Function at 0x1003627d
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Delete registry value
Encrypt data using speck
Get common file path
Get keyboard layout
Parse pe header
Query environment variable
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d97c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2710
call fcn.10089270
push esi
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x11c], 0xafbf2617
mov dword [ebp - 0xa84], 8
mov byte [ebp - 0x1cc], 0
movzx eax, byte [ebp - 0x1cc]
test eax, eax
je 0x100362e2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x1d0], 0
jmp 0x100362fb
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffffa
jle 0x10036713
mov dword [ebp - 0x258], 0x386cce57
push 3
lea ecx, [ebp - 0x90c]
call fcn.10022b61
and dword [ebp - 4], 0
mov dword [ebp - 0x15fc], 0
mov dword [ebp - 0x6c4], 0
jmp 0x10036346
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 3
jge 0x10036368
push dword [ebp - 0x6c4]
lea ecx, [ebp - 0x90c]
call fcn.10022bff
mov dword [eax], 0x8abf8b24
jmp 0x10036339
cmp dword [ebp - 0x258], 0
je 0x10036473
mov dword [ebp - 0x2008], 0x320f2d62
mov dword [ebp - 0x2188], 7
mov dword [ebp - 0x12bc], 0xafe44fa3
push 2
lea ecx, [ebp - 0x1e08]
call fcn.10022b61
mov byte [ebp - 4], 1
mov dword [ebp - 0x344], 0
jmp 0x100363bd
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jge 0x100363df
push dword [ebp - 0x344]
lea ecx, [ebp - 0x1e08]
call fcn.10022bff
mov dword [eax], 9
jmp 0x100363b0
mov dword [ebp - 0x258], 0xfffffff7
jmp 0x100363f8
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x30
jl 0x1003641d
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x1003641b
push 0
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x100363eb
mov eax, dword [ebp - 0xa84]
cmp dword [ebp - 0xa84], eax
jg 0x10036437
mov dword [ebp - 0x12b4], 1
jmp 0x1003643e
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x12b4]
mov dword [ebp - 0x12bc], eax
mov esi, dword [ebp - 0x12bc]
push 0
lea ecx, [ebp - 0x1e08]
call fcn.10022bff
mov dword [eax], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1e08]
call fcn.10022be3
jmp 0x100365a3
mov dword [ebp - 0x59c], 6
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x2190], eax
push 0
lea ecx, [ebp - 0x90c]
call fcn.10022bff
cmp dword [eax], 0x2c67
jl 0x100364aa
mov dword [ebp - 0x12c4], 1
jmp 0x100364b1
and dword [ebp - 0x12c4], 0
push 0
lea ecx, [ebp - 0x90c]
call fcn.10022bff
mov ecx, dword [ebp - 0x12c4]
cmp ecx, dword [eax]
jle 0x100364d4
mov dword [ebp - 0x12cc], 1
jmp 0x100364db
and dword [ebp - 0x12cc], 0
cmp dword [ebp - 0x12cc], 0xffffffff
jae 0x100364f0
mov dword [ebp - 0x1324], 1
jmp 0x100364f7
and dword [ebp - 0x1324], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x1324], eax
jle 0x10036511
mov dword [ebp - 0x1b9c], 1
jmp 0x10036518
and dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x59c], 0
jne 0x1003653c
push 1
lea ecx, [ebp - 0x90c]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1003653c
and dword [ebp - 0x15f4], 0
jmp 0x10036546
mov dword [ebp - 0x15f4], 1
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x2198], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x21a4], eax
mov eax, dword [ebp - 0x59c]
cmp dword [ebp - 0x59c], eax
jle 0x1003657e
cmp dword [ebp - 0x11c], 0
jne 0x1003657e
and dword [ebp - 0x132c], 0
jmp 0x10036588
mov dword [ebp - 0x132c], 1
push 0
lea ecx, [ebp - 0x90c]
call fcn.10022bff
mov ecx, dword [ebp - 0x132c]
add ecx, dword [eax]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x11c], 0
jmp 0x100365bc
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jg 0x100366ff
mov dword [ebp - 0x1334], 7
push 2
lea ecx, [ebp - 0x1bf4]
call fcn.10022b61
mov byte [ebp - 4], 2
mov dword [ebp - 0x34c], 0
jmp 0x100365fd
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x1003661f
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x1bf4]
call fcn.10022bff
mov dword [eax], 0xa1bd053a
jmp 0x100365f0
cmp dword [ebp - 0x258], 0
je 0x100366cb
push 0
lea ecx, [ebp - 0x90c]
call fcn.10022bff
cmp dword [eax], 0
jne 0x10036645
cmp dword [ebp - 0x15fc], 0xffffffff
mov eax, 0x4fbf
test eax, eax
je 0x10036657
cmp dword [ebp - 0x1334], 0
jne 0x1003665e
cmp dword [ebp - 0x1334], 0
push 0
lea ecx, [ebp - 0x1bf4]
call fcn.10022bff
mov esi, eax
push 0
lea ecx, [ebp - 0x1bf4]
call fcn.10022bff
mov ecx, dword [esi]
sub ecx, dword [eax]
jne 0x1003669b
push 2
lea ecx, [ebp - 0x90c]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1003669b
and dword [ebp - 0x133c], 0
jmp 0x100366a5
mov dword [ebp - 0x133c], 1
push 0
lea ecx, [ebp - 0x90c]
call fcn.10022bff
mov ecx, dword [ebp - 0x133c]
imul ecx, dword [eax]
test ecx, ecx
je 0x100366cb
mov dword [ebp - 0x1344], 1
jmp 0x100366d2
and dword [ebp - 0x1344], 0
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x90c]
call fcn.10022bff
mov ecx, dword [ebp - 0x1344]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bf4]
call fcn.10022be3
jmp 0x100365af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c]
call fcn.10022be3
jmp 0x100362ee
mov dword [ebp - 0x958], 0x2a6e
mov dword [ebp - 0x19e8], 0x1000a710
cmp dword [ebp - 0x958], 0x2b9e
jle 0x100367ee
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
and dword [ebp - 0x5a4], 0
jmp 0x1003675b
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0x3698
jge 0x100367ee
and dword [ebp - 0x75c], 0
jmp 0x10036781
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0x282a
jge 0x100367e9
and dword [ebp - 0x354], 0
jmp 0x100367a3
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x2425
jge 0x100367e7
mov eax, dword [ebp - 0x75c]
imul eax, dword [ebp - 0x354]
or eax, dword [ebp - 0x5a4]
cdq
mov dword [ebp - 0x1628], eax
mov dword [ebp - 0x1624], edx
push dword [ebp - 0x1624]
push dword [ebp - 0x1628]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10036796
jmp 0x10036774
jmp 0x1003674e
cmp dword [ebp + 0x10], 0
jbe 0x10036dac
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10036dac
mov dword [ebp - 0xb8], 0xe0648261
mov dword [ebp - 0xb8], 0
jmp 0x10036827
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffe7
jle 0x10036d5f
mov dword [ebp - 0x6cc], 0xffffffff
mov dword [ebp - 0x1338], 0xc4e2bf5f
mov dword [ebp - 0x35c], 0
jmp 0x10036861
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x1003687d
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0x144c], 0
jmp 0x10036854
mov dword [ebp - 0x6cc], 0x17
jmp 0x10036896
mov eax, dword [ebp - 0x6cc]
dec eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0xfffffffd
jge 0x10036d5a
mov dword [ebp - 0x150], 0x87cf2e56
cmp dword [ebp - 0x150], 0
je 0x100368bb
jmp 0x10036d5a
mov dword [ebp - 0x150], 0
jmp 0x100368d4
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jg 0x10036d55
mov dword [ebp - 0xfc], 8
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x10036909
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [ebp - 0xfc], 2
jmp 0x10036922
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x10036d50
mov dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xfc]
cmp dword [ebp + eax*4 - 0x144c], ecx
jge 0x1003695a
mov dword [ebp - 0x134c], 1
jmp 0x10036961
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x134c]
mov dword [ebp + eax*4 - 0x144c], ecx
mov dword [ebp - 0x1128], 0x780a
mov dword [ebp - 0x1614], 0x1000a738
cmp dword [ebp - 0x1128], 0x7b49
jle 0x10036a59
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
and dword [ebp - 0x36c], 0
jmp 0x100369bc
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x17c1
jge 0x10036a51
and dword [ebp - 0x364], 0
jmp 0x100369e2
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x6bd6
jge 0x10036a4c
and dword [ebp - 0x5ac], 0
jmp 0x10036a04
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0x3166
jge 0x10036a4a
mov eax, dword [ebp - 0x364]
cdq
idiv dword [ebp - 0x5ac]
xor edx, dword [ebp - 0x36c]
mov eax, edx
cdq
mov dword [ebp - 0x1634], eax
mov dword [ebp - 0x1630], edx
push dword [ebp - 0x1630]
push dword [ebp - 0x1634]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x100369f7
jmp 0x100369d5
jmp 0x100369af
push 0
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [ebp - 0x2d8], 2
jmp 0x10036a72
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jl 0x10036d2f
mov dword [ebp - 0x13e4], 0x646b8d96
mov dword [ebp - 0x13e0], 0x646b8d96
mov dword [ebp - 0x13dc], 0x646b8d96
mov dword [ebp - 0x13d8], 0x646b8d96
mov dword [ebp - 0x1398], 0x63c5
mov dword [ebp - 0x160c], 0x1000a750
cmp dword [ebp - 0x1398], 0x669e
jle 0x10036bd2
and dword [ebp - 0x5b4], 0
jmp 0x10036ae1
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0x2f70
jge 0x10036bd2
and dword [ebp - 0x7cc], 0
jmp 0x10036b07
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0x5d2f
jge 0x10036bcd
and dword [ebp - 0x374], 0
jmp 0x10036b2d
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x1a60
jge 0x10036bc8
and dword [ebp - 0x37c], 0
jmp 0x10036b53
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x3d2f
jge 0x10036bc3
mov eax, dword [ebp - 0x7cc]
imul eax, dword [ebp - 0x374]
add eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x37c]
cdq
mov dword [ebp - 0x1640], eax
mov dword [ebp - 0x163c], edx
push dword [ebp - 0x163c]
push dword [ebp - 0x1640]
lea ecx, [ebp - 0x2338]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1604], eax
mov ecx, dword [ebp - 0x1604]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2338]
call fcn.1002281d
jmp 0x10036b46
jmp 0x10036b20
jmp 0x10036afa
jmp 0x10036ad4
cmp dword [ebp - 0x1398], 0x6287
jge 0x10036bea
push dword [ebp - 0x160c]
call fcn.10077843
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13e4], 2
jmp 0x10036c18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x13e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13e4], 0
jl 0x10036d2a
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp + eax*4 - 0x144c]
mov dword [ebp - 0x217c], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x144c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x13e4]
je 0x10036c68
mov dword [ebp - 0x12ac], 1
jmp 0x10036c6f
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1338], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp + eax*4 - 0x144c]
cmp dword [ebp - 0x1338], eax
jle 0x10036c9c
mov dword [ebp - 0x948], 1
jmp 0x10036ca3
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x948], eax
jne 0x10036cbd
mov dword [ebp - 0xe88], 1
jmp 0x10036cc4
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x12ac]
cmp eax, dword [ebp - 0xe88]
jl 0x10036cde
mov dword [ebp - 0x950], 1
jmp 0x10036ce5
and dword [ebp - 0x950], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x950]
sub ecx, dword [ebp + eax - 0x13e4]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x144c], ecx
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x10036d25
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x10036bfd
jmp 0x10036a65
cmp dword [ebp - 0x1128], 0x7663
jge 0x10036d4b
mov edx, dword [ebp - 0x1614]
mov ecx, 0x10092b78
call fcn.10025597
jmp 0x10036915
jmp 0x100368c7
jmp 0x10036889
jmp 0x1003681a
mov dword [ebp - 0xb8], 0
jmp 0x10036d78
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 8
je 0x10036d98
mov dword [ebp - 0x161c], 0xfffffffb
cmp dword [ebp - 0x161c], 0
je 0x10036d96
jmp 0x10036d98
jmp 0x10036d6b
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10030761
pop ecx
pop ecx
jmp 0x10046cf1
cmp dword [ebp - 0x958], 0x27d0
jge 0x10036dc8
mov edx, dword [ebp - 0x19e8]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x2d0], 0x189
mov dword [ebp - 0x890], 0x1aae4b9
mov dword [ebp - 0x960], 0xfe2cf45
mov dword [ebp - 0x1130], 0x6efe0cd1
mov dword [ebp - 0x19f0], 0xffffffff
mov dword [ebp - 0x808], 0x50714ba0
mov dword [ebp - 0x1a08], 0x96d56a42
mov dword [ebp - 0x98], 0
jmp 0x10036e27
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10036e43
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x914], 0xb1a88af1
jmp 0x10036e1a
mov dword [ebp - 0x98], 0
jmp 0x10036e5c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10036e78
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1a10], 0xffffffff
jmp 0x10036e4f
cmp dword [ebp - 0x2d0], 0
jne 0x100370c9
cmp dword [ebp - 0x2d0], 0
jne 0x10036ef1
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x2d0], eax
jl 0x10036ea8
mov dword [ebp - 0xe90], 1
jmp 0x10036eaf
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0xe90]
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 0x6046e74a
jg 0x10036ed3
mov dword [ebp - 0x1278], 1
jmp 0x10036eda
and dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0x890]
add eax, dword [ebp - 0x1278]
jne 0x10036ef1
and dword [ebp - 0x968], 0
jmp 0x10036efb
mov dword [ebp - 0x968], 1
mov eax, dword [ebp - 0x890]
cmp dword [ebp - 0x968], eax
jne 0x10036f15
mov dword [ebp - 0xe98], 1
jmp 0x10036f1c
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0xe98], eax
jl 0x10036f36
mov dword [ebp - 0x970], 1
jmp 0x10036f3d
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x1130], eax
cmp dword [ebp - 0x1130], 1
je 0x10036f6e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x914], 0
je 0x10036f6e
mov dword [ebp - 0x978], 1
jmp 0x10036f75
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x978], 0x3ae5
je 0x10036f9a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x914], 0
jne 0x10036f9a
and dword [ebp - 0xea0], 0
jmp 0x10036fa4
mov dword [ebp - 0xea0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x914]
cmp dword [ebp - 0xea0], eax
jg 0x10036fc5
mov dword [ebp - 0x980], 1
jmp 0x10036fcc
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x19f0]
cmp dword [ebp - 0x980], eax
jle 0x10036fe6
mov dword [ebp - 0x1360], 1
jmp 0x10036fed
and dword [ebp - 0x1360], 0
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x1360]
jl 0x10037007
mov dword [ebp - 0x988], 1
jmp 0x1003700e
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x10037036
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10037036
mov dword [ebp - 0x19f8], 1
jmp 0x1003703d
and dword [ebp - 0x19f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x914]
mov dword [ebp - 0x1fe0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x914]
cmp dword [ebp - 0x808], eax
jl 0x10037071
mov dword [ebp - 0x1a00], 1
jmp 0x10037078
and dword [ebp - 0x1a00], 0
cmp dword [ebp - 0x1a08], 0
je 0x1003708a
mov eax, 0x2a4e6309
test eax, eax
jne 0x100370a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x914], 0
jne 0x100370a3
and dword [ebp - 0xea8], 0
jmp 0x100370ad
mov dword [ebp - 0xea8], 1
cmp dword [ebp - 0xea8], 0xaee5
jge 0x100370c9
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x100370c9
and dword [ebp - 0x990], 0
jmp 0x100370d3
mov dword [ebp - 0x990], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x990]
mov dword [ebp + eax - 0x1a10], ecx
cmp dword [ebp + 0x10], 0
jne 0x1003cbc7
mov dword [ebp - 0x8fc], 0
push 4
lea ecx, [ebp - 0x1c0c]
call fcn.10022b61
mov dword [ebp - 4], 3
mov dword [ebp - 0x810], 0xfa8bc07c
mov dword [ebp - 0x998], 0x8f2ba167
mov dword [ebp - 0x1a18], 0xfffffffe
mov dword [ebp - 0x1a28], 0x3072c02a
mov dword [ebp - 0x2088], 0xffffffff
mov dword [ebp - 0xd8], 0
jmp 0x10037159
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10037175
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1c78], 0x1bc7dcd6
jmp 0x1003714c
mov dword [ebp - 0xd8], 0
jmp 0x1003718e
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x100371b0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1c0c]
call fcn.10022bff
mov dword [eax], 7
jmp 0x10037181
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c78], 0
jb 0x100371cc
mov dword [ebp - 0x1138], 1
jmp 0x100371d3
and dword [ebp - 0x1138], 0
push 0
lea ecx, [ebp - 0x1c0c]
call fcn.10022bff
mov dword [eax], 0x747b
mov eax, dword [ebp - 0x1138]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x998], eax
imul eax, dword [ebp - 0x998], 0x747b
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1c78]
add ecx, 0xffaf
cmp ecx, eax
jle 0x1003722b
mov dword [ebp - 0xeb0], 1
jmp 0x10037232
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x1a18]
add eax, dword [ebp - 0xeb0]
je 0x1003725e
push 0
lea ecx, [ebp - 0x1c0c]
call fcn.10022bff
cmp dword [eax], 0
je 0x1003725e
mov dword [ebp - 0x9a0], 1
jmp 0x10037265
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x8fc]
dec eax
mov dword [ebp - 0x8fc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1c78]
add eax, dword [ebp - 0x9a0]
cmp dword [ebp - 0x8fc], eax
jne 0x10037298
mov dword [ebp - 0x1280], 1
jmp 0x1003729f
and dword [ebp - 0x1280], 0
cmp dword [ebp - 0x1280], 0xfffffff8
jle 0x100372b4
mov dword [ebp - 0x9a8], 1
jmp 0x100372bb
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0
jle 0x100372d0
mov dword [ebp - 0x1a20], 1
jmp 0x100372d7
and dword [ebp - 0x1a20], 0
mov eax, dword [ebp - 0x1a28]
mov dword [ebp - 0x1e78], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x810]
mov dword [ebp + eax - 0x1c78], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c0c]
call fcn.10022be3
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1002659b
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x250], 0xfffffff9
mov dword [ebp - 0x1148], 0x2632c5b6
mov dword [ebp - 0xeb8], 0x278a
mov dword [ebp - 0x1a38], 0x1000a7a4
cmp dword [ebp - 0xeb8], 0x27a2
jle 0x1003745e
and dword [ebp - 0x5bc], 0
jmp 0x10037364
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x665c
jge 0x1003745e
and dword [ebp - 0x6d4], 0
jmp 0x1003738a
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 0x1169
jge 0x10037459
and dword [ebp - 0x384], 0
jmp 0x100373b0
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x4e21
jge 0x10037454
and dword [ebp - 0x38c], 0
jmp 0x100373d6
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x5e4c
jge 0x1003744f
mov eax, dword [ebp - 0x6d4]
cdq
idiv dword [ebp - 0x384]
mov eax, dword [ebp - 0x5bc]
mov ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0x38c]
shl eax, cl
cdq
mov dword [ebp - 0x164c], eax
mov dword [ebp - 0x1648], edx
push dword [ebp - 0x1648]
push dword [ebp - 0x164c]
lea ecx, [ebp - 0x253c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1a30], eax
mov ecx, dword [ebp - 0x1a30]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x253c]
call fcn.1002281d
jmp 0x100373c9
jmp 0x100373a3
jmp 0x1003737d
jmp 0x10037357
mov dword [ebp - 0x1140], 3
cmp dword [ebp - 0xeb8], 0x2668
jge 0x10037480
push dword [ebp - 0x1a38]
call fcn.10077843
pop ecx
mov dword [ebp - 0x9b0], 0x40fe
mov dword [ebp - 0x1a40], 0x1000a7c8
cmp dword [ebp - 0x9b0], 0x425b
jle 0x10037588
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [ebp - 0x764], 0
jmp 0x100374c0
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 0x1ec2
jge 0x10037588
and dword [ebp - 0x394], 0
jmp 0x100374e6
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x5881
jge 0x10037583
and dword [ebp - 0x5c4], 0
jmp 0x1003750c
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0x3322
jge 0x1003757e
and dword [ebp - 0x39c], 0
jmp 0x1003752e
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x5f13
jge 0x1003757c
mov ecx, dword [ebp - 0x764]
and ecx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x5c4]
cdq
idiv dword [ebp - 0x39c]
or ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x1658], eax
mov dword [ebp - 0x1654], edx
push dword [ebp - 0x1654]
push dword [ebp - 0x1658]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10037521
jmp 0x100374ff
jmp 0x100374d9
jmp 0x100374b3
cmp dword [ebp - 0x9b0], 0x3e0d
jge 0x100375a4
mov edx, dword [ebp - 0x1a40]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x1a50], 0xba09a164
mov dword [ebp - 0x6dc], 0
jmp 0x100375c7
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 3
jge 0x100375e3
mov eax, dword [ebp - 0x6dc]
mov dword [ebp + eax*4 - 0x21dc], 0xfffffff6
jmp 0x100375ba
mov dword [ebp - 0x250], 0
jmp 0x100375fc
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xfffffff4
jle 0x1003775a
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x898], 0xcf456574
mov dword [ebp - 0x1140], 1
mov eax, dword [ebp - 0x1140]
sub eax, dword [ebp - 0x898]
mov dword [ebp - 0x9b8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9b8]
mov dword [ebp + eax - 0x21dc], ecx
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x9b8]
je 0x10037666
mov dword [ebp - 0xec0], 1
jmp 0x1003766d
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0xec0], eax
je 0x10037687
mov dword [ebp - 0x9c0], 1
jmp 0x1003768e
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x9c0], eax
jle 0x100376a8
mov dword [ebp - 0x1328], 1
jmp 0x100376af
and dword [ebp - 0x1328], 0
mov eax, dword [ebp - 0x1148]
cmp dword [ebp - 0x1328], eax
jge 0x100376c9
mov dword [ebp - 0x9c8], 1
jmp 0x100376d0
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0x9c8]
jl 0x100376ea
mov dword [ebp - 0xec8], 1
jmp 0x100376f1
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x898]
imul eax, dword [ebp - 0xec8]
sub eax, dword [ebp - 0x898]
cmp eax, 0x1a88
jle 0x10037717
mov dword [ebp - 0x9d0], 1
jmp 0x1003771e
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x9d0], eax
jl 0x10037738
mov dword [ebp - 0x1a48], 1
jmp 0x1003773f
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0x1148]
mov dword [ebp - 0x216c], eax
mov dword [ebp - 0x1a50], 0xd2fc5c3c
jmp 0x100375ef
mov dword [ebp - 0x1e80], 0xf1124f01
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10037780
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1003779a
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 2
lea ecx, [ebp - 0x13b4]
call fcn.10022b61
mov dword [ebp - 4], 4
mov dword [ebp - 0x1a60], 1
mov dword [ebp - 0x1a68], 0x1d933bd
mov dword [ebp - 0x3a4], 0
jmp 0x100377db
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 2
jge 0x100377fd
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
mov dword [eax], 1
jmp 0x100377ce
mov dword [ebp - 0x1374], 0x6b7
mov dword [ebp - 0x1a70], 0x1000a830
cmp dword [ebp - 0x1374], 0x7d1
jle 0x10037908
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MoveWindow]
and dword [ebp - 0x5cc], 0
jmp 0x10037849
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x2681
jge 0x10037908
and dword [ebp - 0x3ac], 0
jmp 0x1003786f
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0x3a2d
jge 0x10037903
and dword [ebp - 0x7ac], 0
jmp 0x10037895
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0x33d2
jge 0x100378fe
mov eax, dword [ebp - 0x5cc]
sub eax, dword [ebp - 0x3ac]
xor eax, dword [ebp - 0x7ac]
cdq
mov dword [ebp - 0x1664], eax
mov dword [ebp - 0x1660], edx
push dword [ebp - 0x1660]
push dword [ebp - 0x1664]
lea ecx, [ebp - 0x2368]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1a58], eax
mov ecx, dword [ebp - 0x1a58]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2368]
call fcn.1002281d
jmp 0x10037888
jmp 0x10037862
jmp 0x1003783c
push 0
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
and dword [eax], 0
jmp 0x1003793e
push 0
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9d8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
cmp dword [eax], 4
jl 0x10037ad8
mov dword [ebp - 0x3b4], 0xe66c619a
mov dword [ebp - 0x1150], 0xbf748dc1
push 0
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
cmp dword [eax], 0x2006887e
jg 0x10037a43
push 0
lea ecx, [ebp - 0x13b4]
call fcn.10022bff
mov ecx, dword [ebp - 0x3b4]
cmp dword [eax], ecx
jge 0x100379a4
mov dword [ebp - 0xed0], 1
jmp 0x100379ab
and dword [ebp - 0xed0], 0
cmp dword [ebp - 0xed0], 0x1e1d82c3
jle 0x100379c3
mov dword [ebp - 0x9e0], 1
jmp 0x100379ca
and dword [ebp - 0x9e0], 0
cmp dword [ebp - 0x9e0], 0x1e0c863c
jle 0x100379e2
mov dword [ebp - 0x1288], 1
jmp 0x100379e9
and dword [ebp - 0x1288], 0
cmp dword [ebp - 0x1288], 0x737e
jle 0x10037a01
mov dword [ebp - 0x9e8], 1
jmp 0x10037a08
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x9e8]
jg 0x10037a22
mov dword [ebp - 0xed8], 1
jmp 0x10037a29
and dword [ebp - 0xed8], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0xed8], eax
jl 0x10037a43
mov dword [ebp - 0x9f0], 1
jmp 0x10037a4a
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
sub eax, 0x2395
mov dword [ebp - 0x1150], eax
cmp dword [ebp - 0x1150], 0x7806aa1c
jne 0x10037a7c
cmp dword [ebp - 0x1a60], 0
je 0x10037a7c
mov dword [ebp - 0x9f8], 1
jmp 0x10037a83
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
add eax, 0x4ffd76e5
cmp eax, 1
je 0x10037a9f
mov dword [ebp - 0xee0], 1
jmp 0x10037aa6
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0xee0], eax
jle 0x10037ac0
mov dword [ebp - 0xa00], 1
jmp 0x10037ac7
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x1a68], eax
jmp 0x1003791a
cmp dword [ebp - 0x1374], 0x429
jge 0x10037af0
push dword [ebp - 0x1a70]
call fcn.10077843
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13b4]
call fcn.10022be3
cmp dword [section.kojxoc], 0
jne 0x1003c446
mov dword [ebp - 0x1a78], 0xd222
lea eax, [ebp - 0x1a78]
push eax
call fcn.10030666
pop ecx
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x8a0], 3
mov dword [ebp - 0x820], 0x996a5308
mov dword [ebp - 0xa18], 0xfffffff6
mov dword [ebp - 0x8dc], 0x5205300c
mov dword [ebp - 0x1290], 0xf9f3b06d
mov dword [ebp - 0x5d4], 0
jmp 0x10037b7e
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 2
jge 0x10037b9a
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x21a0], 0
jmp 0x10037b71
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2090], eax
cmp dword [ebp - 0x114], 0
je 0x10037bc2
push 4
pop eax
test eax, eax
je 0x10037bc2
mov dword [ebp - 0xa08], 1
jmp 0x10037bc9
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0xa08]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0xfffffffa
ja 0x10037bf4
mov dword [ebp - 0xee8], 1
jmp 0x10037bfb
and dword [ebp - 0xee8], 0
cmp dword [ebp - 0xee8], 0xd07ddbf4
je 0x10037c13
mov dword [ebp - 0xa10], 1
jmp 0x10037c1a
and dword [ebp - 0xa10], 0
xor eax, eax
sub eax, dword [ebp - 0xa10]
cmp eax, dword [ebp - 0x114]
je 0x10037c36
mov dword [ebp - 0x1a80], 1
jmp 0x10037c3d
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1e88], eax
mov eax, 0x813
cmp eax, 0x8fbf
jle 0x10037c67
cmp dword [ebp - 0x114], 0
jne 0x10037c67
and dword [ebp - 0x1158], 0
jmp 0x10037c71
mov dword [ebp - 0x1158], 1
mov eax, dword [ebp - 0x1158]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
cmp dword [ebp - 0x114], eax
jg 0x10037c97
mov dword [ebp - 0xef0], 1
jmp 0x10037c9e
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0xef0]
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 0xd978
jl 0x10037cc2
mov dword [ebp - 0xa20], 1
jmp 0x10037cc9
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0xa20]
inc eax
cmp dword [ebp - 0x8a0], eax
jge 0x10037cff
cmp dword [ebp - 0x8dc], 0
jne 0x10037cff
cmp dword [ebp - 0x820], 0
jne 0x10037cff
and dword [ebp - 0x1a88], 0
jmp 0x10037d09
mov dword [ebp - 0x1a88], 1
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x1290], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1290]
mov dword [ebp + eax - 0x21a0], ecx
push 2
lea ecx, [ebp - 0x141c]
call fcn.10022b61
mov dword [ebp - 4], 5
mov dword [ebp - 0x104], 0xc184c506
mov dword [ebp - 0x1b8c], 4
mov dword [ebp - 0x3bc], 0
jmp 0x10037d69
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 2
jge 0x10037d8b
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x141c]
call fcn.10022bff
mov dword [eax], 0x5b57
jmp 0x10037d5c
mov dword [ebp - 0x104], 1
jmp 0x10037da4
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10037e8b
mov dword [ebp - 0x1a90], 0x106ec6e5
cmp dword [ebp - 0x1a90], 0
jne 0x10037dd6
cmp dword [ebp - 0x104], 0
jne 0x10037dd6
and dword [ebp - 0xa28], 0
jmp 0x10037de0
mov dword [ebp - 0xa28], 1
mov esi, dword [ebp - 0x104]
push dword [ebp - 0x104]
lea ecx, [ebp - 0x141c]
call fcn.10022bff
cmp esi, dword [eax]
jle 0x10037e07
mov dword [ebp - 0xef8], 1
jmp 0x10037e0e
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xa28]
cmp eax, dword [ebp - 0xef8]
jne 0x10037e28
mov dword [ebp - 0xa30], 1
jmp 0x10037e2f
and dword [ebp - 0xa30], 0
push dword [ebp - 0x104]
lea ecx, [ebp - 0x141c]
call fcn.10022bff
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa30]
jg 0x10037e68
push 0
lea ecx, [ebp - 0x141c]
call fcn.10022bff
cmp dword [eax], 0
je 0x10037e68
mov dword [ebp - 0x1b84], 1
jmp 0x10037e6f
and dword [ebp - 0x1b84], 0
push 1
lea ecx, [ebp - 0x141c]
call fcn.10022bff
mov dword [ebp - 0x1b8c], 0xffffffff
jmp 0x10037d97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x141c]
call fcn.10022be3
mov byte [ebp - 0x304], 1
mov byte [ebp - 0x303], 0x5c
mov byte [ebp - 0x302], 2
mov byte [ebp - 0x301], 0x11
mov byte [ebp - 0x300], 4
mov byte [ebp - 0x2ff], 0x59
mov byte [ebp - 0x2fe], 0xb5
mov byte [ebp - 0x2fd], 5
mov byte [ebp - 0x2fc], 0x56
mov byte [ebp - 0x2fb], 0
mov byte [ebp - 0x2fa], 0x33
mov byte [ebp - 0x2f9], 5
mov byte [ebp - 0x2f8], 0x35
mov byte [ebp - 0x2f7], 3
mov byte [ebp - 0x2f6], 0x24
mov byte [ebp - 0x2f5], 7
mov byte [ebp - 0x2f4], 0x3f
mov byte [ebp - 0x2f3], 0xc
mov byte [ebp - 0x2f2], 0x3e
mov byte [ebp - 0x2f1], 0xa
mov byte [ebp - 0x2f0], 0x12
mov byte [ebp - 0x2ef], 0xb
mov byte [ebp - 0x2ee], 0x3d
mov byte [ebp - 0x2ed], 9
mov byte [ebp - 0x2ec], 0x16
mov byte [ebp - 0x2eb], 6
mov byte [ebp - 0x2ea], 0x1d
mov byte [ebp - 0x2e9], 8
mov byte [ebp - 0x2e8], 0x1c
mov byte [ebp - 0x2e7], 4
mov byte [ebp - 0x2e6], 0xa
push 2
lea ecx, [ebp - 0x1c24]
call fcn.10022b61
mov dword [ebp - 4], 6
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x2114], 0xffffffff
mov dword [ebp - 0x1b94], 1
mov dword [ebp - 0x1e90], 0xc3997b09
mov dword [ebp - 0x1bb0], 0xb9628eaf
mov dword [ebp - 0x2098], 0xfffffffc
mov dword [ebp - 0x148c], 0x58d0336d
mov dword [ebp - 0x1330], 3
mov dword [ebp - 0x3c], 0
jmp 0x10037fe7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10038003
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1c24]
call fcn.10022bff
mov dword [eax], 0x342eb90d
jmp 0x10037fe0
mov dword [ebp - 0x3c], 0
jmp 0x10038013
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10038029
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1e98], 0xf8e3bf11
jmp 0x1003800c
mov dword [ebp - 0x3c], 0
jmp 0x10038039
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1003804f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2268], 0xffffffff
jmp 0x10038032
mov dword [ebp - 0x6e4], 1
jmp 0x10038068
mov eax, dword [ebp - 0x6e4]
dec eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 0
jl 0x10038422
mov dword [ebp - 0xa0], 0x2eac4530
mov dword [ebp - 0x830], 0xffffffff
mov dword [ebp - 0x1cd4], 0xf9534236
mov dword [ebp - 0x1cd0], 0xf9534236
mov dword [ebp - 0x1ccc], 0xf9534236
mov dword [ebp - 0x1cc8], 0xf9534236
lea ecx, [ebp - 0x8ed]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1cc4]
push eax
lea eax, [ebp - 0x1cd4]
push eax
lea ecx, [ebp - 0x2238]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2200]
call fcn.10022bbd
mov byte [ebp - 4], 7
mov dword [ebp - 0x828], 0x83a09977
push 2
lea ecx, [ebp - 0x1c6c]
call fcn.10022b61
mov byte [ebp - 4], 8
mov dword [ebp - 0x3c4], 0
jmp 0x1003811e
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 2
jge 0x10038140
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x1c6c]
call fcn.10022bff
mov dword [eax], 0xb79a97a8
jmp 0x10038111
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x10038160
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateICW]
mov dword [ebp - 0xa0], 1
jmp 0x10038179
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x100383ff
mov dword [ebp - 0x3cc], 0xffffffff
mov dword [ebp - 0x5dc], 0
jmp 0x100381a9
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 2
jge 0x100381c5
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x1c80], 0x1966c477
jmp 0x1003819c
cmp dword [ebp - 0xa0], 0
je 0x100382c8
cmp dword [ebp - 0x3cc], 0
je 0x1003829b
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x1b94], eax
mov eax, dword [ebp - 0x828]
dec eax
mov dword [ebp - 0x828], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c80]
cmp dword [ebp - 0x828], eax
jg 0x10038219
mov dword [ebp - 0x8f4], 1
jmp 0x10038220
and dword [ebp - 0x8f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8f4]
mov dword [ebp + eax - 0x1c80], ecx
mov eax, dword [ebp - 0x1330]
cmp dword [ebp - 0x8f4], eax
jl 0x1003824d
mov dword [ebp - 0x1160], 1
jmp 0x10038254
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x1160]
jle 0x1003826e
mov dword [ebp - 0xa38], 1
jmp 0x10038275
and dword [ebp - 0xa38], 0
push 1
lea ecx, [ebp - 0x1c6c]
call fcn.10022bff
mov ecx, dword [ebp - 0xa38]
imul ecx, dword [eax]
test ecx, ecx
je 0x1003829b
mov dword [ebp - 0xf00], 1
jmp 0x100382a2
and dword [ebp - 0xf00], 0
mov eax, dword [ebp - 0xf00]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x148c]
cmp dword [ebp - 0x830], eax
je 0x100382c8
mov dword [ebp - 0xa40], 1
jmp 0x100382cf
and dword [ebp - 0xa40], 0
push 0
lea ecx, [ebp - 0x1c6c]
call fcn.10022bff
mov ecx, dword [ebp - 0xa40]
imul ecx, dword [eax]
test ecx, ecx
jne 0x100382fb
cmp dword [ebp - 0x1330], 0
jne 0x100382fb
and dword [ebp - 0xa48], 0
jmp 0x10038305
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0x1bb0]
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x3cc], eax
jg 0x10038325
mov dword [ebp - 0xf08], 1
jmp 0x1003832c
and dword [ebp - 0xf08], 0
cmp dword [ebp - 0xf08], 0xffff
jae 0x10038344
mov dword [ebp - 0xa50], 1
jmp 0x1003834b
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xa50]
add eax, 6
cmp eax, dword [ebp - 0x3cc]
jle 0x10038368
mov dword [ebp - 0xa58], 1
jmp 0x1003836f
and dword [ebp - 0xa58], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1c24]
call fcn.10022bff
mov dword [ebp - 0x1168], eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1c24]
call fcn.10022bff
mov ecx, dword [ebp - 0x1168]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1168]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa58]
jg 0x100383bd
mov dword [ebp - 0xf10], 1
jmp 0x100383c4
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0xf10]
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x100383fa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x1003816c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c6c]
call fcn.10022be3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2200]
call fcn.10022be3
jmp 0x1003805b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c24]
call fcn.10022be3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x304]
or eax, 0x39
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x304]
and ecx, 0x39
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x304]
mov byte [ebp + ecx - 0x1b64], al
mov dword [ebp - 0xb38], 0x35e3
mov dword [ebp - 0x14c8], 0x1000a888
cmp dword [ebp - 0xb38], 0x399f
jle 0x10038504
and dword [ebp - 0x76c], 0
jmp 0x100384a0
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 0x1864
jge 0x10038504
and dword [ebp - 0x3d4], 0
jmp 0x100384c2
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x5cb3
jge 0x10038502
mov eax, dword [ebp - 0x76c]
cdq
idiv dword [ebp - 0x3d4]
mov eax, edx
cdq
mov dword [ebp - 0x1670], eax
mov dword [ebp - 0x166c], edx
push dword [ebp - 0x166c]
push dword [ebp - 0x1670]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x100384b5
jmp 0x10038493
mov dword [ebp - 0x50], 2
and dword [ebp - 0x42c], 0
jmp 0x1003851c
mov eax, dword [ebp - 0x50]
inc eax
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x1f
jae 0x1003996f
or dword [ebp - 0x1d24], 0xffffffff
or dword [ebp - 0x1d20], 0xffffffff
or dword [ebp - 0x1d1c], 0xffffffff
or dword [ebp - 0x1d18], 0xffffffff
lea ecx, [ebp - 0x8f5]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1d14]
push eax
lea eax, [ebp - 0x1d24]
push eax
lea ecx, [ebp - 0x2278]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2e4]
call fcn.10022bbd
mov dword [ebp - 4], 9
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x160], 0x488
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0x28], 3
jmp 0x100385b0
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10038d92
mov dword [ebp - 0x158], 0x4ec7e318
mov dword [ebp - 0xa60], 0x20fb
mov dword [ebp - 0x1a74], 0x1000a8d8
cmp dword [ebp - 0xa60], 0x21a8
jle 0x100386db
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
and dword [ebp - 0x6ec], 0
jmp 0x1003860c
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0xe4
jge 0x100386cb
and dword [ebp - 0x5e4], 0
jmp 0x10038632
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0x1914
jge 0x100386c6
and dword [ebp - 0x3dc], 0
jmp 0x10038658
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x781a
jge 0x100386c1
mov eax, dword [ebp - 0x5e4]
and eax, dword [ebp - 0x3dc]
or eax, dword [ebp - 0x6ec]
cdq
mov dword [ebp - 0x167c], eax
mov dword [ebp - 0x1678], edx
push dword [ebp - 0x1678]
push dword [ebp - 0x167c]
lea ecx, [ebp - 0x26bc]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1bb8], eax
mov ecx, dword [ebp - 0x1bb8]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x26bc]
call fcn.1002281d
jmp 0x1003864b
jmp 0x10038625
jmp 0x100385ff
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [ebp - 0xa60], 0x1ef8
jge 0x100386f3
push dword [ebp - 0x1a74]
call fcn.10077843
pop ecx
mov dword [ebp - 0xc0], 0
jmp 0x1003870c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10038728
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x924], 0xfffffffb
jmp 0x100386ff
mov dword [ebp - 0xc0], 0
jmp 0x10038741
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1003875d
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x3ec], 0x5e5316d
jmp 0x10038734
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov esi, dword [ebp - 0x160]
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
cmp esi, dword [eax]
je 0x10038792
mov dword [ebp - 0xf18], 1
jmp 0x10038799
and dword [ebp - 0xf18], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
cmp dword [eax], 0xfffffffb
jle 0x100387b8
mov dword [ebp - 0x1298], 1
jmp 0x100387bf
and dword [ebp - 0x1298], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov esi, dword [ebp - 0x1298]
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
sub esi, dword [eax]
cmp esi, dword [ebp - 0x68]
jg 0x10038819
mov dword [ebp - 0xa68], 1
jmp 0x10038820
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 0xd64c9d8d
jbe 0x10038838
mov dword [ebp - 0xa70], 1
jmp 0x1003883f
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xf18]
cmp eax, dword [ebp - 0xa70]
jne 0x10038859
mov dword [ebp - 0x1170], 1
jmp 0x10038860
and dword [ebp - 0x1170], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov ecx, dword [ebp - 0x1170]
cmp ecx, dword [eax]
jge 0x10038884
mov dword [ebp - 0xa78], 1
jmp 0x1003888b
and dword [ebp - 0xa78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x924]
add eax, dword [ebp - 0xa78]
je 0x100388bc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x924], 0
je 0x100388bc
mov dword [ebp - 0xf20], 1
jmp 0x100388c3
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0xf20]
test eax, eax
je 0x100388e3
cmp dword [ebp - 0x28], 0
je 0x100388e3
mov dword [ebp - 0xa80], 1
jmp 0x100388ea
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0xa80], eax
jne 0x10038904
mov dword [ebp - 0x1370], 1
jmp 0x1003890b
and dword [ebp - 0x1370], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1370], eax
jne 0x10038922
mov dword [ebp - 0xa88], 1
jmp 0x10038929
and dword [ebp - 0xa88], 0
cmp dword [ebp - 0xa88], 0x976b5a7d
jb 0x10038941
mov dword [ebp - 0xf28], 1
jmp 0x10038948
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xf28], eax
jg 0x10038c39
mov dword [ebp - 0x1498], 0x5fec6b03
mov dword [ebp - 0x160], 0
jmp 0x1003897a
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jg 0x10038c34
mov dword [ebp - 0x15ec], 0x5d8bac8e
mov dword [ebp - 0x158], 3
jmp 0x100389aa
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x10038c2f
mov dword [ebp - 0xa98], 0
mov dword [ebp - 0x3e4], 0
jmp 0x100389da
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 4
jge 0x100389f6
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x2288], 0x20f90f5f
jmp 0x100389cd
mov dword [ebp - 0x68], 3
jmp 0x10038a06
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10038be3
imul eax, dword [ebp - 0xa98], 9
cmp eax, 0x5c6f
je 0x10038a2e
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10038a2e
and dword [ebp - 0xa90], 0
jmp 0x10038a38
mov dword [ebp - 0xa90], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x924]
cmp dword [ebp - 0xa90], eax
je 0x10038a59
mov dword [ebp - 0x1178], 1
jmp 0x10038a60
and dword [ebp - 0x1178], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x924]
cmp dword [ebp - 0x1178], eax
jle 0x10038a81
mov dword [ebp - 0xf30], 1
jmp 0x10038a88
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0xa98]
cmp dword [ebp - 0xf30], eax
jne 0x10038aa2
mov dword [ebp - 0xaa0], 1
jmp 0x10038aa9
and dword [ebp - 0xaa0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x924]
mov dword [ebp - 0x8a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp + eax - 0x3ec], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp + eax - 0x2288], ecx
mov eax, dword [ebp - 0x8a8]
cmp eax, dword [ebp - 0xaa0]
je 0x10038afb
mov dword [ebp - 0x12a0], 1
jmp 0x10038b02
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x12a0]
sub eax, 0x3437bdcb
cmp eax, 0xffff
ja 0x10038b20
mov dword [ebp - 0xaa8], 1
jmp 0x10038b27
and dword [ebp - 0xaa8], 0
push dword [ebp - 0x158]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov ecx, dword [ebp - 0xaa8]
cmp ecx, dword [eax]
jge 0x10038b4e
mov dword [ebp - 0xf38], 1
jmp 0x10038b55
and dword [ebp - 0xf38], 0
push dword [ebp - 0x158]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov esi, dword [eax]
sub esi, dword [ebp - 0xf38]
shl esi, 2
push dword [ebp - 0x160]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
cmp esi, dword [eax]
je 0x10038b92
mov dword [ebp - 0x18a8], 1
jmp 0x10038b99
and dword [ebp - 0x18a8], 0
mov eax, dword [ebp - 0x15ec]
mov dword [ebp - 0x218c], eax
push dword [ebp - 0x160]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov dword [ebp - 0x1498], 0xfffffff8
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x10038bde
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x100389ff
mov dword [ebp - 0x68], 0
jmp 0x10038bf3
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x10038c2a
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x10038c13
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
cmp dword [eax], 0
je 0x10038c28
jmp 0x10038c2a
jmp 0x10038bec
jmp 0x1003899d
jmp 0x1003896d
jmp 0x10038d8d
mov dword [ebp - 0xf40], 1
mov dword [ebp - 0x5ec], 0xffffffff
push 3
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
cmp dword [eax], 0xac17b1ab
ja 0x10038c6e
mov dword [ebp - 0xab8], 1
jmp 0x10038c75
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1ea0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
mov dword [ebp - 0x20a0], eax
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x1ea8], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e4]
call fcn.10022bff
mov eax, 0xfff6
test eax, eax
jne 0x10038cd9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ec], 0
jne 0x10038cd9
and dword [ebp - 0x1180], 0
jmp 0x10038ce3
mov dword [ebp - 0x1180], 1
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x1180], eax
jge 0x10038cfd
mov dword [ebp - 0xac0], 1
jmp 0x10038d04
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xf40], eax
mov eax, dword [ebp - 0xf40]
cmp eax, dword [ebp - 0xac0]
jge 0x10038d30
mov eax, 0x1fe44aa
test eax, eax
jne 0x10038d30
and dword [ebp - 0x12e0], 0
jmp 0x10038d3a
mov dword [ebp - 0x12e0], 1
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x12e0]
lea eax, [ecx + eax + 1]
test eax, eax
jne 0x10038d64
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x924], 0
jne 0x10038d64
and dword [ebp - 0xac8], 0
jmp 0x10038d6e
mov dword [ebp - 0xac8], 1
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3ec], eax
jmp 0x100385a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.10022be3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x304]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x50], eax
jne 0x1003912c
mov dword [ebp - 0xf48], 0x73c3
mov dword [ebp - 0x1968], 0x1000a930
cmp dword [ebp - 0xf48], 0x75ab
jle 0x10038ebd
and dword [ebp - 0x7ec], 0
jmp 0x10038df6
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 0x5ede
jge 0x10038ebd
and dword [ebp - 0x3f4], 0
jmp 0x10038e1c
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x5669
jge 0x10038eb8
and dword [ebp - 0x5f4], 0
jmp 0x10038e42
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0x1099
jge 0x10038eb3
and dword [ebp - 0x3fc], 0
jmp 0x10038e64
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0xb81
jge 0x10038eb1
mov eax, dword [ebp - 0x7ec]
mov ecx, dword [ebp - 0x3f4]
sar eax, cl
mov ecx, dword [ebp - 0x5f4]
shl eax, cl
or eax, dword [ebp - 0x3fc]
cdq
mov dword [ebp - 0x1688], eax
mov dword [ebp - 0x1684], edx
push dword [ebp - 0x1684]
push dword [ebp - 0x1688]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10038e57
jmp 0x10038e35
jmp 0x10038e0f
jmp 0x10038de9
mov dword [ebp - 0xad0], 1
cmp dword [ebp - 0xf48], 0x70c1
jge 0x10038ee3
mov edx, dword [ebp - 0x1968]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x14a0], 4
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x211c], eax
cmp dword [ebp - 0xad0], 0
je 0x10038f20
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x10038f1e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10038f2a
mov dword [ebp - 0x14a0], 0x2b57e8b7
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x304]
inc eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x1188], 0x5435
mov dword [ebp - 0x18b4], 0x1000a978
cmp dword [ebp - 0x1188], 0x5522
jle 0x10039008
and dword [ebp - 0x6f4], 0
jmp 0x10038f76
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0x4807
jge 0x10039008
and dword [ebp - 0x404], 0
jmp 0x10038f9c
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x1cfe
jge 0x10039003
and dword [ebp - 0x5fc], 0
jmp 0x10038fbe
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0x3acf
jge 0x10039001
mov eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0x404]
add eax, dword [ebp - 0x5fc]
cdq
mov dword [ebp - 0x1694], eax
mov dword [ebp - 0x1690], edx
push dword [ebp - 0x1690]
push dword [ebp - 0x1694]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10038fb1
jmp 0x10038f8f
jmp 0x10038f69
push 1
lea ecx, [ebp - 0x1aa0]
call fcn.10022b61
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x1188], 0x5362
jge 0x10039038
mov edx, dword [ebp - 0x18b4]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x40c], 0
jmp 0x10039051
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 1
jge 0x10039073
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x1aa0]
call fcn.10022bff
mov dword [eax], 0x9f9b3198
jmp 0x10039044
push 0
lea ecx, [ebp - 0x1aa0]
call fcn.10022bff
and dword [eax], 0
jmp 0x100390a9
push 0
lea ecx, [ebp - 0x1aa0]
call fcn.10022bff
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xad8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xad8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1aa0]
call fcn.10022bff
cmp dword [eax], 0xffffffe7
jne 0x10039103
mov dword [ebp - 0x774], 0
jmp 0x100390d4
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 4
jge 0x100390f0
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x2298], 0xfffffffc
jmp 0x100390c7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2298], 0
je 0x10039101
jmp 0x10039103
jmp 0x10039085
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1aa0]
call fcn.10022be3
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x304]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x50], eax
jmp 0x10038514
mov dword [ebp - 0x1dc], 0xcff0ea75
mov dword [ebp - 0x414], 0
jmp 0x1003914f
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 2
jge 0x1003916b
mov eax, dword [ebp - 0x414]
mov dword [ebp + eax*4 - 0x1c88], 0x5761be36
jmp 0x10039142
mov dword [ebp - 0x1dc], 0xffffffff
jmp 0x10039184
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 4
jg 0x10039455
mov dword [ebp - 0x23c], 0x1fc
mov dword [ebp - 0x1e4], 0xfffffffb
mov dword [ebp - 0x14b8], 6
cmp dword [ebp - 0x23c], 0x5440
je 0x100391c7
mov dword [ebp - 0xf50], 1
jmp 0x100391ce
and dword [ebp - 0xf50], 0
imul eax, dword [ebp - 0xf50], 0xfff6
test eax, eax
je 0x100391e8
mov dword [ebp - 0xae0], 1
jmp 0x100391ef
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
sub eax, 0x3ee76371
cmp eax, dword [ebp - 0x1dc]
jle 0x1003920e
mov dword [ebp - 0x14a8], 1
jmp 0x10039215
and dword [ebp - 0x14a8], 0
cmp dword [ebp - 0x1dc], 0x4383
je 0x1003922d
mov dword [ebp - 0x12a8], 1
jmp 0x10039234
and dword [ebp - 0x12a8], 0
imul eax, dword [ebp - 0x12a8], 0xffffffff
cmp dword [ebp - 0x1e4], eax
jg 0x1003924f
mov dword [ebp - 0xae8], 1
jmp 0x10039256
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0xae8]
jl 0x10039270
mov dword [ebp - 0xf58], 1
jmp 0x10039277
and dword [ebp - 0xf58], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf58]
mov dword [ebp + eax - 0x1c88], ecx
mov dword [ebp - 0x1e4], 0xfffffff3
jmp 0x100392a3
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x13
jle 0x10039450
mov dword [ebp - 0x1970], 0x29c214f1
mov dword [ebp - 0x23c], 0
jmp 0x100392d3
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x14
jg 0x1003944b
mov dword [ebp - 0xaf0], 0
push 4
lea ecx, [ebp - 0x1e20]
call fcn.10022b61
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xaf8], 0xb38e5161
mov dword [ebp - 0x14b0], 0
mov dword [ebp - 0x604], 0
jmp 0x1003932b
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 4
jge 0x1003934d
push dword [ebp - 0x604]
lea ecx, [ebp - 0x1e20]
call fcn.10022bff
mov dword [eax], 0x7fc0336a
jmp 0x1003931e
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10039369
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [ebp - 0x1970], 0xa1172167
jae 0x10039381
mov dword [ebp - 0x1190], 1
jmp 0x10039388
and dword [ebp - 0x1190], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xf60], eax
push 3
lea ecx, [ebp - 0x1e20]
call fcn.10022bff
mov ecx, dword [ebp - 0xf60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0xf60], eax
jge 0x100393db
mov dword [ebp - 0xb00], 1
jmp 0x100393e2
and dword [ebp - 0xb00], 0
or eax, 0xffffffff
je 0x100393f9
cmp dword [ebp - 0x14b0], 0
je 0x100393f9
and dword [ebp - 0x12e4], 0
jmp 0x10039403
mov dword [ebp - 0x12e4], 1
mov eax, dword [ebp - 0xb00]
cmp eax, dword [ebp - 0x12e4]
je 0x1003941d
mov dword [ebp - 0x18c0], 1
jmp 0x10039424
and dword [ebp - 0x18c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c88]
mov dword [ebp - 0x14b8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e20]
call fcn.10022be3
jmp 0x100392c6
jmp 0x10039296
jmp 0x10039177
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x303]
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x42c]
movzx ecx, byte [ebp + ecx - 0x306]
movsx ecx, byte [ebp + ecx - 0x1b64]
or eax, ecx
mov ecx, dword [ebp - 0x50]
movzx ecx, byte [ebp + ecx - 0x303]
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x42c]
movzx edx, byte [ebp + edx - 0x306]
movsx edx, byte [ebp + edx - 0x1b64]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x50]
movzx ecx, byte [ebp + ecx - 0x304]
mov byte [ebp + ecx - 0x1b64], al
push 1
lea ecx, [ebp - 0x2c4]
call fcn.10022b61
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x2c], 0x4c506d44
mov dword [ebp - 0x41c], 0
jmp 0x100394e9
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 1
jge 0x1003950b
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov dword [eax], 0x5b57fd54
jmp 0x100394dc
mov dword [ebp - 0x2c], 0
jmp 0x1003951b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x10039954
mov dword [ebp - 0x224], 0xb5a7dd9a
mov dword [ebp - 0x6fc], 0
jmp 0x10039548
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 1
jge 0x10039564
mov eax, dword [ebp - 0x6fc]
mov dword [ebp + eax*4 - 0x1978], 0xffffffff
jmp 0x1003953b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jle 0x1003979c
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov esi, eax
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100395ab
mov dword [ebp - 0xb08], 1
jmp 0x100395b2
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xb08], eax
jl 0x100395c9
mov dword [ebp - 0xf68], 1
jmp 0x100395d0
and dword [ebp - 0xf68], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0xf68]
cmp ecx, dword [eax]
je 0x100395f4
mov dword [ebp - 0xb10], 1
jmp 0x100395fb
and dword [ebp - 0xb10], 0
cmp dword [ebp - 0xb10], 2
jne 0x10039610
mov dword [ebp - 0x1198], 1
jmp 0x10039617
and dword [ebp - 0x1198], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0x1198]
sub ecx, dword [eax]
cmp ecx, 0x7e318b47
jl 0x10039641
mov dword [ebp - 0xb18], 1
jmp 0x10039648
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1eb0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20a8], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov esi, eax
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov esi, dword [esi]
sub esi, dword [eax]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
cmp esi, dword [eax]
jne 0x100396a5
mov dword [ebp - 0xf70], 1
jmp 0x100396ac
and dword [ebp - 0xf70], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0xf70]
cmp ecx, dword [eax]
jne 0x100396d0
mov dword [ebp - 0xb20], 1
jmp 0x100396d7
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb20]
add eax, 0x417f
je 0x100396f7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1003971b
cmp dword [ebp - 0x224], 0
jne 0x1003971b
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1003971b
and dword [ebp - 0x12b0], 0
jmp 0x10039725
mov dword [ebp - 0x12b0], 1
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0x12b0]
cmp ecx, dword [eax]
jle 0x10039748
mov dword [ebp - 0xb28], 1
jmp 0x1003974f
and dword [ebp - 0xb28], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov ecx, dword [ebp - 0xb28]
cmp ecx, dword [eax]
jg 0x10039772
mov dword [ebp - 0xf78], 1
jmp 0x10039779
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0xf78]
add eax, 0x7e29
cmp eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xbc41bbbb
ja 0x1003979c
mov dword [ebp - 0xb30], 1
jmp 0x100397a3
and dword [ebp - 0xb30], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb30]
sub ecx, dword [ebp + eax - 0x1978]
cmp ecx, 0xfffffff6
ja 0x100397d7
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
cmp dword [eax], 0
je 0x100397d2
jmp 0x10039954
jmp 0x1003994f
mov dword [ebp - 0x224], 4
jmp 0x100397f0
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffe2
jg 0x10039840
mov dword [ebp - 0x25c], 0x4965da1f
mov dword [ebp - 0x25c], 0
jmp 0x1003981c
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1003983e
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x2c4]
call fcn.10022bff
mov dword [eax], 1
jmp 0x1003980f
jmp 0x100397e3
mov dword [ebp - 0x11a0], 0x41fd
mov dword [ebp - 0x18cc], 0x1000a9c4
cmp dword [ebp - 0x11a0], 0x4297
jle 0x1003991d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [ebp - 0x424], 0
jmp 0x10039882
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0x5be9
jge 0x10039913
and dword [ebp - 0x60c], 0
jmp 0x100398a8
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0x692c
jge 0x1003990e
mov eax, dword [ebp - 0x424]
cdq
idiv dword [ebp - 0x60c]
mov eax, edx
cdq
mov dword [ebp - 0x16a0], eax
mov dword [ebp - 0x169c], edx
push dword [ebp - 0x169c]
push dword [ebp - 0x16a0]
lea ecx, [ebp - 0x2398]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x14c0], eax
mov ecx, dword [ebp - 0x14c0]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2398]
call fcn.1002281d
jmp 0x1003989b
jmp 0x10039875
push 0
push 0
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x10039937
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp dword [ebp - 0x11a0], 0x3f3b
jge 0x1003994f
push dword [ebp - 0x18cc]
call fcn.10077843
pop ecx
jmp 0x10039514
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.10022be3
and dword [ebp - 0x42c], 0
jmp 0x10038514
cmp dword [ebp - 0xb38], 0x338b
jge 0x1003998b
mov edx, dword [ebp - 0x14c8]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0xf80], 0x8dc
mov dword [ebp - 0x1980], 0x1000a9fc
cmp dword [ebp - 0xf80], 0x9f3
jle 0x10039a22
and dword [ebp - 0x7b4], 0
jmp 0x100399c1
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 0x5cdf
jge 0x10039a22
and dword [ebp - 0x434], 0
jmp 0x100399e3
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0x5d22
jge 0x10039a20
mov eax, dword [ebp - 0x7b4]
xor eax, dword [ebp - 0x434]
cdq
mov dword [ebp - 0x16ac], eax
mov dword [ebp - 0x16a8], edx
push dword [ebp - 0x16a8]
push dword [ebp - 0x16ac]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x100399d6
jmp 0x100399b4
push 2
lea ecx, [ebp - 0x1e38]
call fcn.10022b61
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0xf80], 0x751
jge 0x10039a52
mov edx, dword [ebp - 0x1980]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x1ec], 0xcc2443ac
mov dword [ebp - 0x1eb8], 0xffffffff
mov dword [ebp - 0x1988], 0xa6edad94
mov dword [ebp - 0x4c], 0
jmp 0x10039a80
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10039a9c
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1e38]
call fcn.10022bff
mov dword [eax], 3
jmp 0x10039a79
mov dword [ebp - 0x4c], 0
jmp 0x10039aac
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x10039ac2
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1be8], 0x13532fe2
jmp 0x10039aa5
mov dword [ebp - 0x4c], 0
jmp 0x10039ad2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10039ae8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x11a8], 0
jmp 0x10039acb
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1be8], 1
jmp 0x10039b16
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1be8]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1be8], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1be8], 0
jl 0x10039dae
mov dword [ebp - 0xb40], 0x1c0f
mov dword [ebp - 0x18d8], 0x1000aa28
cmp dword [ebp - 0xb40], 0x1f53
jle 0x10039bfb
and dword [ebp - 0x614], 0
jmp 0x10039b64
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0x2440
jge 0x10039bf5
and dword [ebp - 0x43c], 0
jmp 0x10039b8a
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x442a
jge 0x10039bf0
mov eax, dword [ebp - 0x614]
cdq
idiv dword [ebp - 0x43c]
mov eax, edx
cdq
mov dword [ebp - 0x16b8], eax
mov dword [ebp - 0x16b4], edx
push dword [ebp - 0x16b4]
push dword [ebp - 0x16b8]
lea ecx, [ebp - 0x256c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x14d0], eax
mov ecx, dword [ebp - 0x14d0]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x256c]
call fcn.1002281d
jmp 0x10039b7d
jmp 0x10039b57
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x14d8], 0x4de6
cmp dword [ebp - 0xb40], 0x19d1
jge 0x10039c1d
push dword [ebp - 0x18d8]
call fcn.10077843
pop ecx
mov dword [ebp - 0x124], 0xce45d764
mov dword [ebp - 0x704], 0
jmp 0x10039c40
mov eax, dword [ebp - 0x704]
inc eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 2
jge 0x10039c5c
mov eax, dword [ebp - 0x704]
mov dword [ebp + eax*4 - 0x1fec], 0xffffffff
jmp 0x10039c33
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x1be8]
lea ecx, [ebp - 0x1e38]
call fcn.10022bff
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x1ec]
add eax, dword [ebp - 0x124]
je 0x10039cab
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1be8], 0
je 0x10039cab
mov dword [ebp - 0x12ec], 1
jmp 0x10039cb2
and dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0x14d8]
cmp dword [ebp - 0x12ec], eax
jne 0x10039ccc
mov dword [ebp - 0xb48], 1
jmp 0x10039cd3
and dword [ebp - 0xb48], 0
imul eax, dword [ebp - 0x1988], 0x9744
cmp dword [ebp - 0xb48], eax
jne 0x10039cf1
mov dword [ebp - 0xf88], 1
jmp 0x10039cf8
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x1ec]
add eax, dword [ebp - 0xf88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x11a8]
jge 0x10039d1f
mov dword [ebp - 0xb50], 1
jmp 0x10039d26
and dword [ebp - 0xb50], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb50]
mov dword [ebp + eax - 0x1fec], ecx
mov dword [ebp - 0x124], 0
jmp 0x10039d52
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jg 0x10039da9
mov dword [ebp - 0xb58], 0xfff7
mov dword [ebp - 0x1ec], 1
jmp 0x10039d7e
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x10039da7
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x11a8], 1
mov eax, dword [ebp - 0xb58]
inc eax
mov dword [ebp - 0xb58], eax
jmp 0x10039d71
jmp 0x10039d45
jmp 0x10039afb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e38]
call fcn.10022be3
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1b64], 0
mov dword [ebp - 0x212c], 0
mov dword [ebp - 0x2128], 0
mov dword [ebp - 0x2124], 0
mov dword [ebp - 0x2120], 0
mov dword [ebp - 0x10c], 0x6de713a
mov dword [ebp - 0x10c], 0
jmp 0x10039e16
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x10039e3b
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x10039e39
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
jmp 0x10039e09
mov dword [ebp - 0x10c], 0
jmp 0x10039e54
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x10039e9b
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x10039e7d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10039e99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
jmp 0x10039e47
lea eax, [ebp - 0x1b64]
push eax
lea ecx, [ebp - 0x23c8]
call fcn.1004b4ef
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x18e4], eax
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x18e4]
call fcn.1002659b
mov dword [section.kojxoc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c8]
call fcn.10022ace
mov dword [ebp - 0xa8], 0xe0648261
mov dword [ebp - 0xa8], 0
jmp 0x10039f0e
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe7
jle 0x1003a355
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x2174], 0x100925d8
mov dword [ebp - 0x12b8], 0xc4e2bf5f
mov dword [ebp - 0x444], 0
jmp 0x10039f52
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 3
jge 0x10039f6e
mov eax, dword [ebp - 0x444]
mov dword [ebp + eax*4 - 0x1428], 0
jmp 0x10039f45
mov dword [ebp - 0x61c], 0x17
jmp 0x10039f87
mov eax, dword [ebp - 0x61c]
dec eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0xfffffffd
jge 0x1003a350
mov dword [ebp - 0x168], 0x87cf2e56
cmp dword [ebp - 0x168], 0
je 0x10039fac
jmp 0x1003a350
mov dword [ebp - 0x168], 0
jmp 0x10039fc5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jg 0x1003a34b
mov dword [ebp - 0xf0], 8
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x10039ffa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [ebp - 0xf0], 2
jmp 0x1003a013
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1003a346
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0xf90], 0x7663
mov dword [ebp - 0x1990], 0x1000aa48
cmp dword [ebp - 0xf90], 0x79ac
jle 0x1003a15b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
and dword [ebp - 0x454], 0
jmp 0x1003a07c
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0x3dac
jge 0x1003a13d
and dword [ebp - 0x44c], 0
jmp 0x1003a0a2
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x7f64
jge 0x1003a138
and dword [ebp - 0x77c], 0
jmp 0x1003a0c8
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0x62cf
jge 0x1003a133
mov ecx, dword [ebp - 0x44c]
add ecx, dword [ebp - 0x77c]
mov eax, dword [ebp - 0x454]
sar eax, cl
cdq
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16c0], edx
push dword [ebp - 0x16c0]
push dword [ebp - 0x16c4]
lea ecx, [ebp - 0x265c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x14e8], eax
mov ecx, dword [ebp - 0x14e8]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x265c]
call fcn.1002281d
jmp 0x1003a0bb
jmp 0x1003a095
jmp 0x1003a06f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp dword [ebp - 0xf90], 0x74c6
jge 0x1003a173
push dword [ebp - 0x1990]
call fcn.10077843
pop ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0x1428], ecx
jge 0x1003a194
mov dword [ebp - 0xb60], 1
jmp 0x1003a19b
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xb60]
mov dword [ebp + eax*4 - 0x1428], ecx
mov dword [ebp - 0x2a0], 2
jmp 0x1003a1c7
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x1003a341
mov dword [ebp - 0x1404], 0x646b8d96
mov dword [ebp - 0x1400], 0x646b8d96
mov dword [ebp - 0x13fc], 0x646b8d96
mov dword [ebp - 0x13f8], 0x646b8d96
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1404], 2
jmp 0x1003a22a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1404]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1404], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1404], 0
jl 0x1003a33c
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x1428]
mov dword [ebp - 0x1ec0], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0x1428]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1404]
je 0x1003a27a
mov dword [ebp - 0xf98], 1
jmp 0x1003a281
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x12b8], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x1428]
cmp dword [ebp - 0x12b8], eax
jle 0x1003a2ae
mov dword [ebp - 0xb68], 1
jmp 0x1003a2b5
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xb68], eax
jne 0x1003a2cf
mov dword [ebp - 0xb70], 1
jmp 0x1003a2d6
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xf98]
cmp eax, dword [ebp - 0xb70]
jl 0x1003a2f0
mov dword [ebp - 0x11b0], 1
jmp 0x1003a2f7
and dword [ebp - 0x11b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11b0]
sub ecx, dword [ebp + eax - 0x1404]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1428], ecx
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1003a337
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x1003a20f
jmp 0x1003a1ba
jmp 0x1003a006
jmp 0x10039fb8
jmp 0x10039f7a
jmp 0x10039f01
mov dword [ebp - 0xa8], 0
jmp 0x1003a36e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 8
je 0x1003a38e
mov dword [ebp - 0x14f0], 0xfffffffb
cmp dword [ebp - 0x14f0], 0
je 0x1003a38c
jmp 0x1003a38e
jmp 0x1003a361
and dword [ebp - 0x45c], 0
jmp 0x1003a3a4
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xe
jae 0x1003a571
mov dword [ebp - 0x624], 0xfffffff7
mov dword [ebp - 0xfa0], 0x7a61eefb
mov dword [ebp - 0x14f8], 6
mov dword [ebp - 0x20b0], 4
mov dword [ebp - 0x1ec8], 0x4e797535
mov dword [ebp - 0x2130], 8
mov dword [ebp - 0x1ed0], 0x191b4956
mov dword [ebp - 0x20b8], 0xa08ecb30
push 2
lea ecx, [ebp - 0x1f44]
call fcn.10022b61
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1ed8], 0xe469209a
push 4
lea ecx, [ebp - 0x1e14]
call fcn.10022b61
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xd0], 0
jmp 0x1003a449
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1003a468
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1f44]
call fcn.10022bff
and dword [eax], 0
jmp 0x1003a43c
mov dword [ebp - 0xd0], 0
jmp 0x1003a481
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x1003a4a0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1e14]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x1003a474
or eax, 0xffffffff
je 0x1003a4ba
cmp dword [ebp - 0x624], 0
je 0x1003a4ba
mov dword [ebp - 0xb78], 1
jmp 0x1003a4c1
and dword [ebp - 0xb78], 0
mov eax, 0xfffc
sub eax, dword [ebp - 0xb78]
jne 0x1003a4fc
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x624]
imul ecx, dword [ebp - 0xfa0]
add ecx, dword [ebp - 0x624]
add eax, ecx
imul eax, eax, 0x4896
test eax, eax
jne 0x1003a4fc
and dword [ebp - 0x18f0], 0
jmp 0x1003a506
mov dword [ebp - 0x18f0], 1
mov eax, dword [ebp - 0xfa0]
mov dword [ebp - 0x1fdc], eax
mov dword [ebp - 0x14f8], 0
push 2
lea ecx, [ebp - 0x1e14]
call fcn.10022bff
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xb80]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb80]
mov dword [ecx], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1e14]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f44]
call fcn.10022be3
mov eax, dword [ebp - 0x45c]
mov byte [ebp + eax - 0x1b64], 0
jmp 0x1003a397
mov dword [ebp - 0x1cac], 2
mov dword [ebp - 0x1ca8], 2
mov dword [ebp - 0x1ca4], 2
mov dword [ebp - 0x1ca0], 2
lea ecx, [ebp - 0x8fe]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1c9c]
push eax
lea eax, [ebp - 0x1cac]
push eax
lea ecx, [ebp - 0x22e8]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1ac0]
call fcn.10022bbd
mov dword [ebp - 4], 0x11
push 3
lea ecx, [ebp - 0x1ab0]
call fcn.10022b61
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x464], 0xffffffff
mov dword [ebp - 0x70c], 0
jmp 0x1003a609
mov eax, dword [ebp - 0x70c]
inc eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 3
jge 0x1003a62b
push dword [ebp - 0x70c]
lea ecx, [ebp - 0x1ab0]
call fcn.10022bff
mov dword [eax], 0x580d416d
jmp 0x1003a5fc
push 0
lea ecx, [ebp - 0x1ac0]
call fcn.10022bff
mov dword [eax], 0xffffffe2
jmp 0x1003a664
push 0
lea ecx, [ebp - 0x1ac0]
call fcn.10022bff
mov dword [ebp - 0x12f4], eax
mov eax, dword [ebp - 0x12f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x12f4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ac0]
call fcn.10022bff
cmp dword [eax], 9
je 0x1003a695
push 0
lea ecx, [ebp - 0x1ac0]
call fcn.10022bff
push 1
lea ecx, [ebp - 0x1ab0]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x1003a640
mov dword [ebp - 0x464], 0xffffffe6
jmp 0x1003a6ae
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffed
jl 0x1003ae6d
mov dword [ebp - 0x4a4], 0x2b82c447
mov dword [ebp - 0xfb0], 0x34859bb
mov dword [ebp - 0xfb8], 8
mov dword [ebp - 0x1ee0], 0xffffffff
mov dword [ebp - 0x1fe4], 0x71808adc
mov dword [ebp - 0x1ee8], 1
mov dword [ebp - 0x1914], 1
mov dword [ebp - 0xb88], 0xe02
mov dword [ebp - 0x1500], 0x1000aa8c
cmp dword [ebp - 0xb88], 0xe2d
jle 0x1003a7fc
and dword [ebp - 0x62c], 0
jmp 0x1003a73b
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0x6be6
jge 0x1003a7fc
and dword [ebp - 0x46c], 0
jmp 0x1003a761
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0x3486
jge 0x1003a7f7
and dword [ebp - 0x7d4], 0
jmp 0x1003a787
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 0x1a37
jge 0x1003a7f2
mov eax, dword [ebp - 0x62c]
add eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x7d4]
sar eax, cl
cdq
mov dword [ebp - 0x16d0], eax
mov dword [ebp - 0x16cc], edx
push dword [ebp - 0x16cc]
push dword [ebp - 0x16d0]
lea ecx, [ebp - 0x23f8]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1998], eax
mov ecx, dword [ebp - 0x1998]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x23f8]
call fcn.1002281d
jmp 0x1003a77a
jmp 0x1003a754
jmp 0x1003a72e
cmp dword [ebp - 0xb88], 0xcd1
jge 0x1003a814
push dword [ebp - 0x1500]
call fcn.10077843
pop ecx
mov dword [ebp - 0xfa8], 0x794b
mov dword [ebp - 0x1508], 0x1000aacc
cmp dword [ebp - 0xfa8], 0x79f8
jle 0x1003a968
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawStateW]
and dword [ebp - 0x714], 0
jmp 0x1003a868
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0x3ceb
jge 0x1003a95c
and dword [ebp - 0x474], 0
jmp 0x1003a88e
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0x2bf5
jge 0x1003a957
and dword [ebp - 0x634], 0
jmp 0x1003a8b4
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x137
jge 0x1003a952
and dword [ebp - 0x47c], 0
jmp 0x1003a8da
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0x24c2
jge 0x1003a94d
mov ecx, dword [ebp - 0x474]
imul ecx, dword [ebp - 0x634]
imul ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x714]
shl eax, cl
cdq
mov dword [ebp - 0x16dc], eax
mov dword [ebp - 0x16d8], edx
push dword [ebp - 0x16d8]
push dword [ebp - 0x16dc]
lea ecx, [ebp - 0x259c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x259c]
call fcn.1002281d
jmp 0x1003a8cd
jmp 0x1003a8a7
jmp 0x1003a881
jmp 0x1003a85b
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x484], 0
jmp 0x1003a981
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 1
jge 0x1003a99d
mov eax, dword [ebp - 0x484]
mov dword [ebp + eax*4 - 0x19a0], 0xd42c
jmp 0x1003a974
cmp dword [ebp - 0xfa8], 0x7730
jge 0x1003a9b5
push dword [ebp - 0x1508]
call fcn.10077843
pop ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x19a0], 0
je 0x1003ae48
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x1ff0], 0x52324067
mov dword [ebp - 0x1528], 1
push 3
lea ecx, [ebp - 0x1c54]
call fcn.10022b61
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x838], 0xf0dc4b63
mov dword [ebp - 0xb90], 0x3f04
mov dword [ebp - 0x1908], 0x1000ab08
cmp dword [ebp - 0xb90], 0x41fd
jle 0x1003aad4
and dword [ebp - 0x63c], 0
jmp 0x1003aa3c
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0x70d6
jge 0x1003aac6
and dword [ebp - 0x48c], 0
jmp 0x1003aa5e
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0x1b19
jge 0x1003aac1
mov eax, dword [ebp - 0x63c]
sub eax, dword [ebp - 0x48c]
cdq
mov dword [ebp - 0x16e8], eax
mov dword [ebp - 0x16e4], edx
push dword [ebp - 0x16e4]
push dword [ebp - 0x16e8]
lea ecx, [ebp - 0x2308]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1510], eax
mov ecx, dword [ebp - 0x1510]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2308]
call fcn.1002281d
jmp 0x1003aa51
jmp 0x1003aa2f
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
mov dword [ebp - 0x1920], 0xfffffffb
cmp dword [ebp - 0xb90], 0x3b27
jge 0x1003aaf6
push dword [ebp - 0x1908]
call fcn.10077843
pop ecx
mov dword [ebp - 0x11b8], 0x7169
mov dword [ebp - 0x19a8], 0x1000ab3c
cmp dword [ebp - 0x11b8], 0x71f9
jle 0x1003ac32
and dword [ebp - 0x324], 0
jmp 0x1003ab30
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x7d2
jge 0x1003ac24
and dword [ebp - 0x784], 0
jmp 0x1003ab56
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0x5e3c
jge 0x1003ac1f
and dword [ebp - 0x494], 0
jmp 0x1003ab7c
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x531d
jge 0x1003ac1a
and dword [ebp - 0x644], 0
jmp 0x1003aba2
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0x4fd1
jge 0x1003ac15
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x784]
mov ecx, dword [ebp - 0x494]
sar eax, cl
mov ecx, dword [ebp - 0x644]
shl eax, cl
cdq
mov dword [ebp - 0x16f4], eax
mov dword [ebp - 0x16f0], edx
push dword [ebp - 0x16f0]
push dword [ebp - 0x16f4]
lea ecx, [ebp - 0x2710]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1518], eax
mov ecx, dword [ebp - 0x1518]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2710]
call fcn.1002281d
jmp 0x1003ab95
jmp 0x1003ab6f
jmp 0x1003ab49
jmp 0x1003ab23
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0x49c], 0
jmp 0x1003ac4b
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 3
jge 0x1003ac6a
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x1c54]
call fcn.10022bff
and dword [eax], 0
jmp 0x1003ac3e
cmp dword [ebp - 0x11b8], 0x700e
jge 0x1003ac82
push dword [ebp - 0x19a8]
call fcn.10077843
pop ecx
mov dword [ebp - 0x268], 0x19
jmp 0x1003ac9b
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x18
jge 0x1003ae37
mov dword [ebp - 0x71c], 0xd0f12afb
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 0x838]
inc ecx
mov dword [ebp - 0x838], ecx
test eax, eax
je 0x1003ace1
cmp dword [ebp - 0x71c], 0x674f9af3
jg 0x1003ace1
mov dword [ebp - 0x1520], 1
jmp 0x1003ace8
and dword [ebp - 0x1520], 0
cmp dword [ebp - 0x1914], 0
jne 0x1003ad03
cmp dword [ebp - 0x71c], 0
jne 0x1003ad03
and dword [ebp - 0xb98], 0
jmp 0x1003ad0d
mov dword [ebp - 0xb98], 1
mov esi, dword [ebp - 0x4a4]
push 2
lea ecx, [ebp - 0x1ab0]
call fcn.10022bff
mov ecx, dword [ebp - 0xb98]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x1528]
cmp esi, ecx
jl 0x1003ad3e
mov dword [ebp - 0x19b0], 1
jmp 0x1003ad45
and dword [ebp - 0x19b0], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x1ef0], eax
push 0
lea ecx, [ebp - 0x1c54]
call fcn.10022bff
cmp dword [ebp - 0x71c], 0
je 0x1003ad7c
cmp dword [ebp - 0xfb8], 0
je 0x1003ad7c
mov dword [ebp - 0x1530], 1
jmp 0x1003ad83
and dword [ebp - 0x1530], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x1ffc], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1ef8], eax
mov dword [ebp - 0xfb0], 0x9cc099a5
mov eax, dword [ebp - 0x1920]
cmp dword [ebp - 0xfb0], eax
jg 0x1003adbf
mov dword [ebp - 0xba0], 1
jmp 0x1003adc6
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0xba0]
je 0x1003ade0
mov dword [ebp - 0x12c0], 1
jmp 0x1003ade7
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x12c0], eax
jle 0x1003ae01
mov dword [ebp - 0xba8], 1
jmp 0x1003ae08
and dword [ebp - 0xba8], 0
mov esi, dword [ebp - 0xba8]
sub esi, dword [ebp - 0xfb8]
push 0
lea ecx, [ebp - 0x1c54]
call fcn.10022bff
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x1ab0]
call fcn.10022bff
mov dword [eax], esi
jmp 0x1003ac8e
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1c54]
call fcn.10022be3
jmp 0x1003ae68
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1003ae68
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x1003a6a1
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1ab0]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac0]
call fcn.10022be3
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x1fc], 0x65425a80
mov dword [ebp - 0x8b0], 8
mov dword [ebp - 0x8e4], 3
mov dword [ebp - 0x192c], 0xfffffff8
mov dword [ebp - 0xbf0], 0
mov dword [ebp - 0x22c], 0x4d8bc897
mov dword [ebp - 0x64c], 0
jmp 0x1003aeea
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 2
jge 0x1003af06
mov eax, dword [ebp - 0x64c]
mov dword [ebp + eax*4 - 0x13d4], 0x16db
jmp 0x1003aedd
cmp dword [ebp - 0xf8], 0x11accbad
jg 0x1003af1e
mov dword [ebp - 0xbb0], 1
jmp 0x1003af25
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0xbb0]
jg 0x1003af3f
mov dword [ebp - 0x11c0], 1
jmp 0x1003af46
and dword [ebp - 0x11c0], 0
cmp dword [ebp - 0x11c0], 0x4c23
je 0x1003af5e
mov dword [ebp - 0xbb8], 1
jmp 0x1003af65
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0xf8], 0
jmp 0x1003af8a
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x1003b462
mov dword [ebp - 0x840], 0xac895352
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x24c], 0x24067bc6
cmp dword [ebp - 0xf8], 0xd35
jne 0x1003afcd
mov dword [ebp - 0xfc0], 1
jmp 0x1003afd4
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x840]
cmp eax, dword [ebp - 0xfc0]
jle 0x1003afee
mov dword [ebp - 0xbc0], 1
jmp 0x1003aff5
and dword [ebp - 0xbc0], 0
cmp dword [ebp - 0xbc0], 0xa0c0
jge 0x1003b014
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003b014
mov dword [ebp - 0x1538], 1
jmp 0x1003b01b
and dword [ebp - 0x1538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13d4]
mov dword [ebp - 0x2004], eax
mov eax, 0xbc21
cmp eax, 0xfff9
jae 0x1003b046
mov dword [ebp - 0x12fc], 1
jmp 0x1003b04d
and dword [ebp - 0x12fc], 0
mov dword [ebp - 0x1fc], 0xffffde93
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0x12fc]
sub ecx, dword [ebp - 0x1f4]
sub eax, ecx
jne 0x1003b07d
push 9
pop eax
test eax, eax
jne 0x1003b07d
and dword [ebp - 0x19b8], 0
jmp 0x1003b087
mov dword [ebp - 0x19b8], 1
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1f00], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x200c], eax
mov eax, 0x589d3895
cmp eax, 1
je 0x1003b0b5
mov dword [ebp - 0xbc8], 1
jmp 0x1003b0bc
and dword [ebp - 0xbc8], 0
cmp dword [ebp - 0xbc8], 0xc86f8036
jbe 0x1003b0d4
mov dword [ebp - 0xfc8], 1
jmp 0x1003b0db
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x1f08], eax
cmp dword [ebp - 0x24c], 6
jge 0x1003b114
mov dword [ebp - 0xbd0], 1
jmp 0x1003b11b
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xbd0]
sub eax, 5
cmp eax, dword [ebp - 0x1f4]
jge 0x1003b138
mov dword [ebp - 0x11c8], 1
jmp 0x1003b13f
and dword [ebp - 0x11c8], 0
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x2014], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13d4]
mov dword [ebp - 0x1f10], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x201c], eax
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x1f18], eax
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [ebp - 0x1f4]
lea eax, [eax + ecx + 0xb25b]
cmp eax, dword [ebp - 0x8e4]
jl 0x1003b1a9
mov dword [ebp - 0xbd8], 1
jmp 0x1003b1b0
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0xbd8]
sub eax, 6
cmp dword [ebp - 0x1f4], eax
jge 0x1003b1cd
mov dword [ebp - 0x1540], 1
jmp 0x1003b1d4
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x2024], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13d4]
mov ecx, dword [ebp - 0x1f4]
lea eax, [eax + ecx + 0x6d0a8d95]
cmp eax, dword [ebp - 0x840]
jg 0x1003b20e
mov dword [ebp - 0xfd0], 1
jmp 0x1003b215
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0xfd0]
sub eax, 0x6833
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x13d4]
jl 0x1003b23b
mov dword [ebp - 0xbe0], 1
jmp 0x1003b242
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xbe0]
sub eax, dword [ebp - 0x8b0]
jne 0x1003b25d
xor eax, eax
jne 0x1003b25d
and dword [ebp - 0x12c8], 0
jmp 0x1003b267
mov dword [ebp - 0x12c8], 1
mov eax, dword [ebp - 0x192c]
cmp dword [ebp - 0x12c8], eax
je 0x1003b281
mov dword [ebp - 0xbe8], 1
jmp 0x1003b288
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x8b0]
cmp dword [ebp - 0xbe8], eax
jl 0x1003b2a2
mov dword [ebp - 0xfd8], 1
jmp 0x1003b2a9
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x22c], 0
jmp 0x1003b2e6
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jg 0x1003b45d
mov dword [ebp - 0x11d0], 0x6a2a
mov dword [ebp - 0x1548], 0x1000ab70
cmp dword [ebp - 0x11d0], 0x6b32
jle 0x1003b3cc
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
and dword [ebp - 0x4ac], 0
jmp 0x1003b337
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x6f9a
jge 0x1003b3cc
and dword [ebp - 0x7bc], 0
jmp 0x1003b35d
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0x18ac
jge 0x1003b3c7
and dword [ebp - 0x4b4], 0
jmp 0x1003b37f
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x601
jge 0x1003b3c5
mov eax, dword [ebp - 0x4ac]
cdq
idiv dword [ebp - 0x7bc]
add edx, dword [ebp - 0x4b4]
mov eax, edx
cdq
mov dword [ebp - 0x1700], eax
mov dword [ebp - 0x16fc], edx
push dword [ebp - 0x16fc]
push dword [ebp - 0x1700]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003b372
jmp 0x1003b350
jmp 0x1003b32a
cmp dword [ebp - 0x11d0], 0x66c4
jge 0x1003b3e8
mov edx, dword [ebp - 0x1548]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x654], 0
jmp 0x1003b401
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 1
jge 0x1003b41d
mov eax, dword [ebp - 0x654]
mov dword [ebp + eax*4 - 0x19c0], 0xea916a8
jmp 0x1003b3f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c0]
mov dword [ebp - 0x1fc], eax
mov byte [ebp - 0x1ca], 0
movzx eax, byte [ebp - 0x1ca]
test eax, eax
je 0x1003b458
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x1003b2d9
jmp 0x1003af7d
mov byte [ebp - 0x320], 5
mov byte [ebp - 0x31f], 0x9f
mov byte [ebp - 0x31e], 0xc
mov byte [ebp - 0x31d], 0x16
mov byte [ebp - 0x31c], 9
mov byte [ebp - 0x31b], 0x10
mov byte [ebp - 0x31a], 0xd
mov byte [ebp - 0x319], 0x34
mov byte [ebp - 0x318], 4
mov byte [ebp - 0x317], 0x23
mov byte [ebp - 0x316], 3
mov byte [ebp - 0x315], 0x15
mov byte [ebp - 0x314], 2
mov byte [ebp - 0x313], 4
mov byte [ebp - 0x312], 1
mov byte [ebp - 0x311], 0x17
mov byte [ebp - 0x310], 6
mov byte [ebp - 0x30f], 0x22
mov byte [ebp - 0x30e], 0xa
mov byte [ebp - 0x30d], 0x35
mov byte [ebp - 0x30c], 0xb
mov byte [ebp - 0x30b], 0x16
mov byte [ebp - 0x30a], 0
mov byte [ebp - 0x309], 0x30
mov byte [ebp - 0x308], 8
mov byte [ebp - 0x307], 0x2c
mov byte [ebp - 0x306], 7
mov byte [ebp - 0x305], 0x1d
mov dword [ebp - 0x170], 0x65797632
push 2
lea ecx, [ebp - 0x1d90]
call fcn.10022b61
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1550], 0x2b96ce02
mov dword [ebp - 0xb0], 0
jmp 0x1003b567
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1003b583
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1c98], 0
jmp 0x1003b55a
mov dword [ebp - 0xb0], 0
jmp 0x1003b59c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1003b5be
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1d90]
call fcn.10022bff
mov dword [eax], 4
jmp 0x1003b58f
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x1f20], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xbf8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbf8]
mov dword [ebp + eax - 0x1c98], ecx
cmp dword [ebp - 0xbf8], 0
je 0x1003b60e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c98], 0
je 0x1003b60e
mov dword [ebp - 0xc00], 1
jmp 0x1003b615
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x170], eax
jge 0x1003b62f
mov dword [ebp - 0xfe0], 1
jmp 0x1003b636
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0xfe0]
imul eax, dword [ebp - 0x170]
mov dword [ebp - 0x1304], eax
push 1
lea ecx, [ebp - 0x1d90]
call fcn.10022bff
mov ecx, dword [ebp - 0x1304]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc00]
imul eax, dword [ebp - 0x1304]
cmp eax, dword [ebp - 0x170]
jge 0x1003b67f
mov dword [ebp - 0xc08], 1
jmp 0x1003b686
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0xc08]
jle 0x1003b6a0
mov dword [ebp - 0xfe8], 1
jmp 0x1003b6a7
and dword [ebp - 0xfe8], 0
imul eax, dword [ebp - 0xfe8], 0
mov dword [ebp - 0x1550], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d90]
call fcn.10022be3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x320]
or eax, 0xfa
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x320]
and ecx, 0xfa
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x320]
mov byte [ebp + ecx - 0x1bc8], al
mov dword [ebp - 0x4bc], 0xfffffff6
mov dword [ebp - 0x202c], 0xe17ca002
mov dword [ebp - 0x4bc], 0x10
jmp 0x1003b72e
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0x1b
jl 0x1003b76a
mov dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0xc10]
inc eax
mov dword [ebp - 0xc10], eax
mov byte [ebp - 0x1cb], 0
movzx eax, byte [ebp - 0x1cb]
test eax, eax
je 0x1003b768
push 0
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1003b721
mov dword [ebp - 0x100], 2
and dword [ebp - 0xc30], 0
jmp 0x1003b78b
mov eax, dword [ebp - 0x100]
inc eax
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1c
jae 0x1003bb5d
mov dword [ebp - 0x8c4], 0x23dcdf5e
mov dword [ebp - 0xc18], 0xfffffffa
mov dword [ebp - 0x11d8], 0x2c81
mov dword [ebp - 0x1938], 0x1000abc4
cmp dword [ebp - 0x11d8], 0x2edf
jle 0x1003b888
and dword [ebp - 0x65c], 0
jmp 0x1003b7e6
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0x6827
jge 0x1003b878
and dword [ebp - 0x724], 0
jmp 0x1003b80c
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0x60c1
jge 0x1003b873
and dword [ebp - 0x4c4], 0
jmp 0x1003b82e
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x6675
jge 0x1003b871
mov eax, dword [ebp - 0x724]
add eax, dword [ebp - 0x4c4]
or eax, dword [ebp - 0x65c]
cdq
mov dword [ebp - 0x170c], eax
mov dword [ebp - 0x1708], edx
push dword [ebp - 0x1708]
push dword [ebp - 0x170c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003b821
jmp 0x1003b7ff
jmp 0x1003b7d9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 1
lea ecx, [ebp - 0x1d6c]
call fcn.10022b61
mov dword [ebp - 4], 0x15
cmp dword [ebp - 0x11d8], 0x2b62
jge 0x1003b8b8
mov edx, dword [ebp - 0x1938]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0xc8], 0
jmp 0x1003b8d1
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1003b8ed
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x848], 0xffffffff
jmp 0x1003b8c4
mov dword [ebp - 0xc8], 0
jmp 0x1003b906
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1003b928
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1d6c]
call fcn.10022bff
mov dword [eax], 0xe26c12a7
jmp 0x1003b8f9
mov dword [ebp - 0xff8], 0x6616
mov dword [ebp - 0x1558], 0x1000abec
cmp dword [ebp - 0xff8], 0x67e9
jle 0x1003b9f4
and dword [ebp - 0x4cc], 0
jmp 0x1003b962
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0x26ff
jge 0x1003b9f4
and dword [ebp - 0x78c], 0
jmp 0x1003b988
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 0x2018
jge 0x1003b9ef
and dword [ebp - 0x4d4], 0
jmp 0x1003b9aa
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0x56cf
jge 0x1003b9ed
mov eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x78c]
and eax, dword [ebp - 0x4d4]
cdq
mov dword [ebp - 0x1718], eax
mov dword [ebp - 0x1714], edx
push dword [ebp - 0x1714]
push dword [ebp - 0x1718]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003b99d
jmp 0x1003b97b
jmp 0x1003b955
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x848]
sub eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xc18], eax
imul eax, dword [ebp - 0xc18], 0x64e6
cmp eax, 1
jg 0x1003ba28
mov dword [ebp - 0xff0], 1
jmp 0x1003ba2f
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x8c4]
cmp dword [ebp - 0xff0], eax
je 0x1003ba49
mov dword [ebp - 0xc20], 1
jmp 0x1003ba50
and dword [ebp - 0xc20], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc20]
sub ecx, dword [ebp + eax - 0x848]
push 4
pop eax
imul eax, eax, 0
sub ecx, dword [ebp + eax - 0x848]
je 0x1003ba7e
mov dword [ebp - 0x12d0], 1
jmp 0x1003ba85
and dword [ebp - 0x12d0], 0
mov eax, dword [ebp - 0x12d0]
sub eax, dword [ebp - 0x8c4]
cmp eax, 1
je 0x1003baa2
mov dword [ebp - 0xc28], 1
jmp 0x1003baa9
and dword [ebp - 0xc28], 0
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.10022bff
mov ecx, dword [ebp - 0xc28]
mov dword [eax], ecx
cmp dword [ebp - 0xff8], 0x65d4
jge 0x1003bada
mov edx, dword [ebp - 0x1558]
mov ecx, 0x10092b78
call fcn.10025597
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d6c]
call fcn.10022be3
mov eax, dword [ebp - 0x100]
movzx eax, byte [ebp + eax - 0x31f]
mov ecx, dword [ebp - 0x100]
sub ecx, dword [ebp - 0xc30]
movzx ecx, byte [ebp + ecx - 0x322]
movsx ecx, byte [ebp + ecx - 0x1bc8]
or eax, ecx
mov ecx, dword [ebp - 0x100]
movzx ecx, byte [ebp + ecx - 0x31f]
mov edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0xc30]
movzx edx, byte [ebp + edx - 0x322]
movsx edx, byte [ebp + edx - 0x1bc8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x100]
movzx ecx, byte [ebp + ecx - 0x320]
mov byte [ebp + ecx - 0x1bc8], al
jmp 0x1003b77d
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1bc8], 0
mov dword [ebp - 0x850], 1
mov dword [ebp - 0x178], 5
push 3
lea ecx, [ebp - 0x1488]
call fcn.10022b61
mov dword [ebp - 4], 0x16
push 1
lea ecx, [ebp - 0x1c3c]
call fcn.10022b61
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x88], 0
jmp 0x1003bbd1
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1003bbf3
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1488]
call fcn.10022bff
mov dword [eax], 0x658edfe0
jmp 0x1003bbc4
mov dword [ebp - 0x88], 0
jmp 0x1003bc0c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1003bc2e
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1c3c]
call fcn.10022bff
mov dword [eax], 0x2d91
jmp 0x1003bbff
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x1f28], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x11e0], eax
push 0
lea ecx, [ebp - 0x1488]
call fcn.10022bff
mov ecx, dword [ebp - 0x11e0]
mov dword [eax], ecx
cmp dword [ebp - 0x11e0], 0
jne 0x1003bc70
mov dword [ebp - 0xc38], 1
jmp 0x1003bc77
and dword [ebp - 0xc38], 0
push 0
lea ecx, [ebp - 0x1c3c]
call fcn.10022bff
mov ecx, dword [ebp - 0xc38]
cmp ecx, dword [eax]
jge 0x1003bca4
cmp dword [ebp - 0x94], 0
jne 0x1003bca4
cmp dword [ebp - 0x178], 0
jne 0x1003bca4
xor eax, eax
je 0x1003bcb9
cmp dword [ebp - 0x94], 0
je 0x1003bcb9
mov dword [ebp - 0x1000], 1
jmp 0x1003bcc0
and dword [ebp - 0x1000], 0
cmp dword [ebp - 0x1000], 0x758e92ed
jg 0x1003bcd8
mov dword [ebp - 0xc40], 1
jmp 0x1003bcdf
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x850]
cmp dword [ebp - 0x66c], eax
jle 0x1003bd05
mov dword [ebp - 0x130c], 1
jmp 0x1003bd0c
and dword [ebp - 0x130c], 0
mov eax, dword [ebp - 0x850]
cmp eax, dword [ebp - 0x130c]
jl 0x1003bd26
mov dword [ebp - 0xc48], 1
jmp 0x1003bd2d
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0xc48]
cmp eax, 0x6bd
jl 0x1003bf9d
mov dword [ebp - 0x1560], 0x9d9e62b5
mov dword [ebp - 0x19d0], 0xfffffffa
mov dword [ebp - 0x94], 0
jmp 0x1003bd72
cmp dword [ebp - 0x94], 2
jg 0x1003bf98
mov dword [ebp - 0x1008], 0x5341
mov dword [ebp - 0x19c8], 0x1000ac18
cmp dword [ebp - 0x1008], 0x54c8
jle 0x1003be4e
and dword [ebp - 0x664], 0
jmp 0x1003bdb9
cmp dword [ebp - 0x664], 0x5c9f
jge 0x1003be4e
and dword [ebp - 0x4dc], 0
jmp 0x1003bddf
cmp dword [ebp - 0x4dc], 0x2b6d
jge 0x1003be49
and dword [ebp - 0x72c], 0
jmp 0x1003be01
jmp 0x1003bdac
mov dword [ebp - 0x4e4], 0x7071
cmp dword [ebp - 0x1008], 0x5072
jge 0x1003be74
mov edx, dword [ebp - 0x19c8]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x1944], 0x3b03c3fa
mov dword [ebp - 0x1568], 0xcecce005
mov dword [ebp - 0x1570], 7
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x2034], eax
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x1560], eax
jne 0x1003beb8
mov dword [ebp - 0x11e8], 1
jmp 0x1003bebf
and dword [ebp - 0x11e8], 0
cmp dword [ebp - 0x1944], 0xfffffff9
jne 0x1003bed4
mov dword [ebp - 0x8b8], 1
jmp 0x1003bedb
and dword [ebp - 0x8b8], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1488]
call fcn.10022bff
mov ecx, dword [ebp - 0x8b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x8b8]
imul eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x1568], eax
cmp dword [ebp - 0x94], 0xe34f
jl 0x1003bf26
mov dword [ebp - 0xc50], 1
jmp 0x1003bf2d
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0x19d0]
cmp dword [ebp - 0xc50], eax
jg 0x1003bf47
jmp 0x1003c117
mov dword [ebp - 0x2d4], 0x4c996e15
mov dword [ebp - 0x858], 1
cmp dword [ebp - 0x858], 0
je 0x1003bfcf
cmp dword [ebp - 0x858], 0
je 0x1003bfcf
mov dword [ebp - 0xc60], 1
jmp 0x1003bfd6
and dword [ebp - 0xc60], 0
push 1
lea ecx, [ebp - 0x1488]
call fcn.10022bff
mov ecx, dword [ebp - 0x2d4]
cmp dword [eax], ecx
jg 0x1003bff9
mov dword [ebp - 0x12dc], 1
jmp 0x1003c000
and dword [ebp - 0x12dc], 0
mov eax, dword [ebp - 0xc60]
cmp eax, dword [ebp - 0x12dc]
jg 0x1003c01a
mov dword [ebp - 0xc68], 1
jmp 0x1003c021
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x2d4]
add eax, dword [ebp - 0xc68]
cmp eax, 1
jne 0x1003c03e
mov dword [ebp - 0x1018], 1
jmp 0x1003c045
and dword [ebp - 0x1018], 0
push 0
lea ecx, [ebp - 0x1c3c]
call fcn.10022bff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1018]
jle 0x1003c068
mov dword [ebp - 0xc70], 1
jmp 0x1003c06f
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
sub eax, dword [ebp - 0x858]
cmp eax, 0x64f6128b
jle 0x1003c0a0
cmp dword [ebp - 0x2d4], 0
jne 0x1003c0a0
and dword [ebp - 0x11f0], 0
jmp 0x1003c0aa
mov dword [ebp - 0x11f0], 1
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x11f0]
jne 0x1003c0c4
mov dword [ebp - 0xc78], 1
jmp 0x1003c0cb
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x178], 0
jmp 0x1003c0f0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1c3c]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1488]
call fcn.10022be3
lea eax, [ebp - 0x1bc8]
push eax
lea ecx, [ebp - 0x244c]
call fcn.1004b4ef
mov dword [ebp - 0x1950], eax
mov eax, dword [ebp - 0x1950]
mov dword [ebp - 0x1578], eax
mov dword [ebp - 4], 0x18
mov edx, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x1578]
call fcn.1002659b
mov dword [0x100980dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244c]
call fcn.10022ace
push 3
lea ecx, [ebp - 0x1f54]
call fcn.10022b61
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x7e4], 0xffffffff
mov dword [ebp - 0x4ec], 0
jmp 0x1003c1bc
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 3
jge 0x1003c1db
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x1f54]
call fcn.10022bff
and dword [eax], 0
jmp 0x1003c1af
mov dword [ebp - 0x7e4], 2
jmp 0x1003c1f4
cmp dword [ebp - 0x7e4], 0
jl 0x1003c21d
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1003c21b
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1003c235
mov dword [ebp - 0xca0], 0xfffffffd
mov dword [ebp - 0x1590], 0xf9f36173
mov dword [ebp - 0x67c], 0x815898f0
mov dword [ebp - 0x1f58], 0x8ea38884
mov dword [ebp - 0x131c], 0xfffffffa
mov dword [ebp - 0x2054], 0x74a52027
mov dword [ebp - 0x8c8], 0x11d01887
mov dword [ebp - 0x19e0], 0xe022
mov dword [ebp - 0x1588], 0x3b0a6d08
mov dword [ebp - 0x1030], 0xcadfb1af
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x1003c4c6
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropA]
cmp dword [ebp - 0xca0], 0
jne 0x1003c4e1
cmp dword [ebp - 0x67c], 0
jne 0x1003c4e1
and dword [ebp - 0xc88], 0
jmp 0x1003c4eb
mov dword [ebp - 0xc88], 1
mov eax, dword [ebp - 0x67c]
cmp dword [ebp - 0xc88], eax
jge 0x1003c505
mov dword [ebp - 0x1028], 1
jmp 0x1003c50c
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x19e0]
sub eax, dword [ebp - 0x1028]
cmp eax, dword [ebp - 0x1588]
je 0x1003c52c
mov dword [ebp - 0x195c], 1
jmp 0x1003c533
and dword [ebp - 0x195c], 0
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x1f68], eax
cmp dword [ebp - 0x1030], 0
jne 0x1003c567
cmp dword [ebp - 0x131c], 0
jne 0x1003c567
and dword [ebp - 0xc90], 0
jmp 0x1003c571
mov dword [ebp - 0xc90], 1
cmp dword [ebp - 0xc90], 9
jle 0x1003c586
mov dword [ebp - 0x11f8], 1
jmp 0x1003c58d
and dword [ebp - 0x11f8], 0
cmp dword [ebp - 0x11f8], 0x886a6c65
ja 0x1003c5a5
mov dword [ebp - 0xc98], 1
jmp 0x1003c5ac
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x67c], eax
imul eax, dword [ebp - 0x67c], 0xfffffff6
imul eax, eax, 0x3901
cmp eax, dword [ebp - 0x1030]
jne 0x1003c5df
cmp dword [ebp - 0x1590], 0
jne 0x1003c5df
and dword [ebp - 0x1b44], 0
jmp 0x1003c5e9
mov dword [ebp - 0x1b44], 1
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x131c], eax
mov eax, dword [section.kojxoc]
cmp eax, dword [ebp - 0x650]
je 0x1003c613
mov eax, dword [0x100980dc]
cmp eax, dword [ebp - 0x650]
jne 0x1003cbc7
mov dword [ebp - 0x18], 0xe7d8
push 2
lea ecx, [ebp - 0x1c00]
call fcn.10022b61
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x50c], 0
jmp 0x1003c647
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 2
jge 0x1003c669
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x1c00]
call fcn.10022bff
mov dword [eax], 0xbdddd5d5
jmp 0x1003c63a
cmp dword [ebp - 0x18], 0
jne 0x1003c67e
cmp dword [ebp - 0x18], 0
jne 0x1003c67e
and dword [ebp - 0xca8], 0
jmp 0x1003c688
mov dword [ebp - 0xca8], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xca8]
jle 0x1003cb86
push 2
lea ecx, [ebp - 0x21c]
call fcn.10022b61
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xcb0], 0x437ffeac
push 1
lea ecx, [ebp - 0x1da8]
call fcn.10022b61
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x9c], 0
jmp 0x1003c6dc
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1003c6fe
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov dword [eax], 0x25b3
jmp 0x1003c6cf
mov dword [ebp - 0x9c], 0
jmp 0x1003c717
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1003c736
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x1da8]
call fcn.10022bff
and dword [eax], 0
jmp 0x1003c70a
mov dword [ebp - 0x18], 0
jmp 0x1003c746
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1003cb66
mov dword [ebp - 0x180], 0x759951ea
mov dword [ebp - 0x794], 0
jmp 0x1003c773
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 1
jge 0x1003c78f
mov eax, dword [ebp - 0x794]
mov dword [ebp + eax*4 - 0x15a8], 1
jmp 0x1003c766
mov dword [ebp - 0x180], 1
jmp 0x1003c7a8
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x1003c7c7
mov dword [ebp - 0x1598], 0xfffffffc
mov dword [ebp - 0x1598], 0x4f3d4e6
jmp 0x1003c79b
mov eax, 0x89f2
test eax, eax
je 0x1003c871
cmp dword [ebp - 0x18], 0
jne 0x1003c82b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov eax, dword [eax]
sub eax, 0x610a85ab
cmp eax, dword [ebp - 0x18]
jg 0x1003c800
mov dword [ebp - 0x1038], 1
jmp 0x1003c807
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x1038]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0xcb0], 0
jne 0x1003c82b
cmp dword [ebp - 0x18], 0
jne 0x1003c82b
and dword [ebp - 0x1964], 0
jmp 0x1003c835
mov dword [ebp - 0x1964], 1
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov eax, dword [eax]
mov dword [ebp - 0x180], eax
imul eax, dword [ebp - 0x180], 0xa9a9
test eax, eax
je 0x1003c871
mov dword [ebp - 0x1200], 1
jmp 0x1003c878
and dword [ebp - 0x1200], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0x1200]
cmp ecx, dword [eax]
jge 0x1003c89c
mov dword [ebp - 0xcb8], 1
jmp 0x1003c8a3
and dword [ebp - 0xcb8], 0
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0xcb8]
cmp ecx, dword [eax]
jg 0x1003c8c6
mov dword [ebp - 0x1040], 1
jmp 0x1003c8cd
and dword [ebp - 0x1040], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1040]
jge 0x1003c8f1
mov dword [ebp - 0x15a0], 1
jmp 0x1003c8f8
and dword [ebp - 0x15a0], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003c935
mov dword [ebp - 0xcc0], 1
jmp 0x1003c93c
and dword [ebp - 0xcc0], 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0xcc0]
cmp ecx, dword [eax]
jne 0x1003c95f
mov dword [ebp - 0x860], 1
jmp 0x1003c966
and dword [ebp - 0x860], 0
push 0
lea ecx, [ebp - 0x1c00]
call fcn.10022bff
mov ecx, dword [ebp - 0x860]
mov dword [eax], ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0x860]
cmp ecx, dword [eax]
jg 0x1003c99f
mov dword [ebp - 0x12e8], 1
jmp 0x1003c9a6
and dword [ebp - 0x12e8], 0
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov esi, dword [ebp - 0x12e8]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x21c]
call fcn.10022bff
cmp esi, dword [eax]
jle 0x1003c9d8
mov dword [ebp - 0xcc8], 1
jmp 0x1003c9df
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xcc8]
sub eax, 0x6af83395
jne 0x1003c9fb
cmp dword [ebp - 0x18], 0
jne 0x1003c9fb
and dword [ebp - 0x1048], 0
jmp 0x1003ca05
mov dword [ebp - 0x1048], 1
cmp dword [ebp - 0x1048], 0x2fb38a83
jne 0x1003ca26
cmp dword [ebp - 0x180], 0
je 0x1003ca26
mov dword [ebp - 0xcd0], 1
jmp 0x1003ca2d
and dword [ebp - 0xcd0], 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0xcd0]
cmp ecx, dword [eax]
jge 0x1003ca50
mov dword [ebp - 0x1208], 1
jmp 0x1003ca57
and dword [ebp - 0x1208], 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0x1208]
cmp ecx, dword [eax]
jl 0x1003ca7a
mov dword [ebp - 0xcd8], 1
jmp 0x1003ca81
and dword [ebp - 0xcd8], 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov ecx, dword [ebp - 0xcd8]
cmp ecx, dword [eax]
jne 0x1003caa4
mov dword [ebp - 0x1050], 1
jmp 0x1003caab
and dword [ebp - 0x1050], 0
imul eax, dword [ebp - 0x1050], 0xffffffff
cmp eax, 0x15f7
jl 0x1003cac5
mov dword [ebp - 0x1a7c], 1
jmp 0x1003cacc
and dword [ebp - 0x1a7c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
call fcn.10022bff
push 0
lea ecx, [ebp - 0x21c]
call fcn.10022bff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x205c], eax
push 0
lea ecx, [ebp - 0x1c00]
call fcn.10022bff
imul eax, dword [eax], 0xcb9
cmp eax, dword [ebp - 0x18]
jl 0x1003cb14
mov dword [ebp - 0x8c0], 1
jmp 0x1003cb1b
and dword [ebp - 0x8c0], 0
push 0
lea ecx, [ebp - 0x1da8]
call fcn.10022bff
mov ecx, dword [ebp - 0x8c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x8c0], eax
jg 0x1003cb47
mov dword [ebp - 0xce0], 1
jmp 0x1003cb4e
and dword [ebp - 0xce0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xce0]
mov dword [ebp + eax - 0x15a8], ecx
jmp 0x1003c73f
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1da8]
call fcn.10022be3
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x21c]
call fcn.10022be3
jmp 0x1003cba0
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1003cba0
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c00]
call fcn.10022be3
mov ecx, dword [ebp + 0xc]
call fcn.10022827
push eax
push dword [ebp + 8]
call fcn.10030761
pop ecx
pop ecx
jmp 0x10046cf1
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x270], 0x1fc2da8a
mov dword [ebp - 0x188], 9
mov dword [ebp - 0x1070], 0xa75e3aa9
push 1
lea ecx, [ebp - 0x1e2c]
call fcn.10022b61
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x1078], 0xfffffffc
mov dword [ebp - 0x870], 3
mov dword [ebp - 0x44], 0
jmp 0x1003cc27
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1003cc3a
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x38], 0x4a8c6a53
jmp 0x1003cc20
mov dword [ebp - 0x44], 0
jmp 0x1003cc4a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1003cc66
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1e2c]
call fcn.10022bff
mov dword [eax], 0xb017290b
jmp 0x1003cc43
mov dword [ebp - 0x1378], 0x137
mov dword [ebp - 0x15b0], 0x1000ac9c
cmp dword [ebp - 0x1378], 0x43f
jle 0x1003cd97
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
and dword [ebp - 0x51c], 0
jmp 0x1003cca6
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x2e9b
jge 0x1003cd97
and dword [ebp - 0x514], 0
jmp 0x1003cccc
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x3ea6
jge 0x1003cd92
and dword [ebp - 0x684], 0
jmp 0x1003ccf2
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0x6583
jge 0x1003cd8d
and dword [ebp - 0x73c], 0
jmp 0x1003cd18
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0x27df
jge 0x1003cd88
mov eax, dword [ebp - 0x514]
imul eax, dword [ebp - 0x684]
add eax, dword [ebp - 0x51c]
or eax, dword [ebp - 0x73c]
cdq
mov dword [ebp - 0x173c], eax
mov dword [ebp - 0x1738], edx
push dword [ebp - 0x1738]
push dword [ebp - 0x173c]
lea ecx, [ebp - 0x247c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x196c], eax
mov ecx, dword [ebp - 0x196c]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x247c]
call fcn.1002281d
jmp 0x1003cd0b
jmp 0x1003cce5
jmp 0x1003ccbf
jmp 0x1003cc99
mov dword [ebp - 0x44], 0
jmp 0x1003cda7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1003cdbd
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x197c], 1
jmp 0x1003cda0
cmp dword [ebp - 0x1378], 0xe7
jge 0x1003cdd5
push dword [ebp - 0x15b0]
call fcn.10077843
pop ecx
mov dword [ebp - 0xac], 0
jmp 0x1003cdee
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x1003d329
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0xd18], 1
mov dword [ebp - 0x1060], 0
mov dword [ebp - 0x8d0], 0x860bc23c
mov dword [ebp - 0x1b88], 0xa00b
mov dword [ebp - 0x868], 8
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x38]
cmp dword [ebp + eax - 0x38], ecx
jne 0x1003ce66
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x38], 0
je 0x1003ce66
mov dword [ebp - 0xce8], 1
jmp 0x1003ce6d
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
add eax, 0x74b2014
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x38]
jle 0x1003ce90
mov dword [ebp - 0x1058], 1
jmp 0x1003ce97
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x188], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
neg eax
or ecx, 0xffffffff
sub ecx, eax
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0x5ee5
jle 0x1003ced2
mov dword [ebp - 0xcf0], 1
jmp 0x1003ced9
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x38]
cmp dword [ebp - 0x244], eax
je 0x1003cf03
mov dword [ebp - 0x1210], 1
jmp 0x1003cf0a
and dword [ebp - 0x1210], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
sub eax, dword [ebp - 0x1210]
mov dword [ebp - 0xd18], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
jne 0x1003cf3f
cmp dword [ebp - 0x244], 0
jne 0x1003cf3f
and dword [ebp - 0xcf8], 0
jmp 0x1003cf49
mov dword [ebp - 0xcf8], 1
mov eax, dword [ebp - 0xcf8]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1060], 0x3d478254
jne 0x1003cf6d
mov dword [ebp - 0xd00], 1
jmp 0x1003cf74
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x38]
cmp eax, dword [ebp - 0xd00]
jge 0x1003cf92
mov dword [ebp - 0x12f0], 1
jmp 0x1003cf99
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x12f0]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
sub eax, dword [ebp - 0x1b88]
je 0x1003d1ba
mov dword [ebp - 0xd08], 0x61e0
mov dword [ebp - 0x1974], 0x1000acd8
cmp dword [ebp - 0xd08], 0x61ef
jle 0x1003d0b0
and dword [ebp - 0x524], 0
jmp 0x1003cff1
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x1850
jge 0x1003d0b0
and dword [ebp - 0x68c], 0
jmp 0x1003d017
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0x2e4a
jge 0x1003d0ab
and dword [ebp - 0x52c], 0
jmp 0x1003d03d
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x73e9
jge 0x1003d0a6
mov eax, dword [ebp - 0x524]
add eax, dword [ebp - 0x68c]
add eax, dword [ebp - 0x52c]
cdq
mov dword [ebp - 0x1748], eax
mov dword [ebp - 0x1744], edx
push dword [ebp - 0x1744]
push dword [ebp - 0x1748]
lea ecx, [ebp - 0x268c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x15b8], eax
mov ecx, dword [ebp - 0x15b8]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x268c]
call fcn.1002281d
jmp 0x1003d030
jmp 0x1003d00a
jmp 0x1003cfe4
cmp dword [ebp - 0xd08], 0x602a
jge 0x1003d0c8
push dword [ebp - 0x1974]
call fcn.10077843
pop ecx
mov dword [ebp - 0xa4], 0
jmp 0x1003d0e1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1003d0fd
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1f64], 0xae05
jmp 0x1003d0d4
mov dword [ebp - 0xa4], 0
jmp 0x1003d116
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1003d132
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x21e8], 0xb323fa9d
jmp 0x1003d109
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x1f78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f64]
mov dword [ebp - 0x2064], eax
mov eax, dword [ebp - 0x868]
dec eax
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x1f88], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1068], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1068]
mov dword [ebp + eax - 0x21e8], ecx
mov eax, dword [ebp - 0xac]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1f64]
sub ecx, dword [ebp + eax*4 - 0x38]
imul ecx, dword [ebp - 0x1068]
mov eax, dword [ebp - 0x188]
sub eax, ecx
mov dword [ebp - 0x8d0], eax
jmp 0x1003d324
mov byte [ebp - 0x169], 0
mov dword [ebp - 0xd10], 0x128
mov dword [ebp - 0x1a84], 0x1000ad38
cmp dword [ebp - 0xd10], 0x46f
jle 0x1003d28c
call dword [sym.imp.USER32.dll_WaitMessage]
and dword [ebp - 0x7c4], 0
jmp 0x1003d201
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0x288d
jge 0x1003d28c
and dword [ebp - 0x534], 0
jmp 0x1003d223
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x6cd4
jge 0x1003d287
mov eax, dword [ebp - 0x7c4]
imul eax, dword [ebp - 0x534]
cdq
mov dword [ebp - 0x1754], eax
mov dword [ebp - 0x1750], edx
push dword [ebp - 0x1750]
push dword [ebp - 0x1754]
lea ecx, [ebp - 0x24ac]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x15c0], eax
mov ecx, dword [ebp - 0x15c0]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x24ac]
call fcn.1002281d
jmp 0x1003d216
jmp 0x1003d1f4
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1003d29f
push 0
call dword [sym.imp.USER32.dll_BringWindowToTop]
cmp dword [ebp - 0xd10], 0xfffffe9a
jge 0x1003d2b7
push dword [ebp - 0x1a84]
call fcn.10077843
pop ecx
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x206c], eax
mov eax, dword [ebp - 0x1078]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x38]
jne 0x1003d2e1
mov dword [ebp - 0x1218], 1
jmp 0x1003d2e8
and dword [ebp - 0x1218], 0
mov eax, dword [ebp - 0x1218]
sub eax, dword [ebp - 0x244]
cmp eax, 0x5b78
jge 0x1003d307
mov dword [ebp - 0x15c8], 1
jmp 0x1003d30e
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0x1f98], eax
mov dword [ebp - 0x244], 0
jmp 0x1003cde1
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x870]
add eax, dword [ebp - 0x1070]
cmp eax, 0x9acc
jg 0x1003d361
mov dword [ebp - 0xd20], 1
jmp 0x1003d368
and dword [ebp - 0xd20], 0
cmp dword [ebp - 0x1070], 0x1810
jle 0x1003d380
mov dword [ebp - 0x1340], 1
jmp 0x1003d387
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0xd20]
add eax, dword [ebp - 0x1340]
imul eax, eax, 9
test eax, eax
je 0x1003d3b3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
je 0x1003d3b3
mov dword [ebp - 0x8d8], 1
jmp 0x1003d3ba
and dword [ebp - 0x8d8], 0
push 0
lea ecx, [ebp - 0x1e2c]
call fcn.10022bff
mov ecx, dword [ebp - 0x8d8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
imul eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x188]
jg 0x1003d3f4
mov dword [ebp - 0xd28], 1
jmp 0x1003d3fb
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x1078], 0xe255f809
jae 0x1003d41f
mov dword [ebp - 0xd30], 1
jmp 0x1003d426
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0xd30], eax
jl 0x1003d440
mov dword [ebp - 0x1220], 1
jmp 0x1003d447
and dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0x1220]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 7
jae 0x1003d468
mov dword [ebp - 0xd38], 1
jmp 0x1003d46f
and dword [ebp - 0xd38], 0
cmp dword [ebp - 0xd38], 0x1e8
jl 0x1003d487
mov dword [ebp - 0x1080], 1
jmp 0x1003d48e
and dword [ebp - 0x1080], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
cmp dword [ebp - 0x1080], eax
jle 0x1003d4ac
mov dword [ebp - 0xd40], 1
jmp 0x1003d4b3
and dword [ebp - 0xd40], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd40]
mov dword [ebp + eax - 0x197c], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e2c]
call fcn.10022be3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x564], eax
mov dword [ebp - 0x108], 0x82062403
mov dword [ebp - 0x12f8], 0x4437
mov dword [ebp - 0x1b4c], 0x1000ad9c
cmp dword [ebp - 0x12f8], 0x44ae
jle 0x1003d5b2
and dword [ebp - 0x694], 0
jmp 0x1003d522
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0x7eeb
jge 0x1003d5b2
and dword [ebp - 0x53c], 0
jmp 0x1003d548
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x6a92
jge 0x1003d5ad
mov eax, dword [ebp - 0x694]
mov ecx, dword [ebp - 0x53c]
sar eax, cl
cdq
mov dword [ebp - 0x1760], eax
mov dword [ebp - 0x175c], edx
push dword [ebp - 0x175c]
push dword [ebp - 0x1760]
lea ecx, [ebp - 0x25fc]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x15d0], eax
mov ecx, dword [ebp - 0x15d0]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x25fc]
call fcn.1002281d
jmp 0x1003d53b
jmp 0x1003d515
mov dword [ebp - 0x108], 0
jmp 0x1003d5cb
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x1d
jle 0x1003d5f4
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1003d5f2
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x1003d5be
cmp dword [ebp - 0x12f8], 0x43ad
jge 0x1003d60c
push dword [ebp - 0x1b4c]
call fcn.10077843
pop ecx
mov dword [ebp - 0x108], 0
jmp 0x1003d625
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffef
jl 0x1003d79b
mov dword [ebp - 0x744], 0
mov dword [ebp - 0x744], 0
jmp 0x1003d655
mov eax, dword [ebp - 0x744]
dec eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0xffffffee
jne 0x1003d796
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x544], 0
jmp 0x1003d685
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 6
jl 0x1003d76b
mov dword [ebp - 0x54c], 0x5751cfd1
push 3
lea ecx, [ebp - 0x1f74]
call fcn.10022b61
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x69c], 0
jmp 0x1003d6c9
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 3
jge 0x1003d6eb
push dword [ebp - 0x69c]
lea ecx, [ebp - 0x1f74]
call fcn.10022bff
mov dword [eax], 8
jmp 0x1003d6bc
mov dword [ebp - 0x54c], 0xc
jmp 0x1003d704
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0x18
jl 0x1003d757
mov dword [ebp - 0x79c], 3
mov dword [ebp - 0x79c], 0
jmp 0x1003d730
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 2
jg 0x1003d755
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x1003d753
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x1003d723
jmp 0x1003d6f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f74]
call fcn.10022be3
jmp 0x1003d678
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1003d791
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBits]
jmp 0x1003d648
jmp 0x1003d618
cmp dword [ebp - 0x564], 0
je 0x10046cef
mov eax, dword [ebp - 0x564]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10046cef
mov dword [ebp - 0x6a4], 0
push 3
lea ecx, [ebp - 0x1dc0]
call fcn.10022b61
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x1984], 0
mov dword [ebp - 0x554], 0
jmp 0x1003d7fd
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 3
jge 0x1003d81f
push dword [ebp - 0x554]
lea ecx, [ebp - 0x1dc0]
call fcn.10022bff
mov dword [eax], 0xfffffffb
jmp 0x1003d7f0
mov dword [ebp - 0x6a4], 0x15
jmp 0x1003d838
mov eax, dword [ebp - 0x6a4]
dec eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0xfffffff9
jle 0x1003d975
mov dword [ebp - 0x204], 0x72304b25
mov dword [ebp - 0x204], 2
jmp 0x1003d868
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x1003d964
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1003d891
push 0
push 0
call dword [sym.imp.USER32.dll_IsDialogMessageW]
mov dword [ebp - 0xd48], 0x5292
mov dword [ebp - 0x15d8], 0x1000adc0
cmp dword [ebp - 0xd48], 0x5638
jle 0x1003d928
and dword [ebp - 0x55c], 0
jmp 0x1003d8c7
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x1488
jge 0x1003d928
and dword [ebp - 0x74c], 0
jmp 0x1003d8e9
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0x7f96
jge 0x1003d926
mov eax, dword [ebp - 0x55c]
sub eax, dword [ebp - 0x74c]
cdq
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0x1768], edx
push dword [ebp - 0x1768]
push dword [ebp - 0x176c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003d8dc
jmp 0x1003d8ba
push dword [ebp - 0x204]
lea ecx, [ebp - 0x1dc0]
call fcn.10022bff
cmp dword [eax], 0
je 0x1003d943
jmp 0x1003d85b
cmp dword [ebp - 0xd48], 0x4f88
jge 0x1003d95f
mov edx, dword [ebp - 0x15d8]
mov ecx, 0x10092b78
call fcn.10025597
jmp 0x1003d85b
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1984], eax
jmp 0x1003d82b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc0]
call fcn.10022be3
mov eax, dword [ebp - 0x564]
mov ecx, dword [ebp - 0x564]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x5c], 0xd5e48d32
mov dword [ebp - 0x234], 0xc12265e3
mov dword [ebp - 0x1238], 0x380ee91b
mov dword [ebp - 0x754], 0xb38eb16e
mov dword [ebp - 0x2074], 4
mov dword [ebp - 0x1fa8], 0
mov dword [ebp - 0x207c], 0xfffffff7
mov dword [ebp - 0x1bb4], 0
mov dword [ebp - 0x1088], 0x3950
mov dword [ebp - 0x1a8c], 0x1000ae08
cmp dword [ebp - 0x1088], 0x3c03
jle 0x1003db13
and dword [ebp - 0x574], 0
jmp 0x1003da20
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x10d0
jge 0x1003db13
and dword [ebp - 0x6ac], 0
jmp 0x1003da46
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0x3a03
jge 0x1003db0e
and dword [ebp - 0x56c], 0
jmp 0x1003da6c
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0x1a46
jge 0x1003db09
and dword [ebp - 0x7dc], 0
jmp 0x1003da92
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0x2e9d
jge 0x1003db04
mov eax, dword [ebp - 0x6ac]
cdq
idiv dword [ebp - 0x56c]
xor edx, dword [ebp - 0x7dc]
or edx, dword [ebp - 0x574]
mov eax, edx
cdq
mov dword [ebp - 0x1778], eax
mov dword [ebp - 0x1774], edx
push dword [ebp - 0x1774]
push dword [ebp - 0x1778]
lea ecx, [ebp - 0x24dc]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x15e0], eax
mov ecx, dword [ebp - 0x15e0]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x24dc]
call fcn.1002281d
jmp 0x1003da85
jmp 0x1003da5f
jmp 0x1003da39
jmp 0x1003da13
mov dword [ebp - 0x1994], 0xad50a0c
cmp dword [ebp - 0x1088], 0x35d0
jge 0x1003db35
push dword [ebp - 0x1a8c]
call fcn.10077843
pop ecx
mov dword [ebp - 0x1fb8], 3
mov dword [ebp - 0x10b8], 0x98381653
mov dword [ebp - 0x8ec], 4
mov dword [ebp - 0x5c], 0
jmp 0x1003db63
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xe
je 0x1003dc1f
mov dword [ebp - 0x15e8], 0x4ddb
mov dword [ebp - 0xd50], 0xcc2fdcba
mov dword [ebp - 0x198c], 0x31eb2391
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2084], eax
cmp dword [ebp - 0x5c], 0
jne 0x1003dbac
cmp dword [ebp - 0x15e8], 0
jne 0x1003dbac
and dword [ebp - 0x1090], 0
jmp 0x1003dbb6
mov dword [ebp - 0x1090], 1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xd50], eax
jle 0x1003dbd6
mov dword [ebp - 0x1228], 1
jmp 0x1003dbdd
and dword [ebp - 0x1228], 0
cmp dword [ebp - 0x1228], 0x737a9a97
je 0x1003dbf5
mov dword [ebp - 0xd58], 1
jmp 0x1003dbfc
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x1090]
sub eax, dword [ebp - 0x234]
mov dword [ebp - 0x198c], eax
jmp 0x1003db5c
mov dword [ebp - 0x234], 4
jmp 0x1003dc38
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x24
jne 0x1003e1c0
mov dword [ebp - 0x6b4], 0xf72b
mov dword [ebp - 0x190], 2
mov dword [ebp - 0x2a8], 0x972ce3c4
mov dword [ebp - 0x584], 0xe948eca1
cmp dword [ebp - 0x5c], 0
jne 0x1003dc85
mov eax, 0xa855
test eax, eax
jne 0x1003dc85
and dword [ebp - 0xd60], 0
jmp 0x1003dc8f
mov dword [ebp - 0xd60], 1
mov eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0xd60], eax
jge 0x1003dcaf
cmp dword [ebp - 0x1238], 0
jne 0x1003dcaf
and dword [ebp - 0x1380], 0
jmp 0x1003dcb9
mov dword [ebp - 0x1380], 1
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x1380], eax
je 0x1003dcd3
mov dword [ebp - 0x15f0], 1
jmp 0x1003dcda
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1fc8], eax
cmp dword [ebp - 0x6b4], 0xfd074def
ja 0x1003dcfb
mov dword [ebp - 0xd68], 1
jmp 0x1003dd02
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0xd68]
neg eax
cmp dword [ebp - 0x6b4], eax
jle 0x1003dd1e
mov dword [ebp - 0x1098], 1
jmp 0x1003dd25
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x6b4]
imul eax, dword [ebp - 0x1098]
test eax, eax
jne 0x1003dd48
cmp dword [ebp - 0x754], 0
jne 0x1003dd48
and dword [ebp - 0xd70], 0
jmp 0x1003dd52
mov dword [ebp - 0xd70], 1
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0xd70], eax
jne 0x1003dd6c
mov dword [ebp - 0x1230], 1
jmp 0x1003dd73
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0x1230]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x190], 0
jmp 0x1003dd98
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffed
jl 0x1003e1bb
mov dword [ebp - 0x880], 1
mov dword [ebp - 0x208c], 1
mov dword [ebp - 0xda8], 0xe724d257
mov dword [ebp - 0x1fd8], 3
mov dword [ebp - 0x1d4c], 0xdb3aac01
mov dword [ebp - 0x1d48], 0xdb3aac01
mov dword [ebp - 0x1d44], 0xdb3aac01
mov dword [ebp - 0x1d40], 0xdb3aac01
lea ecx, [ebp - 0x8d1]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1d3c]
push eax
lea eax, [ebp - 0x1d4c]
push eax
lea ecx, [ebp - 0x2240]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1464]
call fcn.10022bbd
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x70], 0xfffffffc
mov dword [ebp - 0x2094], 0x874d2d97
mov dword [ebp - 0x199c], 0xc50ec319
mov dword [ebp - 0x878], 0x3d709c59
mov dword [ebp - 0x57c], 0
jmp 0x1003de6f
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 2
jge 0x1003de8b
mov eax, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0x1784], 0xffffffff
jmp 0x1003de62
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
jne 0x1003deac
cmp dword [ebp - 0x1bb4], 0
jne 0x1003deac
and dword [ebp - 0x15f8], 0
jmp 0x1003deb6
mov dword [ebp - 0x15f8], 1
push 3
lea ecx, [ebp - 0x1464]
call fcn.10022bff
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x1003dee0
cmp dword [ebp - 0xda8], 0
jne 0x1003dee0
and dword [ebp - 0xd78], 0
jmp 0x1003deea
mov dword [ebp - 0xd78], 1
mov eax, dword [ebp - 0x1994]
add eax, dword [ebp - 0xd78]
cmp dword [ebp - 0x880], eax
jl 0x1003df0a
mov dword [ebp - 0x10a0], 1
jmp 0x1003df11
and dword [ebp - 0x10a0], 0
cmp dword [ebp - 0x10a0], 1
je 0x1003df26
mov dword [ebp - 0xd80], 1
jmp 0x1003df2d
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0xd80]
jle 0x1003df47
mov dword [ebp - 0x1300], 1
jmp 0x1003df4e
and dword [ebp - 0x1300], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x1300], eax
jl 0x1003df68
mov dword [ebp - 0xd88], 1
jmp 0x1003df6f
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x584]
cmp dword [ebp - 0xd88], eax
jle 0x1003df89
mov dword [ebp - 0x1600], 1
jmp 0x1003df90
and dword [ebp - 0x1600], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x209c], eax
imul eax, dword [ebp - 0x584], 0xbb77
test eax, eax
je 0x1003dfb6
mov dword [ebp - 0x1a94], 1
jmp 0x1003dfbd
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2000], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1784]
cmp dword [ebp - 0x8ec], eax
jne 0x1003dfe7
mov dword [ebp - 0x10a8], 1
jmp 0x1003dfee
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 0x5314680e
je 0x1003e006
mov dword [ebp - 0xd90], 1
jmp 0x1003e00d
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
sub eax, dword [ebp - 0x190]
je 0x1003e02d
cmp dword [ebp - 0x1238], 0
je 0x1003e02d
and dword [ebp - 0xd98], 0
jmp 0x1003e037
mov dword [ebp - 0xd98], 1
cmp dword [ebp - 0xd98], 0xebcd5902
jb 0x1003e04f
mov dword [ebp - 0x10b0], 1
jmp 0x1003e056
and dword [ebp - 0x10b0], 0
cmp dword [ebp - 0x10b0], 0xa093
jle 0x1003e06e
mov dword [ebp - 0xda0], 1
jmp 0x1003e075
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x70], 1
jmp 0x1003e091
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1003e1a7
mov eax, dword [ebp - 0x70]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x1464]
call fcn.10022bff
mov eax, dword [ebp - 0x70]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x1464]
call fcn.10022bff
mov eax, dword [ebp - 0x70]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x1464]
call fcn.10022bff
mov esi, dword [ebp - 0x2a8]
imul esi, dword [ebp - 0x2a8]
push 1
lea ecx, [ebp - 0x1464]
call fcn.10022bff
add esi, dword [eax]
cmp esi, dword [ebp - 0x754]
jle 0x1003e0fe
mov dword [ebp - 0x1348], 1
jmp 0x1003e105
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x1348], eax
jge 0x1003e11f
mov dword [ebp - 0x8cc], 1
jmp 0x1003e126
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp + eax*4 - 0x1784], ecx
mov eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0x880]
je 0x1003e159
cmp dword [ebp - 0x8ec], 0
je 0x1003e159
mov dword [ebp - 0x1608], 1
jmp 0x1003e160
and dword [ebp - 0x1608], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x20cc], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x1784]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x10b8], eax
mov eax, dword [ebp - 0x10b8]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x199c], 0
je 0x1003e1a2
jmp 0x1003e08a
jmp 0x1003e08a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1464]
call fcn.10022be3
jmp 0x1003dd8b
jmp 0x1003dc2b
mov eax, dword [ebp - 0x274]
cmp dword [eax], 0x4550
jne 0x10046cef
mov eax, dword [ebp - 0x274]
cmp dword [eax + 0x74], 0
jbe 0x10046cef
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x274]
cmp dword [ecx + eax + 0x78], 0
je 0x10046cef
mov dword [ebp - 0x278], 0xfff6
mov dword [ebp - 0x1610], 0xfffffffd
mov dword [ebp - 0x7f8], 8
mov dword [ebp - 0x1618], 0x5cf1c946
mov dword [ebp - 0x1e6c], 0x4ab6
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x278], 0
jmp 0x1003e250
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x1f
jge 0x1003e3be
mov dword [ebp - 0x888], 0xe32cf415
mov dword [ebp - 0x19a4], 0
mov dword [ebp - 0x6bc], 0
jmp 0x1003e28a
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 4
jge 0x1003e2a6
mov eax, dword [ebp - 0x6bc]
mov dword [ebp + eax*4 - 0x1e58], 0x7c1188e1
jmp 0x1003e27d
mov eax, dword [ebp - 0x7f8]
imul eax, dword [ebp - 0x7f8]
test eax, eax
jne 0x1003e31d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e58], 9
jne 0x1003e2dc
mov eax, 0xb27f
test eax, eax
je 0x1003e2dc
mov dword [ebp - 0xdb0], 1
jmp 0x1003e2e3
and dword [ebp - 0xdb0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e58]
cmp dword [ebp - 0xdb0], eax
jne 0x1003e304
mov dword [ebp - 0x1b54], 1
jmp 0x1003e30b
and dword [ebp - 0x1b54], 0
cmp dword [ebp - 0x1618], 0
jne 0x1003e31d
and dword [ebp - 0x1240], 0
jmp 0x1003e327
mov dword [ebp - 0x1240], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e58]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x1240]
jg 0x1003e35d
cmp dword [ebp - 0x888], 0
je 0x1003e35d
mov dword [ebp - 0xdb8], 1
jmp 0x1003e364
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x7f8]
imul eax, dword [ebp - 0xdb8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1e58]
jg 0x1003e38c
mov dword [ebp - 0x10c0], 1
jmp 0x1003e393
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x19a4], eax
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1003e3b9
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1003e243
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x2cc], 0x189
mov dword [ebp - 0x7fc], 0x1aae4b9
mov dword [ebp - 0xdc8], 0xfe2cf45
mov dword [ebp - 0x10d0], 0x6efe0cd1
mov dword [ebp - 0x1aa4], 0xffffffff
mov dword [ebp - 0x804], 0x50714ba0
mov dword [ebp - 0x1638], 0x96d56a42
mov dword [ebp - 0xdc0], 0x5af5
mov dword [ebp - 0x1620], 0x1000ae70
cmp dword [ebp - 0xdc0], 0x5ce8
jle 0x1003e4c0
and dword [ebp - 0x58c], 0
jmp 0x1003e447
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0x77f9
jge 0x1003e4a8
and dword [ebp - 0x7a4], 0
jmp 0x1003e469
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0xd0b
jge 0x1003e4a6
mov eax, dword [ebp - 0x58c]
or eax, dword [ebp - 0x7a4]
cdq
mov dword [ebp - 0x1790], eax
mov dword [ebp - 0x178c], edx
push dword [ebp - 0x178c]
push dword [ebp - 0x1790]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003e45c
jmp 0x1003e43a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawIconEx]
mov dword [ebp - 0xb4], 0
jmp 0x1003e4d9
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1003e4f5
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x92c], 0xb1a88af1
jmp 0x1003e4cc
cmp dword [ebp - 0xdc0], 0x5798
jge 0x1003e511
mov edx, dword [ebp - 0x1620]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0xb4], 0
jmp 0x1003e52a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1003e546
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1b90], 0xffffffff
jmp 0x1003e51d
cmp dword [ebp - 0x2cc], 0
jne 0x1003e797
cmp dword [ebp - 0x2cc], 0
jne 0x1003e5bf
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x2cc], eax
jl 0x1003e576
mov dword [ebp - 0x1308], 1
jmp 0x1003e57d
and dword [ebp - 0x1308], 0
mov eax, dword [ebp - 0x1308]
mov dword [ebp - 0xdc8], eax
cmp dword [ebp - 0xdc8], 0x6046e74a
jg 0x1003e5a1
mov dword [ebp - 0x10c8], 1
jmp 0x1003e5a8
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x7fc]
add eax, dword [ebp - 0x10c8]
jne 0x1003e5bf
and dword [ebp - 0xdd0], 0
jmp 0x1003e5c9
mov dword [ebp - 0xdd0], 1
mov eax, dword [ebp - 0x7fc]
cmp dword [ebp - 0xdd0], eax
jne 0x1003e5e3
mov dword [ebp - 0x1248], 1
jmp 0x1003e5ea
and dword [ebp - 0x1248], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x1248], eax
jl 0x1003e604
mov dword [ebp - 0xdd8], 1
jmp 0x1003e60b
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0xdd8]
mov dword [ebp - 0x10d0], eax
cmp dword [ebp - 0x10d0], 1
je 0x1003e63c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x92c], 0
je 0x1003e63c
mov dword [ebp - 0xde0], 1
jmp 0x1003e643
and dword [ebp - 0xde0], 0
cmp dword [ebp - 0xde0], 0x3ae5
je 0x1003e668
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x92c], 0
jne 0x1003e668
and dword [ebp - 0x137c], 0
jmp 0x1003e672
mov dword [ebp - 0x137c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
cmp dword [ebp - 0x137c], eax
jg 0x1003e693
mov dword [ebp - 0xde8], 1
jmp 0x1003e69a
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0x1aa4]
cmp dword [ebp - 0xde8], eax
jle 0x1003e6b4
mov dword [ebp - 0x10d8], 1
jmp 0x1003e6bb
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x10d8]
jl 0x1003e6d5
mov dword [ebp - 0xdf0], 1
jmp 0x1003e6dc
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0
je 0x1003e704
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1003e704
mov dword [ebp - 0x162c], 1
jmp 0x1003e70b
and dword [ebp - 0x162c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
mov dword [ebp - 0x214c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
cmp dword [ebp - 0x804], eax
jl 0x1003e73f
mov dword [ebp - 0x19ac], 1
jmp 0x1003e746
and dword [ebp - 0x19ac], 0
cmp dword [ebp - 0x1638], 0
je 0x1003e758
mov eax, 0x2a4e6309
test eax, eax
jne 0x1003e771
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x92c], 0
jne 0x1003e771
and dword [ebp - 0x1250], 0
jmp 0x1003e77b
mov dword [ebp - 0x1250], 1
cmp dword [ebp - 0x1250], 0xaee5
jge 0x1003e797
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1003e797
and dword [ebp - 0xdf8], 0
jmp 0x1003e7a1
mov dword [ebp - 0xdf8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdf8]
mov dword [ebp + eax - 0x1b90], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x274]
mov edx, dword [ebp - 0x240]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x10e0], 0x7870
mov dword [ebp - 0x19b4], 0x1000aec8
cmp dword [ebp - 0x10e0], 0x7b59
jle 0x1003e89d
and dword [ebp - 0x594], 0
jmp 0x1003e80a
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0x4b6b
jge 0x1003e895
and dword [ebp - 0x330], 0
jmp 0x1003e82c
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x22d3
jge 0x1003e890
mov eax, dword [ebp - 0x594]
imul eax, dword [ebp - 0x330]
cdq
mov dword [ebp - 0x179c], eax
mov dword [ebp - 0x1798], edx
push dword [ebp - 0x1798]
push dword [ebp - 0x179c]
lea ecx, [ebp - 0x26ec]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1644], eax
mov ecx, dword [ebp - 0x1644]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x26ec]
call fcn.1002281d
jmp 0x1003e81f
jmp 0x1003e7fd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x280], 0xb9f9b319
mov dword [ebp - 0x280], 0
jmp 0x1003e8c0
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffe4
jne 0x1003e8ee
cmp dword [ebp - 0x280], 0
je 0x1003e8d4
jmp 0x1003e8ee
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1003e8ec
call dword [sym.imp.GDI32.dll_GdiFlush]
jmp 0x1003e8b3
cmp dword [ebp - 0x10e0], 0x7600
jge 0x1003e906
push dword [ebp - 0x19b4]
call fcn.10077843
pop ecx
mov eax, 0xffff
mov word [ebp - 0x8c], ax
or dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x74], 0x730f94f3
mov dword [ebp - 0x94c], 0xfffffff8
mov dword [ebp - 0x824], 0x16db6d03
mov dword [ebp - 0x1d4], 4
mov dword [ebp - 0x814], 1
mov dword [ebp - 0x1cc0], 0xa8cda2ae
mov dword [ebp - 0x1cbc], 0xa8cda2ae
mov dword [ebp - 0x1cb8], 0xa8cda2ae
mov dword [ebp - 0x1cb4], 0xa8cda2ae
lea ecx, [ebp - 0x7f1]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1cb0]
push eax
lea eax, [ebp - 0x1cc0]
push eax
lea ecx, [ebp - 0x2248]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c18]
call fcn.10022bbd
mov dword [ebp - 4], 0x21
mov dword [ebp - 0xe20], 0xfffffffc
mov dword [ebp - 0x2010], 0xddd0f98e
mov dword [ebp - 0x340], 0
jmp 0x1003e9d9
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 4
jge 0x1003e9f5
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x1bd8], 0x4ec2e0cf
jmp 0x1003e9cc
mov dword [ebp - 0x74], 0
jmp 0x1003ea05
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x1003f198
mov dword [ebp - 0x20c], 2
mov dword [ebp - 0x80c], 0xa258
mov dword [ebp - 0x348], 0
jmp 0x1003ea3c
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 2
jge 0x1003ea58
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x91c], 0x5af8b513
jmp 0x1003ea2f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x91c]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x814], eax
jg 0x1003ea85
mov dword [ebp - 0xe00], 1
jmp 0x1003ea8c
and dword [ebp - 0xe00], 0
cmp dword [ebp - 0xe00], 0xb974
jge 0x1003eaa4
mov dword [ebp - 0x1650], 1
jmp 0x1003eaab
and dword [ebp - 0x1650], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x20d4], eax
push 2
lea ecx, [ebp - 0x1c18]
call fcn.10022bff
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x2018], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x91c]
cmp dword [ebp + eax - 0x91c], ecx
jne 0x1003eaf8
mov dword [ebp - 0x1310], 1
jmp 0x1003eaff
and dword [ebp - 0x1310], 0
mov eax, dword [ebp - 0x824]
cmp dword [ebp - 0x1310], eax
jl 0x1003eb19
mov dword [ebp - 0xe08], 1
jmp 0x1003eb20
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0xe08], eax
jg 0x1003eb3a
mov dword [ebp - 0x10e8], 1
jmp 0x1003eb41
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x10e8], eax
je 0x1003eb5b
mov dword [ebp - 0xe10], 1
jmp 0x1003eb62
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xe20]
add eax, dword [ebp - 0xe10]
jne 0x1003eb89
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x91c], 0
jne 0x1003eb89
and dword [ebp - 0x1258], 0
jmp 0x1003eb93
mov dword [ebp - 0x1258], 1
cmp dword [ebp - 0x1258], 0x6cae
jl 0x1003ebab
mov dword [ebp - 0x10f0], 1
jmp 0x1003ebb2
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x1bd8]
mov dword [ebp - 0xe18], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xe18]
mov dword [ebp + eax*4 - 0x1bd8], ecx
mov eax, dword [ebp - 0xe18]
cmp eax, dword [ebp - 0x10f0]
jne 0x1003ebec
mov dword [ebp - 0x1ab4], 1
jmp 0x1003ebf3
and dword [ebp - 0x1ab4], 0
cmp dword [ebp - 0xe20], 0x9f00f3b
jle 0x1003ec0b
mov dword [ebp - 0x1350], 1
jmp 0x1003ec12
and dword [ebp - 0x1350], 0
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
imul eax, dword [ebp - 0x1350]
mov dword [ebp - 0xe28], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe28]
mov dword [ebp + eax - 0x91c], ecx
cmp dword [ebp - 0xe28], 0
je 0x1003ec65
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x1bd8], 0
je 0x1003ec60
jmp 0x1003f198
jmp 0x1003f160
mov dword [ebp - 0x10f8], 0x53fb
mov dword [ebp - 0x165c], 0x1000af00
cmp dword [ebp - 0x10f8], 0x57cc
jle 0x1003ed65
and dword [ebp - 0x350], 0
jmp 0x1003ec9f
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x5820
jge 0x1003ed65
and dword [ebp - 0x358], 0
jmp 0x1003ecc5
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x5ce3
jge 0x1003ed60
and dword [ebp - 0x360], 0
jmp 0x1003eceb
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x2148
jge 0x1003ed5b
and dword [ebp - 0x368], 0
jmp 0x1003ed0d
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x7c80
jge 0x1003ed59
mov eax, dword [ebp - 0x350]
imul eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0x360]
sub ecx, dword [ebp - 0x368]
sar eax, cl
cdq
mov dword [ebp - 0x17a8], eax
mov dword [ebp - 0x17a4], edx
push dword [ebp - 0x17a4]
push dword [ebp - 0x17a8]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1003ed00
jmp 0x1003ecde
jmp 0x1003ecb8
jmp 0x1003ec92
mov dword [ebp - 0x254], 0
cmp dword [ebp - 0x10f8], 0x5205
jge 0x1003ed8b
mov edx, dword [ebp - 0x165c]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x370], 8
mov dword [ebp - 0x1b1c], 0xffffffff
mov dword [ebp - 0x1d4], 0
jmp 0x1003edb8
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jg 0x1003f160
mov dword [ebp - 0x1108], 0
mov dword [ebp - 0xe80], 0x16b841ae
cmp dword [ebp - 0x814], 0
je 0x1003effe
mov dword [ebp - 0x81c], 7
mov dword [ebp - 0x2b0], 0x2237eebd
mov eax, 0x2cbf
test eax, eax
je 0x1003ef78
cmp dword [ebp - 0x254], 0
jne 0x1003ee5b
mov eax, dword [ebp - 0x824]
cmp dword [ebp - 0x2b0], eax
jl 0x1003ee2a
mov dword [ebp - 0xe30], 1
jmp 0x1003ee31
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xe30]
sub ecx, dword [ebp + eax*4 - 0x1bd8]
cmp dword [ebp - 0x2b0], ecx
jge 0x1003ee52
mov eax, 0x9ac07f4c
test eax, eax
jne 0x1003ee5b
and dword [ebp - 0x1260], 0
jmp 0x1003ee65
mov dword [ebp - 0x1260], 1
mov eax, dword [ebp - 0x1108]
cmp dword [ebp - 0x1260], eax
je 0x1003ee7f
mov dword [ebp - 0xe38], 1
jmp 0x1003ee86
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0xe38], eax
jne 0x1003eea0
mov dword [ebp - 0x1100], 1
jmp 0x1003eea7
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x1100], eax
jne 0x1003eec1
mov dword [ebp - 0xe40], 1
jmp 0x1003eec8
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0xe40], eax
je 0x1003eee8
cmp dword [ebp - 0x370], 0
jne 0x1003eee8
and dword [ebp - 0x1318], 0
jmp 0x1003eef2
mov dword [ebp - 0x1318], 1
cmp dword [ebp - 0x1318], 0xffff
jae 0x1003ef0a
mov dword [ebp - 0xe48], 1
jmp 0x1003ef11
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0xe48]
add eax, 0x79d94524
cmp eax, dword [ebp - 0x254]
je 0x1003ef39
cmp dword [ebp - 0x1108], 0
je 0x1003ef39
mov dword [ebp - 0xe50], 1
jmp 0x1003ef40
and dword [ebp - 0xe50], 0
mov esi, dword [ebp - 0x81c]
sub esi, dword [ebp - 0xe50]
push 0
lea ecx, [ebp - 0x1c18]
call fcn.10022bff
sub esi, dword [eax]
mov eax, dword [ebp - 0x81c]
dec eax
mov dword [ebp - 0x81c], eax
test esi, esi
je 0x1003ef78
mov dword [ebp - 0x1268], 1
jmp 0x1003ef7f
and dword [ebp - 0x1268], 0
mov eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0x1268]
cmp eax, 0x2c95c8f3
jg 0x1003ef9f
mov dword [ebp - 0xe58], 1
jmp 0x1003efa6
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 0xffff
jbe 0x1003efbe
mov dword [ebp - 0x19bc], 1
jmp 0x1003efc5
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2150], eax
cmp dword [ebp - 0x254], 0
jne 0x1003efe6
mov dword [ebp - 0x1110], 1
jmp 0x1003efed
and dword [ebp - 0x1110], 0
mov eax, dword [ebp - 0x1110]
mov dword [ebp - 0xe80], eax
jmp 0x1003f15b
mov dword [ebp - 0x1668], 0
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1003f038
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x254], 0xd012
mov eax, dword [ebp - 0x1668]
imul eax, dword [ebp - 0x254]
test eax, eax
je 0x1003f068
cmp dword [ebp - 0x370], 4
jbe 0x1003f068
mov dword [ebp - 0xe60], 1
jmp 0x1003f06f
and dword [ebp - 0xe60], 0
cmp dword [ebp - 0xe60], 7
je 0x1003f084
mov dword [ebp - 0x1384], 1
jmp 0x1003f08b
and dword [ebp - 0x1384], 0
cmp dword [ebp - 0x1384], 0xa7a40015
jbe 0x1003f0a3
mov dword [ebp - 0xe68], 1
jmp 0x1003f0aa
and dword [ebp - 0xe68], 0
cmp dword [ebp - 0xe68], 0
ja 0x1003f0bf
mov dword [ebp - 0x1118], 1
jmp 0x1003f0c6
and dword [ebp - 0x1118], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x1118], eax
jl 0x1003f0e0
mov dword [ebp - 0xe70], 1
jmp 0x1003f0e7
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x94c]
add eax, dword [ebp - 0xe70]
cmp eax, 0x634890b8
jne 0x1003f106
mov dword [ebp - 0x1270], 1
jmp 0x1003f10d
and dword [ebp - 0x1270], 0
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x1270]
jl 0x1003f127
mov dword [ebp - 0xe78], 1
jmp 0x1003f12e
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x1b1c]
cmp dword [ebp - 0xe78], eax
jl 0x1003f148
mov dword [ebp - 0x1120], 1
jmp 0x1003f14f
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x1120]
mov dword [ebp - 0xe80], eax
jmp 0x1003edab
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x1bd8]
mov dword [ebp - 0x1320], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x1320]
mov dword [ebp + eax*4 - 0x1bd8], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1320]
mov dword [ebp + eax - 0x91c], ecx
jmp 0x1003e9fe
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x944], eax
push 0
lea ecx, [ebp - 0x1c18]
call fcn.10022bff
mov ecx, dword [ebp - 0x944]
mov dword [eax], ecx
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x94c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c18]
call fcn.10022be3
cmp dword [ebp + 0x10], 0
jbe 0x1003f55c
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003f557
mov dword [ebp - 0xbc], 0xe0648261
mov dword [ebp - 0xbc], 0
jmp 0x1003f21f
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe7
jle 0x1003f513
mov dword [ebp - 0x380], 0xffffffff
mov dword [ebp - 0x95c], 0xc4e2bf5f
mov dword [ebp - 0x378], 0
jmp 0x1003f259
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x1003f275
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x1440], 0
jmp 0x1003f24c
mov dword [ebp - 0x380], 0x17
jmp 0x1003f28e
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xfffffffd
jge 0x1003f50e
mov dword [ebp - 0x12c], 0x87cf2e56
cmp dword [ebp - 0x12c], 0
je 0x1003f2b3
jmp 0x1003f50e
mov dword [ebp - 0x12c], 0
jmp 0x1003f2cc
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jg 0x1003f509
mov dword [ebp - 0x110], 8
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1003f301
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [ebp - 0x110], 2
jmp 0x1003f31a
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x1003f504
mov dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x110]
cmp dword [ebp + eax*4 - 0x1440], ecx
jge 0x1003f352
mov dword [ebp - 0x954], 1
jmp 0x1003f359
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x954]
mov dword [ebp + eax*4 - 0x1440], ecx
mov dword [ebp - 0x288], 2
jmp 0x1003f385
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jl 0x1003f4ff
mov dword [ebp - 0x13f4], 0x646b8d96
mov dword [ebp - 0x13f0], 0x646b8d96
mov dword [ebp - 0x13ec], 0x646b8d96
mov dword [ebp - 0x13e8], 0x646b8d96
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13f4], 2
jmp 0x1003f3e8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13f4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x13f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13f4], 0
jl 0x1003f4fa
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp + eax*4 - 0x1440]
mov dword [ebp - 0x2020], eax
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp + eax*4 - 0x1440]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x13f4]
je 0x1003f438
mov dword [ebp - 0x96c], 1
jmp 0x1003f43f
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp + eax*4 - 0x1440]
cmp dword [ebp - 0x95c], eax
jle 0x1003f46c
mov dword [ebp - 0x964], 1
jmp 0x1003f473
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x964], eax
jne 0x1003f48d
mov dword [ebp - 0x974], 1
jmp 0x1003f494
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x96c]
cmp eax, dword [ebp - 0x974]
jl 0x1003f4ae
mov dword [ebp - 0x97c], 1
jmp 0x1003f4b5
and dword [ebp - 0x97c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x97c]
sub ecx, dword [ebp + eax - 0x13f4]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1440], ecx
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1003f4f5
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x1003f3cd
jmp 0x1003f378
jmp 0x1003f30d
jmp 0x1003f2bf
jmp 0x1003f281
jmp 0x1003f212
mov dword [ebp - 0xbc], 0
jmp 0x1003f52c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 8
je 0x1003f54c
mov dword [ebp - 0x1674], 0xfffffffb
cmp dword [ebp - 0x1674], 0
je 0x1003f54a
jmp 0x1003f54c
jmp 0x1003f51f
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x8c], ax
jmp 0x10043e0e
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x20dc], 1
mov dword [ebp - 0x2028], 1
mov dword [ebp - 0x2154], 0xfffffff8
mov dword [ebp - 0x2030], 0x653b1dab
mov dword [ebp - 0x20e4], 0xc8210466
mov dword [ebp - 0x2038], 0x93ba6aed
mov dword [ebp - 0x2194], 0x193fe696
mov dword [ebp - 0x2040], 0
mov dword [ebp - 0x984], 0x7827
mov dword [ebp - 0x1680], 0x1000af48
cmp dword [ebp - 0x984], 0x7979
jle 0x1003f6af
and dword [ebp - 0x388], 0
jmp 0x1003f5f0
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x4d66
jge 0x1003f6af
and dword [ebp - 0x390], 0
jmp 0x1003f616
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x52ba
jge 0x1003f6aa
and dword [ebp - 0x398], 0
jmp 0x1003f63c
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0xe2
jge 0x1003f6a5
mov eax, dword [ebp - 0x388]
and eax, dword [ebp - 0x390]
and eax, dword [ebp - 0x398]
cdq
mov dword [ebp - 0x17b4], eax
mov dword [ebp - 0x17b0], edx
push dword [ebp - 0x17b0]
push dword [ebp - 0x17b4]
lea ecx, [ebp - 0x250c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x19c4], eax
mov ecx, dword [ebp - 0x19c4]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x250c]
call fcn.1002281d
jmp 0x1003f62f
jmp 0x1003f609
jmp 0x1003f5e3
push 1
lea ecx, [ebp - 0x1f84]
call fcn.10022b61
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x984], 0x749d
jge 0x1003f6db
push dword [ebp - 0x1680]
call fcn.10077843
pop ecx
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x3a0], 0
jmp 0x1003f6fe
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x1003f720
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x1f84]
call fcn.10022bff
mov dword [eax], 1
jmp 0x1003f6f1
mov dword [ebp - 0x1e0], 0
jmp 0x1003f739
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xf
jg 0x1003f808
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x994], 0
mov dword [ebp - 0x1d8], 0x14
jmp 0x1003f773
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 7
jle 0x1003f803
mov dword [ebp - 0x1ac4], 0x3bd65256
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x1d8], eax
je 0x1003f7e1
cmp dword [ebp - 0x1ac4], 0
je 0x1003f7b6
cmp dword [ebp - 0x1e0], 0
je 0x1003f7b6
mov dword [ebp - 0x98c], 1
jmp 0x1003f7bd
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
sub eax, 0xa9b27fa
sub eax, dword [ebp - 0x994]
cmp eax, 0xfff9
je 0x1003f7e1
mov dword [ebp - 0x168c], 1
jmp 0x1003f7e8
and dword [ebp - 0x168c], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x20ec], eax
mov dword [ebp - 0x994], 0xbca7
jmp 0x1003f766
jmp 0x1003f72c
mov eax, dword [ebp - 0x99c]
inc eax
mov dword [ebp - 0x99c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f84]
call fcn.10022be3
mov dword [ebp - 0x9a4], 0x6c10
mov dword [ebp - 0x1698], 0x1000af88
cmp dword [ebp - 0x9a4], 0x6c24
jle 0x1003f8e9
and dword [ebp - 0x3a8], 0
jmp 0x1003f85e
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x59c
jge 0x1003f8e9
and dword [ebp - 0x3b0], 0
jmp 0x1003f880
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x3a3f
jge 0x1003f8e4
mov eax, dword [ebp - 0x3a8]
imul eax, dword [ebp - 0x3b0]
cdq
mov dword [ebp - 0x17c0], eax
mov dword [ebp - 0x17bc], edx
push dword [ebp - 0x17bc]
push dword [ebp - 0x17c0]
lea ecx, [ebp - 0x262c]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x19cc], eax
mov ecx, dword [ebp - 0x19cc]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x262c]
call fcn.1002281d
jmp 0x1003f873
jmp 0x1003f851
cmp dword [ebp - 0x9a4], 0x6a0a
jge 0x1003f901
push dword [ebp - 0x1698]
call fcn.10077843
pop ecx
mov dword [ebp - 0x64], 0x2086bd08
mov dword [ebp - 0x1e8], 0x1637c1d6
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x3b8], 0
jmp 0x1003f932
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 2
jge 0x1003f94e
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x20c4], 0
jmp 0x1003f925
push 6
pop eax
test eax, eax
je 0x1003f99e
cmp dword [ebp - 0x64], 0
je 0x1003f99e
mov dword [ebp - 0x64], 0xd90c0e82
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x64], eax
jg 0x1003f979
mov dword [ebp - 0x1b18], 1
jmp 0x1003f980
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x2048], eax
cmp dword [ebp - 0x6c], 0
je 0x1003f99e
mov dword [ebp - 0x9ac], 1
jmp 0x1003f9a5
and dword [ebp - 0x9ac], 0
cmp dword [ebp - 0x9ac], 1
jne 0x1003f9ba
mov dword [ebp - 0x9b4], 1
jmp 0x1003f9c1
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x9b4]
add eax, 0xbf0b
neg eax
jne 0x1003f9df
push 4
pop eax
test eax, eax
je 0x1003fa70
push 3
lea ecx, [ebp - 0x1de4]
call fcn.10022b61
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x3c0], 0
jmp 0x1003fa0c
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 3
jge 0x1003fa2b
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x1de4]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x1003f9ff
push 1
lea ecx, [ebp - 0x1de4]
call fcn.10022bff
cmp dword [eax], 0xfffffffa
ja 0x1003fa49
mov dword [ebp - 0x9bc], 1
jmp 0x1003fa50
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x1e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1de4]
call fcn.10022be3
jmp 0x1003fcd5
push 1
lea ecx, [ebp - 0x135c]
call fcn.10022b61
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x3c8], 0
jmp 0x1003fa9d
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 1
jge 0x1003fabc
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x135c]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x1003fa90
mov dword [ebp - 0x64], 0
jmp 0x1003facc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x1003fcc6
mov dword [ebp - 0x118], 0xec56
mov dword [ebp - 0x6c], 0
jmp 0x1003faf0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x1003fcc1
mov dword [ebp - 0x54], 0xffffffff
mov esi, dword [ebp - 0x54]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x135c]
call fcn.10022bff
mov dword [eax], esi
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x64], eax
jge 0x1003fb28
mov dword [ebp - 0x9c4], 1
jmp 0x1003fb2f
and dword [ebp - 0x9c4], 0
mov esi, dword [ebp - 0x118]
sub esi, dword [ebp - 0x9c4]
sub esi, 0xcbad
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x135c]
call fcn.10022bff
cmp esi, dword [eax]
jge 0x1003fb5f
mov dword [ebp - 0x9cc], 1
jmp 0x1003fb66
and dword [ebp - 0x9cc], 0
imul eax, dword [ebp - 0x9cc], 0x2658
test eax, eax
jne 0x1003fb86
cmp dword [ebp - 0x118], 0
jne 0x1003fb86
and dword [ebp - 0x16a4], 0
jmp 0x1003fb90
mov dword [ebp - 0x16a4], 1
push 0
lea ecx, [ebp - 0x135c]
call fcn.10022bff
push 0
lea ecx, [ebp - 0x135c]
call fcn.10022bff
mov esi, dword [ebp - 0x6c]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x135c]
call fcn.10022bff
cmp esi, dword [eax]
jl 0x1003fbd4
mov eax, 0x31364f2c
test eax, eax
je 0x1003fbd4
mov dword [ebp - 0x9d4], 1
jmp 0x1003fbdb
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x9d4]
jne 0x1003fbf9
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1003fbf9
and dword [ebp - 0x19d4], 0
jmp 0x1003fc03
mov dword [ebp - 0x19d4], 1
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x215c], eax
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x54], eax
jg 0x1003fc23
mov dword [ebp - 0x9dc], 1
jmp 0x1003fc2a
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x9dc], eax
jle 0x1003fc66
mov dword [ebp - 0x54], 0
jmp 0x1003fc48
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1003fc64
push dword [ebp - 0x54]
lea ecx, [ebp - 0x135c]
call fcn.10022bff
mov dword [eax], 0xac89d693
jmp 0x1003fc41
jmp 0x1003fcbc
mov dword [ebp - 0x54], 0xb
jmp 0x1003fc76
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffa
jl 0x1003fcbc
mov dword [ebp - 0x118], 0xffffffe7
jmp 0x1003fc95
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x12
jg 0x1003fcba
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1003fcb8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003fc88
jmp 0x1003fc6f
jmp 0x1003fae9
jmp 0x1003fac5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x135c]
call fcn.10022be3
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x64], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20c4], 1
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x6c]
je 0x1003fd03
mov dword [ebp - 0x9e4], 1
jmp 0x1003fd0a
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x1e8], eax
mov eax, dword [0x10093c30]
and eax, 1
jne 0x1003fd4d
mov eax, dword [0x10093c30]
or eax, 1
mov dword [0x10093c30], eax
mov dword [ebp - 4], 0x25
mov ecx, 0x10098058
call fcn.10022e90
push 0x1008e242
call fcn.10077819
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x9fc], 0xfffffffe
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x9ec], 0x1da7bc99
mov dword [ebp - 0x16b0], 0xfaeb382
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1003fda0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp dword [ebp - 0x78], 0x9689
jne 0x1003fdb5
mov dword [ebp - 0x9f4], 1
jmp 0x1003fdbc
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
add eax, dword [ebp - 0x9f4]
cmp eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x82c], eax
jge 0x1003fe01
mov dword [ebp - 0xa04], 1
jmp 0x1003fe08
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0xa04]
cmp eax, dword [ebp - 0x78]
je 0x1003fe22
mov dword [ebp - 0xa0c], 1
jmp 0x1003fe29
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 7
jne 0x1003fe3e
mov dword [ebp - 0xa14], 1
jmp 0x1003fe45
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0xa14]
cmp eax, dword [ebp - 0x78]
jle 0x1003fe5f
mov dword [ebp - 0xa1c], 1
jmp 0x1003fe66
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0xa1c]
test eax, eax
jne 0x1003fe86
cmp dword [ebp - 0x82c], 0
jne 0x1003fe86
and dword [ebp - 0xa24], 0
jmp 0x1003fe90
mov dword [ebp - 0xa24], 1
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x16b0], eax
movzx eax, byte [0x10098010]
test eax, eax
je 0x100407af
mov ecx, 0x10098058
call fcn.1004b57b
movzx eax, al
test eax, eax
jne 0x100407af
mov dword [ebp - 0x1ce8], 2
mov dword [ebp - 0x1ce4], 2
mov dword [ebp - 0x1ce0], 2
mov dword [ebp - 0x1cdc], 2
lea ecx, [ebp - 0x7fd]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1cd8]
push eax
lea eax, [ebp - 0x1ce8]
push eax
lea ecx, [ebp - 0x2260]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1ae0]
call fcn.10022bbd
mov dword [ebp - 4], 0x26
push 3
lea ecx, [ebp - 0x1ad0]
call fcn.10022b61
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x3d8], 0xffffffff
mov dword [ebp - 0x3d0], 0
jmp 0x1003ff58
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x1003ff7a
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x1ad0]
call fcn.10022bff
mov dword [eax], 0x580d416d
jmp 0x1003ff4b
push 0
lea ecx, [ebp - 0x1ae0]
call fcn.10022bff
mov dword [eax], 0xffffffe2
jmp 0x1003ffb3
push 0
lea ecx, [ebp - 0x1ae0]
call fcn.10022bff
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa2c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ae0]
call fcn.10022bff
cmp dword [eax], 9
je 0x1003ffe4
push 0
lea ecx, [ebp - 0x1ae0]
call fcn.10022bff
push 1
lea ecx, [ebp - 0x1ad0]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x1003ff8f
mov dword [ebp - 0x3d8], 0xffffffe6
jmp 0x1003fffd
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xffffffed
jl 0x1004055c
mov dword [ebp - 0x438], 0x2b82c447
mov dword [ebp - 0xa44], 0x34859bb
mov dword [ebp - 0xa64], 8
mov dword [ebp - 0x2050], 0xffffffff
mov dword [ebp - 0x20f4], 0x71808adc
mov dword [ebp - 0x2058], 1
mov dword [ebp - 0x1b28], 1
mov dword [ebp - 0x3e0], 0
jmp 0x10040069
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 1
jge 0x10040085
mov eax, dword [ebp - 0x3e0]
mov dword [ebp + eax*4 - 0x1ad4], 0xd42c
jmp 0x1004005c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ad4], 0
je 0x10040537
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x2184], 0x52324067
mov dword [ebp - 0x16d4], 1
push 3
lea ecx, [ebp - 0x1c30]
call fcn.10022b61
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x834], 0xf0dc4b63
mov dword [ebp - 0x1ae4], 0xfffffffb
mov dword [ebp - 0x3e8], 0
jmp 0x100400f5
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 3
jge 0x10040114
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x1c30]
call fcn.10022bff
and dword [eax], 0
jmp 0x100400e8
mov dword [ebp - 0xa6c], 0x77ad
mov dword [ebp - 0x16ec], 0x1000afa8
cmp dword [ebp - 0xa6c], 0x79d7
jle 0x10040211
and dword [ebp - 0x3f0], 0
jmp 0x1004014e
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x5b2b
jge 0x10040211
and dword [ebp - 0x3f8], 0
jmp 0x10040174
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x3337
jge 0x1004020c
and dword [ebp - 0x400], 0
jmp 0x1004019a
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x1be5
jge 0x10040207
and dword [ebp - 0x408], 0
jmp 0x100401bc
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x3fd8
jge 0x10040205
mov eax, dword [ebp - 0x3f0]
and eax, dword [ebp - 0x3f8]
or eax, dword [ebp - 0x400]
or eax, dword [ebp - 0x408]
cdq
mov dword [ebp - 0x17cc], eax
mov dword [ebp - 0x17c8], edx
push dword [ebp - 0x17c8]
push dword [ebp - 0x17cc]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x100401af
jmp 0x1004018d
jmp 0x10040167
jmp 0x10040141
mov dword [ebp - 0x2b4], 0x19
jmp 0x1004022a
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x18
jge 0x1004050a
mov dword [ebp - 0xa34], 0x232b
mov dword [ebp - 0x19dc], 0x1000afec
cmp dword [ebp - 0xa34], 0x23f8
jle 0x10040363
and dword [ebp - 0x420], 0
jmp 0x10040271
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x7a3f
jge 0x10040363
and dword [ebp - 0x410], 0
jmp 0x10040297
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x17b5
jge 0x1004035e
and dword [ebp - 0x418], 0
jmp 0x100402bd
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x2de1
jge 0x10040359
and dword [ebp - 0x428], 0
jmp 0x100402e3
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x3da3
jge 0x10040354
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x418]
shl eax, cl
and eax, dword [ebp - 0x420]
xor eax, dword [ebp - 0x428]
cdq
mov dword [ebp - 0x17d8], eax
mov dword [ebp - 0x17d4], edx
push dword [ebp - 0x17d4]
push dword [ebp - 0x17d8]
lea ecx, [ebp - 0x2320]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x16bc], eax
mov ecx, dword [ebp - 0x16bc]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2320]
call fcn.1002281d
jmp 0x100402d6
jmp 0x100402b0
jmp 0x1004028a
jmp 0x10040264
mov dword [ebp - 0x430], 0xd0f12afb
cmp dword [ebp - 0xa34], 0x22c9
jge 0x10040385
push dword [ebp - 0x19dc]
call fcn.10077843
pop ecx
mov eax, dword [ebp - 0x834]
mov ecx, dword [ebp - 0x834]
inc ecx
mov dword [ebp - 0x834], ecx
test eax, eax
je 0x100403b4
cmp dword [ebp - 0x430], 0x674f9af3
jg 0x100403b4
mov dword [ebp - 0x16c8], 1
jmp 0x100403bb
and dword [ebp - 0x16c8], 0
cmp dword [ebp - 0x1b28], 0
jne 0x100403d6
cmp dword [ebp - 0x430], 0
jne 0x100403d6
and dword [ebp - 0xa3c], 0
jmp 0x100403e0
mov dword [ebp - 0xa3c], 1
mov esi, dword [ebp - 0x438]
push 2
lea ecx, [ebp - 0x1ad0]
call fcn.10022bff
mov ecx, dword [ebp - 0xa3c]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x16d4]
cmp esi, ecx
jl 0x10040411
mov dword [ebp - 0x19e4], 1
jmp 0x10040418
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x2060], eax
push 0
lea ecx, [ebp - 0x1c30]
call fcn.10022bff
cmp dword [ebp - 0x430], 0
je 0x1004044f
cmp dword [ebp - 0xa64], 0
je 0x1004044f
mov dword [ebp - 0x16e0], 1
jmp 0x10040456
and dword [ebp - 0x16e0], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x20fc], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2068], eax
mov dword [ebp - 0xa44], 0x9cc099a5
mov eax, dword [ebp - 0x1ae4]
cmp dword [ebp - 0xa44], eax
jg 0x10040492
mov dword [ebp - 0xa4c], 1
jmp 0x10040499
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0xa4c]
je 0x100404b3
mov dword [ebp - 0xa54], 1
jmp 0x100404ba
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0xa54], eax
jle 0x100404d4
mov dword [ebp - 0xa5c], 1
jmp 0x100404db
and dword [ebp - 0xa5c], 0
mov esi, dword [ebp - 0xa5c]
sub esi, dword [ebp - 0xa64]
push 0
lea ecx, [ebp - 0x1c30]
call fcn.10022bff
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x1ad0]
call fcn.10022bff
mov dword [eax], esi
jmp 0x1004021d
cmp dword [ebp - 0xa6c], 0x74db
jge 0x10040526
mov edx, dword [ebp - 0x16ec]
mov ecx, 0x10092b78
call fcn.10025597
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1c30]
call fcn.10022be3
jmp 0x10040557
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x10040557
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x1003fff0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1ad0]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ae0]
call fcn.10022be3
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0xabc]
push eax
mov ecx, 0x10098058
call fcn.10022cea
lea eax, [ebp - 0x2164]
push eax
mov ecx, 0x10098058
call fcn.10022cdc
push eax
lea ecx, [ebp - 0xabc]
call fcn.10022f47
movzx eax, al
test eax, eax
je 0x100407af
mov dword [ebp - 0xa74], 0xfffffffc
mov dword [ebp - 0x1b30], 1
mov dword [ebp - 0xa8c], 0xf2b29949
push 2
lea ecx, [ebp - 0x1dfc]
call fcn.10022b61
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x2070], 0x524f2047
mov dword [ebp - 0x844], 0xfffffffa
mov dword [ebp - 0x2104], 0x9668
mov dword [ebp - 0x83c], 8
mov dword [ebp - 0x440], 0
jmp 0x1004062d
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 2
jge 0x1004064c
push dword [ebp - 0x440]
lea ecx, [ebp - 0x1dfc]
call fcn.10022bff
and dword [eax], 0
jmp 0x10040620
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x2078], eax
cmp dword [ebp - 0xa74], 0
je 0x10040684
mov eax, dword [ebp - 0x83c]
mov ecx, dword [ebp - 0x83c]
inc ecx
mov dword [ebp - 0x83c], ecx
test eax, eax
je 0x10040684
mov dword [ebp - 0xa7c], 1
jmp 0x1004068b
and dword [ebp - 0xa7c], 0
cmp dword [ebp - 0xa7c], 0
jle 0x100406a0
mov dword [ebp - 0x940], 1
jmp 0x100406a7
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0xa8c]
cmp eax, dword [ebp - 0x940]
jg 0x100406ea
or eax, 0xffffffff
je 0x100406cf
cmp dword [ebp - 0xa8c], 0
je 0x100406cf
mov dword [ebp - 0xa94], 1
jmp 0x100406d6
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
add eax, 7
jne 0x100406ea
and dword [ebp - 0xa9c], 0
jmp 0x100406f4
mov dword [ebp - 0xa9c], 1
cmp dword [ebp - 0xa9c], 1
jne 0x10040709
mov dword [ebp - 0xaa4], 1
jmp 0x10040710
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x19ec], eax
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x19ec]
cmp eax, dword [ebp - 0x16f8]
jl 0x1004074f
mov dword [ebp - 0xaac], 1
jmp 0x10040756
and dword [ebp - 0xaac], 0
push 1
lea ecx, [ebp - 0x1dfc]
call fcn.10022bff
mov ecx, dword [ebp - 0xaac]
cmp ecx, dword [eax]
jne 0x10040779
mov dword [ebp - 0xab4], 1
jmp 0x10040780
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x1b30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dfc]
call fcn.10022be3
lea ecx, [ebp - 0xabc]
call fcn.1004b584
mov eax, dword [eax + 4]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0xac4], 0x5c3
mov dword [ebp - 0x1704], 0x1000b018
cmp dword [ebp - 0xac4], 0x76e
jle 0x100408c4
and dword [ebp - 0x448], 0
jmp 0x100407f7
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x7831
jge 0x100408c4
and dword [ebp - 0x328], 0
jmp 0x1004081d
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x7b7c
jge 0x100408bf
and dword [ebp - 0x32c], 0
jmp 0x10040843
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x37e3
jge 0x100408ba
and dword [ebp - 0x450], 0
jmp 0x10040865
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x5508
jge 0x100408b5
mov esi, dword [ebp - 0x448]
sub esi, dword [ebp - 0x328]
mov eax, dword [ebp - 0x32c]
cdq
idiv dword [ebp - 0x450]
mov ecx, edx
shl esi, cl
mov eax, esi
cdq
mov dword [ebp - 0x17e4], eax
mov dword [ebp - 0x17e0], edx
push dword [ebp - 0x17e0]
push dword [ebp - 0x17e4]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10040858
jmp 0x10040836
jmp 0x10040810
jmp 0x100407ea
mov dword [ebp - 0x84c], 1
cmp dword [ebp - 0xac4], 0x2da
jge 0x100408ea
mov edx, dword [ebp - 0x1704]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x1a0c], 0x416af0cf
mov dword [ebp - 0x1c], 0
jmp 0x10040904
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe2
jle 0x10040d2d
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x480], 0xa2d34caa
mov dword [ebp - 0xacc], 0x327a
mov dword [ebp - 0x1710], 0x1000b050
cmp dword [ebp - 0xacc], 0x3394
jle 0x10040a1f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 0x468], 0
jmp 0x1004095f
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0x2197
jge 0x10040a1f
and dword [ebp - 0x458], 0
jmp 0x10040985
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0x61f4
jge 0x10040a1a
and dword [ebp - 0x460], 0
jmp 0x100409ab
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0xc4f
jge 0x10040a15
mov eax, dword [ebp - 0x458]
imul eax, dword [ebp - 0x460]
and eax, dword [ebp - 0x468]
cdq
mov dword [ebp - 0x17f0], eax
mov dword [ebp - 0x17ec], edx
push dword [ebp - 0x17ec]
push dword [ebp - 0x17f0]
lea ecx, [ebp - 0x2350]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x19f4], eax
mov ecx, dword [ebp - 0x19f4]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2350]
call fcn.1002281d
jmp 0x1004099e
jmp 0x10040978
jmp 0x10040952
mov dword [ebp - 0x470], 0
jmp 0x10040a38
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 1
jge 0x10040a54
mov eax, dword [ebp - 0x470]
mov dword [ebp + eax*4 - 0xb2c], 0
jmp 0x10040a2b
cmp dword [ebp - 0xacc], 0x30b9
jge 0x10040a6c
push dword [ebp - 0x1710]
call fcn.10077843
pop ecx
cmp dword [ebp - 0x1c], 9
ja 0x10040a7e
mov dword [ebp - 0xae4], 1
jmp 0x10040a85
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x80]
mov ecx, 0x5731
sub ecx, dword [ebp - 0x80]
sub eax, ecx
cmp eax, dword [ebp - 0x80]
jne 0x10040aac
mov eax, 0x9958900f
test eax, eax
je 0x10040aac
mov dword [ebp - 0xad4], 1
jmp 0x10040ab3
and dword [ebp - 0xad4], 0
imul eax, dword [ebp - 0xad4], 0x8939
cmp eax, dword [ebp - 0x80]
jg 0x10040ace
mov dword [ebp - 0xadc], 1
jmp 0x10040ad5
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xadc], eax
jg 0x10040aec
mov dword [ebp - 0xaec], 1
jmp 0x10040af3
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0xae4]
cmp eax, dword [ebp - 0xaec]
jne 0x10040b0d
mov dword [ebp - 0x1af4], 1
jmp 0x10040b14
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x21a8], eax
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x80], 0
jmp 0x10040b37
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x13
jge 0x10040d28
mov dword [ebp - 0x1f0], 0x61c4
mov dword [ebp - 0xb24], 0xa832397b
mov dword [ebp - 0x478], 0
jmp 0x10040b6e
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 1
jge 0x10040b8a
mov eax, dword [ebp - 0x478]
mov dword [ebp + eax*4 - 0x19fc], 0x9b96
jmp 0x10040b61
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x2080], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x210c], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov ecx, dword [ebp - 0x80]
imul ecx, dword [ebp - 0x1c]
add eax, ecx
cmp eax, dword [ebp - 0x1f0]
jg 0x10040bd4
mov dword [ebp - 0xaf4], 1
jmp 0x10040bdb
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xaf4]
cmp eax, dword [ebp - 0x1f0]
jne 0x10040bf8
mov dword [ebp - 0xafc], 1
jmp 0x10040bff
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xafc]
cmp eax, dword [ebp - 0x80]
jle 0x10040c20
cmp dword [ebp - 0x1f0], 0
jne 0x10040c20
and dword [ebp - 0xb04], 0
jmp 0x10040c2a
mov dword [ebp - 0xb04], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xb04], eax
je 0x10040c41
mov dword [ebp - 0xb0c], 1
jmp 0x10040c48
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xb0c]
cmp eax, 3
jae 0x10040c62
mov dword [ebp - 0xb14], 1
jmp 0x10040c69
and dword [ebp - 0xb14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb2c]
cmp dword [ebp - 0xb14], eax
jge 0x10040c8a
mov dword [ebp - 0xb1c], 1
jmp 0x10040c91
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0xb24], eax
je 0x10040cb7
mov dword [ebp - 0x171c], 1
jmp 0x10040cbe
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e70], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19fc]
cmp dword [ebp - 0x7c], eax
jne 0x10040ce8
mov dword [ebp - 0xb34], 1
jmp 0x10040cef
and dword [ebp - 0xb34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb2c]
cmp dword [ebp - 0xb34], eax
jl 0x10040d10
mov dword [ebp - 0xb3c], 1
jmp 0x10040d17
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0x84c], eax
jmp 0x10040b30
jmp 0x100408fd
mov dword [ebp - 0x1c], 0x1c
jmp 0x10040d3d
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jl 0x100412d5
mov dword [ebp - 0xb44], 0x678f
mov dword [ebp - 0x1b38], 0x1000b074
cmp dword [ebp - 0xb44], 0x6822
jle 0x10040e7a
push 0
call dword [sym.imp.USER32.dll_IsZoomed]
and dword [ebp - 0x488], 0
jmp 0x10040d89
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0x6439
jge 0x10040e7a
and dword [ebp - 0x490], 0
jmp 0x10040daf
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0x4b7a
jge 0x10040e75
and dword [ebp - 0x498], 0
jmp 0x10040dd5
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0x1547
jge 0x10040e70
and dword [ebp - 0x4a0], 0
jmp 0x10040dfb
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0x37e0
jge 0x10040e6b
mov eax, dword [ebp - 0x488]
imul eax, dword [ebp - 0x490]
or eax, dword [ebp - 0x498]
or eax, dword [ebp - 0x4a0]
cdq
mov dword [ebp - 0x17fc], eax
mov dword [ebp - 0x17f8], edx
push dword [ebp - 0x17f8]
push dword [ebp - 0x17fc]
lea ecx, [ebp - 0x2380]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1728], eax
mov ecx, dword [ebp - 0x1728]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2380]
call fcn.1002281d
jmp 0x10040dee
jmp 0x10040dc8
jmp 0x10040da2
jmp 0x10040d7c
mov dword [ebp - 0x4c8], 0xfffffffb
cmp dword [ebp - 0xb44], 0x642b
jge 0x10040e9c
push dword [ebp - 0x1b38]
call fcn.10077843
pop ecx
mov dword [ebp - 0xb7c], 0
mov dword [ebp - 0x174c], 0xdb27c3d8
mov dword [ebp - 0x1758], 0x8bbd03c5
mov dword [ebp - 0x7c], 0
jmp 0x10040eca
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xd
jne 0x100412b0
mov dword [ebp - 0x198], 9
mov dword [ebp - 0xb4c], 0x1cd6
mov dword [ebp - 0x1a04], 0x1000b090
cmp dword [ebp - 0xb4c], 0x1d33
jle 0x10041016
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
and dword [ebp - 0x4c0], 0
jmp 0x10040f22
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x3767
jge 0x10041016
and dword [ebp - 0x4a8], 0
jmp 0x10040f48
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0x6313
jge 0x10041011
and dword [ebp - 0x4b0], 0
jmp 0x10040f6e
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0x6ef3
jge 0x1004100c
and dword [ebp - 0x4b8], 0
jmp 0x10040f94
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0x4ddd
jge 0x10041007
mov eax, dword [ebp - 0x4a8]
cdq
idiv dword [ebp - 0x4b0]
imul edx, dword [ebp - 0x4b8]
xor edx, dword [ebp - 0x4c0]
mov eax, edx
cdq
mov dword [ebp - 0x1808], eax
mov dword [ebp - 0x1804], edx
push dword [ebp - 0x1804]
push dword [ebp - 0x1808]
lea ecx, [ebp - 0x23b0]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1734], eax
mov ecx, dword [ebp - 0x1734]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x23b0]
call fcn.1002281d
jmp 0x10040f87
jmp 0x10040f61
jmp 0x10040f3b
jmp 0x10040f15
mov dword [ebp - 0xb5c], 0xffffffff
cmp dword [ebp - 0xb4c], 0x1a4d
jge 0x10041038
push dword [ebp - 0x1a04]
call fcn.10077843
pop ecx
mov dword [ebp - 0xbc4], 1
mov dword [ebp - 0x1b40], 0xf84ff3fa
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1e74], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x1e7c], eax
cmp dword [ebp - 0x4c8], 0xffffffff
jg 0x10041079
mov dword [ebp - 0xb54], 1
jmp 0x10041080
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0xb5c]
sub eax, 0x6c07
cmp eax, dword [ebp - 0x198]
jg 0x100410ab
mov dword [ebp - 0xb64], 1
jmp 0x100410b2
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x84c]
cmp dword [ebp - 0xb64], eax
jl 0x100410cc
mov dword [ebp - 0xb6c], 1
jmp 0x100410d3
and dword [ebp - 0xb6c], 0
cmp dword [ebp - 0xb6c], 0xc1b2
jle 0x100410eb
mov dword [ebp - 0x1740], 1
jmp 0x100410f2
and dword [ebp - 0x1740], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1e84], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x198], eax
jg 0x10041112
mov dword [ebp - 0x1b04], 1
jmp 0x10041119
and dword [ebp - 0x1b04], 0
mov eax, 0xe74c
sub eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x198]
jg 0x10041138
mov dword [ebp - 0xb74], 1
jmp 0x1004113f
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x84c]
imul eax, dword [ebp - 0xb7c]
cmp eax, dword [ebp - 0x198]
je 0x1004116c
mov dword [ebp - 0xb84], 1
jmp 0x10041173
and dword [ebp - 0xb84], 0
imul eax, dword [ebp - 0xb84], 0xf7d1
cmp eax, dword [ebp - 0x7c]
jle 0x1004118e
mov dword [ebp - 0xb8c], 1
jmp 0x10041195
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xb8c], eax
jne 0x100411ac
mov dword [ebp - 0xb94], 1
jmp 0x100411b3
and dword [ebp - 0xb94], 0
cmp dword [ebp - 0xb94], 0xa3212ec3
jne 0x100411cb
mov dword [ebp - 0xb9c], 1
jmp 0x100411d2
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xb9c], eax
jg 0x100411ec
mov dword [ebp - 0xba4], 1
jmp 0x100411f3
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xba4], eax
jl 0x1004120d
mov dword [ebp - 0xbac], 1
jmp 0x10041214
and dword [ebp - 0xbac], 0
cmp dword [ebp - 0xbac], 0x22f2ee3b
jl 0x1004122c
mov dword [ebp - 0xbb4], 1
jmp 0x10041233
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0xbb4], eax
jl 0x1004124d
mov dword [ebp - 0xbbc], 1
jmp 0x10041254
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0x174c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xbc4], eax
jne 0x10041286
cmp dword [ebp - 0x1a0c], 0
jne 0x10041286
and dword [ebp - 0xbcc], 0
jmp 0x10041290
mov dword [ebp - 0xbcc], 1
mov eax, dword [ebp - 0xbcc]
add eax, 0x63943e12
mov dword [ebp - 0x1758], eax
mov dword [ebp - 0x1b40], 0x10c1a6fe
jmp 0x10040ec3
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x100412d0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthA]
jmp 0x10040d36
mov dword [ebp - 0xf14], 0x4837
mov dword [ebp - 0x1958], 0x1000b0e0
cmp dword [ebp - 0xf14], 0x4947
jle 0x100413d6
and dword [ebp - 0x4d0], 0
jmp 0x1004130f
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x25a6
jge 0x100413d0
and dword [ebp - 0x4d8], 0
jmp 0x10041335
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x2335
jge 0x100413cb
and dword [ebp - 0x4e0], 0
jmp 0x1004135b
mov eax, dword [ebp - 0x4e0]
inc eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0x3784
jge 0x100413c6
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x4d8]
sar eax, cl
or eax, dword [ebp - 0x4e0]
cdq
mov dword [ebp - 0x1814], eax
mov dword [ebp - 0x1810], edx
push dword [ebp - 0x1810]
push dword [ebp - 0x1814]
lea ecx, [ebp - 0x23e0]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1764], eax
mov ecx, dword [ebp - 0x1764]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x23e0]
call fcn.1002281d
jmp 0x1004134e
jmp 0x10041328
jmp 0x10041302
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
cmp dword [ebp - 0x238], 0xffffffff
jne 0x10043df6
mov dword [ebp - 0xc1c], 0x6833
mov dword [ebp - 0x177c], 0x1000b128
cmp dword [ebp - 0xc1c], 0x68ef
jle 0x10041511
and dword [ebp - 0x4e8], 0
jmp 0x1004141d
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0x2dd
jge 0x10041511
and dword [ebp - 0x4f0], 0
jmp 0x10041443
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0x7b75
jge 0x1004150c
and dword [ebp - 0x4f8], 0
jmp 0x10041469
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x4ab3
jge 0x10041507
and dword [ebp - 0x500], 0
jmp 0x1004148f
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x4c5d
jge 0x10041502
mov eax, dword [ebp - 0x4e8]
imul eax, dword [ebp - 0x4f0]
mov ecx, dword [ebp - 0x4f8]
imul ecx, dword [ebp - 0x500]
shl eax, cl
cdq
mov dword [ebp - 0x1820], eax
mov dword [ebp - 0x181c], edx
push dword [ebp - 0x181c]
push dword [ebp - 0x1820]
lea ecx, [ebp - 0x2410]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x1a14], eax
mov ecx, dword [ebp - 0x1a14]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x2410]
call fcn.1002281d
jmp 0x10041482
jmp 0x1004145c
jmp 0x10041436
jmp 0x10041410
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x854], 0x30f94f37
push 2
lea ecx, [ebp - 0x1c48]
call fcn.10022b61
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xbf4], 0xfffffffd
mov dword [ebp - 0xc04], 0x8700d35d
mov dword [ebp - 0xc4], 0
jmp 0x10041566
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x10041585
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1c48]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x10041559
mov dword [ebp - 0xc4], 0
jmp 0x1004159e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x100415ba
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x21f4], 1
jmp 0x10041591
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x854], eax
mov dword [ebp - 0xc14], 0x79cc
mov dword [ebp - 0x1b14], 0x1000b17c
cmp dword [ebp - 0xc14], 0x7d6c
jle 0x100416c3
and dword [ebp - 0x518], 0
jmp 0x10041600
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0x717e
jge 0x100416c3
and dword [ebp - 0x508], 0
jmp 0x10041626
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0x49ed
jge 0x100416be
and dword [ebp - 0x510], 0
jmp 0x1004164c
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0x539e
jge 0x100416b9
and dword [ebp - 0x520], 0
jmp 0x1004166e
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0xa81
jge 0x100416b7
mov eax, dword [ebp - 0x508]
add eax, dword [ebp - 0x510]
and eax, dword [ebp - 0x518]
or eax, dword [ebp - 0x520]
cdq
mov dword [ebp - 0x182c], eax
mov dword [ebp - 0x1828], edx
push dword [ebp - 0x1828]
push dword [ebp - 0x182c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10041661
jmp 0x1004163f
jmp 0x10041619
jmp 0x100415f3
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xbd4], eax
push 0
lea ecx, [ebp - 0x1c48]
call fcn.10022bff
mov ecx, dword [ebp - 0xbd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xbf4], eax
push 0
lea ecx, [ebp - 0x1c48]
call fcn.10022bff
cmp dword [eax], 0x3b37
jle 0x10041711
mov dword [ebp - 0xbdc], 1
jmp 0x10041718
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1e8c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1e94], eax
cmp dword [ebp - 0x120], 0x4c20f746
jg 0x10041748
mov dword [ebp - 0xbe4], 1
jmp 0x1004174f
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0xbdc]
cmp eax, dword [ebp - 0xbe4]
jl 0x10041772
mov eax, 0x79cc
test eax, eax
je 0x10041772
mov dword [ebp - 0xbec], 1
jmp 0x10041779
and dword [ebp - 0xbec], 0
mov dword [ebp - 0x854], 0x416db6d0
mov eax, dword [ebp - 0x120]
imul eax, dword [ebp - 0xbec]
cmp dword [ebp - 0x854], eax
jge 0x100417a4
mov dword [ebp - 0x1770], 1
jmp 0x100417ab
and dword [ebp - 0x1770], 0
cmp dword [ebp - 0xbf4], 0
jne 0x100417c2
xor eax, eax
inc eax
jne 0x100417c2
and dword [ebp - 0xbfc], 0
jmp 0x100417cc
mov dword [ebp - 0xbfc], 1
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0xc04], eax
jl 0x100417f8
mov dword [ebp - 0xc0c], 1
jmp 0x100417ff
and dword [ebp - 0xc0c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp + eax - 0x21f4], ecx
cmp dword [ebp - 0xc14], 0x76a2
jge 0x1004182d
mov edx, dword [ebp - 0x1b14]
mov ecx, 0x10092b78
call fcn.10025597
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c48]
call fcn.10022be3
cmp dword [ebp - 0xc1c], 0x6520
jge 0x10041854
push dword [ebp - 0x177c]
call fcn.10077843
pop ecx
mov ecx, 0x10098058
call fcn.1004b5c8
mov ecx, dword [ebp - 0x128]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10098058
call fcn.1004b5cc
mov dword [ebp - 0x1f8], 9
mov dword [ebp - 0x528], 0
jmp 0x10041895
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 4
jge 0x100418b1
mov eax, dword [ebp - 0x528]
mov dword [ebp + eax*4 - 0x1e48], 0x4ec2e0cf
jmp 0x10041888
mov dword [ebp - 0x1f8], 0
jmp 0x100418ca
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jg 0x100418f1
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x100418ef
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x100418bd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e48], 0
jl 0x1004190c
mov dword [ebp - 0xc24], 1
jmp 0x10041913
and dword [ebp - 0xc24], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e48]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x1e48]
lea eax, [eax + ecx + 0x47c2]
cmp dword [ebp - 0xc24], eax
jg 0x10041947
mov dword [ebp - 0xc2c], 1
jmp 0x1004194e
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0xc2c]
jg 0x10041968
mov dword [ebp - 0xc34], 1
jmp 0x1004196f
and dword [ebp - 0xc34], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e48]
cmp dword [ebp - 0xc34], eax
je 0x10041990
mov dword [ebp - 0xc3c], 1
jmp 0x10041997
and dword [ebp - 0xc3c], 0
cmp dword [ebp - 0xc3c], 0x6e52d8cb
jg 0x100419af
mov dword [ebp - 0xc44], 1
jmp 0x100419b6
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0x1f8], eax
and dword [ebp - 0x230], 0
jmp 0x100419d8
cmp dword [ebp - 0xf14], 0x4571
jge 0x10043e0e
push dword [ebp - 0x1958]
call fcn.10077843
pop ecx
cmp dword [ebp + 0x10], 0
jne 0x10044086
cmp dword [ebp - 0x238], 0xffffffff
je 0x10044086
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x260], 0x619a80bf
push 2
lea ecx, [ebp - 0x147c]
call fcn.10022b61
mov dword [ebp - 4], 0x38
mov dword [ebp - 0xf64], 0xf27142b6
mov dword [ebp - 0x189c], 2
mov dword [ebp - 0x20bc], 0xfff7
mov dword [ebp - 0x680], 0
jmp 0x10043e84
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x10043ea6
push dword [ebp - 0x680]
lea ecx, [ebp - 0x147c]
call fcn.10022bff
mov dword [eax], 0x1362
jmp 0x10043e77
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x2b8], eax
jne 0x10043ec0
mov dword [ebp - 0xf34], 1
jmp 0x10043ec7
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x20c8], eax
cmp dword [ebp - 0x260], 0
jne 0x10043f45
cmp dword [ebp - 0x260], 0xe028
jg 0x10043efa
mov eax, 0x3cc1
test eax, eax
jne 0x10043efa
and dword [ebp - 0xf1c], 0
jmp 0x10043f04
mov dword [ebp - 0xf1c], 1
push 0
lea ecx, [ebp - 0x147c]
call fcn.10022bff
mov ecx, dword [ebp - 0xf1c]
cmp ecx, dword [eax]
jge 0x10043f27
mov dword [ebp - 0xf24], 1
jmp 0x10043f2e
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0xf24], eax
jle 0x10043f45
and dword [ebp - 0xf2c], 0
jmp 0x10043f4f
mov dword [ebp - 0xf2c], 1
imul eax, dword [ebp - 0xf2c], 0x43af
cmp dword [ebp - 0xf34], eax
je 0x10043f6d
mov dword [ebp - 0xf3c], 1
jmp 0x10043f74
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0xf3c], eax
je 0x10043f8e
mov dword [ebp - 0xf44], 1
jmp 0x10043f95
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 0xf44]
sub eax, 0xc017
mov dword [ebp - 0x2b8], eax
mov esi, dword [ebp - 0x2b8]
sub esi, 0x5bb00289
push 0
lea ecx, [ebp - 0x147c]
call fcn.10022bff
imul esi, dword [eax]
imul eax, esi, 0xee3f
cmp eax, 0xfff6
jae 0x10043fdb
mov dword [ebp - 0xf4c], 1
jmp 0x10043fe2
and dword [ebp - 0xf4c], 0
push 1
lea ecx, [ebp - 0x147c]
call fcn.10022bff
mov ecx, dword [ebp - 0xf4c]
add ecx, dword [eax]
je 0x10044017
push 0
lea ecx, [ebp - 0x147c]
call fcn.10022bff
cmp dword [eax], 0
je 0x10044017
mov dword [ebp - 0xf54], 1
jmp 0x1004401e
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0xf54], eax
jl 0x10044038
mov dword [ebp - 0xf5c], 1
jmp 0x1004403f
and dword [ebp - 0xf5c], 0
mov eax, dword [ebp - 0xf5c]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x189c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x147c]
call fcn.10022be3
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x240]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x238]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x8c], ax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0xf74], 1
mov dword [ebp - 0x1494], 0x4b2e809b
mov dword [ebp - 0xf8c], 0xfffffffb
mov dword [ebp - 0x149c], 0x6ba8dad4
mov dword [ebp - 0xf6c], 0x18e1
mov dword [ebp - 0x1960], 0x1000b498
cmp dword [ebp - 0xf6c], 0x1a83
jle 0x1004414c
and dword [ebp - 0x688], 0
jmp 0x100440eb
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 0x27e3
jge 0x1004414c
and dword [ebp - 0x690], 0
jmp 0x1004410d
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x4c35
jge 0x1004414a
mov eax, dword [ebp - 0x688]
and eax, dword [ebp - 0x690]
cdq
mov dword [ebp - 0x18bc], eax
mov dword [ebp - 0x18b8], edx
push dword [ebp - 0x18b8]
push dword [ebp - 0x18bc]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10044100
jmp 0x100440de
cmp dword [ebp - 0xf6c], 0x178b
jge 0x10044168
mov edx, dword [ebp - 0x1960]
mov ecx, 0x10092b78
call fcn.10025597
mov dword [ebp - 0x698], 0
jmp 0x10044181
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 3
jge 0x1004419d
mov eax, dword [ebp - 0x698]
mov dword [ebp + eax*4 - 0x136c], 5
jmp 0x10044174
mov dword [ebp - 0x58], 0
jmp 0x100441ad
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x1004440e
mov dword [ebp - 0x87c], 7
mov dword [ebp - 0xfc4], 0x80335900
mov dword [ebp - 0xfa4], 1
mov dword [ebp - 0x6a0], 0
jmp 0x100441ee
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 2
jge 0x1004420a
mov eax, dword [ebp - 0x6a0]
mov dword [ebp + eax*4 - 0x1ff8], 0x4eb0a117
jmp 0x100441e1
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x136c], ecx
jle 0x10044225
mov dword [ebp - 0xfb4], 1
jmp 0x1004422c
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x136c]
mov dword [ebp - 0xf74], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x136c]
cmp dword [ebp - 0xf74], eax
je 0x1004425a
mov dword [ebp - 0x1490], 1
jmp 0x10044261
and dword [ebp - 0x1490], 0
mov eax, 0xe5741311
test eax, eax
je 0x10044275
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x136c], 0
mov dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x87c], eax
jl 0x10044296
mov dword [ebp - 0xf7c], 1
jmp 0x1004429d
and dword [ebp - 0xf7c], 0
cmp dword [ebp - 0xf7c], 0xc57f
jg 0x100442b5
mov dword [ebp - 0xf84], 1
jmp 0x100442bc
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0xf84]
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x20d0], eax
mov eax, dword [ebp - 0xfc4]
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0xf8c]
mov dword [ebp - 0x20d8], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x136c], 0x6b51f0ef
jg 0x10044308
mov dword [ebp - 0xf94], 1
jmp 0x1004430f
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0xf94]
add eax, 0xe3d4752e
mov dword [ebp - 0xf9c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf9c]
mov dword [ebp + eax - 0x1ff8], ecx
mov eax, dword [ebp - 0xf9c]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0xfa4]
mov dword [ebp - 0x20e0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x136c]
mov dword [ebp - 0x20e8], eax
mov eax, 0xecdc0f1f
cmp eax, 0xffffffff
jbe 0x10044374
mov dword [ebp - 0xfac], 1
jmp 0x1004437b
and dword [ebp - 0xfac], 0
cmp dword [ebp - 0xfac], 7
jne 0x10044390
mov dword [ebp - 0xfbc], 1
jmp 0x10044397
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0xfb4]
imul eax, dword [ebp - 0xfbc]
test eax, eax
je 0x100443bd
cmp dword [ebp - 0xfc4], 0
je 0x100443bd
mov dword [ebp - 0xfcc], 1
jmp 0x100443c4
and dword [ebp - 0xfcc], 0
cmp dword [ebp - 0xfcc], 0x7a0d7c8a
jl 0x100443dc
mov dword [ebp - 0xfd4], 1
jmp 0x100443e3
and dword [ebp - 0xfd4], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x136c]
mov ecx, dword [ebp - 0xfd4]
lea eax, [ecx + eax - 1]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x136c]
mov dword [ebp - 0x149c], eax
jmp 0x100441a6
movzx eax, word [ebp - 0x8c]
cmp eax, 0xffff
je 0x10046cef
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x240]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x8c]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0xff4], 3
mov dword [ebp - 0x14a4], 1
mov dword [ebp - 0x20f0], 0xd3c891c5
mov dword [ebp - 0x20f8], 0xffffffff
mov dword [ebp - 0x1cfc], 0x1e1c5a3d
mov dword [ebp - 0x1cf8], 0x1e1c5a3d
mov dword [ebp - 0x1cf4], 0x1e1c5a3d
mov dword [ebp - 0x1cf0], 0x1e1c5a3d
lea ecx, [ebp - 0x8e5]
call fcn.10022c0e
push eax
lea eax, [ebp - 0x1cec]
push eax
lea eax, [ebp - 0x1cfc]
push eax
lea ecx, [ebp - 0x22d8]
call fcn.10022c11
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1434]
call fcn.10022bbd
mov dword [ebp - 4], 0x39
mov dword [ebp - 0x884], 0xffff
push 4
lea ecx, [ebp - 0x1d78]
call fcn.10022b61
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x24], 0
jmp 0x100444f6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1004450c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2230], 1
jmp 0x100444ef
mov dword [ebp - 0x24], 0
jmp 0x1004451c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10044532
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1c90], 0x10ec3203
jmp 0x10044515
mov dword [ebp - 0x24], 0
jmp 0x10044542
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10044558
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1e68], 0x6b43d271
jmp 0x1004453b
mov dword [ebp - 0x24], 0
jmp 0x10044568
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10044581
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1d78]
call fcn.10022bff
or dword [eax], 0xffffffff
jmp 0x10044561
mov eax, dword [ebp - 0x14a4]
mov dword [ebp - 0x2100], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c90], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e68]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x1e68]
cmp eax, 0xd38c
jg 0x100445cc
mov dword [ebp - 0x14ac], 1
jmp 0x100445d3
and dword [ebp - 0x14ac], 0
push 2
lea ecx, [ebp - 0x1434]
call fcn.10022bff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2230], 0
jne 0x1004460a
push 1
lea ecx, [ebp - 0x1434]
call fcn.10022bff
cmp dword [eax], 0
jne 0x1004460a
and dword [ebp - 0xfdc], 0
jmp 0x10044614
mov dword [ebp - 0xfdc], 1
mov eax, dword [ebp - 0x884]
imul eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x14b4], eax
push 3
lea ecx, [ebp - 0x1434]
call fcn.10022bff
mov eax, dword [eax]
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x14b4]
cmp eax, dword [ebp - 0x14bc]
jle 0x10044663
mov dword [ebp - 0xfe4], 1
jmp 0x1004466a
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0xff4]
cmp dword [ebp - 0xfe4], eax
jg 0x100448e9
mov dword [ebp - 0x6c0], 0x79d62bf
push 4
lea ecx, [ebp - 0x1df0]
call fcn.10022b61
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0xfec], 0x61ff
mov dword [ebp - 0x14cc], 0x1000b4f0
cmp dword [ebp - 0xfec], 0x62aa
jle 0x10044767
and dword [ebp - 0x6a8], 0
jmp 0x100446d1
cmp dword [ebp - 0x6a8], 0x88f
jge 0x1004475b
mov dword [ebp - 0x6b8], 0
jmp 0x10044780
cmp dword [ebp - 0x6b8], 4
jge 0x100447a2
mov dword [ebp - 0x14dc], 0xfffffffc
mov dword [ebp - 0x14e4], 0xb22489af
mov eax, dword [ebp - 0x14dc]
neg eax
mov dword [ebp - 0x14e4], eax
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x1e68]
push 1
lea ecx, [ebp - 0x1434]
call fcn.10022bff
mov dword [eax], esi
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x1d78]
call fcn.10022be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1434]
call fcn.10022be3
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [ebp - 0x240]
add ecx, dword [eax]
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x26c], 0x619a80bf
push 2
lea ecx, [ebp - 0x1410]
call fcn.10022b61
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x106c], 0xf27142b6
mov dword [ebp - 0x14f4], 2
mov dword [ebp - 0x2108], 0xfff7
mov dword [ebp - 0x6c8], 0
jmp 0x100449b8
cmp dword [ebp - 0x6c8], 2
jge 0x100449da
push dword [ebp - 0x6c8]
lea ecx, [ebp - 0x1410]
call fcn.10022bff
mov dword [eax], 0x1362
jmp 0x100449ab
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x264], eax
jne 0x100449f4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret