Function at 0x10041b1e
Capabilities:
Check for time delay via queryperformancecounter
Create thread
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c986
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1130
call fcn.10077820
push esi
push edi
mov dword [ebp - 0xcc], 0xb9f9b319
mov dword [ebp - 0xb00], 0xfffffff8
mov dword [ebp - 0xb18], 0x704dcf74
mov dword [ebp - 0x3dc], 0xaa9320af
mov dword [ebp - 0x1fc], 0
jmp 0x10041b83
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x10041b9f
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x106c], 0x30c1abdd
jmp 0x10041b76
mov dword [ebp - 0xcc], 0
jmp 0x10041bb8
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xc
jge 0x10042273
mov dword [ebp - 0x198], 0xf1bf506e
push 2
lea ecx, [ebp - 0x340]
call fcn.10012997
and dword [ebp - 4], 0
and dword [ebp - 0xe54], 0
and dword [ebp - 0xe50], 0
and dword [ebp - 0xe4c], 0
and dword [ebp - 0xe48], 0
lea ecx, [ebp - 0x3cd]
call fcn.10012a47
push eax
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0xe54]
push eax
lea ecx, [ebp - 0x10d4]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb38]
call fcn.100129f6
mov byte [ebp - 4], 1
mov dword [ebp - 0x1f8], 0xfffffffe
mov dword [ebp - 0x1f0], 0
jmp 0x10041c58
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x10041c77
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x340]
call fcn.10012a38
or dword [eax], 0xffffffff
jmp 0x10041c4b
mov dword [ebp - 0x198], 0
jmp 0x10041c90
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x1a
je 0x100420b1
push 2
lea ecx, [ebp - 0x1c4]
call fcn.10012997
mov byte [ebp - 4], 2
mov dword [ebp - 0x424], 0xfffffffe
mov dword [ebp - 0xaa8], 0x820b275c
mov dword [ebp - 0x288], 0
jmp 0x10041cdb
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x10041cfd
push dword [ebp - 0x288]
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov dword [eax], 0x693e9323
jmp 0x10041cce
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
and dword [eax], 0
jmp 0x10041d33
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x964]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x964]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
cmp dword [eax], 1
jg 0x10042090
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x10041d7b
push 0
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10041da8
or eax, 0xffffffff
jne 0x10041da8
and dword [ebp - 0xae0], 0
jmp 0x10041db2
mov dword [ebp - 0xae0], 1
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push 1
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp dword [eax], 0
je 0x10041deb
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
je 0x10041e15
mov dword [ebp - 0xaa0], 1
jmp 0x10041e1c
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
shl eax, 1
cmp eax, dword [ebp - 0xcc]
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov esi, eax
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x10041e64
mov dword [ebp - 0xab0], 1
jmp 0x10041e6b
and dword [ebp - 0xab0], 0
cmp dword [ebp - 0xab0], 0xc51938d1
ja 0x10041e83
mov dword [ebp - 0xab8], 1
jmp 0x10041e8a
and dword [ebp - 0xab8], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
mov ecx, dword [ebp - 0xab8]
cmp ecx, dword [eax]
je 0x10041eba
mov dword [ebp - 0xac0], 1
jmp 0x10041ec1
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 1
jl 0x10041ed6
mov dword [ebp - 0xac8], 1
jmp 0x10041edd
and dword [ebp - 0xac8], 0
push 1
lea ecx, [ebp - 0x340]
call fcn.10012a38
mov ecx, dword [ebp - 0xac8]
cmp ecx, dword [eax]
je 0x10041f00
mov dword [ebp - 0x41c], 1
jmp 0x10041f07
and dword [ebp - 0x41c], 0
push 2
lea ecx, [ebp - 0xb38]
call fcn.10012a38
mov ecx, dword [ebp - 0x41c]
mov dword [eax], ecx
cmp dword [ebp - 0x41c], 0xfe905687
je 0x10041f34
mov dword [ebp - 0xad0], 1
jmp 0x10041f3b
and dword [ebp - 0xad0], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
mov ecx, dword [ebp - 0xad0]
cmp ecx, dword [eax]
jle 0x10041f71
cmp dword [ebp - 0x424], 0
jne 0x10041f71
and dword [ebp - 0xad8], 0
jmp 0x10041f7b
mov dword [ebp - 0xad8], 1
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0x1f8], eax
mov esi, dword [ebp - 0x1f8]
add esi, dword [ebp - 0xae0]
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp esi, dword [eax]
jl 0x10041fbd
mov dword [ebp - 0xae8], 1
jmp 0x10041fc4
and dword [ebp - 0xae8], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
mov esi, dword [ebp - 0xae8]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x10042003
mov dword [ebp - 0xaf0], 1
jmp 0x1004200a
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xaf0], eax
je 0x10042024
mov dword [ebp - 0xaf8], 1
jmp 0x1004202b
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 7
jl 0x10042050
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004204e
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1004208b
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1004206a
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp dword [eax], 0
je 0x1004208b
jmp 0x10042090
jmp 0x10041d0f
mov eax, dword [ebp - 0xb00]
dec eax
mov dword [ebp - 0xb00], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.10012a1c
jmp 0x10041c83
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1010], eax
mov esi, dword [ebp - 0xb18]
push 1
lea ecx, [ebp - 0xb38]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x100420e0
mov dword [ebp - 0xb08], 1
jmp 0x100420e7
and dword [ebp - 0xb08], 0
imul eax, dword [ebp - 0xb08], 0xfffc
test eax, eax
je 0x10042113
push 3
lea ecx, [ebp - 0xb38]
call fcn.10012a38
cmp dword [eax], 0
je 0x10042113
mov dword [ebp - 0xb10], 1
jmp 0x1004211a
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
sub eax, dword [ebp - 0xb18]
cmp eax, dword [ebp - 0x1f8]
je 0x1004213a
mov dword [ebp - 0xb28], 1
jmp 0x10042141
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x3dc], eax
mov esi, dword [ebp - 0x3dc]
push 2
lea ecx, [ebp - 0xb38]
call fcn.10012a38
cmp esi, dword [eax]
jg 0x10042170
mov dword [ebp - 0xaf4], 1
jmp 0x10042177
and dword [ebp - 0xaf4], 0
push 1
lea ecx, [ebp - 0x340]
call fcn.10012a38
cmp dword [ebp - 0x3dc], 0
jne 0x1004219f
cmp dword [ebp - 0xcc], 0
jne 0x1004219f
and dword [ebp - 0x840], 0
jmp 0x100421a9
mov dword [ebp - 0x840], 1
cmp dword [ebp - 0x840], 0x7d86
jne 0x100421c1
mov dword [ebp - 0x4a8], 1
jmp 0x100421c8
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xffffffff
je 0x100421dd
mov dword [ebp - 0x848], 1
jmp 0x100421e4
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0x7718da91
jne 0x10042209
cmp dword [ebp - 0x198], 0
jne 0x10042209
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10042209
and dword [ebp - 0x4b0], 0
jmp 0x10042213
mov dword [ebp - 0x4b0], 1
push 2
lea ecx, [ebp - 0xb38]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4b0]
jg 0x10042236
mov dword [ebp - 0x850], 1
jmp 0x1004223d
and dword [ebp - 0x850], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x850]
mov dword [ebp + eax - 0x106c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb38]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.10012a1c
jmp 0x10041bab
mov dword [ebp - 0xff4], 7
mov dword [ebp - 0x2f8], 0
jmp 0x10042296
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x100422b2
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x200], 0xffffffff
jmp 0x10042289
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x100422df
push 0xe08
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x200], 0
jmp 0x1004230d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x200], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x200], 0xe
jg 0x10042337
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x10042335
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x100422f2
mov dword [ebp - 0xdc], 0xb9f9b319
mov dword [ebp - 0x54], 0xb9b55bb2
mov dword [ebp - 0x54], 0
jmp 0x10042358
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe8
je 0x10042456
mov dword [ebp - 0xb54], 0xfe5e81a7
mov dword [ebp - 0xbc0], 0xf3ac9d73
mov dword [ebp - 0x290], 0
jmp 0x1004238f
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x100423ab
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xed4], 1
jmp 0x10042382
cmp dword [ebp - 0x54], 0
jne 0x1004242b
cmp dword [ebp - 0xb54], 0
jne 0x10042407
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed4]
mov dword [ebp - 0x102c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed4]
sub eax, dword [ebp - 0x54]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xed4]
cmp eax, dword [ebp - 0x54]
jl 0x10042407
cmp dword [ebp - 0x54], 0
jne 0x10042407
and dword [ebp - 0x4b8], 0
jmp 0x10042411
mov dword [ebp - 0x4b8], 1
imul eax, dword [ebp - 0x4b8], 0xfffffff6
test eax, eax
jne 0x10042425
mov eax, 0xd8ea5f34
test eax, eax
je 0x1004243e
cmp dword [ebp - 0x54], 0
je 0x1004243e
push 6
pop eax
test eax, eax
je 0x1004243e
mov dword [ebp - 0x858], 1
jmp 0x10042445
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xbc0], eax
jmp 0x10042351
mov dword [ebp - 0x938], 0xfffffff8
mov dword [ebp - 0x5a8], 0x704dcf74
mov dword [ebp - 0x384], 0xaa9320af
push 2
lea ecx, [ebp - 0xeec]
call fcn.10012997
mov dword [ebp - 4], 3
mov dword [ebp - 0x170], 0xabecba2a
mov dword [ebp - 0xf50], 0xb57a67d9
mov dword [ebp - 0x4c0], 0x46cd5fec
mov dword [ebp - 0x208], 0
jmp 0x100424bf
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x100424e1
push dword [ebp - 0x208]
lea ecx, [ebp - 0xeec]
call fcn.10012a38
mov dword [eax], 0xdd33a4a9
jmp 0x100424b2
mov dword [ebp - 0x170], 0
jmp 0x100424fa
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x1004251c
push dword [ebp - 0x170]
lea ecx, [ebp - 0xeec]
call fcn.10012a38
mov dword [eax], 7
jmp 0x100424ed
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeec]
call fcn.10012a1c
mov dword [ebp - 0x2d8], 0
jmp 0x10042551
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1004256d
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x109c], 0x30c1abdd
jmp 0x10042544
mov dword [ebp - 0xbc8], 0xffffffff
mov dword [ebp - 0xbd0], 0xffffffff
mov dword [ebp - 0xffc], 0xceafd94f
mov dword [ebp - 0xf58], 0x6dd8d130
mov dword [ebp - 0x1054], 0x93e9323d
mov dword [ebp - 0xf60], 0x6923607a
push 1
lea ecx, [ebp - 0xfac]
call fcn.10012997
mov dword [ebp - 4], 4
mov dword [ebp - 0x58], 0
jmp 0x100425cd
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x100425e6
push dword [ebp - 0x58]
lea ecx, [ebp - 0xfac]
call fcn.10012a38
and dword [eax], 0
jmp 0x100425c6
mov dword [ebp - 0x58], 0
jmp 0x100425f6
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004260c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x860], 0x82ca9683
jmp 0x100425ef
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbd0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x860]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x860], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfac]
call fcn.10012a1c
mov dword [ebp - 0xdc], 0
jmp 0x1004265b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xc
jge 0x100437f9
mov dword [ebp - 0x178], 0xf1bf506e
push 2
lea ecx, [ebp - 0x358]
call fcn.10012997
mov dword [ebp - 4], 5
mov dword [ebp - 0x448], 0xe033c22
mov dword [ebp - 0x210], 0
jmp 0x100426a9
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x100426c5
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xcfc], 0x31713b91
jmp 0x1004269c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xcfc], 0
jmp 0x100426f0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcfc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xcfc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcfc], 7
jne 0x100428cc
mov dword [ebp - 0x374], 0xffff
mov dword [ebp - 0xbd8], 0xcbed562b
mov dword [ebp - 0xbe0], 0x2ca3
mov dword [ebp - 0x298], 0
jmp 0x1004273a
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x10042756
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xa4], 0x7d8e6e83
jmp 0x1004272d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa4], 0xf
jmp 0x10042784
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0xfffffffb
jne 0x100428c7
mov dword [ebp - 0x878], 1
mov dword [ebp - 0xbe8], 0xe2bf35dd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x448], eax
je 0x100427d9
mov dword [ebp - 0x4c8], 1
jmp 0x100427e0
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x4c8], eax
je 0x10042801
mov dword [ebp - 0x868], 1
jmp 0x10042808
and dword [ebp - 0x868], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
jne 0x1004282a
cmp dword [ebp - 0x374], 0
jne 0x1004282a
and dword [ebp - 0x4d0], 0
jmp 0x10042834
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x868]
neg eax
imul ecx, dword [ebp - 0x4d0], 0xbec0
push 4
pop edx
imul edx, edx, 0
imul ecx, dword [ebp + edx - 0xa4]
sub eax, ecx
sub eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x374]
jne 0x10042870
mov dword [ebp - 0x870], 1
jmp 0x10042877
and dword [ebp - 0x870], 0
cmp dword [ebp - 0x870], 0
je 0x1004288c
mov dword [ebp - 0x4d8], 1
jmp 0x10042893
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x1004], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0x448], 0
je 0x100428c2
jmp 0x100428c7
jmp 0x10042769
jmp 0x100426d7
and dword [ebp - 0xe2c], 0
and dword [ebp - 0xe28], 0
and dword [ebp - 0xe24], 0
and dword [ebp - 0xe20], 0
lea ecx, [ebp - 0x3bd]
call fcn.10012a47
push eax
lea eax, [ebp - 0xe1c]
push eax
lea eax, [ebp - 0xe2c]
push eax
lea ecx, [ebp - 0x10dc]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb50]
call fcn.100129f6
mov byte [ebp - 4], 6
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x9c], 0x98ba832a
mov dword [ebp - 0x1b0], 0xfffffff8
mov dword [ebp - 0xdf0], 0x4c5d19e7
mov dword [ebp - 0xdec], 0x4c5d19e7
mov dword [ebp - 0xde8], 0x4c5d19e7
mov dword [ebp - 0xde4], 0x4c5d19e7
lea ecx, [ebp - 0x3dd]
call fcn.10012a47
push eax
lea eax, [ebp - 0xde0]
push eax
lea eax, [ebp - 0xdf0]
push eax
lea ecx, [ebp - 0x10fc]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1084]
call fcn.100129f6
mov byte [ebp - 4], 7
mov dword [ebp - 0x30], 0
jmp 0x100429ad
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffee
jne 0x10042e67
push 3
lea ecx, [ebp - 0x434]
call fcn.10012997
mov byte [ebp - 4], 8
mov dword [ebp - 0x318], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x100429eb
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x10042a0d
push dword [ebp - 0x218]
lea ecx, [ebp - 0x434]
call fcn.10012a38
mov dword [eax], 0x3695
jmp 0x100429de
mov dword [ebp - 0x318], 0
jmp 0x10042a26
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jg 0x10042e2d
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4f0], 0xe2499e68
mov dword [ebp - 0x5c], 0
jmp 0x10042a54
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x10042e28
mov dword [ebp - 0x38], 0xd72276b
mov dword [ebp - 0xbf8], 1
mov dword [ebp - 0x38], 0
jmp 0x10042a7f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10042acd
mov dword [ebp - 0x220], 0
jmp 0x10042a9e
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10042aba
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xbf0], 0xfffffffe
jmp 0x10042a91
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbf0], 3
jmp 0x10042a78
mov dword [ebp - 0x38], 2
jmp 0x10042add
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10042e23
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x84], 0
jmp 0x10042b0a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x10042d4c
mov dword [ebp - 0x2a0], 9
mov dword [ebp - 0x2a0], 2
jmp 0x10042b3a
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x10042b61
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10042b5f
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x10042b2d
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x434]
call fcn.10012a38
cmp dword [eax], 0
je 0x10042c1a
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x38], eax
jle 0x10042b8f
mov dword [ebp - 0x4e0], 1
jmp 0x10042b96
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0x7b187b35
jge 0x10042bae
mov dword [ebp - 0x880], 1
jmp 0x10042bb5
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
sub eax, dword [ebp - 0x5c]
cmp eax, 0xfffffff6
jne 0x10042bcf
mov dword [ebp - 0x4e8], 1
jmp 0x10042bd6
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0xfffffffc
jle 0x10042beb
mov dword [ebp - 0x888], 1
jmp 0x10042bf2
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x888]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
je 0x10042c1a
mov dword [ebp - 0x890], 1
jmp 0x10042c21
and dword [ebp - 0x890], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x434]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x890]
jge 0x10042c45
mov dword [ebp - 0x4f8], 1
jmp 0x10042c4c
and dword [ebp - 0x4f8], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x434]
call fcn.10012a38
mov ecx, dword [ebp - 0x4f8]
cmp ecx, dword [eax]
jl 0x10042c70
mov dword [ebp - 0x898], 1
jmp 0x10042c77
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 0x88ff7673
jae 0x10042c8f
mov dword [ebp - 0x500], 1
jmp 0x10042c96
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x500]
cmp eax, 0x2d6273d5
jle 0x10042cb2
mov dword [ebp - 0x8a0], 1
jmp 0x10042cb9
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x8a0], eax
jl 0x10042cd0
mov dword [ebp - 0x508], 1
jmp 0x10042cd7
and dword [ebp - 0x508], 0
push 1
lea ecx, [ebp - 0x434]
call fcn.10012a38
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [eax]
jle 0x10042cfa
mov dword [ebp - 0x8a8], 1
jmp 0x10042d01
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0xfffffffd
jbe 0x10042d22
push 1
lea ecx, [ebp - 0x434]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10042d22
cmp dword [ebp - 0x38], 0
je 0x10042d34
cmp dword [ebp - 0x5c], 0
je 0x10042d34
mov dword [ebp - 0x510], 1
jmp 0x10042d3b
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xbf8], eax
jmp 0x10042afd
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xf68], eax
mov esi, dword [ebp - 0x30]
push 1
lea ecx, [ebp - 0x434]
call fcn.10012a38
sub esi, dword [eax]
cmp esi, dword [ebp - 0x9c]
je 0x10042d7e
mov dword [ebp - 0x8b0], 1
jmp 0x10042d85
and dword [ebp - 0x8b0], 0
push 2
lea ecx, [ebp - 0x434]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8b0]
jg 0x10042da8
mov dword [ebp - 0x518], 1
jmp 0x10042daf
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x518], eax
jle 0x10042dc6
mov dword [ebp - 0x8b8], 1
jmp 0x10042dcd
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 1
jne 0x10042de2
mov dword [ebp - 0x520], 1
jmp 0x10042de9
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
add eax, 0xd230
je 0x10042e0b
cmp dword [ebp - 0x84], 0
je 0x10042e0b
mov dword [ebp - 0x8c0], 1
jmp 0x10042e12
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x1b0], eax
jmp 0x10042ad6
jmp 0x10042a4d
jmp 0x10042a19
push 0
lea ecx, [ebp - 0x434]
call fcn.10012a38
cmp dword [eax], 0
je 0x10042e53
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x434]
call fcn.10012a1c
jmp 0x100429a6
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x434]
call fcn.10012a1c
jmp 0x100429a6
cmp dword [ebp - 0x9c], 0
jne 0x10042f22
cmp dword [ebp - 0x9c], 0
jne 0x10042e8f
cmp dword [ebp - 0x9c], 0
jne 0x10042e8f
and dword [ebp - 0xc00], 0
jmp 0x10042e99
mov dword [ebp - 0xc00], 1
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x1b0], eax
jne 0x10042ebf
mov dword [ebp - 0x528], 1
jmp 0x10042ec6
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x528], eax
jne 0x10042ee0
mov dword [ebp - 0x8c8], 1
jmp 0x10042ee7
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x9c]
je 0x10042f04
mov dword [ebp - 0x530], 1
jmp 0x10042f0b
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x530], eax
jl 0x10042f22
and dword [ebp - 0x8d0], 0
jmp 0x10042f2c
mov dword [ebp - 0x8d0], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x8d0], eax
jg 0x10042f43
mov dword [ebp - 0x538], 1
jmp 0x10042f4a
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x538]
jne 0x10042f61
mov dword [ebp - 0x8d8], 1
jmp 0x10042f68
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x8d8]
add eax, dword [ebp - 0x9c]
cmp eax, 0x5b3a
jne 0x10042f8b
mov dword [ebp - 0x540], 1
jmp 0x10042f92
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x540], eax
jl 0x10042fa9
mov dword [ebp - 0x8e0], 1
jmp 0x10042fb0
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1084]
call fcn.10012a1c
mov dword [ebp - 0x238], 0xfffffffe
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0xc08], 8
mov dword [ebp - 0x228], 0
jmp 0x10042fff
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1004301b
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xfbc], 0x64a6847d
jmp 0x10042ff2
mov dword [ebp - 0x48], 0
jmp 0x1004302b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x10043070
mov dword [ebp - 0x2e0], 9
mov dword [ebp - 0x2e0], 0
jmp 0x10043054
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jg 0x1004306e
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xfbc], 0
je 0x1004306c
jmp 0x1004306e
jmp 0x10043047
jmp 0x10043024
mov dword [ebp - 0x48], 0xffffffed
jmp 0x10043080
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x10
jg 0x100431c5
mov dword [ebp - 0xd4], 0x7d2703d9
mov dword [ebp - 0xd4], 0x85c9e53
cmp dword [ebp - 0x48], 0
jne 0x100430b6
cmp dword [ebp - 0xd4], 0
jne 0x100430b6
and dword [ebp - 0x8e8], 0
jmp 0x100430c0
mov dword [ebp - 0x8e8], 1
cmp dword [ebp - 0xd4], 0
je 0x100430e5
mov eax, dword [ebp - 0xd4]
neg eax
cmp eax, dword [ebp - 0xd4]
jg 0x100430e5
mov dword [ebp - 0x548], 1
jmp 0x100430ec
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0x30a4ccfd
je 0x10043104
mov dword [ebp - 0x550], 1
jmp 0x1004310b
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x8e8]
cmp eax, dword [ebp - 0x550]
jge 0x10043125
mov dword [ebp - 0x8f0], 1
jmp 0x1004312c
and dword [ebp - 0x8f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfbc]
cmp dword [ebp - 0x8f0], eax
jle 0x1004314c
mov dword [ebp - 0x558], 1
jmp 0x10043153
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x558], eax
je 0x1004316d
mov dword [ebp - 0x8f8], 1
jmp 0x10043174
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x8f8], eax
jne 0x1004318e
mov dword [ebp - 0x560], 1
jmp 0x10043195
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0xb72b
jge 0x100431ad
mov dword [ebp - 0x900], 1
jmp 0x100431b4
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xc08], eax
jmp 0x10043079
mov dword [ebp - 0x230], 0
jmp 0x100431de
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x100431fd
push dword [ebp - 0x230]
lea ecx, [ebp - 0x358]
call fcn.10012a38
or dword [eax], 0xffffffff
jmp 0x100431d1
mov dword [ebp - 0x178], 0
jmp 0x10043216
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x1a
je 0x10043637
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10012997
mov byte [ebp - 4], 9
mov dword [ebp - 0x3e4], 0xfffffffe
mov dword [ebp - 0x570], 0x820b275c
mov dword [ebp - 0x2a8], 0
jmp 0x10043261
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x10043283
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov dword [eax], 0x693e9323
jmp 0x10043254
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
and dword [eax], 0
jmp 0x100432b9
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x568]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
cmp dword [eax], 1
jg 0x10043616
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10043301
push 0
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp dword [eax], 0
jne 0x1004332e
or eax, 0xffffffff
jne 0x1004332e
and dword [ebp - 0x928], 0
jmp 0x10043338
mov dword [ebp - 0x928], 1
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push 1
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp dword [eax], 0
je 0x10043371
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1004339b
mov dword [ebp - 0x908], 1
jmp 0x100433a2
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
shl eax, 1
cmp eax, dword [ebp - 0xdc]
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov esi, eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x100433ea
mov dword [ebp - 0x910], 1
jmp 0x100433f1
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x910], 0xc51938d1
ja 0x10043409
mov dword [ebp - 0x578], 1
jmp 0x10043410
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
je 0x10043440
mov dword [ebp - 0x918], 1
jmp 0x10043447
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 1
jl 0x1004345c
mov dword [ebp - 0x580], 1
jmp 0x10043463
and dword [ebp - 0x580], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.10012a38
mov ecx, dword [ebp - 0x580]
cmp ecx, dword [eax]
je 0x10043486
mov dword [ebp - 0x37c], 1
jmp 0x1004348d
and dword [ebp - 0x37c], 0
push 2
lea ecx, [ebp - 0xb50]
call fcn.10012a38
mov ecx, dword [ebp - 0x37c]
mov dword [eax], ecx
cmp dword [ebp - 0x37c], 0xfe905687
je 0x100434ba
mov dword [ebp - 0x920], 1
jmp 0x100434c1
and dword [ebp - 0x920], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
mov ecx, dword [ebp - 0x920]
cmp ecx, dword [eax]
jle 0x100434f7
cmp dword [ebp - 0x3e4], 0
jne 0x100434f7
and dword [ebp - 0x588], 0
jmp 0x10043501
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x238], eax
mov esi, dword [ebp - 0x238]
add esi, dword [ebp - 0x928]
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp esi, dword [eax]
jl 0x10043543
mov dword [ebp - 0x590], 1
jmp 0x1004354a
and dword [ebp - 0x590], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
mov esi, dword [ebp - 0x590]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x10043589
mov dword [ebp - 0x930], 1
jmp 0x10043590
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x930], eax
je 0x100435aa
mov dword [ebp - 0x598], 1
jmp 0x100435b1
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 7
jl 0x100435d6
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x100435d4
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x10043611
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x100435f0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp dword [eax], 0
je 0x10043611
jmp 0x10043616
jmp 0x10043295
mov eax, dword [ebp - 0x938]
dec eax
mov dword [ebp - 0x938], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1d4]
call fcn.10012a1c
jmp 0x10043209
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0xf70], eax
mov esi, dword [ebp - 0x5a8]
push 1
lea ecx, [ebp - 0xb50]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x10043666
mov dword [ebp - 0x5a0], 1
jmp 0x1004366d
and dword [ebp - 0x5a0], 0
imul eax, dword [ebp - 0x5a0], 0xfffc
test eax, eax
je 0x10043699
push 3
lea ecx, [ebp - 0xb50]
call fcn.10012a38
cmp dword [eax], 0
je 0x10043699
mov dword [ebp - 0x940], 1
jmp 0x100436a0
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
sub eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0x238]
je 0x100436c0
mov dword [ebp - 0x948], 1
jmp 0x100436c7
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x384], eax
mov esi, dword [ebp - 0x384]
push 2
lea ecx, [ebp - 0xb50]
call fcn.10012a38
cmp esi, dword [eax]
jg 0x100436f6
mov dword [ebp - 0x5b0], 1
jmp 0x100436fd
and dword [ebp - 0x5b0], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.10012a38
cmp dword [ebp - 0x384], 0
jne 0x10043725
cmp dword [ebp - 0xdc], 0
jne 0x10043725
and dword [ebp - 0x950], 0
jmp 0x1004372f
mov dword [ebp - 0x950], 1
cmp dword [ebp - 0x950], 0x7d86
jne 0x10043747
mov dword [ebp - 0x5b8], 1
jmp 0x1004374e
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0xffffffff
je 0x10043763
mov dword [ebp - 0x958], 1
jmp 0x1004376a
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x958], 0x7718da91
jne 0x1004378f
cmp dword [ebp - 0x178], 0
jne 0x1004378f
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1004378f
and dword [ebp - 0x5c0], 0
jmp 0x10043799
mov dword [ebp - 0x5c0], 1
push 2
lea ecx, [ebp - 0xb50]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5c0]
jg 0x100437bc
mov dword [ebp - 0x960], 1
jmp 0x100437c3
and dword [ebp - 0x960], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0x109c], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb50]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x358]
call fcn.10012a1c
jmp 0x1004264e
mov dword [ebp - 0x14], 0x3b4e1a36
mov dword [ebp - 0x118], 0xf13e13a6
mov dword [ebp - 0x38c], 0x16501874
mov dword [ebp - 0x5f0], 0xfffffff6
mov dword [ebp - 0x14], 0x14
jmp 0x1004382e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x11
jle 0x1004383e
cmp dword [ebp - 0x14], 0
je 0x1004383c
jmp 0x1004383e
jmp 0x10043827
mov dword [ebp - 0x14], 0
jmp 0x1004384e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff8
jl 0x10043bbf
mov dword [ebp - 0x420], 0x3c15
push 4
lea ecx, [ebp - 0xe74]
call fcn.10012997
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x5d8], 1
mov dword [ebp - 0x300], 0
jmp 0x10043899
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 4
jge 0x100438bb
push dword [ebp - 0x300]
lea ecx, [ebp - 0xe74]
call fcn.10012a38
mov dword [eax], 0xfcfbce00
jmp 0x1004388c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x14], 0xfffffff9
jl 0x100438d6
mov dword [ebp - 0x5c8], 1
jmp 0x100438dd
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5c8], eax
je 0x100438f4
mov dword [ebp - 0x968], 1
jmp 0x100438fb
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x968], eax
jne 0x10043927
mov dword [ebp - 0x5d0], 1
jmp 0x1004392e
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5d0], eax
jg 0x10043945
mov dword [ebp - 0x970], 1
jmp 0x1004394c
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x970], eax
jle 0x10043a7d
mov dword [ebp - 0x240], 3
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0xc10], eax
push 0
lea ecx, [ebp - 0xe74]
call fcn.10012a38
mov ecx, dword [ebp - 0xc10]
mov dword [eax], ecx
mov dword [ebp - 0x38c], 0x3598
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x5d8], eax
jl 0x100439de
mov dword [ebp - 0x978], 1
jmp 0x100439e5
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x978], 0x62b5
jle 0x100439fd
mov dword [ebp - 0x5e0], 1
jmp 0x10043a04
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x5e0], eax
je 0x10043a1e
mov dword [ebp - 0x980], 1
jmp 0x10043a25
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0xffffffff
je 0x10043a3a
mov dword [ebp - 0x5e8], 1
jmp 0x10043a41
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x13ed
jg 0x10043a65
mov dword [ebp - 0x988], 1
jmp 0x10043a6c
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x5f0], eax
jmp 0x10043bab
mov dword [ebp - 0x120], 0xf162c80f
mov dword [ebp - 0x118], 6
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x5f0], eax
jge 0x10043aab
mov dword [ebp - 0x608], 1
jmp 0x10043ab2
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x120], 0x402ad923
jl 0x10043aca
mov dword [ebp - 0x990], 1
jmp 0x10043ad1
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
inc eax
je 0x10043aec
cmp dword [ebp - 0x120], 0
je 0x10043aec
and dword [ebp - 0x5f8], 0
jmp 0x10043af6
mov dword [ebp - 0x5f8], 1
mov eax, dword [ebp - 0x38c]
sub eax, dword [ebp - 0x5f8]
cmp eax, dword [ebp - 0x120]
jle 0x10043b16
mov dword [ebp - 0x998], 1
jmp 0x10043b1d
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0xffffffff
jg 0x10043b32
mov dword [ebp - 0x600], 1
jmp 0x10043b39
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x600]
jne 0x10043b53
mov dword [ebp - 0x9a0], 1
jmp 0x10043b5a
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x9a0], eax
jg 0x10043b71
mov dword [ebp - 0x9a8], 1
jmp 0x10043b78
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x608]
add eax, dword [ebp - 0x9a8]
cmp eax, dword [ebp - 0x120]
je 0x10043b98
mov dword [ebp - 0x610], 1
jmp 0x10043b9f
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x120], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.10012a1c
jmp 0x10043847
mov dword [ebp - 0xec], 0xb9f9b319
mov dword [ebp - 0x498], 0x8c176b0f
mov dword [ebp - 0x494], 0x8c176b0f
mov dword [ebp - 0x490], 0x8c176b0f
mov dword [ebp - 0x48c], 0x8c176b0f
mov dword [ebp - 0x248], 3
push 1
lea ecx, [ebp - 0xe98]
call fcn.10012997
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x650], 0xbc1846e9
mov dword [ebp - 0x60], 0
jmp 0x10043c29
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10043c42
push dword [ebp - 0x60]
lea ecx, [ebp - 0xe98]
call fcn.10012a38
and dword [eax], 0
jmp 0x10043c22
mov dword [ebp - 0x60], 0
jmp 0x10043c52
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10043c68
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x10b4], 0x8e0ea626
jmp 0x10043c4b
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x498], 0
jmp 0x10043c93
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x498]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x498], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x498], 0xd
jle 0x100440a2
mov dword [ebp - 0x630], 3
mov dword [ebp - 0x1a0], 0x49e3
mov dword [ebp - 0x658], 0xc2c102d1
mov dword [ebp - 0x9f8], 0xab2bd68e
mov dword [ebp - 0xc20], 7
mov dword [ebp - 0x2b0], 0
jmp 0x10043cf1
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x10043d0a
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x28], 0
jmp 0x10043ce4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xf88], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28]
cmp dword [ebp + eax - 0x28], ecx
jg 0x10043d3c
mov dword [ebp - 0x9b0], 1
jmp 0x10043d43
and dword [ebp - 0x9b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x498]
cmp dword [ebp - 0x9b0], eax
jg 0x10043d64
mov dword [ebp - 0x618], 1
jmp 0x10043d6b
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x498]
cmp dword [ebp - 0x618], eax
jne 0x10043d8b
mov dword [ebp - 0x9b8], 1
jmp 0x10043d92
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 5
jle 0x10043da7
mov dword [ebp - 0x620], 1
jmp 0x10043dae
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
sub eax, 9
cmp eax, 0x6f0d
jl 0x10043dca
mov dword [ebp - 0x628], 1
jmp 0x10043dd1
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x9c0], eax
push 0
lea ecx, [ebp - 0xe98]
call fcn.10012a38
mov ecx, dword [ebp - 0x9c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c0]
cmp eax, dword [ebp - 0x628]
je 0x10043e0c
mov dword [ebp - 0x9c8], 1
jmp 0x10043e13
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x630], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x630], eax
jg 0x10043e3d
mov dword [ebp - 0x9d0], 1
jmp 0x10043e44
and dword [ebp - 0x9d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9d0], eax
jne 0x10043e5f
mov eax, 0x79deb476
test eax, eax
je 0x10043e7b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x498], 0
je 0x10043e7b
mov dword [ebp - 0x638], 1
jmp 0x10043e82
and dword [ebp - 0x638], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x498]
imul eax, dword [ebp - 0x638]
test eax, eax
je 0x10043eb3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
je 0x10043eb3
mov dword [ebp - 0x9d8], 1
jmp 0x10043eba
and dword [ebp - 0x9d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9d8], eax
jge 0x10043ed8
mov dword [ebp - 0x640], 1
jmp 0x10043edf
and dword [ebp - 0x640], 0
imul eax, dword [ebp - 0x640], 0xdbfe
cmp eax, dword [ebp - 0x1a0]
jle 0x10043efd
mov dword [ebp - 0x9e0], 1
jmp 0x10043f04
and dword [ebp - 0x9e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9e0], eax
jge 0x10043f22
mov dword [ebp - 0x3ec], 1
jmp 0x10043f29
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp + eax - 0x10b4], ecx
mov eax, dword [ebp - 0x3ec]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x28]
jl 0x10043f5b
mov dword [ebp - 0x648], 1
jmp 0x10043f62
and dword [ebp - 0x648], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
sub eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x1a0]
je 0x10043f86
mov dword [ebp - 0x9e8], 1
jmp 0x10043f8d
and dword [ebp - 0x9e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
add eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
sub eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x248]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x28]
jle 0x10043fcd
mov dword [ebp - 0x9f0], 1
jmp 0x10043fd4
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x658], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x658], eax
jl 0x1004400a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x498], 0
jne 0x1004400a
and dword [ebp - 0xc18], 0
jmp 0x10044014
mov dword [ebp - 0xc18], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x9f8]
add eax, 0x21409db2
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x498]
jle 0x1004405e
mov dword [ebp - 0x660], 1
jmp 0x10044065
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 0x5a47
jl 0x1004407d
mov dword [ebp - 0xa00], 1
jmp 0x10044084
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0xa00]
lea eax, [ecx + eax + 0x11f0]
mov dword [ebp - 0xc20], eax
jmp 0x10043c7a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe98]
call fcn.10012a1c
mov dword [ebp - 0x94c], 0xfffffff8
mov dword [ebp - 0x954], 0x704dcf74
mov dword [ebp - 0x3f8], 0xaa9320af
push 3
lea ecx, [ebp - 0x444]
call fcn.10012997
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa18], 0x6c0e2632
mov dword [ebp - 0x394], 0xfbde
mov dword [ebp - 0xc38], 0xffff
mov dword [ebp - 0x70], 0
jmp 0x10044111
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10044127
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x10cc], 1
jmp 0x1004410a
mov dword [ebp - 0x70], 0
jmp 0x10044137
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10044153
push dword [ebp - 0x70]
lea ecx, [ebp - 0x444]
call fcn.10012a38
mov dword [eax], 0x1897a4a
jmp 0x10044130
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
mov dword [eax], 2
jmp 0x1004418c
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x668]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
cmp dword [eax], 0
jl 0x100441ba
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x100441b8
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x10044168
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
cmp dword [eax], 0
je 0x100442e1
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0x101c], eax
push 0
lea ecx, [ebp - 0x444]
call fcn.10012a38
cmp dword [eax], 1
jne 0x10044207
mov dword [ebp - 0xc28], 1
jmp 0x1004420e
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xf98], eax
mov esi, dword [ebp - 0x394]
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
cmp esi, dword [eax]
jg 0x1004423d
mov dword [ebp - 0xa08], 1
jmp 0x10044244
and dword [ebp - 0xa08], 0
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
mov esi, dword [ebp - 0xa08]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x444]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x10044276
mov dword [ebp - 0x670], 1
jmp 0x1004427d
and dword [ebp - 0x670], 0
imul eax, dword [ebp - 0x670], 0x2ddb
test eax, eax
jne 0x1004429d
mov eax, 0xffff
test eax, eax
jne 0x1004429d
and dword [ebp - 0xa10], 0
jmp 0x100442a7
mov dword [ebp - 0xa10], 1
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0xa10], eax
jge 0x100442c1
mov dword [ebp - 0xc30], 1
jmp 0x100442c8
and dword [ebp - 0xc30], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x10cc]
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0xc38], 0
mov eax, 0xeab3
cmp eax, 0x11b5
jl 0x100442f9
mov dword [ebp - 0x678], 1
jmp 0x10044300
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0xa18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.10012a1c
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x180], 2
mov dword [ebp - 0x180], 0
jmp 0x10044348
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x11
jl 0x10044372
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x10044370
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x1004433b
mov dword [ebp - 0x2e8], 0
jmp 0x1004438b
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jge 0x100443a7
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x1090], 0x30c1abdd
jmp 0x1004437e
mov dword [ebp - 0xec], 0
jmp 0x100443c0
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xc
jge 0x100458af
mov dword [ebp - 0x1a8], 0xf1bf506e
mov dword [ebp - 0xfa0], 7
mov dword [ebp - 0x250], 0
jmp 0x100443fa
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x10044416
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x2b8], 0xffffffff
jmp 0x100443ed
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10044443
push 0xe08
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2b8], 0
jmp 0x10044471
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0xe
jg 0x1004449b
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x10044499
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x10044456
push 2
lea ecx, [ebp - 0x334]
call fcn.10012997
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x50], 0xb9b55bb2
mov dword [ebp - 0x50], 0
jmp 0x100444c6
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffe8
je 0x100445c4
mov dword [ebp - 0xc40], 0xfe5e81a7
mov dword [ebp - 0xc48], 0xf3ac9d73
mov dword [ebp - 0x258], 0
jmp 0x100444fd
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x10044519
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xec8], 1
jmp 0x100444f0
cmp dword [ebp - 0x50], 0
jne 0x10044599
cmp dword [ebp - 0xc40], 0
jne 0x10044575
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xfe4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec8]
mov dword [ebp - 0xfb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec8]
sub eax, dword [ebp - 0x50]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xec8]
cmp eax, dword [ebp - 0x50]
jl 0x10044575
cmp dword [ebp - 0x50], 0
jne 0x10044575
and dword [ebp - 0x680], 0
jmp 0x1004457f
mov dword [ebp - 0x680], 1
imul eax, dword [ebp - 0x680], 0xfffffff6
test eax, eax
jne 0x10044593
mov eax, 0xd8ea5f34
test eax, eax
je 0x100445ac
cmp dword [ebp - 0x50], 0
je 0x100445ac
push 6
pop eax
test eax, eax
je 0x100445ac
mov dword [ebp - 0xa20], 1
jmp 0x100445b3
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0xc48], eax
jmp 0x100444bf
and dword [ebp - 0xe18], 0
and dword [ebp - 0xe14], 0
and dword [ebp - 0xe10], 0
and dword [ebp - 0xe0c], 0
lea ecx, [ebp - 0x3d5]
call fcn.10012a47
push eax
lea eax, [ebp - 0xe08]
push eax
lea eax, [ebp - 0xe18]
push eax
lea ecx, [ebp - 0x110c]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb44]
call fcn.100129f6
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1ec], 0xfffffffe
mov dword [ebp - 0x310], 0
jmp 0x1004463c
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x1004465b
push dword [ebp - 0x310]
lea ecx, [ebp - 0x334]
call fcn.10012a38
or dword [eax], 0xffffffff
jmp 0x1004462f
mov dword [ebp - 0x1a8], 0
jmp 0x10044674
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x1a
je 0x1004562c
mov dword [ebp - 0xc50], 0xffffffff
mov dword [ebp - 0xcbc], 0xffffffff
mov dword [ebp - 0xef4], 0xceafd94f
mov dword [ebp - 0xef8], 0x6dd8d130
mov dword [ebp - 0xf00], 0x93e9323d
mov dword [ebp - 0xf08], 0x6923607a
push 1
lea ecx, [ebp - 0xfcc]
call fcn.10012997
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x64], 0
jmp 0x100446de
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x100446f7
push dword [ebp - 0x64]
lea ecx, [ebp - 0xfcc]
call fcn.10012a38
and dword [eax], 0
jmp 0x100446d7
mov dword [ebp - 0x64], 0
jmp 0x10044707
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1004471d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x688], 0x82ca9683
jmp 0x10044700
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0xcbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x688]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x688], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xfcc]
call fcn.10012a1c
push 2
lea ecx, [ebp - 0x168]
call fcn.10012997
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x3a4], 0xfffffffe
mov dword [ebp - 0x734], 0x820b275c
mov dword [ebp - 0x39c], 0xe033c22
mov dword [ebp - 0x260], 0
jmp 0x1004479b
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x100447b7
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xd98], 0x31713b91
jmp 0x1004478e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd98], 0
jmp 0x100447e2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd98]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd98], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd98], 7
jne 0x100449a3
mov dword [ebp - 0x3fc], 0xffff
mov dword [ebp - 0xb64], 0xcbed562b
mov dword [ebp - 0xbb8], 0x2ca3
mov dword [ebp - 0x2c0], 0
jmp 0x1004482c
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x10044845
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x78], 0x7d8e6e83
jmp 0x1004481f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x78], 0xf
jmp 0x1004486a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0xfffffffb
jne 0x1004499e
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0xbb0], 0xe2bf35dd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x39c], eax
je 0x100448b9
mov dword [ebp - 0xa28], 1
jmp 0x100448c0
and dword [ebp - 0xa28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0xa28], eax
je 0x100448de
mov dword [ebp - 0x690], 1
jmp 0x100448e5
and dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0
jne 0x10044904
cmp dword [ebp - 0x3fc], 0
jne 0x10044904
and dword [ebp - 0xa30], 0
jmp 0x1004490e
mov dword [ebp - 0xa30], 1
mov eax, dword [ebp - 0x690]
neg eax
imul ecx, dword [ebp - 0xa30], 0xbec0
push 4
pop edx
imul edx, edx, 0
imul ecx, dword [ebp + edx - 0x78]
sub eax, ecx
sub eax, dword [ebp - 0x6a0]
cmp eax, dword [ebp - 0x3fc]
jne 0x10044947
mov dword [ebp - 0x698], 1
jmp 0x1004494e
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0
je 0x10044963
mov dword [ebp - 0xa38], 1
jmp 0x1004496a
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xf10], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0x39c], 0
je 0x10044999
jmp 0x1004499e
jmp 0x10044855
jmp 0x100447c9
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x94], 0x98ba832a
mov dword [ebp - 0x1c8], 0xfffffff8
mov dword [ebp - 0xe40], 0x4c5d19e7
mov dword [ebp - 0xe3c], 0x4c5d19e7
mov dword [ebp - 0xe38], 0x4c5d19e7
mov dword [ebp - 0xe34], 0x4c5d19e7
lea ecx, [ebp - 0x3e5]
call fcn.10012a47
push eax
lea eax, [ebp - 0xe30]
push eax
lea eax, [ebp - 0xe40]
push eax
lea ecx, [ebp - 0x111c]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10a8]
call fcn.100129f6
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2c], 0
jmp 0x10044a2f
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffee
jne 0x10044ee9
push 3
lea ecx, [ebp - 0x454]
call fcn.10012997
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x268], 0
jmp 0x10044a6d
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x10044a8f
push dword [ebp - 0x268]
lea ecx, [ebp - 0x454]
call fcn.10012a38
mov dword [eax], 0x3695
jmp 0x10044a60
mov dword [ebp - 0x2f0], 0
jmp 0x10044aa8
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jg 0x10044eaf
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xa50], 0xe2499e68
mov dword [ebp - 0x6c], 0
jmp 0x10044ad6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x10044eaa
mov dword [ebp - 0x34], 0xd72276b
mov dword [ebp - 0xcc4], 1
mov dword [ebp - 0x34], 0
jmp 0x10044b01
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10044b4f
mov dword [ebp - 0x270], 0
jmp 0x10044b20
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x10044b3c
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xb68], 0xfffffffe
jmp 0x10044b13
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb68], 3
jmp 0x10044afa
mov dword [ebp - 0x34], 2
jmp 0x10044b5f
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10044ea5
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xac], 0
jmp 0x10044b8c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x10044dce
mov dword [ebp - 0x2c8], 9
mov dword [ebp - 0x2c8], 2
jmp 0x10044bbc
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jl 0x10044be3
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10044be1
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x10044baf
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x454]
call fcn.10012a38
cmp dword [eax], 0
je 0x10044c9c
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x34], eax
jle 0x10044c11
mov dword [ebp - 0xa40], 1
jmp 0x10044c18
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0x7b187b35
jge 0x10044c30
mov dword [ebp - 0x6a8], 1
jmp 0x10044c37
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
sub eax, dword [ebp - 0x6c]
cmp eax, 0xfffffff6
jne 0x10044c51
mov dword [ebp - 0xa48], 1
jmp 0x10044c58
and dword [ebp - 0xa48], 0
cmp dword [ebp - 0xa48], 0xfffffffc
jle 0x10044c6d
mov dword [ebp - 0x6b0], 1
jmp 0x10044c74
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x6b0]
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0xa50], 0
je 0x10044c9c
mov dword [ebp - 0x6b8], 1
jmp 0x10044ca3
and dword [ebp - 0x6b8], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x454]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6b8]
jge 0x10044cc7
mov dword [ebp - 0xa58], 1
jmp 0x10044cce
and dword [ebp - 0xa58], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x454]
call fcn.10012a38
mov ecx, dword [ebp - 0xa58]
cmp ecx, dword [eax]
jl 0x10044cf2
mov dword [ebp - 0x6c0], 1
jmp 0x10044cf9
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0x88ff7673
jae 0x10044d11
mov dword [ebp - 0xa60], 1
jmp 0x10044d18
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0xa60]
cmp eax, 0x2d6273d5
jle 0x10044d34
mov dword [ebp - 0x6c8], 1
jmp 0x10044d3b
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6c8], eax
jl 0x10044d52
mov dword [ebp - 0xa68], 1
jmp 0x10044d59
and dword [ebp - 0xa68], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.10012a38
mov ecx, dword [ebp - 0xa68]
cmp ecx, dword [eax]
jle 0x10044d7c
mov dword [ebp - 0x6d0], 1
jmp 0x10044d83
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 0xfffffffd
jbe 0x10044da4
push 1
lea ecx, [ebp - 0x454]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10044da4
cmp dword [ebp - 0x34], 0
je 0x10044db6
cmp dword [ebp - 0x6c], 0
je 0x10044db6
mov dword [ebp - 0xa70], 1
jmp 0x10044dbd
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xcc4], eax
jmp 0x10044b7f
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xf18], eax
mov esi, dword [ebp - 0x2c]
push 1
lea ecx, [ebp - 0x454]
call fcn.10012a38
sub esi, dword [eax]
cmp esi, dword [ebp - 0x94]
je 0x10044e00
mov dword [ebp - 0x6d8], 1
jmp 0x10044e07
and dword [ebp - 0x6d8], 0
push 2
lea ecx, [ebp - 0x454]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6d8]
jg 0x10044e2a
mov dword [ebp - 0xa78], 1
jmp 0x10044e31
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xa78], eax
jle 0x10044e48
mov dword [ebp - 0x6e0], 1
jmp 0x10044e4f
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 1
jne 0x10044e64
mov dword [ebp - 0xa80], 1
jmp 0x10044e6b
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
add eax, 0xd230
je 0x10044e8d
cmp dword [ebp - 0xac], 0
je 0x10044e8d
mov dword [ebp - 0x6e8], 1
jmp 0x10044e94
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x1c8], eax
jmp 0x10044b58
jmp 0x10044acf
jmp 0x10044a9b
push 0
lea ecx, [ebp - 0x454]
call fcn.10012a38
cmp dword [eax], 0
je 0x10044ed5
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x454]
call fcn.10012a1c
jmp 0x10044a28
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x454]
call fcn.10012a1c
jmp 0x10044a28
cmp dword [ebp - 0x94], 0
jne 0x10044fa4
cmp dword [ebp - 0x94], 0
jne 0x10044f11
cmp dword [ebp - 0x94], 0
jne 0x10044f11
and dword [ebp - 0xb6c], 0
jmp 0x10044f1b
mov dword [ebp - 0xb6c], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1c8], eax
jne 0x10044f41
mov dword [ebp - 0xa88], 1
jmp 0x10044f48
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xa88], eax
jne 0x10044f62
mov dword [ebp - 0x6f0], 1
jmp 0x10044f69
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x94]
je 0x10044f86
mov dword [ebp - 0xa90], 1
jmp 0x10044f8d
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xa90], eax
jl 0x10044fa4
and dword [ebp - 0xa98], 0
jmp 0x10044fae
mov dword [ebp - 0xa98], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xa98], eax
jg 0x10044fc5
mov dword [ebp - 0x6fc], 1
jmp 0x10044fcc
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x6fc]
jne 0x10044fe3
mov dword [ebp - 0x91c], 1
jmp 0x10044fea
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x91c]
add eax, dword [ebp - 0x94]
cmp eax, 0x5b3a
jne 0x1004500d
mov dword [ebp - 0x704], 1
jmp 0x10045014
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x704], eax
jl 0x1004502b
mov dword [ebp - 0xa2c], 1
jmp 0x10045032
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x10a8]
call fcn.10012a1c
mov dword [ebp - 0x278], 0
jmp 0x10045066
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x10045088
push dword [ebp - 0x278]
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov dword [eax], 0x693e9323
jmp 0x10045059
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0xc34], 8
mov dword [ebp - 0x308], 0
jmp 0x100450b2
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x100450ce
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xfdc], 0x64a6847d
jmp 0x100450a5
mov dword [ebp - 0x4c], 0
jmp 0x100450de
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x10045123
mov dword [ebp - 0x280], 9
mov dword [ebp - 0x280], 0
jmp 0x10045107
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jg 0x10045121
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xfdc], 0
je 0x1004511f
jmp 0x10045121
jmp 0x100450fa
jmp 0x100450d7
mov dword [ebp - 0x4c], 0xffffffed
jmp 0x10045133
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x10
jg 0x10045278
mov dword [ebp - 0xe4], 0x7d2703d9
mov dword [ebp - 0xe4], 0x85c9e53
cmp dword [ebp - 0x4c], 0
jne 0x10045169
cmp dword [ebp - 0xe4], 0
jne 0x10045169
and dword [ebp - 0x924], 0
jmp 0x10045173
mov dword [ebp - 0x924], 1
cmp dword [ebp - 0xe4], 0
je 0x10045198
mov eax, dword [ebp - 0xe4]
neg eax
cmp eax, dword [ebp - 0xe4]
jg 0x10045198
mov dword [ebp - 0x70c], 1
jmp 0x1004519f
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0x30a4ccfd
je 0x100451b7
mov dword [ebp - 0x714], 1
jmp 0x100451be
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x924]
cmp eax, dword [ebp - 0x714]
jge 0x100451d8
mov dword [ebp - 0xab4], 1
jmp 0x100451df
and dword [ebp - 0xab4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfdc]
cmp dword [ebp - 0xab4], eax
jle 0x100451ff
mov dword [ebp - 0x71c], 1
jmp 0x10045206
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x71c], eax
je 0x10045220
mov dword [ebp - 0x92c], 1
jmp 0x10045227
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x92c], eax
jne 0x10045241
mov dword [ebp - 0x724], 1
jmp 0x10045248
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0xb72b
jge 0x10045260
mov dword [ebp - 0xa34], 1
jmp 0x10045267
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0xc34], eax
jmp 0x1004512c
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
and dword [eax], 0
jmp 0x100452ae
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x72c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
cmp dword [eax], 1
jg 0x1004560b
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x100452f6
push 0
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10045323
or eax, 0xffffffff
jne 0x10045323
and dword [ebp - 0x944], 0
jmp 0x1004532d
mov dword [ebp - 0x944], 1
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push 1
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp dword [eax], 0
je 0x10045366
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xffffffff
je 0x10045390
mov dword [ebp - 0x934], 1
jmp 0x10045397
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x734]
shl eax, 1
cmp eax, dword [ebp - 0xec]
push 1
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov esi, eax
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x100453df
mov dword [ebp - 0xb20], 1
jmp 0x100453e6
and dword [ebp - 0xb20], 0
cmp dword [ebp - 0xb20], 0xc51938d1
ja 0x100453fe
mov dword [ebp - 0x73c], 1
jmp 0x10045405
and dword [ebp - 0x73c], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
mov ecx, dword [ebp - 0x73c]
cmp ecx, dword [eax]
je 0x10045435
mov dword [ebp - 0x93c], 1
jmp 0x1004543c
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 1
jl 0x10045451
mov dword [ebp - 0x744], 1
jmp 0x10045458
and dword [ebp - 0x744], 0
push 1
lea ecx, [ebp - 0x334]
call fcn.10012a38
mov ecx, dword [ebp - 0x744]
cmp ecx, dword [eax]
je 0x1004547b
mov dword [ebp - 0x3f4], 1
jmp 0x10045482
and dword [ebp - 0x3f4], 0
push 2
lea ecx, [ebp - 0xb44]
call fcn.10012a38
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
cmp dword [ebp - 0x3f4], 0xfe905687
je 0x100454af
mov dword [ebp - 0xa3c], 1
jmp 0x100454b6
and dword [ebp - 0xa3c], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
mov ecx, dword [ebp - 0xa3c]
cmp ecx, dword [eax]
jle 0x100454ec
cmp dword [ebp - 0x3a4], 0
jne 0x100454ec
and dword [ebp - 0x74c], 0
jmp 0x100454f6
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x1ec], eax
mov esi, dword [ebp - 0x1ec]
add esi, dword [ebp - 0x944]
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp esi, dword [eax]
jl 0x10045538
mov dword [ebp - 0x754], 1
jmp 0x1004553f
and dword [ebp - 0x754], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
mov esi, dword [ebp - 0x754]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x1004557e
mov dword [ebp - 0xabc], 1
jmp 0x10045585
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xabc], eax
je 0x1004559f
mov dword [ebp - 0x75c], 1
jmp 0x100455a6
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 7
jl 0x100455cb
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x100455c9
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x10045606
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x100455e5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
lea ecx, [ebp - 0x168]
call fcn.10012a38
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp dword [eax], 0
je 0x10045606
jmp 0x1004560b
jmp 0x1004528a
mov eax, dword [ebp - 0x94c]
dec eax
mov dword [ebp - 0x94c], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x168]
call fcn.10012a1c
jmp 0x10044667
push 2
lea ecx, [ebp - 0xee0]
call fcn.10012997
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x188], 0xabecba2a
mov dword [ebp - 0xf28], 0xb57a67d9
mov dword [ebp - 0x764], 0x46cd5fec
mov dword [ebp - 0x1e8], 0
jmp 0x10045674
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x10045696
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xee0]
call fcn.10012a38
mov dword [eax], 0xdd33a4a9
jmp 0x10045667
mov dword [ebp - 0x188], 0
jmp 0x100456af
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x100456d1
push dword [ebp - 0x188]
lea ecx, [ebp - 0xee0]
call fcn.10012a38
mov dword [eax], 7
jmp 0x100456a2
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xee0]
call fcn.10012a1c
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xf30], eax
mov esi, dword [ebp - 0x954]
push 1
lea ecx, [ebp - 0xb44]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x1004571c
mov dword [ebp - 0xa44], 1
jmp 0x10045723
and dword [ebp - 0xa44], 0
imul eax, dword [ebp - 0xa44], 0xfffc
test eax, eax
je 0x1004574f
push 3
lea ecx, [ebp - 0xb44]
call fcn.10012a38
cmp dword [eax], 0
je 0x1004574f
mov dword [ebp - 0x76c], 1
jmp 0x10045756
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
sub eax, dword [ebp - 0x954]
cmp eax, dword [ebp - 0x1ec]
je 0x10045776
mov dword [ebp - 0x774], 1
jmp 0x1004577d
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x3f8], eax
mov esi, dword [ebp - 0x3f8]
push 2
lea ecx, [ebp - 0xb44]
call fcn.10012a38
cmp esi, dword [eax]
jg 0x100457ac
mov dword [ebp - 0xafc], 1
jmp 0x100457b3
and dword [ebp - 0xafc], 0
push 1
lea ecx, [ebp - 0x334]
call fcn.10012a38
cmp dword [ebp - 0x3f8], 0
jne 0x100457db
cmp dword [ebp - 0xec], 0
jne 0x100457db
and dword [ebp - 0x77c], 0
jmp 0x100457e5
mov dword [ebp - 0x77c], 1
cmp dword [ebp - 0x77c], 0x7d86
jne 0x100457fd
mov dword [ebp - 0x95c], 1
jmp 0x10045804
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0xffffffff
je 0x10045819
mov dword [ebp - 0x784], 1
jmp 0x10045820
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0x7718da91
jne 0x10045845
cmp dword [ebp - 0x1a8], 0
jne 0x10045845
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10045845
and dword [ebp - 0xa4c], 0
jmp 0x1004584f
mov dword [ebp - 0xa4c], 1
push 2
lea ecx, [ebp - 0xb44]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa4c]
jg 0x10045872
mov dword [ebp - 0x78c], 1
jmp 0x10045879
and dword [ebp - 0x78c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x78c]
mov dword [ebp + eax - 0x1090], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb44]
call fcn.10012a1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.10012a1c
jmp 0x100443b3
mov dword [ebp - 0x128], 0xe1757117
push 2
lea ecx, [ebp - 0xc60]
call fcn.10012997
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xcdc], 1
mov dword [ebp - 0x1f4], 0
jmp 0x100458f0
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x10045912
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0xc60]
call fcn.10012a38
mov dword [eax], 8
jmp 0x100458e3
mov dword [ebp - 0x128], 0
jmp 0x1004592b
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffe8
jle 0x10045b2c
mov dword [ebp - 0x7c], 0xe1e2c0d3
mov dword [ebp - 0x190], 0xffff
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x7c], 1
jmp 0x10045963
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x10045afa
mov dword [ebp - 0x3c], 0x23e64f14
mov dword [ebp - 0x3c], 0
jmp 0x10045984
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x100459ae
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc60]
call fcn.10012a38
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xc60]
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1004597d
cmp dword [ebp - 0x190], 0
jne 0x100459c6
cmp dword [ebp - 0x7c], 0
jne 0x100459c6
and dword [ebp - 0x794], 0
jmp 0x100459d0
mov dword [ebp - 0x794], 1
mov dword [ebp - 0x148], 0x7f08
mov eax, dword [ebp - 0x148]
add eax, 0xfff6
cmp eax, 0x6c064155
je 0x100459f8
mov dword [ebp - 0x49c], 1
jmp 0x100459ff
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x190]
sub eax, 0x819d
sub eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x794]
jne 0x10045a30
cmp dword [ebp - 0x128], 0
jne 0x10045a30
and dword [ebp - 0xac4], 0
jmp 0x10045a3a
mov dword [ebp - 0xac4], 1
mov eax, dword [ebp - 0xac4]
sub eax, dword [ebp - 0x7c]
je 0x10045a57
cmp dword [ebp - 0x3c], 0
je 0x10045a57
mov dword [ebp - 0xb74], 1
jmp 0x10045a5e
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xf38], eax
cmp dword [ebp - 0x3c], 0
je 0x10045aa4
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10045aa2
push 0
push 0x14ad
push 0x115a
push 0
push 0x1535
push 0x1a9d
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x10045af5
mov dword [ebp - 0x3c], 0
jmp 0x10045ab4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10045af5
mov dword [ebp - 0x148], 1
jmp 0x10045ad3
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x10045af3
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xc60]
call fcn.10012a38
cmp dword [eax], 0
je 0x10045af1
jmp 0x10045af3
jmp 0x10045ac6
jmp 0x10045aad
jmp 0x1004595c
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x190], eax
jl 0x10045b14
mov dword [ebp - 0x79c], 1
jmp 0x10045b1b
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0xcdc], eax
jmp 0x1004591e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc60]
call fcn.10012a1c
push 2
lea ecx, [ebp - 0x34c]
call fcn.10012997
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x80], 0x56915a13
mov dword [ebp - 0xa54], 0xffffffff
mov dword [ebp - 0x1044], 1
mov dword [ebp - 0xf3c], 0xfffffffb
mov dword [ebp - 0x97c], 0xe5fef407
mov dword [ebp - 0x1e4], 0
jmp 0x10045b97
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x10045bb9
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x34c]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10045b8a
mov dword [ebp - 0x80], 1
jmp 0x10045bc9
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10045e2e
mov dword [ebp - 0x1b8], 0xfffffff6
push 1
lea ecx, [ebp - 0xd14]
call fcn.10012997
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x96c], 0x6b59229a
mov dword [ebp - 0x204], 0
jmp 0x10045c11
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10045c33
push dword [ebp - 0x204]
lea ecx, [ebp - 0xd14]
call fcn.10012a38
mov dword [eax], 0xfffffffb
jmp 0x10045c04
push dword [ebp - 0x80]
lea ecx, [ebp - 0x34c]
call fcn.10012a38
cmp dword [eax], 0
je 0x10045c5a
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xd14]
call fcn.10012a1c
jmp 0x10045e2e
mov dword [ebp - 0x1b8], 0x10
jmp 0x10045c73
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 7
jge 0x10045e1a
mov dword [ebp - 0xc3c], 8
push 0
lea ecx, [ebp - 0x34c]
call fcn.10012a38
cmp dword [eax], 1
jne 0x10045ca8
mov dword [ebp - 0xb7c], 1
jmp 0x10045caf
and dword [ebp - 0xb7c], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x34c]
call fcn.10012a38
push dword [ebp - 0x80]
lea ecx, [ebp - 0x34c]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x96c], eax
mov esi, dword [ebp - 0x96c]
inc esi
push 1
lea ecx, [ebp - 0x34c]
call fcn.10012a38
cmp dword [eax], esi
jge 0x10045cf7
mov dword [ebp - 0x7a4], 1
jmp 0x10045cfe
and dword [ebp - 0x7a4], 0
push 0
lea ecx, [ebp - 0x34c]
call fcn.10012a38
mov ecx, dword [ebp - 0x7a4]
cmp ecx, dword [eax]
jne 0x10045d21
mov dword [ebp - 0x7ac], 1
jmp 0x10045d28
and dword [ebp - 0x7ac], 0
push 0
lea ecx, [ebp - 0xd14]
call fcn.10012a38
and dword [eax], 0
mov dword [ebp - 0xa54], 0
mov esi, dword [ebp - 0xa54]
add esi, dword [ebp - 0x7ac]
push 1
lea ecx, [ebp - 0x34c]
call fcn.10012a38
sub esi, dword [eax]
cmp esi, 0x43e5
jl 0x10045d71
mov dword [ebp - 0x974], 1
jmp 0x10045d78
and dword [ebp - 0x974], 0
cmp dword [ebp - 0x974], 0x35211521
je 0x10045d90
mov dword [ebp - 0x7b4], 1
jmp 0x10045d97
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x7b4], eax
je 0x10045db1
mov dword [ebp - 0xb1c], 1
jmp 0x10045db8
and dword [ebp - 0xb1c], 0
mov esi, dword [ebp - 0xc3c]
push dword [ebp - 0x80]
lea ecx, [ebp - 0x34c]
call fcn.10012a38
imul esi, dword [eax]
mov eax, dword [ebp - 0xb1c]
add eax, 0x698d
cmp esi, eax
jle 0x10045dea
mov dword [ebp - 0x7bc], 1
jmp 0x10045df1
and dword [ebp - 0x7bc], 0
push 0
lea ecx, [ebp - 0x34c]
call fcn.10012a38
mov esi, dword [ebp - 0x7bc]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x34c]
call fcn.10012a38
mov dword [eax], esi
jmp 0x10045c66
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xd14]
call fcn.10012a1c
jmp 0x10045bc2
mov eax, dword [ebp - 0x97c]
inc eax
mov dword [ebp - 0x97c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c]
call fcn.10012a1c
mov dword [ebp - 0x130], 0xe1757117
push 2
lea ecx, [ebp - 0xc70]
call fcn.10012997
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xccc], 1
mov dword [ebp - 0x20c], 0
jmp 0x10045e8b
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10045ead
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xc70]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10045e7e
mov dword [ebp - 0x130], 0
jmp 0x10045ec6
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffe8
jle 0x100460e2
mov dword [ebp - 0x88], 0xe1e2c0d3
mov dword [ebp - 0x15c], 0xffff
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x88], 1
jmp 0x10045f0a
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x100460b0
mov dword [ebp - 0x44], 0x23e64f14
mov dword [ebp - 0x44], 0
jmp 0x10045f2e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x10045f5b
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc70]
call fcn.10012a38
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0xc70]
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10045f27
cmp dword [ebp - 0x15c], 0
jne 0x10045f76
cmp dword [ebp - 0x88], 0
jne 0x10045f76
and dword [ebp - 0xa5c], 0
jmp 0x10045f80
mov dword [ebp - 0xa5c], 1
mov dword [ebp - 0x140], 0x7f08
mov eax, dword [ebp - 0x140]
add eax, 0xfff6
cmp eax, 0x6c064155
je 0x10045fa8
mov dword [ebp - 0x7c4], 1
jmp 0x10045faf
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x15c]
sub eax, 0x819d
sub eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0xa5c]
jne 0x10045fe0
cmp dword [ebp - 0x130], 0
jne 0x10045fe0
and dword [ebp - 0x7cc], 0
jmp 0x10045fea
mov dword [ebp - 0x7cc], 1
mov eax, dword [ebp - 0x7cc]
sub eax, dword [ebp - 0x88]
je 0x1004600a
cmp dword [ebp - 0x44], 0
je 0x1004600a
mov dword [ebp - 0xb84], 1
jmp 0x10046011
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xf44], eax
cmp dword [ebp - 0x44], 0
je 0x10046057
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10046055
push 0
push 0x14ad
push 0x115a
push 0
push 0x1535
push 0x1a9d
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x100460ab
mov dword [ebp - 0x44], 0
jmp 0x10046067
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x100460ab
mov dword [ebp - 0x140], 1
jmp 0x10046086
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x100460a9
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc70]
call fcn.10012a38
cmp dword [eax], 0
je 0x100460a7
jmp 0x100460a9
jmp 0x10046079
jmp 0x10046060
jmp 0x10045efd
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x15c], eax
jl 0x100460ca
mov dword [ebp - 0x984], 1
jmp 0x100460d1
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0xccc], eax
jmp 0x10045eb9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc70]
call fcn.10012a1c
movzx eax, byte [0x1066ddc8]
test eax, eax
je 0x1004610f
mov esi, 0x1066c460
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10049f2b
push 2
lea ecx, [ebp - 0x364]
call fcn.10012997
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x90], 0x56915a13
mov dword [ebp - 0x7dc], 0xffffffff
mov dword [ebp - 0xf4c], 1
mov dword [ebp - 0xf54], 0xfffffffb
mov dword [ebp - 0x7f4], 0xe5fef407
mov dword [ebp - 0x214], 0
jmp 0x1004616e
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x10046190
push dword [ebp - 0x214]
lea ecx, [ebp - 0x364]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10046161
mov dword [ebp - 0x90], 1
jmp 0x100461a9
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1004641d
mov dword [ebp - 0x16c], 0xfffffff6
push 1
lea ecx, [ebp - 0xd5c]
call fcn.10012997
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x7d4], 0x6b59229a
mov dword [ebp - 0x21c], 0
jmp 0x100461f4
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x10046216
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xd5c]
call fcn.10012a38
mov dword [eax], 0xfffffffb
jmp 0x100461e7
push dword [ebp - 0x90]
lea ecx, [ebp - 0x364]
call fcn.10012a38
cmp dword [eax], 0
je 0x10046240
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xd5c]
call fcn.10012a1c
jmp 0x1004641d
mov dword [ebp - 0x16c], 0x10
jmp 0x10046259
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 7
jge 0x10046409
mov dword [ebp - 0xc44], 8
push 0
lea ecx, [ebp - 0x364]
call fcn.10012a38
cmp dword [eax], 1
jne 0x1004628e
mov dword [ebp - 0xb8c], 1
jmp 0x10046295
and dword [ebp - 0xb8c], 0
push dword [ebp - 0x90]
lea ecx, [ebp - 0x364]
call fcn.10012a38
push dword [ebp - 0x90]
lea ecx, [ebp - 0x364]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x7d4], eax
mov esi, dword [ebp - 0x7d4]
inc esi
push 1
lea ecx, [ebp - 0x364]
call fcn.10012a38
cmp dword [eax], esi
jge 0x100462e3
mov dword [ebp - 0xacc], 1
jmp 0x100462ea
and dword [ebp - 0xacc], 0
push 0
lea ecx, [ebp - 0x364]
call fcn.10012a38
mov ecx, dword [ebp - 0xacc]
cmp ecx, dword [eax]
jne 0x1004630d
mov dword [ebp - 0x98c], 1
jmp 0x10046314
and dword [ebp - 0x98c], 0
push 0
lea ecx, [ebp - 0xd5c]
call fcn.10012a38
and dword [eax], 0
mov dword [ebp - 0x7dc], 0
mov esi, dword [ebp - 0x7dc]
add esi, dword [ebp - 0x98c]
push 1
lea ecx, [ebp - 0x364]
call fcn.10012a38
sub esi, dword [eax]
cmp esi, 0x43e5
jl 0x1004635d
mov dword [ebp - 0x7e4], 1
jmp 0x10046364
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 0x35211521
je 0x1004637c
mov dword [ebp - 0xa64], 1
jmp 0x10046383
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0xa64], eax
je 0x1004639d
mov dword [ebp - 0x7ec], 1
jmp 0x100463a4
and dword [ebp - 0x7ec], 0
mov esi, dword [ebp - 0xc44]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x364]
call fcn.10012a38
imul esi, dword [eax]
mov eax, dword [ebp - 0x7ec]
add eax, 0x698d
cmp esi, eax
jle 0x100463d9
mov dword [ebp - 0x994], 1
jmp 0x100463e0
and dword [ebp - 0x994], 0
push 0
lea ecx, [ebp - 0x364]
call fcn.10012a38
mov esi, dword [ebp - 0x994]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x364]
call fcn.10012a38
mov dword [eax], esi
jmp 0x1004624c
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xd5c]
call fcn.10012a1c
jmp 0x1004619c
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10012a1c
mov dword [ebp - 0x224], 0x48bbca63
mov dword [ebp - 0xcec], 1
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x10046484
push 0x1570
push 0x26
push 0x1e53
push 0x893
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x224], 0xe
jmp 0x1004649d
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xfffffff3
jle 0x100464dd
mov dword [ebp - 0xb94], 0x1265ab3e
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xcec], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x100464db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x10046490
mov dword [ebp - 0x138], 0xe1757117
push 2
lea ecx, [ebp - 0xc80]
call fcn.10012997
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0xc4c], 1
mov dword [ebp - 0x22c], 0
jmp 0x1004651e
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x10046540
push dword [ebp - 0x22c]
lea ecx, [ebp - 0xc80]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10046511
mov dword [ebp - 0x138], 0
jmp 0x10046559
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffe8
jle 0x10046775
mov dword [ebp - 0x98], 0xe1e2c0d3
mov dword [ebp - 0x174], 0xffff
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x98], 1
jmp 0x1004659d
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x10046743
mov dword [ebp - 0x40], 0x23e64f14
mov dword [ebp - 0x40], 0
jmp 0x100465c1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x100465ee
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc80]
call fcn.10012a38
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0xc80]
call fcn.10012a38
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100465ba
cmp dword [ebp - 0x174], 0
jne 0x10046609
cmp dword [ebp - 0x98], 0
jne 0x10046609
and dword [ebp - 0x7fc], 0
jmp 0x10046613
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0x150], 0x7f08
mov eax, dword [ebp - 0x150]
add eax, 0xfff6
cmp eax, 0x6c064155
je 0x1004663b
mov dword [ebp - 0xb04], 1
jmp 0x10046642
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0xb04]
sub eax, dword [ebp - 0x174]
sub eax, 0x819d
sub eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x7fc]
jne 0x10046673
cmp dword [ebp - 0x138], 0
jne 0x10046673
and dword [ebp - 0x99c], 0
jmp 0x1004667d
mov dword [ebp - 0x99c], 1
mov eax, dword [ebp - 0x99c]
sub eax, dword [ebp - 0x98]
je 0x1004669d
cmp dword [ebp - 0x40], 0
je 0x1004669d
mov dword [ebp - 0xb9c], 1
jmp 0x100466a4
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xf5c], eax
cmp dword [ebp - 0x40], 0
je 0x100466ea
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x100466e8
push 0
push 0x14ad
push 0x115a
push 0
push 0x1535
push 0x1a9d
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x1004673e
mov dword [ebp - 0x40], 0
jmp 0x100466fa
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1004673e
mov dword [ebp - 0x150], 1
jmp 0x10046719
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1004673c
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc80]
call fcn.10012a38
cmp dword [eax], 0
je 0x1004673a
jmp 0x1004673c
jmp 0x1004670c
jmp 0x100466f3
jmp 0x10046590
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x174], eax
jl 0x1004675d
mov dword [ebp - 0x804], 1
jmp 0x10046764
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xc4c], eax
jmp 0x1004654c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.10012a1c
mov dword [ebp - 0xf64], 0x1066c460
mov dword [ebp - 0x11c], 4
push 2
lea ecx, [ebp - 0xeb0]
call fcn.10012997
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x234], 0
jmp 0x100467c5
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x100467e7
push dword [ebp - 0x234]
lea ecx, [ebp - 0xeb0]
call fcn.10012a38
mov dword [eax], 7
jmp 0x100467b8
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1004680a
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x11c], 1
jmp 0x10046823
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x17
jle 0x10046a5e
and dword [ebp - 0xe68], 0
and dword [ebp - 0xe64], 0
and dword [ebp - 0xe60], 0
and dword [ebp - 0xe5c], 0
lea ecx, [ebp - 0x365]
call fcn.10012a47
push eax
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xe68]
push eax
lea ecx, [ebp - 0x1114]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x46c]
call fcn.100129f6
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], 0
jmp 0x1004689c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x10046a4a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0x18], 0
jne 0x100468e9
mov dword [ebp - 0xa6c], 1
jmp 0x100468f0
and dword [ebp - 0xa6c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov ecx, dword [ebp - 0xa6c]
add ecx, dword [eax]
jne 0x10046914
mov dword [ebp - 0x80c], 1
jmp 0x1004691b
and dword [ebp - 0x80c], 0
cmp dword [ebp - 0x80c], 6
jne 0x10046930
mov dword [ebp - 0x9a4], 1
jmp 0x10046937
and dword [ebp - 0x9a4], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov eax, dword [eax]
sub eax, dword [ebp - 0x9a4]
cmp eax, 0xabf8b243
jae 0x10046960
mov dword [ebp - 0x814], 1
jmp 0x10046967
and dword [ebp - 0x814], 0
imul eax, dword [ebp - 0x814], 0x3521
test eax, eax
je 0x10046987
cmp dword [ebp - 0x18], 0
je 0x10046987
mov dword [ebp - 0xad4], 1
jmp 0x1004698e
and dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0xad4]
jg 0x100469b1
mov dword [ebp - 0x81c], 1
jmp 0x100469b8
and dword [ebp - 0x81c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov esi, dword [eax]
imul esi, dword [ebp - 0x81c]
push 1
lea ecx, [ebp - 0x46c]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x100469ec
mov dword [ebp - 0xba4], 1
jmp 0x100469f3
and dword [ebp - 0xba4], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x46c]
call fcn.10012a38
mov esi, dword [ebp - 0x11c]
push 2
lea ecx, [ebp - 0x46c]
call fcn.10012a38
cmp esi, dword [eax]
je 0x10046a24
mov dword [ebp - 0xcd4], 1
jmp 0x10046a2b
and dword [ebp - 0xcd4], 0
mov eax, 0xfda3
imul esi, eax, 0x6337
push 1
lea ecx, [ebp - 0xeb0]
call fcn.10012a38
mov dword [eax], esi
jmp 0x10046895
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x46c]
call fcn.10012a1c
jmp 0x10046816
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.10012a1c
push 2
lea ecx, [ebp - 0x328]
call fcn.10012997
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xa0], 0x56915a13
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0xf7c], 1
mov dword [ebp - 0xf84], 0xfffffffb
mov dword [ebp - 0x9bc], 0xe5fef407
mov dword [ebp - 0x23c], 0
jmp 0x10046acc
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x10046aee
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x328]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10046abf
mov dword [ebp - 0xa0], 1
jmp 0x10046b07
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x10046d7b
mov dword [ebp - 0x17c], 0xfffffff6
push 1
lea ecx, [ebp - 0xd2c]
call fcn.10012997
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x9ac], 0x6b59229a
mov dword [ebp - 0x244], 0
jmp 0x10046b52
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x10046b74
push dword [ebp - 0x244]
lea ecx, [ebp - 0xd2c]
call fcn.10012a38
mov dword [eax], 0xfffffffb
jmp 0x10046b45
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x328]
call fcn.10012a38
cmp dword [eax], 0
je 0x10046b9e
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xd2c]
call fcn.10012a1c
jmp 0x10046d7b
mov dword [ebp - 0x17c], 0x10
jmp 0x10046bb7
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 7
jge 0x10046d67
mov dword [ebp - 0xc54], 8
push 0
lea ecx, [ebp - 0x328]
call fcn.10012a38
cmp dword [eax], 1
jne 0x10046bec
mov dword [ebp - 0xbac], 1
jmp 0x10046bf3
and dword [ebp - 0xbac], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x328]
call fcn.10012a38
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x328]
call fcn.10012a38
mov eax, dword [eax]
mov dword [ebp - 0x9ac], eax
mov esi, dword [ebp - 0x9ac]
inc esi
push 1
lea ecx, [ebp - 0x328]
call fcn.10012a38
cmp dword [eax], esi
jge 0x10046c41
mov dword [ebp - 0x824], 1
jmp 0x10046c48
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0x328]
call fcn.10012a38
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jne 0x10046c6b
mov dword [ebp - 0x82c], 1
jmp 0x10046c72
and dword [ebp - 0x82c], 0
push 0
lea ecx, [ebp - 0xd2c]
call fcn.10012a38
and dword [eax], 0
mov dword [ebp - 0xa74], 0
mov esi, dword [ebp - 0xa74]
add esi, dword [ebp - 0x82c]
push 1
lea ecx, [ebp - 0x328]
call fcn.10012a38
sub esi, dword [eax]
cmp esi, 0x43e5
jl 0x10046cbb
mov dword [ebp - 0x9b4], 1
jmp 0x10046cc2
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 0x35211521
je 0x10046cda
mov dword [ebp - 0x834], 1
jmp 0x10046ce1
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x834], eax
je 0x10046cfb
mov dword [ebp - 0xb24], 1
jmp 0x10046d02
and dword [ebp - 0xb24], 0
mov esi, dword [ebp - 0xc54]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x328]
call fcn.10012a38
imul esi, dword [eax]
mov eax, dword [ebp - 0xb24]
add eax, 0x698d
cmp esi, eax
jle 0x10046d37
mov dword [ebp - 0x83c], 1
jmp 0x10046d3e
and dword [ebp - 0x83c], 0
push 0
lea ecx, [ebp - 0x328]
call fcn.10012a38
mov esi, dword [ebp - 0x83c]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x328]
call fcn.10012a38
mov dword [eax], esi
jmp 0x10046baa
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xd2c]
call fcn.10012a1c
jmp 0x10046afa
mov eax, dword [ebp - 0x9bc]
inc eax
mov dword [ebp - 0x9bc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.10012a1c
mov dword [ebp - 0x24c], 0x48bbca63
mov dword [ebp - 0xcb8], 1
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10046de2
push 0x1570
push 0x26
push 0x1e53
push 0x893
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x24c], 0xe
jmp 0x10046dfb
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xfffffff3
jle 0x10046e3b
mov dword [ebp - 0xbb4], 0x1265ab3e
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xcb8], eax
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x10046e39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x10046dee
mov dword [ebp - 0x184], 2
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xdb8], 0xfffa
mov dword [ebp - 0xdb4], 0xfffa
mov dword [ebp - 0xdb0], 0xfffa
mov dword [ebp - 0xdac], 0xfffa
mov dword [ebp - 0x254], 0
jmp 0x10046e90
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x10046eac
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xd8c], 0x71c7bf0b
jmp 0x10046e83
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd8c]
mov dword [ebp - 0x844], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x844]
mov dword [ebp + eax - 0xdb8], ecx
cmp dword [ebp - 0x844], 0
je 0x100472f1
mov dword [ebp - 0x264], 0x2703d9b9
mov dword [ebp - 0x414], 0x5e42506e
mov dword [ebp - 0x124], 0xb5b06a83
mov dword [ebp - 0x884], 1
mov dword [ebp - 0x25c], 0
jmp 0x10046f37
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x10046f53
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xd44], 0
jmp 0x10046f2a
mov eax, 0x9ecf4a41
test eax, eax
je 0x10046f74
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + eax - 0xd8c], ecx
jmp 0x10047244
mov dword [ebp - 0x26c], 0xec56
mov dword [ebp - 0xa7c], 0x9c3f9080
mov dword [ebp - 0x1d8], 0
jmp 0x10046fa1
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x10046fbd
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x113c], 0
jmp 0x10046f94
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd44], 0x7fce
jl 0x10046fdc
mov dword [ebp - 0x874], 1
jmp 0x10046fe3
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0xa7c], eax
je 0x10047009
mov dword [ebp - 0x84c], 1
jmp 0x10047010
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x264]
cmp eax, 6
je 0x1004702d
mov dword [ebp - 0x9c4], 1
jmp 0x10047034
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x9c4], 1
jb 0x10047049
mov dword [ebp - 0x854], 1
jmp 0x10047050
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0xa8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xd44]
jne 0x10047077
mov dword [ebp - 0xadc], 1
jmp 0x1004707e
and dword [ebp - 0xadc], 0
cmp dword [ebp - 0xadc], 0xffff
jae 0x10047096
mov dword [ebp - 0x3ac], 1
jmp 0x1004709d
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp + eax - 0xd8c], ecx
mov eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x3ac]
je 0x100470ca
mov dword [ebp - 0x85c], 1
jmp 0x100470d1
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x85c], eax
jg 0x100470eb
mov dword [ebp - 0x9cc], 1
jmp 0x100470f2
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x26c]
imul eax, dword [ebp - 0x9cc]
cmp eax, 0xad4db1d7
ja 0x10047112
mov dword [ebp - 0x864], 1
jmp 0x10047119
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x864]
lea eax, [ecx + eax + 3]
cmp eax, 0x1364
jne 0x1004713c
mov dword [ebp - 0xa84], 1
jmp 0x10047143
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x25ac
jle 0x10047175
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd8c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd44]
cmp dword [ebp - 0x26c], eax
jle 0x10047195
mov dword [ebp - 0x86c], 1
jmp 0x1004719c
and dword [ebp - 0x86c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x86c]
sub ecx, dword [ebp + eax - 0xd44]
mov dword [ebp - 0x9d4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9d4]
mov dword [ebp + eax - 0x113c], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xdb8]
cmp eax, dword [ebp - 0x9d4]
je 0x100471e8
mov dword [ebp - 0xb0c], 1
jmp 0x100471ef
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x874]
add eax, dword [ebp - 0xb0c]
je 0x10047210
push 9
pop eax
test eax, eax
je 0x10047210
mov dword [ebp - 0x87c], 1
jmp 0x10047217
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x87c], eax
jle 0x10047231
mov dword [ebp - 0x9dc], 1
jmp 0x10047238
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x9dc]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x184], 0
jmp 0x1004725d
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff3
jl 0x100472ef
mov dword [ebp - 0x124], 0
jmp 0x10047283
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jg 0x100472dc
mov dword [ebp - 0xa8], 0
jmp 0x100472a5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x100472da
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x100472d8
push 0
push 0x610
push 0
push 0
push 0x193d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10047298
jmp 0x10047276
cmp dword [ebp - 0x884], 0
je 0x100472ea
jmp 0x10047250
jmp 0x10047250
jmp 0x10047311
mov dword [ebp - 0xbbc], 0xfffffff9
mov dword [ebp - 0xc64], 0xffffffff
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xc64], eax
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1004733e
push 0
push 0
push 0x574
push 0x1a30
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 0xf94], 0x1066c464
mov dword [ebp - 0x274], 0x48bbca63
mov dword [ebp - 0xcc0], 1
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10047393
push 0x1570
push 0x26
push 0x1e53
push 0x893
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x274], 0xe
jmp 0x100473ac
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xfffffff3
jle 0x100473ec
mov dword [ebp - 0xbc4], 0x1265ab3e
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xcc0], eax
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x100473ea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x1004739f
mov dword [ebp - 0x12c], 4
push 2
lea ecx, [ebp - 0xe80]
call fcn.10012997
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x27c], 0
jmp 0x10047423
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10047445
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xe80]
call fcn.10012a38
mov dword [eax], 7
jmp 0x10047416
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10047468
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x12c], 1
jmp 0x10047481
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x17
jle 0x100476bc
and dword [ebp - 0xe04], 0
and dword [ebp - 0xe00], 0
and dword [ebp - 0xdfc], 0
and dword [ebp - 0xdf8], 0
lea ecx, [ebp - 0x3ed]
call fcn.10012a47
push eax
lea eax, [ebp - 0xdf4]
push eax
lea eax, [ebp - 0xe04]
push eax
lea ecx, [ebp - 0x1104]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x478]
call fcn.100129f6
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0
jmp 0x100474fa
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x100476a8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xef0], eax
cmp dword [ebp - 0x1c], 0
jne 0x10047547
mov dword [ebp - 0xa8c], 1
jmp 0x1004754e
and dword [ebp - 0xa8c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov ecx, dword [ebp - 0xa8c]
add ecx, dword [eax]
jne 0x10047572
mov dword [ebp - 0x88c], 1
jmp 0x10047579
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 6
jne 0x1004758e
mov dword [ebp - 0x9e4], 1
jmp 0x10047595
and dword [ebp - 0x9e4], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov eax, dword [eax]
sub eax, dword [ebp - 0x9e4]
cmp eax, 0xabf8b243
jae 0x100475be
mov dword [ebp - 0x894], 1
jmp 0x100475c5
and dword [ebp - 0x894], 0
imul eax, dword [ebp - 0x894], 0x3521
test eax, eax
je 0x100475e5
cmp dword [ebp - 0x1c], 0
je 0x100475e5
mov dword [ebp - 0xae4], 1
jmp 0x100475ec
and dword [ebp - 0xae4], 0
push 1
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0xae4]
jg 0x1004760f
mov dword [ebp - 0x89c], 1
jmp 0x10047616
and dword [ebp - 0x89c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov esi, dword [eax]
imul esi, dword [ebp - 0x89c]
push 1
lea ecx, [ebp - 0x478]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x1004764a
mov dword [ebp - 0xbcc], 1
jmp 0x10047651
and dword [ebp - 0xbcc], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x478]
call fcn.10012a38
mov esi, dword [ebp - 0x12c]
push 2
lea ecx, [ebp - 0x478]
call fcn.10012a38
cmp esi, dword [eax]
je 0x10047682
mov dword [ebp - 0xc74], 1
jmp 0x10047689
and dword [ebp - 0xc74], 0
mov eax, 0xfda3
imul esi, eax, 0x6337
push 1
lea ecx, [ebp - 0xe80]
call fcn.10012a38
mov dword [eax], esi
jmp 0x100474f3
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x478]
call fcn.10012a1c
jmp 0x10047474
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe80]
call fcn.10012a1c
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0xa94], 1
mov dword [ebp - 0xb2c], 0xffffffff
mov dword [ebp - 0x8a4], 0x4ee87f6f
mov dword [ebp - 0x1018], 0xaf425f5f
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0xbe4], 0
mov dword [ebp - 0x3b4], 0x5457d670
push 1
lea ecx, [ebp - 0xd74]
call fcn.10012997
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x1020], 3
mov dword [ebp - 0x40c], 0x9a6fdd8f
mov dword [ebp - 0xbd4], 0xffffffff
mov dword [ebp - 0xc84], 0xba430906
mov dword [ebp - 0x8cc], 0xbbbf
mov dword [ebp - 0x284], 0
jmp 0x1004777a
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1004779c
push dword [ebp - 0x284]
lea ecx, [ebp - 0xd74]
call fcn.10012a38
mov dword [eax], 6
jmp 0x1004776d
push 0
lea ecx, [ebp - 0xd74]
call fcn.10012a38
mov eax, 0xc1b16eb2
test eax, eax
je 0x1004787b
cmp dword [ebp - 0xb2c], 0
je 0x100477d4
mov eax, 0x66896e60
test eax, eax
je 0x100477d4
mov dword [ebp - 0x9ec], 1
jmp 0x100477db
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x1004781d
cmp dword [ebp - 0x3b4], 0
je 0x1004781d
mov dword [ebp - 0x8ac], 1
jmp 0x10047824
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0xbd4]
cmp dword [ebp - 0x8ac], eax
jg 0x1004783e
mov dword [ebp - 0x9f4], 1
jmp 0x10047845
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x9f4], 1
jne 0x1004785a
mov dword [ebp - 0x8b4], 1
jmp 0x10047861
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x8b4]
jge 0x1004787b
mov dword [ebp - 0xcc8], 1
jmp 0x10047882
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x1028], eax
push 0
lea ecx, [ebp - 0xd74]
call fcn.10012a38
mov dword [eax], 0x14c259db
mov eax, 0x14c259db
sub eax, dword [ebp - 0xb2c]
mov ecx, dword [ebp - 0x40c]
add ecx, eax
mov dword [ebp - 0xbdc], ecx
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0xbdc], 0xffffffff
jl 0x100478dc
mov dword [ebp - 0x8bc], 1
jmp 0x100478e3
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x8bc], eax
jne 0x100478fd
mov dword [ebp - 0x9fc], 1
jmp 0x10047904
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
sub eax, dword [ebp - 0xc84]
cmp dword [ebp - 0x3bc], eax
jg 0x10047924
mov dword [ebp - 0x8c4], 1
jmp 0x1004792b
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x8c4], eax
jl 0x10047945
mov dword [ebp - 0xa9c], 1
jmp 0x1004794c
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x8cc]
cmp dword [ebp - 0xa9c], eax
je 0x10047966
mov dword [ebp - 0xa04], 1
jmp 0x1004796d
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x8cc]
cmp dword [ebp - 0xa04], eax
jg 0x10047987
mov dword [ebp - 0x8d4], 1
jmp 0x1004798e
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x8d4], eax
jg 0x100479a8
mov dword [ebp - 0xaec], 1
jmp 0x100479af
and dword [ebp - 0xaec], 0
cmp dword [ebp - 0xaec], 0x8d88
jne 0x100479c7
mov dword [ebp - 0x8dc], 1
jmp 0x100479ce
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xbe4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd74]
call fcn.10012a1c
mov byte [0x1066ddc8], 1
mov dword [ebp - 0x18c], 0xd837
mov dword [ebp - 0xf4], 0x6e871d97
mov dword [ebp - 0xbec], 0
cmp dword [ebp - 0x18c], 8
jbe 0x10047a23
mov dword [ebp - 0xa0c], 1
jmp 0x10047a2a
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf4], 0
jmp 0x10047a4f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x13
jl 0x10047bb6
mov dword [ebp - 0xcd0], 5
mov dword [ebp - 0x18c], 0
jmp 0x10047a7f
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xa
jne 0x10047bb1
push 2
lea ecx, [ebp - 0xc90]
call fcn.10012997
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x28c], 0
jmp 0x10047ab9
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x10047adb
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xc90]
call fcn.10012a38
mov dword [eax], 0x51cf
jmp 0x10047aac
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x10047afc
push 0x3f6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
lea ecx, [ebp - 0xc90]
call fcn.10012a38
mov ecx, dword [ebp - 0xcd0]
cmp dword [eax], ecx
jg 0x10047b1f
mov dword [ebp - 0xaa4], 1
jmp 0x10047b26
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1030], eax
push 1
lea ecx, [ebp - 0xc90]
call fcn.10012a38
cmp dword [eax], 0
jne 0x10047b56
cmp dword [ebp - 0xf4], 0
jne 0x10047b56
and dword [ebp - 0x8e4], 0
jmp 0x10047b60
mov dword [ebp - 0x8e4], 1
push 0
lea ecx, [ebp - 0xc90]
call fcn.10012a38
mov ecx, dword [ebp - 0x8e4]
cmp ecx, dword [eax]
jge 0x10047b83
mov dword [ebp - 0x8ec], 1
jmp 0x10047b8a
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0xaa4]
imul eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xbec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.10012a1c
jmp 0x10047a72
jmp 0x10047a42
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x1066c470
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x294], 0x3ae35568
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x294], 0
jmp 0x10047bf7
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffe2
jl 0x10047c41
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10047c27
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10047c3f
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x10047bea
mov dword [ebp - 0x194], 2
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0xdc8], 0xfffa
mov dword [ebp - 0xdc4], 0xfffa
mov dword [ebp - 0xdc0], 0xfffa
mov dword [ebp - 0xdbc], 0xfffa
mov dword [ebp - 0x29c], 0
jmp 0x10047c96
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x10047cb2
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0xd08], 0x71c7bf0b
jmp 0x10047c89
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd08]
mov dword [ebp - 0xa14], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa14]
mov dword [ebp + eax - 0xdc8], ecx
cmp dword [ebp - 0xa14], 0
je 0x100480f7
mov dword [ebp - 0x2b4], 0x2703d9b9
mov dword [ebp - 0x410], 0x5e42506e
mov dword [ebp - 0x134], 0xb5b06a83
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x2a4], 0
jmp 0x10047d3d
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jge 0x10047d59
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xd20], 0
jmp 0x10047d30
mov eax, 0x9ecf4a41
test eax, eax
je 0x10047d7a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax - 0xd08], ecx
jmp 0x1004804a
mov dword [ebp - 0x2bc], 0xec56
mov dword [ebp - 0x8f4], 0x9c3f9080
mov dword [ebp - 0x2ac], 0
jmp 0x10047da7
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 4
jge 0x10047dc3
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x112c], 0
jmp 0x10047d9a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd20], 0x7fce
jl 0x10047de2
mov dword [ebp - 0x700], 1
jmp 0x10047de9
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x8f4], eax
je 0x10047e0f
mov dword [ebp - 0xb14], 1
jmp 0x10047e16
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xb14]
sub eax, dword [ebp - 0x2b4]
cmp eax, 6
je 0x10047e33
mov dword [ebp - 0x8fc], 1
jmp 0x10047e3a
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x8fc], 1
jb 0x10047e4f
mov dword [ebp - 0xa1c], 1
jmp 0x10047e56
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
sub eax, dword [ebp - 0xb0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xd20]
jne 0x10047e7d
mov dword [ebp - 0x904], 1
jmp 0x10047e84
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0xffff
jae 0x10047e9c
mov dword [ebp - 0x3c4], 1
jmp 0x10047ea3
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0xd08], ecx
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0x3c4]
je 0x10047ed0
mov dword [ebp - 0xaac], 1
jmp 0x10047ed7
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xaac], eax
jg 0x10047ef1
mov dword [ebp - 0x90c], 1
jmp 0x10047ef8
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x2bc]
imul eax, dword [ebp - 0x90c]
cmp eax, 0xad4db1d7
ja 0x10047f18
mov dword [ebp - 0xa24], 1
jmp 0x10047f1f
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0xa24]
lea eax, [ecx + eax + 3]
cmp eax, 0x1364
jne 0x10047f42
mov dword [ebp - 0x194], 0
jmp 0x10048063
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffffff3
jl 0x100480f5
mov dword [ebp - 0x134], 0
jmp 0x10048089
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jg 0x100480e2
mov dword [ebp - 0xb0], 0
jmp 0x100480ab
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x100480e0
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x100480de
push 0
push 0x610
push 0
push 0
push 0x193d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1004809e
jmp 0x1004807c
cmp dword [ebp - 0x720], 0
je 0x100480f0
jmp 0x10048056
jmp 0x10048056
jmp 0x10048117
mov dword [ebp - 0xc94], 0xfffffff9
mov dword [ebp - 0xbf4], 0xffffffff
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xbf4], eax
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10048144
push 0
push 0
push 0x574
push 0x1a30
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 0x13c], 4
push 2
lea ecx, [ebp - 0xe8c]
call fcn.10012997
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x1dc], 0
jmp 0x1004817b
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1004819d
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xe8c]
call fcn.10012a38
mov dword [eax], 7
jmp 0x1004816e
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x100481c0
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x13c], 1
jmp 0x100481d9
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x17
jle 0x10048414
and dword [ebp - 0xddc], 0
and dword [ebp - 0xdd8], 0
and dword [ebp - 0xdd4], 0
and dword [ebp - 0xdd0], 0
lea ecx, [ebp - 0x3c5]
call fcn.10012a47
push eax
lea eax, [ebp - 0xdcc]
push eax
lea eax, [ebp - 0xddc]
push eax
lea ecx, [ebp - 0x10e4]
call fcn.10012a4a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x460]
call fcn.100129f6
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0
jmp 0x10048252
cmp dword [ebp - 0x20], 3
jg 0x10048400
push dword [ebp - 0x20]
lea ecx, [ebp - 0x460]
call fcn.10012a38
push dword [ebp - 0x20]
lea ecx, [ebp - 0x460]
call fcn.10012a38
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x20], 0
jne 0x1004829f
mov dword [ebp - 0x728], 1
jmp 0x100482a6
and dword [ebp - 0x728], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x460]
call fcn.10012a38
mov ecx, dword [ebp - 0x728]
add ecx, dword [eax]
jne 0x100482ca
mov dword [ebp - 0x730], 1
jmp 0x100482d1
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 6
jne 0x100482e6
mov dword [ebp - 0x738], 1
jmp 0x100482ed
and dword [ebp - 0x738], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x460]
call fcn.10012a38
mov eax, dword [eax]
sub eax, dword [ebp - 0x738]
cmp eax, 0xabf8b243
jae 0x10048316
mov dword [ebp - 0x740], 1
jmp 0x1004831d
and dword [ebp - 0x740], 0
imul eax, dword [ebp - 0x740], 0x3521
test eax, eax
je 0x1004833d
cmp dword [ebp - 0x20], 0
je 0x1004833d
mov dword [ebp - 0x748], 1
jmp 0x10048344
and dword [ebp - 0x748], 0
push 1
lea ecx, [ebp - 0x460]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x748]
jg 0x10048367
mov dword [ebp - 0x750], 1
jmp 0x1004836e
and dword [ebp - 0x750], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x460]
call fcn.10012a38
mov esi, dword [eax]
imul esi, dword [ebp - 0x750]
push 1
lea ecx, [ebp - 0x460]
call fcn.10012a38
cmp esi, dword [eax]
jge 0x100483a2
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x460]
call fcn.10012a1c
jmp 0x100481cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.10012a1c
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x1066c470
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x6cc]
mov dword [0x1066c460], eax
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x768], 1
mov dword [ebp - 0x788], 0xffffffff
mov dword [ebp - 0x760], 0x4ee87f6f
mov dword [ebp - 0x1058], 0xaf425f5f
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0x3cc], 0x5457d670
push 1
lea ecx, [ebp - 0xd38]
call fcn.10012997
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x1060], 3
mov dword [ebp - 0x428], 0x9a6fdd8f
mov dword [ebp - 0xca4], 0xffffffff
mov dword [ebp - 0xc0c], 0xba430906
mov dword [ebp - 0x7b0], 0xbbbf
mov dword [ebp - 0x1e0], 0
jmp 0x100484ee
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10048510
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xd38]
call fcn.10012a38
mov dword [eax], 6
jmp 0x100484e1
push 0
lea ecx, [ebp - 0xd38]
call fcn.10012a38
mov eax, 0xc1b16eb2
test eax, eax
je 0x100485ef
cmp dword [ebp - 0x788], 0
je 0x10048548
mov eax, 0x66896e60
test eax, eax
je 0x10048548
mov dword [ebp - 0x758], 1
jmp 0x1004854f
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
je 0x10048591
cmp dword [ebp - 0x3cc], 0
je 0x10048591
mov dword [ebp - 0x770], 1
jmp 0x10048598
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xca4]
cmp dword [ebp - 0x770], eax
jg 0x100485b2
mov dword [ebp - 0x778], 1
jmp 0x100485b9
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 1
jne 0x100485ce
mov dword [ebp - 0x780], 1
jmp 0x100485d5
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x780]
jge 0x100485ef
mov dword [ebp - 0xc04], 1
jmp 0x100485f6
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x1024], eax
push 0
lea ecx, [ebp - 0xd38]
call fcn.10012a38
mov dword [eax], 0x14c259db
mov eax, 0x14c259db
sub eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x428]
add ecx, eax
mov dword [ebp - 0xce0], ecx
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0xce0], 0xffffffff
jl 0x10048650
mov dword [ebp - 0x790], 1
jmp 0x10048657
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x3d4]
cmp dword [ebp - 0x790], eax
jne 0x10048671
mov dword [ebp - 0x798], 1
jmp 0x10048678
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0xc0c]
cmp dword [ebp - 0x3d4], eax
jg 0x10048698
mov dword [ebp - 0x7a0], 1
jmp 0x1004869f
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x3d4]
cmp dword [ebp - 0x7a0], eax
jl 0x100486b9
mov dword [ebp - 0x7a8], 1
jmp 0x100486c0
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x7a8], eax
je 0x100486da
mov dword [ebp - 0x7b8], 1
jmp 0x100486e1
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x7b8], eax
jg 0x100486fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret