Function at 0x10040958
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bf80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e8
push esi
push edi
mov dword [ebp - 0x3c], 0x53b26bdd
mov dword [ebp - 0x464], 0xf5ecce35
mov dword [ebp - 0x3c], 0
jmp 0x10040999
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffa
jg 0x10040bc2
mov dword [ebp - 0xd4], 0xb999fb0
mov dword [ebp - 0x3c0], 0xa2c39d5b
push 1
lea ecx, [ebp - 0x5e8]
call fcn.1000bc50
and dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
jmp 0x100409d8
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100409ee
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x6d8], 0xfffffffb
jmp 0x100409d1
mov dword [ebp - 0x58], 0
jmp 0x100409fe
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x10040a17
push dword [ebp - 0x58]
lea ecx, [ebp - 0x5e8]
call fcn.1000bcce
or dword [eax], 0xffffffff
jmp 0x100409f7
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x304], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax - 0x6d8], ecx
cmp dword [ebp - 0x304], 0x307a329f
jl 0x10040a4a
mov dword [ebp - 0x3b0], 1
jmp 0x10040a51
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0x24891023
jl 0x10040a72
cmp dword [ebp - 0xd4], 0
je 0x10040a72
mov dword [ebp - 0x1e0], 1
jmp 0x10040a79
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x3c]
cmp eax, 1
jbe 0x10040a93
mov dword [ebp - 0x3b8], 1
jmp 0x10040a9a
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3b8]
jne 0x10040ab4
mov dword [ebp - 0x1e8], 1
jmp 0x10040abb
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3c0], eax
jle 0x10040ae4
mov dword [ebp - 0x1f0], 1
jmp 0x10040aeb
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1f0], eax
jge 0x10040b05
mov dword [ebp - 0x3c8], 1
jmp 0x10040b0c
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3c8], eax
jne 0x10040b26
mov dword [ebp - 0x1f8], 1
jmp 0x10040b2d
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1f8], eax
je 0x10040b44
mov dword [ebp - 0x17c], 1
jmp 0x10040b4b
and dword [ebp - 0x17c], 0
push 0
lea ecx, [ebp - 0x5e8]
call fcn.1000bcce
mov ecx, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
sub eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], eax
jl 0x10040b80
mov dword [ebp - 0x3d0], 1
jmp 0x10040b87
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x464], eax
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x10040bae
push 0xe1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e8]
call fcn.1000bcb2
jmp 0x10040992
mov dword [ebp - 0x53c], 0x175f
cmp dword [ebp - 0x53c], 0x1263
jge 0x100410a1
call fcn.10052cca
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10009ba8
push 0x10009bac
call fcn.100535aa
add esp, 0xc
call fcn.10052cca
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10009bb4
push 0x10009bb8
call fcn.100535aa
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100099fc
call fcn.10050bab
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x200]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
mov dword [0x1150b6b4], eax
and dword [ebp - 0x7c], 0
jmp 0x10040c5d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [0x1150b6b4]
inc eax
cmp dword [ebp - 0x7c], eax
jge 0x10040cc8
and dword [ebp - 0x544], 0
lea eax, [ebp - 0x544]
push eax
imul eax, dword [ebp - 0x7c], 0x44
mov ecx, dword [0x1150b6b4]
lea edx, [eax + ecx*4 + 0x11a14e54]
imul ecx, dword [ebp - 0x7c], 0x44
add ecx, 0x11a14e50
call fcn.1002f9b8
pop ecx
and dword [ebp - 0x52c], 0
lea eax, [ebp - 0x52c]
push eax
imul eax, dword [ebp - 0x7c], 0x44
mov ecx, dword [0x1150b6b4]
lea edx, [eax + ecx*4 + 0x11a149cc]
imul ecx, dword [ebp - 0x7c], 0x44
add ecx, 0x11a149c8
call fcn.1002f9b8
pop ecx
jmp 0x10040c56
mov eax, dword [0x1150b6b4]
inc eax
push eax
mov ecx, 0x11a16688
call fcn.1002e8ef
and dword [ebp - 0xe8], 0
jmp 0x10040cef
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x10]
jge 0x10040d61
push 0x44
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe8]
mov dword [eax + ecx*4 + 0x11a14e54], 1
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0x534], eax
lea eax, [ebp - 0x534]
push eax
push 0
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
and dword [ebp - 0x484], 0
lea eax, [ebp - 0x484]
push eax
mov eax, dword [ebp - 0xe8]
inc eax
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
jmp 0x10040ce2
and dword [ebp - 0x18], 0
jmp 0x10040d6e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jge 0x10040fb8
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x478]
push eax
push 0x10009ae0
call fcn.10050bab
add esp, 0xc
and dword [ebp - 0x1bc], 0
jmp 0x10040dab
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x478]
jge 0x10040e42
lea eax, [ebp - 0x84]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
imul eax, dword [ebp - 0x84], 0x44
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + ecx + 1]
mov dword [eax + ecx*4 + 0x11a14e50], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x4f8]
push eax
push dword [ebp - 0x84]
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
jmp 0x10040d9e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
imul eax, eax, 0x44
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + ecx + 1]
add ecx, dword [ebp - 0x18]
mov dword [eax + ecx*4 + 0x11a14e50], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x480]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x538], eax
lea eax, [ebp - 0x538]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x18]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
and dword [ebp - 0x184], 0
jmp 0x10040ee9
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x488]
jge 0x10040fb3
lea eax, [ebp - 0x84]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x18]
imul eax, eax, 0x44
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + ecx*2]
add ecx, dword [ebp - 0x84]
mov dword [eax + ecx*4 + 0x11a14e50], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax*2]
add eax, dword [ebp - 0x84]
mov dword [ebp - 0x500], eax
lea eax, [ebp - 0x500]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x18]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x490], eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax*2]
add eax, dword [ebp - 0x84]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
jmp 0x10040edc
jmp 0x10040d67
and dword [ebp - 0xe0], 0
jmp 0x10040fce
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x200]
jge 0x1004106d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
imul eax, eax, 0x44
mov ecx, dword [0x1150b6b4]
mov dword [eax + ecx*4 + 0x11a14e50], 1
push 0x1150b6b4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
push eax
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x568], eax
lea eax, [ebp - 0x568]
push eax
push dword [0x1150b6b4]
mov ecx, 0x11a16688
call fcn.1002e83d
mov ecx, eax
call fcn.1002e3cd
jmp 0x10040fc1
and dword [ebp - 0x1ac], 0
call fcn.10040726
movzx eax, al
test eax, eax
je 0x1004108f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
jmp 0x10041074
push dword [ebp - 0x1ac]
push 0x10009ae8
call fcn.10050dc6
pop ecx
pop ecx
mov dword [ebp - 0x38], 0x53b26bdd
mov dword [ebp - 0x498], 0xf5ecce35
mov dword [ebp - 0x38], 0
jmp 0x100410c2
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffffa
jg 0x100412f4
mov dword [ebp - 0xf0], 0xb999fb0
mov dword [ebp - 0x218], 0xa2c39d5b
push 1
lea ecx, [ebp - 0x5f4]
call fcn.1000bc50
mov dword [ebp - 4], 1
mov dword [ebp - 0x48], 0
jmp 0x10041104
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1004111a
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x6e4], 0xfffffffb
jmp 0x100410fd
mov dword [ebp - 0x48], 0
jmp 0x1004112a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10041143
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5f4]
call fcn.1000bcce
or dword [eax], 0xffffffff
jmp 0x10041123
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3d8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0x6e4], ecx
cmp dword [ebp - 0x3d8], 0x307a329f
jl 0x10041176
mov dword [ebp - 0x208], 1
jmp 0x1004117d
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 0x24891023
jl 0x1004119e
cmp dword [ebp - 0xf0], 0
je 0x1004119e
mov dword [ebp - 0x3e0], 1
jmp 0x100411a5
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
sub eax, dword [ebp - 0x38]
cmp eax, 1
jbe 0x100411bf
mov dword [ebp - 0x210], 1
jmp 0x100411c6
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x210]
jne 0x100411e0
mov dword [ebp - 0x3e8], 1
jmp 0x100411e7
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x218], eax
jle 0x10041210
mov dword [ebp - 0x3f0], 1
jmp 0x10041217
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3f0], eax
jge 0x10041231
mov dword [ebp - 0x220], 1
jmp 0x10041238
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x220], eax
jne 0x10041252
mov dword [ebp - 0x3f8], 1
jmp 0x10041259
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3f8], eax
je 0x10041270
mov dword [ebp - 0x18c], 1
jmp 0x10041277
and dword [ebp - 0x18c], 0
push 0
lea ecx, [ebp - 0x5f4]
call fcn.1000bcce
mov ecx, dword [ebp - 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xf0], eax
jl 0x100412ac
mov dword [ebp - 0x228], 1
jmp 0x100412b3
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x498], eax
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100412e0
push 0xe1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f4]
call fcn.1000bcb2
jmp 0x100410bb
mov dword [ebp - 0x8c], 0xd5e48d32
mov dword [ebp - 0x60], 0x91cb4e76
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x120], 0
jmp 0x10041328
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x10041344
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x508], 0x66c1932e
jmp 0x1004131b
mov dword [ebp - 0x8c], 0xffffffea
jmp 0x1004135d
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffe9
jg 0x100414a1
mov dword [ebp - 0xd8], 1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x624], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0x8c]
cmp eax, 1
jg 0x100413b1
mov dword [ebp - 0x400], 1
jmp 0x100413b8
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0xd8]
jl 0x100413d8
mov dword [ebp - 0x230], 1
jmp 0x100413df
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
neg eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x8c]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10041440
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x10041418
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1004143e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1004149c
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x60], 0
jmp 0x1004145c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x2e
jg 0x1004149c
mov dword [ebp - 0x1cc], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp + eax - 0x508], ecx
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004149a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x10041455
jmp 0x10041350
mov dword [ebp - 0x60], 0x16
jmp 0x100414b1
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x26
jge 0x100414e8
mov dword [ebp - 0x4a0], 1
cmp dword [ebp - 0x4a0], 0
je 0x100414cc
jmp 0x100414e8
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x100414e6
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x100414aa
mov dword [ebp - 0x20], 0x42c7
mov dword [ebp - 0x448], 0xf8067e3
mov dword [ebp - 0x194], 4
mov dword [ebp - 0x1b4], 0x441791e6
push 3
lea ecx, [ebp - 0x600]
call fcn.1000bc50
mov dword [ebp - 4], 2
mov dword [ebp - 0x274], 0xbb1300ca
mov dword [ebp - 0x4a8], 0x2967684a
mov dword [ebp - 0x540], 0x183b
cmp dword [ebp - 0x540], 0x135f
jge 0x100415ff
and dword [ebp - 0x104], 0
lea eax, [ebp - 0x104]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
and dword [ebp - 0x128], 0
mov dword [ebp - 0x148], 2
jmp 0x10041589
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x104]
jge 0x100415b8
push dword [ebp - 0x148]
push dword [ebp - 0x104]
call fcn.1004092a
pop ecx
pop ecx
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x128], eax
jmp 0x1004157c
mov eax, dword [ebp - 0x104]
dec eax
dec eax
push eax
push dword [ebp - 0x128]
call fcn.100408fc
pop ecx
pop ecx
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x104]
dec eax
dec eax
cdq
idiv dword [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x128]
cdq
idiv dword [ebp - 0x408]
push eax
push 0x1000a0d8
call fcn.10050dc6
add esp, 0xc
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x168], 0
jmp 0x10041622
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x10041644
push dword [ebp - 0x168]
lea ecx, [ebp - 0x600]
call fcn.1000bcce
mov dword [eax], 5
jmp 0x10041615
mov dword [ebp - 0x20], 0xfffffff8
cmp dword [ebp - 0x20], 0xfffffffc
jb 0x1004165d
mov dword [ebp - 0x238], 1
jmp 0x10041664
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x478c9dff
jne 0x1004167c
mov dword [ebp - 0x410], 1
jmp 0x10041683
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfff7
ja 0x100416a7
mov dword [ebp - 0x240], 1
jmp 0x100416ae
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x240]
cmp dword [ebp - 0x20], eax
jne 0x100416c8
mov dword [ebp - 0x420], 1
jmp 0x100416cf
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x420], eax
jl 0x100416e6
mov dword [ebp - 0x248], 1
jmp 0x100416ed
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x248], eax
jge 0x10041704
mov dword [ebp - 0x428], 1
jmp 0x1004170b
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x428], eax
jg 0x10041722
mov dword [ebp - 0x250], 1
jmp 0x10041729
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x430], eax
push 2
lea ecx, [ebp - 0x600]
call fcn.1000bcce
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
cmp dword [ebp - 0x430], 0
jne 0x10041771
cmp dword [ebp - 0x194], 0
jne 0x10041771
and dword [ebp - 0x258], 0
jmp 0x1004177b
mov dword [ebp - 0x258], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x258], eax
jle 0x10041792
mov dword [ebp - 0x438], 1
jmp 0x10041799
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
sub eax, dword [ebp - 0x20]
jne 0x100417b9
cmp dword [ebp - 0x1b4], 0
je 0x100417b9
mov dword [ebp - 0x260], 1
jmp 0x100417c0
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0xffffffff
jb 0x100417d5
mov dword [ebp - 0x440], 1
jmp 0x100417dc
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x440], eax
jle 0x100417f3
mov dword [ebp - 0x268], 1
jmp 0x100417fa
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x268]
dec eax
imul eax, eax, 0x7279
cmp dword [ebp - 0x448], eax
jle 0x10041824
mov dword [ebp - 0x43c], 1
jmp 0x1004182b
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
add eax, 0x2e8326ad
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x4a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.1000bcb2
mov dword [ebp - 0x94], 0xd5e48d32
mov dword [ebp - 0x5c], 0x91cb4e76
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x1004188b
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x100418a7
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x4c0], 0x66c1932e
jmp 0x1004187e
mov dword [ebp - 0x94], 0xffffffea
jmp 0x100418c0
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffe9
jg 0x1004200d
mov dword [ebp - 0xe4], 1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x644], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0x94]
cmp eax, 1
jg 0x10041914
mov dword [ebp - 0x364], 1
jmp 0x1004191b
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x364]
cmp eax, dword [ebp - 0xe4]
jl 0x1004193b
mov dword [ebp - 0x27c], 1
jmp 0x10041942
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
neg eax
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x94]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x100419ac
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10041981
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x100419a7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x10042008
mov dword [ebp - 0x510], 0x20d8
cmp dword [ebp - 0x510], 0x1362
jge 0x10041ab2
and dword [ebp - 0x4b0], 0
and dword [ebp - 0xf8], 0
and dword [ebp - 0x3dc], 0
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x4b0]
push eax
push 0x10009dac
call fcn.10050bab
add esp, 0x10
mov eax, dword [ebp - 0xf8]
dec eax
imul eax, dword [ebp - 0xf8]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x100099ec
call fcn.10050dc6
pop ecx
pop ecx
mov dword [ebp - 0xdc], 1
jmp 0x10041a36
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xf8]
jge 0x10041ab2
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xfc], eax
jmp 0x10041a60
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xf8]
jg 0x10041aad
cmp dword [ebp - 0x3dc], 0
jne 0x10041a92
push dword [ebp - 0xfc]
push dword [ebp - 0xdc]
push 0x10009b9c
call fcn.10050dc6
add esp, 0xc
jmp 0x10041aab
push dword [ebp - 0xdc]
push dword [ebp - 0xfc]
push 0x1000a0e4
call fcn.10050dc6
add esp, 0xc
jmp 0x10041a53
jmp 0x10041a29
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x570], 0x2274
cmp dword [ebp - 0x570], 0x64b
jge 0x10041cf3
push 0x10009ba8
push 0x1000a0ec
call fcn.10053bc3
pop ecx
pop ecx
mov dword [ebp - 0x178], eax
and dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push eax
push 0x100099e8
push dword [ebp - 0x178]
call fcn.100539e2
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp - 0x64]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004c24e
pop ecx
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x180], eax
xor ecx, ecx
mov eax, dword [ebp - 0x64]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004c24e
pop ecx
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x284], eax
and dword [ebp - 0x1c4], 0
and dword [ebp - 0x174], 0
and dword [ebp - 0x19c], 0
and dword [ebp - 0x100], 0
jmp 0x10041b89
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x64]
jge 0x10041c0b
lea eax, [ebp - 0x19c]
push eax
push 0x100099e8
push dword [ebp - 0x178]
call fcn.100539e2
add esp, 0xc
cmp dword [ebp - 0x19c], 0
jle 0x10041bc6
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
jmp 0x10041bdc
cmp dword [ebp - 0x19c], 0
jge 0x10041bdc
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x1c4]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x284]
mov edx, dword [ebp - 0x174]
mov dword [ecx + eax*4], edx
jmp 0x10041b7c
push dword [ebp - 0x178]
call fcn.10053d56
pop ecx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x188], eax
and dword [ebp - 0x9c], 0
jmp 0x10041c36
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x64]
dec eax
cmp dword [ebp - 0x9c], eax
jge 0x10041cb7
mov eax, dword [ebp - 0x9c]
inc eax
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x284]
sub eax, dword [edx + ecx*4]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x64]
dec eax
sub eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x180]
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0x180]
mov ecx, dword [edx + ecx*4 - 4]
sub ecx, dword [edi + esi*4]
sub eax, ecx
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x36c]
add eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x188]
jge 0x10041cb2
mov eax, dword [ebp - 0x36c]
add eax, dword [ebp - 0x28c]
mov dword [ebp - 0x188], eax
jmp 0x10041c29
push 0x10009bb4
push 0x1000a0f8
call fcn.10053bc3
pop ecx
pop ecx
mov dword [ebp - 0x418], eax
push dword [ebp - 0x188]
push 0x100099ec
push dword [ebp - 0x418]
call fcn.10053bd8
add esp, 0xc
push dword [ebp - 0x418]
call fcn.10053d56
pop ecx
mov dword [ebp - 0x5c], 0
jmp 0x10041d03
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x2e
jg 0x10042008
mov dword [ebp - 0x190], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x190]
mov dword [ebp + eax - 0x4c0], ecx
mov dword [ebp - 0x548], 0x1cbb
cmp dword [ebp - 0x548], 0xbb8
jge 0x10041fe2
lea eax, [ebp - 0x198]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x4c8], 0
je 0x10041fe2
lea eax, [ebp - 0x50]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
push dword [ebp - 0x50]
lea ecx, [ebp - 0x594]
call fcn.1000bc50
mov dword [ebp - 4], 3
and dword [ebp - 0x150], 0
jmp 0x10041db8
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x50]
jge 0x10041de3
push dword [ebp - 0x150]
lea ecx, [ebp - 0x594]
call fcn.1000bcce
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
jmp 0x10041dab
and dword [ebp - 0x520], 0
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x588]
call fcn.1002e3ab
mov byte [ebp - 4], 4
and dword [ebp - 0x4d0], 0
lea eax, [ebp - 0x4d0]
push eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x57c]
call fcn.1002e3ab
mov byte [ebp - 4], 5
and dword [ebp - 0x68], 0
jmp 0x10041e30
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x50]
jge 0x10041e93
cmp dword [ebp - 0x68], 0
je 0x10041e53
mov eax, dword [ebp - 0x68]
dec eax
push eax
lea ecx, [ebp - 0x588]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10041e74
push dword [ebp - 0x68]
lea ecx, [ebp - 0x594]
call fcn.1000bcce
mov eax, dword [eax]
cmp eax, dword [ebp - 0x68]
jl 0x10041e74
mov dword [ebp - 0x294], 1
jmp 0x10041e7b
and dword [ebp - 0x294], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x588]
call fcn.1000bcce
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
jmp 0x10041e29
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x6c], eax
jmp 0x10041ea3
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10041f0b
mov eax, dword [ebp - 0x50]
dec eax
cmp dword [ebp - 0x6c], eax
je 0x10041ec7
mov eax, dword [ebp - 0x6c]
inc eax
push eax
lea ecx, [ebp - 0x57c]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10041eec
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x594]
call fcn.1000bcce
mov ecx, dword [ebp - 0x50]
dec ecx
sub ecx, dword [ebp - 0x6c]
cmp dword [eax], ecx
jl 0x10041eec
mov dword [ebp - 0x374], 1
jmp 0x10041ef3
and dword [ebp - 0x374], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x57c]
call fcn.1000bcce
mov ecx, dword [ebp - 0x374]
mov dword [eax], ecx
jmp 0x10041e9c
mov byte [ebp - 0x11], 0
and dword [ebp - 0x108], 0
jmp 0x10041f25
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x50]
jge 0x10041f86
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x10041f86
push dword [ebp - 0x108]
lea ecx, [ebp - 0x588]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10041f70
push dword [ebp - 0x108]
lea ecx, [ebp - 0x57c]
call fcn.1000bcce
cmp dword [eax], 0
je 0x10041f70
mov dword [ebp - 0x29c], 1
jmp 0x10041f77
and dword [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x11]
or eax, dword [ebp - 0x29c]
mov byte [ebp - 0x11], al
jmp 0x10041f18
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10041f9a
mov dword [ebp - 0x3e4], 0x10009ea0
jmp 0x10041fa4
mov dword [ebp - 0x3e4], 0x10009e9c
push dword [ebp - 0x3e4]
call fcn.10050f86
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x57c]
call fcn.1000c2c6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x588]
call fcn.1000c2c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x594]
call fcn.1000c2c6
jmp 0x10041d57
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10042003
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x10041cfc
jmp 0x100418b3
mov dword [ebp - 0x5c], 0x16
jmp 0x1004201d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x26
jge 0x10042054
mov dword [ebp - 0x56c], 1
cmp dword [ebp - 0x56c], 0
je 0x10042038
jmp 0x10042054
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10042052
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x10042016
mov dword [ebp - 0x64c], 0xaf43
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10042080
push 0x89b
push 0x163f
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1004209c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x28], 0x42c7
mov dword [ebp - 0x394], 0xf8067e3
mov dword [ebp - 0x1a0], 4
mov dword [ebp - 0x1a8], 0x441791e6
push 3
lea ecx, [ebp - 0x60c]
call fcn.1000bc50
mov dword [ebp - 4], 6
mov dword [ebp - 0x3f4], 0xbb1300ca
mov dword [ebp - 0x4d8], 0x2967684a
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x138], 0
jmp 0x1004210c
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x1004212e
push dword [ebp - 0x138]
lea ecx, [ebp - 0x60c]
call fcn.1000bcce
mov dword [eax], 5
jmp 0x100420ff
mov dword [ebp - 0x28], 0xfffffff8
cmp dword [ebp - 0x28], 0xfffffffc
jb 0x10042147
mov dword [ebp - 0x2a4], 1
jmp 0x1004214e
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0x478c9dff
jne 0x10042166
mov dword [ebp - 0x37c], 1
jmp 0x1004216d
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfff7
ja 0x10042191
mov dword [ebp - 0x2ac], 1
jmp 0x10042198
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x28], eax
jne 0x100421b2
mov dword [ebp - 0x41c], 1
jmp 0x100421b9
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x41c], eax
jl 0x100421d0
mov dword [ebp - 0x2b4], 1
jmp 0x100421d7
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2b4], eax
jge 0x100421ee
mov dword [ebp - 0x384], 1
jmp 0x100421f5
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x384], eax
jg 0x1004220c
mov dword [ebp - 0x2bc], 1
jmp 0x10042213
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x3ec], eax
push 2
lea ecx, [ebp - 0x60c]
call fcn.1000bcce
mov ecx, dword [ebp - 0x3ec]
mov dword [eax], ecx
cmp dword [ebp - 0x3ec], 0
jne 0x1004225b
cmp dword [ebp - 0x1a0], 0
jne 0x1004225b
and dword [ebp - 0x2c4], 0
jmp 0x10042265
mov dword [ebp - 0x2c4], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2c4], eax
jle 0x1004227c
mov dword [ebp - 0x38c], 1
jmp 0x10042283
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
sub eax, dword [ebp - 0x28]
jne 0x100422a3
cmp dword [ebp - 0x1a8], 0
je 0x100422a3
mov dword [ebp - 0x2cc], 1
jmp 0x100422aa
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0xffffffff
jb 0x100422bf
mov dword [ebp - 0x434], 1
jmp 0x100422c6
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x434], eax
jle 0x100422dd
mov dword [ebp - 0x2d4], 1
jmp 0x100422e4
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x2d4]
dec eax
imul eax, eax, 0x7279
cmp dword [ebp - 0x394], eax
jle 0x1004230e
mov dword [ebp - 0x2dc], 1
jmp 0x10042315
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
add eax, 0x2e8326ad
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x4d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.1000bcb2
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x160], 0
jmp 0x10042364
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x10042380
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x528], 0x45f1dbec
jmp 0x10042357
mov dword [ebp - 0x140], 0xfffffff1
jmp 0x10042399
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffe3
jl 0x100423d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x528], 0xffffffff
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x100423d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x1004238c
mov dword [ebp - 0x65c], 0xaf43
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x10042400
push 0x89b
push 0x163f
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004241c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x158], 0
jmp 0x1004243f
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x1004245b
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x4e0], 0x45f1dbec
jmp 0x10042432
mov dword [ebp - 0x11c], 0xfffffff1
jmp 0x10042474
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffe3
jl 0x100424af
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4e0], 0xffffffff
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x100424ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x10042467
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x31c], 0xfffffff7
mov dword [ebp - 0x1b0], 0x7e4fc228
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x30], 0
push 4
lea ecx, [ebp - 0x460]
call fcn.1000bc50
mov dword [ebp - 4], 7
push 4
lea ecx, [ebp - 0x554]
call fcn.1000bc50
mov byte [ebp - 4], 8
mov dword [ebp - 0xa4], 8
mov dword [ebp - 0x39c], 3
mov dword [ebp - 0x40], 0
jmp 0x10042531
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1004254d
push dword [ebp - 0x40]
lea ecx, [ebp - 0x460]
call fcn.1000bcce
mov dword [eax], 1
jmp 0x1004252a
mov dword [ebp - 0x40], 0
jmp 0x1004255d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x10042579
push dword [ebp - 0x40]
lea ecx, [ebp - 0x554]
call fcn.1000bcce
mov dword [eax], 0x5b1b
jmp 0x10042556
cmp dword [ebp - 0x12c], 0
jne 0x100426ff
push 3
lea ecx, [ebp - 0x554]
call fcn.1000bcce
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx], eax
cmp dword [ebp - 0x12c], 0x2728
jle 0x100425c2
mov dword [ebp - 0x2f4], 1
jmp 0x100425c9
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
dec ecx
mov dword [ebp - 0xa4], ecx
test eax, eax
je 0x100425f2
cmp dword [ebp - 0x30], 0
je 0x100425f2
mov dword [ebp - 0x558], 1
jmp 0x100425f9
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x5d1cb6a7
je 0x10042626
mov eax, 0x4d81
test eax, eax
je 0x10042626
mov dword [ebp - 0x2ec], 1
jmp 0x1004262d
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x2ec], eax
jge 0x10042647
mov dword [ebp - 0x4e8], 1
jmp 0x1004264e
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x424], 0x752b
jl 0x10042666
mov dword [ebp - 0x3a4], 1
jmp 0x1004266d
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x2f4]
cmp eax, dword [ebp - 0x3a4]
jl 0x10042687
mov dword [ebp - 0x2fc], 1
jmp 0x1004268e
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x2fc], eax
jge 0x100426a8
mov dword [ebp - 0x3fc], 1
jmp 0x100426af
and dword [ebp - 0x3fc], 0
push 1
lea ecx, [ebp - 0x460]
call fcn.1000bcce
mov ecx, dword [ebp - 0x3fc]
cmp ecx, dword [eax]
jl 0x100426d2
mov dword [ebp - 0x1d4], 1
jmp 0x100426d9
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1b0]
add eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x1b0]
dec ecx
mov dword [ebp - 0x1b0], ecx
test eax, eax
jne 0x100426ff
and dword [ebp - 0x3ac], 0
jmp 0x10042709
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3ac], eax
jle 0x10042720
mov dword [ebp - 0x30c], 1
jmp 0x10042727
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa4], 0
jmp 0x10042749
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x35
je 0x10042a05
mov dword [ebp - 0x24], 0x50d5
mov dword [ebp - 0x32c], 0xbc3393a3
mov dword [ebp - 0x470], 0x6030033
mov dword [ebp - 0x474], 9
mov dword [ebp - 0x124], 0
jmp 0x10042794
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffed
jle 0x10042811
mov dword [ebp - 0x444], 0xf7cd3e5c
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x30], 3
jmp 0x100427c1
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x100427f6
push dword [ebp - 0x30]
lea ecx, [ebp - 0x460]
call fcn.1000bcce
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x460]
call fcn.1000bcce
mov ecx, dword [esi]
mov dword [eax], ecx
cmp dword [ebp - 0x444], 0
je 0x100427f4
jmp 0x100427f6
jmp 0x100427ba
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x530], eax
jmp 0x10042787
push 1
lea ecx, [ebp - 0x460]
call fcn.1000bcce
mov dword [eax], 0x256f
mov eax, 0x256f
test eax, eax
je 0x10042983
cmp dword [ebp - 0x24], 0
jne 0x10042849
mov eax, 0x42cc3231
test eax, eax
jne 0x10042849
and dword [ebp - 0x42c], 0
jmp 0x10042853
mov dword [ebp - 0x42c], 1
cmp dword [ebp - 0x24], 0
jne 0x10042867
xor eax, eax
inc eax
jne 0x10042867
and dword [ebp - 0x314], 0
jmp 0x10042871
mov dword [ebp - 0x314], 1
cmp dword [ebp - 0x314], 0x140d
jg 0x1004289b
push 3
lea ecx, [ebp - 0x554]
call fcn.1000bcce
cmp dword [eax], 0
je 0x1004289b
mov dword [ebp - 0x3b4], 1
jmp 0x100428a2
and dword [ebp - 0x3b4], 0
cmp dword [ebp - 0x3b4], 0
jne 0x100428af
cmp dword [ebp - 0x24], 0
cmp dword [ebp - 0x31c], 0x5de30ea3
jle 0x100428c7
mov dword [ebp - 0x404], 1
jmp 0x100428ce
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xffffffff
je 0x100428e3
mov dword [ebp - 0x324], 1
jmp 0x100428ea
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x324], eax
jne 0x10042901
mov dword [ebp - 0x3bc], 1
jmp 0x10042908
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x42c], eax
jle 0x1004292e
mov dword [ebp - 0x4f0], 1
jmp 0x10042935
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6cc], eax
xor eax, eax
inc eax
imul eax, eax, 0x17c9
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x24], 0
je 0x10042983
mov dword [ebp - 0x334], 1
jmp 0x1004298a
and dword [ebp - 0x334], 0
push 2
lea ecx, [ebp - 0x554]
call fcn.1000bcce
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [eax]
jge 0x100429ad
mov dword [ebp - 0x3c4], 1
jmp 0x100429b4
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x3c4], eax
jne 0x100429ce
mov dword [ebp - 0x33c], 1
jmp 0x100429d5
and dword [ebp - 0x33c], 0
imul eax, dword [ebp - 0x33c], 7
cmp eax, dword [ebp - 0x24]
jne 0x100429ed
mov dword [ebp - 0x40c], 1
jmp 0x100429f4
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x474], eax
jmp 0x1004273c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x554]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.1000bcb2
movzx eax, byte [0x11a166ac]
test eax, eax
je 0x10042a41
mov esi, 0x1065bbe4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10043d91
mov dword [ebp - 0x288], 9
mov dword [ebp - 0x290], 0x10b999fb
mov dword [ebp - 0x298], 0xfffffffb
mov dword [ebp - 0xac], 0x5f88e10e
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x48c], 0xd69b45c
mov dword [ebp - 0x134], 0
jmp 0x10042a96
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10042ab2
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x5b4], 0x8c7f
jmp 0x10042a89
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5b4], 1
je 0x10042acd
mov dword [ebp - 0x344], 1
jmp 0x10042ad4
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x344], eax
je 0x10042aee
mov dword [ebp - 0x3cc], 1
jmp 0x10042af5
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 0x24891023
jge 0x10042b0d
mov dword [ebp - 0x34c], 1
jmp 0x10042b14
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x34c]
lea eax, [eax + ecx + 0x6c4f32b7]
test eax, eax
jne 0x10042b39
xor eax, eax
inc eax
jne 0x10042b39
and dword [ebp - 0x414], 0
jmp 0x10042b43
mov dword [ebp - 0x414], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x414], eax
jne 0x10042b5d
mov dword [ebp - 0x354], 1
jmp 0x10042b64
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
add eax, 0xfff8
cmp eax, 9
jbe 0x10042b80
mov dword [ebp - 0x3d4], 1
jmp 0x10042b87
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
add eax, 9
cmp eax, dword [ebp - 0xac]
jle 0x10042ba4
mov dword [ebp - 0x35c], 1
jmp 0x10042bab
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0x63090707
jg 0x10042bc3
mov dword [ebp - 0x26c], 1
jmp 0x10042bca
and dword [ebp - 0x26c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b4]
cmp dword [ebp - 0x26c], eax
jl 0x10042bea
mov dword [ebp - 0x270], 1
jmp 0x10042bf1
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x10042c12
mov dword [ebp - 0x280], 1
jmp 0x10042c19
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x280], eax
je 0x10042c33
mov dword [ebp - 0x47c], 1
jmp 0x10042c3a
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x618], eax
mov eax, 0xded1
test eax, eax
je 0x10042c79
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5b4], 0
je 0x10042c79
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5b4], 0
je 0x10042c79
mov dword [ebp - 0x46c], 1
jmp 0x10042c80
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x5b4]
add eax, dword [ebp - 0xac]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x310], 0xfffffff7
mov dword [ebp - 0x1b8], 0x7e4fc228
mov dword [ebp - 0x2b8], 7
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x2c], 0
push 4
lea ecx, [ebp - 0x454]
call fcn.1000bc50
mov dword [ebp - 4], 9
push 4
lea ecx, [ebp - 0x564]
call fcn.1000bc50
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xb4], 8
mov dword [ebp - 0x2a8], 3
mov dword [ebp - 0x44], 0
jmp 0x10042d45
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10042d61
push dword [ebp - 0x44]
lea ecx, [ebp - 0x454]
call fcn.1000bcce
mov dword [eax], 1
jmp 0x10042d3e
mov dword [ebp - 0x44], 0
jmp 0x10042d71
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10042d8d
push dword [ebp - 0x44]
lea ecx, [ebp - 0x564]
call fcn.1000bcce
mov dword [eax], 0x5b1b
jmp 0x10042d6a
cmp dword [ebp - 0x144], 0
jne 0x10042f13
push 3
lea ecx, [ebp - 0x564]
call fcn.1000bcce
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx], eax
cmp dword [ebp - 0x144], 0x2728
jle 0x10042dd6
mov dword [ebp - 0x2c0], 1
jmp 0x10042ddd
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
dec ecx
mov dword [ebp - 0xb4], ecx
test eax, eax
je 0x10042e06
cmp dword [ebp - 0x2c], 0
je 0x10042e06
mov dword [ebp - 0x494], 1
jmp 0x10042e0d
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x5d1cb6a7
je 0x10042e3a
mov eax, 0x4d81
test eax, eax
je 0x10042e3a
mov dword [ebp - 0x2b0], 1
jmp 0x10042e41
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x2b0], eax
jge 0x10042e5b
mov dword [ebp - 0x49c], 1
jmp 0x10042e62
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x2b8], 0x752b
jl 0x10042e7a
mov dword [ebp - 0x2c8], 1
jmp 0x10042e81
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x2c8]
jl 0x10042e9b
mov dword [ebp - 0x2d0], 1
jmp 0x10042ea2
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x2d0], eax
jge 0x10042ebc
mov dword [ebp - 0x2d8], 1
jmp 0x10042ec3
and dword [ebp - 0x2d8], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.1000bcce
mov ecx, dword [ebp - 0x2d8]
cmp ecx, dword [eax]
jl 0x10042ee6
mov dword [ebp - 0x2e0], 1
jmp 0x10042eed
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x1b8]
dec ecx
mov dword [ebp - 0x1b8], ecx
test eax, eax
jne 0x10042f13
and dword [ebp - 0x2e8], 0
jmp 0x10042f1d
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2e8], eax
jle 0x10042f34
mov dword [ebp - 0x2f0], 1
jmp 0x10042f3b
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xb4], 0
jmp 0x10042f5d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x35
je 0x10043219
mov dword [ebp - 0x34], 0x50d5
mov dword [ebp - 0x330], 0xbc3393a3
mov dword [ebp - 0x4b4], 0x6030033
mov dword [ebp - 0x4bc], 9
mov dword [ebp - 0x13c], 0
jmp 0x10042fa8
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffed
jle 0x10043025
mov dword [ebp - 0x2f8], 0xf7cd3e5c
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x2c], 3
jmp 0x10042fd5
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1004300a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000bcce
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000bcce
mov ecx, dword [esi]
mov dword [eax], ecx
cmp dword [ebp - 0x2f8], 0
je 0x10043008
jmp 0x1004300a
jmp 0x10042fce
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2f8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4a4], eax
jmp 0x10042f9b
push 1
lea ecx, [ebp - 0x454]
call fcn.1000bcce
mov dword [eax], 0x256f
mov eax, 0x256f
test eax, eax
je 0x10043197
cmp dword [ebp - 0x34], 0
jne 0x1004305d
mov eax, 0x42cc3231
test eax, eax
jne 0x1004305d
and dword [ebp - 0x338], 0
jmp 0x10043067
mov dword [ebp - 0x338], 1
cmp dword [ebp - 0x34], 0
jne 0x1004307b
xor eax, eax
inc eax
jne 0x1004307b
and dword [ebp - 0x300], 0
jmp 0x10043085
mov dword [ebp - 0x300], 1
cmp dword [ebp - 0x300], 0x140d
jg 0x100430af
push 3
lea ecx, [ebp - 0x564]
call fcn.1000bcce
cmp dword [eax], 0
je 0x100430af
mov dword [ebp - 0x308], 1
jmp 0x100430b6
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0
jne 0x100430c3
cmp dword [ebp - 0x34], 0
cmp dword [ebp - 0x310], 0x5de30ea3
jle 0x100430db
mov dword [ebp - 0x318], 1
jmp 0x100430e2
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0xffffffff
je 0x100430f7
mov dword [ebp - 0x320], 1
jmp 0x100430fe
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x320], eax
jne 0x10043115
mov dword [ebp - 0x328], 1
jmp 0x1004311c
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x338], eax
jle 0x10043142
mov dword [ebp - 0x4ac], 1
jmp 0x10043149
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x628], eax
xor eax, eax
inc eax
imul eax, eax, 0x17c9
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x34], 0
je 0x10043197
mov dword [ebp - 0x340], 1
jmp 0x1004319e
and dword [ebp - 0x340], 0
push 2
lea ecx, [ebp - 0x564]
call fcn.1000bcce
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [eax]
jge 0x100431c1
mov dword [ebp - 0x348], 1
jmp 0x100431c8
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x348], eax
jne 0x100431e2
mov dword [ebp - 0x350], 1
jmp 0x100431e9
and dword [ebp - 0x350], 0
imul eax, dword [ebp - 0x350], 7
cmp eax, dword [ebp - 0x34]
jne 0x10043201
mov dword [ebp - 0x358], 1
jmp 0x10043208
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x4bc], eax
jmp 0x10042f50
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x564]
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.1000bcb2
mov dword [ebp - 0xbc], 0xd5e48d32
mov dword [ebp - 0x4c], 0x91cb4e76
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x14c], 0
jmp 0x1004326b
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x10043287
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x4c4], 0x66c1932e
jmp 0x1004325e
mov dword [ebp - 0xbc], 0xffffffea
jmp 0x100432a0
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffe9
jg 0x100433f0
mov dword [ebp - 0xec], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x638], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0xbc]
cmp eax, 1
jg 0x100432f4
mov dword [ebp - 0x360], 1
jmp 0x100432fb
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0xec]
jl 0x1004331b
mov dword [ebp - 0x368], 1
jmp 0x10043322
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
neg eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xbc]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10043389
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x10043361
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x10043387
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x100433eb
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x4c], 0
jmp 0x100433a5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x2e
jg 0x100433eb
mov dword [ebp - 0x1c0], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + eax - 0x4c4], ecx
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x100433e9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1004339e
jmp 0x10043293
mov dword [ebp - 0x4c], 0x16
jmp 0x10043400
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x26
jge 0x10043431
mov dword [ebp - 0x4cc], 1
cmp dword [ebp - 0x4cc], 0
je 0x1004341b
jmp 0x10043431
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1004342f
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x100433f9
mov dword [ebp - 0x680], 0x1065bbe4
mov dword [ebp - 0x114], 0x824a8c6a
push 4
lea ecx, [ebp - 0x67c]
call fcn.1000bc50
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x640], 0xcb03629a
mov dword [ebp - 0x370], 0x7f8b4dfe
mov dword [ebp - 0x154], 0
jmp 0x10043486
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x100434a5
push dword [ebp - 0x154]
lea ecx, [ebp - 0x67c]
call fcn.1000bcce
and dword [eax], 0
jmp 0x10043479
mov dword [ebp - 0x114], 0
jmp 0x100434be
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffed
jl 0x100434eb
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x100434e9
push 0
push 0
push 0x1ccc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100434b1
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.1000bcb2
mov dword [ebp - 0x6bc], 0x1065bbe8
mov dword [ebp - 0x110], 0xfffffff7
mov dword [ebp - 0x4d4], 3
mov dword [ebp - 0x5dc], 0x420452a2
mov dword [ebp - 0x5d8], 0x420452a2
mov dword [ebp - 0x5d4], 0x420452a2
mov dword [ebp - 0x5d0], 0x420452a2
lea ecx, [ebp - 0x1a1]
call fcn.1000bcdd
push eax
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x5dc]
push eax
lea ecx, [ebp - 0x6f4]
call fcn.1000bce0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x68c]
call fcn.1000bc8c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x4e4], 0xfffffff9
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x100435a7
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x110], eax
jge 0x100435c1
mov dword [ebp - 0x378], 1
jmp 0x100435c8
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x378], eax
jne 0x100435e2
mov dword [ebp - 0x380], 1
jmp 0x100435e9
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4dc], eax
push 2
lea ecx, [ebp - 0x68c]
call fcn.1000bcce
mov ecx, dword [ebp - 0x4dc]
mov dword [eax], ecx
cmp dword [ebp - 0x380], 0x39ec
jge 0x1004362e
mov dword [ebp - 0x388], 1
jmp 0x10043635
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x388], eax
je 0x1004364f
mov dword [ebp - 0x390], 1
jmp 0x10043656
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x4e4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68c]
call fcn.1000bcb2
mov byte [0x11a166ac], 1
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x1065b9b8
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x214], 9
mov dword [ebp - 0x21c], 0x10b999fb
mov dword [ebp - 0x224], 0xfffffffb
mov dword [ebp - 0x70], 0x5f88e10e
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x4fc], 0xd69b45c
mov dword [ebp - 0x15c], 0
jmp 0x100436de
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x100436fa
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x5a4], 0x8c7f
jmp 0x100436d1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5a4], 1
je 0x10043715
mov dword [ebp - 0x398], 1
jmp 0x1004371c
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x398], eax
je 0x10043733
mov dword [ebp - 0x3a0], 1
jmp 0x1004373a
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0x24891023
jge 0x10043752
mov dword [ebp - 0x3a8], 1
jmp 0x10043759
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x3a8]
lea eax, [eax + ecx + 0x6c4f32b7]
test eax, eax
jne 0x1004377b
xor eax, eax
inc eax
jne 0x1004377b
and dword [ebp - 0x1d8], 0
jmp 0x10043785
mov dword [ebp - 0x1d8], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1d8], eax
jne 0x1004379c
mov dword [ebp - 0x1dc], 1
jmp 0x100437a3
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
add eax, 0xfff8
cmp eax, 9
jbe 0x100437bf
mov dword [ebp - 0x1e4], 1
jmp 0x100437c6
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
add eax, 9
cmp eax, dword [ebp - 0x70]
jle 0x100437e0
mov dword [ebp - 0x1ec], 1
jmp 0x100437e7
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 0x63090707
jg 0x100437ff
mov dword [ebp - 0x1f4], 1
jmp 0x10043806
and dword [ebp - 0x1f4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1f4], eax
jl 0x10043826
mov dword [ebp - 0x1fc], 1
jmp 0x1004382d
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xffffffff
jne 0x1004384e
mov dword [ebp - 0x20c], 1
jmp 0x10043855
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x20c], eax
je 0x1004386c
mov dword [ebp - 0x4ec], 1
jmp 0x10043873
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x690], eax
mov eax, 0xded1
test eax, eax
je 0x100438af
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5a4], 0
je 0x100438af
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5a4], 0
je 0x100438af
mov dword [ebp - 0x4f4], 1
jmp 0x100438b6
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x5a4]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x4fc], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x1065b9b8
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0xc4], 0xd5e48d32
mov dword [ebp - 0x54], 0x91cb4e76
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x164], 0
jmp 0x1004393b
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x10043957
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x504], 0x66c1932e
jmp 0x1004392e
mov dword [ebp - 0xc4], 0xffffffea
jmp 0x10043970
cmp dword [ebp - 0xc4], 0xffffffe9
jg 0x10043ab4
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x6a0], eax
mov eax, 0x30cc2fdc
sub eax, dword [ebp - 0xc4]
cmp eax, 1
jg 0x100439c4
mov dword [ebp - 0x22c], 1
jmp 0x100439cb
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0xf4]
jl 0x100439eb
mov dword [ebp - 0x234], 1
jmp 0x100439f2
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
neg eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xc4]
lea eax, [eax + ecx - 0x3703aa75]
test eax, eax
je 0x10043a53
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10043a2b
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10043a51
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x54], 0
jmp 0x10043a6f
cmp dword [ebp - 0x54], 0x2e
jg 0x10043aaf
mov dword [ebp - 0x54], 0x16
jmp 0x10043ac4
cmp dword [ebp - 0x54], 0x26
jge 0x10043afb
mov dword [ebp - 0x50c], 1
cmp dword [ebp - 0x50c], 0
je 0x10043adf
jmp 0x10043afb
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10043af9
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x10043abd
mov eax, dword [ebp - 0x264]
mov dword [0x1065bbe4], eax
mov dword [ebp - 0x118], 0x824a8c6a
push 4
lea ecx, [ebp - 0x69c]
call fcn.1000bc50
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x660], 0xcb03629a
mov dword [ebp - 0x23c], 0x7f8b4dfe
mov dword [ebp - 0x16c], 0
jmp 0x10043b51
cmp dword [ebp - 0x16c], 4
jge 0x10043b70
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x69c]
call fcn.1000bcce
and dword [eax], 0
jmp 0x10043b44
mov dword [ebp - 0x118], 0
jmp 0x10043b89
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret