Function at 0x1003db82
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports
Set environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100639dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b8
push ebx
push esi
push edi
push 2
pop esi
mov edi, edx
mov dword [esp + 0x50], ecx
push esi
lea ecx, [esp + 0x138]
mov dword [esp + 0x38], edi
call fcn.1000ad98
xor ebx, ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x2cc], ebx
mov dword [esp + 0x18], 0xffffffff
push esi
call fcn.1000ad98
mov dword [esp + 0x1c], 0xad5b481d
mov dword [esp + 0x10], ebx
jmp 0x1003dbff
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x134]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003dbec
mov dword [esp + 0x10], ebx
jmp 0x1003dc1d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003dc0b
mov esi, dword [esp + 0x134]
mov dword [esi + 4], ebx
mov dword [esp + 0xa8], ebx
xor edx, edx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], 0x522452a2
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov eax, dword [esp + 0xac]
mov eax, dword [esp + 0x8c]
or dword [eax], 0xffffffff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, 1
mov eax, dword [esp + 0xb0]
setle dl
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0xb0]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 8
setge al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xb0]
cmp eax, dword [esi + 4]
je 0x1003dccb
cmp dword [esp + 0x1c], ebx
je 0x1003dccb
xor ecx, ecx
inc ecx
jmp 0x1003dccd
mov ecx, ebx
xor eax, eax
cmp ecx, 1
setne al
cmp eax, dword [esp + 0x18]
jl 0x1003dd53
mov dword [esp + 0x28], 0x60fc5c2f
mov dword [esp + 0x18], ebx
jmp 0x1003dd02
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1003dce9
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x2c], ebx
je 0x1003dd2f
mov eax, dword [esp + 0xb0]
xor ecx, ecx
cmp dword [esi + 4], ebx
mov eax, dword [esp + 0x14]
setg cl
add eax, ecx
je 0x1003dd2f
xor eax, eax
inc eax
jmp 0x1003dd31
mov eax, ebx
cmp eax, dword [esp + 0x28]
jl 0x1003dd45
cmp dword [esp + 0xb0], ebx
je 0x1003dd45
xor ecx, ecx
inc ecx
jmp 0x1003dd47
mov ecx, ebx
mov eax, dword [esp + 0x8c]
mov dword [eax + 4], ecx
jmp 0x1003dd83
mov dword [esp + 0x1c], ebx
jmp 0x1003dd7c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1003dd78
push 0xd9f
push 0x2232
push 0x62d
call dword [sym.imp.USER32.dll_SetWindowLongA]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x3a
je 0x1003dd59
dec dword [esi + 4]
cmp dword [esi + 4], 0xffffffee
jg 0x1003dc2d
push dword [esp + 0x8c]
call fcn.1004a2e7
or dword [esp + 0x2d0], 0xffffffff
pop ecx
push dword [esp + 0x134]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.1004a2e7
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x28], 0x24de
cmp dword [esp + 0x28], 0xcbe
pop ecx
jge 0x1003de42
lea eax, [esp + 0x78]
mov dword [esp + 0x5c], ebx
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x7c], ebx
push eax
push 0x10007770
call fcn.10049deb
add esp, 0xc
mov edi, ebx
cmp dword [esp + 0x5c], ebx
jle 0x1003de3e
xor esi, esi
inc esi
lea eax, [esi + 1]
cmp edi, dword [esp + 0x78]
jge 0x1003de25
push esi
push eax
jmp 0x1003de27
push eax
push esi
push 0x10007904
call fcn.1004a17c
add esp, 0xc
add esi, 2
inc edi
cmp edi, dword [esp + 0x5c]
jl 0x1003de18
mov edi, dword [esp + 0x34]
push 3
lea ecx, [esp + 0x108]
call fcn.1000ad98
mov dword [esp + 0x10], ebx
jmp 0x1003de6c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003de56
push 4
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1003de8f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f0], 0xdada439b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003de7c
mov dword [esp + 0x1f0], 2
cmp dword [esp + 0x1f0], ebx
jl 0x1003def6
mov dword [esp + 0x24], 0x4d9edbda
mov ecx, dword [esp + 0x1f0]
mov eax, dword [esp + 0x104]
cmp dword [eax + ecx*4], ebx
je 0x1003ded9
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x104]
cmp dword [ecx + eax*4], ebx
jne 0x1003defd
jmp 0x1003dee9
mov dword [esp + 0x24], 0x1ded6804
mov dword [esp + 0x24], 0xfaaaeb9a
mov dword [esp + 0x24], ebx
dec dword [esp + 0x1f0]
jns 0x1003dea9
mov ecx, dword [esp + 0x104]
test ecx, ecx
je 0x1003df1d
push ecx
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov eax, dword [0x1686a390]
xor esi, esi
inc esi
test al, 1
jne 0x1003dfc2
or eax, esi
mov dword [0x1686a390], eax
push ebx
mov dword [esp + 0x2d0], esi
push ebx
mov dword [0x1686a350], ebx
mov dword [0x1686a354], ebx
call fcn.1000e32b
mov dword [0x1686a350], eax
mov dword [0x1686a358], ebx
mov dword [0x1686a360], ebx
mov byte [esp + 0x2cc], 3
mov ecx, 0x1686a358
mov dword [esp + 0x1ec], eax
lea eax, [esp + 0x1ec]
push eax
push 0x10
push ebx
lea eax, [esp + 0x250]
mov dword [0x1686a36c], 0x3f800000
push eax
mov dword [0x1686a35c], ebx
call fcn.1000e0cf
push 0x10063dd7
mov dword [0x1686a364], 7
mov dword [0x1686a368], 8
call fcn.1004a152
or dword [esp + 0x2d0], 0xffffffff
pop ecx
mov dword [esp + 0x1c], 0xda1
lea ecx, [esp + 0xc8]
mov dword [esp + 0x30], 0x3b6182ea
mov dword [esp + 0x20], 0x8cccddd
mov dword [esp + 0x10], 5
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x8d9ba5f2
push 3
call fcn.1000ad98
push 4
pop edx
mov dword [esp + 0x2cc], edx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1003e02f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x288], 0x8c9a01c7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003e01c
mov dword [esp + 0x10], ebx
jmp 0x1003e052
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x104353ea
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003e03c
cmp dword [esp + 0x1c], ebx
je 0x1003e199
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0xec]
mov dword [esp + 0x20], 0x2dafbbd0
mov dword [esp + 0x20], 0xc9c3d069
mov dword [esp + 0x20], 0x884cb8f6
mov dword [esp + 0x20], edx
push esi
call fcn.1000ad98
mov dword [esp + 0x1c], ebx
jmp 0x1003e0a9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xec]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003e096
mov dword [esp + 0x1c], 0xffffffe4
cmp dword [esp + 0x1c], 0x21
jg 0x1003e138
push 4
pop edx
mov dword [esp + 0x20], 8
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0x16a205b2
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x997b09b3
mov dword [esp + 0x20], 0x8f62c4df
mov dword [esp + 0x20], 0x831966c4
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x30], ebx
jmp 0x1003e11e
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x2a0], 6
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edx
jl 0x1003e10b
mov eax, dword [esp + 0xc8]
dec dword [eax]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x21
jle 0x1003e0c1
mov dword [esp + 0x10], ebx
jmp 0x1003e164
mov dword [esp + 0x30], ebx
jmp 0x1003e15a
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0xb137d37
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x1003e144
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x15
jge 0x1003e13e
cmp dword [esp + 0xec], 0
je 0x1003e1ac
push dword [esp + 0xec]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
jmp 0x1003e1ac
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003e1ac
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
or dword [esp + 0x2cc], 0xffffffff
cmp dword [esp + 0xc8], 0
je 0x1003e1e0
push dword [esp + 0xc8]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
imul eax, dword [esp + 0x50], 0x2710
lea ecx, [esp + 0x158]
push 0xfffffffffffffff8
add eax, edi
mov dword [esp + 0x80], eax
mov dword [esp + 0x14], 0xa296
pop edi
mov dword [esp + 0x18], 0xe7ed6f18
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], 0xffff
push 4
call fcn.1000ad98
mov dword [esp + 0x20], 0x69097d9
mov dword [esp + 0x1c], ebx
jmp 0x1003e23e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1003e22c
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, edx
setge cl
sub ecx, edi
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x10]
jne 0x1003e27c
mov eax, ebx
cmp dword [esp + 0x10], ebx
je 0x1003e27e
mov eax, esi
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1003e32c
mov dword [esp + 0x1c], 0xb6fe6d39
xor ecx, ecx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xd17c
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, 0xb2f6
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
add eax, 0x12c0
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0xeb59
setg cl
mov dword [esp + 0x2c], ecx
jmp 0x1003e352
mov dword [esp + 0x18], 0xfffffff2
jmp 0x1003e34b
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003e347
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x11
jg 0x1003e336
mov dword [esp + 0x18], ebx
jmp 0x1003e364
mov dword [esp + 0x2c], esi
dec dword [esp + 0x2c]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1003e358
cmp dword [esp + 0x158], 0
je 0x1003e397
push dword [esp + 0x158]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
lea eax, [esp + 0x7c]
push eax
call fcn.1004015b
mov edi, dword [eax]
mov dword [esp + 0x20], edi
test edi, edi
je 0x1003e794
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0xacc4
mov dword [esp + 0x24], 0x8b15e31
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x24], 0x8ab9c279
push 4
call fcn.1000ad98
mov dword [esp + 0x2cc], 5
mov dword [esp + 0x18], ebx
jmp 0x1003e40d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x128], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1003e3fe
mov dword [esp + 0x18], ebx
jmp 0x1003e42d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x21c], 0x8787d636
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1003e41a
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 4
jge 0x1003e45e
push 9
pop esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1cc]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1003e442
xor esi, esi
inc esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 8
cmp dword [esp + 0x1c], 0x1c
jg 0x1003e766
mov dword [esp + 0x14], 0xfffffff9
lea ecx, [esp + 0xe0]
push 2
call fcn.1000ad98
mov dword [esp + 0x24], 0x225e
cmp dword [esp + 0x24], 0x713
jge 0x1003e50f
lea eax, [esp + 0x80]
push eax
push 0x10007754
call fcn.10049deb
xorps xmm2, xmm2
mov eax, esi
pop ecx
pop ecx
cmp dword [esp + 0x80], esi
jl 0x1003e4fb
movsd xmm1, qword [0x10007f00]
movd xmm0, eax
inc eax
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm2, xmm1
cmp eax, dword [esp + 0x80]
jle 0x1003e4d9
push ecx
push ecx
movsd qword [esp], xmm2
push 0x10007ba0
call fcn.1004a17c
add esp, 0xc
mov dword [esp + 0x24], 0x1d979388
mov dword [esp + 0x10], ebx
jmp 0x1003e52d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], 0xdfa90ef8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003e51d
mov dword [esp + 0x10], ebx
jmp 0x1003e54f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0x25ad92ed
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003e539
mov dword [esp + 0x10], ebx
jmp 0x1003e71c
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1003e628
mov dword [esp + 0x28], ebx
jmp 0x1003e58e
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x98], ebx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x1003e57f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
jne 0x1003e789
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x128]
mov eax, dword [esp + 0x220]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x128]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1cc]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x130]
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x98]
dec dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x128]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x128]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + eax*4 + 0x128], ecx
dec dword [esp + 0x18]
jns 0x1003e579
mov dword [esp + 0x30], 0xa
cmp dword [esp + 0x30], 2
jne 0x1003e718
mov esi, dword [esp + 0x1cc]
mov edi, dword [esp + 0xe0]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0xad14ca72
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp dword [esi + 0xc], ebx
setne al
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setge dl
xor ecx, ecx
cmp edx, 0x2de47e5f
setg cl
add eax, ecx
mov ecx, dword [esp + 0x21c]
imul ecx, eax
neg ecx
je 0x1003e69d
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], 0xe410f713
mov eax, dword [esp + 0x28]
neg eax
je 0x1003e6b5
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov ecx, 0x8456a9e5
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
dec ecx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 2
je 0x1003e649
xor esi, esi
inc esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1003e55f
cmp dword [esp + 0xe0], 0
je 0x1003e753
push dword [esp + 0xe0]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1c
jle 0x1003e48f
mov edi, dword [esp + 0x20]
cmp dword [esp + 0x1cc], 0
je 0x1003e77d
push dword [esp + 0x1cc]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x18c], edi
jmp 0x1003fd58
push 0x252
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x14], ebx
jmp 0x1003e7a9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x240], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003e79a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003e7c5
push 0x1a17
call dword [sym.imp.USER32.dll_GetSysColor]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003e7d7
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x1686a390]
test al, 2
jne 0x1003e87e
or eax, 2
mov dword [0x1686a390], eax
push ebx
mov dword [esp + 0x2d0], 6
push ebx
mov dword [0x1686a370], ebx
mov dword [0x1686a374], ebx
call fcn.1000e32b
mov dword [0x1686a370], eax
mov dword [0x1686a378], ebx
mov dword [0x1686a380], ebx
mov byte [esp + 0x2cc], 8
mov ecx, 0x1686a378
mov dword [esp + 0x1dc], eax
lea eax, [esp + 0x1dc]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1e4]
mov dword [0x1686a38c], 0x3f800000
push eax
mov dword [0x1686a37c], ebx
call fcn.1000e0cf
push 0x10063dd2
mov dword [0x1686a384], 7
mov dword [0x1686a388], 8
call fcn.1004a152
or dword [esp + 0x2d0], 0xffffffff
pop ecx
push 9
xorps xmm0, xmm0
movdqu xmmword [esp + 0x174], xmm0
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], ebx
jmp 0x1003e8e6
mov dword [esp + 0x28], 1
mov dword [esp + 0x28], 1
jmp 0x1003e8db
mov dword [esp + 0x14], 0x9fb023ed
mov dword [esp + 0x14], 0xffffffe3
jmp 0x1003e8d0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003e8cc
call dword [sym.imp.USER32.dll_ReleaseCapture]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
je 0x1003e8bb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x13
jle 0x1003e8a9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
je 0x1003e897
lea eax, [esp + 0x50]
push eax
call fcn.100401bd
push 1
lea ecx, [esp + 0x19c]
mov edi, dword [eax]
mov dword [esp + 0x34], edi
call fcn.1000ad98
push 2
lea ecx, [esp + 0x184]
mov dword [esp + 0x2d0], esi
call fcn.1000ad98
mov dword [esp + 0x20], 0x4e1c2e93
mov dword [esp + 0x20], 0x78ee3f2f
mov dword [esp + 0x10], ebx
jmp 0x1003e94c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x2667
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1003e936
mov dword [esp + 0x10], ebx
jmp 0x1003e96f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xea21
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003e959
mov esi, dword [esp + 0x198]
xor eax, eax
mov edx, dword [esp + 0x180]
push edx
cmp dword [esi], eax
setne al
xor ecx, ecx
cmp eax, dword [edx]
setge cl
xor eax, eax
cmp ecx, 0x33c017f2
setg al
xor ecx, ecx
add eax, dword [esi]
cmp eax, dword [esi]
setne cl
xor eax, eax
cmp dword [esi], ecx
setge al
mov dword [esp + 0x24], eax
call fcn.1004a2e7
or dword [esp + 0x2d0], 0xffffffff
pop ecx
push esi
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
call fcn.1004a2e7
mov al, byte [ebp + 0xc]
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
pop ecx
test al, al
jne 0x1003ea00
test edi, edi
jne 0x1003ee94
lea ecx, [esp + 0x2b0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x54]
call fcn.1003336b
mov esi, eax
lea edi, [esp + 0x174]
pop ecx
push 4
lea ecx, [esp + 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push edi
call fcn.1000ad98
mov dword [esp + 0x2c], 0x98ceef9a
mov dword [esp + 0x10], ebx
jmp 0x1003ea4f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], 0xe48d327c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003ea3c
push 2
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1003ea6e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0x52061f6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003ea5e
mov dword [esp + 0x20], 0x1cb4
cmp dword [esp + 0x20], 0x8ef
jge 0x1003ead9
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x1a8]
push eax
push 0x100077bc
call fcn.10049deb
mov eax, dword [esp + 0x1b0]
add esp, 0xc
cmp dword [esp + 0x88], eax
cmovl eax, dword [esp + 0x88]
and eax, 0x80000001
jns 0x1003eac5
dec eax
or eax, 0xfffffffe
inc eax
je 0x1003eace
push 0x10007ba8
jmp 0x1003ead3
push 0x10007bb0
call fcn.1004a3e5
pop ecx
mov dword [esp + 0x48], 3
cmp dword [esp + 0x48], ebx
jl 0x1003eb7c
mov dword [esp + 0x14], 0x76ab2aee
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x14]
sub edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x6c]
setne cl
add ecx, dword [eax + esi*4]
je 0x1003eb23
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x6c]
cmp dword [ecx + eax*4], 1
mov ecx, dword [ecx + esi*4]
mov eax, dword [esp + 0x14]
sete dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x6c]
setle dl
mov dword [eax + ecx*4], edx
mov dword [esp + 0x2c], edx
dec dword [esp + 0x48]
jns 0x1003eaeb
push 2
pop esi
mov ecx, dword [esp + 0x48]
xor edx, edx
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setne dl
cmp dword [esp + 0x6c], 0
mov dword [esp + 0x2c], edx
je 0x1003ebac
push dword [esp + 0x6c]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
cmp byte [ebp + 0xc], 0
je 0x1003ee90
cmp dword [esp + 0x178], 0
je 0x1003ee90
mov eax, dword [esp + 0x17c]
lea ecx, [esp + 0x11c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0x3cf95751
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 0xbd3aeb59
mov dword [esp + 0x10], 0xf1fdbd01
mov dword [esp + 0x20], 0x93c1
mov dword [esp + 0x18], 0x43b8a277
push 1
mov dword [esp + 0x194], eax
call fcn.1000ad98
push 3
lea ecx, [esp + 0x150]
mov dword [esp + 0x2d0], 0xa
call fcn.1000ad98
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
jmp 0x1003ec49
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x109d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1003ec33
mov dword [esp + 0x10], ebx
jmp 0x1003ec69
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003ec56
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 6
setne cl
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], 0xd6f1
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor eax, eax
add ecx, dword [esp + 0x14]
cmp ecx, 0xfe
setne al
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x1003ecc5
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1003ecfe
mov dword [esp + 0x20], 0xfffffff8
cmp dword [esp + 0x20], ebx
jne 0x1003ecf6
cmp dword [esp + 0x18], ebx
jne 0x1003ecf6
mov eax, ebx
jmp 0x1003edd9
xor eax, eax
inc eax
jmp 0x1003edd9
mov eax, 0x6243a5d8
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov dword [esp + 0x218], eax
mov dword [esp + 0x2c], 0xe7587697
mov dword [esp + 0x20], 0x4f89c894
mov dword [esp + 0x2c], 0x5f8a4198
mov dword [esp + 0x10], ebx
jmp 0x1003ed50
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1e4], 0xb969b42c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003ed3d
push 3
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1003ed72
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x264], 0xe1a8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003ed5f
mov eax, dword [esp + 0x26c]
mov eax, dword [esp + 0x214]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x214]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1e4]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1e4]
sub eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x1e8], ebx
je 0x1003eddf
mov dword [esp + 0x20], 0xcceb8a06
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
jmp 0x1003ee1e
mov dword [esp + 0x18], 0x1d
jmp 0x1003ee17
mov dword [esp + 0x14], ebx
jmp 0x1003ee02
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x258], 0x779e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1003edef
mov eax, dword [esp + 0x260]
mov dword [esp + 0x1c], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe4
je 0x1003ede9
dec dword [esp + 0x24]
cmp dword [esp + 0x14c], 0
je 0x1003ee4e
push dword [esp + 0x14c]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
or dword [esp + 0x2cc], 0xffffffff
cmp dword [esp + 0x11c], 0
je 0x1003ee82
push dword [esp + 0x11c]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov eax, dword [esp + 0x178]
mov dword [esp + 0x194], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x14], 0xfd3df75d
lea ecx, [esp + 0xf8]
push 3
call fcn.1000ad98
mov dword [esp + 0x20], 0xad67a4be
mov dword [esp + 0x14], ebx
jmp 0x1003eece
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003eeb8
mov dword [esp + 0x14], 0xffffffe4
cmp dword [esp + 0x14], 0xffffffe6
jg 0x1003ef1c
mov ecx, dword [esp + 0xf8]
mov dword [esp + 0x24], 0x1d83
cmp dword [esp + 0x24], ebx
je 0x1003ef08
cmp dword [esp + 0x24], 0x4781
jg 0x1003ef08
xor eax, eax
inc eax
jmp 0x1003ef0a
mov eax, ebx
mov dword [ecx + 4], eax
mov dword [esp + 0x20], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe6
jle 0x1003eeeb
cmp dword [esp + 0xf8], 0
je 0x1003ef48
push dword [esp + 0xf8]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
test edi, edi
jne 0x1003f8b4
cmp dword [esp + 0x170], edi
jle 0x1003f8b4
push dword [esp + 0x1d8]
movdqa xmm0, xmmword [0x10007f60]
lea eax, [esp + 0x25c]
push eax
lea eax, [esp + 0x250]
mov dword [esp + 0x1c], 0xffffffff
push eax
push ebx
lea ecx, [esp + 0xac]
mov dword [esp + 0xac], ebx
movdqu xmmword [esp + 0x258], xmm0
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
call fcn.1000ef4c
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x9c]
mov dword [eax], ecx
mov eax, 0xf5872d9e
cmp eax, ecx
mov eax, dword [esp + 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x5fe4
setle al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, 0x7ccc
setg dl
xor ecx, ecx
add edx, 0x59310c14
cmp eax, edx
setl cl
mov dword [esp + 0x20], ecx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f032
push ebx
push 0xd11
push 0x190f
push 0x1269
call dword [sym.imp.KERNEL32.dll_RaiseException]
push dword [esp + 0x9c]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x9c], ebx
lea ecx, [esp + 0x164]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x18], 0x8da8e97e
push 3
call fcn.1000ad98
mov dword [esp + 0x2c], 0xe491ba6b
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebx
jmp 0x1003f09a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0xbefa1e1c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003f084
push 2
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1003f0bd
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b8], 0x46b4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003f0aa
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0x14cd4959
setne cl
xor edx, edx
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, 0x8e17
setl dl
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
add edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0x164]
setg cl
xor edx, edx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x1bc]
imul ecx, ecx, 0xa9b
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x1bc]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0x20], 0x2601c8d5
mov dword [esp + 0x14], ebx
jmp 0x1003f16f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a8], 0x53d97512
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1003f15c
mov eax, dword [esp + 0x20]
push dword [esp + 0x164]
mov dword [esp + 0x1ac], eax
call fcn.1004a2e7
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x28], 0x49c9fb37
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x1003f1d1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x54], 0x3df603fa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003f1c1
push 3
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1003f1f3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x27c], 0x342bb1e5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003f1e0
cmp dword [esp + 0x58], ebx
je 0x1003f225
cmp dword [esp + 0x28], ebx
jne 0x1003f209
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x58], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x24], 0xa9961215
mov dword [esp + 0x230], ebx
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x23c], ebx
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x14], ebx
jmp 0x1003f272
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x224], 0xce6f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1003f25f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f28f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x224]
mov ecx, 0xffff5121
mov eax, dword [esp + 0x58]
sub ecx, eax
mov eax, dword [esp + 0x54]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x284]
neg esi
sbb esi, esi
neg esi
sub esi, eax
mov eax, dword [esp + 0x224]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, 0x76a4
setge cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x58]
cmp esi, eax
setl dl
xor ecx, ecx
mov dword [esp + 0x23c], edx
mov eax, dword [esp + 0x58]
cmp edx, eax
mov edx, dword [esp + 0x24]
setge cl
imul edx, ecx
sub edx, dword [esp + 0x28]
mov eax, dword [esp + 0x22c]
neg edx
sbb edx, edx
neg edx
imul eax, edx
mov dword [esp + 0x20], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f355
push ebx
push 0x1154
push 0x1284
push 0x1b25
push 0x26b
push 0x9f3
push 0x900
push 0x2563
push 0x153f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 3
lea ecx, [esp + 0x144]
call fcn.1000ad98
mov dword [esp + 0x2cc], 0xb
mov dword [esp + 0x20], 0x17cb
cmp dword [esp + 0x20], 0xf80
jge 0x1003f541
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x40]
push eax
push 0x10007894
call fcn.10049deb
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x120]
add esp, 0x10
inc eax
push eax
call fcn.1000ad98
mov byte [esp + 0x2cc], 0xc
lea ecx, [esp + 0x1ac]
mov eax, dword [esp + 0x38]
inc eax
push eax
call fcn.1000ad98
xor edi, edi
mov byte [esp + 0x2cc], 0xd
mov ecx, dword [esp + 0x38]
inc edi
cmp ecx, edi
jl 0x1003f408
mov esi, dword [esp + 0x110]
add esi, 4
push esi
push 0x10007754
call fcn.10049deb
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
inc edi
add esi, 4
cmp edi, ecx
jle 0x1003f3ef
mov esi, dword [esp + 0x1ac]
xor edi, edi
inc edi
cmp ecx, edi
jl 0x1003f432
add esi, 4
push esi
push 0x10007754
call fcn.10049deb
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
inc edi
add esi, 4
cmp edi, ecx
jle 0x1003f419
cmp dword [esp + 0x84], 1
mov esi, dword [esp + 0x110]
mov edi, dword [esp + 0x1ac]
mov byte [esp + 0xf], 1
mov dword [esp + 0x24], 1
jle 0x1003f48b
mov eax, edi
lea edx, [esi + 4]
sub eax, esi
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
mov eax, dword [edx]
push 0
cmp eax, dword [ebx + edx]
pop ebx
jne 0x1003f487
mov eax, dword [esp + 0x24]
add edx, 4
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x84]
jl 0x1003f462
jmp 0x1003f48b
mov byte [esp + 0xf], bl
mov edx, dword [esp + 0x1e0]
inc edx
cmp edx, ecx
jg 0x1003f4c3
mov ebx, edi
lea esi, [esi + edx*4]
sub ebx, dword [esp + 0x110]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x20]
mov eax, dword [esi]
push 0
cmp eax, dword [esi + ebx]
pop ebx
jne 0x1003f4bf
inc edx
add esi, 4
cmp edx, ecx
jle 0x1003f4a7
jmp 0x1003f4c3
mov byte [esp + 0xf], bl
push dword [esp + 0x114]
mov esi, dword [esp + 0x114]
push esi
call fcn.1002c737
push dword [esp + 0x1b8]
push edi
call fcn.1002c737
xor edx, edx
add esp, 0x10
inc edx
cmp dword [esp + 0x38], edx
jl 0x1003f50c
lea ecx, [esi + 4]
sub edi, esi
mov eax, dword [ecx]
cmp eax, dword [ecx + edi]
jne 0x1003f508
inc edx
add ecx, 4
cmp edx, dword [esp + 0x38]
jle 0x1003f4f5
jmp 0x1003f50c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
mov ecx, 0x10007bc0
mov eax, 0x10007bb8
cmove eax, ecx
push eax
call fcn.1004a3e5
pop ecx
lea ecx, [esp + 0x1ac]
call fcn.1000ba11
lea ecx, [esp + 0x110]
call fcn.1000ba11
mov edi, dword [esp + 0x30]
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1003f55d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x270], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003f54a
mov dword [esp + 0x10], ebx
jmp 0x1003f57f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003f569
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f59d
push ebx
push 0x1297
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov ecx, dword [esp + 0x140]
push 2
pop esi
mov dword [ecx + 8], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1003f5c5
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x270], ebx
jne 0x1003f5cb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1003f5b4
inc dword [ecx + 8]
cmp dword [ecx + 8], esi
jle 0x1003f5aa
or dword [esp + 0x2cc], 0xffffffff
push dword [esp + 0x140]
call fcn.1004a2e7
pop ecx
push esi
lea ecx, [esp + 0xc0]
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
call fcn.1000ad98
mov dword [esp + 0x2cc], 0xe
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1003f639
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003f623
mov dword [esp + 0x1c], ebx
jmp 0x1003f6ba
push 1
lea ecx, [esp + 0x1c4]
call fcn.1000ad98
mov dword [esp + 0x14], ebx
jmp 0x1003f66f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0x4215e1ab
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1003f659
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xbc]
mov ecx, dword [eax + ecx*4]
sub ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x1c0]
neg ecx
push eax
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
call fcn.1004a2e7
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
inc dword [esp + 0x20]
pop ecx
cmp dword [esp + 0x1c], 1
jle 0x1003f645
or dword [esp + 0x2cc], 0xffffffff
cmp dword [esp + 0xbc], 0
je 0x1003f6f5
push dword [esp + 0xbc]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
cmp dword [esp + 0x174], 0
je 0x1003f8b4
mov dword [esp + 0x20], 0xffffffff
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f71e
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003f766
push 4
pop esi
push esi
lea ecx, [esp + 0x64]
call fcn.1000ad98
mov dword [esp + 0x2c], 0x98ceef9a
mov dword [esp + 0x10], ebx
jmp 0x1003f8e2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], 0xe48d327c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003f8cf
mov dword [esp + 0x10], ebx
jmp 0x1003f8fe
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x3c], 0x52061f6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003f8ee
mov dword [esp + 0x40], 3
cmp dword [esp + 0x40], ebx
jl 0x1003f9a8
mov dword [esp + 0x14], 0x76ab2aee
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x14]
sub edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x60]
setne cl
add ecx, dword [eax + esi*4]
je 0x1003f94f
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x60]
cmp dword [ecx + eax*4], 1
mov ecx, dword [ecx + esi*4]
mov eax, dword [esp + 0x14]
sete dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x60]
setle dl
mov dword [eax + ecx*4], edx
mov dword [esp + 0x2c], edx
dec dword [esp + 0x40]
jns 0x1003f917
push 4
pop esi
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x40]
cmp ecx, eax
setne dl
cmp dword [esp + 0x60], 0
mov dword [esp + 0x2c], edx
je 0x1003f9d8
push dword [esp + 0x60]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
lea ecx, [esp + 0x170]
call fcn.1003a8b7
mov dword [esp + 0x28], 0x2a43d953
lea ecx, [esp + 0xd4]
mov dword [esp + 0x1c], 0x746e33a7
push esi
call fcn.1000ad98
mov dword [esp + 0x24], 0x570e81de
mov dword [esp + 0x20], 0xd1d8475
mov dword [esp + 0x14], ebx
jmp 0x1003fa2d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0x55248722
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003fa17
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003fa54
push 0xff4
push 0x8bd
push ebx
push 0x189
call dword [sym.imp.USER32.dll_DrawEdge]
xor ecx, ecx
cmp dword [esp + 0x28], ebx
jne 0x1003facd
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
test eax, eax
mov eax, dword [esp + 0xd4]
sets cl
mov dword [eax + 8], ecx
test ecx, ecx
je 0x1003fa8e
cmp dword [esp + 0x1c], ebx
je 0x1003fa8e
xor ecx, ecx
inc ecx
jmp 0x1003fa90
mov ecx, ebx
xor eax, eax
cmp ecx, 0xffff
sete al
cmp eax, 0xfff6
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setne dl
add edx, dword [esp + 0x1c]
jne 0x1003fabe
cmp dword [esp + 0x28], ebx
jne 0x1003fabe
mov eax, ebx
jmp 0x1003fac1
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov ecx, ebx
mov eax, dword [esp + 0x24]
jmp 0x1003face
inc ecx
xor eax, eax
cmp ecx, 0xfffffffd
setle al
cmp dword [esp + 0xd4], 0
mov dword [esp + 0x20], eax
je 0x1003fb06
push dword [esp + 0xd4]
call fcn.1004a2e7
pop ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
test edi, edi
je 0x1003fbc3
mov dword [esp + 0x20], 0xffffffff
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003fb29
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003fb71
push 0xad5
push 0x59d
push 0x6da
push 0x1665
push 0x19e9
push 0x8b
push 0x14a3
push 0x6bc
push 0x1ef3
push 0x12dc
push 0x189e
call dword [sym.imp.GDI32.dll_StretchBlt]
mov edx, dword [esp + 0x34]
mov ecx, edi
call fcn.1003db78
mov dword [esp + 0x1c], 0x6847
mov esi, eax
inc dword [esp + 0x1c]
mov dword [esp + 0x18c], esi
mov dword [esp + 0x1c], ebx
jmp 0x1003fbb0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003fbac
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xd
jge 0x1003fb97
lea eax, [esp + 0x7c]
push eax
call fcn.1004015b
mov dword [eax], esi
push 0xfffffffffffffffc
pop edi
mov dword [esp + 0x10], 0x3ae35568
lea ecx, [esp + 0x200]
mov dword [esp + 0x24], edi
push 2
call fcn.1000ad98
mov dword [esp + 0x14], ebx
jmp 0x1003fbf8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x200]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003fbe6
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xfffffffe
jl 0x1003fd41
mov esi, dword [esp + 0x200]
mov dword [esp + 0x18], 0xa473eb90
mov dword [esp + 0x34], 0xfffffffa
mov dword [esp + 0x18], 0xb
jmp 0x1003fc6c
mov dword [esp + 0x24], 6
inc dword [esp + 0x24]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003fc68
push ebx
push 0xc80
push ebx
push ebx
push 0x733
push 0xbf7
push 0x6a9
push 0x265e
call dword [sym.imp.GDI32.dll_ExtTextOutA]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff6
jne 0x1003fc2f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x10], 0x48865c89
test eax, eax
je 0x1003fced
mov dword [esp + 0x24], 0x18f8f6a1
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x10], edi
je 0x1003fcb9
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp dword [esi + 4], ebx
sete cl
xor eax, eax
test ecx, ecx
setg al
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp eax, ecx
setle dl
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x34]
jmp 0x1003fd32
push 4
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1003fd09
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x290], 0x3314648a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1003fcf6
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
cmp ecx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [esp + 0x294]
mov eax, dword [esp + 0x34]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov dword [esi + 4], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffe
jge 0x1003fc15
cmp dword [esp + 0x200], 0
je 0x1003fd58
push dword [esp + 0x200]
call fcn.1004a2e7
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x18c]
mov ecx, dword [esp + 0x2c4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret