Function at 0x10040643
Capabilities:
Check os version
Compare security identifiers
Extract resource via kernel32 functions
Get disk size
Get geographical location
Log keystrokes via polling
Query environment variable
Resume thread
Suspend thread

Disassembly:
mov eax, 0x10071ecc
call fcn.10070a18
sub esp, 0x714
push ebx
push esi
push edi
push 0xfffffffffffffffe
mov byte [ebp - 0x6d], dl
or esi, 0xffffffff
mov dword [ebp - 0x60], ecx
xor ebx, ebx
mov dword [ebp - 0x2c], 0x17571177
mov ecx, 0xe2c0d37a
pop edx
mov dword [ebp - 0x28], ecx
push 0xffffffffffffffe3
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], ebx
pop edi
jmp 0x100406ac
mov dword [ebp - 0x38], 0x6efba1a4
mov dword [ebp - 0x28], 0x3245f1db
mov dword [ebp - 0x28], 0xffffffed
jmp 0x100406a4
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jne 0x10040695
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
je 0x1004067e
mov dword [ebp - 0x2c], 0x17571177
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], ebx
jmp 0x100406f1
mov dword [ebp - 0x38], 0x6efba1a4
mov dword [ebp - 0x28], 0x3245f1db
mov dword [ebp - 0x28], 0xffffffed
jmp 0x100406e9
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jne 0x100406da
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
je 0x100406c3
mov dword [ebp - 0x40], 0xc8a6b950
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x1c], 0xef9d7865
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x4c], 0xfffffff9
push 2
call fcn.10011f61
mov dword [ebp - 0x4c], 0x5eec80f2
mov dword [ebp - 0x4c], 0x7911b9c6
mov dword [ebp - 0x34], 0xe19f8c51
mov dword [ebp - 0x2c], ebx
jmp 0x1004074f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54c]
mov dword [eax + ecx*4], 0x81f3403c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1004073c
cmp dword [ebp - 0x1c], ebx
je 0x1004082b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
inc edx
mov eax, edx
neg eax
je 0x10040772
cmp dword [ebp - 0x1c], ebx
jne 0x10040779
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1004077b
mov ecx, edx
mov dword [ebp - 0x40], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x54c]
dec dword [ebp - 0x34]
call fcn.10011fee
mov dword [ebp - 0x38], 0x157d
cmp dword [ebp - 0x38], 0x7c1
jge 0x100408b8
lea eax, [ebp - 0x74]
push eax
push 0x1000b200
call fcn.1005856b
pop ecx
pop ecx
push dword [ebp - 0x74]
lea ecx, [ebp - 0x55c]
call fcn.10011f61
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x5f0]
push dword [ebp - 0x74]
call fcn.1003eca3
mov eax, dword [ebp - 0x74]
mov edi, ebx
mov ebx, dword [ebp - 0x55c]
test eax, eax
jle 0x1004080f
mov esi, ebx
push esi
push 0x1000b200
call fcn.1005856b
mov eax, dword [ebp - 0x74]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jl 0x100407f7
mov esi, dword [ebp - 0x5f0]
lea ecx, [eax - 1]
xor edx, edx
test ecx, ecx
js 0x10040878
test edx, edx
jle 0x1004083e
sub edx, dword [ebx + ecx*4]
mov byte [esi + ecx], 0x2d
jmp 0x10040845
cmp dword [ebp - 0x38], ebx
jne 0x10040764
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10040769
add edx, dword [ebx + ecx*4]
mov byte [esi + ecx], 0x2b
dec ecx
jns 0x1004081e
mov eax, dword [ebp - 0x74]
xor ebx, ebx
test edx, edx
jns 0x1004087a
mov ecx, ebx
test eax, eax
jle 0x1004087a
mov dl, byte [esi + ecx]
cmp dl, 0x2b
jne 0x10040865
mov byte [esi + ecx], 0x2d
jmp 0x1004086e
cmp dl, 0x2d
jne 0x10040871
mov byte [esi + ecx], 0x2b
mov eax, dword [ebp - 0x74]
inc ecx
cmp ecx, eax
jl 0x10040857
jmp 0x1004087a
xor ebx, ebx
mov edi, ebx
test eax, eax
jle 0x10040891
movsx eax, byte [esi + edi]
push eax
call fcn.10059912
inc edi
pop ecx
cmp edi, dword [ebp - 0x74]
jl 0x10040880
push 0x1000b169
call fcn.10058e86
pop ecx
lea ecx, [ebp - 0x5f0]
call fcn.10011fee
or esi, 0xffffffff
lea ecx, [ebp - 0x55c]
mov dword [ebp - 4], esi
call fcn.10011fee
mov dword [ebp - 0x28], 0xe0cf5720
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
push 3
call fcn.10011f61
xor edi, edi
mov dword [ebp - 0x40], esi
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
jmp 0x100408f6
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], 0xccbad86e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100408e3
inc dword [ebp - 0x40]
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x1004095a
mov dword [ebp - 0x40], 0x7223b16a
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
neg eax
cmp eax, 0x475ee4c2
mov eax, dword [ebp - 0x484]
setne cl
mov dword [eax + edx*4], ecx
mov eax, 0xffff
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x28]
jns 0x1004090b
lea ecx, [ebp - 0x484]
call fcn.10011fee
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x4c], 0xfffffff8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10040986
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 0x18], ebx
jne 0x100409c4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x1004099a
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x1004099c
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jne 0x100409a4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], ebx
jmp 0x100409e2
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100409df
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffe
jne 0x100409cf
mov dword [ebp - 0x38], 0xeab3ae5d
mov dword [ebp - 0x14], 0x17571177
mov dword [ebp - 0x1c], 0xe60f
mov dword [ebp - 0x34], 0x9729cf30
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x1ac4
cmp dword [ebp - 0x38], 0xcce
jge 0x10040acb
lea eax, [ebp - 0xf0]
mov esi, 0x1000b200
push eax
push esi
call fcn.1005856b
mov eax, dword [ebp - 0xf0]
pop ecx
pop ecx
test eax, eax
je 0x10040ac4
jmp 0x10040a4a
mov esi, 0x1000b200
dec eax
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0x1a0]
push eax
push esi
call fcn.1005856b
lea eax, [ebp - 0x248]
push eax
push esi
call fcn.1005856b
xor eax, eax
add esp, 0x10
inc eax
mov esi, eax
cmp dword [ebp - 0x1a0], eax
jle 0x10040a97
lea eax, [ebp - 0x2f4]
push eax
push 0x1000b200
call fcn.1005856b
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x1a0]
jl 0x10040a7b
mov eax, dword [ebp - 0x248]
mov ecx, 0x1000b25c
cmp eax, dword [ebp - 0x2f4]
mov eax, 0x1000b260
cmovge ecx, eax
push ecx
call fcn.10058e86
mov eax, dword [ebp - 0xf0]
pop ecx
test eax, eax
jne 0x10040a45
xor edi, edi
inc edi
dec eax
mov dword [ebp - 0xf0], eax
movdqa xmm0, xmmword [0x1000b970]
lea ecx, [ebp - 0x64c]
push ecx
lea eax, [ebp - 0x63c]
push eax
push ecx
lea ecx, [ebp - 0x63c]
movdqu xmmword [ebp - 0x64c], xmm0
call fcn.10011f9d
cmp dword [ebp - 0x1c], ebx
jne 0x10040b74
mov esi, dword [ebp - 0x1c]
mov edx, edi
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x1c], ebx
jg 0x10040b0b
mov edx, ebx
mov eax, dword [ebp - 0x1c]
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
dec ecx
jne 0x10040b2d
mov ecx, ebx
cmp dword [ebp - 0x30], ebx
je 0x10040b2f
mov ecx, edi
xor eax, eax
mov dword [ebp - 0x34], 0x164c
cmp esi, ecx
setge al
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0x96e6
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, ebx
setg cl
cmp ecx, dword [ebp - 0x3c]
jl 0x10040b76
mov eax, edi
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x63c]
mov dword [eax + 8], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10040ba9
push 0x1eb6
push 0x26c7
push 0x132d
push 0x1bfd
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea ecx, [ebp - 0x63c]
call fcn.10011fee
mov dword [ebp - 0x20], 0xe2c0d37a
mov dword [ebp - 0x28], 0xf73838a1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x24], 0x849f845
mov dword [ebp - 0x40], 0x7b4bc66
mov dword [ebp - 0x30], 0xb7bededb
mov dword [ebp - 0x1c], 0xc3938dd4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
jmp 0x10040c01
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x574], 0xfffffff8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10040bf0
inc dword [ebp - 0x28]
xor edx, edx
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, 0xb608
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
sub eax, 0xf7c2f5a2
neg eax
sbb eax, eax
inc eax
sub eax, edx
add eax, dword [ebp - 0x14]
je 0x10040d6d
mov dword [ebp - 0x38], 0x1fd9
cmp dword [ebp - 0x38], 0xb8a
jge 0x10040cf3
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
push eax
push 0x1000b1fc
call fcn.1005856b
pop ecx
pop ecx
jmp 0x10040ce2
dec eax
xorps xmm0, xmm0
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x308]
push eax
push 0x1000b6e4
movlpd qword [ebp - 0x308], xmm0
call fcn.1005856b
mov ecx, dword [ebp - 0x308]
xor edx, edx
mov eax, dword [ebp - 0x304]
mov edi, ecx
mov esi, eax
inc edx
shld esi, edi, 2
shl edi, 2
add ecx, edx
adc eax, ebx
push eax
push ecx
push esi
push edi
call fcn.100404fb
add esp, 0x18
push edx
push eax
push esi
push edi
call fcn.10070a40
xor ecx, ecx
inc ecx
add eax, ecx
adc edx, ebx
push edx
push eax
push 0x1000b6bc
call fcn.10058bc8
add esp, 0xc
mov eax, dword [ebp - 0xa0]
test eax, eax
jne 0x10040c76
dec eax
mov dword [ebp - 0xa0], eax
xor ecx, ecx
mov dword [ebp - 0x14], 0xf1e2
inc ecx
mov dword [ebp - 0x30], ecx
mov esi, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
jne 0x10040d0f
mov esi, ebx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
imul edx, esi
cmp edx, 0xa9d707d8
sbb eax, eax
neg eax
sub eax, 0x7bfbc35c
je 0x10040d42
cmp dword [ebp - 0x30], ebx
je 0x10040d42
xor edi, edi
inc edi
mov edx, edi
jmp 0x10040d47
xor edi, edi
mov edx, ebx
inc edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
jmp 0x10040e8f
push 2
lea ecx, [ebp - 0x35c]
call fcn.10011f61
mov dword [ebp - 0x20], 0x8a24e228
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], ebx
jmp 0x10040da3
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x35c]
mov dword [eax + ecx*4], 0xb2235412
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10040d90
mov eax, dword [ebp - 0x574]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x35c]
add eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, 0xd68e
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setle al
cmp dword [esi + 4], eax
jg 0x10040e28
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10040e84
push 0x22f8
push 0x2505
push 0x1569
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x10040e84
mov dword [ebp - 0x4c], 0xfffffff8
xor edx, edx
mov dword [ebp - 0x30], 9
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x35c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
sub edx, ecx
add eax, edx
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0xa6f2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
xor ebx, ebx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x35c]
call fcn.10011fee
or esi, 0xffffffff
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x20], ebx
je 0x10040ecc
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10040eba
push 0x2109
push ebx
push 0x1ac0
call dword [sym.imp.GDI32.dll_Polygon]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10040ee0
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x10040ee0
mov dword [ebp - 0x20], ebx
jmp 0x10040eda
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jne 0x10040ed1
mov dword [ebp - 0x14], ebx
mov edx, 0xb9ae77ab
cmp dword [ebp - 0x14], 0xfffffffe
jne 0x100410b9
xor ecx, ecx
mov dword [ebp - 0x3c], 0x6efba1a4
inc ecx
mov dword [ebp - 0x20], 0x3245f1db
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setne cl
sub ecx, 0x11bc383c
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x24], ecx
jg 0x10040f72
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10040fac
push ebx
push ebx
push 0x1897
push 0x155b
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x10040fac
push 0xffffffffffffffe9
mov dword [ebp - 0x18], 0x15
pop eax
jmp 0x10040fa7
mov dword [ebp - 0x1c], ebx
jmp 0x10040f9e
mov dword [ebp - 0x24], eax
jmp 0x10040f95
mov dword [ebp - 0x38], 0xdfddae9
mov dword [ebp - 0x38], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffc
jge 0x10040f88
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
jne 0x10040f83
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x10040f7e
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, 0x23d3
setle cl
cmp ecx, 0x92764969
ja 0x10040fd3
cmp dword [ebp - 0x1c], ebx
jne 0x10040fd3
mov eax, ebx
jmp 0x10040fd6
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
neg eax
xor ecx, ecx
cmp eax, 0xffff9b69
setge cl
xor eax, eax
cmp ecx, ebx
setle al
xor edx, edx
cmp eax, 0xfffffff8
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xffffffe3
je 0x100410a4
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x28], 0xbecba2af
mov dword [ebp - 0x2c], ebx
jmp 0x10041054
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2e8], 0x7a888ada
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10041043
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1004108f
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x2e8], ebx
jne 0x1004108c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10041087
push ebx
push 0x1b07
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
dec dword [ebp - 0x28]
jns 0x10041067
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jne 0x10041030
dec dword [ebp - 0x14]
mov edx, 0xb9ae77ab
cmp dword [ebp - 0x14], 0xfffffffe
je 0x10040ef2
xor edi, edi
inc edi
mov dword [ebp - 0x40], 0xc8a6b950
lea ecx, [ebp - 0x56c]
push 0xfffffffffffffff9
mov dword [ebp - 0x1c], 0xef9d7865
pop eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], eax
push 2
call fcn.10011f61
mov dword [ebp - 0x4c], 0x5eec80f2
mov dword [ebp - 0x4c], 0x7911b9c6
mov dword [ebp - 0x34], 0xe19f8c51
mov dword [ebp - 0x14], ebx
jmp 0x1004110d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0x81f3403c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100410fa
cmp dword [ebp - 0x1c], ebx
je 0x1004118b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
inc edx
mov eax, edx
neg eax
je 0x1004112c
cmp dword [ebp - 0x1c], ebx
jne 0x10041133
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10041135
mov ecx, edx
mov dword [ebp - 0x40], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x56c]
dec dword [ebp - 0x34]
call fcn.10011fee
xor eax, eax
mov dword [ebp - 0x24], 0xbd2ab60e
inc eax
lea ecx, [ebp - 0x260]
push eax
call fcn.10011f61
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x14], ebx
jmp 0x100411aa
cmp dword [ebp - 0x38], ebx
jne 0x1004111e
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10041123
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x260]
mov dword [eax + ecx*4], 0x184e5a94
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10041197
cmp dword [ebp - 0x24], ebx
je 0x100411d4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x260]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x260]
cmp dword [eax], ebx
jne 0x100411e8
cmp dword [ebp - 0x24], ebx
jne 0x100411e8
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xa9a9
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x16
jle 0x10041418
mov dword [ebp - 0x3c], 0x4707
mov dword [ebp - 0x38], 0x23f1
cmp dword [ebp - 0x38], 0x51a
jge 0x10041357
push 0x5d
lea ecx, [ebp - 0x580]
call fcn.10011f61
push 0x5d
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 2
call fcn.10011f61
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x184]
push eax
push 0x1000b3a0
call fcn.1005856b
mov esi, dword [ebp - 0x580]
add esp, 0x10
cmp dword [ebp - 0x184], 0
mov edi, ebx
jle 0x100412ab
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0x1000b21c
call fcn.1005856b
mov eax, dword [ebp - 0x2b8]
add esp, 0xc
inc dword [esi + eax*4]
mov eax, dword [ebp - 0x244]
dec dword [esi + eax*4 + 4]
inc edi
cmp edi, dword [ebp - 0x184]
jl 0x10041274
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [esi + ecx*4 - 4]
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, 0x5d
jl 0x100412b0
mov edi, dword [ebp - 0x608]
sub esi, edi
push 0x5c
pop ebx
lea edx, [edi + 4]
mov eax, dword [esi + edx]
xor ecx, ecx
cmp eax, dword [ebp - 0x310]
setge cl
add ecx, dword [edx - 4]
add dword [edx], ecx
lea edx, [edx + 4]
dec ebx
jne 0x100412cb
jmp 0x10041328
dec eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0x1000b21c
call fcn.1005856b
mov eax, dword [ebp - 0x24c]
add esp, 0xc
mov ecx, dword [edi + eax*4]
mov eax, dword [ebp - 0x2f0]
sub ecx, dword [edi + eax*4 - 4]
push ecx
push 0x1000b22c
call fcn.10058bc8
pop ecx
pop ecx
mov eax, dword [ebp - 0xfc]
test eax, eax
jne 0x100412e6
dec eax
lea ecx, [ebp - 0x608]
mov dword [ebp - 0xfc], eax
call fcn.10011fee
xor eax, eax
lea ecx, [ebp - 0x580]
inc eax
mov byte [ebp - 4], al
call fcn.10011fee
xor ebx, ebx
mov dword [ebp - 0x44], 0x28e48792
mov dword [ebp - 0x2c], 0xd5d57d38
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x30], 0x74462d17
mov dword [ebp - 0x14], ebx
jmp 0x10041389
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c8], 0x9f81a770
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10041378
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, 0x58e56a96
inc dword [ebp - 0x2c]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x44]
push 0
setge bl
sub eax, 0xcb933df
neg eax
sbb eax, eax
inc eax
sub ebx, eax
add ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, 0x69a0
setne cl
sub ecx, ebx
mov dword [ebp - 0x6c8], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg ecx
pop ebx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x260]
setg dl
mov eax, dword [ecx]
lea eax, [edx + eax*2]
mov dword [ecx], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jg 0x10041208
or esi, 0xffffffff
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], esi
call fcn.10011fee
xor eax, eax
lea ecx, [ebp - 0x208]
inc eax
push eax
call fcn.10011f61
xor eax, eax
mov dword [ebp - 4], 3
inc eax
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], eax
push 3
call fcn.10011f61
xor edx, edx
mov dword [ebp - 0x40], 0x78029323
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1004146f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0xe17c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10041461
mov dword [ebp - 0x18], ebx
jmp 0x1004148c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x208]
mov dword [eax + ecx*4], 0x197f0a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10041479
mov dword [ebp - 0x18], ebx
jmp 0x100414a9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x448]
mov dword [eax + ecx*4], 0x494fb389
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10041496
mov ecx, dword [ebp - 0x6c]
mov edi, 0xc9105fa2
mov eax, dword [ebp - 0x208]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x100415f4
mov dword [ebp - 0x40], 7
mov ecx, 0xc65b0b55
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x40], 0xf6872920
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0x40], ecx
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x40]
sub eax, 0x4ab462a7
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x208]
setle cl
xor ebx, ebx
mov eax, dword [eax + esi*4]
inc eax
add ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne bl
mov eax, dword [ebp + eax*4 - 0x6c]
cmp edi, eax
mov ecx, dword [ebp - 0x18]
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x208]
setle dl
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
imul ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
lea eax, [ecx - 0x17b75]
mov ecx, dword [ebp - 0x6c]
imul ecx, eax
test ecx, ecx
jne 0x1004158e
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1004158e
mov edx, ebx
jmp 0x10041593
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
imul eax, ecx
test eax, eax
jne 0x100415b0
cmp dword [ebp - 0x34], ebx
jne 0x100415b0
mov ecx, ebx
jmp 0x100415b5
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x6c]
sub ecx, eax
mov eax, dword [ebp - 0x6c]
sub ecx, eax
mov eax, dword [ebp - 0x448]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x208]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100414d1
or esi, 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.10011fee
lea ecx, [ebp - 0x208]
mov dword [ebp - 4], esi
call fcn.10011fee
xor eax, eax
mov dword [ebp - 0x40], 0xc8a6b950
inc eax
mov dword [ebp - 0x20], 0xef9d7865
push eax
lea ecx, [ebp - 0x1f0]
call fcn.10011f61
mov dword [ebp - 0x18], 0x971c1ec2
xor edx, edx
mov dword [ebp - 0x2c], 0x1afa
inc edx
mov dword [ebp - 0x1c], 0xc0dcee05
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x14], ebx
jmp 0x10041660
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1f0]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1004164d
mov dword [ebp - 0x18], ebx
jmp 0x100416aa
mov dword [ebp - 0x14], 0xc0aa39ed
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10041696
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x14]
jns 0x10041679
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100416a7
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1004166a
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xaf86
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 2
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1f0]
setl cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, edx
setge al
cmp eax, esi
jle 0x100416f6
cmp dword [ebp - 0x2c], ebx
je 0x100416f9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edi, 0xc61bbcb5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1f0]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
je 0x1004180a
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x1c], ebx
jmp 0x100417fb
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x18], 0xffffffe4
cmp dword [ebp - 0x18], 0xffffffea
jl 0x100417f2
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x40], 0x18db0686
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jne 0x10041776
mov dword [ebp - 0x40], 0xf3ac16b4
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x14]
mov eax, ebx
je 0x10041778
mov eax, ecx
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge bl
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, 0x3490
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x14]
jne 0x100417d8
cmp dword [ebp - 0x34], ebx
je 0x100417d8
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100417da
mov ecx, ebx
mov eax, dword [ebp - 0x34]
add eax, ecx
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
push 1
pop ecx
jge 0x1004174c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffeb
jl 0x1004172d
jmp 0x10041936
mov dword [ebp - 0x38], 0x24b4
cmp dword [ebp - 0x38], 0x888
jge 0x10041898
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], ebx
push eax
push 0x1000b1fc
call fcn.1005856b
pop ecx
pop ecx
mov esi, ebx
mov edi, ebx
jmp 0x10041872
dec eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x110]
push eax
push 0x1000b1fc
call fcn.1005856b
cmp dword [ebp - 0x110], 0
pop ecx
pop ecx
jge 0x1004186c
test esi, esi
jle 0x10041869
dec esi
jmp 0x10041872
inc edi
jmp 0x10041872
add esi, dword [ebp - 0x110]
mov eax, dword [ebp - 0x9c]
test eax, eax
jne 0x10041839
dec eax
push edi
push 0x1000b22c
mov dword [ebp - 0x9c], eax
call fcn.10058bc8
pop ecx
pop ecx
or esi, 0xffffffff
mov edi, 0xc61bbcb5
xor ecx, ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x100418b0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2d8], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100418a3
imul eax, dword [ebp - 0x1c], 0x4289
mov edx, 0xffff
cmp edx, eax
sbb eax, eax
inc eax
cmp eax, 0x7236
jle 0x100418d0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1f0]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
cmp edi, ecx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setne cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
cmp ecx, 0x24ca
setl al
mov dword [ebp - 0x2d8], eax
lea ecx, [ebp - 0x1f0]
call fcn.10011fee
xor eax, eax
mov dword [ebp - 0x44], esi
inc eax
lea ecx, [ebp - 0x460]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 0x89b1ab44
mov dword [ebp - 0x4c], 0x8bd921b0
push 2
call fcn.10011f61
xor edx, edx
mov dword [ebp - 0x4c], esi
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x14], ebx
jmp 0x10041985
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x460]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10041976
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
je 0x10041996
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x100419b3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x460]
mov dword [eax + ecx*4], 0xfd8b26de
dec dword [ebp - 0x14]
jns 0x1004199e
lea ecx, [ebp - 0x460]
mov dword [ebp - 4], esi
call fcn.10011fee
push 0xfffffffffffffff9
pop edi
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x630]
push 2
call fcn.10011f61
mov dword [ebp - 0x4c], 0x5eec80f2
mov dword [ebp - 0x4c], 0x7911b9c6
mov dword [ebp - 0x34], 0xe19f8c51
mov dword [ebp - 0x14], ebx
jmp 0x10041a01
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x630]
mov dword [eax + ecx*4], 0x81f3403c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100419ee
mov dword [ebp - 0x1c], edi
mov edi, 0x29855eec
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], esi
mov esi, 0x801465ee
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x1c], 5
jmp 0x10041aa1
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x40], 0xeb2d3650
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 7
setg cl
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x10041a2a
cmp dword [ebp - 0x20], ebx
je 0x10041bc1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
inc edx
mov eax, edx
neg eax
je 0x10041ac4
cmp dword [ebp - 0x20], ebx
jne 0x10041acb
mov ecx, ebx
cmp dword [ebp - 0x20], ebx
je 0x10041acd
mov ecx, edx
mov dword [ebp - 0x40], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x630]
dec dword [ebp - 0x34]
call fcn.10011fee
push 3
lea ecx, [ebp - 0x478]
call fcn.10011f61
mov dword [ebp - 0x34], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x4c], 0xe56890c5
inc ecx
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x40], 0xab227d37
mov dword [ebp - 0x4c], 0x73a4c924
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], 0x11e2db80
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0x37c57f39
mov dword [ebp - 0x4c], 0x809b4af7
push 9
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 5
push 2
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x3c], 0x8e51
mov dword [ebp - 0x40], 0xf7a0d7c8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jge 0x10041bbc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x478]
mov dword [eax + ecx*4], 0x108f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10041ba0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x10041be5
cmp dword [ebp - 0x44], ebx
jne 0x10041ab6
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10041abb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x588], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10041bd4
mov dword [ebp - 0x18], ebx
jmp 0x10041c00
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x194], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10041bef
mov eax, dword [ebp - 0x38]
mov esi, 0xb4b1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x194]
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x584], esi
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
add ecx, esi
mov esi, 0xa4a1
mov dword [ebp - 0x40], ecx
mov edx, esi
mov eax, dword [ebp - 0x44]
sub edx, eax
mov ecx, dword [ebp - 0x478]
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ecx + 4]
sub ecx, eax
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x478]
setle al
mov dword [ebp - 0x194], eax
call fcn.10011fee
xor eax, eax
mov dword [ebp - 0x24], 0xbd2ab60e
inc eax
lea ecx, [ebp - 0x270]
push eax
call fcn.10011f61
mov dword [ebp - 0x38], ebx
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x14], ebx
jmp 0x10041cae
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x270]
mov dword [eax + ecx*4], 0x184e5a94
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10041c9b
cmp dword [ebp - 0x24], ebx
je 0x10041cd8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x270]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x270]
cmp dword [eax], ebx
jne 0x10041cec
cmp dword [ebp - 0x24], ebx
jne 0x10041cec
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xa9a9
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x16
jle 0x10041dd1
mov dword [ebp - 0x38], 0x4707
mov dword [ebp - 0x44], 0x28e48792
mov dword [ebp - 0x2c], 0xd5d57d38
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x30], 0x74462d17
mov dword [ebp - 0x14], ebx
jmp 0x10041d45
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e0], 0x9f81a770
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10041d34
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, 0x58e56a96
inc dword [ebp - 0x2c]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x44]
push 0
setge bl
sub eax, 0xcb933df
neg eax
sbb eax, eax
inc eax
sub ebx, eax
add ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp eax, 0x69a0
setne cl
sub ecx, ebx
mov dword [ebp - 0x6e0], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg ecx
pop ebx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x270]
setg dl
mov eax, dword [ecx]
lea eax, [edx + eax*2]
mov dword [ecx], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jg 0x10041d0c
lea ecx, [ebp - 0x270]
call fcn.10011fee
mov eax, 0xad72
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x30], 0xe730
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x10c], ebx
jne 0x10041e83
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x10c]
jge 0x10041e31
cmp dword [ebp - 0x10c], ebx
jne 0x10041e31
cmp dword [ebp - 0x104], ebx
jne 0x10041e31
mov ecx, ebx
jmp 0x10041e36
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x104]
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul eax, ecx, 0xf157
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x10c]
setle dl
sub edx, eax
cmp edx, dword [ebp - 0x108]
je 0x10041e83
mov edx, ebx
jmp 0x10041e88
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x100]
xor ecx, ecx
cmp edx, eax
setg cl
lea eax, [ecx - 0x55073046]
cmp eax, dword [ebp - 0x104]
je 0x10041eaf
cmp dword [ebp - 0x10c], ebx
jne 0x10041eaf
mov edx, ebx
jmp 0x10041eb4
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setge cl
sub ecx, eax
cmp ecx, dword [ebp - 0x10c]
mov byte [ebp - 0xd], bl
jle 0x10041f1e
cmp byte [ebp - 0xd], 0
je 0x10041eef
push 0x3cd
push 0x2104
push 0x2438
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [ebp - 0x20], ebx
jmp 0x10041f16
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10041f04
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10041f13
call dword [sym.imp.KERNEL32.dll_GetACP]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
je 0x10041ef4
jmp 0x10041f35
cmp byte [ebp - 0xd], 0
je 0x10041f2f
push 0xf2
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
push 3
lea ecx, [ebp - 0x490]
call fcn.10011f61
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x4c], 0xe56890c5
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x40], 0xab227d37
mov dword [ebp - 0x4c], 0x73a4c924
mov dword [ebp - 0x38], 0x26df
cmp dword [ebp - 0x38], 0x109d
jge 0x10042012
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x274]
push eax
push 0x1000b3a0
call fcn.1005856b
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x1000b3a0
call fcn.1005856b
mov ecx, dword [ebp - 0x274]
add esp, 0x20
mov edx, dword [ebp - 0x2e0]
cmp ecx, edx
jg 0x10041ffa
mov eax, dword [ebp - 0x2f8]
add ecx, eax
add edx, dword [ebp - 0x298]
cmp ecx, edx
jg 0x10041ffa
mov eax, dword [ebp - 0x230]
add ecx, dword [ebp - 0x21c]
add eax, edx
cmp ecx, eax
jg 0x10041ffa
xor eax, eax
inc eax
jmp 0x10041ffc
mov al, bl
test al, al
mov ecx, 0x1000b260
mov eax, 0x1000b25c
cmove eax, ecx
push eax
call fcn.10058e86
pop ecx
mov dword [ebp - 0x44], 0xfffffff7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], 0x11e2db80
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0x37c57f39
mov dword [ebp - 0x4c], 0x809b4af7
push 9
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 5
push 2
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x38], 0x8e51
mov dword [ebp - 0x40], 0xf7a0d7c8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jge 0x100420a2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x490]
mov dword [eax + ecx*4], 0x108f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10042086
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x100420b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x59c], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100420a7
mov dword [ebp - 0x18], ebx
jmp 0x100420d3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x19c], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100420c2
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x19c]
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x598], 0xb4b1
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
add ecx, 0xb4b1
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x44]
sub esi, eax
mov ecx, dword [ebp - 0x490]
add esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ecx + 4]
sub ecx, eax
xor eax, eax
cmp ecx, esi
lea ecx, [ebp - 0x490]
setle al
mov dword [ebp - 0x19c], eax
call fcn.10011fee
mov dword [ebp - 0x18], ebx
push 4
pop esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], 0xfffffff8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1004215f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 0x18], ebx
jne 0x100421a1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10042176
cmp dword [ebp - 0x18], ebx
je 0x10042176
xor eax, eax
inc eax
jmp 0x10042178
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jne 0x10042180
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x100421c3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100421c0
cmp dword [ebp - 0x18], 0xfffffffe
jne 0x100421b0
mov dword [ebp - 0x38], 0xeab3ae5d
lea ecx, [ebp - 0x4c0]
push 2
call fcn.10011f61
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 3
push 2
call fcn.10011f61
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x66c]
movdqa xmm0, xmmword [0x1000b970]
xor eax, eax
mov dword [ebp - 0x4c], 0xffffffff
inc eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x65c]
push ecx
mov dword [ebp - 0x40], 0xa9f4f9a0
mov dword [ebp - 0x44], 0xffffffff
push eax
mov dword [ebp - 0x40], 0xfffffffd
push ecx
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x594]
mov dword [ebp - 0x40], 0x7276cc72
movdqu xmmword [ebp - 0x66c], xmm0
call fcn.10011f9d
xor edx, edx
mov dword [ebp - 0x38], 0xf4d4e209
mov dword [ebp - 0x1c], ebx
inc edx
cmp dword [ebp - 0x1c], 2
jge 0x10042280