]
jmp 0x10041cd4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x54]
push eax
call fcn.10042118
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x30], 0x6c52
cmp dword [ebp - 0x30], 0x6ef2
jle 0x10041f3a
push ebx
push 0x10a9
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
and eax, esi
lea ecx, [edi + ebx]
xor eax, ecx
mov ecx, 0x10606d98
cdq
push edx
push eax
call fcn.10011b50
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x112
jl 0x10041ef2
inc esi
push 0
pop ebx
cmp esi, 0x7fdf
jl 0x10041eea
inc edi
cmp edi, 0x2abe
jl 0x10041ee8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x7b2a
jl 0x10041ee6
xor edi, edi
inc edi
mov dword [ebp - 4], 0x21
cmp dword [ebp - 0x30], 0x6b04
jge 0x10041f59
mov edx, 0x1000bc90
mov ecx, 0x10606d98
call fcn.10014461
or dword [ebp - 4], 0xffffffff
push 3
pop esi
mov dword [ebp - 0x24], 0x8cff0ea7
lea ecx, [ebp - 0x224]
push 4
call fcn.10011d78
mov dword [ebp - 0x34], ebx
jmp 0x10041fad
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x224]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10041f9e
mov dword [ebp - 0x24], ebx
jmp 0x1004201d
mov dword [ebp - 0x20], 0xb108f825
mov dword [ebp - 0x38], 0x1d21f1eb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041fd6
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10042014
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], ebx
jmp 0x1004200c
mov dword [ebp - 0x40], 0xc17e5c28
dec dword [ebp - 0x40]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042009
push 0x7f8
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10041feb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
je 0x10041fdf
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jge 0x10041fb8
lea ecx, [ebp - 0x224]
call fcn.10011dfa
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret