Function at 0x1003d1a6
Capabilities:
Check os version
Get file size
Modify service
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006c93b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b8
push ebx
push esi
push edi
mov dword [esp + 0x4c], ecx
or eax, 0xffffffff
push 2
mov dword [esp + 0x2c], 0x7e2799ac
mov esi, edx
mov dword [esp + 0x30], 0x4f4fcf42
pop edi
mov dword [esp + 0x28], 0xffffffe6
push 0
mov dword [esp + 0x40], esi
pop ebx
cmp dword [esp + 0x28], eax
jge 0x1003d54e
or esi, eax
push edi
lea ecx, [esp + 0xbc]
call fcn.1002c487
mov dword [esp + 0x2cc], ebx
mov dword [esp + 0x2c], 6
mov dword [esp + 0x14], ebx
jmp 0x1003d232
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x16c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003d223
mov dword [esp + 0x14], ebx
jmp 0x1003d254
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003d23e
mov eax, dword [esp + 0xb8]
mov dword [eax], ebx
xor eax, eax
lea ecx, [esp + 0x13c]
inc eax
mov dword [esp + 0x18], eax
push eax
call fcn.1002c487
mov dword [esp + 0x34], 0x37e8f884
mov dword [esp + 0x30], ebx
jmp 0x1003d297
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 1
jl 0x1003d285
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 1
jg 0x1003d3c1
mov esi, dword [esp + 0xb8]
mov dword [esp + 0x14], 0x89a69576
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ebx
jmp 0x1003d2f8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d2de
push 0x2505
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d2f4
push 0x1d86
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x1003d2c6
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x16c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x16c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
cmp dword [eax], 1
setge cl
mov dword [esp + 0x34], ecx
cmp dword [esp + 0x34], ebx
je 0x1003d359
cmp dword [esp + 0x2c], ebx
je 0x1003d359
xor edx, edx
inc edx
jmp 0x1003d35b
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xb8]
setne cl
cmp ecx, dword [eax]
jl 0x1003d380
mov eax, dword [esp + 0x13c]
cmp dword [eax], ebx
jne 0x1003d380
mov ecx, ebx
jmp 0x1003d383
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x538fd232
setne al
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x28]
setns cl
xor edx, edx
cmp ecx, 0xb0bb
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [esi + 4]
mov dword [esp + 0x34], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1003d2b4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d3db
push ebx
push 1
push 0x643
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
lea ecx, [esp + 0x13c]
call fcn.1002c55e
mov eax, dword [esp + 0xb8]
push 0xffffffffffffffff
pop esi
inc dword [eax]
cmp dword [eax], 1
jle 0x1003d263
mov dword [esp + 0x2c], 0x1b80
cmp dword [esp + 0x2c], 0xdc2
jge 0x1003d51e
lea eax, [esp + 0x5c]
push eax
push 0x100077e4
call fcn.1005459b
mov eax, dword [esp + 0x64]
cdq
pop ecx
sub eax, edx
pop ecx
sar eax, 1
lea ecx, [esp + 0xe0]
push eax
call fcn.1002c487
mov byte [esp + 0x2cc], 1
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0xe0]
cdq
sub eax, edx
mov dword [esp + 0x2c], ebx
sar eax, 1
test eax, eax
jle 0x1003d47d
mov edi, esi
push edi
push 0x100077e4
call fcn.1005459b
pop ecx
pop ecx
push 4
pop eax
add edi, eax
inc ebx
mov eax, dword [esp + 0x5c]
cdq
sub eax, edx
sar eax, 1
cmp ebx, eax
jl 0x1003d45b
xor ebx, ebx
push dword [esp + 0xe4]
push esi
call fcn.100308d4
mov eax, dword [esp + 0x64]
mov edi, ebx
cdq
sub eax, edx
mov dword [esp + 0x24], ebx
mov edx, eax
sar edx, 1
pop ecx
pop ecx
test edx, edx
jle 0x1003d4c3
mov dword [esp + 0x2c], ebx
mov eax, ebx
mov ecx, ebx
sub ecx, dword [esi + edi*4]
add ecx, 2
jns 0x1003d4b3
neg ecx
add eax, ecx
add ebx, 2
inc edi
cmp edi, edx
jl 0x1003d4a7
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov ecx, ebx
mov edi, ebx
test edx, edx
jle 0x1003d4e5
mov dword [esp + 0x2c], ebx
mov eax, ebx
sub eax, dword [esi + edi*4]
inc eax
jns 0x1003d4d9
neg eax
add ecx, eax
add ebx, 2
inc edi
cmp edi, edx
jl 0x1003d4cf
xor ebx, ebx
cmp dword [esp + 0x1c], ecx
cmovl ecx, dword [esp + 0x1c]
push ecx
push 0x100077f4
call fcn.10054c24
pop ecx
pop ecx
test esi, esi
je 0x1003d51b
push esi
call fcn.10054df9
pop ecx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
push 2
pop edi
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xb8]
mov dword [esp + 0x2c], eax
or esi, 0xffffffff
mov dword [esp + 0x2cc], esi
call fcn.1002c55e
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x1003d201
mov esi, dword [esp + 0x3c]
push 1
lea ecx, [esp + 0x164]
call fcn.1002c487
mov dword [esp + 0x28], ebx
push 4
mov dword [esp + 0x1c], 0x8ce3e63e
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], ebx
jmp 0x1003d587
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1003d575
mov dword [esp + 0x14], ebx
jmp 0x1003d5a3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x298], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003d594
mov eax, dword [esp + 0x160]
push 0xfffffffffffffff9
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
pop eax
sub eax, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
add ecx, dword [eax]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], 0x18
cmp dword [esp + 0x18], 0xb
jne 0x1003d64e
or esi, 0xffffffff
mov dword [esp + 0x30], 0xffff
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], esi
jmp 0x1003d638
mov dword [esp + 0x28], ebx
jmp 0x1003d62d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d629
push 0x12ae
push ebx
push 0x319
push 0x27d
push ebx
push 0x139b
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffff6
je 0x1003d602
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x38
je 0x1003d5fc
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xb
je 0x1003d5e6
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x160]
call fcn.1002c55e
mov eax, dword [0x1154a5e0]
test al, 1
jne 0x1003d701
or eax, 1
mov dword [0x1154a5e0], eax
push ebx
mov dword [esp + 0x2d0], edi
push ebx
mov dword [0x1154a5c0], ebx
mov dword [0x1154a5c4], ebx
call fcn.10040023
mov dword [0x1154a5c0], eax
mov dword [0x1154a5c8], ebx
mov dword [0x1154a5d0], ebx
push 4
pop ecx
mov byte [esp + 0x2cc], cl
mov ecx, 0x1154a5c8
mov dword [esp + 0x124], eax
lea eax, [esp + 0x124]
push eax
push 0x10
push ebx
lea eax, [esp + 0x208]
mov dword [0x1154a5dc], 0x3f800000
push eax
mov dword [0x1154a5cc], ebx
call fcn.1003fdfb
push 0x1006cfe0
mov dword [0x1154a5d4], 7
mov dword [0x1154a5d8], 8
call fcn.10054a8b
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x2cc], eax
imul eax, dword [esp + 0x4c], 0x2710
add eax, esi
mov dword [esp + 0x98], eax
lea eax, [esp + 0x98]
push eax
call fcn.1003f712
mov edi, dword [eax]
mov dword [esp + 0x38], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d74d
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x803
push 0x1398
push 0x1edb
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d764
push 0x1e12
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
test edi, edi
je 0x1003d9a4
mov eax, 0x2d5e48d3
lea ecx, [esp + 0x214]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
xor eax, eax
inc eax
mov dword [esp + 0x14], 0x52061f6
mov dword [esp + 0x3c], eax
push eax
call fcn.1002c487
mov dword [esp + 0x2cc], 5
mov dword [esp + 0x30], ebx
jmp 0x1003d7d0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x214]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 1
jl 0x1003d7ba
push 3
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1003d83e
push 1
lea ecx, [esp + 0x158]
call fcn.1002c487
xor edx, edx
mov dword [esp + 0x30], ebx
inc edx
jmp 0x1003d809
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edx
jl 0x1003d7f7
mov eax, dword [esp + 0x154]
mov dword [eax], esi
mov eax, dword [eax]
cmp dword [esp + eax*4 + 0xa8], ebx
jne 0x1003d82e
mov eax, dword [esp + 0x154]
dec dword [eax]
jns 0x1003d818
lea ecx, [esp + 0x154]
call fcn.1002c55e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1003d7e0
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
je 0x1003d855
mov eax, dword [esp + 0xb4]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x214]
mov eax, dword [esp + 0xac]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0x14]
or eax, 0xffffffff
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x2cc], eax
call fcn.1002c55e
mov dword [esp + 0x30], 0x76820624
or eax, 0xffffffff
mov dword [esp + 0x2c], 0x3e7ed6f1
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x9193c1de
mov dword [esp + 0x38], 0x8b922806
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xec], edi
mov dword [esp + 0x30], ebx
jmp 0x1003d97a
mov dword [esp + 0x20], 0xfffffffe
lea ecx, [esp + 0x198]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], 0x8cf5a8b0
push esi
call fcn.1002c487
mov dword [esp + 0x24], ebx
jmp 0x1003d91f
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x38d927f7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1003d909
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x1c]
test eax, eax
je 0x1003d951
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x198]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x198]
mov eax, dword [eax + 8]
sub dword [esp + 0x28], eax
call fcn.1002c55e
inc dword [esp + 0x30]
push 0xffffffffffffffff
pop eax
cmp dword [esp + 0x30], 0x1d
jle 0x1003d8de
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f483
push 0x1aaf
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x1003f483
push 1
lea ecx, [esp + 0x178]
call fcn.1002c487
mov dword [esp + 0x30], ebx
jmp 0x1003d9ce
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0x1928c176
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 1
jl 0x1003d9b8
mov eax, dword [esp + 0x174]
lea ecx, [esp + 0x174]
mov dword [eax], 0xfffffffe
call fcn.1002c55e
mov eax, dword [0x1154a5e0]
test al, 2
jne 0x1003da97
or eax, 2
mov dword [0x1154a5e0], eax
push ebx
mov dword [esp + 0x2d0], 6
push ebx
mov dword [0x1154a5a0], ebx
mov dword [0x1154a5a4], ebx
call fcn.10040023
mov dword [0x1154a5a0], eax
mov dword [0x1154a5a8], ebx
mov dword [0x1154a5b0], ebx
mov byte [esp + 0x2cc], 8
mov ecx, 0x1154a5a8
mov dword [esp + 0x120], eax
lea eax, [esp + 0x120]
push eax
push 0x10
push ebx
lea eax, [esp + 0x9c]
mov dword [0x1154a5bc], 0x3f800000
push eax
mov dword [0x1154a5ac], ebx
call fcn.1003fdfb
push 0x1006cfdb
mov dword [0x1154a5b4], 7
mov dword [0x1154a5b8], 8
call fcn.10054a8b
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], 0x7b1891f7
mov dword [esp + 0x2c], 0x138d
cmp dword [esp + 0x2c], 0x7b1
push 3
pop esi
jge 0x1003dc4b
lea eax, [esp + 0x54]
push eax
push 0x100077e4
call fcn.1005459b
pop ecx
jmp 0x1003dc39
dec eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
push eax
push 0x100077e4
call fcn.1005459b
pop ecx
mov edi, ebx
mov dword [esp + 0x80], ebx
pop ecx
mov dword [esp + 0x78], edi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x2cc], 9
mov eax, dword [esp + 0x44]
push 2
pop ecx
mov dword [esp + 0x70], ecx
lea edx, [eax + 0xa]
cmp edx, 4
jl 0x1003db63
mov ebx, eax
mov edi, edx
mov eax, ebx
jmp 0x1003db44
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x7c]
call fcn.1002c659
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x70]
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x44], ebx
cdq
idiv ecx
test edx, edx
je 0x1003db25
inc ecx
mov eax, ecx
mov dword [esp + 0x70], ecx
imul eax, ecx
cmp eax, edi
jle 0x1003db21
mov edi, dword [esp + 0x78]
xor ebx, ebx
mov eax, dword [esp + 0x44]
cmp eax, 1
jle 0x1003db7a
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x7c]
call fcn.1002c659
mov edi, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
sub ecx, edi
sar ecx, 2
cmp ecx, esi
push 1
sbb al, al
inc al
mov byte [esp + 0x17], al
pop eax
mov dword [esp + 0x30], eax
je 0x1003dc08
mov ebx, dword [edi + 4]
push 2
pop edx
cmp dword [edi], ebx
jne 0x1003dbae
mov edx, dword [edi + 8]
imul edx, ebx
mov dword [esp + 0x24], edx
mov edx, esi
jmp 0x1003dbb2
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x30]
push 0
pop ebx
cmp edx, ecx
jae 0x1003dc00
mov ebx, eax
imul ebx, dword [edi + edx*4]
inc edx
cmp edx, ecx
jb 0x1003dbbf
mov ecx, dword [esp + 0x24]
cmp ebx, 1
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x30]
push 0
pop ebx
jle 0x1003dc04
cmp eax, dword [edi]
je 0x1003dc04
cmp eax, ecx
je 0x1003dc04
mov dl, byte [esp + 0x13]
test dl, dl
je 0x1003dc08
push eax
mov eax, dword [edi]
push ecx
push eax
push 0x10007a40
call fcn.10054c24
add esp, 0x10
jmp 0x1003dc13
mov ecx, dword [esp + 0x24]
mov dl, bl
jmp 0x1003dbe8
push 0x10007804
call fcn.10055012
pop ecx
or eax, 0xffffffff
mov dword [esp + 0x2cc], eax
test edi, edi
je 0x1003dc3a
push edi
call fcn.10054df9
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
pop ecx
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x1003dad5
dec eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x2c], 8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003dc79
push 0x18f5
push ebx
push 0x1e3e
push 0xfc7
push 0x1941
call dword [sym.imp.GDI32.dll_ExtFloodFill]
cmp dword [esp + 0x1c], ebx
je 0x1003dc98
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
jmp 0x1003dd22
mov dword [esp + 0x28], 0x9d01
mov dword [esp + 0x34], 0xfa1a8f1e
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x1c], ebx
je 0x1003dcbe
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, 0x9150
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, 0x4082
setge dl
xor ecx, ecx
add edx, 0xffff
cmp edx, eax
setl cl
sub ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
add edx, dword [esp + 0x28]
cmp esi, edx
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], 1
or eax, 0xffffffff
xor edx, edx
xorps xmm0, xmm0
movdqu xmmword [esp + 0xd0], xmm0
mov dword [esp + 0x14], 7
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x86d6dbc1
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], 6
mov dword [esp + 0x2c], 0xfc53d8b3
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], 0x6aa1dd5c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x2fe81720
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x30], ebx
jne 0x1003de0e
push 4
pop ecx
jmp 0x1003decc
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x18c], 5
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x1003ddfb
mov dword [esp + 0x18], 0xfffffff2
cmp dword [esp + 0x18], 0x18
jne 0x1003dedd
push 2
pop ecx
mov dword [esp + 0x28], ebx
jmp 0x1003de89
mov dword [esp + 0x14], ebx
jmp 0x1003de52
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x18c], ebx
jne 0x1003de58
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x18c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x1003de36
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jl 0x1003de85
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
jl 0x1003de7f
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x18c], ebx
jne 0x1003de7f
dec dword [esp + 0x14]
jns 0x1003de6c
dec dword [esp + 0x24]
jns 0x1003de62
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ecx
jle 0x1003de30
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003dea8
push 0x209c
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 2
pop ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
je 0x1003de2a
jmp 0x1003dedd
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x2a0], 1
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ecx
jl 0x1003deb9
mov dword [esp + 0x2a4], 1
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x1c]
test eax, eax
je 0x1003def4
cmp dword [esp + 0x20], ebx
je 0x1003def4
xor edi, edi
inc edi
jmp 0x1003def6
mov edi, ebx
cmp dword [esp + 0x18], ebx
jne 0x1003df44
mov eax, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, 0xfff9
setg dl
cmp eax, edx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [esp + 0x24]
cmp ecx, 0x3978
setge al
cmp eax, 0xb00b7228
jb 0x1003df44
mov eax, ebx
jmp 0x1003df47
xor eax, eax
inc eax
xor edx, edx
cmp edi, eax
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
lea eax, [esp + 0x4c]
push eax
setge cl
mov dword [esp + 0x24], ecx
call fcn.1003f774
mov edi, dword [eax]
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x1c], 0x7374489b
mov dword [esp + 0x20], 0xde6eab3a
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 0x11
mov dword [esp + 0x30], edi
jg 0x1003e2a2
push esi
lea ecx, [esp + 0x14c]
call fcn.1002c487
mov dword [esp + 0x2cc], 0xa
mov dword [esp + 0x18], 0x2edc7555
mov dword [esp + 0x34], 1
mov dword [esp + 0x34], 0x2d63d2c8
mov dword [esp + 0x2c], 0x169b
cmp dword [esp + 0x2c], 0x122c
jge 0x1003e0e7
lea eax, [esp + 0x60]
push eax
push 0x100077e4
call fcn.1005459b
mov eax, dword [esp + 0x68]
pop ecx
pop ecx
lea ecx, [esp + 0x11c]
mov dword [esp + 0x11c], ebx
push ecx
inc eax
mov dword [esp + 0xa0], ebx
push eax
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.1002cfd9
mov edx, dword [esp + 0x60]
mov edi, dword [esp + 0x9c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x34], ebx
test edx, edx
jle 0x1003e093
mov esi, ebx
lea eax, [esp + 0x94]
push eax
push 0x100077e4
call fcn.1005459b
mov eax, dword [esp + 0x9c]
pop ecx
pop ecx
cmp eax, ebx
jle 0x1003e06f
or dword [edi + eax*4], 0xffffffff
mov esi, ebx
mov ebx, eax
jmp 0x1003e07d
cmp eax, esi
jle 0x1003e07d
inc dword [edi + ebx*4]
mov esi, dword [esp + 0x94]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x60]
inc eax
mov dword [esp + 0x34], eax
cmp eax, edx
jl 0x1003e046
push 3
xor ebx, ebx
pop esi
xor ecx, ecx
inc ecx
cmp edx, ecx
jl 0x1003e0b7
push 4
pop eax
mov ebx, eax
mov eax, dword [edi + ecx*4]
cmp eax, dword [ebx + edi]
jle 0x1003e0b0
mov ebx, ecx
mov dword [esp + 0x24], ecx
shl ebx, 2
inc ecx
cmp ecx, edx
jle 0x1003e09f
xor ebx, ebx
push dword [esp + 0x24]
push 0x100077f4
call fcn.10054c24
pop ecx
pop ecx
test edi, edi
je 0x1003e0e7
push edi
call fcn.10054df9
pop ecx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x2c], 0xde97ee8c
mov dword [esp + 0x14], ebx
jmp 0x1003e10b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0x7e8b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003e0f5
mov dword [esp + 0x14], ebx
jmp 0x1003e12a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x22c], 0xa1f05067
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003e117
push 2
mov dword [esp + 0x18], ebx
pop edi
jmp 0x1003e14c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x200], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003e139
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1003e1d9
or esi, 0xffffffff
mov dword [esp + 0x1c], ebx
xor edx, edx
push 4
pop eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x22c], 0x5b641b44
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, esi
setge cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [esp + 0x18]
imul edx, dword [esp + 0x28]
sub edx, 7
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
imul eax, dword [esp + 0x1c], 6
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x204]
dec dword [esp + 0x18]
jns 0x1003e15f
push 3
pop esi
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1003e279
mov edi, dword [esp + 0x148]
xor ecx, ecx
mov dword [esp + 0x24], ebx
inc ecx
jmp 0x1003e207
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x74], 0xfffffffd
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1003e1f7
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x74], ebx
jne 0x1003e21b
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x22c], ecx
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
add eax, 0x771fda66
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x148]
mov ecx, dword [edi + 4]
mov dword [eax + edx*4], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x74]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x20]
cmp eax, ecx
setne dl
mov dword [esp + 0x2c], edx
dec dword [esp + 0x18]
jns 0x1003e1ee
or eax, 0xffffffff
lea ecx, [esp + 0x148]
mov dword [esp + 0x2cc], eax
call fcn.1002c55e
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x11
jle 0x1003df94
mov edi, dword [esp + 0x30]
cmp byte [ebp + 0xc], 0
jne 0x1003e2b0
test edi, edi
jne 0x1003e578
push 2
lea ecx, [esp + 0x248]
call fcn.1002c487
mov dword [esp + 0x2c], esi
or esi, 0xffffffff
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jge 0x1003e2e4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x244]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
jmp 0x1003e2c9
push 4
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x1003e300
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1e0], 0xeef20fe6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1003e2ed
xor edx, edx
inc edx
mov dword [esp + 0x1e4], edx
cmp dword [esp + 0x1e4], ebx
jl 0x1003e339
mov dword [esp + 0x1c], esi
xor ecx, ecx
dec dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, edx
setge cl
mov dword [esp + 0x2c], ecx
dec dword [esp + 0x1e4]
jns 0x1003e319
lea ecx, [esp + 0x244]
call fcn.1002c55e
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2b0]
mov ecx, dword [esp + 0x4c]
push eax
call fcn.10032c04
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0xd4]
mov esi, eax
pop ecx
push 3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
je 0x1003e574
cmp dword [esp + 0xd8], 0
je 0x1003e574
mov eax, dword [esp + 0xdc]
lea ecx, [esp + 0x180]
push esi
mov dword [esp + 0xf4], eax
call fcn.1002c487
mov dword [esp + 0x2cc], 0xb
mov dword [esp + 0x34], 9
mov dword [esp + 0x20], ebx
jmp 0x1003e3cc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0x62d5e48d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003e3b6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e3ea
push 1
push 0x265b
call dword [sym.imp.USER32.dll_EnableWindow]
mov edi, dword [esp + 0x180]
mov dword [edi + 4], 1
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], 0x2e6e7f73
mov dword [esp + 0x1c], 0xce3c
mov dword [esp + 0x28], 0x2e3ca369
mov dword [esp + 0x20], ebx
jmp 0x1003e430
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1b0], 0x3c8fc558
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003e41d
mov dword [esp + 0x2c], 0x18f0
cmp dword [esp + 0x2c], 0xa8c
jge 0x1003e49a
lea eax, [esp + 0x50]
push eax
push 0x100077e4
call fcn.1005459b
pop ecx
pop ecx
jmp 0x1003e48d
dec eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x128]
push eax
push 0x100077e4
call fcn.1005459b
mov eax, dword [esp + 0x130]
inc eax
cdq
sub eax, edx
sar eax, 1
push eax
push 0x100077f4
call fcn.10054c24
add esp, 0x10
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x1003e45b
dec eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1003e50a
push 1
lea ecx, [esp + 0x1cc]
call fcn.1002c487
mov dword [esp + 0x20], ebx
jmp 0x1003e4d2
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x1003e4bc
mov eax, dword [esp + 0x1c8]
dec dword [eax]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x1b0]
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x1b0], ecx
lea ecx, [esp + 0x1c8]
call fcn.1002c55e
dec dword [esp + 0x24]
jns 0x1003e4a8
imul eax, dword [edi + 4], 3
mov ecx, dword [esp + 0x1b0]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x34], ecx
je 0x1003e52d
cmp dword [esp + 0x1c], ebx
je 0x1003e52d
xor eax, eax
inc eax
jmp 0x1003e52f
mov eax, ebx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
dec dword [edi + 4]
cmp dword [edi + 4], 0xffffffe2
mov dword [esp + 0x24], 1
jge 0x1003e3f8
or eax, 0xffffffff
lea ecx, [esp + 0x180]
mov dword [esp + 0x2cc], eax
call fcn.1002c55e
mov eax, dword [esp + 0xd8]
mov dword [esp + 0xf4], eax
mov edi, dword [esp + 0x30]
push esi
lea ecx, [esp + 0x20c]
call fcn.1002c487
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], ebx
jmp 0x1003e5a9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003e593
push 2
mov dword [esp + 0x28], ebx
pop eax
jmp 0x1003e5e0
mov dword [esp + 0x20], 7
mov dword [esp + 0x20], ebx
jmp 0x1003e5d6
mov dword [esp + 0x2c], 0x65121ac4
mov dword [esp + 0x2c], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x1003e5c6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x1003e5b8
lea ecx, [esp + 0x208]
call fcn.1002c55e
test edi, edi
jne 0x1003f09d
cmp dword [esp + 0xd0], edi
jle 0x1003f09d
or edi, 0xffffffff
lea ecx, [esp + 0x220]
mov dword [esp + 0x24], edi
push esi
call fcn.1002c487
mov dword [esp + 0x2cc], 0xc
mov dword [esp + 0x20], ebx
jmp 0x1003e642
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x220]
mov dword [eax + ecx*4], 0x9d786592
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003e62c
mov dword [esp + 0x24], 0xb
jmp 0x1003e6bc
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x38], ebx
push 1
call fcn.1002c487
mov dword [esp + 0x20], ebx
jmp 0x1003e684
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1f0]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x1003e66e
mov dword [esp + 0x20], 0xffffffe6
jmp 0x1003e6a5
mov dword [esp + 0x34], 0xffff
dec dword [esp + 0x34]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 6
jne 0x1003e695
lea ecx, [esp + 0x1f0]
call fcn.1002c55e
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jle 0x1003e652
lea ecx, [esp + 0x220]
mov dword [esp + 0x2cc], edi
call fcn.1002c55e
push esi
lea ecx, [esp + 0x88]
call fcn.1002c487
mov dword [esp + 0x2cc], 0xd
lea ecx, [esp + 0x250]
mov dword [esp + 0x2c], 0xbbf9acf2
mov dword [esp + 0x34], 0x34c865b4
mov dword [esp + 0x24], 0xffff
push 1
call fcn.1002c487
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], 6
mov dword [esp + 0x1c], 0x10ca1d2
mov dword [esp + 0x18], ebx
jmp 0x1003e744
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1003e72e
mov dword [esp + 0x18], ebx
jmp 0x1003e762
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x250]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1003e750
mov edx, dword [esp + 0x84]
lea edi, [edx + 8]
cmp dword [edi], 0x6748f69f
je 0x1003e7f2
inc dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x84]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1003e7d1
cmp dword [esp + 0x24], ebx
je 0x1003e7b5
mov eax, dword [esp + 0x2c]
push 0xfffffffffffffffc
pop ecx
sub ecx, eax
sub ecx, 0xea0
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 1
jle 0x1003e7b5
xor eax, eax
inc eax
jmp 0x1003e7b7
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x84]
setne cl
imul ecx, dword [eax + 4]
test ecx, ecx
jne 0x1003e7d1
mov edx, ebx
jmp 0x1003e7d4
xor edx, edx
inc edx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x84]
setg cl
cmp ecx, dword [edi]
jle 0x1003e7f2
cmp dword [edx], ebx
jne 0x1003e7f2
mov ecx, ebx
jmp 0x1003e7f5
xor ecx, ecx
inc ecx
xor eax, eax
test ecx, ecx
sete al
xor ecx, ecx
cmp dword [edx], 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
setne cl
imul eax, ecx
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
add eax, dword [edi]
je 0x1003e876
mov dword [esp + 0x2c], 0x6aeab669
cmp dword [esp + 0x2c], ebx
je 0x1003e846
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
mov eax, dword [edi]
mov dword [esp + 0x2c], eax
jmp 0x1003e96b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e85c
push 0x144f
call dword [sym.imp.USER32.dll_IsIconic]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e96b
call dword [sym.imp.GDI32.dll_GdiFlush]
jmp 0x1003e96b
mov dword [esp + 0x28], 0x57f0
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x34], 0xcfa8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
jmp 0x1003e8a8
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x6c], 0x1d5bc3f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1003e898
mov eax, dword [esp + 0x28]
cmp dword [edi], ebx
je 0x1003e902
xor ecx, ecx
mov dword [esp + 0x1c], 0xd3f1
mov eax, dword [esp + 0x1c]
mov edx, dword [edi]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, edx
push 0
setle cl
cmp ecx, edx
pop ecx
setg cl
sub ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x84]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax + 4]
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x28]
jle 0x1003e902
xor eax, eax
inc eax
jmp 0x1003e904
mov eax, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
sub eax, dword [edi]
je 0x1003e920
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x6c]
add eax, 0x2486
cmp eax, 0x74c1
mov eax, dword [esp + 0x34]
setne cl
xor edx, edx
cmp ecx, 0xbebc
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x6c]
neg ecx
sbb ecx, ecx
add ecx, 0xffff9ead
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x250]
call fcn.1002c55e
or edi, 0xffffffff
lea ecx, [esp + 0x84]
mov dword [esp + 0x2cc], edi
call fcn.1002c55e
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x28], 6
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], 0xa7fc
mov dword [esp + 0x14], 0x5be734e2
push 1
call fcn.1002c487
xor edx, edx
mov dword [esp + 0x38], 0x7b405a81
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1003e9e2
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0xc011
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1003e9cc
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], edi
jge 0x1003ebed
jmp 0x1003ea03
xor edx, edx
inc edx
mov dword [esp + 0x18], 0x23fa
mov dword [esp + 0x24], 0x6aac8953
mov dword [esp + 0x34], 0x5e1b
mov dword [esp + 0x20], 0x36fa7abe
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
jne 0x1003ea57
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], 0xe81de982
jbe 0x1003ead8
mov dword [esp + 0x20], 0x728ad64d
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0xdfcc
setl cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jne 0x1003ea9b
cmp dword [esp + 0x64], 0xfffffffe
jge 0x1003ea9b
mov esi, ebx
jmp 0x1003ea9e
xor esi, esi
inc esi
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp esi, eax
setle cl
xor eax, eax
cmp edx, ecx
setg al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x14], ebx
jne 0x1003ebdc
jmp 0x1003eb63
mov dword [esp + 0x20], 0x925b974d
xor edx, edx
mov dword [esp + 0x48], 0x2e0c
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x18]
cmp eax, 0x9adbd3d3
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
imul eax, ecx, 0x5c53
sub eax, 0x4fdaf0db
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x14]
cmp eax, 1
mov eax, dword [esp + 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
jne 0x1003eb49
cmp dword [esp + 0x48], ebx
jne 0x1003eb49
mov eax, ebx
jmp 0x1003eb4c
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003eb63
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x2c], ebx
je 0x1003eba7
mov eax, dword [esp + 0x1a4]
mov esi, dword [esp + 0x28]
push 2
pop ecx
sub ecx, dword [eax]
mov eax, dword [esp + 0x34]
add esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
sub edx, 0x9559
cmp eax, edx
setl cl
cmp dword [esp + 0x1c], ecx
je 0x1003eba7
xor eax, eax
inc eax
jmp 0x1003eba9
mov eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
je 0x1003ebbe
cmp dword [esp + 0x38], ebx
je 0x1003ebbe
xor eax, eax
inc eax
jmp 0x1003ebc0
mov eax, ebx
mov edx, dword [esp + 0x2c]
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x34]
sub edx, 0xeec2f9c
cmp edx, eax
setg cl
mov dword [esp + 0x20], ecx
dec dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x1003ea00
push 3
pop esi
lea ecx, [esp + 0x1a4]
call fcn.1002c55e
push 4
pop eax
push eax
lea ecx, [esp + 0xfc]
call fcn.1002c487
push 4
mov dword [esp + 0x2d0], 0xe
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1003ec2f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1003ec1d
mov dword [esp + 0x18], ebx
jmp 0x1003ec4e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc4], 0x42fafece
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1003ec3b
mov edi, dword [esp + 0xf8]
mov dword [esp + 0x64], edi
mov dword [edi + 8], 0x11
mov dword [esp + 0x24], 0xfe64fd9e
lea ecx, [esp + 0x238]
mov dword [esp + 0x18], 0xf80c3414
push 1
call fcn.1002c487
mov byte [esp + 0x2cc], 0xf
lea eax, [esp + 0x26c]
push dword [esp + 0x90]
movdqa xmm0, xmmword [0x10007fd0]
lea ecx, [esp + 0x114]
push eax
lea eax, [esp + 0x264]
mov dword [esp + 0x118], ebx
push eax
push ebx
movdqu xmmword [esp + 0x26c], xmm0
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
call fcn.100318d0
mov dword [esp + 0x1c], ebx
jmp 0x1003ecf2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x238]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1003ecdc
xor eax, eax
or ecx, 0xffffffff
cmp dword [edi + 8], ecx
setge al
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, 0x1245
sub eax, dword [edi + 8]
je 0x1003ee5a
mov dword [esp + 0x2c], 0x15ed761e
mov dword [esp + 0x48], 0x856a759f
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jg 0x1003ee6d
mov dword [esp + 0x34], 1
mov dword [esp + 0x20], 9
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1003ee46
mov edi, dword [esp + 0xf8]
mov dword [esp + 0x38], 0x3bf58aae
mov dword [esp + 0x1c], ebx
jmp 0x1003ed86
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x28c], 0xfffffff9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003ed73
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
neg ecx
dec dword [esp + 0x34]
mov eax, dword [esp + 0x110]
mov edx, dword [eax]
mov eax, 0x97e65fbc
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
xor eax, eax
cmp edx, ecx
mov ecx, dword [esp + 0x34]
setl al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
je 0x1003edda
cmp dword [esp + 0x2c], ebx
je 0x1003edda
xor edx, edx
inc edx
jmp 0x1003eddc
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
xor eax, eax
cmp dword [edi + 4], 1
setne al
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x1003ee1d
cmp dword [esp + 0x20], ebx
je 0x1003ee1d
xor ecx, ecx
inc ecx
jmp 0x1003ee1f
mov ecx, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x28c], ecx
dec dword [esp + 0x18]
jns 0x1003ed65
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x1003ed40
mov edi, dword [esp + 0x64]
jmp 0x1003ee6d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003ee6d
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
lea ecx, [esp + 0x110]
call fcn.1002c55e
lea ecx, [esp + 0x238]
mov byte [esp + 0x2cc], 0xe
call fcn.1002c55e
dec dword [edi + 8]
cmp dword [edi + 8], 0xffffffe3
jg 0x1003ec66
push 4
mov dword [esp + 0xcc], ebx
pop edx
jmp 0x1003eec2
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x589a4582
inc dword [esp + 0xc8]
cmp dword [esp + 0xc8], edx
jl 0x1003eea6
or eax, 0xffffffff
lea ecx, [esp + 0xf8]
mov dword [esp + 0x2cc], eax
call fcn.1002c55e
cmp dword [esp + 0xd4], 0
je 0x1003f09d
push esi
lea ecx, [esp + 0x1c0]
call fcn.1002c487
mov dword [esp + 0x38], 0xe7d214c4
mov dword [esp + 0x38], 0x7822e6e
mov dword [esp + 0x1c], ebx
jmp 0x1003ef28
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0x62d5e48d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003ef12
mov eax, dword [esp + 0x1bc]
lea ecx, [esp + 0x1bc]
mov dword [eax], ebx
call fcn.1002c55e
mov ecx, dword [esp + 0xd4]
call fcn.1003d170
push 4
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1d8]
pop eax
mov dword [esp + 0x28], 2
mov dword [esp + 0x24], 0xfffffff8
push eax
call fcn.1002c487
push 4
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1003ef92
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 0x3dd61fb9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1003ef7c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003efb0
push 1
push 0x265b
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esp + 0x28], ebx
je 0x1003efc5
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x28]
je 0x1003efc5
xor edi, edi
inc edi
jmp 0x1003efc7
mov edi, ebx
mov eax, dword [esp + 0x28]
xor edx, edx
add eax, 0x222c0ba
cmp eax, 1
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp edi, eax
sete cl
cmp edx, ecx
je 0x1003f020
cmp dword [esp + 0x28], ebx
jne 0x1003f020
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003effe
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [esp + 0x24], esi
cmp dword [esp + 0x24], ebx
jl 0x1003f081
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1d4]
cmp dword [eax + ecx*4], ebx
jne 0x1003f081
dec dword [esp + 0x24]
jns 0x1003f008
jmp 0x1003f081
xor ecx, ecx
mov dword [esp + 0x34], 0xfffffffe
mov eax, dword [esp + 0x34]
cmp eax, 0x3303
setg cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x34]
cmp eax, 1
setle cl
xor eax, eax
sub ecx, 0x6d193f4d
cmp ecx, 0x4593f6a0
mov ecx, 0xef339200
setl al
imul eax, eax, 0x76fb
cmp ecx, eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x56e623b2
setl al
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1d4]
call fcn.1002c55e
lea eax, [esp + 0x4c]
push eax
call fcn.1003f774
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
or eax, 0xffffffff
mov dword [esp + 0x14], eax
push 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x1003f0c4
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x26c], 0x53f0
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1003f0b1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jne 0x1003f11d
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
sub edx, 0x5c6f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
inc ecx
neg ecx
sbb ecx, ecx
add ecx, 0xf
cmp ecx, dword [esp + 0x14]
je 0x1003f11d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
jmp 0x1003f225
mov byte [esp + 0x13], bl
mov dword [esp + 0x38], 0x1472
cmp dword [esp + 0x38], 0x10cc
jge 0x1003f212
lea eax, [esp + 0x40]
mov dword [esp + 0x40], ebx
push eax
push 0x100077e0
call fcn.1005459b
mov eax, dword [esp + 0x48]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004e176
add esp, 0xc
mov dword [esp + 0x48], eax
cmp dword [esp + 0x40], 0
mov edi, ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebx
jle 0x1003f1a6
mov edi, eax
mov esi, ebx
push edi
push 0x100077e0
call fcn.1005459b
add ebx, dword [edi]
inc esi
pop ecx
pop ecx
push 4
pop eax
add edi, eax
cmp esi, dword [esp + 0x40]
jl 0x1003f17e
mov dword [esp + 0x34], ebx
xor ebx, ebx
mov edi, dword [esp + 0x34]
push 3
pop esi
lea eax, [esp + 0x68]
mov dword [esp + 0x58], ebx
push eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], ebx
push eax
push 0x10007814
call fcn.1005459b
add esp, 0xc
mov edx, ebx
cmp dword [esp + 0x40], 0
mov ecx, ebx
jle 0x1003f207
mov eax, dword [esp + 0x58]
cmp eax, edx
jg 0x1003f1f6
cmp edx, dword [esp + 0x68]
jg 0x1003f1f6
add eax, edx
cmp eax, edi
jg 0x1003f1f2
mov eax, dword [esp + 0x68]
add eax, edx
cmp edi, eax
jle 0x1003f32e
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x48]
push 0
add edx, dword [ebx + ecx*4]
inc ecx
pop ebx
cmp ecx, dword [esp + 0x40]
jl 0x1003f1d4
push 0x10007808
call fcn.10055012
pop ecx
cmp byte [esp + 0x13], 0
je 0x1003f225
push ebx
push 0xd23
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x1003f28e
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], ebx
jl 0x1003f288
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f26c
push 0x423
push 0x160b
push 0x1322
push 0x1ca0
push 0x19ec
push ebx
push ebx
push ebx
push ebx
push 0x1ffa
call dword [sym.imp.USER32.dll_DrawStateW]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x26c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x26c], ecx
dec dword [esp + 0x28]
jns 0x1003f239
dec dword [esp + 0x14]
jns 0x1003f22f
lea ecx, [esp + 0xd0]
call fcn.100398b4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1003f2c8
mov edx, dword [esp + 0x3c]
mov ecx, eax
call fcn.1003d19c
mov esi, eax
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0xf0], esi
call fcn.1003f712
push 3
mov dword [eax], esi
pop esi
push dword [esp + 0x90]
movdqa xmm0, xmmword [0x10007fc0]
lea ecx, [esp + 0x108]
or eax, 0xffffffff
mov dword [esp + 0x108], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x290]
push eax
lea eax, [esp + 0x284]
mov dword [esp + 0x3c], 0xe85a7b05
push eax
push ebx
movdqu xmmword [esp + 0x28c], xmm0
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
call fcn.100318d0
push 4
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x1003f35d
test ecx, ecx
je 0x1003f207
lea eax, [ecx + 1]
push eax
push 0x10007828
call fcn.10054c24
pop ecx
jmp 0x1003f211
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x12c], 0xa8eac8b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1003f34a
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], esi
jg 0x1003f390
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x12c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x12c], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1003f36d
push 4
pop ecx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xffffffe7
je 0x1003f477
mov edi, dword [esp + 0x104]
or eax, 0xffffffff
xor edx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0x3d188047
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], 0xd9a54e58
mov dword [esp + 0x38], 0xc23782ec
mov eax, dword [esp + 0x138]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x130]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
push 4
setg cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x130]
mov eax, dword [esp + 0x30]
cmp eax, ecx
mov eax, dword [esp + 0x130]
setle dl
xor ecx, ecx
add eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
cmp eax, 1
mov esi, dword [edi + 8]
setl cl
xor edx, edx
cmp ecx, esi
pop ecx
setne dl
xor eax, eax
cmp edx, esi
setg al
mov dword [esp + 0x38], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe7
jne 0x1003f3a6
lea ecx, [esp + 0x104]
call fcn.1002c55e
mov eax, dword [ebp + 8]
lea esi, [esp + 0xec]
mov ecx, dword [esp + 0x2c4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret