Function at 0x10036777
Capabilities:
Encrypt data using speck
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100646c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1318
call fcn.1005fde0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100368ed
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xbf8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0xd28]
movzx eax, byte [eax]
test eax, eax
je 0x10036860
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0x154]
mov dword [eax], 0
jmp 0x10036835
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x154]
mov dword [ecx], eax
mov eax, dword [ebp - 0x154]
cmp dword [eax], 2
jge 0x1003685b
mov eax, dword [ebp - 0x154]
push dword [eax]
mov ecx, dword [ebp - 0xd20]
call fcn.1001a954
mov dword [eax], 0xf58382bd
jmp 0x10036824
jmp 0x100368e8
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x110]
mov dword [eax], 3
jmp 0x100368af
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
mov eax, dword [ebp - 0x110]
cmp dword [eax], 0
jl 0x100368e8
mov eax, dword [ebp - 0x110]
push dword [eax]
mov ecx, dword [ebp - 0x59c]
call fcn.1001a954
mov esi, eax
mov eax, dword [ebp - 0x110]
push dword [eax]
mov ecx, dword [ebp - 0x59c]
call fcn.1001a954
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003689e
jmp 0x1003f3f4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xd68], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0xd50], eax
mov dword [ebp - 0x9d0], 0x1e59
mov dword [ebp - 0xd48], 0x1000a570
cmp dword [ebp - 0x9d0], 0x1fea
jle 0x10036a08
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
and dword [ebp - 0x224], 0
jmp 0x10036943
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x22c7
jge 0x10036a08
and dword [ebp - 0x1b8], 0
jmp 0x10036969
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x5bcc
jge 0x10036a03
and dword [ebp - 0x3a4], 0
jmp 0x1003698f
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x7ffe
jge 0x100369fe
and dword [ebp - 0x1b0], 0
jmp 0x100369b1
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x25d2
jge 0x100369fc
mov eax, dword [ebp - 0x3a4]
sub eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x1b8]
xor eax, ecx
cdq
mov dword [ebp - 0xc1c], eax
mov dword [ebp - 0xc18], edx
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x100369a4
jmp 0x10036982
jmp 0x1003695c
jmp 0x10036936
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xd60], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x9d0], 0x1d74
jge 0x10036a31
mov edx, dword [ebp - 0xd48]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x10036a4d
or dword [ebp - 4], 0xffffffff
jmp 0x10036a57
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xd50]
movzx eax, byte [eax]
test eax, eax
je 0x10036a81
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x1003f3f4
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x404], eax
push 1
lea ecx, [ebp - 0xa10]
call fcn.1001a8b6
mov dword [ebp - 4], 2
push 3
lea ecx, [ebp - 0x1a4]
call fcn.1001a8b6
mov byte [ebp - 4], 3
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x1c0], 0xedda5659
mov dword [ebp - 0xab0], 0x4942beba
mov dword [ebp - 0x164], 0
jmp 0x10036b0d
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x10036b2f
push dword [ebp - 0x164]
lea ecx, [ebp - 0xa10]
call fcn.1001a954
mov dword [eax], 0x55683450
jmp 0x10036b00
lea eax, [ebp - 0x1a4]
push eax
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.1004697a
add esp, 0xc
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
and dword [eax], 0
jmp 0x10036b7d
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9d8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
cmp dword [eax], 0
jl 0x10037327
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x22c], 0xae8b0121
push 2
lea ecx, [ebp - 0xd78]
call fcn.1001a8b6
mov byte [ebp - 4], 4
mov dword [ebp - 0x38], 0
jmp 0x10036bc8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10036bde
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa28], 0xfffffffe
jmp 0x10036bc1
push 0x57fe
push 0
push 0
lea eax, [ebp - 0xd78]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x728a
call fcn.10047bb7
add esp, 0x18
mov dword [ebp - 0x38], 0
jmp 0x10036c0f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10036c25
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe84], 0x7f6a191a
jmp 0x10036c08
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa28]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa28], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa28], 0xfffffffb
jl 0x10036c5c
mov dword [ebp - 0xde8], 1
jmp 0x10036c63
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xfa8], eax
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
mov esi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
mov eax, dword [eax]
lea eax, [esi + eax - 1]
cmp eax, 7
jl 0x10036ca6
mov dword [ebp - 0x9e0], 1
jmp 0x10036cad
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x9e0], eax
jne 0x10036cc7
mov dword [ebp - 0x9e8], 1
jmp 0x10036cce
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x22c], eax
mov esi, dword [ebp - 0x22c]
push 1
lea ecx, [ebp - 0xd78]
call fcn.1001a954
imul esi, dword [eax]
mov dword [ebp - 0x424], esi
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa10]
call fcn.1001a954
cmp dword [ebp - 0xd8], 0xffff
ja 0x10036d28
mov dword [ebp - 0x9f0], 1
jmp 0x10036d2f
and dword [ebp - 0x9f0], 0
cmp dword [ebp - 0x9f0], 0x4c7b
jg 0x10036d47
mov dword [ebp - 0x9f8], 1
jmp 0x10036d4e
and dword [ebp - 0x9f8], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xe84]
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
mov ecx, dword [ebp - 0x9f8]
imul ecx, dword [eax]
imul eax, ecx, 0x7d64
sub eax, esi
je 0x10036dc2
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x10036d97
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 1
lea ecx, [ebp - 0xd78]
call fcn.1001a954
cmp dword [eax], 0
je 0x10036dbd
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd78]
call fcn.1001a938
jmp 0x10037327
jmp 0x10037313
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x23c], 0
cmp dword [ebp - 0x22c], 0
jne 0x10036e11
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa10]
call fcn.1001a954
cmp dword [eax], 0
jne 0x10036e11
and dword [ebp - 0x738], 0
jmp 0x10036e1b
mov dword [ebp - 0x738], 1
cmp dword [ebp - 0x1c0], 0x5452
jl 0x10036e33
mov dword [ebp - 0x8a4], 1
jmp 0x10036e3a
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x8a4], eax
je 0x10036e54
mov dword [ebp - 0x9c8], 1
jmp 0x10036e5b
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 0xbe945d4
je 0x10036e79
cmp dword [ebp - 0x22c], 0
jne 0x10036e79
and dword [ebp - 0x454], 0
jmp 0x10036e83
mov dword [ebp - 0x454], 1
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x454]
jle 0x10036e9d
mov dword [ebp - 0x450], 1
jmp 0x10036ea4
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe84]
cmp dword [ebp - 0x450], eax
jge 0x10036ec5
mov dword [ebp - 0x734], 1
jmp 0x10036ecc
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x734], eax
jge 0x10036ee6
mov dword [ebp - 0x458], 1
jmp 0x10036eed
and dword [ebp - 0x458], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x458]
sub ecx, dword [ebp + eax - 0xa28]
cmp ecx, 0x84ebf8c3
jae 0x10036f14
mov dword [ebp - 0x460], 1
jmp 0x10036f1b
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0x460]
jne 0x10036f35
mov dword [ebp - 0x8b0], 1
jmp 0x10036f3c
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x8b0]
jl 0x10036f57
xor eax, eax
jne 0x10036f57
and dword [ebp - 0x468], 0
jmp 0x10036f61
mov dword [ebp - 0x468], 1
mov eax, dword [ebp - 0x468]
sub eax, dword [ebp - 0x234]
jne 0x10036f8d
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
cmp dword [eax], 0
jne 0x10036f8d
mov dword [ebp - 0x740], 1
jmp 0x10036f94
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x424], 0x2b4b20f9
jne 0x10036fb8
mov dword [ebp - 0x470], 1
jmp 0x10036fbf
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
add eax, 0xfff9
cmp eax, dword [ebp - 0x234]
je 0x10036fe4
cmp dword [ebp - 0x234], 0
jne 0x10036fe4
and dword [ebp - 0x9a4], 0
jmp 0x10036fee
mov dword [ebp - 0x9a4], 1
cmp dword [ebp - 0x9a4], 0xfffffff9
jg 0x10037003
mov dword [ebp - 0x478], 1
jmp 0x1003700a
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x23c]
jle 0x10037030
mov dword [ebp - 0x748], 1
jmp 0x10037037
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0x748], eax
jge 0x10037051
mov dword [ebp - 0x480], 1
jmp 0x10037058
and dword [ebp - 0x480], 0
mov esi, dword [ebp - 0x13c]
sub esi, dword [ebp - 0x480]
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa10]
call fcn.1001a954
cmp esi, dword [eax]
je 0x1003708e
mov dword [ebp - 0xdf0], 1
jmp 0x10037095
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xffc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c0]
sub ecx, dword [ebp + eax - 0xe84]
imul esi, ecx, 0xfffffffd
add esi, 0x5e6b711a
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
cmp esi, dword [eax]
jg 0x100370d9
mov dword [ebp - 0x8ac], 1
jmp 0x100370e0
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x8ac]
je 0x10037227
mov dword [ebp - 0x42c], 0xbf2dcfcb
mov dword [ebp - 0xbf0], 0xffffffff
mov dword [ebp - 0xaf8], 8
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1104], eax
cmp dword [ebp - 0x42c], 0
jne 0x10037137
cmp dword [ebp - 0x42c], 0
jne 0x10037137
and dword [ebp - 0xbfc], 0
jmp 0x10037141
mov dword [ebp - 0xbfc], 1
mov esi, dword [ebp - 0xbf0]
push 4
pop eax
shl eax, 0
mov edi, dword [ebp + eax - 0xe84]
push 2
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
mov ebx, dword [eax]
add ebx, edi
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa10]
call fcn.1001a954
imul ebx, dword [eax]
sub ebx, esi
cmp ebx, 0xffffffff
jg 0x10037195
mov dword [ebp - 0x488], 1
jmp 0x1003719c
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x488]
jne 0x100371b6
mov dword [ebp - 0x750], 1
jmp 0x100371bd
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x234]
neg eax
add eax, dword [ebp - 0x750]
je 0x100371e0
push 7
pop eax
test eax, eax
je 0x100371e0
mov dword [ebp - 0x490], 1
jmp 0x100371e7
and dword [ebp - 0x490], 0
push 0
lea ecx, [ebp - 0xa10]
call fcn.1001a954
mov ecx, dword [ebp - 0x490]
cmp ecx, dword [eax]
jne 0x1003720a
mov dword [ebp - 0x954], 1
jmp 0x10037211
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
add eax, 0x1a1ccc58
mov dword [ebp - 0xaf8], eax
jmp 0x10037313
mov dword [ebp - 0x1c8], 0
jmp 0x10037240
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1003725c
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xac0], 0x400d43e6
jmp 0x10037233
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe84], 0
jne 0x1003727c
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x1003727c
and dword [ebp - 0x498], 0
jmp 0x10037286
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x498]
jg 0x100372a0
mov dword [ebp - 0x758], 1
jmp 0x100372a7
and dword [ebp - 0x758], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac0]
neg eax
cmp eax, dword [ebp - 0x758]
je 0x100372dc
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1001a954
cmp dword [eax], 0
je 0x100372dc
mov dword [ebp - 0x4a0], 1
jmp 0x100372e3
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0xab0]
cmp eax, 1
jb 0x10037300
mov dword [ebp - 0x8b4], 1
jmp 0x10037307
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd78]
call fcn.1001a938
jmp 0x10036b59
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a4]
call fcn.1001a938
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa10]
call fcn.1001a938
push 1
lea ecx, [ebp - 0xe44]
call fcn.1001a8b6
mov dword [ebp - 4], 5
mov dword [ebp - 0x1d8], 0x1747
mov dword [ebp - 0x9e4], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x1003737d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10037393
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x188], 0x99841b3c
jmp 0x10037376
mov dword [ebp - 0x18], 0
jmp 0x100373a3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100373bf
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe44]
call fcn.1001a954
mov dword [eax], 0xbb67
jmp 0x1003739c
mov dword [ebp - 0x18], 0
jmp 0x100373cf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100373e5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24c], 0x2579253a
jmp 0x100373c8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x188], 0
jmp 0x10037413
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x188], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 8
je 0x100374ea
mov dword [ebp - 0x1d0], 0xfffffff7
mov dword [ebp - 0x1d0], 0
jmp 0x1003744a
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x100374e5
push 1
lea ecx, [ebp - 0xf5c]
call fcn.1001a8b6
mov byte [ebp - 4], 6
mov dword [ebp - 0x244], 0
jmp 0x10037481
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x100374a3
push dword [ebp - 0x244]
lea ecx, [ebp - 0xf5c]
call fcn.1001a954
mov dword [eax], 0xeaa29c14
jmp 0x10037474
push 0x34e5
push 0
push 0x549e
push 0
lea eax, [ebp - 0xf5c]
push eax
call fcn.1003381d
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24c], 0x837182ab
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf5c]
call fcn.1001a938
jmp 0x1003743d
jmp 0x100373f8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1d8], 0
je 0x10037666
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [ebp + eax - 0x188]
jne 0x1003752b
mov dword [ebp - 0x4a8], 1
jmp 0x10037532
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x4a8], eax
jle 0x1003754c
mov dword [ebp - 0x760], 1
jmp 0x10037553
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x760], eax
jne 0x1003756d
mov dword [ebp - 0xa9c], 1
jmp 0x10037574
and dword [ebp - 0xa9c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 0
jne 0x1003759d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0
jne 0x1003759d
and dword [ebp - 0xdac], 0
jmp 0x100375a7
mov dword [ebp - 0xdac], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c]
mov dword [ebp - 0x1144], eax
push 0
lea ecx, [ebp - 0xe44]
call fcn.1001a954
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x188]
cmp ecx, dword [ebp + eax - 0x188]
jge 0x100375ef
mov dword [ebp - 0x4b0], 1
jmp 0x100375f6
and dword [ebp - 0x4b0], 0
push 0
lea ecx, [ebp - 0xe44]
call fcn.1001a954
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4b0]
lea eax, [ecx + eax + 0xb65c]
test eax, eax
je 0x1003762b
cmp dword [ebp - 0x1d8], 0
je 0x1003762b
mov dword [ebp - 0xaa4], 1
jmp 0x10037632
and dword [ebp - 0xaa4], 0
cmp dword [ebp - 0x9e4], 0xffff
jae 0x1003764a
mov dword [ebp - 0x4b8], 1
jmp 0x10037651
and dword [ebp - 0x4b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c]
cmp dword [ebp - 0x4b8], eax
jl 0x10037674
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24c], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x188], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe44]
call fcn.1001a938
push 1
lea ecx, [ebp - 0xa04]
call fcn.1001a8b6
mov dword [ebp - 4], 7
push 3
lea ecx, [ebp - 0x198]
call fcn.1001a8b6
mov byte [ebp - 4], 8
mov dword [ebp - 0x34], 0xd41e
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x17c], 0x3dc99cdf
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x95c], 1
push 4
lea ecx, [ebp - 0xe5c]
call fcn.1001a8b6
mov byte [ebp - 4], 9
push 0x77b4
push 0
push 0x6072
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xe5c]
push eax
call fcn.1002f7f4
add esp, 0x14
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xe0]
jle 0x100377d4
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x34], 0xbbb4f5ac
jbe 0x10037760
mov dword [ebp - 0x768], 1
jmp 0x10037767
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
add eax, dword [ebp - 0x34]
jne 0x10037790
cmp dword [ebp - 0xe0], 0
jne 0x10037790
and dword [ebp - 0x4c0], 0
jmp 0x1003779a
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x4c0]
jne 0x100377b4
mov dword [ebp - 0x8bc], 1
jmp 0x100377bb
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
sub eax, 0x8633
je 0x100377d4
mov dword [ebp - 0x4c8], 1
jmp 0x100377db
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
neg eax
sub eax, dword [ebp - 0xe0]
je 0x100377fd
cmp dword [ebp - 0x34], 0
je 0x100377fd
mov dword [ebp - 0x770], 1
jmp 0x10037804
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x770], eax
jne 0x1003781b
mov dword [ebp - 0x4d0], 1
jmp 0x10037822
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
neg eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x95c], 0xfffa
cmp dword [ebp - 0x95c], 0x8bbd
je 0x10037867
mov dword [ebp - 0x4d8], 1
jmp 0x1003786e
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x4d8], eax
jne 0x10037888
mov dword [ebp - 0x778], 1
jmp 0x1003788f
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x778], eax
je 0x10037916
mov dword [ebp - 0x34], 0
jmp 0x100378ad
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x100378d7
lea eax, [ebp - 0xe5c]
push eax
push 0
push 0x3813
lea eax, [ebp - 0x17c]
push eax
push 0x6530
call fcn.10036743
add esp, 0x14
jmp 0x100378a6
push 0x7cfd
push 0
push 0x681d
lea eax, [ebp - 0xe5c]
push eax
push 0x6708
push 0x7c13
push 0x574
lea eax, [ebp - 0x434]
push eax
push 0
push 1
push 0x253f
call fcn.1002c72b
add esp, 0x2c
jmp 0x10037a25
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10037a25
push 0x7586
push 0
push 0
push 0x21da
call fcn.1002f1de
add esp, 0x10
mov dword [ebp - 0x4e0], 0xbdc
mov dword [ebp - 0xc04], 0x1000a5f8
cmp dword [ebp - 0x4e0], 0xed9
jle 0x100379d9
and dword [ebp - 0x1e0], 0
jmp 0x10037978
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0x30c5
jge 0x100379d9
and dword [ebp - 0x254], 0
jmp 0x1003799a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x7eb9
jge 0x100379d7
mov eax, dword [ebp - 0x1e0]
and eax, dword [ebp - 0x254]
cdq
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc24], edx
push dword [ebp - 0xc24]
push dword [ebp - 0xc28]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1003798d
jmp 0x1003796b
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x4e0], 0xab9
jge 0x100379f9
mov edx, dword [ebp - 0xc04]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x10037a15
mov dword [ebp - 4], 9
jmp 0x10037a25
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe5c]
call fcn.1001a938
mov dword [ebp - 0x3e8], 1
push 0x55e4
push 0x2fb3
push 0
call fcn.1002fc14
add esp, 0xc
mov dword [ebp - 0x298], 0xedda5659
mov dword [ebp - 0x118], 5
mov dword [ebp - 0x84], 0x57bf5cd5
mov dword [ebp - 0x68], 0x5c7a00f4
mov dword [ebp - 0xe8], 0xfa51
mov dword [ebp - 0x8c4], 0x76d2
mov dword [ebp - 0xd04], 0x1000a648
cmp dword [ebp - 0x8c4], 0x7a0a
jle 0x10037bb3
and dword [ebp - 0x1f0], 0
jmp 0x10037abb
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x607e
jge 0x10037bb3
and dword [ebp - 0x264], 0
jmp 0x10037ae1
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x5f90
jge 0x10037bae
and dword [ebp - 0x1e8], 0
jmp 0x10037b07
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x46a3
jge 0x10037ba9
and dword [ebp - 0x25c], 0
jmp 0x10037b2d
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x201
jge 0x10037ba4
mov eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x264]
shl edx, cl
xor eax, edx
cdq
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0xc30], edx
push dword [ebp - 0xc30]
push dword [ebp - 0xc34]
lea ecx, [ebp - 0x1264]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xaac], eax
mov ecx, dword [ebp - 0xaac]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x1264]
call fcn.1001a65b
jmp 0x10037b20
jmp 0x10037afa
jmp 0x10037ad4
jmp 0x10037aae
mov dword [ebp - 0x94], 0x4a6f4440
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x8c4], 0x7359
jge 0x10037bd9
push dword [ebp - 0xd04]
call fcn.1004e4c6
pop ecx
jmp 0x10037bf5
mov dword [ebp - 4], 8
jmp 0x10037c05
mov dword [ebp - 0x1f8], 0
jmp 0x10037c1e
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x10037c3a
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x1060], 0xffffffff
jmp 0x10037c11
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x10037c5b
mov dword [ebp - 0x4e8], 1
jmp 0x10037c62
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1114], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x114c], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
add eax, 5
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xe8], 1
jmp 0x10037cc0
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffffb
jne 0x1003811a
mov dword [ebp - 0xe9c], 0
mov dword [ebp - 0xe98], 0
mov dword [ebp - 0xe94], 0
mov dword [ebp - 0xe90], 0
mov dword [ebp - 0x790], 5
mov dword [ebp - 0x94], 3
jmp 0x10037d18
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10037f71
push 2
lea ecx, [ebp - 0xe2c]
call fcn.1001a8b6
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x26c], 0
jmp 0x10037d4f
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x10037d71
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xe2c]
call fcn.1001a954
mov dword [eax], 7
jmp 0x10037d42
mov dword [ebp - 0x84], 3
jmp 0x10037d8a
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x10037dfa
mov dword [ebp - 0x111c], 0xd6273d59
mov dword [ebp - 0x118], 0
jmp 0x10037db6
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jg 0x10037df8
mov dword [ebp - 0x780], 0xffffffff
mov dword [ebp - 0x68], 3
jmp 0x10037dd9
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10037df6
push 0
call fcn.1004013b
pop ecx
mov eax, dword [ebp - 0x780]
dec eax
mov dword [ebp - 0x780], eax
jmp 0x10037dd2
jmp 0x10037da9
jmp 0x10037d7d
push 1
lea ecx, [ebp - 0xe2c]
call fcn.1001a954
cmp dword [eax], 0
jne 0x10037e18
mov dword [ebp - 0x9ac], 1
jmp 0x10037e1f
and dword [ebp - 0x9ac], 0
xor eax, eax
jne 0x10037e64
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x94]
jg 0x10037e46
mov dword [ebp - 0x4f0], 1
jmp 0x10037e4d
and dword [ebp - 0x4f0], 0
imul eax, dword [ebp - 0x4f0], 0x5088
test eax, eax
jne 0x10037e64
and dword [ebp - 0xab4], 0
jmp 0x10037e6e
mov dword [ebp - 0xab4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1060]
mov dword [ebp - 0x1034], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe9c]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x9ac], eax
jle 0x10037eae
mov dword [ebp - 0x4f8], 1
jmp 0x10037eb5
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1060]
cmp dword [ebp - 0x4f8], eax
je 0x10037ed6
mov dword [ebp - 0x788], 1
jmp 0x10037edd
and dword [ebp - 0x788], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe9c]
cmp dword [ebp - 0x788], eax
jg 0x10037efe
mov dword [ebp - 0x500], 1
jmp 0x10037f05
and dword [ebp - 0x500], 0
push 1
lea ecx, [ebp - 0xe2c]
call fcn.1001a954
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [eax]
jne 0x10037f28
mov dword [ebp - 0x8cc], 1
jmp 0x10037f2f
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x10037f4a
mov dword [ebp - 0x508], 1
jmp 0x10037f51
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x790], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe2c]
call fcn.1001a938
jmp 0x10037d0b
mov dword [ebp - 0x510], 0xd7c
mov dword [ebp - 0xabc], 0x1000a6c8
cmp dword [ebp - 0x510], 0xe2c
jle 0x1003809e
and dword [ebp - 0x2d8], 0
jmp 0x10037fab
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x3ba0
jge 0x1003809e
and dword [ebp - 0x1a8], 0
jmp 0x10037fd1
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x1c23
jge 0x10038099
and dword [ebp - 0x274], 0
jmp 0x10037ff7
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x38b1
jge 0x10038094
and dword [ebp - 0x208], 0
jmp 0x1003801d
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x3f77
jge 0x1003808f
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0x208]
sar eax, cl
and eax, dword [ebp - 0x2d8]
cdq
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0xc3c], edx
push dword [ebp - 0xc3c]
push dword [ebp - 0xc40]
lea ecx, [ebp - 0x12b8]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xc0c], eax
mov ecx, dword [ebp - 0xc0c]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x12b8]
call fcn.1001a65b
jmp 0x10038010
jmp 0x10037fea
jmp 0x10037fc4
jmp 0x10037f9e
push 0x4488
push 0x5068
push 0x7c16
push 0
push 0x2ec0
push 0x3a21
push 0x5453
lea eax, [ebp - 0x790]
push eax
call fcn.1003501c
add esp, 0x20
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x510], 0xa5f
jge 0x100380e9
push dword [ebp - 0xabc]
call fcn.1004e4c6
pop ecx
jmp 0x10038105
mov dword [ebp - 4], 8
jmp 0x10038115
jmp 0x10037cb3
mov dword [ebp - 0xbc4], 0x4942beba
mov dword [ebp - 0x144], 0
jmp 0x1003813d
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1003815f
push dword [ebp - 0x144]
lea ecx, [ebp - 0xa04]
call fcn.1001a954
mov dword [eax], 0x55683450
jmp 0x10038130
mov dword [ebp - 0xf0], 1
push 1
lea ecx, [ebp - 0xa40]
call fcn.1001a8b6
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x103c]
push eax
push 0
lea eax, [ebp - 0xa40]
push eax
push 0x4af4
push 0x4ebf
call fcn.10030425
add esp, 0x14
mov esi, dword [ebp - 0xf0]
push 0
lea ecx, [ebp - 0xa40]
call fcn.1001a954
mov dword [eax], esi
mov dword [ebp - 0xf0], 0
jmp 0x100381ca
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x10038260
mov dword [ebp - 0x210], 0x912491e2
mov dword [ebp - 0x210], 0
jmp 0x100381fa
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x10038237
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1003821d
push 0
call fcn.1002dee3
pop ecx
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xa40]
call fcn.1001a954
cmp dword [eax], 0
je 0x10038235
jmp 0x100381ed
jmp 0x100381ed
push 0
lea ecx, [ebp - 0xa40]
call fcn.1001a954
mov esi, eax
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xa40]
call fcn.1001a954
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100381bd
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa40]
call fcn.1001a938
push 0
lea eax, [ebp - 0x144]
push eax
push 0x12d8
push 0x6087
push 0x10bd
lea eax, [ebp - 0x198]
push eax
push 0x5bf0
push 0xb45
call fcn.1002f7be
add esp, 0x20
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
and dword [eax], 0
jmp 0x100382d6
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x964]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x964]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
cmp dword [eax], 0
jl 0x1003bbab
mov dword [ebp - 0x8d4], 0xffffffff
mov dword [ebp - 0x340], 0x3ccde6bc
mov dword [ebp - 0x128], 0x4dbf0cf8
mov dword [ebp - 0x530], 0xfffc
push 1
lea ecx, [ebp - 0xa34]
call fcn.1001a8b6
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xc14], 0x30b91300
mov dword [ebp - 0x109c], 0x69ee
lea eax, [ebp - 0xa34]
push eax
push 0x5c8c
push 0
push 0x19b0
push 0x7152
lea eax, [ebp - 0x1044]
push eax
push 0x3e09
push 0x2950
call fcn.1002e79f
add esp, 0x20
cmp dword [ebp - 0x128], 0
jb 0x1003837f
mov dword [ebp - 0x518], 1
jmp 0x10038386
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 3
jg 0x1003839b
mov dword [ebp - 0x798], 1
jmp 0x100383a2
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x128]
jg 0x100383c2
mov dword [ebp - 0x520], 1
jmp 0x100383c9
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x520], eax
je 0x100383e3
mov dword [ebp - 0xd64], 1
jmp 0x100383ea
and dword [ebp - 0xd64], 0
mov dword [ebp - 0x8d4], 0xffffffff
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x1054], eax
push 0
lea ecx, [ebp - 0xa34]
call fcn.1001a954
mov esi, eax
push 0
lea ecx, [ebp - 0xa34]
call fcn.1001a954
mov edi, dword [eax]
sub edi, dword [esi]
add edi, 0x7c502b90
push 0
lea ecx, [ebp - 0xa34]
call fcn.1001a954
cmp edi, dword [eax]
jl 0x10038479
cmp dword [ebp - 0x340], 0
jne 0x10038479
and dword [ebp - 0x528], 0
jmp 0x10038483
mov dword [ebp - 0x528], 1
cmp dword [ebp - 0x528], 0x522452a2
jne 0x1003849b
mov dword [ebp - 0x7a0], 1
jmp 0x100384a2
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 1
jne 0x100384b7
mov dword [ebp - 0xac4], 1
jmp 0x100384be
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x10b4], eax
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x1064], eax
push 0
lea ecx, [ebp - 0xa34]
call fcn.1001a954
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa34]
call fcn.1001a938
mov dword [ebp - 0x10bc], 3
mov dword [ebp - 0x1074], 0xffffffff
mov dword [ebp - 0x10c4], 0x9b2cfb63
mov dword [ebp - 0x10a0], 1
mov dword [ebp - 0x1124], 0x2b7b88cd
mov dword [ebp - 0x10a8], 0x58fe4de5
mov dword [ebp - 0x1154], 7
mov dword [ebp - 0xf74], 0x2f8dc70e
mov dword [ebp - 0xf78], 0xfffffffb
mov dword [ebp - 0xf80], 0
mov dword [ebp - 0x58], 0
jmp 0x1003856e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x10038584
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1328], 0x6210b999
jmp 0x10038567
mov dword [ebp - 0x58], 0
jmp 0x10038594
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x100385aa
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x9d4], 0xa7160c63
jmp 0x1003858d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9d4], eax
mov dword [ebp - 0xa8], 0xffffffff
push 2
lea ecx, [ebp - 0xf50]
call fcn.1001a8b6
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x120], 7
mov dword [ebp - 0x540], 0xffffffff
mov dword [ebp - 0xf88], 0xfffffffa
mov dword [ebp - 0xed8], 1
mov dword [ebp - 0xed4], 1
mov dword [ebp - 0xed0], 1
mov dword [ebp - 0xecc], 1
lea ecx, [ebp - 0x419]
call fcn.1001a963
push eax
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xed8]
push eax
lea ecx, [ebp - 0x122c]
call fcn.1001a966
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11bc]
call fcn.1001a912
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xf90]
push eax
push 1
push 0xf4a
push 0x1808
push 0x28be
lea eax, [ebp - 0xf50]
push eax
push 0x4cca
push 0x23e
push 0
push 1
push 0x20ab
call fcn.1002c72b
add esp, 0x2c
mov dword [ebp - 0x120], 1
jmp 0x100386b2
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x100388a2
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0xf98], 0x21e1d82c
mov dword [ebp - 0xfa0], 7
mov dword [ebp - 0x218], 0
jmp 0x100386f3
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 4
jge 0x1003870f
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x1190], 0
jmp 0x100386e6
cmp dword [ebp - 0x80], 2
jbe 0x10038721
mov dword [ebp - 0x538], 1
jmp 0x10038728
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x538], eax
jg 0x10038745
cmp dword [ebp - 0x80], 0
jne 0x10038745
and dword [ebp - 0xacc], 0
jmp 0x1003874f
mov dword [ebp - 0xacc], 1
push 0
lea ecx, [ebp - 0xf50]
call fcn.1001a954
cmp dword [eax], 0xffffffff
jge 0x1003876d
mov dword [ebp - 0xd10], 1
jmp 0x10038774
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x80]
jl 0x10038862
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0xfb0], 0x748dc164
push 1
lea ecx, [ebp - 0x1070]
call fcn.1001a8b6
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x7a8], 0
lea eax, [ebp - 0x1070]
push eax
push 0x77f9
push 0x5609
push 0
push 0
push 0x4ef9
lea eax, [ebp - 0xfb8]
push eax
push 0x4434
push 0x7b60
push 0x546c
call fcn.1002e2dc
add esp, 0x28
mov dword [ebp - 0x80], 1
jmp 0x100387fd
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10038851
mov dword [ebp - 0xfc0], 0xf97812a3
mov dword [ebp - 0x2e0], 0
jmp 0x10038826
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x10038842
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1288], 0xe028f4e1
jmp 0x10038819
mov eax, dword [ebp - 0x7a8]
dec eax
mov dword [ebp - 0x7a8], eax
jmp 0x100387f6
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1070]
call fcn.1001a938
jmp 0x1003889d
mov dword [ebp - 0xad4], 0x7796
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1190]
mov dword [ebp - 0xfc8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1190]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xad4], eax
jmp 0x100386a5
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x11bc]
call fcn.1001a938
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf50]
call fcn.1001a938
mov dword [ebp - 0x290], 0xae8b0121
mov dword [ebp - 0x3a0], 0xd3df75dc
push 3
lea ecx, [ebp - 0xf38]
call fcn.1001a8b6
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x220], 0
jmp 0x100388fe
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x1003891d
push dword [ebp - 0x220]
lea ecx, [ebp - 0xf38]
call fcn.1001a954
or dword [eax], 0xffffffff
jmp 0x100388f1
mov dword [ebp - 0x3a0], 0xfffffffa
jmp 0x10038936
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0xfffffff1
jl 0x10038c2c
mov dword [ebp - 0x78], 0x35f394a2
push 3
lea ecx, [ebp - 0xefc]
call fcn.1001a8b6
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x16c], 0xf7e7308f
push 0x589e
lea eax, [ebp - 0xfd0]
push eax
lea eax, [ebp - 0xefc]
push eax
push 0
push 0x74b6
call fcn.10035487
add esp, 0x14
mov dword [ebp - 0x78], 0
jmp 0x10038997
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1a
jg 0x100389f6
mov dword [ebp - 0xc20], 1
push 0
lea eax, [ebp - 0xc20]
push eax
push 0x3aa8
lea eax, [ebp - 0xf38]
push eax
call fcn.1002df63
add esp, 0x10
push 0x5818
push 0x1a11
push 0
push 0x6104
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0xeee
lea eax, [ebp - 0xefc]
push eax
call fcn.1002eb7a
add esp, 0x20
jmp 0x10038990
mov dword [ebp - 0x8dc], 0x7c20
mov dword [ebp - 0xadc], 0x1000a720
cmp dword [ebp - 0x8dc], 0x7d3a
jle 0x10038b0b
push 0
push 0x20f7
call dword [sym.imp.USER32.dll_GetWindowPlacement]
and dword [ebp - 0x230], 0
jmp 0x10038a3d
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x785e
jge 0x10038b0b
and dword [ebp - 0x348], 0
jmp 0x10038a63
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x3e80
jge 0x10038b06
and dword [ebp - 0x228], 0
jmp 0x10038a89
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x6914
jge 0x10038b01
and dword [ebp - 0x2e8], 0
jmp 0x10038aab
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x41f
jge 0x10038afc
mov eax, dword [ebp - 0x228]
cdq
idiv dword [ebp - 0x2e8]
mov ecx, edx
mov eax, dword [ebp - 0x230]
cdq
idiv dword [ebp - 0x348]
or edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], edx
push dword [ebp - 0xc48]
push dword [ebp - 0xc4c]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x10038a9e
jmp 0x10038a7c
jmp 0x10038a56
jmp 0x10038a30
mov dword [ebp - 0x16c], 2
jmp 0x10038b24
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x10038bcc
mov dword [ebp - 0x238], 0
jmp 0x10038b4a
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x10038b66
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xe74], 0xffff
jmp 0x10038b3d
mov dword [ebp - 0x78], 0
jmp 0x10038b76
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jg 0x10038bc7
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x2f0], 2
jmp 0x10038b9f
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x10038bc5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe74]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe74], eax
jmp 0x10038b92
jmp 0x10038b6f
jmp 0x10038b17
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x8dc], 0x79e1
jge 0x10038bec
mov edx, dword [ebp - 0xadc]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x10038c08
mov dword [ebp - 4], 0x17
jmp 0x10038c18
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xefc]
call fcn.1001a938
jmp 0x10038929
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf38]
call fcn.1001a938
push 2
lea ecx, [ebp - 0xdc8]
call fcn.1001a8b6
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xf8], 0x2e91a04
mov dword [ebp - 0x408], 1
push 2
lea ecx, [ebp - 0xf14]
call fcn.1001a8b6
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x240], 0
jmp 0x10038c8a
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x10038cac
push dword [ebp - 0x240]
lea ecx, [ebp - 0xf14]
call fcn.1001a954
mov dword [eax], 0xfffffff8
jmp 0x10038c7d
mov dword [ebp - 0xf8], 1
jmp 0x10038cc5
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x14
jg 0x10038ebc
mov dword [ebp - 0xa70], 0x9dcee34e
mov dword [ebp - 0xa6c], 0x9dcee34e
mov dword [ebp - 0xa68], 0x9dcee34e
mov dword [ebp - 0xa64], 0x9dcee34e
mov dword [ebp - 0x548], 0x74edf0eb
mov dword [ebp - 0xae4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa70]
mov dword [ebp - 0xfd8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa70]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
cmp eax, dword [ebp - 0xf8]
jge 0x10038d4d
mov dword [ebp - 0xddc], 1
jmp 0x10038d54
and dword [ebp - 0xddc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa70]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
imul eax, dword [ebp - 0xf8]
cmp eax, 0x25db2b05
jne 0x10038d87
mov dword [ebp - 0x7b0], 1
jmp 0x10038d8e
and dword [ebp - 0x7b0], 0
cmp dword [ebp - 0x7b0], 0x68de
jg 0x10038da6
mov dword [ebp - 0x550], 1
jmp 0x10038dad
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xa97f51ef
jne 0x10038dc5
mov dword [ebp - 0x96c], 1
jmp 0x10038dcc
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x96c], eax
jg 0x10038de6
mov dword [ebp - 0x558], 1
jmp 0x10038ded
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa70]
cmp dword [ebp - 0x558], eax
jl 0x10038e0e
mov dword [ebp - 0x7b8], 1
jmp 0x10038e15
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 4
jl 0x10038e2a
mov dword [ebp - 0x560], 1
jmp 0x10038e31
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 4
jge 0x10038e46
mov dword [ebp - 0x8e4], 1
jmp 0x10038e4d
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 0
jne 0x10038e68
cmp dword [ebp - 0x408], 0
jne 0x10038e68
and dword [ebp - 0x568], 0
jmp 0x10038e72
mov dword [ebp - 0x568], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa70]
cmp dword [ebp - 0x568], eax
jl 0x10038ea1
push 1
lea ecx, [ebp - 0xf14]
call fcn.1001a954
cmp dword [eax], 0
jne 0x10038ea1
and dword [ebp - 0x7c0], 0
jmp 0x10038eab
mov dword [ebp - 0x7c0], 1
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0xae4], eax
jmp 0x10038cb8
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10038ee2
push 0x75a3
push 0
push 0x2ace
call fcn.10047d76
add esp, 0xc
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xf14]
call fcn.1001a938
mov dword [ebp - 0x2c], 0x4fddd3f4
mov dword [ebp - 0x380], 0
jmp 0x10038f11
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 1
jge 0x10038f2d
mov eax, dword [ebp - 0x380]
mov dword [ebp + eax*4 - 0x43c], 0x901f
jmp 0x10038f04
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10038f4e
push 0xc43
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x43c]
mov dword [ebp - 0x2c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x43c]
cmp eax, dword [ebp - 0x2c]
jge 0x10038f9b
mov dword [ebp - 0x2c], 0
jmp 0x10038f80
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10038f96
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x43c], 0x9124
jmp 0x10038f79
jmp 0x1003916c
mov dword [ebp - 0xaec], 9
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10039128
push 0x2b92
push 0x6dac
push 0x2b15
push 0x1e4
push 0
call fcn.100461e7
add esp, 0x14
mov dword [ebp - 0x570], 0x115f
mov dword [ebp - 0xc2c], 0x1000a760
cmp dword [ebp - 0x570], 0x1371
jle 0x100390dc
and dword [ebp - 0x250], 0
jmp 0x10039013
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x540
jge 0x100390dc
and dword [ebp - 0x350], 0
jmp 0x10039039
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x7eb0
jge 0x100390d7
and dword [ebp - 0x248], 0
jmp 0x1003905f
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x4185
jge 0x100390d2
and dword [ebp - 0x2f8], 0
jmp 0x10039081
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x474b
jge 0x100390d0
mov ecx, dword [ebp - 0x248]
imul ecx, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x250]
cdq
idiv dword [ebp - 0x350]
add edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0xc54], edx
push dword [ebp - 0xc54]
push dword [ebp - 0xc58]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x10039074
jmp 0x10039052
jmp 0x1003902c
jmp 0x10039006
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x570], 0xe05
jge 0x100390fc
mov edx, dword [ebp - 0xc2c]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x10039118
mov dword [ebp - 4], 0x1a
jmp 0x10039128
mov dword [ebp - 0x2c], 0xc
jmp 0x10039138
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffec
jle 0x1003916c
mov dword [ebp - 0xd1c], 5
lea eax, [ebp - 0xaec]
push eax
push 0x6e56
lea eax, [ebp - 0xd1c]
push eax
push 0
push 0x1a53
call fcn.1002e7e9
add esp, 0x14
jmp 0x10039131
push 1
lea ecx, [ebp - 0xd98]
call fcn.1001a8b6
mov byte [ebp - 4], 0x1e
push 0x2618
lea eax, [ebp - 0xd98]
push eax
push 0
lea eax, [ebp - 0xfe0]
push eax
push 0x12d5
call fcn.1002fe04
add esp, 0x14
push 0
lea ecx, [ebp - 0xd98]
call fcn.1001a954
mov dword [eax], 0xe
jmp 0x100391d8
push 0
lea ecx, [ebp - 0xd98]
call fcn.1001a954
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x9b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd98]
call fcn.1001a954
cmp dword [eax], 0xfffffffa
jle 0x1003933a
push 2
lea ecx, [ebp - 0xd88]
call fcn.1001a8b6
mov byte [ebp - 4], 0x1f
push 0x6798
push 0
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0xd88]
push eax
push 0x6eb8
call fcn.1002f3c5
add esp, 0x14
mov dword [ebp - 0x14c], 0
jmp 0x1003923a
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x10039256
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x1088], 0xfffffff8
jmp 0x1003922d
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1003927c
push 0
push 0x149b
push 0x3634
call fcn.1003560c
add esp, 0xc
push 1
lea ecx, [ebp - 0xd88]
call fcn.1001a954
mov dword [eax], 0x14
jmp 0x100392b5
push 1
lea ecx, [ebp - 0xd88]
call fcn.1001a954
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x578]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x578]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xd88]
call fcn.1001a954
cmp dword [eax], 0x17
jge 0x10039326
mov dword [ebp - 0x258], 0x3bf38c08
mov dword [ebp - 0x258], 1
jmp 0x100392ea
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jl 0x1003930f
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1003930d
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100392dd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1088], 0
je 0x10039321
jmp 0x10039326
jmp 0x10039291
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xd88]
call fcn.1001a938
jmp 0x100391b4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xd98]
call fcn.1001a938
mov dword [ebp - 0x1c], 0
jmp 0x10039359
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003936f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa20], 0xfffffffe
jmp 0x10039352
mov dword [ebp - 0xfe8], 1
mov dword [ebp - 0xff0], 7
mov dword [ebp - 0xff8], 0
mov dword [ebp - 0x1000], 0x88a137b1
mov dword [ebp - 0x1008], 0x2a1836cc
push 2
lea ecx, [ebp - 0x1080]
call fcn.1001a8b6
mov byte [ebp - 4], 0x20
mov dword [ebp - 0xc38], 0x1371
mov dword [ebp - 0xafc], 0
mov dword [ebp - 0xaf4], 6
mov dword [ebp - 0x300], 0
jmp 0x100393e9
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x10039408
push dword [ebp - 0x300]
lea ecx, [ebp - 0x1080]
call fcn.1001a954
and dword [eax], 0
jmp 0x100393dc
push 0
lea eax, [ebp - 0xaf4]
push eax
call fcn.10042027
pop ecx
pop ecx
lea eax, [ebp - 0xc38]
push eax
push 0x7914
push 0x7dd1
push 0
lea eax, [ebp - 0xafc]
push eax
push 0
call fcn.100352ee
add esp, 0x18
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1080]
call fcn.1001a938
mov dword [ebp - 0x1c], 0
jmp 0x1003945b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10039477
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdc8]
call fcn.1001a954
mov dword [eax], 0x3062a4b1
jmp 0x10039454
mov dword [ebp - 0x7c8], 0x64a
mov dword [ebp - 0xd6c], 0x1000a7d0
cmp dword [ebp - 0x7c8], 0x719
jle 0x10039545
and dword [ebp - 0x268], 0
jmp 0x100394b1
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x2458
jge 0x10039545
and dword [ebp - 0x260], 0
jmp 0x100394d7
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x3a24
jge 0x10039540
and dword [ebp - 0x398], 0
jmp 0x100394f9
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x338
jge 0x1003953e
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x398]
shl eax, cl
and eax, dword [ebp - 0x268]
cdq
mov dword [ebp - 0xc64], eax
mov dword [ebp - 0xc60], edx
push dword [ebp - 0xc60]
push dword [ebp - 0xc64]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x100394ec
jmp 0x100394ca
jmp 0x100394a4
mov dword [ebp - 0x1c], 0
jmp 0x10039555
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003956b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe6c], 0x7f6a191a
jmp 0x1003954e
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x7c8], 0x370
jge 0x1003958b
mov edx, dword [ebp - 0xd6c]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x100395a7
mov dword [ebp - 4], 0x1a
jmp 0x100395b7
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x8ec], 0x8ea38884
mov dword [ebp - 0xb04], 0x6dd
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0x60], 0
jmp 0x100395ef
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10039605
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xa18], 0xffffffff
jmp 0x100395e8
mov dword [ebp - 0x60], 0
jmp 0x10039615
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1003962b
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x124c], 0xfc80ae7b
jmp 0x1003960e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa18], 0
jne 0x10039654
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa18], 0
jne 0x10039654
and dword [ebp - 0x580], 0
jmp 0x1003965e
mov dword [ebp - 0x580], 1
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x98], 0xffffffee
jmp 0x10039684
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x19
jne 0x1003979a
mov dword [ebp - 0x3d8], 0xcb143e95
mov dword [ebp - 0x588], 1
mov dword [ebp - 0x974], 0xde6b9338
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x8ec], 0x1589
cmp dword [ebp - 0x8ec], 0
je 0x100396ee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa18], 0xa22e
jge 0x100396ee
mov dword [ebp - 0x7d0], 1
jmp 0x100396f5
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0xb04], 0
je 0x10039705
cmp dword [ebp - 0x98], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa18]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x98], 0x263b
jle 0x10039748
mov dword [ebp - 0xc44], 1
jmp 0x1003974f
and dword [ebp - 0xc44], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124c]
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0x7d0], 1
je 0x10039776
mov dword [ebp - 0x590], 1
jmp 0x1003977d
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xb0c], eax
jmp 0x10039677
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa20]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa20], eax
mov dword [ebp - 0x180], 7
mov dword [ebp - 0x7d8], 0x9cd49fcf
mov dword [ebp - 0x1028], 0x67656540
mov dword [ebp - 0x1030], 0x23a34071
mov dword [ebp - 0x1038], 6
mov dword [ebp - 0x1040], 1
mov dword [ebp - 0x180], 0
jmp 0x1003980a
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff2
jne 0x10039af3
mov dword [ebp - 0x308], 0x643cdf98
mov dword [ebp - 0x70], 0
jmp 0x10039831
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10039847
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x11f4], 0xd3c15d0d
jmp 0x1003982a
mov dword [ebp - 0x70], 0
jmp 0x10039857
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1003986d
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x5a0], 0x8c5c
jmp 0x10039850
mov dword [ebp - 0x308], 0xffffffeb
jmp 0x10039886
mov eax, dword [ebp - 0x308]
dec eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0xffffffe7
jge 0x10039ad3
push 4
lea ecx, [ebp - 0xe38]
call fcn.1001a8b6
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x358], 0xb8ce3e63
mov dword [ebp - 0x278], 0x87a7525d
mov dword [ebp - 0xb14], 0xfffffffa
mov dword [ebp - 0xdbc], 4
mov dword [ebp - 0x270], 0
jmp 0x100398e5
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 4
jge 0x10039907
push dword [ebp - 0x270]
lea ecx, [ebp - 0xe38]
call fcn.1001a954
mov dword [eax], 1
jmp 0x100398d8
push 2
lea ecx, [ebp - 0xe38]
call fcn.1001a954
cmp dword [eax], 0
je 0x1003992d
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe38]
call fcn.1001a938
jmp 0x10039ad3
mov dword [ebp - 0x358], 0xfffffff5
jmp 0x10039946
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0xfffffffb
jl 0x10039abf
push 1
lea ecx, [ebp - 0xda8]
call fcn.1001a8b6
mov byte [ebp - 4], 0x24
push 0
lea eax, [ebp - 0xda8]
push eax
lea eax, [ebp - 0x1048]
push eax
call fcn.10042535
add esp, 0xc
push 0
lea ecx, [ebp - 0xda8]
call fcn.1001a954
mov dword [eax], 0xffffffee
jmp 0x100399b5
push 0
lea ecx, [ebp - 0xda8]
call fcn.1001a954
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x598]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xda8]
call fcn.1001a954
cmp dword [eax], 4
jle 0x100399d6
mov eax, dword [ebp - 0x7d8]
dec eax
mov dword [ebp - 0x7d8], eax
jmp 0x10039991
mov dword [ebp - 0x278], 6
jmp 0x100399ef
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xfffffff1
jne 0x10039aab
mov dword [ebp - 0xc50], 0x81a8
mov dword [ebp - 0xb24], 0x4886255d
mov dword [ebp - 0xd24], 9
mov dword [ebp - 0xb1c], 0xdf78b15b
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0xb1c]
push eax
push 0
lea eax, [ebp - 0xdbc]
push eax
lea eax, [ebp - 0xb24]
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.1003f757
add esp, 0x20
mov byte [ebp - 0x102], 0
push 0x3689
lea eax, [ebp - 0x102]
push eax
push 0
push 0x2343
push 0x404
push 0x13e
push 0x126d
push 0
push 0x2933
push 0x7479
push 0x3b62
push 0x3b4d
call fcn.1002e81f
add esp, 0x30
jmp 0x100399e2
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xda8]
call fcn.1001a938
jmp 0x10039939
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe38]
call fcn.1001a938
jmp 0x10039879
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5a0], eax
jmp 0x100397fd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa20], 0xfffffffb
jl 0x10039b0f
mov dword [ebp - 0xc5c], 1
jmp 0x10039b16
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1050], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
mov esi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
mov eax, dword [eax]
lea eax, [esi + eax - 1]
cmp eax, 7
jl 0x10039b59
mov dword [ebp - 0x8f4], 1
jmp 0x10039b60
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x8f4], eax
jne 0x10039b7a
mov dword [ebp - 0x5a8], 1
jmp 0x10039b81
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x290], eax
mov esi, dword [ebp - 0x290]
push 1
lea ecx, [ebp - 0xdc8]
call fcn.1001a954
imul esi, dword [eax]
mov dword [ebp - 0x3e8], esi
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa04]
call fcn.1001a954
cmp dword [ebp - 0xa8], 0xffff
ja 0x10039bdb
mov dword [ebp - 0x7e0], 1
jmp 0x10039be2
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 0x4c7b
jg 0x10039bfa
mov dword [ebp - 0x5b0], 1
jmp 0x10039c01
and dword [ebp - 0x5b0], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xe6c]
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
mov ecx, dword [ebp - 0x5b0]
imul ecx, dword [eax]
imul eax, ecx, 0x7d64
sub eax, esi
je 0x1003a102
push 0x3b47
push 0x6a75
push 0
push 0x73a0
push 0x6215
push 0x745b
call fcn.10035dfe
add esp, 0x18
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10039ef3
push 2
lea ecx, [ebp - 0xdb8]
call fcn.1001a8b6
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x4c], 0
jmp 0x10039c8c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10039ca5
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xdb8]
call fcn.1001a954
or dword [eax], 0xffffffff
jmp 0x10039c85
mov dword [ebp - 0x4c], 0
jmp 0x10039cb5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10039ccb
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1094], 0x5f39
jmp 0x10039cae
push 0
lea ecx, [ebp - 0xdb8]
call fcn.1001a954
mov dword [eax], 0xfffffff9
jmp 0x10039d04
push 0
lea ecx, [ebp - 0xdb8]
call fcn.1001a954
mov dword [ebp - 0x9f4], eax
mov eax, dword [ebp - 0x9f4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9f4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xdb8]
call fcn.1001a954
cmp dword [eax], 0xffffffeb
je 0x10039eda
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xd2c], 0
mov byte [ebp - 0x104], 0
mov dword [ebp - 0x5b8], 0x352b
mov dword [ebp - 0xb2c], 0x1000a840
cmp dword [ebp - 0x5b8], 0x35e8
jle 0x10039dce
and dword [ebp - 0x310], 0
jmp 0x10039d6b
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x4e29
jge 0x10039dce
and dword [ebp - 0x280], 0
jmp 0x10039d8d
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x4c3b
jge 0x10039dcc
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x280]
sar eax, cl
cdq
mov dword [ebp - 0xc70], eax
mov dword [ebp - 0xc6c], edx
push dword [ebp - 0xc6c]
push dword [ebp - 0xc70]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x10039d80
jmp 0x10039d5e
push 0
lea eax, [ebp - 0x104]
push eax
push 0x235c
push 0
push 0x1b14
push 2
push 0xb81
call fcn.1003f4ef
add esp, 0x1c
mov byte [ebp - 4], 0x26
cmp dword [ebp - 0x5b8], 0x322c
jge 0x10039e12
mov edx, dword [ebp - 0xb2c]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x10039e2e
mov dword [ebp - 4], 0x25
jmp 0x10039e3e
mov dword [ebp - 0xa0], 0
jmp 0x10039e57
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x10039ed5
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x1094]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp + ecx*4 - 0x1094], eax
push 0x6ae6
push 0x16f7
push 0x28c6
push 0x2d49
push 0x7b09
push 0x194e
push 0x21ee
push 0
push 0x10a6
lea eax, [ebp - 0xa0]
push eax
push 0
push 0x545
push 0x699e
push 0x19cf
push 0x1264
lea eax, [ebp - 0xd2c]
push eax
call fcn.1002df94
add esp, 0x40
jmp 0x10039e4a
jmp 0x10039ce0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xdb8]
call fcn.1001a938
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0xb34], 0xec299e88
mov dword [ebp - 0x54], 0
jmp 0x10039f0d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10039f20
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x3c], 0xfffffff9
jmp 0x10039f06
mov dword [ebp - 0x54], 0
jmp 0x10039f30
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10039f46
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x11ec], 0xffffffff
jmp 0x10039f29
mov byte [ebp - 0xc9], 0
push 0x488c
push 0
lea eax, [ebp - 0xc9]
push eax
push 0x130f
push 0x2b55
push 1
push 0
call fcn.1002c0fb
add esp, 0x1c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0xacd7
jge 0x10039f8e
xor eax, eax
jne 0x10039f8e
and dword [ebp - 0x7e8], 0
jmp 0x10039f98
mov dword [ebp - 0x7e8], 1
cmp dword [ebp - 0x7e8], 0xfffb
jb 0x10039fb0
mov dword [ebp - 0x5c0], 1
jmp 0x10039fb7
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp eax, dword [ebp - 0x5c0]
jge 0x10039fd5
mov dword [ebp - 0x8fc], 1
jmp 0x10039fdc
and dword [ebp - 0x8fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x8fc], eax
jle 0x1003a007
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x1003a007
mov dword [ebp - 0x5c8], 1
jmp 0x1003a00e
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0xb34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 9
je 0x1003a033
mov dword [ebp - 0xc68], 1
jmp 0x1003a03a
and dword [ebp - 0xc68], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3c]
cmp ecx, dword [ebp + eax - 0x3c]
jg 0x1003a05c
mov dword [ebp - 0x7f0], 1
jmp 0x1003a063
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 1
jle 0x1003a079
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x1003a092
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x1003a092
mov dword [ebp - 0x5d0], 1
jmp 0x1003a099
and dword [ebp - 0x5d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
add eax, dword [ebp - 0x5d0]
cmp eax, 0x951a
jne 0x1003a0bc
mov dword [ebp - 0x97c], 1
jmp 0x1003a0c3
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11ec], eax
push 1
lea ecx, [ebp - 0xdc8]
call fcn.1001a954
cmp dword [eax], 0
je 0x1003a0fd
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdc8]
call fcn.1001a938
jmp 0x1003bbab
jmp 0x1003bb97
mov dword [ebp - 0x2b8], 0xffffffff
push 2
lea ecx, [ebp - 0x3cc]
call fcn.1001a8b6
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x130], 0xbbda73a1
mov dword [ebp - 0x5d8], 0x24eb
mov dword [ebp - 0xb3c], 0x1000a8c0
cmp dword [ebp - 0x5d8], 0x283a
jle 0x1003a1f3
and dword [ebp - 0x318], 0
jmp 0x1003a161
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x61a0
jge 0x1003a1f3
and dword [ebp - 0x388], 0
jmp 0x1003a187
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x404
jge 0x1003a1ee
and dword [ebp - 0x288], 0
jmp 0x1003a1a9
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x2f80
jge 0x1003a1ec
mov eax, dword [ebp - 0x388]
and eax, dword [ebp - 0x288]
xor eax, dword [ebp - 0x318]
cdq
mov dword [ebp - 0xc7c], eax
mov dword [ebp - 0xc78], edx
push dword [ebp - 0xc78]
push dword [ebp - 0xc7c]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1003a19c
jmp 0x1003a17a
jmp 0x1003a154
mov byte [ebp - 4], 0x29
cmp dword [ebp - 0x5d8], 0x24a5
jge 0x1003a213
mov edx, dword [ebp - 0xb3c]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1003a22f
mov dword [ebp - 4], 0x28
jmp 0x1003a23f
push 0x4cce
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebp - 0x3cc]
push eax
push 0x41b3
push 0x348e
push 0x3a4b
push 0x1a2b
push 1
push 0
call fcn.1002c50b
add esp, 0x24
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
and dword [eax], 0
jmp 0x1003a2a8
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x7f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7f8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
cmp dword [eax], 0xd
jge 0x1003a682
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x114], 3
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
cmp dword [ebp - 0x20], 0
jne 0x1003a2f2
push 7
pop eax
test eax, eax
jne 0x1003a2f2
and dword [ebp - 0x5e0], 0
jmp 0x1003a2fc
mov dword [ebp - 0x5e0], 1
push 0
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov ecx, dword [ebp - 0x5e0]
cmp ecx, dword [eax]
jge 0x1003a31f
mov dword [ebp - 0x904], 1
jmp 0x1003a326
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x904]
test eax, eax
jne 0x1003a343
cmp dword [ebp - 0x20], 0
jne 0x1003a343
and dword [ebp - 0x5e8], 0
jmp 0x1003a34d
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x5e8], eax
jl 0x1003a364
mov dword [ebp - 0x800], 1
jmp 0x1003a36b
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x800], eax
jl 0x1003a382
mov dword [ebp - 0x5f0], 1
jmp 0x1003a389
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x5f0]
cmp eax, 1
jle 0x1003a3a3
mov dword [ebp - 0x9bc], 1
jmp 0x1003a3aa
and dword [ebp - 0x9bc], 0
imul eax, dword [ebp - 0x9bc], 0x6fa6
cmp eax, 0xbc4433ac
jne 0x1003a3c7
mov dword [ebp - 0x5f8], 1
jmp 0x1003a3ce
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0xed7d
jge 0x1003a3e6
mov dword [ebp - 0x808], 1
jmp 0x1003a3ed
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x808], eax
jge 0x1003a40a
mov eax, 0x44ba928f
test eax, eax
jne 0x1003a40a
and dword [ebp - 0x600], 0
jmp 0x1003a414
mov dword [ebp - 0x600], 1
push 0
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov ecx, dword [ebp - 0x600]
cmp ecx, dword [eax]
jle 0x1003a437
mov dword [ebp - 0x90c], 1
jmp 0x1003a43e
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x130], eax
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1003a45d
mov dword [ebp - 0x608], 1
jmp 0x1003a464
and dword [ebp - 0x608], 0
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov eax, dword [eax]
cmp eax, dword [ebp - 0x608]
jg 0x1003a487
mov dword [ebp - 0x810], 1
jmp 0x1003a48e
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x1003a4af
mov dword [ebp - 0x610], 1
jmp 0x1003a4b6
and dword [ebp - 0x610], 0
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov ecx, dword [ebp - 0x610]
cmp ecx, dword [eax]
jg 0x1003a4d9
mov dword [ebp - 0x984], 1
jmp 0x1003a4e0
and dword [ebp - 0x984], 0
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov ecx, dword [ebp - 0x984]
cmp ecx, dword [eax]
jne 0x1003a503
mov dword [ebp - 0x618], 1
jmp 0x1003a50a
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0xc0b
jne 0x1003a522
mov dword [ebp - 0x818], 1
jmp 0x1003a529
and dword [ebp - 0x818], 0
cmp dword [ebp - 0x818], 9
jle 0x1003a53e
mov dword [ebp - 0x620], 1
jmp 0x1003a545
and dword [ebp - 0x620], 0
mov esi, dword [ebp - 0x20]
push 1
lea ecx, [ebp - 0x3cc]
call fcn.1001a954
mov ecx, dword [ebp - 0x620]
add ecx, dword [eax]
cmp ecx, esi
jne 0x1003a56d
mov dword [ebp - 0x914], 1
jmp 0x1003a574
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0x40f8278b
jle 0x1003a5fc
mov dword [ebp - 0xd7c], 2
mov dword [ebp - 0x130], 0xf
jmp 0x1003a5a3
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffe
jge 0x1003a5e9
mov byte [ebp - 0x106], 0
push 0x83
push 0xdac
lea eax, [ebp - 0x106]
push eax
push 0
push 0
push 0x6fb0
push 0x15e2
push 0x2706
call fcn.100450aa
add esp, 0x20
cmp dword [ebp - 0x20], 0
je 0x1003a5e7
jmp 0x1003a5e9
jmp 0x1003a596
cmp dword [ebp - 0xd7c], 0
je 0x1003a5f7
jmp 0x1003a682
jmp 0x1003a67d
mov dword [ebp - 0x20], 0xffffffe5
jmp 0x1003a60c
cmp dword [ebp - 0x20], 0xe
jg 0x1003a666
mov dword [ebp - 0xb44], 0x505ce4ec
mov dword [ebp - 0x114], 0
jmp 0x1003a635
cmp dword [ebp - 0x114], 0x10
jle 0x1003a664
lea eax, [ebp - 0xb44]
push eax
push 1
push 0x625e
push 0x197f
push 0x244c
push 1
push 0
call fcn.1002c0fb
add esp, 0x1c
jmp 0x1003a628
jmp 0x1003a605
mov byte [ebp - 0xd1], 0
lea eax, [ebp - 0xd1]
push eax
push 0
call fcn.10046fe8
pop ecx
pop ecx
jmp 0x1003a284
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x3cc]
call fcn.1001a938
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x430], 0xf951fe7
mov dword [ebp - 0x628], 0xffffffff
mov dword [ebp - 0xa60], 0x948708ef
mov dword [ebp - 0xa5c], 0x948708ef
mov dword [ebp - 0xa58], 0x948708ef
mov dword [ebp - 0xa54], 0x948708ef
mov dword [ebp - 0xe20], 0xfffffffe
mov dword [ebp - 0xe1c], 0xfffffffe
mov dword [ebp - 0xe18], 0xfffffffe
mov dword [ebp - 0xe14], 0xfffffffe
mov dword [ebp - 0x3e0], 0x2aff635
mov dword [ebp - 0xc74], 0x7736d0c1
mov dword [ebp - 0xb4c], 0
mov dword [ebp - 0xc80], 0xed7c3b7c
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [ebp + eax - 0xa60]
jl 0x1003a748
mov dword [ebp - 0x828], 1
jmp 0x1003a74f
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
je 0x1003a779
cmp dword [ebp - 0x430], 0
je 0x1003a779
mov dword [ebp - 0x820], 1
jmp 0x1003a780
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x3e0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3e0]
cmp ecx, dword [ebp + eax - 0xa60]
jle 0x1003a7ac
mov dword [ebp - 0x630], 1
jmp 0x1003a7b3
and dword [ebp - 0x630], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa60]
cmp dword [ebp - 0x630], eax
jne 0x1003a7d4
mov dword [ebp - 0x9dc], 1
jmp 0x1003a7db
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x9dc]
mov dword [ebp - 0xc74], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa60], 0xd2668451
jbe 0x1003a806
mov dword [ebp - 0x638], 1
jmp 0x1003a80d
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0xe283
jg 0x1003a825
mov dword [ebp - 0x640], 1
jmp 0x1003a82c
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0x640]
cmp eax, 4
jne 0x1003a849
mov dword [ebp - 0x91c], 1
jmp 0x1003a850
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0x91c], eax
je 0x1003a86a
mov dword [ebp - 0x648], 1
jmp 0x1003a871
and dword [ebp - 0x648], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe20]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xb54], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe20]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xe20], eax
mov eax, dword [ebp - 0xd34]
cmp eax, dword [ebp - 0xb54]
jge 0x1003a8c5
mov dword [ebp - 0x830], 1
jmp 0x1003a8cc
and dword [ebp - 0x830], 0
imul eax, dword [ebp - 0x830], 0xfffffffe
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa60], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x1110], 0
push 0x5773
push 1
push 0x24c7
push 0x3546
push 0x742b
push 0
push 1
call fcn.1002c0fb
add esp, 0x1c
mov byte [ebp - 0xf9], 0
push 0x468
push 0
lea eax, [ebp - 0xf9]
push eax
push 0
push 1
push 0x60fb
call fcn.1002f01e
add esp, 0x18
cmp dword [ebp - 0x290], 0
jne 0x1003a979
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
push dword [eax]
lea ecx, [ebp - 0xa04]
call fcn.1001a954
cmp dword [eax], 0
jne 0x1003a979
and dword [ebp - 0x668], 0
jmp 0x1003a983
mov dword [ebp - 0x668], 1
cmp dword [ebp - 0x298], 0x5452
jl 0x1003a99b
mov dword [ebp - 0x650], 1
jmp 0x1003a9a2
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x650], eax
je 0x1003a9bc
mov dword [ebp - 0x98c], 1
jmp 0x1003a9c3
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x98c], 0xbe945d4
je 0x1003a9e1
cmp dword [ebp - 0x290], 0
jne 0x1003a9e1
and dword [ebp - 0x658], 0
jmp 0x1003a9eb
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x658]
jle 0x1003aa05
mov dword [ebp - 0x838], 1
jmp 0x1003aa0c
and dword [ebp - 0x838], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe6c]
cmp dword [ebp - 0x838], eax
jge 0x1003aa2d
mov dword [ebp - 0x660], 1
jmp 0x1003aa34
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x660], eax
jge 0x1003aa4e
mov dword [ebp - 0x924], 1
jmp 0x1003aa55
and dword [ebp - 0x924], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x924]
sub ecx, dword [ebp + eax - 0xa20]
cmp ecx, 0x84ebf8c3
jae 0x1003aa7c
mov dword [ebp - 0x840], 1
jmp 0x1003aa83
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x840]
jne 0x1003aa9d
mov dword [ebp - 0x670], 1
jmp 0x1003aaa4
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x670]
jl 0x1003aabf
xor eax, eax
jne 0x1003aabf
and dword [ebp - 0x9c4], 0
jmp 0x1003aac9
mov dword [ebp - 0x9c4], 1
mov eax, dword [ebp - 0x9c4]
sub eax, dword [ebp - 0x2b8]
jne 0x1003aaf5
push 0
lea ecx, [ebp - 0x198]
call fcn.1001a954
cmp dword [eax], 0
jne 0x1003aaf5
mov dword [ebp - 0x678], 1
jmp 0x1003aafc
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x360], 4
mov dword [ebp - 0xb5c], 0x9fb37b04
mov dword [ebp - 0x360], 0x11
jmp 0x1003ab35
cmp dword [ebp - 0x360], 0xffffffff
jg 0x1003abd4
mov dword [ebp - 0x410], 0x67215912
mov byte [ebp - 0x108], 0
push 0
push 0x1bb7
push 0x22d3
push 1
push 0x19b3
push 0
lea eax, [ebp - 0x108]
push eax
push 0x2bbc
push 0x77eb
call fcn.1004216e
add esp, 0x24
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x410]
jge 0x1003ab9b
mov dword [ebp - 0x848], 1
jmp 0x1003aba2
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x848], eax
jle 0x1003abbc
cmp dword [ebp - 0x3e8], 0x2b4b20f9
jne 0x1003abec
mov dword [ebp - 0x92c], 1
jmp 0x1003abf3
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
add eax, 0xfff9
cmp eax, dword [ebp - 0x2b8]
je 0x1003ac18
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdc8]
call fcn.1001a938
jmp 0x100382b2
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x198]
call fcn.1001a938
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.1001a938
mov eax, dword [ebp - 0xcd4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3fc], eax
push 4
lea ecx, [ebp - 0x3b4]
call fcn.1001a8b6
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x4b4], 0xfffffffe
mov dword [ebp - 0x4e4], 1
mov dword [ebp - 0xd54], 0x305aba9a
mov dword [ebp - 0x48], 0
jmp 0x1003bc1a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1003bc30
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xe10], 0xffffffff
jmp 0x1003bc13
mov dword [ebp - 0x48], 0
jmp 0x1003bc40
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1003bc5c
push dword [ebp - 0x48]
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov dword [eax], 5
jmp 0x1003bc39
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov dword [eax], 3
jmp 0x1003bc95
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
cmp dword [eax], 0
jl 0x1003bf0a
mov dword [ebp - 0x338], 0
jmp 0x1003bcc4
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jge 0x1003bce0
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x11b0], 9
jmp 0x1003bcb7
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1003bd0d
push 0x3ec
push 1
push 0x4242
push 0
push 0x313f
call fcn.1003381d
add esp, 0x14
mov dword [ebp - 0x4b4], 1
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov eax, dword [eax]
mov dword [ebp - 0x4b4], eax
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
cmp dword [eax], 9
jne 0x1003bd4a
mov dword [ebp - 0x4bc], 1
jmp 0x1003bd51
and dword [ebp - 0x4bc], 0
mov esi, dword [ebp - 0x4e4]
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov ecx, dword [ebp - 0x4bc]
imul ecx, dword [eax]
cmp ecx, esi
jne 0x1003bd7d
mov dword [ebp - 0x4c4], 1
jmp 0x1003bd84
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 8
jle 0x1003bd99
mov dword [ebp - 0x4cc], 1
jmp 0x1003bda0
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xcea445a8
ja 0x1003bdb8
mov dword [ebp - 0xbcc], 1
jmp 0x1003bdbf
and dword [ebp - 0xbcc], 0
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xe10]
mov dword [ebp - 0xf7c], eax
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xe10]
mov dword [ebp - 0x112c], eax
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xe10]
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xe10], esi
jl 0x1003be27
mov dword [ebp - 0x4d4], 1
jmp 0x1003be2e
and dword [ebp - 0x4d4], 0
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4d4]
sub ecx, dword [ebp + eax*4 - 0xe10]
mov dword [ebp - 0x4dc], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0xe10], ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x11b0]
push 2
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov ecx, dword [ebp - 0x4dc]
imul ecx, dword [eax]
cmp ecx, esi
jg 0x1003be95
mov dword [ebp - 0x4ec], 1
jmp 0x1003be9c
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x4ec], eax
jne 0x1003beb8
xor eax, eax
inc eax
jne 0x1003beb8
and dword [ebp - 0x4f4], 0
jmp 0x1003bec2
mov dword [ebp - 0x4f4], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x11b0]
cmp dword [ebp - 0x4f4], eax
jne 0x1003bee3
mov dword [ebp - 0x4fc], 1
jmp 0x1003beea
and dword [ebp - 0x4fc], 0
push 3
lea ecx, [ebp - 0x3b4]
call fcn.1001a954
mov ecx, dword [ebp - 0x4fc]
add ecx, dword [eax]
mov dword [ebp - 0xd54], ecx
jmp 0x1003bc71
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.1001a938
cmp dword [ebp - 0x3fc], 0
jle 0x1003f3f4
mov dword [ebp - 0x8c], 0xfffffff6
mov dword [ebp - 0x544], 0x7b1891f7
mov dword [ebp - 0xa80], 0xe2e4e
mov dword [ebp - 0xa7c], 0xe2e4e
mov dword [ebp - 0xa78], 0xe2e4e
mov dword [ebp - 0xa74], 0xe2e4e
mov dword [ebp - 0x56c], 0xc3e5f885
mov dword [ebp - 0xbdc], 0x7a832397
mov dword [ebp - 0x8c], 0
jmp 0x1003bf8f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x16
jle 0x1003c23b
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x534], 0x37d437f1
mov dword [ebp - 0xde4], 0x236511f0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10b8], eax
cmp dword [ebp - 0x64], 0
je 0x1003c0ca
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1003bff8
cmp dword [ebp - 0x8c], 0
je 0x1003bff8
cmp dword [ebp - 0x64], 0
je 0x1003bff8
mov dword [ebp - 0x504], 1
jmp 0x1003bfff
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0x3842
jge 0x1003c017
mov dword [ebp - 0x50c], 1
jmp 0x1003c01e
and dword [ebp - 0x50c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa80]
cmp dword [ebp - 0x50c], eax
jge 0x1003c03e
mov dword [ebp - 0xbd4], 1
jmp 0x1003c045
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf8c], eax
cmp dword [ebp - 0x64], 0x1edb6b7b
je 0x1003c063
mov dword [ebp - 0x514], 1
jmp 0x1003c06a
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x514], eax
jl 0x1003c081
mov dword [ebp - 0x51c], 1
jmp 0x1003c088
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa80]
cmp dword [ebp - 0x51c], eax
jle 0x1003c0a9
mov dword [ebp - 0x524], 1
jmp 0x1003c0b0
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x524], eax
jl 0x1003c0ca
mov dword [ebp - 0x52c], 1
jmp 0x1003c0d1
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x53d2
jne 0x1003c0f5
mov dword [ebp - 0x53c], 1
jmp 0x1003c0fc
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x53c], eax
jge 0x1003c116
mov dword [ebp - 0x54c], 1
jmp 0x1003c11d
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x54c], eax
jg 0x1003c137
mov dword [ebp - 0x554], 1
jmp 0x1003c13e
and dword [ebp - 0x554], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x554]
sub ecx, 0x4d92
cmp ecx, dword [ebp + eax - 0xa80]
je 0x1003c167
cmp dword [ebp - 0x64], 0
jne 0x1003c167
and dword [ebp - 0x55c], 0
jmp 0x1003c171
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x55c]
jne 0x1003c188
mov dword [ebp - 0xce0], 1
jmp 0x1003c18f
and dword [ebp - 0xce0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp + eax - 0xa80]
jne 0x1003c1b2
mov eax, 0xb9459240
test eax, eax
jne 0x1003c1b2
and dword [ebp - 0x564], 0
jmp 0x1003c1bc
mov dword [ebp - 0x564], 1
cmp dword [ebp - 0x564], 0xfffffff9
jg 0x1003c1d1
mov dword [ebp - 0x3d0], 1
jmp 0x1003c1d8
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xa80], ecx
mov eax, dword [ebp - 0x3d0]
sub eax, 0x7ae0f76
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0x8c]
je 0x1003c215
mov dword [ebp - 0x574], 1
jmp 0x1003c21c
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xbdc], eax
cmp dword [ebp - 0xde4], 0
je 0x1003c236
jmp 0x1003bf82
jmp 0x1003bf82
push 0x66a3
push 0x37d2
push 0x3d76
push 0x3b8b
push 0
push 0x1cc3
push 0
push 0x491c
push 1
call fcn.1002f81e
add esp, 0x24
mov dword [ebp - 0x134], 0xfffe
mov dword [ebp - 0xb0], 0x3d42
mov dword [ebp - 0x5a4], 0xfffffffd
mov dword [ebp - 0x138], 0x69ac54c9
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0xbe4], 8
mov dword [ebp - 0x2d0], 0
jmp 0x1003c2bc
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 4
jge 0x1003c2d8
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x123c], 0xdb956746
jmp 0x1003c2af
cmp dword [ebp - 0xb0], 1
jge 0x1003c2ed
mov dword [ebp - 0x57c], 1
jmp 0x1003c2f4
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x57c]
jge 0x1003c30e
mov dword [ebp - 0x58c], 1
jmp 0x1003c315
and dword [ebp - 0x58c], 0
mov eax, 0x68de
test eax, eax
je 0x1003c333
cmp dword [ebp - 0x5a4], 0
je 0x1003c333
mov dword [ebp - 0x584], 1
jmp 0x1003c33a
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x584]
cmp eax, dword [ebp - 0x134]
jle 0x1003c35b
mov dword [ebp - 0x594], 1
jmp 0x1003c362
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x594]
je 0x1003c37c
mov dword [ebp - 0x440], 1
jmp 0x1003c383
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x440]
je 0x1003c3a6
cmp dword [ebp - 0x5a4], 0
je 0x1003c3a6
mov dword [ebp - 0x5ac], 1
jmp 0x1003c3ad
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xfffffff6
ja 0x1003c3c2
mov dword [ebp - 0x5b4], 1
jmp 0x1003c3c9
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xb0], 0xfffffffb
jmp 0x1003c3ee
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe6
jle 0x1003c727
mov dword [ebp - 0xa50], 1
mov dword [ebp - 0xa4c], 1
mov dword [ebp - 0xa48], 1
mov dword [ebp - 0xa44], 1
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1180], eax
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1003c448
cmp dword [ebp - 0x138], 0
jne 0x1003c448
and dword [ebp - 0x5fc], 0
jmp 0x1003c452
mov dword [ebp - 0x5fc], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp + eax - 0xa50]
jl 0x1003c47e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa50], 0
jne 0x1003c47e
and dword [ebp - 0x5bc], 0
jmp 0x1003c488
mov dword [ebp - 0x5bc], 1
cmp dword [ebp - 0x5bc], 0
jge 0x1003c49d
mov dword [ebp - 0x5c4], 1
jmp 0x1003c4a4
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5c4], eax
jg 0x1003c4be
mov dword [ebp - 0x5cc], 1
jmp 0x1003c4c5
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 1
jl 0x1003c4da
mov dword [ebp - 0x5d4], 1
jmp 0x1003c4e1
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5dc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5dc]
cmp ecx, dword [ebp + eax - 0xa50]
jl 0x1003c50d
mov dword [ebp - 0x5e4], 1
jmp 0x1003c514
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x5e4], eax
jle 0x1003c53e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa50], 0
je 0x1003c53e
mov dword [ebp - 0x5ec], 1
jmp 0x1003c545
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x5ec], eax
jne 0x1003c55f
mov dword [ebp - 0x5f4], 1
jmp 0x1003c566
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x138]
add ecx, dword [ebp - 0x5f4]
sub ecx, dword [ebp + eax - 0x123c]
sub ecx, dword [ebp - 0xbe4]
cmp dword [ebp - 0x5fc], ecx
jg 0x1003c599
mov dword [ebp - 0x604], 1
jmp 0x1003c5a0
and dword [ebp - 0x604], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x604]
mov dword [ebp + eax - 0xa50], ecx
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1003c722
mov dword [ebp - 0x60c], 0x5410
mov dword [ebp - 0xbec], 0x1000a970
cmp dword [ebp - 0x60c], 0x5633
jle 0x1003c6a2
push 0x1fb7
push 0x31a
call dword [sym.imp.KERNEL32.dll_Beep]
and dword [ebp - 0x200], 0
jmp 0x1003c612
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x7a32
jge 0x1003c6a2
and dword [ebp - 0x204], 0
jmp 0x1003c638
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x73da
jge 0x1003c69d
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x204]
shl eax, cl
cdq
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xc9c], edx
push dword [ebp - 0xc9c]
push dword [ebp - 0xca0]
lea ecx, [ebp - 0x127c]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xcec], eax
mov ecx, dword [ebp - 0xcec]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x127c]
call fcn.1001a65b
jmp 0x1003c62b
jmp 0x1003c605
push 0x3a0c
push 0x7d2c
push 0x3138
push 0x17ef
push 0x3225
push 1
push 0xe55
push 0x146d
push 0
push 0xe3d
push 0x4a1a
push 0
call fcn.1002ebad
add esp, 0x30
mov dword [ebp - 4], 0x31
cmp dword [ebp - 0x60c], 0x538b
jge 0x1003c6fc
push dword [ebp - 0xbec]
call fcn.1004e4c6
pop ecx
jmp 0x1003c718
or dword [ebp - 4], 0xffffffff
jmp 0x1003c722
jmp 0x1003c3e1
mov dword [ebp - 0x614], 0x6c73
mov dword [ebp - 0xd5c], 0x1000a9a0
cmp dword [ebp - 0x614], 0x6e32
jle 0x1003c82b
and dword [ebp - 0x21c], 0
jmp 0x1003c761
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x6a30
jge 0x1003c825
and dword [ebp - 0x20c], 0
jmp 0x1003c787
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x6109
jge 0x1003c820
and dword [ebp - 0x214], 0
jmp 0x1003c7ad
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x7213
jge 0x1003c81b
and dword [ebp - 0x1ac], 0
jmp 0x1003c7cf
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x4da4
jge 0x1003c819
mov eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x1ac]
cdq
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xca8], edx
push dword [ebp - 0xca8]
push dword [ebp - 0xcac]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1003c7c2
jmp 0x1003c7a0
jmp 0x1003c77a
jmp 0x1003c754
call dword [sym.imp.USER32.dll_EndMenu]
mov dword [ebp - 0xa98], 0x36544d18
mov dword [ebp - 4], 0x33
cmp dword [ebp - 0x614], 0x6b98
jge 0x1003c858
mov edx, dword [ebp - 0xd5c]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1003c874
or dword [ebp - 4], 0xffffffff
jmp 0x1003c87e
mov dword [ebp - 0xa94], 0x7e318b47
mov dword [ebp - 0xbf4], 0
mov dword [ebp - 0xcf8], 1
push 1
lea ecx, [ebp - 0xf08]
call fcn.1001a8b6
mov dword [ebp - 4], 0x35
mov dword [ebp - 0xf94], 0xffffffff
push 0x78c2
push 0
push 0x49ac
push 0x7ea1
lea eax, [ebp - 0x10c0]
push eax
lea eax, [ebp - 0xf08]
push eax
call fcn.100454f2
add esp, 0x18
push 0
lea eax, [ebp - 0xbf4]
push eax
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0xf08]
push eax
call fcn.1003582f
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.1001a938
push 4
lea ecx, [ebp - 0x378]
call fcn.1001a8b6
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x88c], 0xfffffffe
mov dword [ebp - 0x44], 0x184c506d
mov dword [ebp - 0xf6c], 0x7c8a6b95
mov dword [ebp - 0xf68], 0x7c8a6b95
mov dword [ebp - 0xf64], 0x7c8a6b95
mov dword [ebp - 0xf60], 0x7c8a6b95
mov dword [ebp - 0x674], 0
cmp dword [ebp - 0x44], 0x4182
jne 0x1003ce7b
mov dword [ebp - 0x1dc], 3
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0xec4], 0xfffffffd
mov dword [ebp - 0xec0], 0xfffffffd
mov dword [ebp - 0xebc], 0xfffffffd
mov dword [ebp - 0xeb8], 0xfffffffd
lea ecx, [ebp - 0x409]
call fcn.1001a963
push eax
lea eax, [ebp - 0xeb4]
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0x11fc]
call fcn.1001a966
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10d4]
call fcn.1001a912
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x694], 0xc650ba43
push 1
lea ecx, [ebp - 0xf20]
call fcn.1001a8b6
mov byte [ebp - 4], 0x38
push 0x484f
lea eax, [ebp - 0xf20]
push eax
push 0
push 0x2337
push 0x67ae
lea eax, [ebp - 0xf9c]
push eax
call fcn.1002e698
add esp, 0x18
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1003ca60
push 0x20a0
push 1
push 0
push 0x97b
call fcn.1002f1de
add esp, 0x10
mov dword [ebp - 0x44], 0
jmp 0x1003ca70
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1003ce58
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0x1d4], 8
mov dword [ebp - 0x61c], 0x4fe2
mov dword [ebp - 0xaa0], 0x1000aa20
cmp dword [ebp - 0x61c], 0x5216
jle 0x1003cb99
push 0x1a27
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [ebp - 0x1c4], 0
jmp 0x1003cad3
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x4c83
jge 0x1003cb99
and dword [ebp - 0x1cc], 0
jmp 0x1003caf9
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x144e
jge 0x1003cb94
and dword [ebp - 0x1b4], 0
jmp 0x1003cb1f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x2c9b
jge 0x1003cb8f
and dword [ebp - 0x1bc], 0
jmp 0x1003cb41
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x37d6
jge 0x1003cb8d
mov eax, dword [ebp - 0x1b4]
cdq
idiv dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1c4]
and eax, dword [ebp - 0x1cc]
and eax, edx
cdq
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0xcb4], edx
push dword [ebp - 0xcb4]
push dword [ebp - 0xcb8]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1003cb34
jmp 0x1003cb12
jmp 0x1003caec
jmp 0x1003cac6
mov byte [ebp - 4], 0x39
cmp dword [ebp - 0x61c], 0x4db9
jge 0x1003cbb9
mov edx, dword [ebp - 0xaa0]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1003cbd5
mov dword [ebp - 4], 0x38
jmp 0x1003cbe5
mov dword [ebp - 0x6c], 0
jmp 0x1003cbf5
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1003cc0b
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xe8c], 0x88f4f368
jmp 0x1003cbee
mov dword [ebp - 0x6c], 0
jmp 0x1003cc1b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1003cc31
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x11e0], 0x3279329b
jmp 0x1003cc14
cmp dword [ebp - 0x3d4], 0
jne 0x1003cd21
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x3d4], 0
jne 0x1003cc65
cmp dword [ebp - 0x674], 0
jne 0x1003cc65
and dword [ebp - 0x624], 0
jmp 0x1003cc6f
mov dword [ebp - 0x624], 1
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x624], eax
jl 0x1003cc89
mov dword [ebp - 0x62c], 1
jmp 0x1003cc90
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0
jl 0x1003cca5
mov dword [ebp - 0x634], 1
jmp 0x1003ccac
and dword [ebp - 0x634], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe8c]
cmp dword [ebp - 0x634], eax
jne 0x1003cccd
mov dword [ebp - 0x63c], 1
jmp 0x1003ccd4
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x63c], eax
je 0x1003cceb
mov dword [ebp - 0x644], 1
jmp 0x1003ccf2
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x64c]
je 0x1003cd21
and dword [ebp - 0x654], 0
jmp 0x1003cd2b
mov dword [ebp - 0x654], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe8c]
mov dword [ebp - 0x65c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x65c]
mov dword [ebp + eax - 0xf6c], ecx
mov eax, dword [ebp - 0x1dc]
imul eax, dword [ebp - 0x654]
cmp dword [ebp - 0x65c], eax
jge 0x1003cd77
cmp dword [ebp - 0x1d4], 0
jne 0x1003cd77
and dword [ebp - 0x664], 0
jmp 0x1003cd81
mov dword [ebp - 0x664], 1
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x664], eax
jl 0x1003cd9b
mov dword [ebp - 0x66c], 1
jmp 0x1003cda2
and dword [ebp - 0x66c], 0
push 1
lea ecx, [ebp - 0x10d4]
call fcn.1001a954
mov ecx, dword [ebp - 0x66c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x10c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11e0], 0
jne 0x1003cde5
cmp dword [ebp - 0x3d4], 0
jne 0x1003cde5
and dword [ebp - 0x67c], 0
jmp 0x1003cdef
mov dword [ebp - 0x67c], 1
imul eax, dword [ebp - 0x67c], 0x5c12
cmp eax, 1
jb 0x1003ce0a
mov dword [ebp - 0x684], 1
jmp 0x1003ce11
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x684], eax
jg 0x1003ce2b
mov dword [ebp - 0x68c], 1
jmp 0x1003ce32
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x694], eax
mov esi, dword [ebp - 0x694]
push 0
lea ecx, [ebp - 0xf20]
call fcn.1001a954
mov dword [eax], esi
jmp 0x1003ca69
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xf20]
call fcn.1001a938
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x10d4]
call fcn.1001a938
jmp 0x1003d025
mov dword [ebp - 0x69c], 0x2b86
mov dword [ebp - 0xa90], 0x1000aaa0
cmp dword [ebp - 0x69c], 0x2d25
jle 0x1003cf75
and dword [ebp - 0x1e4], 0
jmp 0x1003ceb5
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x4c23
jge 0x1003cf75
and dword [ebp - 0x1ec], 0
jmp 0x1003cedb
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0x5cc5
jge 0x1003cf70
and dword [ebp - 0x1f4], 0
jmp 0x1003cf01
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x3b4c
jge 0x1003cf6b
mov eax, dword [ebp - 0x1e4]
imul eax, dword [ebp - 0x1ec]
add eax, dword [ebp - 0x1f4]
cdq
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0xcc0], edx
push dword [ebp - 0xcc0]
push dword [ebp - 0xcc4]
lea ecx, [ebp - 0x12a0]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xaa8], eax
mov ecx, dword [ebp - 0xaa8]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x12a0]
call fcn.1001a65b
jmp 0x1003cef4
jmp 0x1003cece
jmp 0x1003cea8
mov byte [ebp - 0xe9], 0
push 1
push 0x5c25
push 0x771a
push 0x7f1a
lea eax, [ebp - 0xe9]
push eax
push 1
call fcn.1002c053
add esp, 0x18
mov byte [ebp - 4], 0x3b
cmp dword [ebp - 0x69c], 0x28e4
jge 0x1003cfba
push dword [ebp - 0xa90]
call fcn.1004e4c6
pop ecx
jmp 0x1003cfd6
mov dword [ebp - 4], 0x36
jmp 0x1003cfe6
mov dword [ebp - 0x44], 0
jmp 0x1003cff6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1003d025
mov byte [ebp - 0xff], 0
push 0x36fe
push 0
push 0x1973
lea eax, [ebp - 0xff]
push eax
push 0x5dd7
call fcn.1003493d
add esp, 0x14
jmp 0x1003cfef
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 0xbb0], 0x305aba9a
mov dword [ebp - 0x1fc], 0xc03342eb
mov dword [ebp - 0x1fc], 0
jmp 0x1003d05c
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x16
jg 0x1003d0e0
mov byte [ebp - 0xeb], 0
push 0x1d9c
lea eax, [ebp - 0xeb]
push eax
push 0x1d46
push 0x7a00
push 0
push 0x4a4e
push 0x201c
push 1
push 0
push 0x1ad3
push 0x11d1
push 0x465f
call fcn.1002d1d1
add esp, 0x30
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1003d0db
push 0xdb
push 0x28df
push 0x1b09
push 0
push 0x7866
push 1
call fcn.100352ee
add esp, 0x18
jmp 0x1003d04f
mov dword [ebp - 0x148], 0
jmp 0x1003d0f9
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x1003d115
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xe00], 0xffffffff
jmp 0x1003d0ec
mov dword [ebp - 0xeb0], 0x76820624
mov dword [ebp - 0xeac], 0x76820624
mov dword [ebp - 0xea8], 0x76820624
mov dword [ebp - 0xea4], 0x76820624
lea ecx, [ebp - 0x411]
call fcn.1001a963
push eax
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0xeb0]
push eax
lea ecx, [ebp - 0x1204]
call fcn.1001a966
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3c0]
call fcn.1001a912
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x140], 6
mov dword [ebp - 0x3dc], 0x7ab6ce1a
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov dword [eax], 0xffffffee
jmp 0x1003d1c3
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
cmp dword [eax], 0xffffffe9
jg 0x1003d3c8
mov dword [ebp - 0x284], 0xf5a8b060
mov dword [ebp - 0x6d4], 0x5734cb44
mov dword [ebp - 0x27c], 0
jmp 0x1003d206
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1003d222
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0xcd0], 0xffffffff
jmp 0x1003d1f9
push 3
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xfac], eax
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov esi, eax
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1003d269
mov dword [ebp - 0x6ac], 1
jmp 0x1003d270
and dword [ebp - 0x6ac], 0
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax]
jl 0x1003d293
mov dword [ebp - 0x6b4], 1
jmp 0x1003d29a
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0xa277
jne 0x1003d2bf
cmp dword [ebp - 0x284], 0
je 0x1003d2bf
push 2
pop eax
test eax, eax
jne 0x1003d2bf
and dword [ebp - 0x6bc], 0
jmp 0x1003d2c9
mov dword [ebp - 0x6bc], 1
mov eax, dword [ebp - 0x6bc]
sub eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x284]
jge 0x1003d2e9
mov dword [ebp - 0xab8], 1
jmp 0x1003d2f0
and dword [ebp - 0xab8], 0
mov eax, 0x68cb667f
test eax, eax
jne 0x1003d305
mov dword [ebp - 0x6c4], 1
jmp 0x1003d30c
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x6c4], eax
jl 0x1003d326
mov dword [ebp - 0x6cc], 1
jmp 0x1003d32d
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x6d4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x6d4]
add edx, dword [ebp + ecx - 0xcd0]
cmp edx, dword [ebp + eax - 0xcd0]
jl 0x1003d367
mov dword [ebp - 0x6dc], 1
jmp 0x1003d36e
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x6dc], eax
jl 0x1003d388
mov dword [ebp - 0x6e4], 1
jmp 0x1003d38f
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcd0]
cmp dword [ebp - 0x6e4], eax
jl 0x1003d3b0
mov dword [ebp - 0x6ec], 1
jmp 0x1003d3b7
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x3dc], eax
jmp 0x1003d19f
mov eax, dword [ebp - 0x140]
add eax, 0xe26
cmp eax, 0xffff
jae 0x1003d3e6
mov dword [ebp - 0x6f4], 1
jmp 0x1003d3ed
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xfff7
ja 0x1003d405
mov dword [ebp - 0xa8c], 1
jmp 0x1003d40c
and dword [ebp - 0xa8c], 0
mov dword [ebp - 0x3dc], 0x6909
cmp dword [ebp - 0x3dc], 0xfffffff6
jge 0x1003d42b
mov dword [ebp - 0x6fc], 1
jmp 0x1003d432
and dword [ebp - 0x6fc], 0
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6fc]
jne 0x1003d455
mov dword [ebp - 0x704], 1
jmp 0x1003d45c
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0
jae 0x1003d471
mov dword [ebp - 0x70c], 1
jmp 0x1003d478
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0x86de1f17
je 0x1003d490
mov dword [ebp - 0x714], 1
jmp 0x1003d497
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x714], eax
jg 0x1003d4b1
mov dword [ebp - 0x71c], 1
jmp 0x1003d4b8
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 0x28aea381
jge 0x1003d4d0
mov dword [ebp - 0x724], 1
jmp 0x1003d4d7
and dword [ebp - 0x724], 0
mov esi, 0xfff6
sub esi, dword [ebp - 0x724]
push 0
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
cmp esi, dword [eax]
jle 0x1003d4ff
mov dword [ebp - 0x72c], 1
jmp 0x1003d506
and dword [ebp - 0x72c], 0
push 2
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov ecx, dword [ebp - 0x72c]
cmp ecx, dword [eax]
jle 0x1003d532
cmp dword [ebp - 0x140], 0
je 0x1003d532
mov dword [ebp - 0x73c], 1
jmp 0x1003d539
and dword [ebp - 0x73c], 0
push 3
lea ecx, [ebp - 0x3c0]
call fcn.1001a954
mov ecx, dword [ebp - 0x73c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x3c0]
call fcn.1001a938
push 0x7779
push 1
push 0x4926
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x378]
push eax
push 1
push 1
call fcn.1002c0fb
add esp, 0x1c
mov dword [ebp - 0x10ec], 1
mov dword [ebp - 0xfb4], 7
mov dword [ebp - 0x10d8], 0
mov dword [ebp - 0xfbc], 0x88a137b1
mov dword [ebp - 0x10f0], 0x2a1836cc
push 2
lea ecx, [ebp - 0x10e4]
call fcn.1001a8b6
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0xac8], 0x1371
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0x744], 6
lea eax, [ebp - 0x10e4]
push eax
push 1
push 0
lea eax, [ebp - 0xfc4]
push eax
call fcn.1002c1ef
add esp, 0x10
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
lea eax, [ebp - 0xac8]
push eax
push 0x6c8d
lea eax, [ebp - 0xad0]
push eax
push 0x6486
push 0x700f
push 1
push 0xcc1
push 0x6f13
push 0
push 0x2b70
push 0x9ab
push 1
call fcn.1002ebad
add esp, 0x30
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x10e4]
call fcn.1001a938
push 2
lea ecx, [ebp - 0x378]
call fcn.1001a954
mov dword [eax], 3
jmp 0x1003d692
push 2
lea ecx, [ebp - 0x378]
call fcn.1001a954
cmp dword [eax], 0
jl 0x1003e9f0
mov dword [ebp - 0x2bc], 0xcf5720e8
mov dword [ebp - 0x3e4], 0x4f37831e
push 2
lea ecx, [ebp - 0xe50]
call fcn.1001a8b6
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0xae0], 0x12afbcae
mov dword [ebp - 0xae8], 0x84502e46
mov dword [ebp - 0x754], 0x2f2c
mov dword [ebp - 0xad8], 0x1000aaec
cmp dword [ebp - 0x754], 0x2ffe
jle 0x1003d7f2
and dword [ebp - 0x29c], 0
jmp 0x1003d71b
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x5c25
jge 0x1003d7e2
and dword [ebp - 0x2a4], 0
jmp 0x1003d741
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x7bba
jge 0x1003d7dd
and dword [ebp - 0x28c], 0
jmp 0x1003d767
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x5eb0
jge 0x1003d7d8
and dword [ebp - 0x294], 0
jmp 0x1003d789
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x26a1
jge 0x1003d7d6
mov eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x294]
mov edx, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x2a4]
shl edx, cl
or eax, edx
cdq
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0xcd8], edx
push dword [ebp - 0xcd8]
push dword [ebp - 0xcdc]
mov ecx, 0x1060d4b8
call fcn.1001a685
jmp 0x1003d77c
jmp 0x1003d75a
jmp 0x1003d734
jmp 0x1003d70e
push 0x2335
push 0xa39
call dword [sym.imp.USER32.dll_GetDlgItem]
mov byte [ebp - 4], 0x40
cmp dword [ebp - 0x754], 0x2c82
jge 0x1003d812
mov edx, dword [ebp - 0xad8]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1003d82e
mov dword [ebp - 4], 0x3f
jmp 0x1003d83e
mov dword [ebp - 0x2ac], 0
jmp 0x1003d857
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1003d879
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xe50]
call fcn.1001a954
mov dword [eax], 0xf58382bd
jmp 0x1003d84a
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0x3e4], 0
je 0x1003d8b9
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1003d8b4
push 0x474c
push 0
push 0x4d1a
call fcn.1002e807
add esp, 0xc
jmp 0x1003d997
mov dword [ebp - 0x2b4], 0xfffffff7
mov dword [ebp - 0x75c], 0xffffffff
cmp dword [ebp - 0x2b4], 0
jne 0x1003d942
cmp dword [ebp - 0x2b4], 0
jne 0x1003d942
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x75c], eax
imul eax, dword [ebp - 0x75c], 0xae7b
cmp eax, 0xc48b
jne 0x1003d91d
cmp dword [ebp - 0x3e4], 0
je 0x1003d91d
mov dword [ebp - 0x764], 1
jmp 0x1003d924
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jne 0x1003d942
and dword [ebp - 0x76c], 0
jmp 0x1003d94c
mov dword [ebp - 0x76c], 1
cmp dword [ebp - 0x76c], 9
jne 0x1003d961
mov dword [ebp - 0x774], 1
jmp 0x1003d968
and dword [ebp - 0x774], 0
push 0
lea ecx, [ebp - 0xe50]
call fcn.1001a954
mov ecx, dword [ebp - 0x774]
mov dword [eax], ecx
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1003d997
push 0
call fcn.100300c9
pop ecx
lea eax, [ebp - 0x2bc]
push eax
push 0x5c7d
push 0
push 0x6a1c
push 0x56b0
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0x3e4]
push eax
push 1
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xae8]
push eax
push 0x9fc
push 0x1eb2
call fcn.1002e81f
add esp, 0x30
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xe50]
call fcn.1001a938
mov dword [ebp - 0x30], 0x44555950
mov dword [ebp - 0xb8], 0x8a527335
mov dword [ebp - 0x2c4], 0
jmp 0x1003da18
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1003da31
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x74], 0x611bc38
jmp 0x1003da0b
cmp dword [ebp - 0x30], 0
jne 0x1003dafa
push 5
pop eax
test eax, eax
je 0x1003da54
cmp dword [ebp - 0x30], 0
je 0x1003da54
mov dword [ebp - 0xaf0], 1
jmp 0x1003da5b
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa88], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa88]
mov dword [ebp + eax - 0x74], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x10f8], eax
cmp dword [ebp - 0x30], 0x2301
je 0x1003da99
mov dword [ebp - 0x77c], 1
jmp 0x1003daa0
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0x71a
jg 0x1003dab8
mov dword [ebp - 0xb00], 1
jmp 0x1003dabf
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xfd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
jne 0x1003dae8
cmp dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 0
jne 0x1003dafa
and dword [ebp - 0x784], 0
jmp 0x1003db04
mov dword [ebp - 0x784], 1
imul eax, dword [ebp - 0x784], 0xfaaa
cmp eax, dword [ebp - 0x30]
jge 0x1003db1c
mov eax, 0x90412894
test eax, eax
je 0x1003db2f
push 4
pop eax
test eax, eax
je 0x1003db2f
mov dword [ebp - 0x78c], 1
jmp 0x1003db36
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x78c]
cmp eax, 0xf58aae07
jbe 0x1003dc7a
mov dword [ebp - 0x150], 0xfffffff9
mov dword [ebp - 0xb10], 0xfffffff6
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1100], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0xb36c
jge 0x1003db90
mov eax, 0x839bf5bf
test eax, eax
je 0x1003db90
mov dword [ebp - 0x794], 1
jmp 0x1003db97
and dword [ebp - 0x794], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
cmp dword [ebp - 0x794], eax
jl 0x1003dbb5
mov dword [ebp - 0x79c], 1
jmp 0x1003dbbc
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
neg eax
cmp eax, dword [ebp - 0xb8]
jge 0x1003dbd8
mov dword [ebp - 0x7a4], 1
jmp 0x1003dbdf
and dword [ebp - 0x7a4], 0
imul eax, dword [ebp - 0x7a4], 0x9690
imul eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x150]
jge 0x1003dc04
mov dword [ebp - 0x7ac], 1
jmp 0x1003dc0b
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 1
jb 0x1003dc20
mov dword [ebp - 0xb08], 1
jmp 0x1003dc27
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x150]
jl 0x1003dc3e
mov dword [ebp - 0x7b4], 1
jmp 0x1003dc45
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x7b4]
jne 0x1003dc5c
mov dword [ebp - 0x7bc], 1
jmp 0x1003dc63
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0xb10], eax
jmp 0x1003ddca
mov dword [ebp - 0x2cc], 0x94914501
mov dword [ebp - 0x3ec], 3
mov dword [ebp - 0x7f4], 0x762cc684
mov dword [ebp - 0xb18], 0x82e70d5d
cmp dword [ebp - 0x2cc], 0
je 0x1003dcc4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
je 0x1003dcc4
mov dword [ebp - 0x7c4], 1
jmp 0x1003dccb
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x3ec]
jne 0x1003dcf2
mov dword [ebp - 0x7cc], 1
jmp 0x1003dcf9
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7c4]
cmp eax, dword [ebp - 0x7cc]
jl 0x1003dd13
mov dword [ebp - 0x7d4], 1
jmp 0x1003dd1a
and dword [ebp - 0x7d4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
jne 0x1003dd2e
cmp dword [ebp - 0x2cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0xb8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb8]
imul ecx, dword [ebp - 0x2cc]
sub ecx, dword [ebp + eax - 0x74]
cmp ecx, 0xfffb
jae 0x1003dd69
mov dword [ebp - 0x7dc], 1
jmp 0x1003dd70
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0x7dc]
je 0x1003dd8a
mov dword [ebp - 0x7e4], 1
jmp 0x1003dd91
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x7e4], eax
jge 0x1003ddab
mov dword [ebp - 0x7ec], 1
jmp 0x1003ddb2
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0x2d4], 0
jmp 0x1003dde3
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 4
jge 0x1003ddff
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x11a0], 9
jmp 0x1003ddd6
mov dword [ebp - 0x158], 0x387fb0b0
mov dword [ebp - 0x2dc], 0
jmp 0x1003de22
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x1003de3e
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xb28], 0x2e91
jmp 0x1003de15
mov dword [ebp - 0x158], 0
jmp 0x1003de57
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x1003dfee
mov dword [ebp - 0x7fc], 0x6718
mov dword [ebp - 0xb30], 0x1000ab48
cmp dword [ebp - 0x7fc], 0x6727
jle 0x1003df90
and dword [ebp - 0x2f4], 0
jmp 0x1003de9e
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x1301
jge 0x1003df90
and dword [ebp - 0x2e4], 0
jmp 0x1003dec4
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x7b2c
jge 0x1003df8b
and dword [ebp - 0x2ec], 0
jmp 0x1003deea
cmp dword [ebp - 0x2ec], 0x5807
jge 0x1003df86
and dword [ebp - 0x2fc], 0
jmp 0x1003df10
cmp dword [ebp - 0x2fc], 0x284f
jge 0x1003df81
mov ecx, dword [ebp - 0x2e4]
sub ecx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2f4]
shl eax, cl
xor eax, dword [ebp - 0x2fc]
cdq
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xce4], edx
push dword [ebp - 0xce4]
push dword [ebp - 0xce8]
lea ecx, [ebp - 0x12d0]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb20]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x12d0]
call fcn.1001a65b
jmp 0x1003df03
jmp 0x1003dedd
jmp 0x1003deb7
jmp 0x1003de91
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xb28], 0
mov byte [ebp - 4], 0x42
cmp dword [ebp - 0x7fc], 0x64e4
jge 0x1003dfbd
push dword [ebp - 0xb30]
call fcn.1004e4c6
pop ecx
jmp 0x1003dfd9
mov dword [ebp - 4], 0x36
jmp 0x1003dfe9
jmp 0x1003de4a
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1003e008
push 0
call fcn.10047997
pop ecx
mov byte [ebp - 0xd2], 0
mov dword [ebp - 0xb40], 0xec299e88
mov dword [ebp - 0x7c], 0
jmp 0x1003e029
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1003e03c
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x40], 0xfffffff9
jmp 0x1003e022
mov dword [ebp - 0x7c], 0
jmp 0x1003e04c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1003e062
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x11c8], 0xffffffff
jmp 0x1003e045
mov dword [ebp - 0x804], 0x6b97
mov dword [ebp - 0xb38], 0x1000abb8
cmp dword [ebp - 0x804], 0x6d5c
jle 0x1003e162
and dword [ebp - 0x314], 0
jmp 0x1003e09c
cmp dword [ebp - 0x314], 0x5f6d
jge 0x1003e162
and dword [ebp - 0x31c], 0
jmp 0x1003e0c2
cmp dword [ebp - 0x31c], 0x5d9d
jge 0x1003e15d
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1003e18a
push 1
push 0x675
push 0
push 0x71ba
call fcn.1002d648
add esp, 0x10
mov byte [ebp - 4], 0x44
cmp dword [ebp - 0x804], 0x6a79
jge 0x1003e1aa
mov edx, dword [ebp - 0xb38]
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1003e1c6
mov dword [ebp - 4], 0x36
jmp 0x1003e1d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.1001a938
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0xbd8], 1
mov dword [ebp - 0x34c], 0
jmp 0x1003ea33
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x1003ea4f
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xd0], 1
jmp 0x1003ea26
mov dword [ebp - 0xc8], 0xc
jmp 0x1003ea68
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x16
jge 0x1003edee
push 3
lea ecx, [ebp - 0xf44]
call fcn.1001a8b6
mov dword [ebp - 4], 0x48
push 0
push 0x66ac
lea eax, [ebp - 0x168]
push eax
push 0xaf1
lea eax, [ebp - 0xf44]
push eax
call fcn.1002f10a
add esp, 0x14
mov dword [ebp - 0x168], 0
jmp 0x1003eac4
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x1003eae0
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x1214], 1
jmp 0x1003eab7
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x1003eaf7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x1003edda
mov dword [ebp - 0x8f0], 0x4812
mov dword [ebp - 0xbc0], 0x1000acb8
cmp dword [ebp - 0x8f0], 0x49b1
jle 0x1003ec3b
and dword [ebp - 0x36c], 0
jmp 0x1003eb3b
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x30cf
jge 0x1003ec2e
and dword [ebp - 0x354], 0
jmp 0x1003eb61
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x501b
jge 0x1003ec29
and dword [ebp - 0x35c], 0
jmp 0x1003eb87
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x45c0
jge 0x1003ec24
and dword [ebp - 0x364], 0
jmp 0x1003ebad
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x72e3
jge 0x1003ec1f
mov eax, dword [ebp - 0x354]
imul eax, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x364]
sar eax, cl
or eax, dword [ebp - 0x36c]
cdq
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0xd08], edx
push dword [ebp - 0xd08]
push dword [ebp - 0xd0c]
lea ecx, [ebp - 0x1318]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xbb8], eax
mov ecx, dword [ebp - 0xbb8]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x1318]
call fcn.1001a65b
jmp 0x1003eba0
jmp 0x1003eb7a
jmp 0x1003eb54
jmp 0x1003eb2e
push 0
push 0x133e
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 0x50], 0
mov byte [ebp - 4], 0x49
cmp dword [ebp - 0x8f0], 0x46f1
jge 0x1003ec5e
push dword [ebp - 0xbc0]
call fcn.1004e4c6
pop ecx
jmp 0x1003ec7a
mov dword [ebp - 4], 0x48
jmp 0x1003ec8a
mov dword [ebp - 0x50], 0
jmp 0x1003ec9a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1003eda9
mov dword [ebp - 0x170], 0x4401d1b9
mov dword [ebp - 0x170], 0
jmp 0x1003ecc7
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jg 0x1003eda4
push 4
lea ecx, [ebp - 0xdd8]
call fcn.1001a8b6
mov byte [ebp - 4], 0x4b
mov dword [ebp - 0x37c], 0
jmp 0x1003ecfe
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 4
jge 0x1003ed20
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xdd8]
call fcn.1001a954
mov dword [eax], 7
jmp 0x1003ecf1
push 1
lea ecx, [ebp - 0xdd8]
call fcn.1001a954
and dword [eax], 0
jmp 0x1003ed56
push 1
lea ecx, [ebp - 0xdd8]
call fcn.1001a954
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x8f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8f8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xdd8]
call fcn.1001a954
cmp dword [eax], 2
jg 0x1003ed79
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xd0], 0
je 0x1003ed77
jmp 0x1003ed79
jmp 0x1003ed32
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xd0]
mov ecx, dword [ebp - 0x170]
mov dword [ebp + ecx*4 - 0x1208], eax
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xdd8]
call fcn.1001a938
jmp 0x1003ecba
jmp 0x1003ec93
mov dword [ebp - 0x50], 0
jmp 0x1003edb9
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1003edd5
push dword [ebp - 0x50]
lea ecx, [ebp - 0xf44]
call fcn.1001a954
mov dword [eax], 0xfffffffa
jmp 0x1003edb2
jmp 0x1003eaf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf44]
call fcn.1001a938
jmp 0x1003ea5b
mov dword [ebp - 0x24], 0
jmp 0x1003edfe
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c
jg 0x1003f139
mov dword [ebp - 0x394], 0xfffffff8
mov dword [ebp - 0x3f4], 0
mov byte [ebp - 0x99], 0
lea eax, [ebp - 0x99]
push eax
push 0
push 0x7c1
call fcn.1004764c
add esp, 0xc
mov dword [ebp - 0x958], 0xb7f
mov dword [ebp - 0xbe0], 0x1000ad28
cmp dword [ebp - 0x958], 0xeca
jle 0x1003ef05
and dword [ebp - 0x384], 0
jmp 0x1003ee73
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x1258
jge 0x1003eefd
and dword [ebp - 0x38c], 0
jmp 0x1003ee95
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x4f81
jge 0x1003eef8
mov eax, dword [ebp - 0x384]
xor eax, dword [ebp - 0x38c]
cdq
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xd14], edx
push dword [ebp - 0xd14]
push dword [ebp - 0xd18]
lea ecx, [ebp - 0x1300]
call fcn.1000d41a
pop ecx
pop ecx
mov dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xbc8]
call fcn.1001a665
push eax
call fcn.1004e4c6
pop ecx
lea ecx, [ebp - 0x1300]
call fcn.1001a65b
jmp 0x1003ee88
jmp 0x1003ee66
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0xc8], 0
je 0x1003ef23
mov eax, 0x2821
test eax, eax
je 0x1003ef23
mov dword [ebp - 0x900], 1
jmp 0x1003ef2a
and dword [ebp - 0x900], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0xfe4], eax
cmp dword [ebp - 0x900], 1
jl 0x1003ef52
mov dword [ebp - 0x920], 1
jmp 0x1003ef59
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0xc8]
jne 0x1003ef73
mov dword [ebp - 0xbd0], 1
jmp 0x1003ef7a
and dword [ebp - 0xbd0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x113c], eax
cmp dword [ebp - 0x394], 0x12fd
jge 0x1003efa5
mov dword [ebp - 0x908], 1
jmp 0x1003efac
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x908], eax
je 0x1003efc6
mov dword [ebp - 0x910], 1
jmp 0x1003efcd
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
add eax, 0x7eed
cmp eax, dword [ebp - 0x3f4]
jl 0x1003f008
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x1003f008
mov dword [ebp - 0x918], 1
jmp 0x1003f00f
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0xbd8]
add eax, dword [ebp - 0x918]
cmp dword [ebp - 0x920], eax
jl 0x1003f02f
mov dword [ebp - 0x928], 1
jmp 0x1003f036
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0xffffffff
jle 0x1003f058
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
jne 0x1003f058
and dword [ebp - 0x930], 0
jmp 0x1003f062
mov dword [ebp - 0x930], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x930], eax
jge 0x1003f083
mov dword [ebp - 0x938], 1
jmp 0x1003f08a
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 8
jl 0x1003f09f
mov dword [ebp - 0x940], 1
jmp 0x1003f0a6
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x940], eax
jl 0x1003f0c0
mov dword [ebp - 0x948], 1
jmp 0x1003f0c7
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 3
jl 0x1003f0dc
mov dword [ebp - 0x950], 1
jmp 0x1003f0e3
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 4], 0x4c
cmp dword [ebp - 0x958], 0x91a
jge 0x1003f10e
push dword [ebp - 0xbe0]
call fcn.1004e4c6
pop ecx
jmp 0x1003f12a
or dword [ebp - 4], 0xffffffff
jmp 0x1003f134
jmp 0x1003edf7
push 4
push 0x1000
push dword [ebp - 0x3fc]
mov eax, dword [ebp - 0x9c0]
mov ecx, dword [ebp - 0xbe8]
add ecx, dword [eax + 0xc]
push ecx
push 0x7e1e
push 0x820e
call fcn.100225a3
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x404]
mov dword [ecx], eax
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x178], 0xce96f8f
mov dword [ebp - 0x9a0], 0xe81d534a
mov dword [ebp - 0x39c], 0
jmp 0x1003f1a5
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 3
jge 0x1003f1c1
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0x11d4], 0xd1649bc0
jmp 0x1003f198
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x1003f1e4
mov eax, 0x3439
test eax, eax
jne 0x1003f1e4
and dword [ebp - 0x960], 0
jmp 0x1003f1ee
mov dword [ebp - 0x960], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x960], eax
jg 0x1003f205
mov dword [ebp - 0x968], 1
jmp 0x1003f20c
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x968], eax
jne 0x1003f223
mov dword [ebp - 0x970], 1
jmp 0x1003f22a
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x1003f24a
cmp dword [ebp - 0x14], 0
je 0x1003f24a
mov dword [ebp - 0x978], 1
jmp 0x1003f251
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x978]
neg eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
add eax, 0xffff
cmp eax, dword [ebp - 0x14]
je 0x1003f27f
mov dword [ebp - 0x980], 1
jmp 0x1003f286
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x988], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x988]
mov dword [ebp + eax - 0x11d4], ecx
cmp dword [ebp - 0x988], 0
jne 0x1003f2c0
cmp dword [ebp - 0x14], 0
jne 0x1003f2c0
and dword [ebp - 0x990], 0
jmp 0x1003f2ca
mov dword [ebp - 0x990], 1
mov eax, dword [ebp - 0x990]
add eax, 0xfbd1
je 0x1003f2ec
cmp dword [ebp - 0x178], 0
je 0x1003f2ec
mov dword [ebp - 0x998], 1
jmp 0x1003f2f3
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x14]
jl 0x1003f337
mov dword [ebp - 0x9a8], 1
jmp 0x1003f33e
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x9a8], eax
jge 0x1003f355
mov dword [ebp - 0x9b0], 1
jmp 0x1003f35c
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x9b0]
jl 0x1003f380
mov dword [ebp - 0x9b8], 0x87a9b65c
mov eax, dword [ebp - 0x9b8]
dec eax
mov dword [ebp - 0x9b8], eax
jmp 0x1003f39d
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1003f39d
push 0x1d37
call dword [sym.imp.USER32.dll_IsWindow]
push 0x4719
push 0x421b
push 0x47d2
push 0x46d8
push 1
lea eax, [ebp - 0x9c0]
push eax
push 0x5f25
push 1
push 0
lea eax, [ebp - 0x404]
push eax
push 0x66a3
push 0x1d83
call fcn.1002d1d1
add esp, 0x30
push dword [ebp - 0x3fc]
push 0
mov eax, dword [ebp - 0x404]
push dword [eax]
call fcn.10022670
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret