Function at 0x10048f78
Capabilities:
Contain obfuscated stackstrings
Create thread
Get common file path
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007375c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xf80
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x310], 0x4b9a
mov dword [ebp - 0x8dc], 0x5c6f8b8a
mov dword [ebp - 0x8ec], 0xeed1e12a
imul eax, dword [ebp - 0x8e4], 0
test eax, eax
jne 0x1004900a
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x10048fec
cmp dword [ebp - 0x310], 0
je 0x10048fec
mov dword [ebp - 0x8a8], 1
jmp 0x10048ff3
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x8a8], eax
jg 0x1004900a
and dword [ebp - 0x898], 0
jmp 0x10049014
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 0x5b0bb8b
imul eax, dword [ebp - 0x310], 7
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8e4]
cmp eax, dword [ebp - 0x8ec]
jl 0x10049051
mov dword [ebp - 0x8f4], 1
jmp 0x10049058
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 0x99ac7894
ja 0x100490e0
mov dword [ebp - 0x9dc], 0xae0f
push 1
lea ecx, [ebp - 0xcb4]
call fcn.100189c9
and dword [ebp - 4], 0
mov dword [ebp - 0x280], 0
jmp 0x10049098
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x100490ba
push dword [ebp - 0x280]
lea ecx, [ebp - 0xcb4]
call fcn.10018a67
mov dword [eax], 0x6c0e263
jmp 0x1004908b
mov esi, dword [ebp - 0x9dc]
push 0
lea ecx, [ebp - 0xcb4]
call fcn.10018a67
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.10018a4b
jmp 0x10049111
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x10049111
push 0x188f
push 0x1855
push 0x1d1
push 0x1a57
push 0xb0e
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
cmp dword [ebp + 0x10], 0
jbe 0x100493e5
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100493e5
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x48], 0x76b87d0f
mov dword [ebp - 0x318], 0
push 4
lea ecx, [ebp - 0x94c]
call fcn.100189c9
mov dword [ebp - 4], 1
mov dword [ebp - 0x170], 0xc4ddb84c
mov dword [ebp - 0xdec], 0xafe2499e
mov dword [ebp - 0x2a4], 0
jmp 0x10049183
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x100491a5
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
mov dword [eax], 0xfffffffd
jmp 0x10049176
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x168]
je 0x100491bf
mov dword [ebp - 0x8b0], 1
jmp 0x100491c6
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x168]
jle 0x100491dd
mov dword [ebp - 0x8fc], 1
jmp 0x100491e4
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x8fc], eax
jle 0x100491fe
mov dword [ebp - 0x904], 1
jmp 0x10049205
and dword [ebp - 0x904], 0
imul eax, dword [ebp - 0x904], 0xeea5
cmp dword [ebp - 0x48], eax
jne 0x10049220
mov dword [ebp - 0x93c], 1
jmp 0x10049227
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x8b0]
add eax, dword [ebp - 0x93c]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x168], 0xebf0ddd9
jne 0x1004924b
cmp dword [ebp - 0x48], 0
jne 0x1004925d
mov eax, 0xd7d393e7
test eax, eax
jne 0x1004925d
and dword [ebp - 0x3d0], 0
jmp 0x10049267
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x48], 3
jmp 0x10049283
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x100493c2
mov dword [ebp - 0xa24], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
mov dword [ebp - 0xa14], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
mov ecx, dword [ebp - 0xa14]
mov eax, dword [eax]
mov dword [ecx], eax
mov dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xd18], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
cmp dword [eax], 1
jne 0x10049306
mov dword [ebp - 0xa1c], 1
jmp 0x1004930d
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xdd0], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x94c]
call fcn.10018a67
mov ecx, 0x2e63
sub ecx, dword [eax]
neg ecx
cmp ecx, 0xfffffff6
jl 0x10049341
mov dword [ebp - 0x748], 1
jmp 0x10049348
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0xa24]
cmp dword [ebp - 0x748], eax
jg 0x10049394
mov dword [ebp - 0x170], 0xfffffff7
jmp 0x1004936f
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xd
jl 0x10049392
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x10049390
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x10049362
jmp 0x100493bd
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100493b2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [ebp - 0x318], 0
je 0x100493bd
jmp 0x100493c2
jmp 0x1004927c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94c]
call fcn.10018a4b
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10043266
pop ecx
pop ecx
jmp 0x100503ad
mov dword [ebp - 0xbf8], 1
mov dword [ebp - 0xbf4], 1
mov dword [ebp - 0xbf0], 1
mov dword [ebp - 0xbec], 1
lea ecx, [ebp - 0x369]
call fcn.10018a76
push eax
lea eax, [ebp - 0xbe8]
push eax
lea eax, [ebp - 0xbf8]
push eax
lea ecx, [ebp - 0xec4]
call fcn.10018a79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x144]
call fcn.10018a25
mov dword [ebp - 4], 2
mov dword [ebp - 0xc0c], 0xfffffff8
mov dword [ebp - 0xc08], 0xfffffff8
mov dword [ebp - 0xc04], 0xfffffff8
mov dword [ebp - 0xc00], 0xfffffff8
lea ecx, [ebp - 0x371]
call fcn.10018a76
push eax
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 0xf04]
call fcn.10018a79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9ac]
call fcn.10018a25
mov byte [ebp - 4], 3
mov dword [ebp - 0x60], 8
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov esi, eax
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x100494df
mov dword [ebp - 0xa2c], 1
jmp 0x100494e6
and dword [ebp - 0xa2c], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
push 2
lea ecx, [ebp - 0x144]
call fcn.10018a67
cmp dword [eax], 0xffffffff
jge 0x10049511
mov dword [ebp - 0x3d8], 1
jmp 0x10049518
and dword [ebp - 0x3d8], 0
push 3
lea ecx, [ebp - 0x9ac]
call fcn.10018a67
mov ecx, dword [ebp - 0x3d8]
cmp ecx, dword [eax]
jle 0x1004953b
mov dword [ebp - 0x750], 1
jmp 0x10049542
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xffffffff
jne 0x10049557
mov dword [ebp - 0x3e0], 1
jmp 0x1004955e
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov ecx, dword [ebp - 0x3e0]
cmp ecx, dword [eax]
jl 0x10049581
mov dword [ebp - 0x758], 1
jmp 0x10049588
and dword [ebp - 0x758], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x758]
jl 0x100495ab
mov dword [ebp - 0x3e8], 1
jmp 0x100495b2
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0
jbe 0x100495c7
mov dword [ebp - 0x760], 1
jmp 0x100495ce
and dword [ebp - 0x760], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x760]
jge 0x100495f1
mov dword [ebp - 0x360], 1
jmp 0x100495f8
and dword [ebp - 0x360], 0
push 0
lea ecx, [ebp - 0x9ac]
call fcn.10018a67
mov ecx, dword [ebp - 0x360]
mov dword [eax], ecx
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [eax]
jl 0x10049630
mov dword [ebp - 0x3f0], 1
jmp 0x10049637
and dword [ebp - 0x3f0], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov ecx, dword [ebp - 0x3f0]
cmp ecx, dword [eax]
jne 0x1004965a
mov dword [ebp - 0x768], 1
jmp 0x10049661
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
neg eax
cmp eax, 0xae3d
jle 0x1004967c
mov dword [ebp - 0x3f8], 1
jmp 0x10049683
and dword [ebp - 0x3f8], 0
imul eax, dword [ebp - 0x3f8], 0xffffffff
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x100496ae
mov eax, 0xfffb
test eax, eax
jne 0x100496ae
mov eax, 0x9e14
test eax, eax
jne 0x100496ae
and dword [ebp - 0x770], 0
jmp 0x100496b8
mov dword [ebp - 0x770], 1
push 0
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov esi, eax
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov eax, dword [eax]
sub eax, dword [esi]
cmp eax, dword [ebp - 0x770]
jg 0x100496ec
mov dword [ebp - 0xa34], 1
jmp 0x100496f3
and dword [ebp - 0xa34], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
cmp dword [eax], 0x36a7
jg 0x1004973b
mov dword [ebp - 0x400], 1
jmp 0x10049742
and dword [ebp - 0x400], 0
mov esi, dword [ebp - 0x400]
neg esi
push 1
lea ecx, [ebp - 0x144]
call fcn.10018a67
cmp esi, dword [eax]
jg 0x100498b1
mov dword [ebp - 0xc4], 0xf2a6
mov esi, dword [ebp - 0xc4]
push 3
lea ecx, [ebp - 0x9ac]
call fcn.10018a67
imul esi, dword [eax]
cmp dword [ebp - 0xc4], esi
jle 0x10049793
mov dword [ebp - 0x408], 1
jmp 0x1004979a
and dword [ebp - 0x408], 0
mov esi, dword [ebp - 0xc4]
imul esi, dword [ebp - 0xc4]
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
cmp esi, dword [eax]
jle 0x100497c4
mov dword [ebp - 0x778], 1
jmp 0x100497cb
and dword [ebp - 0x778], 0
push 3
lea ecx, [ebp - 0x9ac]
call fcn.10018a67
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax]
jle 0x100497ee
mov dword [ebp - 0x780], 1
jmp 0x100497f5
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x408]
add eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0xc4]
jl 0x10049815
mov dword [ebp - 0x410], 1
jmp 0x1004981c
and dword [ebp - 0x410], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov ecx, dword [ebp - 0x410]
cmp ecx, dword [eax]
jge 0x10049842
cmp dword [ebp - 0x60], 0
jne 0x10049842
and dword [ebp - 0x788], 0
jmp 0x1004984c
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x788], eax
jle 0x10049866
mov dword [ebp - 0x418], 1
jmp 0x1004986d
and dword [ebp - 0x418], 0
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
jl 0x10049890
mov dword [ebp - 0xa54], 1
jmp 0x10049897
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x60], eax
jmp 0x10049b1e
mov dword [ebp - 0x228], 0xac77aca
mov dword [ebp - 0x320], 0x68fb0c4f
mov dword [ebp - 0x60], 0xffffffed
jmp 0x100498d5
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x13
jg 0x10049b1e
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x38c], 0x47b1d005
mov dword [ebp - 0x14c], 0x1b
jmp 0x1004990c
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 7
jl 0x100499f6
mov dword [ebp - 0x220], 0x62b41911
mov dword [ebp - 0x220], 3
jmp 0x1004993c
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x100499f1
cmp dword [ebp - 0x228], 0
je 0x100499a4
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100499a2
push 0
push 0x12b8
push 0
push 0
push 0x1fed
push 0x1b99
push 0xa8
push 0x198e
push 0x1e89
push 0xfa8
push 0x1618
push 0x2655
push 0x1a70
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x100499ec
mov dword [ebp - 0x2ac], 0
jmp 0x100499bd
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 4
jge 0x100499d9
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xf54], 1
jmp 0x100499b0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf54]
mov dword [ebp - 0x38c], eax
jmp 0x1004992f
jmp 0x100498ff
cmp dword [ebp - 0x228], 1
jge 0x10049a0b
mov dword [ebp - 0x790], 1
jmp 0x10049a12
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x790]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xe10], eax
push 3
lea ecx, [ebp - 0x144]
call fcn.10018a67
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x320]
jl 0x10049a60
mov dword [ebp - 0x420], 1
jmp 0x10049a67
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x420]
jle 0x10049a81
mov dword [ebp - 0x428], 1
jmp 0x10049a88
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x798], eax
push 3
lea ecx, [ebp - 0x9ac]
call fcn.10018a67
mov ecx, dword [ebp - 0x798]
mov dword [eax], ecx
mov eax, dword [ebp - 0x798]
cmp eax, dword [ebp - 0x428]
jg 0x10049ac0
mov dword [ebp - 0x7a0], 1
jmp 0x10049ac7
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 1
je 0x10049adc
mov dword [ebp - 0x430], 1
jmp 0x10049ae3
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x430], eax
jg 0x10049b06
cmp dword [ebp - 0x38c], 0
je 0x10049b06
mov dword [ebp - 0x7a8], 1
jmp 0x10049b0d
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x14c], eax
jmp 0x100498ce
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9ac]
call fcn.10018a4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.10018a4b
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x180], 0xfd9e
mov dword [ebp - 0x2b4], 0x8e17c109
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x7e8], 6
mov dword [ebp - 0xa5c], 0xffffffff
cmp dword [ebp - 0x24], 0
jne 0x10049b87
mov dword [ebp - 0x440], 1
jmp 0x10049b8e
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x180]
jge 0x10049ba5
mov dword [ebp - 0x438], 1
jmp 0x10049bac
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jg 0x10049bcc
mov dword [ebp - 0x7b0], 1
jmp 0x10049bd3
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2b4]
jg 0x10049bf6
mov dword [ebp - 0x7b8], 1
jmp 0x10049bfd
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x7b8]
je 0x10049c17
mov dword [ebp - 0x448], 1
jmp 0x10049c1e
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x10049c41
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xd4], eax
jmp 0x10049ed7
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x7e0], 0x7c6d
push 3
lea ecx, [ebp - 0xc54]
call fcn.100189c9
mov dword [ebp - 4], 4
mov dword [ebp - 0x88], 0
jmp 0x10049c82
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10049ca4
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc54]
call fcn.10018a67
mov dword [eax], 1
jmp 0x10049c75
mov dword [ebp - 0x88], 0
jmp 0x10049cbd
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10049cd9
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xe44], 0xf81606dc
jmp 0x10049cb0
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x10049ce9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x34
jle 0x10049e85
cmp dword [ebp - 0xd4], 0
jne 0x10049d0e
cmp dword [ebp - 0xd4], 0
jne 0x10049d0e
and dword [ebp - 0x7c0], 0
jmp 0x10049d18
mov dword [ebp - 0x7c0], 1
cmp dword [ebp - 0x7c0], 5
jbe 0x10049d2d
mov dword [ebp - 0x450], 1
jmp 0x10049d34
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x450]
jle 0x10049d4e
mov dword [ebp - 0x7c8], 1
jmp 0x10049d55
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x7c8]
jne 0x10049d6c
mov dword [ebp - 0x458], 1
jmp 0x10049d73
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x7e0]
cmp dword [ebp - 0x458], eax
jle 0x10049d8d
mov dword [ebp - 0x7d0], 1
jmp 0x10049d94
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x7d0], eax
jne 0x10049dae
mov dword [ebp - 0x460], 1
jmp 0x10049db5
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
add eax, dword [ebp - 0x180]
mov dword [ebp - 0x7d8], eax
push 1
lea ecx, [ebp - 0xc54]
call fcn.10018a67
mov ecx, dword [ebp - 0x7d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x7d8], eax
jl 0x10049df6
mov dword [ebp - 0x468], 1
jmp 0x10049dfd
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
sub eax, dword [ebp - 0x7e0]
cmp eax, dword [ebp - 0x24]
jle 0x10049e1a
mov dword [ebp - 0x470], 1
jmp 0x10049e21
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x470]
jl 0x10049e3b
mov dword [ebp - 0x478], 1
jmp 0x10049e42
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x478], eax
jne 0x10049e5c
mov dword [ebp - 0x7f0], 1
jmp 0x10049e63
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x7f0]
lea eax, [ecx + eax + 0x6c93]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe44], eax
jmp 0x10049ce2
mov dword [ebp - 0x16c], 0xffffffff
jmp 0x10049e9e
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x3b
je 0x10049ec8
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10049ec6
push 0
push 0x194
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10049e91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.10018a4b
mov eax, dword [ebp - 0x180]
neg eax
jne 0x10049f27
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd4], 0xf6b4ab19
cmp dword [ebp - 0xd4], 1
jae 0x10049f0c
mov dword [ebp - 0x480], 1
jmp 0x10049f13
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x480], eax
jge 0x10049f27
and dword [ebp - 0x7f8], 0
jmp 0x10049f31
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0xa5c]
cmp dword [ebp - 0x7f8], eax
je 0x10049f4b
mov dword [ebp - 0x488], 1
jmp 0x10049f52
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x488], eax
jne 0x10049f6c
mov dword [ebp - 0x800], 1
jmp 0x10049f73
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x800]
jle 0x10049f8d
mov dword [ebp - 0x490], 1
jmp 0x10049f94
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 1
jle 0x10049fb2
mov eax, 0x1d5762cc
test eax, eax
je 0x10049fb2
mov dword [ebp - 0x808], 1
jmp 0x10049fb9
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp + 0x10], 0
jne 0x1004dfb5
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1003dc8a
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x1a8], 0x7e307b5c
mov dword [ebp - 0x368], 1
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0xa64], 0xdffbe584
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x1a8]
jne 0x1004a02f
mov dword [ebp - 0x498], 1
jmp 0x1004a036
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xc01e6e2b
jbe 0x1004a05a
mov dword [ebp - 0x810], 1
jmp 0x1004a061
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0x1a8]
cmp eax, 0xfdbd
jl 0x1004a080
mov dword [ebp - 0x4a0], 1
jmp 0x1004a087
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0x368]
jge 0x1004a0b4
mov dword [ebp - 0x4a8], 1
jmp 0x1004a0bb
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0x8064
jg 0x1004a0d3
mov dword [ebp - 0x820], 1
jmp 0x1004a0da
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x1a8]
dec eax
cmp eax, dword [ebp - 0x820]
jle 0x1004a0f5
mov dword [ebp - 0x4b0], 1
jmp 0x1004a0fc
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 1
je 0x1004a10c
cmp dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x368]
mov dword [ebp - 0xa64], eax
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1004a148
push 0
push 0x21d4
push 0x165c
push 0xa9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x90], 0xfffffff7
mov dword [ebp - 0x74], 0x9c17633e
mov dword [ebp - 0xbac], 0
mov dword [ebp - 0xba8], 0
mov dword [ebp - 0xba4], 0
mov dword [ebp - 0xba0], 0
mov dword [ebp - 0x90], 0x3b4e1a36
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x90], 0
jmp 0x1004a1ad
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff5
jne 0x1004a633
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x868], 1
cmp dword [ebp - 0x74], 0xfffa
ja 0x1004a1e0
mov dword [ebp - 0x828], 1
jmp 0x1004a1e7
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x828], eax
jl 0x1004a1fb
cmp dword [ebp - 0x90], 0
jne 0x1004a20b
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1004a20b
and dword [ebp - 0x4b8], 0
jmp 0x1004a215
mov dword [ebp - 0x4b8], 1
cmp dword [ebp - 0x4b8], 0xdfe0
je 0x1004a22d
mov dword [ebp - 0x830], 1
jmp 0x1004a234
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xd30], eax
cmp dword [ebp - 0x74], 0
jbe 0x1004a258
mov dword [ebp - 0x4c0], 1
jmp 0x1004a25f
and dword [ebp - 0x4c0], 0
imul eax, dword [ebp - 0x4c0], 0x815f
test eax, eax
jg 0x1004a279
mov dword [ebp - 0x838], 1
jmp 0x1004a280
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xfffffffc
jae 0x1004a2fd
mov dword [ebp - 0x230], 0
jmp 0x1004a2a2
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x1004a2be
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xeb0], 0x59ec1348
jmp 0x1004a295
mov dword [ebp - 0x2c], 0
jmp 0x1004a2ce
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1004a2e4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbac], 0xffffffff
jmp 0x1004a2c7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xeb0], 0
je 0x1004a2f8
jmp 0x1004a633
jmp 0x1004a627
mov dword [ebp - 0x2bc], 0xb8e00457
mov dword [ebp - 0xa84], 0x6883ce71
mov dword [ebp - 0x330], 0x9e478dfc
mov dword [ebp - 0x848], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x1004a33e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004a35a
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xca8], 0xeb60f9aa
jmp 0x1004a331
mov dword [ebp - 0xa0], 0
jmp 0x1004a373
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004a38f
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xe50], 0xb7f464f6
jmp 0x1004a366
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xdd8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
cmp ecx, dword [ebp + eax - 0xbac]
jne 0x1004a3bc
mov dword [ebp - 0x4c8], 1
jmp 0x1004a3c3
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x330]
cmp eax, 0xfffffffb
jne 0x1004a3ec
mov dword [ebp - 0x840], 1
jmp 0x1004a3f3
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0
jne 0x1004a40e
mov eax, 0x6b4f
test eax, eax
jne 0x1004a40e
and dword [ebp - 0x4d0], 0
jmp 0x1004a418
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x848], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x848]
cmp ecx, dword [ebp + eax - 0xe50]
jle 0x1004a444
mov dword [ebp - 0xa6c], 1
jmp 0x1004a44b
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe00], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp + eax - 0xca8]
jle 0x1004a480
mov dword [ebp - 0x4d8], 1
jmp 0x1004a487
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0xffffffff
jne 0x1004a49c
mov dword [ebp - 0x850], 1
jmp 0x1004a4a3
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x850], eax
jg 0x1004a4ba
mov dword [ebp - 0x4e0], 1
jmp 0x1004a4c1
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4e0], eax
jne 0x1004a4de
cmp dword [ebp - 0x2c], 0
je 0x1004a4de
mov dword [ebp - 0xa74], 1
jmp 0x1004a4e5
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x3074c89a
cmp eax, 0xc46587a7
jae 0x1004a50c
mov dword [ebp - 0x858], 1
jmp 0x1004a513
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x858], eax
jl 0x1004a52a
mov dword [ebp - 0x4e8], 1
jmp 0x1004a531
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
ja 0x1004a546
mov dword [ebp - 0x860], 1
jmp 0x1004a54d
and dword [ebp - 0x860], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
cmp eax, dword [ebp - 0x860]
jge 0x1004a56e
mov dword [ebp - 0x4f0], 1
jmp 0x1004a575
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x868]
dec eax
cmp eax, dword [ebp - 0x330]
jg 0x1004a5a2
mov dword [ebp - 0xa7c], 1
jmp 0x1004a5a9
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xde0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xca8]
mov dword [ebp - 0xd58], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xbac]
imul ecx, dword [ebp + eax - 0xca8]
cmp ecx, dword [ebp - 0xa84]
jge 0x1004a5f7
mov dword [ebp - 0x4f8], 1
jmp 0x1004a5fe
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0xfffffff9
jbe 0x1004a613
mov dword [ebp - 0x870], 1
jmp 0x1004a61a
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x870]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x74], 0x161529ab
jmp 0x1004a1a0
cmp dword [0x1061c0a8], 0
jne 0x1004de1b
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x238], 0
jmp 0x1004a663
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1004a67f
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xf60], 0xa8eac8b1
jmp 0x1004a656
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1004a69e
push 0x13fc
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x2c4], 0
jmp 0x1004a6b7
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jg 0x1004a772
mov dword [ebp - 0x240], 0x77dd6887
mov dword [ebp - 0x240], 2
jmp 0x1004a6e7
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x1004a76d
mov dword [ebp - 0x2cc], 0x4caf14c9
mov dword [ebp - 0x2cc], 0
jmp 0x1004a713
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jg 0x1004a768
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1004a744
push 0
push 0
push 0xb06
push 0x1b99
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1004a766
push 0x13a9
push 0x1ffd
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x1004a706
jmp 0x1004a6da
jmp 0x1004a6aa
mov dword [ebp - 0xa8c], 0x7ab8
lea eax, [ebp - 0xa8c]
push eax
call fcn.1004322b
pop ecx
mov dword [ebp - 0x5f8], eax
push 4
lea ecx, [ebp - 0xc90]
call fcn.100189c9
mov dword [ebp - 4], 5
mov dword [ebp - 0x188], 0x252cb136
mov dword [ebp - 0x51c], 0xfffffffc
mov dword [ebp - 0xabc], 0xb7e80d68
mov dword [ebp - 0xb0], 0
jmp 0x1004a7da
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x1004a7fc
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc90]
call fcn.10018a67
mov dword [eax], 1
jmp 0x1004a7cd
mov dword [ebp - 0xb0], 0
jmp 0x1004a815
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1004a831
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x96c], 0xffffffff
jmp 0x1004a808
mov dword [ebp - 0x188], 0
jmp 0x1004a84a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jg 0x1004ac1a
mov dword [ebp - 0x98], 0x182eac45
push 3
lea ecx, [ebp - 0x9b8]
call fcn.100189c9
mov byte [ebp - 4], 6
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x248], 0
jmp 0x1004a895
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jge 0x1004a8b7
push dword [ebp - 0x248]
lea ecx, [ebp - 0x9b8]
call fcn.10018a67
mov dword [eax], 0x34b0b4ef
jmp 0x1004a888
mov dword [ebp - 0x98], 0
jmp 0x1004a8d0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jg 0x1004abb2
mov dword [ebp - 0xa94], 0
mov dword [ebp - 0xab4], 0xfffffff6
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x524], 0xffffffff
mov dword [ebp - 0x52c], 0xb1495dd6
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004a936
mov eax, 0x30b137d3
test eax, eax
je 0x1004a936
mov dword [ebp - 0x500], 1
jmp 0x1004a93d
and dword [ebp - 0x500], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x96c]
push 2
lea ecx, [ebp - 0xc90]
call fcn.10018a67
mov ecx, dword [ebp - 0x500]
sub ecx, dword [eax]
cmp ecx, esi
jge 0x1004a96f
mov dword [ebp - 0x878], 1
jmp 0x1004a976
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x878], eax
jne 0x1004a990
mov dword [ebp - 0x508], 1
jmp 0x1004a997
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, 0x997736e
cmp eax, 0x11771b70
jge 0x1004a9b5
mov dword [ebp - 0x880], 1
jmp 0x1004a9bc
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0x18d7c584
je 0x1004a9d4
mov dword [ebp - 0x510], 1
jmp 0x1004a9db
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x98]
jl 0x1004aa01
mov dword [ebp - 0x890], 1
jmp 0x1004aa08
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x890], 0x5c4b79a9
jge 0x1004aa3b
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004aa3b
cmp dword [ebp - 0x188], 0
je 0x1004aa3b
mov dword [ebp - 0x394], 1
jmp 0x1004aa42
and dword [ebp - 0x394], 0
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10018a67
mov ecx, dword [ebp - 0x394]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa94]
cmp dword [ebp - 0x394], eax
jge 0x1004aa7a
cmp dword [ebp - 0x51c], 0
je 0x1004aa7a
mov dword [ebp - 0xa9c], 1
jmp 0x1004aa81
and dword [ebp - 0xa9c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x96c], 0xdae1
je 0x1004aaa0
mov dword [ebp - 0xaa4], 1
jmp 0x1004aaa7
and dword [ebp - 0xaa4], 0
cmp dword [ebp - 0x98], 0
je 0x1004aac3
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1004aac3
mov dword [ebp - 0x73c], 1
jmp 0x1004aaca
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
neg eax
cmp eax, 0xc8e8
jge 0x1004aae5
mov dword [ebp - 0xaac], 1
jmp 0x1004aaec
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x524], 0x23917005
jle 0x1004ab1d
mov dword [ebp - 0x338], 1
jmp 0x1004ab24
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x338]
mov dword [ebp + eax - 0x96c], ecx
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x338], eax
jle 0x1004ab51
mov dword [ebp - 0x84c], 1
jmp 0x1004ab58
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 1
jne 0x1004ab79
mov dword [ebp - 0x744], 1
jmp 0x1004ab80
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xab4]
cmp dword [ebp - 0x744], eax
jg 0x1004ab9a
mov dword [ebp - 0x534], 1
jmp 0x1004aba1
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xabc], eax
jmp 0x1004a8c3
mov eax, dword [ebp - 0x98]
neg eax
mov dword [ebp - 0x98], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
cmp eax, dword [ebp - 0x98]
jg 0x1004abea
cmp dword [ebp - 0x2d4], 0
je 0x1004abea
mov dword [ebp - 0x8d8], 1
jmp 0x1004abf1
and dword [ebp - 0x8d8], 0
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10018a67
mov ecx, dword [ebp - 0x8d8]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9b8]
call fcn.10018a4b
jmp 0x1004a83d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.10018a4b
mov dword [ebp - 0x28], 0xf7e2799a
mov dword [ebp - 0x370], 0xffffffff
mov dword [ebp - 0x250], 1
mov dword [ebp - 0xad4], 0xfffffffb
mov dword [ebp - 0x28], 0x11
jmp 0x1004ac5e
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffa
jg 0x1004aca2
mov dword [ebp - 0xac4], 0xfd4914d2
cmp dword [ebp - 0xac4], 0
je 0x1004ac79
jmp 0x1004aca2
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1004aca0
push 0x223f
push 0x452
push 0x164b
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x1004ac57
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
je 0x1004ace4
cmp dword [ebp - 0x370], 0
je 0x1004ace4
mov dword [ebp - 0x53c], 1
jmp 0x1004aceb
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x53c], eax
jl 0x1004ad08
mov eax, 0x6e483bbb
test eax, eax
jne 0x1004ad08
and dword [ebp - 0xacc], 0
jmp 0x1004ad12
mov dword [ebp - 0xacc], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xdac], eax
cmp dword [ebp - 0x28], 0xfffffff9
jne 0x1004ad2d
mov dword [ebp - 0x74c], 1
jmp 0x1004ad34
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x74c], eax
je 0x1004ad4b
mov dword [ebp - 0x544], 1
jmp 0x1004ad52
and dword [ebp - 0x544], 0
imul eax, dword [ebp - 0x544], 0xfffffffe
test eax, eax
jne 0x1004ad6f
mov eax, 0x16de6eab
test eax, eax
jne 0x1004ad6f
and dword [ebp - 0x854], 0
jmp 0x1004ad79
mov dword [ebp - 0x854], 1
cmp dword [ebp - 0x854], 0xffffffff
jge 0x1004ad8e
mov dword [ebp - 0x54c], 1
jmp 0x1004ad95
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x54c]
jl 0x1004adac
mov dword [ebp - 0x754], 1
jmp 0x1004adb3
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 5
cmp eax, dword [ebp - 0x250]
jge 0x1004add6
mov dword [ebp - 0x554], 1
jmp 0x1004addd
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0
jae 0x1004adf2
mov dword [ebp - 0x908], 1
jmp 0x1004adf9
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0x714b
jne 0x1004ae11
mov dword [ebp - 0x55c], 1
jmp 0x1004ae18
and dword [ebp - 0x55c], 0
imul eax, dword [ebp - 0x55c], 0xffffffff
imul eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0xad4]
mov dword [ebp - 0x250], eax
mov byte [ebp - 0x1f4], 6
mov byte [ebp - 0x1f3], 0x34
mov byte [ebp - 0x1f2], 3
mov byte [ebp - 0x1f1], 0x25
mov byte [ebp - 0x1f0], 2
mov byte [ebp - 0x1ef], 0x22
mov byte [ebp - 0x1ee], 4
mov byte [ebp - 0x1ed], 0x11
mov byte [ebp - 0x1ec], 9
mov byte [ebp - 0x1eb], 0xb
mov byte [ebp - 0x1ea], 5
mov byte [ebp - 0x1e9], 0x1c
mov byte [ebp - 0x1e8], 0
mov byte [ebp - 0x1e7], 0x35
mov byte [ebp - 0x1e6], 2
mov byte [ebp - 0x1e5], 0xbc
mov byte [ebp - 0x1e4], 0x2f
mov byte [ebp - 0x1e3], 0xb
mov byte [ebp - 0x1e2], 0x3f
mov byte [ebp - 0x1e1], 8
mov byte [ebp - 0x1e0], 0x17
mov byte [ebp - 0x1df], 0xc
mov byte [ebp - 0x1de], 0x38
mov byte [ebp - 0x1dd], 1
mov byte [ebp - 0x1dc], 0x32
mov byte [ebp - 0x1db], 0xa
mov byte [ebp - 0x1da], 0x20
mov byte [ebp - 0x1d9], 7
mov byte [ebp - 0x1d8], 0x2c
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x340], 0xfcb44481
mov dword [ebp - 0x75c], 0xbc254e7f
mov dword [ebp - 0x58c], 0xfffffff9
mov dword [ebp - 0x774], 0xe1d67a3d
mov dword [ebp - 0x594], 0xaacc702
mov dword [ebp - 0x1c], 0
jmp 0x1004af4c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1004af62
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd64], 0
jmp 0x1004af45
mov dword [ebp - 0x1c], 0
jmp 0x1004af72
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004af88
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd44], 1
jmp 0x1004af6b
mov dword [ebp - 0x1c], 0
jmp 0x1004af98
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1004afae
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xef4], 0xfffffff8
jmp 0x1004af91
mov dword [ebp - 0x1c], 0
jmp 0x1004afbe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1004afd4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe68], 0xd9a65c8b
jmp 0x1004afb7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1004b276
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd64], 1
xor eax, eax
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0xcf59
jge 0x1004b025
mov dword [ebp - 0x564], 1
jmp 0x1004b02c
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
sub eax, dword [ebp - 0x18]
imul eax, eax, 0x8436
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x1004b050
mov dword [ebp - 0x85c], 1
jmp 0x1004b057
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
inc eax
cmp eax, 7
jae 0x1004b06f
mov dword [ebp - 0x56c], 1
jmp 0x1004b076
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0x18]
jge 0x1004b090
mov dword [ebp - 0x764], 1
jmp 0x1004b097
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x764], eax
jg 0x1004b0ae
mov dword [ebp - 0x574], 1
jmp 0x1004b0b5
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0x91f4
jne 0x1004b0cd
mov dword [ebp - 0x8e0], 1
jmp 0x1004b0d4
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
add eax, 0x49ef57a5
cmp eax, dword [ebp - 0x18]
jg 0x1004b0f0
mov dword [ebp - 0x57c], 1
jmp 0x1004b0f7
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 1
jg 0x1004b112
cmp dword [ebp - 0x18], 0
je 0x1004b112
mov dword [ebp - 0x76c], 1
jmp 0x1004b119
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x76c], eax
je 0x1004b130
mov dword [ebp - 0x584], 1
jmp 0x1004b137
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
sub eax, 0xfeac
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xd44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0x340]
cmp eax, dword [ebp - 0x18]
je 0x1004b185
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd64], 0
jne 0x1004b185
and dword [ebp - 0x864], 0
jmp 0x1004b18f
mov dword [ebp - 0x864], 1
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
cmp eax, dword [ebp - 0x18]
jne 0x1004b1be
mov dword [ebp - 0x390], 1
jmp 0x1004b1c5
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0xef4], ecx
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
jne 0x1004b1fd
push 7
pop eax
test eax, eax
jne 0x1004b1fd
and dword [ebp - 0x938], 0
jmp 0x1004b207
mov dword [ebp - 0x938], 1
cmp dword [ebp - 0x938], 0x5d57d38c
jne 0x1004b21f
mov dword [ebp - 0x59c], 1
jmp 0x1004b226
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x59c], eax
jne 0x1004b23d
mov dword [ebp - 0x77c], 1
jmp 0x1004b244
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x77c]
je 0x1004b25b
mov dword [ebp - 0x5a4], 1
jmp 0x1004b262
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5a4], eax
jle 0x1004b276
and dword [ebp - 0x86c], 0
jmp 0x1004b280
mov dword [ebp - 0x86c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x86c]
mov dword [ebp + eax - 0xe68], ecx
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
and eax, 0x47
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f4]
or ecx, 0x47
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0xb88], cl
mov dword [ebp - 0xc20], 1
mov dword [ebp - 0xc1c], 1
mov dword [ebp - 0xc18], 1
mov dword [ebp - 0xc14], 1
lea ecx, [ebp - 0x385]
call fcn.10018a76
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0xf24]
call fcn.10018a79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3a0]
call fcn.10018a25
mov dword [ebp - 4], 7
mov dword [ebp - 0x14], 0x871c7bf0
mov dword [ebp - 0x5c], 0xfd5d7051
mov dword [ebp - 0x348], 0
push 4
lea ecx, [ebp - 0x9a0]
call fcn.100189c9
mov byte [ebp - 4], 8
mov dword [ebp - 0x2dc], 0
jmp 0x1004b371
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 4
jge 0x1004b393
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x9a0]
call fcn.10018a67
mov dword [eax], 0xfffffffb
jmp 0x1004b364
mov dword [ebp - 0x14], 0
jmp 0x1004b3a3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1004b561
mov dword [ebp - 0xb90], 0x80f885bd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004b475
push 9
pop eax
test eax, eax
je 0x1004b3f6
mov esi, dword [ebp - 0x5c]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
sub esi, dword [eax]
je 0x1004b3f6
mov dword [ebp - 0x5ac], 1
jmp 0x1004b3fd
and dword [ebp - 0x5ac], 0
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
mov eax, dword [eax]
add eax, dword [ebp - 0x5ac]
cmp eax, esi
jl 0x1004b426
mov dword [ebp - 0x784], 1
jmp 0x1004b42d
and dword [ebp - 0x784], 0
imul eax, dword [ebp - 0x784], 0x6d8
cmp eax, 0x33f2
jge 0x1004b44a
mov dword [ebp - 0x5b4], 1
jmp 0x1004b451
and dword [ebp - 0x5b4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
mov ecx, dword [ebp - 0x5b4]
cmp ecx, dword [eax]
jle 0x1004b475
mov dword [ebp - 0x8e8], 1
jmp 0x1004b47c
and dword [ebp - 0x8e8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
mov ecx, dword [ebp - 0x8e8]
cmp ecx, dword [eax]
jl 0x1004b4a0
mov dword [ebp - 0x5bc], 1
jmp 0x1004b4a7
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xfff6
jne 0x1004b4bf
mov dword [ebp - 0x78c], 1
jmp 0x1004b4c6
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0
jne 0x1004b4df
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1004b4df
and dword [ebp - 0x5c4], 0
jmp 0x1004b4e9
mov dword [ebp - 0x5c4], 1
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0x14]
jne 0x1004b514
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
cmp dword [eax], 0
jne 0x1004b514
and dword [ebp - 0x874], 0
jmp 0x1004b51e
mov dword [ebp - 0x874], 1
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xb90], eax
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1004b55c
push 0
push 0x1086
push 0x905
push 0xe18
push 0x1d
push 0x14bb
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x1004b39c
mov eax, dword [ebp - 0x5c]
inc eax
cmp eax, dword [ebp - 0x5c]
jl 0x1004b5ee
cmp dword [ebp - 0x5c], 1
jne 0x1004b580
mov dword [ebp - 0x5cc], 1
jmp 0x1004b587
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0xffffffff
jl 0x1004b59c
mov dword [ebp - 0xb98], 1
jmp 0x1004b5a3
and dword [ebp - 0xb98], 0
push 3
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x5c]
jne 0x1004b5c7
cmp dword [ebp - 0x14], 0
jne 0x1004b5c7
and dword [ebp - 0x794], 0
jmp 0x1004b5d1
mov dword [ebp - 0x794], 1
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1004b5ee
mov dword [ebp - 0x5d4], 1
jmp 0x1004b5f5
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xd98], eax
push 3
lea ecx, [ebp - 0x9a0]
call fcn.10018a67
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x918], eax
push 3
lea ecx, [ebp - 0x9a0]
call fcn.10018a67
mov ecx, dword [ebp - 0x918]
mov dword [eax], ecx
cmp dword [ebp - 0x918], 0x7b34
jg 0x1004b650
mov dword [ebp - 0x5dc], 1
jmp 0x1004b657
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0xaa7fcf62
jae 0x1004b66f
mov dword [ebp - 0x79c], 1
jmp 0x1004b676
and dword [ebp - 0x79c], 0
push 3
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
mov ecx, dword [ebp - 0x79c]
add ecx, dword [eax]
jne 0x1004b69c
cmp dword [ebp - 0x5c], 0
jne 0x1004b69c
and dword [ebp - 0xb30], 0
jmp 0x1004b6a6
mov dword [ebp - 0xb30], 1
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10018a67
cmp dword [eax], 0xdc28
jl 0x1004b6c7
mov dword [ebp - 0x5e4], 1
jmp 0x1004b6ce
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x5e4]
cmp eax, 0xfffffffa
je 0x1004b6e9
mov dword [ebp - 0x87c], 1
jmp 0x1004b6f0
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, 0xdfd6
cmp eax, 0x66f
jne 0x1004b70e
mov dword [ebp - 0x5ec], 1
jmp 0x1004b715
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0x7b094c6
je 0x1004b72d
mov dword [ebp - 0x7a4], 1
jmp 0x1004b734
and dword [ebp - 0x7a4], 0
imul eax, dword [ebp - 0x7a4], 0xfffd
cmp eax, 0x2595
je 0x1004b98a
mov dword [ebp - 0x7ac], 0x376b
mov dword [ebp - 0x9e8], 0x39aa88d1
mov dword [ebp - 0x14], 0
jmp 0x1004b76d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xd
jl 0x1004b988
mov dword [ebp - 0xfc], 7
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1004b7a1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [ebp - 0xfc], 0
jne 0x1004b7b6
mov dword [ebp - 0x614], 1
jmp 0x1004b7bd
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x5c], 0
jne 0x1004b821
cmp dword [ebp - 0xfc], 0x317a7f35
jg 0x1004b7db
mov dword [ebp - 0x5f4], 1
jmp 0x1004b7e2
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x5f4], eax
jl 0x1004b7fc
mov dword [ebp - 0xb3c], 1
jmp 0x1004b803
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0xfc], 0
jne 0x1004b821
and dword [ebp - 0x8f0], 0
jmp 0x1004b82b
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x7ac]
cmp dword [ebp - 0x8f0], eax
jge 0x1004b845
mov dword [ebp - 0x5fc], 1
jmp 0x1004b84c
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 5
ja 0x1004b861
mov dword [ebp - 0xa0c], 1
jmp 0x1004b868
and dword [ebp - 0xa0c], 0
push 3
lea ecx, [ebp - 0x9a0]
call fcn.10018a67
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xdc4], eax
cmp dword [ebp - 0x5c], 0x54c1
jg 0x1004b896
mov dword [ebp - 0x604], 1
jmp 0x1004b89d
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x604], eax
je 0x1004b8b7
mov dword [ebp - 0x884], 1
jmp 0x1004b8be
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 3
je 0x1004b8d3
mov dword [ebp - 0x60c], 1
jmp 0x1004b8da
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x60c], eax
jle 0x1004b8f4
mov dword [ebp - 0x7b4], 1
jmp 0x1004b8fb
and dword [ebp - 0x7b4], 0
push 3
lea ecx, [ebp - 0x9a0]
call fcn.10018a67
mov ecx, dword [ebp - 0x7b4]
mov dword [eax], ecx
mov eax, 0xff541edf
test eax, eax
jne 0x1004b92b
mov eax, 0xa3ce9d1b
test eax, eax
jne 0x1004b92b
and dword [ebp - 0x8ac], 0
jmp 0x1004b935
mov dword [ebp - 0x8ac], 1
mov eax, dword [ebp - 0x614]
cmp eax, dword [ebp - 0x8ac]
jge 0x1004b94f
mov dword [ebp - 0x61c], 1
jmp 0x1004b956
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x61c], eax
jle 0x1004b970
mov dword [ebp - 0x7bc], 1
jmp 0x1004b977
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x9e8], eax
jmp 0x1004b766
jmp 0x1004b9aa
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1004b9aa
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9a0]
call fcn.10018a4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.10018a4b
mov dword [ebp - 0x44], 2
and dword [ebp - 0x260], 0
jmp 0x1004b9e0
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1d
jae 0x1004ca17
push 3
lea ecx, [ebp - 0x3c4]
call fcn.100189c9
mov dword [ebp - 4], 9
mov dword [ebp - 0xe20], 4
mov dword [ebp - 0xda8], 0x2285faaf
push 2
lea ecx, [ebp - 0xc6c]
call fcn.100189c9
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x30], 0
jmp 0x1004ba33
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1004ba49
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1b8], 0xfffffffc
jmp 0x1004ba2c
mov dword [ebp - 0x30], 0
jmp 0x1004ba59
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1004ba72
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
and dword [eax], 0
jmp 0x1004ba52
mov dword [ebp - 0x30], 0
jmp 0x1004ba82
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1004ba9e
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc6c]
call fcn.10018a67
mov dword [eax], 0xfffffffd
jmp 0x1004ba7b
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1004bac2
push 0xc9e
push 0
push 0x1c34
call dword [sym.imp.GDI32.dll_Polygon]
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
and dword [eax], 0
jmp 0x1004baf8
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x624]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
cmp dword [eax], 0
jl 0x1004bc59
mov dword [ebp - 0xbc0], 0xdf3d
mov dword [ebp - 0xbbc], 0xdf3d
mov dword [ebp - 0xbb8], 0xdf3d
mov dword [ebp - 0xbb4], 0xdf3d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xbc0]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0xbc0], ecx
test eax, eax
je 0x1004bb73
or eax, 0xffffffff
je 0x1004bb73
mov dword [ebp - 0xad8], 1
jmp 0x1004bb7a
and dword [ebp - 0xad8], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1b8], 0
jne 0x1004bbae
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov eax, dword [eax]
imul eax, dword [ebp + eax*4 - 0x1b8], 0
test eax, eax
je 0x1004bbd8
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1b8], 0
je 0x1004bbd8
or eax, 0xffffffff
je 0x1004bbd8
mov dword [ebp - 0x88c], 1
jmp 0x1004bbdf
and dword [ebp - 0x88c], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp dword [ebp - 0x88c], eax
jle 0x1004bc09
mov dword [ebp - 0x62c], 1
jmp 0x1004bc10
and dword [ebp - 0x62c], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.10018a67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp dword [ebp - 0x62c], eax
jl 0x1004bc3a
mov dword [ebp - 0x9f0], 1
jmp 0x1004bc41
and dword [ebp - 0x9f0], 0
push 0
lea ecx, [ebp - 0xc6c]
call fcn.10018a67
mov dword [eax], 0xf12f3ccd
jmp 0x1004bad4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc6c]
call fcn.10018a4b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.10018a4b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1004c69b
mov dword [ebp - 0x4c], 0xaf43b7c7
mov dword [ebp - 0x634], 3
mov dword [ebp - 0x80], 0
jmp 0x1004bcb3
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004bcc9
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x974], 4
jmp 0x1004bcac
mov dword [ebp - 0x80], 0
jmp 0x1004bcd9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1004bcef
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xe80], 0x1f32afcb
jmp 0x1004bcd2
mov dword [ebp - 0x4c], 0
jmp 0x1004bcff
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1004bd15
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x974], 9
jmp 0x1004bcf8
mov dword [ebp - 0x4c], 0x13
jmp 0x1004bd25
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x1004bf84
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x378], 0
mov dword [ebp - 0xae8], 0xf620a341
mov dword [ebp - 0x654], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x974], 0
je 0x1004be12
mov dword [ebp - 0xb44], 0x188e
mov dword [ebp - 0x190], 0x5a3d7f19
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x974]
mov dword [ebp - 0xccc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb44]
inc ecx
mov edx, 0xe6f7fbf2
sub edx, ecx
cmp edx, dword [ebp + eax - 0x974]
jle 0x1004bdbb
mov dword [ebp - 0x7c4], 1
jmp 0x1004bdc2
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x190], 0
jmp 0x1004bde7
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 5
jle 0x1004be10
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1004be0e
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1004bdda
jmp 0x1004be28
mov dword [ebp - 0x9f8], 0xee491ba6
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x1b0], 0
je 0x1004be7e
mov dword [ebp - 0x634], 1
cmp dword [ebp - 0x634], 0
je 0x1004be7e
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x4c]
cmp eax, 0xe35
jge 0x1004be5d
mov dword [ebp - 0x8b4], 1
jmp 0x1004be64
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x8b4], eax
jle 0x1004be7e
mov dword [ebp - 0x63c], 1
jmp 0x1004be85
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 0xae8]
jge 0x1004bea3
mov dword [ebp - 0x7cc], 1
jmp 0x1004beaa
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
sub eax, dword [ebp - 0x1b0]
jne 0x1004beca
cmp dword [ebp - 0x1b0], 0
jne 0x1004beca
and dword [ebp - 0x644], 0
jmp 0x1004bed4
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x644], eax
jle 0x1004beee
mov dword [ebp - 0x894], 1
jmp 0x1004bef5
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x894]
test eax, eax
jne 0x1004bf16
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1004bf16
and dword [ebp - 0x64c], 0
jmp 0x1004bf20
mov dword [ebp - 0x64c], 1
cmp dword [ebp - 0x64c], 0xed1b4b1c
je 0x1004bf38
mov dword [ebp - 0x7d4], 1
jmp 0x1004bf3f
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x654]
jl 0x1004bf65
mov dword [ebp - 0x8bc], 1
jmp 0x1004bf6c
and dword [ebp - 0x8bc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp + eax - 0xe80], ecx
jmp 0x1004bd1e
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x1f4]
inc eax
mov dword [ebp - 0x260], eax
push 3
lea ecx, [ebp - 0x914]
call fcn.100189c9
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x78], 0x789328a0
push 4
lea ecx, [ebp - 0x988]
call fcn.100189c9
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xcc], 0x110e6b6c
push 2
lea ecx, [ebp - 0xc78]
call fcn.100189c9
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x38], 0
jmp 0x1004bfed
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1004c009
push dword [ebp - 0x38]
lea ecx, [ebp - 0x914]
call fcn.10018a67
mov dword [eax], 0xd16df251
jmp 0x1004bfe6
mov dword [ebp - 0x38], 0
jmp 0x1004c019
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1004c035
push dword [ebp - 0x38]
lea ecx, [ebp - 0x988]
call fcn.10018a67
mov dword [eax], 0xcd9d7540
jmp 0x1004c012
mov dword [ebp - 0x38], 0
jmp 0x1004c045
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1004c05e
push dword [ebp - 0x38]
lea ecx, [ebp - 0xc78]
call fcn.10018a67
and dword [eax], 0
jmp 0x1004c03e
push 1
lea ecx, [ebp - 0x914]
call fcn.10018a67
cmp dword [eax], 0
jne 0x1004c08b
push 1
lea ecx, [ebp - 0x914]
call fcn.10018a67
cmp dword [eax], 0
jne 0x1004c08b
and dword [ebp - 0x65c], 0
jmp 0x1004c095
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0x65c]
neg eax
je 0x1004c310
mov dword [ebp - 0x64], 0xb1c0
mov dword [ebp - 0x694], 0xffffffff
mov dword [ebp - 0xa00], 0
mov dword [ebp - 0xb4c], 0x6968939f
mov eax, dword [ebp - 0x694]
shl eax, 2
test eax, eax
je 0x1004c0e6
xor eax, eax
inc eax
je 0x1004c0e6
and dword [ebp - 0x7dc], 0
push 1
lea ecx, [ebp - 0x914]
call fcn.10018a67
mov ecx, dword [ebp - 0x7dc]
cmp ecx, dword [eax]
jg 0x1004c110
mov dword [ebp - 0xa08], 0xfffffff7
mov dword [ebp - 0xa08], 0xeb945924
mov dword [ebp - 0x78], 2
jmp 0x1004c334
cmp dword [ebp - 0x78], 0
jl 0x1004c533
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x260]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0xb88]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x1f3]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x260]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0xb88]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0x1f3]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0xb88], dl
mov dword [ebp - 0x54], 0xaf43b7c7
mov dword [ebp - 0x940], 3
mov dword [ebp - 0x8c], 0
jmp 0x1004c725
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004c741
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x97c], 4
jmp 0x1004c718
mov dword [ebp - 0x8c], 0
jmp 0x1004c75a
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1004c776
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xebc], 0x1f32afcb
jmp 0x1004c74d
mov dword [ebp - 0x54], 0
jmp 0x1004c786
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1004c79c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x97c], 9
jmp 0x1004c77f
mov dword [ebp - 0x54], 0x13
jmp 0x1004c7ac
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x1004ca0b
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x350], 0
mov dword [ebp - 0xa18], 0xf620a341
mov dword [ebp - 0x8f8], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x97c], 0
je 0x1004c899
mov dword [ebp - 0xa10], 0x188e
mov dword [ebp - 0x1c4], 0x5a3d7f19
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x97c]
mov dword [ebp - 0xcf4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa10]
inc ecx
mov edx, 0xe6f7fbf2
sub edx, ecx
cmp edx, dword [ebp + eax - 0x97c]
jle 0x1004c842
mov dword [ebp - 0x6b4], 1
jmp 0x1004c849
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c4], 0
jmp 0x1004c86e
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 5
jle 0x1004c897
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1004c895
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1004c861
jmp 0x1004c8af
mov dword [ebp - 0xb54], 0xee491ba6
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x174], 0
je 0x1004c905
mov dword [ebp - 0x940], 1
cmp dword [ebp - 0x940], 0
je 0x1004c905
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x54]
cmp eax, 0xe35
jge 0x1004c8e4
mov dword [ebp - 0x6bc], 1
jmp 0x1004c8eb
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x6bc], eax
jle 0x1004c905
mov dword [ebp - 0x80c], 1
jmp 0x1004c90c
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x80c]
cmp eax, dword [ebp - 0xa18]
jge 0x1004c92a
mov dword [ebp - 0x6c4], 1
jmp 0x1004c931
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
sub eax, dword [ebp - 0x174]
jne 0x1004c951
cmp dword [ebp - 0x174], 0
jne 0x1004c951
and dword [ebp - 0x8b8], 0
jmp 0x1004c95b
mov dword [ebp - 0x8b8], 1
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x8b8], eax
jle 0x1004c975
mov dword [ebp - 0x6cc], 1
jmp 0x1004c97c
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x6cc]
test eax, eax
jne 0x1004c99d
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1004c99d
and dword [ebp - 0x814], 0
jmp 0x1004c9a7
mov dword [ebp - 0x814], 1
cmp dword [ebp - 0x814], 0xed1b4b1c
je 0x1004c9bf
mov dword [ebp - 0x6d4], 1
jmp 0x1004c9c6
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x8f8]
jl 0x1004c9ec
mov dword [ebp - 0x6dc], 1
jmp 0x1004c9f3
and dword [ebp - 0x6dc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp + eax - 0xebc], ecx
jmp 0x1004c7a5
and dword [ebp - 0x260], 0
jmp 0x1004b9d8
mov dword [ebp - 0xcfc], 0xffffffff
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1004ca3f
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1004ca62
push 0
push 0x17d2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xb88], 0
lea eax, [ebp - 0xb88]
push eax
lea ecx, [ebp - 0xf78]
call fcn.1003d450
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xa20], eax
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0x5f8]
mov ecx, dword [ebp - 0xa20]
call fcn.1003dc8a
mov dword [0x1061c0a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.10018936
push 2
lea ecx, [ebp - 0x1d4]
call fcn.100189c9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x20], 6
mov dword [ebp - 0xa28], 0xfffaa232
mov dword [ebp - 0x2ec], 0
jmp 0x1004cafe
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x1004cb1d
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
and dword [eax], 0
jmp 0x1004caf1
mov dword [ebp - 0x20], 0
jmp 0x1004cb2d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x1004cd22
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004cb69
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004cb69
mov dword [ebp - 0x824], 1
jmp 0x1004cb70
and dword [ebp - 0x824], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
cmp dword [eax], 0
jne 0x1004cb8c
mov eax, 0x20348f4a
test eax, eax
je 0x1004cb99
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
cmp dword [eax], 0xffffffff
jge 0x1004cbef
mov dword [ebp - 0x81c], 1
jmp 0x1004cbf6
and dword [ebp - 0x81c], 0
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
mov ecx, dword [ebp - 0x81c]
cmp ecx, dword [eax]
jle 0x1004cc19
mov dword [ebp - 0xb5c], 1
jmp 0x1004cc20
and dword [ebp - 0xb5c], 0
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
mov eax, dword [eax]
add eax, 0x4326
je 0x1004cc63
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004cc63
mov dword [ebp - 0x6e4], 1
jmp 0x1004cc6a
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x6e4], eax
jle 0x1004cc81
mov dword [ebp - 0x8c0], 1
jmp 0x1004cc88
and dword [ebp - 0x8c0], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d4]
call fcn.10018a67
mov ecx, dword [ebp - 0x8c0]
cmp ecx, dword [eax]
jle 0x1004ccac
mov dword [ebp - 0x6ec], 1
jmp 0x1004ccb3
and dword [ebp - 0x6ec], 0
imul eax, dword [ebp - 0x6ec], 0x39d5
test eax, eax
jle 0x1004cccd
mov dword [ebp - 0x6f4], 1
jmp 0x1004ccd4
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x824]
cmp eax, dword [ebp - 0x6f4]
jg 0x1004ccee
mov dword [ebp - 0x928], 1
jmp 0x1004ccf5
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 4
jb 0x1004cd0a
mov dword [ebp - 0x6fc], 1
jmp 0x1004cd11
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0xa28], eax
jmp 0x1004cb26
mov dword [ebp - 0x20], 0
jmp 0x1004cd32
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x13
jl 0x1004cd6c
mov dword [ebp - 0xb18], 1
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1004cd5f
push 0x15fe
call dword [sym.imp.GDI32.dll_GetBkColor]
cmp dword [ebp - 0xb18], 0
je 0x1004cd6a
jmp 0x1004cd2b
jmp 0x1004cd2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d4]
call fcn.10018a4b
and dword [ebp - 0x268], 0
jmp 0x1004cd91
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xe
jae 0x1004cdaa
mov eax, dword [ebp - 0x268]
mov byte [ebp + eax - 0xb88], 0
jmp 0x1004cd84
mov dword [ebp - 0x68], 0x8c45cdbe
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0xb64], 0x94b5
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1004cde9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x68], 0
je 0x1004cf16
mov dword [ebp - 0x70c], 0x7c04ccb6
mov dword [ebp - 0x2f4], 0
jmp 0x1004ce16
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1004ce32
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0xae4], 0xffff
jmp 0x1004ce09
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xae4]
cmp ecx, dword [ebp + eax - 0xae4]
jg 0x1004ce58
mov dword [ebp - 0x82c], 1
jmp 0x1004ce5f
and dword [ebp - 0x82c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xae4]
mov dword [ebp - 0xd04], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae4]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x82c], eax
je 0x1004ce9e
mov dword [ebp - 0x704], 1
jmp 0x1004cea5
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x704], eax
jne 0x1004cebc
mov dword [ebp - 0x8c8], 1
jmp 0x1004cec3
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x8c8], eax
jl 0x1004ceda
mov dword [ebp - 0xa30], 1
jmp 0x1004cee1
and dword [ebp - 0xa30], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae4]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xd14], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x68], eax
jmp 0x1004d0a1
mov dword [ebp - 0x178], 1
mov dword [ebp - 0xb28], 0xe74bb9c
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x1004cf51
mov eax, 0xef7e
test eax, eax
jne 0x1004cf51
and dword [ebp - 0x714], 0
jmp 0x1004cf5b
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0xb64]
test eax, eax
ja 0x1004cf78
mov dword [ebp - 0x834], 1
jmp 0x1004cf7f
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0xa6f9
jg 0x1004cf97
mov dword [ebp - 0x900], 1
jmp 0x1004cf9e
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 0x900]
jge 0x1004cfb8
mov dword [ebp - 0x71c], 1
jmp 0x1004cfbf
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
add eax, 0x324015fb
jns 0x1004cfd8
mov dword [ebp - 0x83c], 1
jmp 0x1004cfdf
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x83c], eax
jge 0x1004cff9
mov dword [ebp - 0x724], 1
jmp 0x1004d000
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x724], eax
jne 0x1004d020
cmp dword [ebp - 0x178], 0
jne 0x1004d020
and dword [ebp - 0xa38], 0
jmp 0x1004d02a
mov dword [ebp - 0xa38], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xd24], eax
cmp dword [ebp - 0x68], 3
je 0x1004d04e
mov dword [ebp - 0x8d0], 1
jmp 0x1004d055
and dword [ebp - 0x8d0], 0
imul eax, dword [ebp - 0x8d0], 0x9b45
cmp eax, dword [ebp - 0x68]
jg 0x1004d070
mov dword [ebp - 0x72c], 1
jmp 0x1004d077
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x72c]
je 0x1004d08e
mov dword [ebp - 0x844], 1
jmp 0x1004d095
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0x104], 0xfffffffc
mov dword [ebp - 0x2fc], 0xfffffff9
mov dword [ebp - 0x538], 0x8f9ed02e
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0xa50], 0xfffffffa
mov dword [ebp - 0x270], 0
jmp 0x1004d0ec
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x1004d108
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x994], 0xfffffff8
jmp 0x1004d0df
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x734], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0x994], ecx
cmp dword [ebp - 0x734], 0
jne 0x1004d1f8
cmp dword [ebp - 0x104], 0x45c1
jl 0x1004d14c
mov dword [ebp - 0x514], 1
jmp 0x1004d153
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xfffc
jb 0x1004d16b
mov dword [ebp - 0x518], 1
jmp 0x1004d172
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x518], eax
jge 0x1004d18c
mov dword [ebp - 0xa44], 1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0x2fc], 0x6758
push 3
pop eax
cmp eax, 8
jbe 0x1004d22c
mov dword [ebp - 0xb6c], 1
jmp 0x1004d233
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x104]
mov dword [ebp - 0x538], eax
je 0x1004d25a
cmp dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x994], 3
jae 0x1004d27c
mov dword [ebp - 0x18c], 9
mov dword [ebp - 0x648], 0x79cf1813
push 1
lea ecx, [ebp - 0xc9c]
call fcn.100189c9
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x9c], 0
jmp 0x1004de5c
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1004de7e
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xc9c]
call fcn.10018a67
mov dword [eax], 0xfffffffe
jmp 0x1004de4f
mov dword [ebp - 0x9c], 0
jmp 0x1004de97
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1004deb3
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xee4], 0x673292c5
jmp 0x1004de8a
mov dword [ebp - 0x18c], 0
jmp 0x1004decc
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x11
je 0x1004df74
mov dword [ebp - 0xa78], 0x7161
mov dword [ebp - 0xb70], 0x15a
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0xa485bf25
je 0x1004df11
mov dword [ebp - 0x31c], 1
jmp 0x1004df18
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0xc9c]
call fcn.10018a67
mov ecx, dword [ebp - 0x31c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x31c]
je 0x1004df47
mov dword [ebp - 0x650], 1
jmp 0x1004df4e
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x650]
mov dword [ebp + eax - 0xee4], ecx
cmp dword [ebp - 0xb70], 0
je 0x1004df6f
jmp 0x1004debf
jmp 0x1004debf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc9c]
call fcn.10018a4b
mov eax, dword [0x1061c0a8]
cmp eax, dword [ebp - 0x224]
je 0x1004df9d
mov eax, dword [0x1061c26c]
cmp eax, dword [ebp - 0x224]
jne 0x1004dfb5
mov ecx, dword [ebp + 0xc]
call fcn.100183f5
push eax
push dword [ebp + 8]
call fcn.10043266
pop ecx
pop ecx
jmp 0x100503ad
mov dword [ebp - 0x154], 9
mov dword [ebp - 0x678], 0x19d87263
mov dword [ebp - 0x298], 0
jmp 0x1004dfe2
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x1004dffe
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x2a0], 0x4e2db58
jmp 0x1004dfd5
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1004e018
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 0x154], 0
jmp 0x1004e031
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jg 0x1004e1dd
mov dword [ebp - 0x2f0], 0
jmp 0x1004e057
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1004e073
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x3b8], 0xf390197f
jmp 0x1004e04a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3b8], 0
jmp 0x1004e09e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3b8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b8], 0
jl 0x1004e1d8
mov dword [ebp - 0xa80], 0xc80ae7b1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b8]
mov eax, dword [ebp + eax*4 - 0x2a0]
mov dword [ebp - 0xdfc], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x3b8]
sub ecx, dword [ebp + eax - 0x3b8]
cmp ecx, 1
jge 0x1004e0fd
mov dword [ebp - 0x658], 1
jmp 0x1004e104
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x658], eax
je 0x1004e124
cmp dword [ebp - 0x154], 0
jne 0x1004e124
and dword [ebp - 0x660], 0
jmp 0x1004e12e
mov dword [ebp - 0x660], 1
cmp dword [ebp - 0x660], 0xa22e
jle 0x1004e14c
mov eax, 0x4220
test eax, eax
jne 0x1004e14c
and dword [ebp - 0x668], 0
jmp 0x1004e156
mov dword [ebp - 0x668], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x3b8]
push 4
pop edx
shl edx, 1
mov edx, dword [ebp + edx - 0x3b8]
mov edx, dword [ebp + edx*4 - 0x2a0]
add edx, dword [ebp - 0x668]
imul edx, dword [ebp + ecx*4 - 0x2a0]
sub edx, dword [ebp + eax - 0x2a0]
cmp edx, 0xef70
jge 0x1004e1a8
xor eax, eax
je 0x1004e1a8
mov dword [ebp - 0x670], 1
jmp 0x1004e1af
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x678], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x678]
sub ecx, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xa80], ecx
jmp 0x1004e085
jmp 0x1004e024
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x324], 0xfffffffb
mov dword [ebp - 0xa88], 0
cmp dword [ebp - 0x6c], 0
jne 0x1004e262
cmp dword [ebp - 0x6c], 0
jne 0x1004e21c
cmp dword [ebp - 0x6c], 0xffffffff
je 0x1004e21c
and dword [ebp - 0x680], 0
jmp 0x1004e226
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0x680]
add eax, 0x74bf90ed
jne 0x1004e242
cmp dword [ebp - 0x6c], 0
jne 0x1004e242
and dword [ebp - 0x688], 0
jmp 0x1004e24c
mov dword [ebp - 0x688], 1
mov eax, dword [ebp - 0x688]
shl eax, 2
test eax, eax
jne 0x1004e262
and dword [ebp - 0x690], 0
jmp 0x1004e26c
mov dword [ebp - 0x690], 1
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x6c], 0xfffffff6
jmp 0x1004e288
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x11
je 0x1004e4db
mov dword [ebp - 0xc0], 0xfffffff8
mov dword [ebp - 0x32c], 0xc0fa
push 4
lea ecx, [ebp - 0x958]
call fcn.100189c9
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xb48], 0xfffffffa
mov dword [ebp - 0xb94], 0xed55c59c
mov dword [ebp - 0x2d8], 0
jmp 0x1004e2e7
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x1004e309
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov dword [eax], 4
jmp 0x1004e2da
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xe04], eax
mov eax, 0xbefa
test eax, eax
jne 0x1004e339
cmp dword [ebp - 0x6c], 0
jne 0x1004e339
and dword [ebp - 0x698], 0
jmp 0x1004e343
mov dword [ebp - 0x698], 1
cmp dword [ebp - 0x698], 0xfffffff8
je 0x1004e358
mov dword [ebp - 0x6a0], 1
jmp 0x1004e35f
and dword [ebp - 0x6a0], 0
mov esi, dword [ebp - 0x324]
mov edi, dword [ebp - 0xc0]
push 1
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov eax, dword [eax]
sub eax, dword [ebp - 0x6a0]
sub eax, edi
cmp eax, esi
jle 0x1004e392
mov dword [ebp - 0x6a8], 1
jmp 0x1004e399
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0x6a8]
jl 0x1004e3b3
mov dword [ebp - 0x6b0], 1
jmp 0x1004e3ba
and dword [ebp - 0x6b0], 0
push 1
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov ecx, dword [ebp - 0x6b0]
cmp ecx, dword [eax]
jne 0x1004e3dd
mov dword [ebp - 0x6b8], 1
jmp 0x1004e3e4
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x6b8], eax
jge 0x1004e3fe
mov dword [ebp - 0x6c0], 1
jmp 0x1004e405
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
sub eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0x6c]
jl 0x1004e422
mov dword [ebp - 0x6c8], 1
jmp 0x1004e429
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 0xffff
je 0x1004e441
mov dword [ebp - 0x6d0], 1
jmp 0x1004e448
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x6d8], eax
push 1
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov ecx, dword [ebp - 0x6d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xc0], 0
jmp 0x1004e494
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1004e4c7
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov esi, eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x958]
call fcn.10018a67
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1004e487
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x958]
call fcn.10018a4b
jmp 0x1004e281
cmp dword [ebp - 0x2a8], 0
je 0x10050143
mov eax, dword [ebp - 0x2a8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10050143
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1bc], ecx
push 2
lea ecx, [ebp - 0x924]
call fcn.100189c9
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x10c], 0x39beb064
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x300], 0
jmp 0x1004e54f
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1004e571
push dword [ebp - 0x300]
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov dword [eax], 0xbca63185
jmp 0x1004e542
mov dword [ebp - 0x10c], 0
jmp 0x1004e58a
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jg 0x1004e6ed
mov dword [ebp - 0x214], 0xfffffff9
mov dword [ebp - 0xa90], 1
mov dword [ebp - 0xb78], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov esi, eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1004e5e7
mov dword [ebp - 0x6e0], 1
jmp 0x1004e5ee
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1004e612
cmp dword [ebp - 0x214], 0
je 0x1004e612
mov dword [ebp - 0x6e8], 1
jmp 0x1004e619
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x6e8], eax
jg 0x1004e633
mov dword [ebp - 0xb50], 1
jmp 0x1004e63a
and dword [ebp - 0xb50], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0xe0c], eax
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x3c]
cmp eax, 0xf2c9
jl 0x1004e66f
mov dword [ebp - 0xa98], 1
jmp 0x1004e676
and dword [ebp - 0xa98], 0
push 0
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov esi, dword [ebp - 0x10c]
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x924]
call fcn.10018a67
cmp dword [eax], esi
jge 0x1004e6aa
mov dword [ebp - 0x6f0], 1
jmp 0x1004e6b1
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xb78], eax
cmp dword [ebp - 0x214], 0
je 0x1004e6c8
jmp 0x1004e6ed
mov dword [ebp - 0x3c], 0
jmp 0x1004e6d8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1004e6e8
cmp dword [ebp - 0x3c], 0
je 0x1004e6e6
jmp 0x1004e6e8
jmp 0x1004e6d1
jmp 0x1004e57d
mov dword [ebp - 0x3c], 0
jmp 0x1004e6fd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1004e719
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x924]
call fcn.10018a67
mov dword [eax], 1
jmp 0x1004e6f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x924]
call fcn.10018a4b
mov eax, dword [ebp - 0x1bc]
cmp dword [eax], 0x4550
jne 0x10050143
mov eax, dword [ebp - 0x1bc]
cmp dword [eax + 0x74], 0
jbe 0x10050143
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
cmp dword [ecx + eax + 0x78], 0
je 0x10050143
mov dword [ebp - 0x34], 0xe0648261
mov dword [ebp - 0x7c], 0xc9ed9ba0
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x740], 0xffffffff
mov dword [ebp - 0x3ec], 0xfef5379a
mov dword [ebp - 0xbb0], 0xf65c
mov dword [ebp - 0x34], 0
jmp 0x1004e7a7
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x13
jne 0x1004eadc
mov dword [ebp - 0x334], 0xe446df37
mov dword [ebp - 0x194], 0x623b4709
cmp dword [ebp - 0x334], 0
je 0x1004e90e
mov dword [ebp - 0x700], 0xffffffff
mov dword [ebp - 0x2b0], 0
jmp 0x1004e7f5
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1004e811
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xe8c], 0xe662db8e
jmp 0x1004e7e8
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x334]
jle 0x1004e828
mov dword [ebp - 0x6f8], 1
jmp 0x1004e82f
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x334]
add eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x700], eax
jmp 0x1004e84f
and dword [ebp - 0x708], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8c]
cmp eax, dword [ebp - 0x708]
je 0x1004e877
mov dword [ebp - 0x710], 1
jmp 0x1004e87e
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x710]
neg eax
jne 0x1004e89a
mov eax, 0xffff
test eax, eax
jne 0x1004e89a
and dword [ebp - 0x718], 0
jmp 0x1004e8a4
mov dword [ebp - 0x718], 1
xor eax, eax
sub eax, dword [ebp - 0x718]
jne 0x1004e8ba
mov dword [ebp - 0x720], 1
jmp 0x1004e8c1
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x720]
test eax, eax
je 0x1004e8e1
cmp dword [ebp - 0x34], 0
je 0x1004e8e1
mov dword [ebp - 0x728], 1
jmp 0x1004e8e8
and dword [ebp - 0x728], 0
mov dword [ebp - 0x7c], 1
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x728]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x7c], 0
je 0x1004e909
jmp 0x1004eadc
jmp 0x1004ead7
mov dword [ebp - 0x194], 0
jmp 0x1004e927
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 9
je 0x1004ead7
mov dword [ebp - 0xaa0], 0x16e1
cmp dword [ebp - 0xaa0], 0x66e
jge 0x1004eab4
lea eax, [ebp - 0x33c]
push eax
push 0x100082dc
call fcn.1005a022
pop ecx
pop ecx
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0xb58], 0
je 0x1004eab4
lea eax, [ebp - 0x1a4]
push eax
push 0x100082dc
call fcn.1005a022
pop ecx
pop ecx
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0xb14]
call fcn.1005321e
mov dword [ebp - 4], 0x1a
and dword [ebp - 0x2e0], 0
jmp 0x1004e9c8
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x1a4]
jge 0x1004e9f6
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xb14]
call fcn.10018a67
push eax
push 0x100082dc
call fcn.1005a022
pop ecx
pop ecx
jmp 0x1004e9bb
or dword [ebp - 0x344], 0xffffffff
mov dword [ebp - 0x19c], 1
jmp 0x1004ea16
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x1a4]
dec eax
cmp dword [ebp - 0x19c], eax
jge 0x1004ea71
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xb14]
call fcn.10018a67
mov esi, eax
push 0
lea ecx, [ebp - 0xb14]
call fcn.10018a67
mov edi, dword [eax]
add edi, dword [esi]
mov eax, dword [ebp - 0x1a4]
dec eax
push eax
lea ecx, [ebp - 0xb14]
call fcn.10018a67
cmp dword [eax], edi
jl 0x1004ea6f
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x344], eax
jmp 0x1004ea71
jmp 0x1004ea09
cmp dword [ebp - 0x344], 0
jle 0x1004ea95
push dword [ebp - 0x1a4]
push dword [ebp - 0x344]
push 0x100095d4
call fcn.10059c69
add esp, 0xc
jmp 0x1004eaa0
push 0x10008ca4
call fcn.1005a16d
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb14]
call fcn.100380c5
jmp 0x1004e961
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1004ead2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x1004e91a
jmp 0x1004e7a0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x7c]
je 0x1004eaf0
mov dword [ebp - 0x3dc], 1
jmp 0x1004eaf7
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe14], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jle 0x1004eb18
mov dword [ebp - 0x730], 1
jmp 0x1004eb1f
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0x7c]
dec eax
sub eax, dword [ebp - 0x114]
jne 0x1004eb58
cmp dword [ebp - 0x114], 0
jne 0x1004eb58
and dword [ebp - 0x738], 0
jmp 0x1004eb62
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
cmp eax, dword [ebp - 0x7c]
jne 0x1004eb85
mov dword [ebp - 0x3cc], 1
jmp 0x1004eb8c
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x3cc], eax
jne 0x1004eba6
mov dword [ebp - 0x3d4], 1
jmp 0x1004ebad
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x3d4]
jg 0x1004ebc4
mov dword [ebp - 0x3e4], 1
jmp 0x1004ebcb
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0x3e4]
jl 0x1004ebe5
mov dword [ebp - 0xaa8], 1
jmp 0x1004ebec
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xde8], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x114]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x11c], 0xfffffffd
mov dword [ebp - 0x40c], 0xffffffff
mov dword [ebp - 0xb60], 0
mov dword [ebp - 0xab8], 0xffffffff
mov dword [ebp - 0x58], 0
jmp 0x1004ec7f
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffee
jge 0x1004eddb
push 1
lea ecx, [ebp - 0xb24]
call fcn.100189c9
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xac], 0
jmp 0x1004ecb6
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1004ecd2
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xab0], 0x9be1d925
jmp 0x1004eca9
mov dword [ebp - 0xac], 0
jmp 0x1004eceb
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1004ed0d
push dword [ebp - 0xac]
lea ecx, [ebp - 0xb24]
call fcn.10018a67
mov dword [eax], 1
jmp 0x1004ecde
push 0
lea ecx, [ebp - 0xb24]
call fcn.10018a67
and dword [eax], 0
jmp 0x1004ed43
push 0
lea ecx, [ebp - 0xb24]
call fcn.10018a67
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb24]
call fcn.10018a67
cmp dword [eax], 0
jg 0x1004edc7
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b8], 0
jmp 0x1004ed78
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1004edc2
mov dword [ebp - 0x1ac], 0xfffffffa
mov dword [ebp - 0x1ac], 0
jmp 0x1004eda4
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1004edc0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xab0], 8
jmp 0x1004ed97
jmp 0x1004ed6b
jmp 0x1004ed1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb24]
call fcn.10018a4b
jmp 0x1004ec78
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xe08], eax
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1004ee42
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x58]
test eax, eax
je 0x1004ee1b
cmp dword [ebp - 0x11c], 0
je 0x1004ee1b
mov dword [ebp - 0x3fc], 1
jmp 0x1004ee22
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
sub eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x11c]
je 0x1004ee42
mov dword [ebp - 0x404], 1
jmp 0x1004ee49
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x11c]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x11c]
jle 0x1004ee81
mov dword [ebp - 0x414], 1
jmp 0x1004ee88
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x414]
je 0x1004ee9f
mov dword [ebp - 0x41c], 1
jmp 0x1004eea6
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xab8], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x124], 0xa3df603f
mov dword [ebp - 0x164], 0x1449c9fb
mov eax, dword [ebp - 0x124]
sub eax, 0x4672
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x164]
je 0x1004ef13
mov dword [ebp - 0x424], 1
jmp 0x1004ef1a
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x424], eax
jne 0x1004ef6c
mov dword [ebp - 0x124], 0
jmp 0x1004ef41
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x2f
jg 0x1004ef6a
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1004ef68
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x1004ef34
jmp 0x1004efe1
mov dword [ebp - 0x2f8], 0
jmp 0x1004ef85
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x1004efa1
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xed4], 0x1df8
jmp 0x1004ef78
mov dword [ebp - 0x164], 1
jmp 0x1004efba
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1004efe1
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1004efdf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x1004efad
mov eax, 0xffff
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x2e8], 0x6d44418
mov dword [ebp - 0x2c0], 0
jmp 0x1004f010
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1004f02c
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xefc], 0xfd5464b5
jmp 0x1004f003
mov dword [ebp - 0x2e8], 1
jmp 0x1004f045
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
jl 0x1004f08f
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1004f08d
push 0x2084
push 0x250d
push 0x1289
push 0x204b
push 0x9a7
push 0x59
push 0x2e
push 0xeb1
push 0xfe7
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x1004f038
or dword [ebp - 0x150], 0xffffffff
push 2
lea ecx, [ebp - 0x3ac]
call fcn.100189c9
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x34c], 0x8499
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x1b4], 7
mov dword [ebp - 0x27c], 0
jmp 0x1004f0eb
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1004f10d
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov dword [eax], 1
jmp 0x1004f0de
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
cmp esi, dword [eax]
jne 0x1004f13b
mov dword [ebp - 0x42c], 1
jmp 0x1004f142
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0xffffffff
jg 0x1004f157
mov dword [ebp - 0x434], 1
jmp 0x1004f15e
and dword [ebp - 0x434], 0
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov ecx, dword [ebp - 0x434]
cmp ecx, dword [eax]
jg 0x1004f193
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004f193
mov dword [ebp - 0x43c], 1
jmp 0x1004f19a
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x43c], eax
jge 0x1004f1b4
mov dword [ebp - 0xb8c], 1
jmp 0x1004f1bb
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xce8], eax
push 1
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov eax, dword [ebp - 0x34c]
dec eax
cmp eax, dword [ebp - 0x15c]
je 0x1004f1f8
mov eax, 0x5aee0cd9
test eax, eax
je 0x1004f1f8
mov dword [ebp - 0x444], 1
jmp 0x1004f1ff
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x15c], eax
mov esi, dword [ebp - 0x15c]
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
cmp esi, dword [eax]
jl 0x1004f234
cmp dword [ebp - 0x44c], 0
jne 0x1004f234
and dword [ebp - 0xac0], 0
jmp 0x1004f23e
mov dword [ebp - 0xac0], 1
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xdb8], eax
mov esi, dword [ebp - 0x44c]
push 0
lea ecx, [ebp - 0x3ac]
call fcn.10018a67
mov eax, dword [eax]
sub eax, esi
neg eax
jne 0x1004f284
cmp dword [ebp - 0x34c], 0
jne 0x1004f284
and dword [ebp - 0x454], 0
jmp 0x1004f28e
mov dword [ebp - 0x454], 1
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b4], 0xfffffff1
jmp 0x1004f2b3
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x10
je 0x1004f331
push 1
lea ecx, [ebp - 0xc84]
call fcn.100189c9
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x284], 0
jmp 0x1004f2e6
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1004f308
push dword [ebp - 0x284]
lea ecx, [ebp - 0xc84]
call fcn.10018a67
mov dword [eax], 0x90e6
jmp 0x1004f2d9
mov esi, dword [ebp - 0x15c]
push 0
lea ecx, [ebp - 0xc84]
call fcn.10018a67
mov dword [eax], esi
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xc84]
call fcn.10018a4b
jmp 0x1004f2a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.10018a4b
cmp dword [ebp + 0x10], 0
jbe 0x1004f364
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1004f35f
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa4], ax
jmp 0x1004fbb0
mov dword [ebp - 0xc8], 0xdb3ae355
mov dword [ebp - 0xac8], 0x86d6dbc1
mov dword [ebp - 0xc8], 2
jmp 0x1004f391
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe9
jle 0x1004f540
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x9c4], 0
mov dword [ebp - 0x9c0], 0
mov dword [ebp - 0x9bc], 0
mov dword [ebp - 0x354], 0xfffffffe
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9c8], 0xfffffff3
jmp 0x1004f3fe
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x9c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c8], 0xfffffffc
jne 0x1004f42f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x354], eax
jmp 0x1004f3e3
cmp dword [ebp - 0xc8], 0
je 0x1004f4eb
mov dword [ebp - 0x28c], 0xffffffff
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xcf0], eax
imul eax, dword [ebp - 0x28c], 0xc9fa
sub eax, dword [ebp - 0x28c]
cmp eax, 1
jae 0x1004f473
mov dword [ebp - 0x45c], 1
jmp 0x1004f47a
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x45c], eax
jge 0x1004f494
mov dword [ebp - 0x464], 1
jmp 0x1004f49b
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x464]
jg 0x1004f4b5
mov dword [ebp - 0xb2c], 1
jmp 0x1004f4bc
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xc8]
jle 0x1004f4d6
mov dword [ebp - 0x46c], 1
jmp 0x1004f4dd
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0xac8], eax
jmp 0x1004f53b
mov dword [ebp - 0x294], 0
jmp 0x1004f504
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x1004f520
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xd74], 0x2130
jmp 0x1004f4f7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd74]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xd74], eax
jmp 0x1004f384
mov eax, dword [0x1061c1c0]
and eax, 1
jne 0x1004f577
mov eax, dword [0x1061c1c0]
or eax, 1
mov dword [0x1061c1c0], eax
mov dword [ebp - 4], 0x1e
mov ecx, 0x1061c1e8
call fcn.10018d0b
push 0x10073a9d
call fcn.10059c3f
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x50], 0x9ad59e57
mov dword [ebp - 0xb4], 0
jmp 0x1004f597
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1004f5b3
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x964], 1
jmp 0x1004f58a
mov dword [ebp - 0xb4], 0
jmp 0x1004f5cc
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1004f5e8
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x29c], 6
jmp 0x1004f5bf
mov eax, dword [ebp - 0x50]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x964], eax
mov dword [ebp - 0x50], 0
jmp 0x1004f607
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1004f804
mov dword [ebp - 0x1c0], 0x3cf68729
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x964]
mov dword [ebp - 0xdf0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x964], 1
jg 0x1004f650
mov dword [ebp - 0x474], 1
jmp 0x1004f657
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x964]
cmp eax, dword [ebp - 0x474]
jg 0x1004f679
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1004f679
and dword [ebp - 0x47c], 0
jmp 0x1004f683
mov dword [ebp - 0x47c], 1
cmp dword [ebp - 0x47c], 0xfff7
jbe 0x1004f69b
mov dword [ebp - 0x484], 1
jmp 0x1004f6a2
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax*4 - 0x964], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x964]
cmp eax, dword [ebp - 0x1c0]
jle 0x1004f6d0
mov dword [ebp - 0x48c], 1
jmp 0x1004f6d7
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x48c], eax
je 0x1004f6f1
mov dword [ebp - 0x494], 1
jmp 0x1004f6f8
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x494]
jle 0x1004f70f
mov dword [ebp - 0x49c], 1
jmp 0x1004f716
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
add eax, 0xfff8
cmp eax, dword [ebp - 0x50]
jl 0x1004f732
mov dword [ebp - 0x4a4], 1
jmp 0x1004f739
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x4a4], eax
jg 0x1004f75a
mov dword [ebp - 0xb34], 1
jmp 0x1004f761
and dword [ebp - 0xb34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x964]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0xd00], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 0xfff7
ja 0x1004f7af
mov dword [ebp - 0x4ac], 1
jmp 0x1004f7b6
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x4ac], eax
je 0x1004f7d7
mov dword [ebp - 0x4b4], 1
jmp 0x1004f7de
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x4b4], eax
jg 0x1004f7f3
cmp dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x1c0], eax
jmp 0x1004f600
movzx eax, byte [0x1061c0b1]
test eax, eax
je 0x1004f870
mov ecx, 0x1061c1e8
call fcn.10053215
movzx eax, al
test eax, eax
jne 0x1004f870
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x4c4]
push eax
mov ecx, 0x1061c1e8
call fcn.10018b52
lea eax, [ebp - 0xe18]
push eax
mov ecx, 0x1061c1e8
call fcn.10018b44
push eax
lea ecx, [ebp - 0x4c4]
call fcn.10018b67
movzx eax, al
test eax, eax
je 0x1004f870
lea ecx, [ebp - 0x4c4]
call fcn.1005325a
mov eax, dword [eax + 4]
mov dword [ebp - 0x150], eax
push 2
lea ecx, [ebp - 0x934]
call fcn.100189c9
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x12c], 0x39beb064
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x218], 0
jmp 0x1004f8ae
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x1004f8d0
push dword [ebp - 0x218]
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov dword [eax], 0xbca63185
jmp 0x1004f8a1
mov dword [ebp - 0x12c], 0
jmp 0x1004f8e9
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jg 0x1004fa4c
mov dword [ebp - 0x21c], 0xfffffff9
mov dword [ebp - 0xad0], 1
mov dword [ebp - 0x9ec], 0
push 0
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov esi, eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1004f946
mov dword [ebp - 0x4cc], 1
jmp 0x1004f94d
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x1004f971
cmp dword [ebp - 0x21c], 0
je 0x1004f971
mov dword [ebp - 0x4d4], 1
jmp 0x1004f978
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0xad0]
cmp dword [ebp - 0x4d4], eax
jg 0x1004f992
mov dword [ebp - 0x9e0], 1
jmp 0x1004f999
and dword [ebp - 0x9e0], 0
push 0
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x40]
cmp eax, 0xf2c9
jl 0x1004f9ce
mov dword [ebp - 0x9e4], 1
jmp 0x1004f9d5
and dword [ebp - 0x9e4], 0
push 0
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov esi, dword [ebp - 0x12c]
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x934]
call fcn.10018a67
cmp dword [eax], esi
jge 0x1004fa09
mov dword [ebp - 0x4dc], 1
jmp 0x1004fa10
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x9ec], eax
cmp dword [ebp - 0x21c], 0
je 0x1004fa27
jmp 0x1004fa4c
mov dword [ebp - 0x40], 0
jmp 0x1004fa37
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x1004fa47
cmp dword [ebp - 0x40], 0
je 0x1004fa45
jmp 0x1004fa47
jmp 0x1004fa30
jmp 0x1004f8dc
mov dword [ebp - 0x40], 0
jmp 0x1004fa5c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1004fa78
push dword [ebp - 0x40]
lea ecx, [ebp - 0x934]
call fcn.10018a67
mov dword [eax], 1
jmp 0x1004fa55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x934]
call fcn.10018a4b
cmp dword [ebp - 0x150], 0xffffffff
jne 0x1004fbb0
mov ecx, 0x1061c1e8
call fcn.1005329e
mov ecx, dword [ebp - 0xd0]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1061c1e8
call fcn.100532a2
and dword [ebp - 0x148], 0
jmp 0x1004fac8
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x148]
cmp ecx, dword [eax + 0x18]
jae 0x1004fbb0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x148]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
je 0x1004fbab
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xf1c]
call fcn.1003d450
mov dword [ebp - 4], 0x20
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xf1c]
call fcn.1003dc8a
mov dword [ebp - 0x4ec], eax
movzx eax, byte [0x1061c0b1]
test eax, eax
je 0x1004fb59
mov ecx, 0x1061c1e8
call fcn.10053215
movzx eax, al
test eax, eax
jne 0x1004fb79
lea eax, [ebp - 0x4ec]
push eax
mov ecx, 0x1061c1e8
call fcn.10053260
mov ecx, dword [ebp - 0x148]
mov dword [eax], ecx
mov byte [0x1061c0b1], 1
cmp dword [ebp - 0x150], 0xffffffff
jne 0x1004fb9c
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x224]
jne 0x1004fb9c
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf1c]
call fcn.10018936
jmp 0x1004fabb
mov dword [ebp - 0xdc8], 0xb950
mov dword [ebp - 0xa8], 0
jmp 0x1004fbd3
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1004fbef
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xe74], 0x7fd5
jmp 0x1004fbc6
mov dword [ebp - 0xa8], 0
jmp 0x1004fc08
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1004fc24
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x8a4], 0xfffffff6
jmp 0x1004fbfb
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8a4], 2
jmp 0x1004fc52
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8a4], 0
jl 0x1004fc7d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
cmp dword [ebp + eax*4 - 0xe74], 0
je 0x1004fc7b
jmp 0x1004fc7d
jmp 0x1004fc37
cmp dword [ebp + 0x10], 0
jne 0x1004fcac
cmp dword [ebp - 0x150], 0xffffffff
je 0x1004fcac
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x150]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xa4], ax
push 3
lea ecx, [ebp - 0xc60]
call fcn.100189c9
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x234], 0xfffffff8
mov dword [ebp - 0x22c], 0
jmp 0x1004fce3
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1004fd05
push dword [ebp - 0x22c]
lea ecx, [ebp - 0xc60]
call fcn.10018a67
mov dword [eax], 0x313dd33a
jmp 0x1004fcd6
mov dword [ebp - 0x234], 2
jmp 0x1004fd1e
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jl 0x1004fd6f
mov dword [ebp - 0x1c8], 0x88adae8c
mov dword [ebp - 0x1c8], 0
jmp 0x1004fd4a
cmp dword [ebp - 0x1c8], 2
jg 0x1004fd6d
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xc60]
call fcn.10018a67
cmp dword [eax], 0
je 0x1004fd6b
jmp 0x1004fd6d
jmp 0x1004fd3d
jmp 0x1004fd11
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc60]
call fcn.10018a4b
movzx eax, word [ebp - 0xa4]
cmp eax, 0xffff
je 0x10050143
movzx eax, word [ebp - 0xa4]
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x9f4], eax
mov eax, dword [ebp - 0x9f4]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax]
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xd0]
jbe 0x10050138
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0xd0]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe0], edx
jae 0x10050138
mov eax, dword [0x1061c1c0]
and eax, 2
jne 0x1004fe29
mov eax, dword [ebp - 0xe0]
jmp 0x100503ad
mov dword [ebp - 0x24c], 0
push 2
lea ecx, [ebp - 0xd94]
call fcn.100189c9
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x244], 0
jmp 0x1005017a
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1005019c
push dword [ebp - 0x244]
lea ecx, [ebp - 0xd94]
call fcn.10018a67
mov dword [eax], 0xfffffffe
jmp 0x1005016d
mov dword [ebp - 0x24c], 0
jmp 0x100501b5
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jg 0x1005039c
push 2
lea ecx, [ebp - 0xd84]
call fcn.100189c9
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x504], 0x609b
mov dword [ebp - 0xa04], 0x100095e0
cmp dword [ebp - 0x504], 0x60a7
jle 0x100502d1
and dword [ebp - 0x254], 0
jmp 0x1005020d
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x3d50
jge 0x100502d1
and dword [ebp - 0x25c], 0
jmp 0x10050233
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x3e5d
jge 0x100502cc
and dword [ebp - 0x264], 0
jmp 0x10050259
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x15c
jge 0x100502c7
and dword [ebp - 0x26c], 0
jmp 0x1005027b
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x27d8
jge 0x100502c5
mov eax, dword [ebp - 0x254]
imul eax, dword [ebp - 0x25c]
sub eax, dword [ebp - 0x264]
add eax, dword [ebp - 0x26c]
cdq
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], edx
push dword [ebp - 0xa48]
push dword [ebp - 0xa4c]
mov ecx, 0x1061af38
call fcn.100186af
jmp 0x1005026e
jmp 0x1005024c
jmp 0x10050226
jmp 0x10050200
mov dword [ebp - 0x50c], 0xa0734f09
mov byte [ebp - 4], 0x29
cmp dword [ebp - 0x504], 0x5d00
jge 0x100502fb
mov edx, dword [ebp - 0xa04]
mov ecx, 0x1061af38
call fcn.1001d234
jmp 0x10050317
mov dword [ebp - 4], 0x28
jmp 0x10050327
mov dword [ebp - 0x274], 0
jmp 0x10050340
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1005035f
push dword [ebp - 0x274]
lea ecx, [ebp - 0xd84]
call fcn.10018a67
or dword [eax], 0xffffffff
jmp 0x10050333
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1005037b
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xd84]
call fcn.10018a4b
jmp 0x100501a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd94]
call fcn.10018a4b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret