Function at 0x1003c7d4
Capabilities:
Accept command line arguments
Connect pipe
Delete file
Query environment variable

Disassembly:
mov eax, 0x100711c3
call fcn.1006ff58
sub esp, 0x7f4
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
lea eax, [ebp - 0x580]
lea ecx, [ebp - 0x590]
mov byte [ebp - 0x59], dl
push ecx
push eax
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x534]
movdqu xmmword [ebp - 0x590], xmm0
call fcn.10030222
mov eax, dword [ebp - 0x534]
xor esi, esi
push 0xa
pop ecx
inc esi
mov edi, 0xaf769bf4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 5
mov dword [eax], ecx
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], edi
call fcn.1003034d
mov dword [ebp - 0x34], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x10], 0xb95c1f4a
mov dword [ebp - 0x10], ebx
jmp 0x1003c877
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1cc], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003c86a
cmp dword [ebp - 0x14], ebx
je 0x1003c8b3
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
add eax, 0x4c714e92
jne 0x1003c896
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, 0x5b04
je 0x1003c8a7
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x1003c8a9
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jne 0x1003c8b7
cmp dword [ebp - 0x14], ebx
jne 0x1003c8b7
mov ecx, ebx
jmp 0x1003c8b9
mov ecx, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
shl ecx, 3
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x14]
jge 0x1003c8d2
mov edx, esi
cmp dword [ebp - 0x14], ebx
jne 0x1003c8d4
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x38d679bd
setg al
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setle cl
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, 0x3e7a3298
setne al
add eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
lea eax, [ebp - 0x610]
mov dword [ebp - 0x1cc], ecx
lea ecx, [ebp - 0x620]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x490]
movdqu xmmword [ebp - 0x620], xmm0
call fcn.10030222
push 5
pop eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x490]
push 0xa
pop ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x490]
mov dword [ebp - 0x44], edi
call fcn.1003034d
mov esi, dword [sym.imp.USER32.dll_RegisterClassA]
mov edi, dword [sym.imp.USER32.dll_WaitMessage]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x38], 0xffffffe9
cmp dword [ebp - 0x38], 0xfffffffe
push 3
pop ecx
jge 0x1003cbba
jmp 0x1003c9dd
push 3
pop ecx
mov dword [ebp - 0x28], 0xa7c20398
mov dword [ebp - 0x34], 0xe7eb6652
mov dword [ebp - 0x3c], 0xb09c821f
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1003ca0f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x268], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003c9fe
mov dword [ebp - 0x18], ebx
jmp 0x1003ca2a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x674], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003ca19
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1003ca3e
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x28], ebx
jmp 0x1003cba3
mov dword [ebp - 0x18], 0x367f5ed9
mov dword [ebp - 0x34], 0x402be2ff
mov dword [ebp - 0x3c], 0xc04840c2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1003ca66
push ebx
call esi
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1003cba0
push 3
mov dword [ebp - 0x4c], 6
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], ebx
jl 0x1003cadb
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ebx
jl 0x1003cac6
mov dword [ebp - 0x10], 0xd0714ad
mov dword [ebp - 0x10], ebx
jmp 0x1003cabb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1003cab8
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003caae
dec dword [ebp - 0x34]
jns 0x1003caa2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1003cad6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec dword [ebp - 0x4c]
jns 0x1003ca8f
mov eax, dword [ebp - 0x28]
add eax, 0x6141060d
cmp eax, dword [ebp - 0x18]
jne 0x1003caf8
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x268], ebx
jne 0x1003caf8
mov ecx, ebx
jmp 0x1003cafb
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x260]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x38]
cmp eax, 7
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x18]
jle 0x1003cb3c
cmp dword [ebp - 0x34], ebx
je 0x1003cb3c
xor edx, edx
inc edx
jmp 0x1003cb3e
mov edx, ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x268]
mov eax, dword [ebp - 0x18]
imul eax, edx
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x268]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x18]
jns 0x1003ca76
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe9
je 0x1003ca46
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffe
jl 0x1003c9da
mov dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x44], 0x13dce9d
mov dword [ebp - 0x44], 0x4b25
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x951ea66e
mov dword [ebp - 0x44], 0x2456160c
push 2
call fcn.100301c4
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x1003cc0c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x494], 0xbd2ab60e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003cbfb
mov dword [ebp - 0x18], ebx
jmp 0x1003cc29
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x378]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003cc16
mov eax, dword [ebp - 0x378]
lea ecx, [ebp - 0x378]
dec dword [eax + 4]
call fcn.1003034d
lea ecx, [ebp - 0x5b0]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x5a0]
push eax
push ecx
lea ecx, [ebp - 0x564]
movdqu xmmword [ebp - 0x5b0], xmm0
call fcn.10030222
mov dword [ebp - 0x44], 1
push 3
mov dword [ebp - 0x34], 0xb7c7ce53
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1003cc8b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003cc7e
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ebx
jl 0x1003ccb7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003ccb2
push ebx
push 0x12e6
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
dec dword [ebp - 0x34]
jns 0x1003cc9c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003cccc
push 0x2057
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 5
pop eax
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov dword [ebp - 0x34], 0xffffffff
inc ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x10], 0xb95c1f4a
mov dword [ebp - 0x10], ebx
jmp 0x1003cd06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x284], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003ccf9
cmp dword [ebp - 0x14], ebx
je 0x1003cd42
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
add eax, 0x4c714e92
jne 0x1003cd25
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, 0x5b04
je 0x1003cd36
mov eax, ecx
cmp dword [ebp - 0x14], ebx
jne 0x1003cd38
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jne 0x1003cd44
cmp dword [ebp - 0x14], ebx
jne 0x1003cd44
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
shl ecx, 3
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x14]
jge 0x1003cd60
cmp dword [ebp - 0x14], ebx
je 0x1003cd60
xor edx, edx
inc edx
jmp 0x1003cd62
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 3
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
cmp ecx, 0x38d679bd
setg al
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, 1
setle cl
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, 0x3e7a3298
setne al
add eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0xaf769bf4
mov dword [ebp - 0x3c], 0x6deec541
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x10], 0
pop ecx
jmp 0x1003ce28
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17c], 0x6c74aa0d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003ce17
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x17c], eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setg cl
sub ecx, 0x56915a13
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x17c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0xddd9cd4
setne cl
xor eax, eax
cmp ecx, edx
setne al
xor edx, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x34]
imul ecx, eax
mov eax, dword [ebp - 0x17c]
cmp ecx, eax
setne dl
mov dword [ebp - 0x17c], edx
test edx, edx
je 0x1003cec9
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x1003cee3
push 0x112d
push 0x2319
push 0x143
push 0x1218
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
jmp 0x1003cee3
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x1003cee3
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 0x564]
or dword [ebp - 4], 0xffffffff
push 0xa
pop ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x564]
call fcn.1003034d
mov dword [ebp - 0x38], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], 0xffffffe9
jmp 0x1003d0f6
mov dword [ebp - 0x28], 0xa7c20398
mov dword [ebp - 0x34], 0xe7eb6652
mov dword [ebp - 0x3c], 0xb09c821f
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], ecx
jmp 0x1003cf47
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x280], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003cf36
mov dword [ebp - 0x18], ecx
jmp 0x1003cf62
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x62c], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003cf51
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003cf79
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
mov dword [ebp - 0x28], ecx
jmp 0x1003d0e9
mov dword [ebp - 0x18], 0x367f5ed9
mov dword [ebp - 0x34], 0x402be2ff
mov dword [ebp - 0x3c], 0xc04840c2
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003cfa4
push ecx
call esi
xor ecx, ecx
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ecx
jl 0x1003d0e6
push 3
mov dword [ebp - 0x4c], 6
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], ecx
jl 0x1003d01f
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ecx
jl 0x1003d007
mov dword [ebp - 0x10], 0xd0714ad
mov dword [ebp - 0x10], ecx
jmp 0x1003cffc
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003cff9
call edi
xor ecx, ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003cfec
dec dword [ebp - 0x34]
jns 0x1003cfe0
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003d01a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
dec dword [ebp - 0x4c]
jns 0x1003cfcd
mov eax, dword [ebp - 0x28]
add eax, 0x6141060d
cmp eax, dword [ebp - 0x18]
jne 0x1003d038
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x280], ecx
je 0x1003d03b
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x278]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
cmp eax, 7
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x18]
jle 0x1003d07f
cmp dword [ebp - 0x34], 0
je 0x1003d07f
xor edx, edx
inc edx
jmp 0x1003d081
xor edx, edx
mov eax, dword [ebp - 0x18]
push 0
mov ecx, dword [ebp + eax*4 - 0x280]
mov eax, dword [ebp - 0x18]
imul eax, edx
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x280]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x18]
pop ecx
mov eax, dword [ebp + eax*4 - 0x280]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x18]
jns 0x1003cfb4
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe9
je 0x1003cf81
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffe
push 3
pop edx
jl 0x1003cf15
mov dword [ebp - 0x20], 0x5c68ec0a
mov dword [ebp - 0x34], 0xafe44fa3
mov dword [ebp - 0x10], ecx
jmp 0x1003d127
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x718], 0x1328f6c7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003d116
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1003d209
mov dword [ebp - 0x44], 0x6cce57bf
mov dword [ebp - 0x3c], 0x1f7b
cmp dword [ebp - 0x3c], 0x532
jge 0x1003d1e0
lea eax, [ebp - 0x74]
push eax
push 0x1000ea08
call fcn.10056960
imul eax, dword [ebp - 0x74], 3
cdq
sub eax, edx
sar eax, 1
push eax
push 0x1000ea7c
call fcn.10056cf1
mov eax, dword [ebp - 0x74]
add esp, 0x10
push 2
pop edi
mov esi, edi
cmp eax, edi
jl 0x1003d19a
push esi
push 0x1000ead0
call fcn.10056cf1
mov eax, dword [ebp - 0x74]
add esi, edi
pop ecx
pop ecx
cmp esi, eax
jle 0x1003d184
xor ecx, ecx
inc ecx
mov esi, ecx
cmp eax, ecx
jl 0x1003d1b9
push esi
push 0x1000ead0
call fcn.10056cf1
mov eax, dword [ebp - 0x74]
add esi, edi
pop ecx
pop ecx
cmp esi, eax
jle 0x1003d1a3
mov esi, edi
cmp eax, edi
jl 0x1003d1d3
push esi
push 0x1000ead0
call fcn.10056cf1
add esi, edi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x74]
jle 0x1003d1bf
push 0x1000e96e
call fcn.100572e2
pop ecx
xor ecx, ecx
mov dword [ebp - 0x44], 0x75cb
mov dword [ebp - 0x10], ecx
jmp 0x1003d1fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d0], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003d1ec
dec dword [ebp - 0x34]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jne 0x1003d138
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003d22c
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 2
lea ecx, [ebp - 0x4a0]
call fcn.100301c4
xor edi, edi
mov dword [ebp - 4], 6
inc edi
lea ecx, [ebp - 0x29c]
push edi
call fcn.100301c4
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 7
movdqa xmm0, xmmword [0x1000efa0]
lea eax, [ebp - 0x5e0]
push ecx
push eax
push ecx
mov dword [ebp - 0x44], 0x3b3152c5
lea ecx, [ebp - 0x6d4]
movdqu xmmword [ebp - 0x5f0], xmm0
call fcn.10030222
push edi
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], 8
call fcn.100301c4
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1003d2aa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4a0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003d29b
mov dword [ebp - 0x14], edx
jmp 0x1003d2c8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x29c]
mov dword [eax + ecx*4], 0x2ee76f50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d2b5
mov dword [ebp - 0x14], edx
jmp 0x1003d2e1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3f0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d2d2
mov eax, dword [ebp - 0x29c]
mov dword [eax], edx
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x80ca9f8d
dec dword [eax]
mov dword [ebp - 0x44], 0xa9bacde9
mov dword [ebp - 0x44], 0xc58bdfad
mov dword [ebp - 0x44], 0x8b78acc4
mov byte [ebp - 0x19], dl
cmp byte [ebp - 0x19], 0
je 0x1003d334
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor edx, edx
mov eax, dword [ebp - 0x29c]
inc dword [eax]
cmp dword [eax], edi
jle 0x1003d2ee
lea ecx, [ebp - 0x3f0]
call fcn.1003034d
lea ecx, [ebp - 0x6d4]
call fcn.1003034d
lea ecx, [ebp - 0x29c]
call fcn.1003034d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a0]
call fcn.1003034d
mov dword [ebp - 0x34], 0xba394643
lea ecx, [ebp - 0x390]
push 9
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x44], 0x551da622
mov dword [ebp - 0x44], 0xec79e672
mov dword [ebp - 0x10], edi
push edi
call fcn.100301c4
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x3c], 0x1d46
cmp dword [ebp - 0x3c], 0xbf8
jge 0x1003d574
push 0x108ca168
push ecx
push 0x108c9fa8
push ecx
push 0x108ca160
mov ecx, 0x10662ef0
call fcn.10048358
pop ecx
mov ecx, eax
call fcn.10048358
pop ecx
mov ecx, eax
call fcn.10048358
mov edi, dword [0x108ca16c]
mov eax, dword [0x108ca164]
mov edx, dword [0x108ca168]
cmp edi, eax
jg 0x1003d467
jl 0x1003d412
mov esi, dword [0x108ca160]
cmp edx, esi
jae 0x1003d46d
push 0
xor eax, eax
pop ebx
inc eax
add edx, eax
push eax
push ecx
adc edi, ebx
mov dword [0x108ca168], edx
push edi
push edx
mov ecx, 0x10662e38
mov dword [0x108ca16c], edi
call fcn.10048590
mov dl, 0x20
mov ecx, eax
call fcn.1003491e
pop ecx
mov ecx, eax
call fcn.100300a5
push eax
call fcn.100346b6
mov eax, dword [0x108ca164]
mov esi, dword [0x108ca160]
mov edi, dword [0x108ca16c]
mov edx, dword [0x108ca168]
pop ecx
jmp 0x1003d46f
mov esi, dword [0x108ca160]
xor ebx, ebx
cmp edx, esi
jne 0x1003d4b5
cmp edi, eax
jne 0x1003d4b5
push 2
push ecx
push eax
push esi
mov ecx, 0x10662e38
call fcn.10048590
mov dl, 0x20
mov ecx, eax
call fcn.1003491e
pop ecx
mov ecx, eax
call fcn.100300a5
push eax
call fcn.100346b6
mov eax, dword [0x108ca164]
mov esi, dword [0x108ca160]
mov edi, dword [0x108ca16c]
mov edx, dword [0x108ca168]
pop ecx
mov ecx, dword [0x108c9fa8]
sub edx, esi
mov dword [ebp - 0x3c], ecx
sbb edi, eax
mov dword [0x108ca168], edx
mov eax, dword [0x108c9fac]
add ecx, 0xfffffffe
mov dword [ebp - 0x30], eax
adc eax, 0xffffffff
mov dword [0x108c9fa8], ecx
add ecx, 1
mov dword [0x108c9fac], eax
mov dword [0x108ca16c], edi
adc eax, ebx
push eax
push ecx
push edi
push edx
call fcn.1006b860
push 2
mov dword [ebp - 0x28], ecx
mov ecx, edx
xor edx, edx
mov dword [ebp - 0x4c], ebx
pop ebx
push edx
push ebx
push ecx
push eax
mov dword [ebp - 0x10], eax
mov edi, edx
mov dword [ebp - 0x20], ecx
call fcn.10070030
or eax, edx
mov eax, dword [0x108ca164]
je 0x1003d522
mov ebx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x30]
sub esi, dword [ebp - 0x10]
sbb eax, dword [ebp - 0x20]
cmp ebx, 2
jne 0x1003d540
xor ecx, ecx
cmp edi, ecx
jne 0x1003d540
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x4c]
add ebx, 2
adc edi, ecx
jmp 0x1003d546
sub ebx, dword [ebp - 0x28]
sbb edi, dword [ebp - 0x4c]
push edi
push ebx
push eax
push esi
mov ecx, 0x10662e38
call fcn.10048590
mov dl, 0x20
mov ecx, eax
call fcn.1003491e
mov ecx, eax
call fcn.10048590
push eax
call fcn.100346b6
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor edi, edi
pop ecx
inc edi
mov dword [ebp - 0x3c], 0x2758e92e
xor edx, edx
mov dword [ebp - 0x20], 0xa34071e9
mov dword [ebp - 0x10], edx
jmp 0x1003d598
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x390]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003d589
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x34], 0x2c87
jl 0x1003d5ca
mov dword [ebp - 0x34], 0xbce0
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x1003d653
mov dword [ebp - 0x44], 0x3147f59e
mov dword [ebp - 0x44], 0x255d5800
mov dword [ebp - 0x44], 0xb870004d
mov dword [ebp - 0x44], 0x3bdf78b1
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x18], edx
jmp 0x1003d613
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x390]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + esi*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x18]
xor edx, edx
cmp dword [ebp - 0x18], edx
jle 0x1003d5f5
mov dword [ebp - 0x10], edx
jmp 0x1003d64e
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x98422518
mov dword [ebp - 0x44], edi
dec dword [ebp - 0x20]
mov byte [ebp - 0x19], dl
cmp byte [ebp - 0x19], 0
je 0x1003d64b
push edx
push edx
call ebx
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1003d61d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.1003034d
push edi
lea ecx, [ebp - 0xdc]
call fcn.100301c4
push 0xa
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x450]
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], 0xa083
mov dword [ebp - 0x34], 8
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x3c], 0x42f466f6
mov dword [ebp - 0x20], 0xa505
push 2
call fcn.100301c4
mov dword [ebp - 0x30], 0x916d66c
push 0xfffffffffffffff7
mov dword [ebp - 0x44], 0xee57e67f
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1003d6e2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d6d3
mov dword [ebp - 0x14], ebx
jmp 0x1003d6fd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x198], 0xa5cd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003d6ec
mov dword [ebp - 0x14], ebx
jmp 0x1003d715
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d708
mov dword [ebp - 0x14], ebx
jmp 0x1003d732
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], 0xb4e2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003d71f
mov dword [ebp - 0x14], ebx
jmp 0x1003d74e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x214], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003d73d
mov eax, dword [ebp - 0xdc]
cmp dword [eax], ebx
jne 0x1003d7f2
mov eax, dword [ebp - 0x10]
xor edx, edx
push 6
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x190]
setg dl
xor ebx, ebx
cmp edx, 0x7e70
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setle cl
xor ebx, ebx
cmp ecx, 0xa8e4
setg bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0xdc]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
xor edx, edx
add ecx, 9
mov dword [ebp - 0x19c], ecx
mov eax, dword [ebp - 0x190]
cmp ecx, eax
sete dl
xor ebx, ebx
add edx, 0xd443
je 0x1003d7dd
cmp dword [ebp - 0x1a8], ebx
jne 0x1003d7dd
cmp dword [ebp - 0x8c], ebx
je 0x1003d7e0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x38]
neg edx
mov eax, dword [ebp - 0xdc]
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, esi
setg cl
imul ecx, esi
inc dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0xdc]
mov ecx, edi
cmovl ecx, ebx
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 0x450]
cmp dword [eax], ecx
sete dl
cmp edx, dword [ebp - 0x190]
je 0x1003d87d
mov edx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1003d87f
mov edx, edi
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xdc]
setge cl
xor edx, edx
cmp ecx, 0xfffffffe
setg dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x8c]
setle bl
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0xdc]
setle cl
xor edx, edx
cmp ecx, 0xbe1f
setge dl
xor ebx, ebx
mov dword [eax], edx
cmp edx, dword [ebp - 0x34]
jg 0x1003d8d4
mov eax, dword [ebp - 0xdc]
mov ecx, ebx
cmp dword [eax], ebx
je 0x1003d8d6
mov ecx, edi
mov eax, dword [ebp - 0x198]
add eax, ecx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x30], 0x878d
call fcn.1003034d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.1003034d
mov dword [ebp - 0x4c], 0xffffffff
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x20], ebx
push 2
call fcn.100301c4
mov dword [ebp - 0x4c], 0x9bdba76a
mov dword [ebp - 0x10], ebx
jmp 0x1003d941
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003d92e
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], ebx
jl 0x1003d9e7
mov dword [ebp - 0x28], 0x88adae8c
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1003d9de
mov dword [ebp - 0x3c], edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
sub eax, ecx
cmp eax, edi
je 0x1003d989
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x164]
cmp dword [eax + ecx*4], ebx
mov eax, edi
jne 0x1003d98b
mov eax, ebx
cmp eax, edi
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, 0x7d926128
jle 0x1003d9b2
mov ecx, dword [ebp - 0x4c]
mov esi, ebx
mov eax, dword [ebp - 0x164]
cmp dword [eax + ecx*4], ebx
je 0x1003d9b4
mov esi, edi
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x164]
cmp dword [eax + ecx*4], esi
sete dl
xor eax, eax
cmp edx, 0x7704
setle al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x28]
jns 0x1003d965
dec dword [ebp - 0x4c]
jns 0x1003d953
lea ecx, [ebp - 0x164]
call fcn.1003034d
mov dword [ebp - 0x4c], 0xffffffe9
jmp 0x1003fab4
mov dword [ebp - 0x44], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003da21
push ebx
push 0x98d
push 0x813
push 0x42
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003da35
push 0xfd5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10], 0xa7c20398
mov dword [ebp - 0x3c], 0x2521
cmp dword [ebp - 0x3c], 0xc5a
jge 0x1003db71
lea eax, [ebp - 0x90]
push eax
push 0x1000ea04
call fcn.10056960
mov eax, dword [ebp - 0x90]
pop ecx
pop ecx
test eax, eax
je 0x1003db6a
dec eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xa0]
push eax
push 0x1000ea04
call fcn.10056960
mov ebx, dword [ebp - 0xa0]
pop ecx
pop ecx
push 3
pop ecx
dec ebx
mov eax, ebx
mov dword [ebp - 0xa0], ebx
cdq
idiv ecx
push 0
cdq
mov esi, eax
mov ecx, edx
add esi, edi
pop edi
push edx
push eax
adc ecx, edi
push ecx
push esi
call fcn.1005b2c0
push edi
push 2
push edx
push eax
call fcn.1006ff80
push edi
push 3
pop ecx
push ecx
push edx
push eax
call fcn.1005b2c0
push 5
mov dword [ebp - 0x3c], eax
mov eax, ebx
pop edi
mov dword [ebp - 0x30], edx
cdq
idiv edi
push 0
cdq
pop ebx
mov esi, eax
mov ecx, edx
push edx
add esi, 1
push eax
adc ecx, ebx
push ecx
push esi
call fcn.1005b2c0
push ebx
push 2
push edx
push eax
call fcn.1006ff80
push ebx
push edi
push edx
push eax
call fcn.1005b2c0
mov ebx, eax
mov edi, edx
mov eax, dword [ebp - 0xa0]
push 0xf
cdq
pop ecx
idiv ecx
cdq
mov esi, eax
mov ecx, edx
add esi, 1
adc ecx, 0
push edx
push eax
push ecx
push esi
call fcn.1005b2c0
push 0
push 2
push edx
push eax
call fcn.1006ff80
push 0
push 0xf
pop ecx
push ecx
push edx
push eax
call fcn.1005b2c0
sub ebx, eax
sbb edi, edx
add ebx, dword [ebp - 0x3c]
adc edi, dword [ebp - 0x30]
push edi
push ebx
push 0x1000eb30
call fcn.10056cf1
mov eax, dword [ebp - 0x90]
add esp, 0xc
push 1
pop edi
test eax, eax
jne 0x1003da71
xor ebx, ebx
dec eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x14], 0xe0648261
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xfffffff7
jge 0x1003dc41
push 3
pop ecx
mov dword [ebp - 0x38], 0xd45db34e
mov dword [ebp - 0x3c], 0xfff8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x10], ebx
jmp 0x1003dbbd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a8], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003dbac
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 2
jg 0x1003dc34
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
cmp eax, 0x54d
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0x15e0c0a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
jle 0x1003dbcb
push 3
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jl 0x1003db88
mov dword [ebp - 0x3c], 0x1be9
cmp dword [ebp - 0x3c], 0x11f8
jge 0x1003dd8f
call fcn.10056a9a
push eax
push 0x1000eba0
push 0x1000eba4
call fcn.100571a4
add esp, 0xc
call fcn.10056a9a
add eax, 0x20
push eax
push 0x1000ebac
push 0x1000ebb0
call fcn.100571a4
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x1000ea04
call fcn.10056960
cmp dword [ebp - 0x118], 0
mov edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x34], ebx
jle 0x1003dd8c
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x1000ea1c
call fcn.10056960
xor esi, esi
add esp, 0x10
cmp dword [ebp - 0x134], esi
jle 0x1003dd6c
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x1c4]
push eax
push 0x1000ea30
call fcn.10056960
mov eax, dword [ebp - 0x100]
add esp, 0xc
mov edi, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0xb0]
jne 0x1003dd16
test edi, edi
je 0x1003dd5b
cmp eax, dword [ebp - 0xb0]
jle 0x1003dd5c
sub eax, dword [ebp - 0xb0]
push eax
call fcn.10057482
movd xmm1, dword [ebp - 0x288]
movd xmm2, edi
cvtdq2pd xmm2, xmm2
pop ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
divsd xmm2, xmm0
movd xmm0, dword [ebp - 0x100]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
comisd xmm1, xmm2
jb 0x1003dd5c
inc ebx
inc esi
cmp esi, dword [ebp - 0x134]
jl 0x1003dcdd
mov edi, dword [ebp - 0x34]
push ebx
push 0x1000ea38
call fcn.10056cf1
pop ecx
pop ecx
inc edi
push 0
mov dword [ebp - 0x34], edi
pop ebx
cmp edi, dword [ebp - 0x118]
jl 0x1003dcad
xor edi, edi
inc edi
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x5b3b9da4
mov dword [ebp - 0x18], 0xc593c869
mov dword [ebp - 0x30], 0x5c8a52b4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], 0xccedb775
push 2
mov dword [ebp - 0x28], 0x578cca6
pop esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], 0x8e4c
mov dword [ebp - 0x14], ebx
push esi
call fcn.100301c4
mov dword [ebp - 0x50], 0x656e2e31
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x25a7
cmp dword [ebp - 0x3c], 0x1355
jge 0x1003deea
lea eax, [ebp - 0x98]
push eax
push 0x1000ea08
call fcn.10056960
mov eax, dword [ebp - 0x98]
pop ecx
pop ecx
test eax, eax
je 0x1003dee3
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x84]
push eax
push 0x1000ea08
call fcn.10056960
mov eax, dword [ebp - 0x84]
pop ecx
pop ecx
and eax, 0x80000003
jns 0x1003de46
dec eax
or eax, 0xfffffffc
inc eax
je 0x1003de54
push 0x1000ea10
call fcn.100572e2
jmp 0x1003ded1
push 0x1000ea0c
call fcn.100572e2
pop ecx
mov ecx, dword [ebp - 0x84]
mov esi, edi
cmp ecx, 2
jl 0x1003de8a
push 2
pop eax
push eax
push 0x1000ead0
call fcn.10056cf1
inc esi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x84]
lea eax, [esi + esi]
cmp eax, ecx
jle 0x1003de6f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp eax, edi
jle 0x1003debc
mov esi, edi
push edi
push 0x1000ead0
call fcn.10056cf1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x84]
add edi, 2
mov eax, ecx
inc esi
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jl 0x1003de97
xor edi, edi
inc edi
imul eax, ecx, 3
cdq
sub eax, edx
sar eax, 1
dec eax
push eax
push 0x1000ea7c
call fcn.10056cf1
pop ecx
mov eax, dword [ebp - 0x98]
pop ecx
test eax, eax
jne 0x1003de1a
push 2
pop esi
dec eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x10], ebx
jmp 0x1003df02
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x408]
mov dword [eax + ecx*4], 0x38c46158
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003deef
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setle dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffffe
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
imul ecx, dword [ebp - 0x28], 0xf57a
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xfffffff8
jle 0x1003df67
mov eax, edi
cmp dword [ebp - 0x2c], ebx
jne 0x1003df69
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
jne 0x1003df85
mov eax, ebx
cmp dword [ebp - 0x38], ebx
je 0x1003df87
mov eax, edi
mov dword [ebp - 0x14], eax
mov ecx, 0x702b
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x2c], 0x702b
mov edx, dword [ebp - 0x20]
add edx, 0xbd2a
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x408]
setne cl
cmp ecx, 0xffffffff
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
inc ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle bl
xor ecx, ecx
sub ebx, 8
cmp ebx, eax
setge cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x408]
call fcn.1003034d
push 3
pop eax
mov dword [ebp - 0x30], 0xe7eb6652
lea ecx, [ebp - 0x3c0]
mov dword [ebp - 0x44], 0xb09c821f
push eax
call fcn.100301c4
mov dword [ebp - 4], 0xb
xor ebx, ebx
mov dword [ebp - 0x50], 0x225f
cmp dword [ebp - 0x50], 0x96a
jge 0x1003e215
push ebx
push ebx
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
call fcn.10030d0e
push ebx
push ebx
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
call fcn.10030d0e
lea edx, [ebp - 0xf4]
mov byte [ebp - 4], 0xd
call fcn.10048c1d
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1003e1fb
lea edx, [ebp - 0x158]
call fcn.10048c1d
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1003e1f3
mov ebx, dword [ebp - 0x148]
cmp dword [ebp - 0xe4], ebx
jbe 0x1003e0f0
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0xf4]
call fcn.100488bb
mov edi, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x144]
mov ebx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0x144], edi
jmp 0x1003e102
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xe4]
xor edx, edx
mov dword [ebp - 0x38], edx
mov eax, edx
mov dword [ebp - 0x20], edx
mov esi, edx
test ecx, ecx
jle 0x1003e1c6
mov edi, edx
mov dword [ebp - 0x28], edi
test ebx, ebx
jle 0x1003e1aa
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0xf4]
lea ecx, [ebp - 0x158]
cmovae eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x10], 0x10
cmovae ecx, dword [ebp - 0x158]
mov al, byte [eax + esi]
cmp al, byte [ecx + edx]
jne 0x1003e19c
xor edi, edi
inc edi
inc esi
lea eax, [ebp - 0xf4]
inc edx
lea ecx, [ebp - 0x158]
cmp dword [ebp - 0x34], 0x10
cmovae eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x10], 0x10
cmovae ecx, dword [ebp - 0x158]
mov al, byte [eax + esi]
cmp al, byte [ecx + edx]
jne 0x1003e189
cmp edx, ebx
jge 0x1003e189
inc edi
jmp 0x1003e156
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x30], edi
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x30], edi
cmovg edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], edi
inc edx
cmp edx, ebx
jl 0x1003e129
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ebp - 0x20]
cmp edi, eax
push 0
cmovg eax, edi
inc edx
mov dword [ebp - 0x20], edx
mov esi, edx
cmp edx, ecx
mov dword [ebp - 0x38], eax
pop edx
jl 0x1003e11c
push eax
mov ecx, 0x10662e38
call fcn.100300a5
push eax
call fcn.100346b6
pop ecx
lea edx, [ebp - 0xf4]
call fcn.10048c1d
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1003e07d
xor edi, edi
xor ebx, ebx
push 2
inc edi
pop esi
push ebx
push edi
lea ecx, [ebp - 0x158]
call fcn.10030d0e
push ebx
push edi
lea ecx, [ebp - 0xf4]
call fcn.10030d0e
mov dword [ebp - 0x34], 0xfffffff6
push 3
mov dword [ebp - 0x30], 0x9d94
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1003e23e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c0]
mov dword [eax + ecx*4], 0x96dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003e22b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003e261
push ebx
push 0x6c1
push 0x7a
push 0x23e7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], ebx
jl 0x1003e293
mov dword [ebp - 0x10], 0x801fc3ee
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x1003e28b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c0]
cmp dword [eax + ecx*4], ebx
jne 0x1003e28b
dec dword [ebp - 0x10]
jns 0x1003e278
dec dword [ebp - 0x30]
dec dword [ebp - 0x34]
jns 0x1003e269
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.1003034d
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x50], 0x216a
cmp dword [ebp - 0x50], 0x5b1
jge 0x1003e314
lea eax, [ebp - 0xf8]
push eax
push 0x1000ea38
call fcn.10056960
cmp dword [ebp - 0xf8], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x1003e301
lea eax, [ebp - 0x28c]
push eax
push 0x1000ea7c
call fcn.10056960
cmp dword [ebp - 0x28c], 1
pop ecx
pop ecx
je 0x1003e2fe
inc esi
cmp esi, dword [ebp - 0xf8]
jl 0x1003e2d7
jmp 0x1003e301
or edi, 0xffffffff
push edi
push 0x1000ea7c
call fcn.10056cf1
pop ecx
pop ecx
xor edi, edi
push 2
inc edi
pop esi
push esi
lea ecx, [ebp - 0x54c]
call fcn.100301c4
push 0xf
pop eax
push edi
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 4], eax
call fcn.100301c4
lea ecx, [ebp - 0x5d0]
mov byte [ebp - 4], 0x10
movdqa xmm0, xmmword [0x1000efa0]
lea eax, [ebp - 0x5c0]
push ecx
push eax
push ecx
mov dword [ebp - 0x44], 0x3b3152c5
lea ecx, [ebp - 0x68c]
movdqu xmmword [ebp - 0x5d0], xmm0
call fcn.10030222
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x11
call fcn.100301c4
mov dword [ebp - 0x14], ebx
jmp 0x1003e38b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003e37c
mov dword [ebp - 0x14], ebx
jmp 0x1003e3a8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], 0x2ee76f50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003e395
mov dword [ebp - 0x14], ebx
jmp 0x1003e3c1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x438]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003e3b2
mov eax, dword [ebp - 0x2c0]
mov dword [eax], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x80ca9f8d
dec dword [eax]
mov dword [ebp - 0x44], 0xa9bacde9
mov dword [ebp - 0x44], 0xc58bdfad
mov dword [ebp - 0x44], 0x8b78acc4
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003e416
cmp dword [ebp - 0x4c], 0xfffffffe
jl 0x1003d9fe
mov dword [ebp - 0x20], 0x5c68ec0a
push 3
mov dword [ebp - 0x30], 0xafe44fa3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1003fae5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x73c], 0x1328f6c7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003fad4
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1003fb23
mov dword [ebp - 0x44], 0x6cce57bf
mov dword [ebp - 0x44], 0x75cb
mov dword [ebp - 0x10], ebx
jmp 0x1003fb17
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7f0], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003fb06
dec dword [ebp - 0x30]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
jne 0x1003faf3
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
je 0x1003fb48
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov eax, dword [0x100786ec]
xor ecx, ecx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], 0x1ba80278
mov dword [ebp - 0x44], 0x9c18
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x30], ecx
jne 0x1003fd1c
imul eax, dword [ebp - 0x28], 0xa21e
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x28]
jl 0x1003fb9c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg eax
push 5
sbb eax, eax
neg eax
pop edx
cmp eax, edx
je 0x1003fbb3
mov eax, edi
cmp dword [ebp - 0x30], ecx
jne 0x1003fbb5
mov eax, ecx
cmp eax, dword [ebp - 0x10]
jne 0x1003fbbf
cmp dword [ebp - 0x10], ecx
je 0x1003fbc1
mov ecx, edi
mov eax, dword [ebp - 0x10]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, 0x3e018ebd
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x14]
jne 0x1003fd1c
xor edx, edx
mov dword [ebp - 0x4c], edx
push 2
mov dword [ebp - 0x54], 0xfffffff8
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], edx
jmp 0x1003fc0c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x308], 0x5e4bc795
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003fbfb
mov dword [ebp - 0x14], edx
jmp 0x1003fc2e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x308]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x308], ecx
inc dword [ebp - 0x14]
push 3
pop ecx
cmp dword [ebp - 0x14], ecx
jle 0x1003fc17
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
jl 0x1003fd39
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x44], 0xda9a
mov dword [ebp - 0x50], 0xc77a5c6a
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x50], 0xdbcc772a
mov dword [ebp - 0x10], edx
jmp 0x1003fc77
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x668], 0xa2e34ef9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003fc66
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
cmp eax, ecx
jl 0x1003fce2
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x44], edx
jne 0x1003fca2
cmp dword [ebp - 0x28], edx
je 0x1003fca4
mov edx, edi
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x664], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x308]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x308], ecx
mov eax, dword [ebp - 0x20]
imul eax, ecx
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
je 0x1003fce0
mov eax, edx
mov ecx, 0xf6e56995
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, 0xe0da
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x308], edx
jne 0x1003fd39
dec dword [ebp - 0x14]
push 3
pop ecx
jns 0x1003fc42
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff7
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push 2
mov dword [ebp - 0x38], eax
pop esi
push esi
lea ecx, [ebp - 0x4d0]
call fcn.100301c4
push edi
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 4], 0x14
call fcn.100301c4
lea ecx, [ebp - 0x5e0]
mov byte [ebp - 4], 0x15
movdqa xmm0, xmmword [0x1000efa0]
lea eax, [ebp - 0x5d0]
push ecx
push eax
push ecx
mov dword [ebp - 0x44], 0x3b3152c5
lea ecx, [ebp - 0x680]
movdqu xmmword [ebp - 0x5e0], xmm0
call fcn.10030222
push edi
lea ecx, [ebp - 0x384]
mov byte [ebp - 4], 0x16
call fcn.100301c4
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1003fdb3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4d0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003fda4
mov dword [ebp - 0x14], edx
jmp 0x1003fdd0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2b4]
mov dword [eax + ecx*4], 0x2ee76f50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003fdbd
mov dword [ebp - 0x14], edx
jmp 0x1003fde9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x384]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003fdda
mov eax, dword [ebp - 0x2b4]
mov dword [eax], edx
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x80ca9f8d
dec dword [eax]
mov dword [ebp - 0x44], 0xa9bacde9
mov dword [ebp - 0x44], 0xc58bdfad
mov dword [ebp - 0x44], 0x8b78acc4
mov byte [ebp - 0x21], dl
cmp byte [ebp - 0x21], 0
je 0x1003fe3c
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor edx, edx
mov eax, dword [ebp - 0x2b4]
inc dword [eax]
cmp dword [eax], edi
jle 0x1003fdf6
lea ecx, [ebp - 0x384]
call fcn.1003034d
lea ecx, [ebp - 0x680]
call fcn.1003034d
lea ecx, [ebp - 0x2b4]
call fcn.1003034d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.1003034d
mov dword [ebp - 0x4c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x21], cl
cmp byte [ebp - 0x21], cl
je 0x1003fea6
push 0x249
push 0x119c
push 0x229a
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0xfffffffb
jge 0x1003ff4a
mov eax, 0xffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x74734688
mov dword [ebp - 0x28], 0xc8d4675
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x50], 0xfffd
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x44]
jge 0x1003feee
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0x9b2e
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xd02e
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
add ecx, eax
cmp ecx, dword [ebp - 0x28]
jle 0x1003ff23
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x54], edi
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffffb
jl 0x1003feb3
xor ecx, ecx
mov eax, dword [ebp + 8]
push 3
pop edx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [ebp - 0x20], 0x5c68ec0a
mov dword [ebp - 0x30], 0xafe44fa3
mov dword [ebp - 0x10], ecx
jmp 0x1003ff7f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x76c], 0x1328f6c7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003ff6e
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1003ffbd