Function at 0x1003c5d0
Capabilities:
Encrypt data using speck
Get common file path
Get keyboard layout

Disassembly:
mov eax, 0x100650ca
call fcn.10064168
sub esp, 0x370
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
pop esi
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x1a4]
push esi
mov dword [ebp - 0x50], edx
call fcn.1002ff7c
xor ebx, ebx
mov dword [ebp - 0x34], 0x3f9beab1
mov dword [ebp - 0x30], ebx
jmp 0x1003c61c
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0x571177e8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1003c609
mov eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0x1a4]
mov dword [eax + 4], 1
call fcn.1002fffe
push esi
lea ecx, [ebp - 0x104]
call fcn.1002ff7c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], ebx
jmp 0x1003c66a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1003c657
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jl 0x1003c805
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x1c], 0x2522
cmp dword [ebp - 0x1c], 0x27d6
jle 0x1003c706
mov edi, ebx
mov dword [ebp - 0x44], ebx
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov eax, esi
mov dword [ebp - 0x3c], ebx
xor eax, edi
mov dword [ebp - 0x54], eax
mov edi, eax
mov esi, ebx
mov dword [ebp - 0x38], 0x57c2
mov ebx, dword [ebp - 0x3c]
mov eax, edi
mov ecx, 0x1060e278
or eax, esi
cdq
push edx
push eax
call fcn.1002fe67
add esi, ebx
dec dword [ebp - 0x38]
jne 0x1003c6be
inc ebx
push 0
mov dword [ebp - 0x3c], ebx
cmp ebx, 0x7fba
pop ebx
jl 0x1003c6b2
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x44]
inc esi
mov dword [ebp - 0x40], esi
cmp esi, 0x801
jl 0x1003c6a6
inc edi
mov dword [ebp - 0x44], edi
cmp edi, 0x55ff
jl 0x1003c6a1
xor eax, eax
inc eax
mov dword [ebp - 0x54], 0xf5c9b8db
mov byte [ebp - 4], al
cmp dword [ebp - 0x1c], 0x2351
jge 0x1003c749
mov edx, 0x1000b404
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1003c746
xor eax, eax
inc eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jl 0x1003c78b
mov dword [ebp - 0x24], 0x73d2
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jg 0x1003c786
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x104]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jle 0x1003c766
xor eax, eax
xor ebx, ebx
inc eax
dec dword [ebp - 0x14]
jns 0x1003c754
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jl 0x1003c7fd
mov edi, dword [ebp - 0x104]
mov dword [ebp - 0x3c], 0x2b53
xor ecx, ecx
mov dword [ebp - 0x54], 0xf79facd4
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], ebx
mov esi, dword [ebp - 0x28]
imul eax, dword [ebp - 0x54], 0xb2ae999b
mov edx, dword [ebp - 0x104]
push 1
cmp dword [edx + esi*4], eax
setl cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp dword [edi + 4], eax
pop eax
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x14]
jns 0x1003c799
dec dword [ebp - 0x28]
jmp 0x1003c675
or esi, 0xffffffff
lea ecx, [ebp - 0x104]
mov dword [ebp - 4], esi
call fcn.1002fffe
mov eax, dword [0x1060f380]
xor edi, edi
inc edi
test al, 1
jne 0x1003c8af
or eax, edi
mov dword [0x1060f380], eax
push ebx
mov dword [ebp - 4], 3
push ebx
mov dword [0x1060f360], ebx
mov dword [0x1060f364], ebx
call fcn.1003f42e
mov dword [0x1060f360], eax
mov dword [0x1060f368], ebx
mov dword [0x1060f370], ebx
mov byte [ebp - 4], 5
mov ecx, 0x1060f368
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x23c]
mov dword [0x1060f37c], 0x3f800000
push eax
mov dword [0x1060f36c], ebx
call fcn.1003f206
push 0x1006562b
mov dword [0x1060f374], 7
mov dword [0x1060f378], 8
call fcn.1004ee7c
pop ecx
mov dword [ebp - 4], esi
push edi
lea ecx, [ebp - 0xdc]
call fcn.1002ff7c
mov dword [ebp - 4], 6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0x4ab274bf
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x58], 0x5950
mov dword [ebp - 0x2c], 0xcd8a6ce
mov dword [ebp - 0x14], ebx
jmp 0x1003c8fe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003c8eb
push 2
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1003c919
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0x60b4ffb8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003c90b
mov dword [ebp - 0x60], ebx
jmp 0x1003c9d2
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c780]
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x48], 0xfffffff8
push eax
push ebx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], ebx
movdqu xmmword [ebp - 0x298], xmm0
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
call fcn.10031e30
push 4
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 7
call fcn.1002ff7c
mov dword [ebp - 0x30], ebx
jmp 0x1003c995
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1003c982
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
lea ecx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x1e0]
dec dword [eax]
call fcn.1002fffe
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 6
call fcn.1002fffe
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], ebx
jle 0x1003c926
mov dword [ebp - 0x20], ebx
mov eax, 0xffff
cmp dword [ebp - 0x20], ebx
jl 0x1003cb74
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0x64f2ca12
mov dword [ebp - 0x48], 0x2c75
mov dword [ebp - 0x24], 0x2db6
cmp dword [ebp - 0x24], 0x2efe
jle 0x1003ca9c
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 0x2834
mov edx, eax
mov dword [ebp - 0x3c], 0x129a
mov dword [ebp - 0x38], edx
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x33c]
cdq
push edx
push eax
call fcn.1000db90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ca4f
mov eax, dword [eax]
push eax
call fcn.1004eea6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x33c]
call fcn.10030308
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
dec edx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
jne 0x1003ca31
mov eax, dword [ebp - 0x40]
dec eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
jne 0x1003ca25
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4b5f
jl 0x1003ca1b
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x797a
jl 0x1003ca16
mov dword [ebp - 0x14], ebx
jmp 0x1003cab2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x22c], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003caa1
cmp dword [ebp - 0x24], 0x2b50
jge 0x1003cacc
push 0x1000b440
call fcn.1004eea6
pop ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x14], ebx
jmp 0x1003cae9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x220], 0x26ae69ed
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003cad8
mov dword [ebp - 0x38], 0x906d
cmp dword [ebp - 0x38], ebx
jne 0x1003cb07
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x38], ebx
cmp dword [eax], ebx
je 0x1003cb0a
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x21c]
xor edx, edx
mov eax, dword [ebp - 0x54]
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x224]
je 0x1003cb2a
cmp dword [ebp - 0x58], ebx
jne 0x1003cb2a
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, 0xaea1
mov eax, dword [ebp - 0xdc]
setne cl
mov edx, dword [eax + edx*4]
sub edx, ecx
sub edx, dword [eax]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x224], ecx
dec dword [ebp - 0x20]
jmp 0x1003c9de
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xdc]
call fcn.1002fffe
mov dword [ebp - 0x3c], 0x42e9
cmp dword [ebp - 0x3c], 0x4495
jle 0x1003cbcc
mov dword [ebp - 0x38], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
add eax, ebx
mov ecx, 0x1060e278
cdq
push edx
push eax
call fcn.1002fe67
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0xaab
jl 0x1003cba0
inc ebx
push 0
mov dword [ebp - 0x38], ebx
cmp ebx, 0x4652
pop ebx
jl 0x1003cb98
imul eax, dword [ebp - 0x5c], 0x2710
mov dword [ebp - 4], 0xa
add eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3c], 0x405d
mov dword [ebp - 0x68], eax
jge 0x1003cbf8
mov edx, 0x1000b478
mov ecx, 0x1060e278
call fcn.10031911
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0xe76f5020
mov dword [ebp - 0x34], 0x6d402da3
mov dword [ebp - 0x30], ebx
jmp 0x1003cc45
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x258], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1003cc38
mov dword [ebp - 0x14], ebx
jmp 0x1003cd00
mov dword [ebp - 0x1c], 0xff3d
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x48], 0xe314a5ea
mov dword [ebp - 0x30], ebx
jmp 0x1003cc7a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2e8], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1003cc6d
mov eax, dword [ebp - 0x258]
imul eax, dword [ebp - 0x250]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jb 0x1003cca8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x1003cca0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1c], ebx
jne 0x1003cca8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
je 0x1003ccec
mov dword [ebp - 0x30], ebx
jmp 0x1003ccc6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2c4], 0xd21cd430
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1003ccb5
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003cce1
push 0x1c48
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c4], eax
jmp 0x1003ccf4
cmp dword [ebp - 0x250], ebx
jne 0x1003cd0a
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x34], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1003cc53
lea eax, [ebp - 0x68]
push eax
call fcn.1003eb1d
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c760]
lea ecx, [ebp - 0x14c]
movdqu xmmword [ebp - 0x2b8], xmm0
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x14c], ebx
push eax
push ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
call fcn.10031e30
mov dword [ebp - 0x1c], 0x29000d4e
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1003cd88
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003cd83
push ebx
push ebx
push 0xc06
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
dec dword [ebp - 0x1c]
jns 0x1003cd6a
lea ecx, [ebp - 0x14c]
call fcn.1002fffe
cmp dword [ebp - 0x44], 0
je 0x1003cece
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x2c], 0x97412df3
mov dword [ebp - 0x38], 0x555145cc
mov dword [ebp - 0x4c], 0x245f5b1b
mov dword [ebp - 0x34], 0xca27289f
mov dword [ebp - 0x48], 0xccd2466e
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x1c], 0x493e623b
mov dword [ebp - 0x30], 5
push edi
call fcn.1002ff7c
mov dword [ebp - 0x14], ebx
jmp 0x1003cdfa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x180], 0xd8cf4c59
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003cde9
mov dword [ebp - 0x14], ebx
jmp 0x1003ce13
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003ce04
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003ce2d
push ebx
push 0x1600
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x180], eax
cmp eax, dword [ebp - 0x20]
jge 0x1003ce4c
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x180], ebx
je 0x1003ce4f
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x34], ebx
je 0x1003ce57
mov eax, dword [ebp - 0x48]
inc dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
setg dl
xor eax, eax
cmp dword [ebp - 0x2c], edx
setle al
sub ecx, eax
xor eax, eax
sub ecx, esi
cmp ecx, esi
setg al
sub eax, 0xffff
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
jne 0x1003cea5
cmp dword [ebp - 0x4c], ebx
je 0x1003cea7
mov ebx, edi
xor eax, eax
lea ecx, [ebp - 0x1c8]
cmp ebx, 0x122d800f
setle al
mov dword [ebp - 0x48], eax
call fcn.1002fffe
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa0], eax
jmp 0x1003e9e2
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003cee3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003cef3
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x1060f380]
test al, 2
jne 0x1003cf8e
or eax, esi
mov dword [0x1060f380], eax
push ebx
mov dword [ebp - 4], 0xc
push ebx
mov dword [0x1060f340], ebx
mov dword [0x1060f344], ebx
call fcn.1003f42e
mov dword [0x1060f340], eax
mov dword [0x1060f348], ebx
mov dword [0x1060f350], ebx
mov byte [ebp - 4], 0xe
mov ecx, 0x1060f348
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x114]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x230]
mov dword [0x1060f35c], 0x3f800000
push eax
mov dword [0x1060f34c], ebx
call fcn.1003f206
push 0x10065626
mov dword [0x1060f354], 7
mov dword [0x1060f358], 8
call fcn.1004ee7c
or eax, 0xffffffff
pop ecx
mov dword [ebp - 4], eax
jmp 0x1003cf91
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x20], eax
push esi
call fcn.1002ff7c
mov dword [ebp - 0x14], ebx
jmp 0x1003cfbe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003cfaf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], 0xaaf0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x28], 0x1c3ffbe4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffff
mov eax, dword [ebp - 0x170]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0x28], 0xf
jmp 0x1003d02d
mov dword [ebp - 0x34], 0xfa72
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe9
je 0x1003d018
lea ecx, [ebp - 0x170]
call fcn.1002fffe
xorps xmm0, xmm0
or ecx, 0xffffffff
movdqu xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], ebx
jmp 0x1003d0aa
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0xfffffff9
jmp 0x1003d0a1
mov dword [ebp - 0x34], 0x513c61c7
mov ecx, edi
mov dword [ebp - 0x34], 0x9ce4562
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub ecx, eax
sub ecx, dword [ebp - 0x28]
xor eax, eax
imul ecx, dword [ebp - 0x20]
cmp ecx, 0x9fa8
setg al
sub eax, 0x7c2076ac
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jne 0x1003d064
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
jg 0x1003d054
lea eax, [ebp - 0x5c]
push eax
call fcn.1003eb7f
mov ecx, dword [eax]
mov dword [ebp - 0x20], 0xdd1e
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0x5741311e
mov dword [ebp - 0x2c], 0xbbd4856c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x20], edi
je 0x1003d237
mov dword [ebp - 0x14], 0xd8143836
lea ecx, [ebp - 0xb8]
push 4
call fcn.1002ff7c
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 0xa9711f64
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x1003d12e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003d11f
cmp dword [ebp - 0x1c], ebx
jne 0x1003d1df
dec dword [ebp - 0x2c]
je 0x1003d189
mov eax, dword [ebp - 0xb8]
xor edx, edx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xa8db
setl al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf29c
mov edx, dword [ebp - 0xb8]
setge cl
sub ecx, 0x1e33ecdc
cmp ecx, dword [edx + 0xc]
je 0x1003d18f
mov eax, edi
jmp 0x1003d191
mov edx, dword [ebp - 0xb8]
mov eax, ebx
cmp eax, 0xa36a77d7
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edx]
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x8dad
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb8]
mov edx, ebx
setge cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
cmp eax, 0x3f045180
setge cl
imul eax, ecx, 0x6536
cmp eax, dword [ebp - 0x38]
je 0x1003d1e1
mov edx, edi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1ac4
setl al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d21d
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0xb8]
call fcn.1002fffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jne 0x1003d0f9
mov ecx, dword [ebp - 0x30]
cmp byte [ebp + 0xc], 0
jne 0x1003d245
test ecx, ecx
jne 0x1003d874
push 3
lea ecx, [ebp - 0x1bc]
call fcn.1002ff7c
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x2c], 0xfffffffe
push esi
call fcn.1002ff7c
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xfffb
mov dword [ebp - 0x34], 0x844ba928
mov dword [ebp - 0x24], ebx
jmp 0x1003d299
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], 0xf1d8987
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003d286
mov dword [ebp - 0x24], ebx
jmp 0x1003d2b7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0x15fb57a6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003d2a4
mov dword [ebp - 0x24], ebx
jmp 0x1003d2d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x278], 0xee50
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003d2c1
mov edx, dword [ebp - 0x1bc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x198]
mov dword [eax], ecx
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x274]
mov eax, dword [ebp - 0x270]
xor eax, eax
cmp dword [edx + 8], edi
setle al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [edx + 8]
setl cl
xor eax, eax
cmp eax, ecx
lea ecx, [ebp - 0x198]
sbb eax, eax
neg eax
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
call fcn.1002fffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1bc]
call fcn.1002fffe
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x37c]
mov ecx, dword [ebp - 0x5c]
push eax
call fcn.10032084
mov esi, eax
lea edi, [ebp - 0x80]
pop ecx
push 2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xe0a8eac8
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], 0x56123d4a
mov dword [ebp - 0x2c], 0x96fd0fe1
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x1003d398
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 0x3b7c39c9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003d38a
mov dword [ebp - 0x14], 0xf
jmp 0x1003d41a
mov dword [ebp - 0x20], 0x1eefb6f6
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x14], ebx
je 0x1003d3ba
xor ecx, ecx
inc ecx
jmp 0x1003d3bc
mov ecx, ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub ecx, 4
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
setl dl
mov dword [ebp - 0x34], edx
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x34]
setne al
add eax, 0xf0df
imul eax, eax, 5
test eax, eax
jne 0x1003d407
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
je 0x1003d3a6
xor edi, edi
mov dword [ebp - 0x24], ebx
inc edi
jmp 0x1003d49f
mov dword [ebp - 0x2c], 0xe181f51b
xor edx, edx
mov dword [ebp - 0x2c], 0x757a8360
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x70]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x70]
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
sub edx, 0x34219488
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, edx
setg cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x14]
cmp eax, edx
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 0x4faf
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1003d428
cmp byte [ebp + 0xc], 0
je 0x1003d874
cmp dword [ebp - 0x78], 0
je 0x1003d874
mov dword [ebp - 0x24], 0x8f69f7fd
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x2c], 0x65c829e
mov dword [ebp - 0x28], 0xc520ea0c
mov dword [ebp - 0x34], 0xffffffff
push edi
call fcn.1002ff7c
mov dword [ebp - 0x20], ebx
jmp 0x1003d4f8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 0xa6ff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003d4e5
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffe
jge 0x1003d510
mov eax, dword [ebp - 0x24]
mov ecx, edi
cmp dword [ebp - 0x24], ebx
jne 0x1003d512
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff7
setl al
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jne 0x1003d52e
mov edx, edi
cmp dword [ebp - 0x24], ebx
jne 0x1003d530
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x68807383
setge al
xor ecx, ecx
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x58e356ec
setge cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1003d59b
mov dword [ebp - 0x28], ebx
jmp 0x1003d57e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 0xf8f9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003d56b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d598
push ebx
push 0x1b1a
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1003d566
lea ecx, [ebp - 0x18c]
call fcn.1002fffe
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x14], 0x1a
cmp dword [ebp - 0x14], 0x18
jle 0x1003d86b
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0xdc8dfba2
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x3c], 0x32a5
cmp dword [ebp - 0x3c], 0x32d1
jle 0x1003d6ab
push 0xd23
push ebx
push 0x72d
push 0x1aff
push 0x1a1e
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], ecx
mov edx, ebx
mov ecx, eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
shl eax, cl
mov dword [ebp - 0x1c], eax
xor eax, edx
lea ecx, [ebp - 0x30c]
or eax, dword [ebp - 0x28]
cdq
push edx
push eax
call fcn.1000db90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d656
mov eax, dword [eax]
push eax
call fcn.1004eea6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x30c]
call fcn.10030308
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
inc edx
mov dword [ebp - 0x2c], edx
cmp edx, 0x335d
jl 0x1003d639
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x6f0b
jl 0x1003d627
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0xb9e
jl 0x1003d622
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x70ff
jl 0x1003d61d
cmp dword [ebp - 0x3c], 0x2ff6
jge 0x1003d6bf
push 0x1000b500
call fcn.1004eea6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1003d6d5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xec], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003d6c8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1003d6ef
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1c], edi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 8
mov eax, dword [ebp - 0xe8]
setge cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0xe4]
cmp ecx, eax
setge dl
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
je 0x1003d75e
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x34], 0x31cd1ac8
mov dword [ebp - 0x1c], 0x9986e3e4
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setge dl
sub edx, 0x72157666
mov dword [ebp - 0x34], edx
jmp 0x1003d83d
mov dword [ebp - 0x2c], 0xe298319b
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x20], ebx
jmp 0x1003d782
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x238], 0x24e19c78
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003d771
mov eax, dword [ebp - 0xe4]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0xe8]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
push 5
setl cl
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe8]
test eax, eax
mov eax, dword [ebp - 0x40]
setns dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setne dl
add edx, dword [ebp - 0x28]
cmp edx, 7
jb 0x1003d7ed
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1003d7ef
mov ecx, edi
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x238]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
add eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp edi, eax
sbb eax, eax
inc eax
cmp eax, edi
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0x9878
cmp eax, 0xf6f5
setg cl
add ecx, 0x5c6484c1
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d863
push ebx
push 0x1092
push 0x1f0a
push ebx
push 0x3fa
push 0x258
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
dec dword [ebp - 0x14]
jmp 0x1003d5c9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x20], 0xdd1e
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0x5741311e
mov dword [ebp - 0x2c], 0xbbd4856c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0xfffffffa
jmp 0x1003d9da
mov dword [ebp - 0x14], 0xd8143836
lea ecx, [ebp - 0x94]
push 4
call fcn.1002ff7c
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 0xa9711f64
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x1003d8dd
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1003d8ce
cmp dword [ebp - 0x1c], ebx
jne 0x1003d98e
dec dword [ebp - 0x2c]
je 0x1003d938
mov eax, dword [ebp - 0x94]
xor edx, edx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xa8db
setl al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf29c
mov edx, dword [ebp - 0x94]
setge cl
sub ecx, 0x1e33ecdc
cmp ecx, dword [edx + 0xc]
je 0x1003d93e
mov eax, edi
jmp 0x1003d940
mov edx, dword [ebp - 0x94]
mov eax, ebx
cmp eax, 0xa36a77d7
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edx]
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
imul eax, ecx
cmp eax, 0x8dad
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x94]
mov edx, ebx
setge cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
cmp eax, 0x3f045180
setge cl
imul eax, ecx, 0x6536
cmp eax, dword [ebp - 0x38]
je 0x1003d990
mov edx, edi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1ac4
setl al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003d9cc
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x94]
call fcn.1002fffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jne 0x1003d8a8
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x1003e400
cmp dword [ebp - 0x80], ecx
jle 0x1003e400
push 3
lea ecx, [ebp - 0xf8]
call fcn.1002ff7c
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1003da19
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003da0c
mov dword [ebp - 0x14], ebx
jmp 0x1003da36
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x45cdbe8e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003da23
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2c], eax
mov dword [eax + 4], ebx
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1003da9a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003da92
push 0x1616
push 0xdf3
push 0x1872
push 0xfac
push 0x1686
push 0x1130
push 0x2348
push 0x4dd
push 0x12df
call dword [sym.imp.GDI32.dll_BitBlt]
dec dword [ebp - 0x1c]
jns 0x1003da56
mov eax, dword [ebp - 0x2c]
inc dword [eax + 4]
cmp dword [eax + 4], esi
jle 0x1003da47
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xf8]
cmp dword [eax], 0xfffffffd
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xac]
jg 0x1003db9f
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x15
jg 0x1003db77
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp dword [eax + 4], ecx
mov eax, dword [ebp - 0xac]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, 0x422f8dc7
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
sub ecx, eax
jne 0x1003db5f
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1003db61
mov eax, edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jle 0x1003dadf
mov dword [ebp - 0x24], 0xfffffff4
jmp 0x1003db97
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003db94
push 0x1bd2
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
je 0x1003db80
jmp 0x1003dbad
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x34], 0xb861a716
lea ecx, [ebp - 0xf8]
call fcn.1002fffe
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x20], ebx
jmp 0x1003dbdb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x178], 0x713b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003dbca
mov dword [ebp - 0x20], ebx
jmp 0x1003ddc2
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c790]
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0xc4], ebx
push eax
push ebx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
movdqu xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0xbc], ebx
call fcn.10031e30
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xc3532716
push 3
call fcn.1002ff7c
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x28], ebx
jmp 0x1003dc5d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003dc4e
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0x38], edx
mov dword [edx + 4], ebx
mov dword [ebp - 0x24], 0x934215e1
mov dword [ebp - 0x40], 0xa2e42846
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x1003dd7c
mov dword [ebp - 0x28], 0xdc2a82a1
mov dword [ebp - 0x34], 0xcd021aa2
mov dword [ebp - 0x28], ebx
jmp 0x1003dd53
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x34], 0x93765224
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003dcca
push 0x1879
push ebx
push ebx
push ebx
push 0x1150
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x1003dd50
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 3
push esi
call fcn.1002ff7c
mov dword [ebp - 0x14], ebx
jmp 0x1003dd08
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x248]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003dcf9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
setl dl
xor eax, eax
cmp edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x34]
setg al
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.1002fffe
dec dword [ebp - 0x1c]
jns 0x1003dcdb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1003dc9f
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x178]
test eax, eax
sete cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x24]
jns 0x1003dc89
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x178]
cmp eax, edi
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
inc dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp dword [edx + 4], edi
jle 0x1003dc6f
lea ecx, [ebp - 0x1d4]
call fcn.1002fffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.1002fffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1003dbe8
mov dword [ebp - 0x24], 0x24ed
cmp dword [ebp - 0x24], 0x27a0
jle 0x1003de41
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x3c], ebx
mov ecx, eax
mov dword [ebp - 0x38], 0x4195
mov dword [ebp - 0x40], ecx
mov eax, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
add eax, ecx
mov ecx, 0x1060e278
or eax, ebx
cdq
push edx
push eax
call fcn.1002fe67
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x67a2
jl 0x1003ddf7
dec ecx
dec dword [ebp - 0x38]
push 0
mov dword [ebp - 0x40], ecx
pop ebx
jne 0x1003ddef
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x2d71
jl 0x1003dde3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x4b0
jl 0x1003ddde
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x34], 0xfffffffb
push 3
call fcn.1002ff7c
push 3
mov dword [ebp - 4], 0x14
pop edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003de82
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003de71
mov dword [ebp - 0x14], ebx
jmp 0x1003de9f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x208]
mov dword [eax + ecx*4], 0xa18e418a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003de8c
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xd
jge 0x1003dff4
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x34], 0x17c10977
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], esi
jg 0x1003dfe9
mov dword [ebp - 0x20], ebx
jmp 0x1003dee1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x134], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003ded0
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x12c], esi
jg 0x1003dfde
mov dword [ebp - 0x20], 0x68044455
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x1003dfd3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003df25
push 0x1093
push 0x158d
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [ebp - 0x38], 0x4462
cmp dword [ebp - 0x38], 0x4502
jle 0x1003dfa0
mov edx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x40], ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
shl eax, cl
lea ecx, [ebp - 0x324]
and eax, edx
cdq
push edx
push eax
call fcn.1000db90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003df60
mov eax, dword [eax]
push eax
call fcn.1004eea6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x324]
call fcn.10030308
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
inc ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x70a3
jl 0x1003df44
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x82b
jl 0x1003df3f
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 0x53d2
jl 0x1003df3a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003dfb0
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [ebp - 0x38], 0x41ef
jge 0x1003dfc4
push 0x1000b56c
call fcn.1004eea6
pop ecx
mov dword [ebp - 4], 0x14
inc dword [ebp - 0x20]
jmp 0x1003df02
inc dword [ebp - 0x12c]
jmp 0x1003deec
inc dword [ebp - 0x28]
push 3
pop edx
jmp 0x1003dec2
dec dword [ebp - 0x3c]
inc dword [ebp - 0x14]
jmp 0x1003dea7
lea ecx, [ebp - 0x208]
call fcn.1002fffe
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x24], 0x23bf
jge 0x1003e01e
mov edx, 0x1000b534
mov ecx, 0x1060e278
call fcn.10031911
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xa50b5f0b
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x14], 0xf59172dd
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0xbb66efe0
mov dword [ebp - 0x34], 0xbfe73744
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0x6de6eab3
push 3
call fcn.1002ff7c
mov dword [ebp - 0x38], 0xb9ab
mov dword [ebp - 0x48], 0x165aae70
mov dword [ebp - 0x4c], 0x41bd8e70
push 3
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0x8d11a6c9
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x58], 0xa6071001
mov dword [ebp - 0x24], ebx
jmp 0x1003e0cb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x128], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003e0ba
mov dword [ebp - 0x24], ebx
jmp 0x1003e0e9
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xc7e011b5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003e0d6
mov dword [ebp - 0x24], ebx
jmp 0x1003e100
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x218], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003e0f3
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x1003e168
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
cmp edx, 0x232c2a4e
jne 0x1003e135
mov edx, ebx
cmp dword [ebp - 0x128], ebx
je 0x1003e137
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x140]
cmp dword [eax + 8], ebx
mov eax, edi
setne cl
cmp ecx, dword [ebp - 0x28]
jne 0x1003e16a
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x128]
setle dl
add edx, 0xa59febb8
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
xor edx, edx
cmp dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x1003e253
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], 0xe816884
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x4c], 0x340c09c4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x4c], 0x961dfa23
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x4c], 0xf8e16d71
mov dword [ebp - 0x4c], 0xcfa70dae
cmp dword [ebp - 0x34], ebx
jne 0x1003e230
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
cmp edx, 7
mov edx, ebx
ja 0x1003e232
mov edx, edi
dec dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], edi
jmp 0x1003e2ae
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jge 0x1003e270
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x210], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e25e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e27f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], ebx
jmp 0x1003e2a8
mov dword [ebp - 0x20], ebx
jmp 0x1003e29f
cmp dword [ebp - 0x14], 0xfffffff8
jl 0x1003e284
lea ecx, [ebp - 0x140]
call fcn.1002fffe
cmp dword [ebp - 0x7c], 0
je 0x1003e400
mov dword [ebp - 0x34], 0xb4e1a362
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0xe3e63e31
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x1003e435
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2d8], 0xe17f7596
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e424
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x80]
call fcn.10038fd4
mov dword [ebp - 0x34], 0x5d6c05ba
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e460
push 0x1319
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e475
push 0x3fb
push ebx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
cmp dword [ebp - 0x44], 0
jne 0x1003e9e2
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x1003e9e2
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x38], 0xafbd13d
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 9
je 0x1003e57f
push esi
lea ecx, [ebp - 0x158]
call fcn.1002ff7c
mov dword [ebp - 0x3c], 0xd99ea7eb
mov dword [ebp - 0x48], 0xb676bd76
mov dword [ebp - 0x1c], ebx
jmp 0x1003e4e8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e4d9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x38]
test eax, eax
jne 0x1003e506
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x40], edi
jge 0x1003e517
mov eax, dword [ebp - 0x158]
mov edx, ebx
cmp dword [eax], ebx
je 0x1003e519
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x2c]
test ecx, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x34]
je 0x1003e552
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x158]
cmp dword [ecx], eax
setl dl
mov dword [ecx], edx
lea ecx, [ebp - 0x158]
call fcn.1002fffe
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x1003e4ba
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x50]
mov ecx, eax
call fcn.1003c5c6
push 3
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xa0], eax
call fcn.1002ff7c
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x50], 0x9e843631
mov dword [ebp - 0x50], 0x43ccc099
mov dword [ebp - 0x34], 0xed5b6062
mov dword [ebp - 0x1c], ebx
jmp 0x1003e5d0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0x7ddc85f7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003e5bd
mov eax, dword [ebp - 0xd0]
add eax, 4
mov dword [eax], ebx
cmp dword [eax], 0xfffffff8
mov dword [ebp - 0x54], eax
jge 0x1003e9c2
mov dword [ebp - 0x2c], 0x7716
cmp dword [ebp - 0x2c], 0x7878
jle 0x1003e678
push 0x16dc
push 0x200a
push 0x11e6
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov ecx, ebx
mov dword [ebp - 0x50], ebx
sar eax, cl
lea ecx, [ebp - 0x354]
cdq
push edx
push eax
call fcn.1000db90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e636
mov eax, dword [eax]
push eax
call fcn.1004eea6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x354]
call fcn.10030308
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x50], ecx
cmp ecx, 0x3010
jl 0x1003e61c
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x6832
jl 0x1003e617
push 0x1521
push 0x11df
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
push 4
lea ecx, [ebp - 0x1b0]
call fcn.1002ff7c
cmp dword [ebp - 0x2c], 0x76ce
jge 0x1003e699
push 0x1000b600
call fcn.1004eea6
pop ecx
mov dword [ebp - 4], 0x1a
mov eax, 0x88acc167
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1003e6d8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003e6c9
mov dword [ebp - 0x24], 0x628b
cmp dword [ebp - 0x24], 0x64c1
jle 0x1003e72b
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
xor eax, ebx
mov ecx, 0x1060e278
cdq
push edx
push eax
call fcn.1002fe67
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 0x7c6b
jl 0x1003e6ff
inc ebx
push 0
mov dword [ebp - 0x2c], ebx
cmp ebx, 0x5963
pop ebx
jl 0x1003e6f7
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0xffffffe6
cmp dword [eax + 0xc], 0x19
jne 0x1003e95c
push esi
lea ecx, [ebp - 0x1ec]
call fcn.1002ff7c
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1003e770
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0x48afa2fa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e75d
mov dword [ebp - 0x28], 0x5672
cmp dword [ebp - 0x28], 0x59d8
jle 0x1003e811
mov dword [ebp - 0x40], ebx
mov edx, ebx
mov dword [ebp - 0x3c], 0x5584
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], ebx
mov ecx, ebx
mov dword [ebp - 0x2c], 0x54f
mov dword [ebp - 0x50], ecx
mov eax, edx
or eax, ecx
lea ecx, [ebp - 0x36c]
cdq
push edx
push eax
call fcn.1000db90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e7c3
mov eax, dword [eax]
push eax
call fcn.1004eea6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x36c]
call fcn.10030308
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
add ecx, eax
dec dword [ebp - 0x2c]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x50], ecx
jne 0x1003e7a7
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x1664
jl 0x1003e79b
mov eax, dword [ebp - 0x40]
add edx, eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x44], edx
jne 0x1003e798
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x1235
jl 0x1003e78c
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ecx
mov dword [eax + 4], ebx
mov dword [ebp - 0x34], 0x4acc
mov dword [ebp - 0x1c], ebx
jmp 0x1003e843
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 0x9f8d19c9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003e832
mov eax, dword [ecx + 8]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [edx + 0xc]
setl cl
mov dword [ebp - 0x50], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x50]
sub eax, 0x4adc6f79
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x38]
setl cl
xor eax, eax
cmp dword [edx + 8], ecx
setl al
cmp eax, 8
mov eax, dword [ebp - 0x34]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x54]
setg cl
add eax, ecx
xor ecx, ecx
cmp eax, dword [edx]
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x2c]
setne cl
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [edx + 4]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x58905b8b
mov ecx, dword [ebp - 0x50]
setle al
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x84]
mov dword [ebp - 0x1f0], ecx
inc dword [eax + 4]
mov ecx, dword [ebp - 0x38]
je 0x1003e826
cmp dword [ebp - 0x28], 0x53aa
jge 0x1003e917
push 0x1000b688
call fcn.1004eea6
pop ecx
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x30], ebx
jmp 0x1003e93c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003e939
push 0x240f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x11
jge 0x1003e923
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x1a
call fcn.1002fffe
mov eax, dword [ebp - 0x14]
inc dword [eax + 0xc]
jmp 0x1003e73b
mov byte [ebp - 4], 0x20
cmp dword [ebp - 0x24], 0x61e6
jge 0x1003e99c
mov edx, 0x1000b648
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1003e99c
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x19
call fcn.1002fffe
mov eax, dword [ebp - 0xd0]
add eax, 4
dec dword [eax]
jmp 0x1003e5e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.1002fffe
lea eax, [ebp - 0x68]
push eax
call fcn.1003eb1d
mov ecx, dword [ebp - 0xa0]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret