Function at 0x10039fbc
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068331
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3cc
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1003a102
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
movzx eax, byte [eax]
test eax, eax
je 0x1003a0f5
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x208]
cmp dword [eax], 1
jne 0x1003a09c
mov dword [ebp - 0xdc], 1
jmp 0x1003a0a3
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax]
cmp dword [ebp - 0xdc], eax
jle 0x1003a0bf
mov dword [ebp - 0x138], 1
jmp 0x1003a0c6
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 0xfffb
ja 0x1003a0de
mov dword [ebp - 0xd4], 1
jmp 0x1003a0e5
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
jmp 0x1003a0fd
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1003b3ac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1f0], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x16c]
movzx eax, byte [eax]
test eax, eax
je 0x1003b38d
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x5c], 0xc70bb743
mov dword [ebp - 0x184], 0
mov dword [ebp - 0xa0], 0
jmp 0x1003a185
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1003a1a1
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xa8], 0
jmp 0x1003a178
mov dword [ebp - 0x5c], 0
jmp 0x1003a1b1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jg 0x1003a499
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x14], 0x67e307b5
mov dword [ebp - 0x28], 0
jmp 0x1003a1d9
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1003a222
mov dword [ebp - 0x80], 0
jmp 0x1003a1ef
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1003a205
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x10c], 0xc427
jmp 0x1003a1e8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10c], eax
jmp 0x1003a1d2
mov dword [ebp - 0x14], 0
jmp 0x1003a232
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1003a494
mov dword [ebp - 0x1cc], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xa8], 0
jne 0x1003a2c7
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x5c]
cmp eax, 0x2947
jl 0x1003a26c
mov dword [ebp - 0xe4], 1
jmp 0x1003a273
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xa8], 0x9968
jge 0x1003a28f
mov dword [ebp - 0x124], 1
jmp 0x1003a296
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x124]
jne 0x1003a2b0
mov dword [ebp - 0x17c], 1
jmp 0x1003a2b7
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa8]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
sub eax, dword [ebp + ecx*4 - 0xa8]
cmp eax, dword [ebp - 0x14]
jg 0x1003a2ee
mov eax, 0xb42c
test eax, eax
je 0x1003a2ee
mov dword [ebp - 0xec], 1
jmp 0x1003a2f5
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xec], eax
jg 0x1003a30c
mov dword [ebp - 0x114], 1
jmp 0x1003a313
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jle 0x1003a32d
mov dword [ebp - 0xf4], 1
jmp 0x1003a334
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xf4], eax
jge 0x1003a34e
mov dword [ebp - 0x134], 1
jmp 0x1003a355
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1f4], 0x1a2c
cmp dword [ebp - 0x1f4], 0x97a
jge 0x1003a46d
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0xfc]
push eax
mov ecx, 0x10659c50
call fcn.1001605f
mov ecx, eax
call fcn.1001605f
mov ecx, eax
call fcn.1001605f
mov ecx, eax
call fcn.1001605f
mov ecx, eax
call fcn.1001605f
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x1d4]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x194]
imul eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x204]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x104]
jne 0x1003a427
push fcn.1001b109
mov edx, 0x10007a10
mov ecx, 0x10659b98
call fcn.1001af32
mov ecx, eax
call fcn.10016363
jmp 0x1003a46d
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x104]
jge 0x1003a452
push fcn.1001b109
mov edx, 0x10007a1c
mov ecx, 0x10659b98
call fcn.1001af32
mov ecx, eax
call fcn.10016363
jmp 0x1003a46d
push fcn.1001b109
mov edx, 0x10007a24
mov ecx, 0x10659b98
call fcn.1001af32
mov ecx, eax
call fcn.10016363
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x1003a48f
push 0x7e3b
push 1
push 0
push 0x4d3b
call fcn.10028100
add esp, 0x10
jmp 0x1003a22b
jmp 0x1003a1aa
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x1003a4b3
push 0
push 0x268c
call fcn.100296b9
pop ecx
pop ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x19c]
add ecx, dword [eax]
mov dword [ebp - 0x1d0], ecx
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x88], 0
jmp 0x1003a4e9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1003a505
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x294], 0xf6af
jmp 0x1003a4dc
mov dword [ebp - 0x6c], 0
jmp 0x1003a515
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1003a52b
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x294], 0xffff
jmp 0x1003a50e
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x1003a53f
push 0
call fcn.1002abcb
pop ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x98], eax
and dword [ebp - 0xb0], 0
jmp 0x1003a574
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x98]
inc eax
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0xb0], eax
jae 0x1003b0a1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 0xa
jmp 0x1003a5a7
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff4
jne 0x1003a6a0
push 2
lea ecx, [ebp - 0x26c]
call fcn.100166bf
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0x254]
call fcn.100166bf
mov byte [ebp - 4], 1
mov dword [ebp - 0x1dc], 0xfffffff9
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x54], 0
jmp 0x1003a5f7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1003a613
push dword [ebp - 0x54]
lea ecx, [ebp - 0x26c]
call fcn.100167c9
mov dword [eax], 0xfffffff9
jmp 0x1003a5f0
push 1
push 0x2eac
push 0x5c26
push 1
lea eax, [ebp - 0x254]
push eax
push 0xb7
push 0x71ee
lea eax, [ebp - 0x54]
push eax
push 0x6848
push 0
call fcn.10038f8c
add esp, 0x28
push 1
lea eax, [ebp - 0x1dc]
push eax
push 0
push 0x58ba
push 1
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x26c]
push eax
push 0x6c16
lea eax, [ebp - 0x34]
push eax
call fcn.1002846e
add esp, 0x28
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.100167a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.100167a4
jmp 0x1003a5a0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x64], 0xdf7cd95d
mov dword [ebp - 0x10], 0x9b2b534
mov dword [ebp - 0x2b0], 0xffffffff
cmp dword [ebp - 0x1c], 0xac46
jle 0x1003a6da
mov dword [ebp - 0x12c], 1
jmp 0x1003a6e1
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x12c], eax
jle 0x1003a6f8
mov dword [ebp - 0xd8], 1
jmp 0x1003a6ff
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1c], eax
jle 0x1003a722
mov dword [ebp - 0xe0], 1
jmp 0x1003a729
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe0], eax
jne 0x1003a740
mov dword [ebp - 0x1fc], 1
jmp 0x1003a747
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2b8], eax
imul eax, dword [ebp - 0x10], 0xfffffff7
add eax, 0x7689351f
cmp eax, dword [ebp - 0x10]
jne 0x1003a76a
mov dword [ebp - 0xe8], 1
jmp 0x1003a771
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe8], eax
jle 0x1003a788
mov dword [ebp - 0xf0], 1
jmp 0x1003a78f
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
je 0x1003a8db
mov dword [ebp - 0xc8], 5
mov dword [ebp - 0x9c], 0
jmp 0x1003a7c5
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1003a7e1
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x1ac], 0x72ee72c3
jmp 0x1003a7b8
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
cmp dword [ebp - 0x1c], eax
jl 0x1003a814
mov dword [ebp - 0xf8], 1
jmp 0x1003a81b
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xffff
ja 0x1003a833
mov dword [ebp - 0x100], 1
jmp 0x1003a83a
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x100], eax
jg 0x1003a851
mov dword [ebp - 0x108], 1
jmp 0x1003a858
and dword [ebp - 0x108], 0
mov dword [ebp - 0x64], 0xfffffff7
mov eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x64], eax
jl 0x1003a879
mov dword [ebp - 0x110], 1
jmp 0x1003a880
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc8], 0
je 0x1003a89e
mov dword [ebp - 0x1e4], 1
jmp 0x1003a8a5
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2d], 0
push 0
lea eax, [ebp - 0x2d]
push eax
push 0x74d8
push 1
call fcn.100283d1
add esp, 0x10
jmp 0x1003a916
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1003a916
push 0x28c5
push 0
push 0x2f7d
push 1
push 0x39c9
push 0x451d
push 0x6700
push 0x4308
push 0x6dc2
call fcn.1002d4ea
add esp, 0x24
lea eax, [ebp - 0x1c0]
push eax
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.100398a7
add esp, 0xc
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x1b4], 9
mov dword [ebp - 0x31c], 0xfffffffd
mov dword [ebp - 0x318], 0xfffffffd
mov dword [ebp - 0x314], 0xfffffffd
mov dword [ebp - 0x310], 0xfffffffd
mov dword [ebp - 0x1b0], 0x6cf6
mov dword [ebp - 0x48], 0xfffffff5
jmp 0x1003a988
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 6
jne 0x1003aa73
mov dword [ebp - 0x1ec], 0xf40f
mov dword [ebp - 0x1bc], 0xcea445a8
push 2
lea ecx, [ebp - 0x248]
call fcn.100166bf
mov dword [ebp - 4], 2
mov dword [ebp - 0x164], 0xf06e85fc
mov dword [ebp - 0x168], 0xf59f89f2
mov dword [ebp - 0x170], 0xfffffffb
mov dword [ebp - 0x90], 0
jmp 0x1003a9f1
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1003aa13
push dword [ebp - 0x90]
lea ecx, [ebp - 0x248]
call fcn.100167c9
mov dword [eax], 9
jmp 0x1003a9e4
push 1
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x49d7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 0
call fcn.1002e427
add esp, 0x34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.100167a4
jmp 0x1003a981
mov dword [ebp - 0x4c], 0
jmp 0x1003aa83
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff3
jge 0x1003adc7
mov dword [ebp - 0x2e0], 2
mov dword [ebp - 0x2fc], 0xfffffffa
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x2cc], 0x3e8ea471
push 1
lea ecx, [ebp - 0x2f0]
call fcn.100166bf
mov dword [ebp - 4], 3
mov dword [ebp - 0x28c], 0x56a96dad
mov dword [ebp - 0x160], 0x22ab
cmp dword [ebp - 0x160], 0x100a
jge 0x1003ad45
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10007728
call fcn.1004edeb
add esp, 0xc
and dword [ebp - 0x180], 0
lea eax, [ebp - 0x180]
push eax
mov eax, dword [ebp - 0x24]
inc eax
push eax
lea ecx, [ebp - 0x228]
call fcn.100167ef
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x188]
push eax
mov eax, dword [ebp - 0x24]
inc eax
push eax
lea ecx, [ebp - 0x278]
call fcn.100167ef
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebp - 0x24]
inc eax
push eax
lea ecx, [ebp - 0x260]
call fcn.100167ef
mov byte [ebp - 4], 6
and dword [ebp - 0xa4], 0
jmp 0x1003ab87
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x24]
jge 0x1003abb2
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x228]
call fcn.100167c9
push eax
push 0x10007724
call fcn.1004edeb
pop ecx
pop ecx
jmp 0x1003ab7a
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x3c], eax
jmp 0x1003abc2
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1003ac19
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x228]
call fcn.100167c9
push dword [eax]
lea ecx, [ebp - 0x260]
call fcn.100167c9
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x278]
call fcn.100167c9
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x228]
call fcn.100167c9
push dword [eax]
lea ecx, [ebp - 0x260]
call fcn.100167c9
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
jmp 0x1003abbb
and dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xd0]
call fcn.100168b8
mov byte [ebp - 4], 7
and dword [ebp - 0x44], 0
jmp 0x1003ac3c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x24]
jge 0x1003acf7
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0xd0]
call fcn.100168eb
test eax, eax
je 0x1003ac84
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0xd0]
call fcn.10041581
jmp 0x1003ac91
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
lea ecx, [ebp - 0xd0]
call fcn.1004157d
cmp eax, dword [ebp - 0x1a8]
jb 0x1003acd1
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0xd0]
call fcn.10016969
mov ecx, eax
call fcn.1001b892
push dword [eax]
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0xd0]
call fcn.1001a241
push dword [ebp - 0x44]
lea ecx, [ebp - 0x278]
call fcn.100167c9
push eax
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0xd0]
call fcn.100168cd
jmp 0x1003ac35
push dword [ebp - 0xc0]
push 0x10007730
call fcn.1004f4dc
pop ecx
pop ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd0]
call fcn.100108c3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x260]
call fcn.1001685b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x278]
call fcn.1001685b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x228]
call fcn.1001685b
lea eax, [ebp - 0x2f0]
push eax
push 0x131a
push 0x473a
push 0x4df1
push 0xda0
push 1
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.1002a1e2
add esp, 0x20
mov dword [ebp - 0x50], 0
jmp 0x1003ad80
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1003ad96
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2a0], 0xa770aacc
jmp 0x1003ad79
push 0x7d15
push 1
lea eax, [ebp - 0x1b0]
push eax
push 0
push 0x3ac9
call fcn.10029475
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f0]
call fcn.100167a4
jmp 0x1003aa7c
mov eax, dword [ebp - 0x98]
movzx eax, word [eax]
and eax, 0xfff
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x20], 0xa4f833fc
mov dword [ebp - 0x2a8], 0x6a3735b2
mov dword [ebp - 0x2a4], 0x2038e85a
mov dword [ebp - 0x2d4], 1
mov dword [ebp - 0x2ac], 0x302aff63
mov dword [ebp - 0x2f4], 0xffffffff
mov dword [ebp - 0x1b8], 8
mov dword [ebp - 0x18], 0
jmp 0x1003ae2e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003ae44
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x120], 0xfffffffc
jmp 0x1003ae27
mov dword [ebp - 0x18], 0
jmp 0x1003ae54
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003ae6a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2b4], 0x4157736
jmp 0x1003ae4d
mov dword [ebp - 0x20], 0
jmp 0x1003ae7a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1003af67
or dword [ebp - 0x23c], 0xffffffff
or dword [ebp - 0x238], 0xffffffff
or dword [ebp - 0x234], 0xffffffff
or dword [ebp - 0x230], 0xffffffff
lea ecx, [ebp - 0xb5]
call fcn.100167d8
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x338]
call fcn.100167db
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x21c]
call fcn.1001677e
mov dword [ebp - 4], 8
push 2
lea ecx, [ebp - 0x21c]
call fcn.100167c9
and dword [eax], 0
jmp 0x1003af12
push 2
lea ecx, [ebp - 0x21c]
call fcn.100167c9
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x21c]
call fcn.100167c9
cmp dword [eax], 0
jg 0x1003af53
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x58], 0
jmp 0x1003af3b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003af51
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x120], 0xf14c
jmp 0x1003af34
jmp 0x1003aeee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100167a4
jmp 0x1003ae73
mov dword [ebp - 0x20], 0
jmp 0x1003af77
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1003b05a
mov dword [ebp - 0x60], 0xfd947597
mov dword [ebp - 0x2dc], 0xf3e76e5b
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x2f8], 1
mov dword [ebp - 0x2c4], 0x74e80031
mov dword [ebp - 0x2e4], 1
mov dword [ebp - 0x30c], 0xffffffff
mov dword [ebp - 0x308], 0xffffffff
mov dword [ebp - 0x304], 0xffffffff
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x1003aff2
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1003b009
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x120], 0
je 0x1003b007
jmp 0x1003b009
jmp 0x1003afeb
push 0x2eca
push 1
push 0x693d
push 0x3d2a
push 0x7d2e
push 0xc85
lea eax, [ebp - 0x1b8]
push eax
push 0x1f5d
push 1
push 0x54d5
push 0
push 0x71e2
push 0x7e5c
push 0x51f6
push 0x4732
call fcn.1003b3fd
add esp, 0x3c
jmp 0x1003af70
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
je 0x1003b073
jmp 0x1003b09c
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
push 0
lea eax, [ebp - 0x1e0]
push eax
push dword [ebp - 0x140]
call fcn.10028f81
add esp, 0xc
jmp 0x1003a559
mov dword [ebp - 0x148], 0x2681
cmp dword [ebp - 0x148], 0x1101
jge 0x1003b24d
mov dword [ebp - 0x280], 0x9d
mov byte [ebp - 0x3d8], 0
push 0x9c
push 0
lea eax, [ebp - 0x3d7]
push eax
call fcn.1004f590
add esp, 0xc
and dword [ebp - 0xac], 0
lea eax, [ebp - 0xac]
push eax
push 0x10007720
call fcn.1004edeb
pop ecx
pop ecx
and dword [ebp - 0x68], 0
and dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x10007918
call fcn.1004edeb
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
jmp 0x1003b128
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
jge 0x1003b13d
mov eax, dword [ebp - 0x74]
mov byte [ebp + eax - 0x3d8], 1
jmp 0x1003b121
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
je 0x1003b204
and dword [ebp - 0xb4], 0
and dword [ebp - 0xbc], 0
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0x10007918
call fcn.1004edeb
add esp, 0xc
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x68]
jge 0x1003b18f
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x128], eax
jmp 0x1003b19b
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xbc]
jge 0x1003b1bd
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x130], eax
jmp 0x1003b1c9
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x78], eax
jmp 0x1003b1e7
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x158]
jge 0x1003b1ff
mov eax, dword [ebp - 0x78]
mov byte [ebp + eax - 0x3d8], 0
jmp 0x1003b1e0
jmp 0x1003b13d
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
jmp 0x1003b21a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x70]
jge 0x1003b23b
mov eax, dword [ebp - 0x7c]
movzx eax, byte [ebp + eax - 0x3d8]
add eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
jmp 0x1003b213
push dword [ebp - 0xc4]
push 0x1000774c
call fcn.1004f4dc
pop ecx
pop ecx
mov dword [ebp - 0x40], 0x9ad59e57
mov dword [ebp - 0x84], 0
jmp 0x1003b26d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1003b289
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x328], 0xfffffffe
jmp 0x1003b260
mov dword [ebp - 0x40], 0
jmp 0x1003b299
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1003b2fc
mov dword [ebp - 0x8c], 0xa290be4
mov dword [ebp - 0x8c], 2
jmp 0x1003b2c2
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1003b2eb
mov byte [ebp - 0x2a], 0
push 0x4e57
push 1
lea eax, [ebp - 0x2a]
push eax
push 0x17d9
push 1
call fcn.10028344
add esp, 0x14
jmp 0x1003b2b5
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x328], 0
je 0x1003b2fa
jmp 0x1003b2fc
jmp 0x1003b292
cmp dword [ebp - 0x40], 0
je 0x1003b338
mov byte [ebp - 0x2c], 0
push 1
push 0x663e
push 1
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x41f7
push 0x5498
push 0x5fec
push 0xc17
push 0x4c05
call fcn.1002846e
add esp, 0x28
jmp 0x1003b355
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1003b355
push 1
push 0x1e62
push 1
call fcn.10028766
add esp, 0xc
push 0x3f3
push 0x5b82
push 1
push 0x3460
push 1
push 0x1475
push 0x3644
lea eax, [ebp - 0x94]
push eax
push 0x37db
push 0x1ada
call fcn.100287c8
add esp, 0x28
jmp 0x1003b3ac
push 0x540
push 0x2003
push 0x16e8
push 0xbd1
push 0x2421
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret