Function at 0x1003cce9
Capabilities:
Inspect section memory permissions
Log keystrokes via polling
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006580b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003e9b7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x378]
movzx eax, byte [eax]
test eax, eax
je 0x1003cfc0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x200]
cmp dword [eax], 0
je 0x1003cf01
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x200]
mov edx, 0x2923
sub edx, dword [ecx]
cmp edx, dword [eax]
jl 0x1003ce77
mov dword [ebp - 0x1e4], 1
jmp 0x1003ce7e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
cmp dword [ebp - 0x1e4], eax
jne 0x1003cebb
push 1
mov ecx, dword [ebp - 0x310]
call fcn.1001b465
cmp dword [eax], 0
jne 0x1003cebb
push 8
pop eax
test eax, eax
jne 0x1003cebb
mov eax, dword [ebp - 0xc8]
cmp dword [eax], 0
jne 0x1003cebb
and dword [ebp - 0xf4], 0
jmp 0x1003cec5
mov dword [ebp - 0xf4], 1
push 2
mov ecx, dword [ebp - 0x25c]
call fcn.1001b465
mov ecx, dword [ebp - 0xf4]
mov dword [eax], ecx
cmp dword [ebp - 0xf4], 0
je 0x1003ceea
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1003cef5
mov eax, dword [ebp - 0x194]
cmp dword [eax], 0
je 0x1003cf01
mov dword [ebp - 0x114], 1
jmp 0x1003cf08
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
cmp dword [ebp - 0x114], eax
jl 0x1003cf24
mov dword [ebp - 0x1cc], 1
jmp 0x1003cf2b
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
cmp dword [ebp - 0x1cc], eax
jg 0x1003cf47
mov dword [ebp - 0x11c], 1
jmp 0x1003cf4e
and dword [ebp - 0x11c], 0
xor eax, eax
sub eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xc8]
cmp dword [ecx], eax
jg 0x1003cf6c
mov dword [ebp - 0x124], 1
jmp 0x1003cf73
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
cmp dword [ebp - 0x124], eax
jge 0x1003cf8c
mov dword [ebp - 0x6c], 1
jmp 0x1003cf90
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
push 0xfffffffffffffffc
pop esi
sub esi, dword [ebp - 0x6c]
push 0
mov ecx, dword [ebp - 0x320]
call fcn.1001b465
mov dword [eax], esi
jmp 0x1003e9b2
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xc0], eax
push 0x19f8
push 0x598
push 0
push 0x36e1
push 1
push 0x2d3f
call fcn.1002e5ca
add esp, 0x18
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x20], 0x51e
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x64], 0
jmp 0x1003d02c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1003d042
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xfc], 0x3bc6e5c7
jmp 0x1003d025
mov dword [ebp - 0x74], 0
jmp 0x1003d052
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x12
jge 0x1003d388
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x26c], 0x276b87d0
mov dword [ebp - 0x3b8], 0x941fc9a5
mov dword [ebp - 0x3b4], 0x941fc9a5
mov dword [ebp - 0x3b0], 0x941fc9a5
mov dword [ebp - 0x3ac], 0x941fc9a5
lea ecx, [ebp - 0x105]
call fcn.1001b474
push eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x48c]
call fcn.1001b477
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x440]
call fcn.1001b423
and dword [ebp - 4], 0
mov dword [ebp - 0x3d4], 0xf44401d1
mov dword [ebp - 0x444], 0xacee6178
mov eax, 0x43e2
test eax, eax
je 0x1003d138
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x104]
sub eax, 0x5040d9f
cmp eax, dword [ebp - 0x104]
jle 0x1003d119
mov dword [ebp - 0x1f4], 1
jmp 0x1003d120
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0x84c6
jl 0x1003d138
mov dword [ebp - 0x12c], 1
jmp 0x1003d13f
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x2e8]
jl 0x1003d175
mov dword [ebp - 0x134], 1
jmp 0x1003d17c
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x19c], eax
push 1
lea ecx, [ebp - 0x440]
call fcn.1001b465
mov ecx, dword [ebp - 0x19c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x278], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
imul eax, dword [ebp - 0x134]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x354]
je 0x1003d1e1
mov dword [ebp - 0x280], 1
jmp 0x1003d1e8
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x460], eax
xor eax, eax
inc eax
je 0x1003d358
mov dword [ebp - 0x1d4], 0x5f62
mov dword [ebp - 0x2f4], 0x1000b4b8
cmp dword [ebp - 0x1d4], 0x630d
jle 0x1003d2e9
and dword [ebp - 0x84], 0
jmp 0x1003d237
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x42e2
jge 0x1003d2e9
and dword [ebp - 0xac], 0
jmp 0x1003d25d
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x602b
jge 0x1003d2e4
and dword [ebp - 0x7c], 0
jmp 0x1003d276
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x11fd
jge 0x1003d2df
and dword [ebp - 0xc4], 0
jmp 0x1003d295
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x6af4
jge 0x1003d2dd
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc4]
shl eax, cl
or eax, dword [ebp - 0x84]
cdq
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], edx
push dword [ebp - 0x328]
push dword [ebp - 0x32c]
mov ecx, 0x1060df18
call fcn.1001b196
jmp 0x1003d288
jmp 0x1003d26f
jmp 0x1003d250
jmp 0x1003d22a
push 0x1902
push 0x3fea
push 1
push 0
push 0
push 0x506e
push 0x6fa5
push 0x39b8
call fcn.100422c1
add esp, 0x20
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1d4], 0x5bb0
jge 0x1003d330
mov edx, dword [ebp - 0x2f4]
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1003d34c
and dword [ebp - 4], 0
jmp 0x1003d356
jmp 0x1003d374
mov byte [ebp - 0x2f], 0
push 0
lea eax, [ebp - 0x2f]
push eax
push 0x6ff0
push 0x3bfc
call fcn.1003ec8e
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.1001b449
jmp 0x1003d04b
mov dword [ebp - 0x20], 0
jmp 0x1003d398
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1003d40f
mov dword [ebp - 0x2c], 0
jmp 0x1003d3ae
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1003d3db
push 0x41b9
push 0x6fd
push 0x39d5
push 0x37af
push 0
push 0xb5
push 1
call fcn.1002d1ce
add esp, 0x1c
jmp 0x1003d3a7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xfc]
cmp eax, dword [ebp - 0x2c]
jge 0x1003d3f6
mov dword [ebp - 0x13c], 1
jmp 0x1003d3fd
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xfc], ecx
jmp 0x1003d391
and dword [ebp - 0xf0], 0
jmp 0x1003d42e
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xf0], eax
jge 0x1003e9b2
mov dword [ebp - 0x3e4], 0xa8ea
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1003d488
push 0
push 0xaa1
push 0x5e76
push 1
push 0x413a
push 0x895
push 1
push 0x217
push 0x13b8
call fcn.1003ed6b
add esp, 0x24
mov byte [ebp - 0x30], 0
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x1003d4a5
push 0x3b2f
push 1
push 1
call fcn.1002d068
add esp, 0xc
push 4
lea ecx, [ebp - 0x384]
call fcn.1001b3c7
mov dword [ebp - 4], 3
mov dword [ebp - 0x3c], 0xfebaeef2
mov dword [ebp - 0x144], 0x208af066
mov dword [ebp - 0xb4], 0
jmp 0x1003d4e3
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x1003d505
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x384]
call fcn.1001b465
mov dword [eax], 3
jmp 0x1003d4d6
mov dword [ebp - 0x3c], 3
jmp 0x1003d515
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1003d79f
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x44], 0xe2294bb4
mov dword [ebp - 0x330], 0x763c6daa
mov dword [ebp - 0x40], 3
jmp 0x1003d547
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1003d72d
mov dword [ebp - 0x54], 0x63f9e923
mov dword [ebp - 0x54], 0
jmp 0x1003d568
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1003d5be
mov dword [ebp - 0x8c], 0xd8f6efba
mov dword [ebp - 0x8c], 3
jmp 0x1003d591
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1003d5bc
mov byte [ebp - 0x33], 0
push 1
push 0x10b9
push 1
push 1
push 0x262d
lea eax, [ebp - 0x33]
push eax
call fcn.1002d0d5
add esp, 0x18
jmp 0x1003d584
jmp 0x1003d561
push 0
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x2a3d
push 0x1726
lea eax, [ebp - 0x40]
push eax
push 0x68f6
push 0xf67
lea eax, [ebp - 0x54]
push eax
push 1
lea eax, [ebp - 0x44]
push eax
push 0
push 0x12db
call fcn.100381a3
add esp, 0x38
mov dword [ebp - 0x1a4], 0x47c9
mov dword [ebp - 0x288], 0x1000b548
cmp dword [ebp - 0x1a4], 0x4984
jle 0x1003d6dc
and dword [ebp - 0xd8], 0
jmp 0x1003d63d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x4e46
jge 0x1003d6cf
and dword [ebp - 0x94], 0
jmp 0x1003d663
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1273
jge 0x1003d6ca
and dword [ebp - 0xbc], 0
jmp 0x1003d685
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x6a53
jge 0x1003d6c8
mov eax, dword [ebp - 0xd8]
and eax, dword [ebp - 0x94]
or eax, dword [ebp - 0xbc]
cdq
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], edx
push dword [ebp - 0x334]
push dword [ebp - 0x338]
mov ecx, 0x1060df18
call fcn.1001b196
jmp 0x1003d678
jmp 0x1003d656
jmp 0x1003d630
push 0
push 0x2197
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1a4], 0x45d3
jge 0x1003d6fc
mov edx, dword [ebp - 0x288]
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1003d718
mov dword [ebp - 4], 3
jmp 0x1003d728
jmp 0x1003d540
mov dword [ebp - 0x44], 0
jmp 0x1003d73d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1003d79a
push 0x5064
push 0x14f1
push 0x60d
push 0xb67
push 0x4596
lea eax, [ebp - 0x3c]
push eax
push 0x4408
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x3edd
lea eax, [ebp - 0x384]
push eax
push 0
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x330]
push eax
push 0x6b8c
call fcn.1002d302
add esp, 0x40
jmp 0x1003d736
jmp 0x1003d50e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.1001b449
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x1003d7c7
mov dword [ebp - 0x1ec], 1
jmp 0x1003d7ce
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x38], 0xa9ac70c3
mov dword [ebp - 0x1c], 0xad816f93
push 3
lea ecx, [ebp - 0xe8]
call fcn.1001b3c7
mov dword [ebp - 4], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2fc], 0x2be76dcb
lea eax, [ebp - 0xe8]
push eax
push 0
lea eax, [ebp - 0x3e8]
push eax
push 0x7fa3
call fcn.1004152b
add esp, 0x10
mov esi, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
cmp esi, dword [eax]
jg 0x1003d84a
mov dword [ebp - 0x14c], 1
jmp 0x1003d851
and dword [ebp - 0x14c], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x14c]
cmp ecx, dword [eax]
jg 0x1003d874
mov dword [ebp - 0x1ac], 1
jmp 0x1003d87b
and dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1ac], 0xfffffffb
je 0x1003d890
mov dword [ebp - 0x154], 1
jmp 0x1003d897
and dword [ebp - 0x154], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov eax, dword [eax]
cmp eax, dword [ebp - 0x154]
je 0x1003d8ba
mov dword [ebp - 0x1dc], 1
jmp 0x1003d8c1
and dword [ebp - 0x1dc], 0
push 2
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x1dc]
cmp ecx, dword [eax]
jne 0x1003d8e4
mov dword [ebp - 0x15c], 1
jmp 0x1003d8eb
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1003d909
mov dword [ebp - 0x1b4], 1
jmp 0x1003d910
and dword [ebp - 0x1b4], 0
cmp dword [ebp - 0x1b4], 0x9305
jle 0x1003d928
mov dword [ebp - 0x164], 1
jmp 0x1003d92f
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x164], eax
jne 0x1003d946
mov dword [ebp - 0x1fc], 1
jmp 0x1003d94d
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1fc], eax
jge 0x1003d964
mov dword [ebp - 0x16c], 1
jmp 0x1003d96b
and dword [ebp - 0x16c], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x16c]
cmp ecx, dword [eax]
jle 0x1003d98e
mov dword [ebp - 0x1bc], 1
jmp 0x1003d995
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1bc]
je 0x1003d9ac
mov dword [ebp - 0x290], 1
jmp 0x1003d9b3
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3f0], eax
push 8
pop eax
sub eax, 0xe2cd
mov dword [ebp - 0x28], eax
jne 0x1003d9cf
cmp dword [ebp - 0x28], 0
je 0x1003d9e1
cmp dword [ebp - 0x28], 0
je 0x1003d9e1
mov dword [ebp - 0x174], 1
jmp 0x1003d9e8
and dword [ebp - 0x174], 0
push 2
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x174]
cmp ecx, dword [eax]
jl 0x1003da0b
mov dword [ebp - 0x1c4], 1
jmp 0x1003da12
and dword [ebp - 0x1c4], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x1c4]
cmp ecx, dword [eax]
jl 0x1003da35
mov dword [ebp - 0x17c], 1
jmp 0x1003da3c
and dword [ebp - 0x17c], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov ecx, dword [ebp - 0x17c]
cmp ecx, dword [eax]
jge 0x1003da5f
mov dword [ebp - 0x10c], 1
jmp 0x1003da66
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x10c], eax
jne 0x1003da7d
mov dword [ebp - 0x184], 1
jmp 0x1003da84
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfe8b0d19
jae 0x1003daab
cmp dword [ebp - 0x28], 0
jne 0x1003daab
cmp dword [ebp - 0x28], 0
jne 0x1003daab
and dword [ebp - 0x1c8], 0
jmp 0x1003dab5
mov dword [ebp - 0x1c8], 1
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov dword [eax], 1
xor eax, eax
inc eax
jne 0x1003dada
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
dec eax
jne 0x1003daf6
cmp dword [ebp - 0x1c], 0
jne 0x1003daf6
and dword [ebp - 0x18c], 0
jmp 0x1003db00
mov dword [ebp - 0x18c], 1
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x38], 1
jmp 0x1003db1c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x33
jne 0x1003db65
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001b465
cmp dword [eax], 0
je 0x1003db36
jmp 0x1003db65
mov byte [ebp - 0x34], 0
push 0x2498
lea eax, [ebp - 0x34]
push eax
push 1
push 0x7e9e
push 0xf17
push 0x5d41
push 0
push 0x6d12
call fcn.1003ffec
add esp, 0x20
jmp 0x1003db15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001b449
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x1003db8d
mov dword [ebp - 0x110], 1
jmp 0x1003db94
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2b0], eax
push 1
lea ecx, [ebp - 0x218]
call fcn.1001b3c7
mov dword [ebp - 4], 7
mov dword [ebp - 0x24], 0
jmp 0x1003dbc4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003dbda
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x49c], 0
jmp 0x1003dbbd
mov dword [ebp - 0x24], 0
jmp 0x1003dbea
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1003dc06
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.1001b465
mov dword [eax], 0x622ba394
jmp 0x1003dbe3
push 0
lea ecx, [ebp - 0x218]
call fcn.1001b465
and dword [eax], 0
jmp 0x1003dc3c
push 0
lea ecx, [ebp - 0x218]
call fcn.1001b465
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x218]
call fcn.1001b465
cmp dword [eax], 4
jge 0x1003dc6a
push 0
lea ecx, [ebp - 0x218]
call fcn.1001b465
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x49c], 0xffffffff
jmp 0x1003dc18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.1001b449
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x1003dc92
mov dword [ebp - 0x120], 1
jmp 0x1003dc99
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x298], 2
mov dword [ebp - 0x48], 0x7e17f759
mov dword [ebp - 0x2a0], 0xa8628405
mov dword [ebp - 0x9c], 0
jmp 0x1003dcd9
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1003dcf5
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x484], 2
jmp 0x1003dccc
cmp dword [ebp - 0x298], 0
je 0x1003de3d
mov dword [ebp - 0xd0], 0
jmp 0x1003dd1b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1003dd37
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x3dc], 0x43cdf98a
jmp 0x1003dd0e
mov dword [ebp - 0x128], 0x2345
mov dword [ebp - 0x36c], 0x1000b598
cmp dword [ebp - 0x128], 0x24ac
jle 0x1003dddf
and dword [ebp - 0xa4], 0
jmp 0x1003dd71
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x3962
jge 0x1003dddf
and dword [ebp - 0x68], 0
jmp 0x1003dd8a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x3ebd
jge 0x1003dddd
and dword [ebp - 0x70], 0
jmp 0x1003dda0
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x7aa4
jge 0x1003dddb
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
cdq
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], edx
push dword [ebp - 0x340]
push dword [ebp - 0x344]
mov ecx, 0x1060df18
call fcn.1001b196
jmp 0x1003dd99
jmp 0x1003dd83
jmp 0x1003dd64
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 8
cmp dword [ebp - 0x128], 0x1f5f
jge 0x1003de12
mov edx, dword [ebp - 0x36c]
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1003de2e
or dword [ebp - 4], 0xffffffff
jmp 0x1003de38
jmp 0x1003df49
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x48], 1
jmp 0x1003de54
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x10
jl 0x1003df49
mov dword [ebp - 0xf8], 0xfffffffb
imul eax, dword [ebp - 0x2a0], 0x6bde
cmp dword [ebp - 0x78], eax
jg 0x1003de83
mov dword [ebp - 0x130], 1
jmp 0x1003de8a
and dword [ebp - 0x130], 0
cmp dword [ebp - 0x130], 0
je 0x1003de9f
mov dword [ebp - 0x138], 1
jmp 0x1003dea6
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x138], eax
jle 0x1003dec0
mov dword [ebp - 0x140], 1
jmp 0x1003dec7
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x140], eax
jle 0x1003dee1
mov dword [ebp - 0x148], 1
jmp 0x1003dee8
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x148]
jne 0x1003deff
mov dword [ebp - 0x304], 1
jmp 0x1003df06
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x78]
jge 0x1003df23
mov dword [ebp - 0x150], 1
jmp 0x1003df2a
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x150]
neg eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x484], eax
jmp 0x1003de4d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1003e062
push 0x4000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x279e
push 0x255c
call fcn.1004be7c
pop ecx
pop ecx
call eax
mov dword [ebp - 0x3a4], 0x61928c17
mov dword [ebp - 0x3a0], 0x61928c17
mov dword [ebp - 0x39c], 0x61928c17
mov dword [ebp - 0x398], 0x61928c17
mov dword [ebp - 0x80], 0
jmp 0x1003dfb6
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1003dfc9
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x4c], 0xfffffffb
jmp 0x1003dfaf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4c], 0
jmp 0x1003dfee
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 3
jg 0x1003e026
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1003e024
push 1
push 0
push 0xd69
push 0x503d
push 0x1ccc
push 1
call fcn.1003b8b1
add esp, 0x18
jmp 0x1003dfd9
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0x158], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x4c], ecx
mov eax, dword [ebp - 0x158]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3a4], eax
jmp 0x1003d418
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x268]
push eax
push 1
call fcn.1002d1ce
add esp, 0x1c
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x418], 9
mov dword [ebp - 0x420], 0xfffffff8
mov dword [ebp - 0x428], 0x7a73d2d6
mov dword [ebp - 0x430], 0x8bd4dfbd
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x464], 0xac46ddcd
mov dword [ebp - 0x474], 0x6edad94e
mov dword [ebp - 0x470], 0x6edad94e
mov dword [ebp - 0x46c], 0x6edad94e
mov dword [ebp - 0x468], 0x6edad94e
mov dword [ebp - 0x88], 0
jmp 0x1003e11f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1b
jg 0x1003e4ac
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x424], 0xc5021c3a
mov dword [ebp - 0x3e0], 0xfffffff8
mov dword [ebp - 0x160], 0x21c2
mov dword [ebp - 0x2b8], 0x1000b5dc
cmp dword [ebp - 0x160], 0x2513
jle 0x1003e214
and dword [ebp - 0x90], 0
jmp 0x1003e184
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x28bc
jge 0x1003e214
and dword [ebp - 0x98], 0
jmp 0x1003e1aa
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x2ebc
jge 0x1003e20f
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
shl eax, cl
cdq
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
push dword [ebp - 0x34c]
push dword [ebp - 0x350]
lea ecx, [ebp - 0x4e8]
call fcn.1000defa
pop ecx
pop ecx
mov dword [ebp - 0x30c], eax
mov ecx, dword [ebp - 0x30c]
call fcn.1001b176
push eax
call fcn.1004f7a6
pop ecx
lea ecx, [ebp - 0x4e8]
call fcn.1001b16c
jmp 0x1003e19d
jmp 0x1003e177
mov dword [ebp - 0x3f8], 0xd95da228
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x160], 0x1e84
jge 0x1003e23d
push dword [ebp - 0x2b8]
call fcn.1004f7a6
pop ecx
jmp 0x1003e259
or dword [ebp - 4], 0xffffffff
jmp 0x1003e263
mov dword [ebp - 0x5c], 0x7b7f609b
mov dword [ebp - 0x400], 0xfffffff8
mov dword [ebp - 0x3ec], 6
mov dword [ebp - 0x454], 0x9d73df2e
mov dword [ebp - 0x3f4], 0x66d8ff8c
push 2
lea ecx, [ebp - 0x3c4]
call fcn.1001b3c7
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x168], 0x4061
mov dword [ebp - 0x2c0], 0x1000b65c
cmp dword [ebp - 0x168], 0x4255
jle 0x1003e3d6
and dword [ebp - 0xa0], 0
jmp 0x1003e2e0
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x46f7
jge 0x1003e3d0
and dword [ebp - 0xa8], 0
jmp 0x1003e306
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x62f5
jge 0x1003e3cb
and dword [ebp - 0xb0], 0
jmp 0x1003e32c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x79e8
jge 0x1003e3c6
and dword [ebp - 0xb8], 0
jmp 0x1003e352
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xa39
jge 0x1003e3c1
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0xb8]
cdq
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x358], edx
push dword [ebp - 0x358]
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x4d0]
call fcn.1000defa
pop ecx
pop ecx
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
call fcn.1001b176
push eax
call fcn.1004f7a6
pop ecx
lea ecx, [ebp - 0x4d0]
call fcn.1001b16c
jmp 0x1003e345
jmp 0x1003e31f
jmp 0x1003e2f9
jmp 0x1003e2d3
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 1
push 0x3882
push 0x29e2
push 0x6a17
lea eax, [ebp - 0x42c]
push eax
push 1
lea eax, [ebp - 0x3c4]
push eax
call fcn.10040937
add esp, 0x20
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x168], 0x3e42
jge 0x1003e41d
push dword [ebp - 0x2c0]
call fcn.1004f7a6
pop ecx
jmp 0x1003e439
mov dword [ebp - 4], 0xc
jmp 0x1003e449
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1001b465
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x170]
mov dword [ecx], eax
mov dword [ebp - 0x5c], 0
jmp 0x1003e47d
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff0
jg 0x1003e498
cmp dword [ebp - 0x314], 0
je 0x1003e48e
jmp 0x1003e498
cmp dword [ebp - 0x5c], 0
je 0x1003e496
jmp 0x1003e476
jmp 0x1003e476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.1001b449
jmp 0x1003e112
push 0x4671
push 0x121d
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x62ae
push 0x1894
push 0x6e59
push 0
push 0x3777
push 1
push 0x741e
call fcn.1002eee2
add esp, 0x30
mov dword [ebp - 0x394], 0x61928c17
mov dword [ebp - 0x390], 0x61928c17
mov dword [ebp - 0x38c], 0x61928c17
mov dword [ebp - 0x388], 0x61928c17
mov dword [ebp - 0x18], 1
push 2
lea ecx, [ebp - 0x20c]
call fcn.1001b3c7
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2d8], 0x22abf7c2
mov dword [ebp - 0x3fc], 0xbdf11caf
mov dword [ebp - 0x178], 0x4660
mov dword [ebp - 0x348], 0x1000b6b8
cmp dword [ebp - 0x178], 0x4792
jle 0x1003e60e
and dword [ebp - 0xcc], 0
jmp 0x1003e57e
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x37f3
jge 0x1003e60e
and dword [ebp - 0xd4], 0
jmp 0x1003e5a4
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x68f6
jge 0x1003e609
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xd4]
shl eax, cl
cdq
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], edx
push dword [ebp - 0x364]
push dword [ebp - 0x368]
lea ecx, [ebp - 0x500]
call fcn.1000defa
pop ecx
pop ecx
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.1001b176
push eax
call fcn.1004f7a6
pop ecx
lea ecx, [ebp - 0x500]
call fcn.1001b16c
jmp 0x1003e597
jmp 0x1003e571
mov dword [ebp - 0x458], 0x8491f199
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x178], 0x42f0
jge 0x1003e634
push dword [ebp - 0x348]
call fcn.1004f7a6
pop ecx
jmp 0x1003e650
mov dword [ebp - 4], 0xf
jmp 0x1003e660
push 0x37db
push 0x3ce1
push 1
push 1
push 0x45b5
lea eax, [ebp - 0x20c]
push eax
push 0x55ef
lea eax, [ebp - 0x50]
push eax
push 0x1682
push 0x671a
push 0x34eb
call fcn.1002d5a9
add esp, 0x2c
mov dword [ebp - 0x50], 0
jmp 0x1003e6aa
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1003e6c0
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x4b8], 1
jmp 0x1003e6a3
mov dword [ebp - 0x18], 3
jmp 0x1003e6d0
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1003e71d
mov dword [ebp - 0xdc], 0
jmp 0x1003e6ef
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 4
jge 0x1003e70b
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x4ac], 9
jmp 0x1003e6e2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4ac], 0x6580849f
jmp 0x1003e6c9
mov esi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0x20c]
call fcn.1001b465
cmp dword [eax], esi
jl 0x1003e73d
mov dword [ebp - 0x2d0], 1
jmp 0x1003e744
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, 1
jle 0x1003e76d
mov dword [ebp - 0x180], 1
jmp 0x1003e774
and dword [ebp - 0x180], 0
push 0
lea ecx, [ebp - 0x20c]
call fcn.1001b465
mov ecx, dword [ebp - 0x180]
cmp ecx, dword [eax]
jle 0x1003e79d
cmp dword [ebp - 0x18], 0
je 0x1003e79d
mov dword [ebp - 0x188], 1
jmp 0x1003e7a4
and dword [ebp - 0x188], 0
push 1
lea ecx, [ebp - 0x20c]
call fcn.1001b465
mov ecx, dword [ebp - 0x188]
cmp ecx, dword [eax]
jg 0x1003e7c7
mov dword [ebp - 0x190], 1
jmp 0x1003e7ce
and dword [ebp - 0x190], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
cmp eax, dword [ebp - 0x190]
jg 0x1003e7ee
mov dword [ebp - 0x198], 1
jmp 0x1003e7f5
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x198]
je 0x1003e80c
mov dword [ebp - 0x31c], 1
jmp 0x1003e813
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2d8]
jne 0x1003e941
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x324], 0xfffffffe
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x40c], 0xfffffffa
mov dword [ebp - 0x45c], 9
push 1
lea ecx, [ebp - 0x450]
call fcn.1001b3c7
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2e0], 0xdeb47635
push 4
lea ecx, [ebp - 0x3d0]
call fcn.1001b3c7
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x58], 0
jmp 0x1003e890
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003e8a9
push dword [ebp - 0x58]
lea ecx, [ebp - 0x450]
call fcn.1001b465
or dword [eax], 0xffffffff
jmp 0x1003e889
lea eax, [ebp - 0x3d0]
push eax
push 0x93f
push 0
lea eax, [ebp - 0x58]
push eax
push 0x33c9
call fcn.100426eb
add esp, 0x14
lea eax, [ebp - 0x374]
push eax
push 1
lea eax, [ebp - 0x20c]
push eax
push 0x1479
push 0x17d8
push 1
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x3d0]
push eax
push 0x58a5
call fcn.1002d896
add esp, 0x2c
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1003e921
push 0x12ef
call dword [sym.imp.USER32.dll_GetKeyState]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3d0]
call fcn.1001b449
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x450]
call fcn.1001b449
jmp 0x1003e969
mov byte [ebp - 0x2e], 0
push 0x1969
lea eax, [ebp - 0x2e]
push eax
push 0x697
push 0x77e7
push 1
push 1
push 0x141f
call fcn.1002db5d
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.1001b449
cmp dword [ebp - 0x1a0], 0
jbe 0x1003e9ad
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x268]
push dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x279e
push 0x267d
call fcn.1004be7c
pop ecx
pop ecx
call eax
jmp 0x1003d418
jmp 0x1003ec7d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp + 0x50]
mov dword [ebp - 0x29c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
movzx eax, byte [eax]
test eax, eax
je 0x1003ea4b
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
movzx eax, byte [eax]
test eax, eax
je 0x1003ea46
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x1003ec7d
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x248], eax
push 0
mov ecx, dword [ebp - 0x60]
call fcn.1001b465
cmp dword [eax], 0
je 0x1003ec68
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x240]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
jne 0x1003eb38
push 0
mov ecx, dword [ebp - 0x60]
call fcn.1001b465
cmp dword [eax], 0
jne 0x1003eb38
and dword [ebp - 0x1a8], 0
jmp 0x1003eb42
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax]
cmp dword [ebp - 0x1a8], eax
jg 0x1003eb5e
mov dword [ebp - 0x1b0], 1
jmp 0x1003eb65
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 1
ja 0x1003eb85
mov eax, dword [ebp - 0xec]
cmp dword [eax], 0
je 0x1003eb85
mov dword [ebp - 0x1b8], 1
jmp 0x1003eb8c
and dword [ebp - 0x1b8], 0
cmp dword [ebp - 0x1b8], 0xe11a796
jge 0x1003eba4
mov dword [ebp - 0x1d0], 1
jmp 0x1003ebab
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax]
cmp dword [ebp - 0x1d0], eax
jl 0x1003ebc7
mov dword [ebp - 0x1d8], 1
jmp 0x1003ebce
and dword [ebp - 0x1d8], 0
push 0
mov ecx, dword [ebp - 0x60]
call fcn.1001b465
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [eax]
jge 0x1003ebee
mov dword [ebp - 0x1e0], 1
jmp 0x1003ebf5
and dword [ebp - 0x1e0], 0
push 0
mov ecx, dword [ebp - 0x60]
call fcn.1001b465
mov ecx, dword [ebp - 0x1e0]
sub ecx, dword [eax]
jne 0x1003ec15
mov dword [ebp - 0x1e8], 1
jmp 0x1003ec1c
and dword [ebp - 0x1e8], 0
push 0
mov ecx, dword [ebp - 0x60]
call fcn.1001b465
mov ecx, dword [ebp - 0x1e8]
cmp ecx, dword [eax]
jle 0x1003ec3c
mov dword [ebp - 0x1f0], 1
jmp 0x1003ec43
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x250]
mov ecx, dword [ecx]
imul ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
jl 0x1003ec68
mov dword [ebp - 0x1f8], 1
jmp 0x1003ec6f
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x1f8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret