Function at 0x10041d97
Capabilities:
Check os version
Contain obfuscated stackstrings
Create pipe
Enumerate files on windows
Enumerate files recursively
Get common file path
Get disk information
Parse pe header
Query or enumerate registry key
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b8dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1184
call fcn.10066af0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0x43c]
call fcn.10016326
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x9f4]
call fcn.10016326
mov byte [ebp - 4], 1
mov dword [ebp - 0x140], 0
mov dword [ebp - 0xbf0], 1
push 3
lea ecx, [ebp - 0xc7c]
call fcn.10016326
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 0
jmp 0x10041e17
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10041e33
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.100163a4
mov dword [eax], 0xfffd
jmp 0x10041e10
mov dword [ebp - 0x1c], 0
jmp 0x10041e43
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10041e5f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
mov dword [eax], 0x2e56
jmp 0x10041e3c
mov dword [ebp - 0x1c], 0
jmp 0x10041e6f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10041e8b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc7c]
call fcn.100163a4
mov dword [eax], 0xfffffffc
jmp 0x10041e68
mov dword [ebp - 0x1c], 0
jmp 0x10041e9b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10041eb1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea0], 0x8aff
jmp 0x10041e94
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
cmp dword [eax], 0
je 0x10041ed0
push 0
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
mov esi, eax
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10041f0b
mov dword [ebp - 0x4ac], 1
jmp 0x10041f12
and dword [ebp - 0x4ac], 0
push 0
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
mov ecx, dword [ebp - 0x4ac]
add ecx, dword [eax]
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0xbf0], 0
je 0x10041f3f
mov eax, 0x5b1b
test eax, eax
jne 0x10041f5a
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10041f5a
and dword [ebp - 0x8c4], 0
jmp 0x10041f64
mov dword [ebp - 0x8c4], 1
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
mov esi, dword [ebp - 0x8c4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
add esi, dword [eax]
imul esi, esi, 0x2466
push 1
lea ecx, [ebp - 0xc7c]
call fcn.100163a4
mov dword [eax], esi
mov dword [ebp - 0x140], 0
jmp 0x10041fb6
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x13
jge 0x10042230
push 4
lea ecx, [ebp - 0x9b8]
call fcn.10016326
mov byte [ebp - 4], 3
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0x938], 0xc7d8169b
mov dword [ebp - 0x940], 0xfff6
mov dword [ebp - 0xb48], 0xe43c7d75
mov dword [ebp - 0x210], 0
jmp 0x10042015
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 4
jge 0x10042037
push dword [ebp - 0x210]
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
mov dword [eax], 0x972737ae
jmp 0x10042008
push 0
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
push 3
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x102c], eax
mov esi, dword [ebp - 0x140]
push 0
lea ecx, [ebp - 0x43c]
call fcn.100163a4
cmp dword [eax], esi
jne 0x100420a4
push 2
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
cmp dword [eax], 0
jne 0x100420a4
and dword [ebp - 0x8d4], 0
jmp 0x100420ae
mov dword [ebp - 0x8d4], 1
mov eax, dword [ebp - 0x8d4]
neg eax
mov dword [ebp - 0x8dc], eax
push 2
lea ecx, [ebp - 0xc7c]
call fcn.100163a4
mov ecx, dword [ebp - 0x8dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0x8dc], eax
je 0x100420eb
mov dword [ebp - 0x918], 1
jmp 0x100420f2
and dword [ebp - 0x918], 0
mov esi, dword [ebp - 0x940]
push 0
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
mov ecx, dword [ebp - 0x918]
add ecx, dword [eax]
cmp ecx, esi
jle 0x10042122
xor eax, eax
inc eax
je 0x10042122
mov dword [ebp - 0x920], 1
jmp 0x10042129
and dword [ebp - 0x920], 0
push 0
lea ecx, [ebp - 0x9f4]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x920]
jge 0x1004214c
mov dword [ebp - 0x928], 1
jmp 0x10042153
and dword [ebp - 0x928], 0
push 3
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
mov eax, dword [eax]
add eax, dword [ebp - 0x928]
jne 0x10042178
xor eax, eax
inc eax
jne 0x10042178
and dword [ebp - 0x398], 0
jmp 0x10042182
mov dword [ebp - 0x398], 1
push 3
lea ecx, [ebp - 0x9b8]
call fcn.100163a4
mov ecx, dword [ebp - 0x398]
mov dword [eax], ecx
cmp dword [ebp - 0x398], 0
jne 0x100421ac
mov dword [ebp - 0x930], 1
jmp 0x100421b3
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
sub eax, dword [ebp - 0x938]
cmp eax, dword [ebp - 0x940]
jne 0x100421d3
mov dword [ebp - 0xbe0], 1
jmp 0x100421da
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x104c], eax
push 5
pop eax
test eax, eax
je 0x10042202
mov eax, 0x4860c01e
test eax, eax
je 0x10042202
mov dword [ebp - 0x948], 1
jmp 0x10042209
and dword [ebp - 0x948], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x948]
mov dword [ebp + eax - 0xea0], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9b8]
call fcn.10016388
jmp 0x10041fa9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc7c]
call fcn.10016388
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9f4]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.10016388
cmp dword [ebp + 0x10], 0
jbe 0x1004227f
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004227f
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1003e06d
pop ecx
pop ecx
jmp 0x10049fd7
push 2
lea ecx, [ebp - 0x454]
call fcn.10016326
mov dword [ebp - 4], 4
mov dword [ebp - 0xa64], 0x4c7b7f60
mov dword [ebp - 0x184], 3
mov dword [ebp - 0x4b0], 0xabfd090d
mov dword [ebp - 0x748], 0xfffb
mov dword [ebp - 0xe6c], 0xffffffff
mov dword [ebp - 0x88], 0
jmp 0x100422de
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100422fd
push dword [ebp - 0x88]
lea ecx, [ebp - 0x454]
call fcn.100163a4
and dword [eax], 0
jmp 0x100422d1
mov dword [ebp - 0x88], 0
jmp 0x10042316
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10042332
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x170], 0x689351f2
jmp 0x10042309
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov dword [eax], 0xffffffe9
jmp 0x1004236b
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x950]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
cmp dword [eax], 0xffffffe8
jle 0x100427cd
push 3
lea ecx, [ebp - 0x410]
call fcn.10016326
mov byte [ebp - 4], 5
mov dword [ebp - 0x3f4], 0xffffffff
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0xf90], 0x4de6f885
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x34c], 0
jmp 0x100423d3
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 3
jge 0x100423f5
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov dword [eax], 1
jmp 0x100423c6
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
and dword [eax], 0
jmp 0x1004242b
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x958]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
cmp dword [eax], 0
jl 0x1004267d
mov dword [ebp - 0x880], 0xb34c266d
mov dword [ebp - 0xbe8], 0xee3199f2
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10042598
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x170]
sub esi, 0xf5c9
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x170], esi
jge 0x100424a0
mov dword [ebp - 0x960], 1
jmp 0x100424a7
and dword [ebp - 0x960], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x960], eax
je 0x100424d1
mov dword [ebp - 0x8f4], 1
jmp 0x100424d8
and dword [ebp - 0x8f4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x170]
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov ecx, dword [ebp - 0x8f4]
add ecx, dword [eax]
imul eax, ecx, 0
add eax, esi
imul eax, eax, 0xffff
cmp eax, 0xcae8ef33
ja 0x10042518
mov dword [ebp - 0x8bc], 1
jmp 0x1004251f
and dword [ebp - 0x8bc], 0
mov dword [ebp - 0x184], 1
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0x8bc]
je 0x1004254f
mov dword [ebp - 0x4a0], 1
jmp 0x10042556
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
jne 0x10042577
mov dword [ebp - 0x738], 1
jmp 0x1004257e
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x738], eax
jg 0x10042598
mov dword [ebp - 0x4a8], 1
jmp 0x1004259f
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x4b0]
add eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x428], eax
jl 0x100425cc
mov dword [ebp - 0x92c], 1
jmp 0x100425d3
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x92c], 7
jge 0x100425e8
mov dword [ebp - 0x740], 1
jmp 0x100425ef
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x740], eax
jle 0x10042609
mov dword [ebp - 0x4b8], 1
jmp 0x10042610
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x4b8], eax
jge 0x1004263a
mov dword [ebp - 0x888], 1
jmp 0x10042641
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 1
je 0x10042656
mov dword [ebp - 0x4c0], 1
jmp 0x1004265d
and dword [ebp - 0x4c0], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov ecx, dword [ebp - 0x4c0]
sub ecx, dword [eax]
mov dword [ebp - 0xbe8], ecx
jmp 0x10042407
mov esi, dword [ebp - 0x184]
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x410]
call fcn.100163a4
imul esi, dword [eax]
mov dword [ebp - 0x748], esi
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x184], 0xffffffff
jle 0x100426c9
mov dword [ebp - 0x4c8], 1
jmp 0x100426d0
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x4c8], eax
jl 0x100426ea
mov dword [ebp - 0xb58], 1
jmp 0x100426f1
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xe74], eax
mov eax, 0xdef5
cmp eax, 0xba4a
jne 0x10042715
mov dword [ebp - 0x99c], 1
jmp 0x1004271c
and dword [ebp - 0x99c], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov ecx, dword [ebp - 0x99c]
cmp ecx, dword [eax]
jg 0x1004273f
mov dword [ebp - 0x4d0], 1
jmp 0x10042746
and dword [ebp - 0x4d0], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.100163a4
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [eax]
jle 0x10042769
mov dword [ebp - 0x750], 1
jmp 0x10042770
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x750], eax
jge 0x10042791
mov dword [ebp - 0x4d8], 1
jmp 0x10042798
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x3f4], eax
push 1
lea ecx, [ebp - 0x410]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0xa64], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x410]
call fcn.10016388
jmp 0x10042347
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10016388
mov dword [ebp - 0x21c], 0xffffffff
push 2
lea ecx, [ebp - 0xa28]
call fcn.10016326
mov dword [ebp - 4], 6
push 3
lea ecx, [ebp - 0xdd0]
call fcn.10016326
mov byte [ebp - 4], 7
mov dword [ebp - 0x7c], 0
jmp 0x1004281b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10042837
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xa28]
call fcn.100163a4
mov dword [eax], 0x55b7cefa
jmp 0x10042814
mov dword [ebp - 0x7c], 0
jmp 0x10042847
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10042863
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xdd0]
call fcn.100163a4
mov dword [eax], 0xb0fe2cf4
jmp 0x10042840
mov dword [ebp - 0x21c], 0
jmp 0x1004287c
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffe9
jg 0x10042aa2
push 1
lea ecx, [ebp - 0x970]
call fcn.10016326
mov byte [ebp - 4], 8
mov dword [ebp - 0x4e0], 5
mov dword [ebp - 0x3a8], 0xffffffff
mov dword [ebp - 0x94], 0
jmp 0x100428c7
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x100428e9
push dword [ebp - 0x94]
lea ecx, [ebp - 0x970]
call fcn.100163a4
mov dword [eax], 3
jmp 0x100428ba
mov dword [ebp - 0x94], 0
jmp 0x10042902
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1004291e
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xec4], 0
jmp 0x100428f5
push 0
lea ecx, [ebp - 0xa28]
call fcn.100163a4
mov esi, eax
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
mov eax, dword [eax]
mov dword [esi], eax
push 1
lea ecx, [ebp - 0xa28]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
cmp dword [eax], 0x4adca1a1
jg 0x1004296c
mov dword [ebp - 0x890], 1
jmp 0x10042973
and dword [ebp - 0x890], 0
push 2
lea ecx, [ebp - 0xdd0]
call fcn.100163a4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x890]
lea eax, [ecx + eax + 0x678e045]
test eax, eax
je 0x100429a4
or eax, 0xffffffff
je 0x100429a4
mov dword [ebp - 0xb68], 1
jmp 0x100429ab
and dword [ebp - 0xb68], 0
push 0
lea ecx, [ebp - 0xa28]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x4e0], eax
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
mov esi, eax
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
mov eax, dword [eax]
mov ecx, dword [esi]
lea eax, [eax + ecx + 0x1b7c444a]
cmp dword [ebp - 0x4e0], eax
jl 0x10042a08
mov dword [ebp - 0x758], 1
jmp 0x10042a0f
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jne 0x10042a36
cmp dword [ebp - 0x3a8], 0
jne 0x10042a36
and dword [ebp - 0xbf8], 0
jmp 0x10042a40
mov dword [ebp - 0xbf8], 1
push 1
lea ecx, [ebp - 0xa28]
call fcn.100163a4
mov eax, 0xffff
test eax, eax
jne 0x10042a71
push 0
lea ecx, [ebp - 0x970]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10042a71
and dword [ebp - 0x4e8], 0
jmp 0x10042a7b
mov dword [ebp - 0x4e8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4e8]
mov dword [ebp + eax - 0xec4], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.10016388
jmp 0x1004286f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdd0]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.10016388
cmp dword [ebp + 0x10], 0
jne 0x10046a24
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.100376a1
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x15c], 0xfffffff8
mov dword [ebp - 0xa7c], 5
mov dword [ebp - 0x15c], 0
jmp 0x10042b08
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x13
jge 0x10042c16
mov dword [ebp - 0x2cc], 0xaa9ac70c
mov dword [ebp - 0x2cc], 0x1a
jmp 0x10042b38
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 7
je 0x10042c11
mov dword [ebp - 0x934], 0xec752f67
xor eax, eax
jne 0x10042bda
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1014], eax
imul eax, dword [ebp - 0x15c], 0xca8f
cmp dword [ebp - 0x934], eax
jne 0x10042b81
mov dword [ebp - 0x4f0], 1
jmp 0x10042b88
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x934]
cmp dword [ebp - 0x4f0], eax
jg 0x10042ba2
mov dword [ebp - 0x760], 1
jmp 0x10042ba9
and dword [ebp - 0x760], 0
cmp dword [ebp - 0x760], 0xd9d08905
ja 0x10042bc1
mov dword [ebp - 0x4f8], 1
jmp 0x10042bc8
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 1
jle 0x10042bda
and dword [ebp - 0x898], 0
jmp 0x10042be4
mov dword [ebp - 0x898], 1
cmp dword [ebp - 0x898], 0
je 0x10042bf9
mov dword [ebp - 0x500], 1
jmp 0x10042c00
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xa7c], eax
jmp 0x10042b2b
jmp 0x10042afb
mov dword [ebp - 0x224], 0xb3198a8f
mov dword [ebp - 0x224], 0
jmp 0x10042c39
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xd
jg 0x10042c8b
mov dword [ebp - 0x200], 0
jmp 0x10042c5b
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x10042c77
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xa84], 0xffffffff
jmp 0x10042c4e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa84], 0
je 0x10042c89
jmp 0x10042c8b
jmp 0x10042c2c
cmp dword [0x108f0060], 0
jne 0x100467c4
mov dword [ebp - 0x168], 0x5d6c05ba
mov dword [ebp - 0xb4], 0xfffffff8
mov dword [ebp - 0xaa4], 0x9e8bd61c
mov dword [ebp - 0x324], 0
jmp 0x10042ccf
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x10042ceb
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x424], 0xbe197e7c
jmp 0x10042cc2
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x10042d07
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x168], 0x1a
jmp 0x10042d20
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xd
je 0x10043240
mov dword [ebp - 0x100], 0xeede0b40
push 1
lea ecx, [ebp - 0x9dc]
call fcn.10016326
mov dword [ebp - 4], 9
mov dword [ebp - 0x3fc], 0xfffffffb
mov dword [ebp - 0xab4], 5
mov dword [ebp - 0x22c], 0
jmp 0x10042d78
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x10042d9a
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
mov dword [eax], 0xfa8fad74
jmp 0x10042d6b
mov dword [ebp - 0x100], 2
jmp 0x10042db3
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
je 0x1004322c
mov dword [ebp - 0x2d4], 0xe23a266d
mov dword [ebp - 0x3b0], 0x7fa3
mov dword [ebp - 0x1b4], 0x43d2717f
mov dword [ebp - 0xe7c], 0x3550e352
mov dword [ebp - 0x550], 0xb09e
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x100431f7
cmp dword [ebp - 0x2d4], 0
je 0x10042e27
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x10042e27
mov dword [ebp - 0x768], 1
jmp 0x10042e2e
and dword [ebp - 0x768], 0
imul eax, dword [ebp - 0x3b0], 0xbefa
test eax, eax
je 0x10042e51
cmp dword [ebp - 0x100], 0
je 0x10042e51
mov dword [ebp - 0x508], 1
jmp 0x10042e58
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x768]
imul eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0x168]
je 0x10042e79
mov dword [ebp - 0xa8c], 1
jmp 0x10042e80
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
sub eax, 0x39ee491b
mov dword [ebp - 0x984], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x984]
mov dword [ebp + eax - 0x424], ecx
cmp dword [ebp - 0x984], 0
je 0x100431f7
mov dword [ebp - 0x548], 0xed1d25bb
mov dword [ebp - 0x518], 0xfffffffe
mov dword [ebp - 0xa94], 0xfef6f1ac
cmp dword [ebp - 0xb4], 0
je 0x10043000
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xe8c], eax
xor eax, eax
jne 0x10042f37
push 0
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10042f37
and dword [ebp - 0x510], 0
jmp 0x10042f41
mov dword [ebp - 0x510], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0x424], ecx
push 0
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
cmp dword [ebp - 0xb4], 0x6054615
jl 0x10042f79
mov dword [ebp - 0x770], 1
jmp 0x10042f80
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0x3b0]
jl 0x10042fa6
mov dword [ebp - 0x8a0], 1
jmp 0x10042fad
and dword [ebp - 0x8a0], 0
mov esi, dword [ebp - 0x2d4]
push 0
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [eax]
cmp ecx, esi
jge 0x10042fd8
mov dword [ebp - 0x520], 1
jmp 0x10042fdf
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jl 0x10043000
mov dword [ebp - 0x778], 1
jmp 0x10043007
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0xa94]
cmp dword [ebp - 0x778], eax
jle 0x10043021
mov dword [ebp - 0x528], 1
jmp 0x10043028
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x528], eax
jle 0x10043042
mov dword [ebp - 0x93c], 1
jmp 0x10043049
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xa682
jne 0x10043061
mov dword [ebp - 0xa9c], 1
jmp 0x10043068
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xfac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x424], 0
jl 0x10043090
mov dword [ebp - 0x530], 1
jmp 0x10043097
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x530], eax
jge 0x100430b1
mov dword [ebp - 0x780], 1
jmp 0x100430b8
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x780], 0xbadcab39
jb 0x100430d0
mov dword [ebp - 0x538], 1
jmp 0x100430d7
and dword [ebp - 0x538], 0
push 0
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [eax]
jg 0x100430fa
mov dword [ebp - 0xaac], 1
jmp 0x10043101
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xe94], eax
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x2d4]
add eax, dword [ebp - 0xab4]
je 0x1004313b
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1004313b
mov dword [ebp - 0x8a8], 1
jmp 0x10043142
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
sub eax, 0xfff6
cmp eax, dword [ebp - 0x550]
je 0x10043161
mov dword [ebp - 0x540], 1
jmp 0x10043168
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0x119b
je 0x10043180
mov dword [ebp - 0x788], 1
jmp 0x10043187
and dword [ebp - 0x788], 0
push 0
lea ecx, [ebp - 0x9dc]
call fcn.100163a4
mov ecx, dword [ebp - 0x788]
imul ecx, dword [eax]
cmp ecx, 0xffffffff
jle 0x100431ae
mov dword [ebp - 0x9a4], 1
jmp 0x100431b5
and dword [ebp - 0x9a4], 0
mov dword [ebp - 0x548], 3
mov eax, dword [ebp - 0x548]
cmp eax, dword [ebp - 0x9a4]
jg 0x100431e2
cmp dword [ebp - 0x550], 0
je 0x100431e2
mov dword [ebp - 0x790], 1
jmp 0x100431e9
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x1b4], eax
jmp 0x10043227
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1004321d
push 0
push 0x4f5
push 0
push 0x1d2d
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 0x1b4], 0x6e60e451
jmp 0x10042da6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9dc]
call fcn.10016388
jmp 0x10042d13
mov dword [ebp - 0xabc], 0x3232
lea eax, [ebp - 0xabc]
push eax
call fcn.1003e048
pop ecx
mov dword [ebp - 0x870], eax
push 2
lea ecx, [ebp - 0x9c4]
call fcn.10016326
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x568], 0xe17ca002
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0x588], 0x5bbbdebf
mov dword [ebp - 0x103c], 0xb0ca
mov dword [ebp - 0x430], 1
mov dword [ebp - 0xac4], 0xb25631c
push 1
lea ecx, [ebp - 0xc94]
call fcn.10016326
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x30], 0
jmp 0x100432ce
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100432ea
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
mov dword [eax], 0xb58e469a
jmp 0x100432c7
mov dword [ebp - 0x30], 0
jmp 0x100432fa
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10043310
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xa08], 0x5bc42206
jmp 0x100432f3
mov dword [ebp - 0x30], 0
jmp 0x10043320
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1004333c
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc94]
call fcn.100163a4
mov dword [eax], 0xfffffffd
jmp 0x10043319
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xa08]
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
cmp esi, dword [eax]
jl 0x1004337b
mov dword [ebp - 0x558], 1
jmp 0x10043382
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x3c0]
cmp dword [ebp - 0x558], eax
jl 0x1004339c
mov dword [ebp - 0x8b0], 1
jmp 0x100433a3
and dword [ebp - 0x8b0], 0
imul eax, dword [ebp - 0x8b0], 0xfffe
cmp eax, dword [ebp - 0x588]
jl 0x100433c1
mov dword [ebp - 0x3b8], 1
jmp 0x100433c8
and dword [ebp - 0x3b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax - 0xa08], ecx
mov eax, dword [ebp - 0xac4]
cmp dword [ebp - 0x3b8], eax
je 0x100433f5
mov dword [ebp - 0x560], 1
jmp 0x100433fc
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x560]
neg eax
cmp dword [ebp - 0x430], eax
jg 0x10043425
mov dword [ebp - 0x798], 1
jmp 0x1004342c
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0x3c0]
jl 0x10043462
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa08], 0
je 0x10043462
mov dword [ebp - 0x944], 1
jmp 0x10043469
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 5
je 0x1004347e
mov dword [ebp - 0x570], 1
jmp 0x10043485
and dword [ebp - 0x570], 0
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jl 0x100434a8
mov dword [ebp - 0x7a0], 1
jmp 0x100434af
and dword [ebp - 0x7a0], 0
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
mov ecx, dword [ebp - 0x7a0]
cmp ecx, dword [eax]
je 0x100434d2
mov dword [ebp - 0xacc], 1
jmp 0x100434d9
and dword [ebp - 0xacc], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xa08]
push 1
lea ecx, [ebp - 0x9c4]
call fcn.100163a4
mov eax, dword [eax]
neg eax
cmp eax, esi
jge 0x10043519
push 0
lea ecx, [ebp - 0xc94]
call fcn.100163a4
cmp dword [eax], 0
je 0x10043519
mov dword [ebp - 0x578], 1
jmp 0x10043520
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0xc94]
call fcn.100163a4
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
jg 0x10043543
mov dword [ebp - 0x8b8], 1
jmp 0x1004354a
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 0
jl 0x1004355f
mov dword [ebp - 0x580], 1
jmp 0x10043566
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 1
je 0x1004357b
mov dword [ebp - 0x7a8], 1
jmp 0x10043582
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
neg eax
mov dword [ebp - 0x588], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc94]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c4]
call fcn.10016388
mov byte [ebp - 0x1d8], 3
mov byte [ebp - 0x1d7], 0x8c
mov byte [ebp - 0x1d6], 0xb
mov byte [ebp - 0x1d5], 0x2e
mov byte [ebp - 0x1d4], 6
mov byte [ebp - 0x1d3], 0xb
mov byte [ebp - 0x1d2], 4
mov byte [ebp - 0x1d1], 0x16
mov byte [ebp - 0x1d0], 4
mov byte [ebp - 0x1cf], 0xa8
mov byte [ebp - 0x1ce], 0x9c
mov byte [ebp - 0x1cd], 0x6d
mov byte [ebp - 0x1cc], 0x57
mov byte [ebp - 0x1cb], 5
mov byte [ebp - 0x1ca], 0x17
mov byte [ebp - 0x1c9], 0xc
mov byte [ebp - 0x1c8], 0x25
mov byte [ebp - 0x1c7], 0
mov byte [ebp - 0x1c6], 0x10
mov byte [ebp - 0x1c5], 0xa
mov byte [ebp - 0x1c4], 2
mov byte [ebp - 0x1c3], 2
mov byte [ebp - 0x1c2], 0x31
mov byte [ebp - 0x1c1], 8
mov byte [ebp - 0x1c0], 0x1b
mov byte [ebp - 0x1bf], 1
mov byte [ebp - 0x1be], 0xa
mov byte [ebp - 0x1bd], 7
mov byte [ebp - 0x1bc], 0xc
mov byte [ebp - 0x1bb], 9
mov byte [ebp - 0x1ba], 7
mov dword [ebp - 0xbc], 0x5a136951
mov dword [ebp - 0x234], 0
jmp 0x100436aa
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x100436c6
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0xed0], 0xc0ae9714
jmp 0x1004369d
mov dword [ebp - 0xbc], 0
jmp 0x100436df
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10043884
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1004387f
mov dword [ebp - 0x994], 0x4b9b
mov dword [ebp - 0xad4], 0x10008d68
cmp dword [ebp - 0x994], 0x4f76
jle 0x10043820
and dword [ebp - 0x244], 0
jmp 0x1004373c
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x58d7
jge 0x10043801
and dword [ebp - 0x364], 0
jmp 0x10043762
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x12e8
jge 0x100437fc
and dword [ebp - 0x23c], 0
jmp 0x10043788
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x4026
jge 0x100437f7
and dword [ebp - 0x2dc], 0
jmp 0x100437aa
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x60cf
jge 0x100437f5
mov eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x23c]
sar eax, cl
and eax, dword [ebp - 0x2dc]
xor eax, dword [ebp - 0x244]
cdq
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb78], edx
push dword [ebp - 0xb78]
push dword [ebp - 0xb7c]
mov ecx, 0x106127f8
call fcn.1001600c
jmp 0x1004379d
jmp 0x1004377b
jmp 0x10043755
jmp 0x1004372f
push 0x1efa
push 0x7ba
push 0x1d67
push 0x141
push 0x24e0
call dword [sym.imp.GDI32.dll_Ellipse]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x994], 0x4919
jge 0x10043859
mov edx, dword [ebp - 0xad4]
mov ecx, 0x106127f8
call fcn.1001a94a
jmp 0x10043875
or dword [ebp - 4], 0xffffffff
jmp 0x1004387f
jmp 0x100436d2
mov dword [ebp - 0xbc], 0
jmp 0x1004389d
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffec
jne 0x100438c4
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x100438c2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10043890
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
and eax, 0xda
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1d8]
or ecx, 0xda
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
mov byte [ebp + eax - 0xa50], cl
mov dword [ebp - 0x108], 3
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x110], 0xf93bd5de
mov dword [ebp - 0x14c], 0x2f5a260d
mov dword [ebp - 0x2e4], 0x3c8d3fd9
mov dword [ebp - 0x5e8], 0xf9f80411
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10043a7e
push 1
lea ecx, [ebp - 0xdc4]
call fcn.10016326
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x32c], 0
jmp 0x1004398f
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x100439b1
push dword [ebp - 0x32c]
lea ecx, [ebp - 0xdc4]
call fcn.100163a4
mov dword [eax], 0xd811
jmp 0x10043982
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb0]
add ecx, eax
cmp ecx, dword [ebp - 0x110]
jne 0x100439f9
mov dword [ebp - 0x590], 1
jmp 0x10043a00
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x590]
jne 0x10043a12
cmp dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x7b0], eax
push 0
lea ecx, [ebp - 0xdc4]
call fcn.100163a4
mov ecx, dword [ebp - 0x7b0]
mov dword [eax], ecx
imul eax, dword [ebp - 0x20], 0xf9e3
cmp dword [ebp - 0x7b0], eax
je 0x10043a4e
mov dword [ebp - 0x598], 1
jmp 0x10043a55
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x598]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc4]
call fcn.10016388
jmp 0x10043ecf
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x9ac], 0xfffffff7
mov dword [ebp - 0xfb8], 0xfffffffe
mov dword [ebp - 0x84], 0
jmp 0x10043ab2
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x10043ace
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xfe8], 0x772be76d
jmp 0x10043aa5
mov dword [ebp - 0x84], 0
jmp 0x10043ae7
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10043b03
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xc04], 0
jmp 0x10043ada
cmp dword [ebp - 0x34], 0
je 0x10043b72
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x34]
jg 0x10043b23
mov dword [ebp - 0x8c0], 1
jmp 0x10043b2a
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x8c0], eax
je 0x10043b39
cmp dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 0
jne 0x10043b51
cmp dword [ebp - 0x14c], 0
jne 0x10043b51
and dword [ebp - 0x5a0], 0
jmp 0x10043b5b
mov dword [ebp - 0x5a0], 1
mov eax, dword [ebp - 0x5a0]
sub eax, dword [ebp - 0x34]
je 0x10043b72
mov dword [ebp - 0x7b8], 1
jmp 0x10043b79
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 6
je 0x10043b8e
mov dword [ebp - 0x404], 1
jmp 0x10043b95
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x404]
mov dword [ebp + eax - 0xfe8], ecx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x404]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jg 0x10043bd5
mov dword [ebp - 0x5a8], 1
jmp 0x10043bdc
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x5a8], eax
jle 0x10043bff
mov eax, 0xce01
test eax, eax
je 0x10043bff
mov dword [ebp - 0x94c], 1
jmp 0x10043c06
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
neg eax
sub eax, 0x12097756
js 0x10043c21
mov dword [ebp - 0xadc], 1
jmp 0x10043c28
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0x34], 0
je 0x10043c74
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfe8], 0
je 0x10043c74
cmp dword [ebp - 0x108], 0
je 0x10043c74
mov dword [ebp - 0x5b0], 1
jmp 0x10043c7b
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x5b0]
lea eax, [ecx + eax + 0x1f73e702]
cmp eax, dword [ebp - 0x34]
jl 0x10043c9f
mov dword [ebp - 0x7c0], 1
jmp 0x10043ca6
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 0x3d48a24e
je 0x10043cb6
cmp dword [ebp - 0x20], 0
cmp dword [ebp - 0x110], 0
je 0x10043eae
mov dword [ebp - 0x5e0], 0xb0debf62
mov dword [ebp - 0xaf4], 0
mov dword [ebp - 0xfc0], 0x42a2ca01
mov dword [ebp - 0xaec], 0xfffffffa
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x108]
jle 0x10043d0b
mov eax, 0xac5d
test eax, eax
jne 0x10043d0b
and dword [ebp - 0x5b8], 0
jmp 0x10043d15
mov dword [ebp - 0x5b8], 1
cmp dword [ebp - 0x5b8], 5
je 0x10043d2a
mov dword [ebp - 0xae4], 1
jmp 0x10043d31
and dword [ebp - 0xae4], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2e4]
cmp eax, dword [ebp - 0xaec]
jl 0x10043d5f
mov dword [ebp - 0x8c8], 1
jmp 0x10043d66
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0x8c8], eax
jg 0x10043d80
mov dword [ebp - 0x5c0], 1
jmp 0x10043d87
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0x5c0], eax
jl 0x10043da1
mov dword [ebp - 0x7c8], 1
jmp 0x10043da8
and dword [ebp - 0x7c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc04]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xc04]
inc ecx
push 4
pop edx
shl edx, 0
mov dword [ebp + edx - 0xc04], ecx
mov eax, 0xdb298f97
cmp eax, 0x2f19166c
jb 0x10043de8
mov dword [ebp - 0x5c8], 1
jmp 0x10043def
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5e8]
imul eax, dword [ebp - 0x5c8]
cmp dword [ebp - 0x34], eax
jne 0x10043e0d
mov dword [ebp - 0x5d0], 1
jmp 0x10043e14
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0x5d0], eax
je 0x10043e2e
mov dword [ebp - 0x5d8], 1
jmp 0x10043e35
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x7d0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7d0]
mov dword [ebp + eax - 0xfe8], ecx
mov eax, dword [ebp - 0x7d0]
cmp eax, dword [ebp - 0x5d8]
jg 0x10043e6e
mov dword [ebp - 0x8d0], 1
jmp 0x10043e75
and dword [ebp - 0x8d0], 0
cmp dword [ebp - 0x8d0], 9
jle 0x10043e93
mov eax, 0x1552ae0d
test eax, eax
je 0x10043e93
mov dword [ebp - 0x7d8], 1
jmp 0x10043e9a
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x14c], eax
jmp 0x10043ecf
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10043ecf
push 0
push 0x2088
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [ebp - 0x20], 0
jmp 0x10043edf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 9
je 0x10044075
mov dword [ebp - 0x5f8], 0x8d4e4af0
push 4
lea ecx, [ebp - 0xa34]
call fcn.10016326
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xb04], 0xfffffffb
mov dword [ebp - 0x24c], 0
jmp 0x10043f2a
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x10043f49
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xa34]
call fcn.100163a4
and dword [eax], 0
jmp 0x10043f1d
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xef0], eax
push 0
lea ecx, [ebp - 0xa34]
call fcn.100163a4
mov esi, eax
push 2
lea ecx, [ebp - 0xa34]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10043f8f
mov dword [ebp - 0xafc], 1
jmp 0x10043f96
and dword [ebp - 0xafc], 0
mov dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x5e8]
jg 0x10043fba
mov dword [ebp - 0x8f0], 1
jmp 0x10043fc1
and dword [ebp - 0x8f0], 0
push 2
lea ecx, [ebp - 0xa34]
call fcn.100163a4
mov ecx, dword [ebp - 0x8f0]
cmp ecx, dword [eax]
jl 0x10043fe4
mov dword [ebp - 0x5f0], 1
jmp 0x10043feb
and dword [ebp - 0x5f0], 0
mov dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x7e0]
mov ecx, dword [ebp - 0x5f8]
imul ecx, eax
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x8d8], eax
push 1
lea ecx, [ebp - 0xa34]
call fcn.100163a4
mov ecx, dword [ebp - 0x8d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x8d8]
jge 0x1004404e
mov dword [ebp - 0x600], 1
jmp 0x10044055
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0xb04], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.10016388
jmp 0x10043ed8
mov dword [ebp - 0x28], 2
and dword [ebp - 0x17c], 0
jmp 0x1004408d
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1f
jae 0x1004477a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10044321
mov dword [ebp - 0xffc], 0xe91a049f
mov dword [ebp - 0xff8], 0xe91a049f
mov dword [ebp - 0xff4], 0xe91a049f
mov dword [ebp - 0xff0], 0xe91a049f
mov dword [ebp - 0x254], 0xc1ec2db2
mov dword [ebp - 0x254], 0
jmp 0x100440fd
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jg 0x10044124
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x10044122
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x100440f0
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10044141
push 0x22e4
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1d8]
inc eax
mov dword [ebp - 0x17c], eax
push 3
lea ecx, [ebp - 0xb44]
call fcn.10016326
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xa4], 0
jmp 0x10044180
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x100441a2
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xb44]
call fcn.100163a4
mov dword [eax], 0xff0ea75c
jmp 0x10044173
mov dword [ebp - 0xa4], 0
jmp 0x100441bb
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x100441d7
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x468], 0x7df2f4a8
jmp 0x100441ae
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x468], 0
jmp 0x10044205
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x468]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x468], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x468], 2
jg 0x100442f8
mov dword [ebp - 0x354], 0xc3eee2fd
mov dword [ebp - 0x354], 0
jmp 0x1004423c
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 2
jg 0x100442bd
mov dword [ebp - 0x25c], 0x8999d94b
mov dword [ebp - 0x25c], 2
jmp 0x10044268
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x100442b8
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x1b8], 0
jmp 0x10044294
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x100442b6
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xb44]
call fcn.100163a4
mov dword [eax], 0xfffffff8
jmp 0x10044287
jmp 0x1004425b
jmp 0x1004422f
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x468]
lea ecx, [ebp - 0xb44]
call fcn.100163a4
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x468]
lea ecx, [ebp - 0xb44]
call fcn.100163a4
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100441ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb44]
call fcn.10016388
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1d8]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x10044085
push 4
lea ecx, [ebp - 0xcac]
call fcn.10016326
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x3c8], 0x29cf3083
mov dword [ebp - 0x16c], 0xca3191b4
mov dword [ebp - 0x2ec], 0xc556123d
mov dword [ebp - 0x154], 0xfffffffd
mov dword [ebp - 0x120], 0xfffffffb
mov dword [ebp - 0x3dc], 1
mov dword [ebp - 0x8c], 0
jmp 0x1004438a
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x100443ac
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xcac]
call fcn.100163a4
mov dword [eax], 0x210e164c
jmp 0x1004437d
mov dword [ebp - 0x8c], 0
jmp 0x100443c5
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x100443e1
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc5c], 0x9475
jmp 0x100443b8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
mov dword [ebp - 0x1024], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc5c]
mov dword [ebp - 0xef8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
mov dword [ebp - 0x16c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc5c]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0x2ec]
cmp eax, 0xcf041577
jbe 0x1004444f
or eax, 0xffffffff
je 0x1004444f
mov dword [ebp - 0x7e8], 1
jmp 0x10044456
and dword [ebp - 0x7e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp eax, dword [ebp - 0x7e8]
jne 0x10044477
mov dword [ebp - 0x608], 1
jmp 0x1004447e
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x154], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x154]
cmp ecx, dword [ebp + eax - 0xc5c]
jl 0x100444b1
cmp dword [ebp - 0x2ec], 0
jne 0x100444b1
and dword [ebp - 0x8f8], 0
jmp 0x100444bb
mov dword [ebp - 0x8f8], 1
push 0
lea ecx, [ebp - 0xcac]
call fcn.100163a4
mov dword [eax], 8
mov dword [ebp - 0x3c8], 8
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x8f8]
jne 0x100444f8
cmp dword [ebp - 0x154], 0
jne 0x100444f8
and dword [ebp - 0x610], 0
jmp 0x10044502
mov dword [ebp - 0x610], 1
mov eax, dword [ebp - 0x610]
add eax, 5
imul eax, eax, 0xffff
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x16c], 0x15
jmp 0x1004453c
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xfffffff6
jne 0x100446d7
mov dword [ebp - 0x118], 0xfe1f230b
mov dword [ebp - 0x7f8], 4
push 8
pop eax
test eax, eax
je 0x10044617
cmp dword [ebp - 0x3c8], 1
jne 0x1004457d
mov dword [ebp - 0x7f0], 1
jmp 0x10044584
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x7f0]
jne 0x1004459e
mov dword [ebp - 0x618], 1
jmp 0x100445a5
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xfc8], eax
imul eax, dword [ebp - 0x618], 0
test eax, eax
jne 0x100445d7
cmp dword [ebp - 0x154], 0
jne 0x100445d7
cmp dword [ebp - 0x118], 0
jne 0x100445d7
and dword [ebp - 0xb0c], 0
jmp 0x100445e1
mov dword [ebp - 0xb0c], 1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xdd8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x118]
add ecx, dword [ebp + eax - 0xc5c]
je 0x10044617
mov eax, 0x979f9f4a
test eax, eax
je 0x10044617
mov dword [ebp - 0x8e0], 1
jmp 0x1004461e
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0xffffffff
jb 0x10044633
mov dword [ebp - 0x620], 1
jmp 0x1004463a
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x118]
jne 0x10044669
mov eax, 0x9e0cd1ad
test eax, eax
je 0x10044669
mov dword [ebp - 0xb14], 1
jmp 0x10044670
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
sub eax, dword [ebp - 0x118]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x120], 0
jmp 0x100446b3
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x100446d2
push dword [ebp - 0x120]
lea ecx, [ebp - 0xcac]
call fcn.100163a4
and dword [eax], 0
jmp 0x100446a6
jmp 0x1004452f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.10016388
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x17c]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0xa50]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x1d7]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x17c]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0xa50]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x1d7]
and edx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x17c]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0xa50]
mov esi, dword [ebp - 0x28]
movzx ebx, byte [ebp + esi - 0x1d7]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1d8]
mov byte [ebp + eax - 0xa50], bl
and dword [ebp - 0x17c], 0
jmp 0x10044085
mov dword [ebp - 0xde8], 0xffffffff
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x100447a4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x100447c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xa50], 0
mov dword [ebp - 0xd0c], 0xee4e9120
mov dword [ebp - 0xd08], 0xee4e9120
mov dword [ebp - 0xd04], 0xee4e9120
mov dword [ebp - 0xd00], 0xee4e9120
lea ecx, [ebp - 0x3d1]
call fcn.100163b3
push eax
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0xd0c]
push eax
lea ecx, [ebp - 0x1120]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x420]
call fcn.10016362
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x628], 0xa62a9695
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x630], 0xfffffffc
mov dword [ebp - 0xb24], 0x5616d21b
mov dword [ebp - 0x264], 0
jmp 0x10044873
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 4
jge 0x1004488f
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x10b0], 0xf088
jmp 0x10044866
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x628], eax
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x628]
cmp eax, dword [ebp - 0x334]
je 0x100448e0
mov dword [ebp - 0x900], 1
jmp 0x100448e7
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0xdf0], eax
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov esi, dword [ebp - 0x334]
push 3
lea ecx, [ebp - 0x420]
call fcn.100163a4
add esi, dword [eax]
je 0x10044941
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
cmp dword [eax], 0
je 0x10044941
mov dword [ebp - 0x800], 1
jmp 0x10044948
and dword [ebp - 0x800], 0
push 3
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov ecx, dword [ebp - 0x800]
cmp ecx, dword [eax]
jge 0x1004496b
mov dword [ebp - 0x638], 1
jmp 0x10044972
and dword [ebp - 0x638], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov ecx, dword [ebp - 0x638]
imul ecx, dword [eax]
test ecx, ecx
je 0x100449a1
mov eax, 0xd3388a01
test eax, eax
je 0x100449a1
mov dword [ebp - 0x8ec], 1
jmp 0x100449a8
and dword [ebp - 0x8ec], 0
cmp dword [ebp - 0x8ec], 0
jg 0x100449bd
mov dword [ebp - 0xb1c], 1
jmp 0x100449c4
and dword [ebp - 0xb1c], 0
mov esi, dword [ebp - 0x334]
dec esi
push 0
lea ecx, [ebp - 0x420]
call fcn.100163a4
cmp esi, dword [eax]
je 0x100449e8
mov dword [ebp - 0x640], 1
jmp 0x100449ef
and dword [ebp - 0x640], 0
push 3
lea ecx, [ebp - 0x420]
call fcn.100163a4
mov ecx, dword [ebp - 0x640]
cmp ecx, dword [eax]
je 0x10044a12
mov dword [ebp - 0x3d0], 1
jmp 0x10044a19
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x10b0], ecx
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xb24], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.10016388
lea eax, [ebp - 0xa50]
push eax
lea ecx, [ebp - 0x1148]
call fcn.10020022
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb34], eax
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xb34]
call fcn.100376a1
mov dword [0x108f0060], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1148]
call fcn.10016293
and dword [ebp - 0x2f4], 0
jmp 0x10044aac
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xe
jae 0x10044e99
mov dword [ebp - 0x5c], 0xc93b4e1
mov dword [ebp - 0xcd0], 9
mov dword [ebp - 0xccc], 9
mov dword [ebp - 0xcc8], 9
mov dword [ebp - 0xcc4], 9
lea ecx, [ebp - 0x381]
call fcn.100163b3
push eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xcd0]
push eax
lea ecx, [ebp - 0x10a0]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf0c]
call fcn.10016362
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x5c], 0x11
jmp 0x10044b34
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffffc
jge 0x10044e77
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x670], 0xffffffff
push 2
lea ecx, [ebp - 0xdac]
call fcn.10016326
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x26c], 0
jmp 0x10044b79
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x10044b98
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xdac]
call fcn.100163a4
or dword [eax], 0xffffffff
jmp 0x10044b6c
mov dword [ebp - 0x4c], 0
jmp 0x10044ba8
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 9
jge 0x10044d28
mov dword [ebp - 0xb8], 0xfffffff6
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xdf8], eax
cmp dword [ebp - 0xb8], 6
jne 0x10044be3
mov eax, dword [ebp - 0x5c]
dec eax
je 0x10044be3
mov dword [ebp - 0x808], 1
jmp 0x10044bea
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0x501874da
jg 0x10044c02
mov dword [ebp - 0x648], 1
jmp 0x10044c09
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jne 0x10044c23
mov dword [ebp - 0x908], 1
jmp 0x10044c2a
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 6
jb 0x10044c48
cmp dword [ebp - 0xb8], 0
je 0x10044c48
mov dword [ebp - 0x650], 1
jmp 0x10044c4f
and dword [ebp - 0x650], 0
imul eax, dword [ebp - 0x650], 0x64f6
test eax, eax
jne 0x10044c6f
cmp dword [ebp - 0xb8], 0
jne 0x10044c6f
and dword [ebp - 0xc40], 0
jmp 0x10044c79
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0x4c], 0xffffffff
jae 0x10044c8b
mov dword [ebp - 0x810], 1
jmp 0x10044c92
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x810], eax
jne 0x10044ce5
mov dword [ebp - 0xb8], 0x13
jmp 0x10044cb6
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 7
jg 0x10044ce3
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x10044ce1
push 0x8ae
push 0x1966
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x10044ca9
jmp 0x10044cfc
mov dword [ebp - 0x658], 0x59ec1348
mov eax, dword [ebp - 0x658]
dec eax
mov dword [ebp - 0x658], eax
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x10044d23
push 0x16d9
push 0x49f
push 0x22bb
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x10044ba1
mov dword [ebp - 0x4c], 0xffffffef
jmp 0x10044d38
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x17
jne 0x10044e63
mov dword [ebp - 0x164], 0x5dbc2a41
mov dword [ebp - 0x818], 0xad9236f9
mov dword [ebp - 0x164], 1
cmp dword [ebp - 0x164], 0
jne 0x10044d7b
cmp dword [ebp - 0x164], 0
jne 0x10044d7b
and dword [ebp - 0x910], 0
jmp 0x10044d85
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x910], eax
jne 0x10044d9f
mov dword [ebp - 0x660], 1
jmp 0x10044da6
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
imul eax, dword [ebp - 0x670]
imul eax, eax, 0xa5b4
cmp eax, dword [ebp - 0x4c]
jl 0x10044ddc
mov dword [ebp - 0x668], 1
jmp 0x10044de3
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x164]
imul eax, dword [ebp - 0x668]
test eax, eax
je 0x10044e12
push 0
lea ecx, [ebp - 0xdac]
call fcn.100163a4
cmp dword [eax], 0
je 0x10044e12
mov dword [ebp - 0x954], 1
jmp 0x10044e19
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x954]
mov ecx, dword [ebp - 0x164]
sub ecx, eax
je 0x10044e42
cmp dword [ebp - 0x670], 0
je 0x10044e42
mov dword [ebp - 0x820], 1
jmp 0x10044e49
and dword [ebp - 0x820], 0
push 1
lea ecx, [ebp - 0xf0c]
call fcn.100163a4
mov ecx, dword [ebp - 0x820]
mov dword [eax], ecx
jmp 0x10044d31
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xdac]
call fcn.10016388
jmp 0x10044b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0c]
call fcn.10016388
mov eax, dword [ebp - 0x2f4]
mov byte [ebp + eax - 0xa50], 0
jmp 0x10044a9f
push 3
lea ecx, [ebp - 0x484]
call fcn.10016326
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x44], 0xfaaaeb9a
mov dword [ebp - 0x60], 0
jmp 0x10044ec4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10044ee0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x484]
call fcn.100163a4
mov dword [eax], 0xfff6
jmp 0x10044ebd
mov dword [ebp - 0x60], 0
jmp 0x10044ef0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10044f06
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x8e8], 0xffffffff
jmp 0x10044ee9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8e8], 2
jmp 0x10044f34
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8e8], 0
jl 0x10044f77
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x10044f63
push 0
push 0x1a14
call dword [sym.imp.GDI32.dll_SetTextColor]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8e8], 0
je 0x10044f75
jmp 0x10044f19
jmp 0x10044f19
mov dword [ebp - 0x44], 0
jmp 0x10044f87
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x100450ad
mov dword [ebp - 0xc1c], 0xfffffffb
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10044fd7
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
push 1
lea ecx, [ebp - 0x484]
call fcn.100163a4
or eax, 0xffffffff
jne 0x10044fd7
and dword [ebp - 0xc60], 0
jmp 0x10044fe1
mov dword [ebp - 0xc60], 1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
cmp dword [ebp - 0x44], 0x1355
jne 0x10045004
mov dword [ebp - 0x678], 1
jmp 0x1004500b
and dword [ebp - 0x678], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
imul eax, dword [eax], 0x58e1
cmp eax, dword [ebp - 0x678]
jle 0x10045033
mov dword [ebp - 0x8fc], 1
jmp 0x1004503a
and dword [ebp - 0x8fc], 0
mov esi, dword [ebp - 0x44]
add esi, dword [ebp - 0x8fc]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
cmp esi, dword [eax]
jg 0x10045061
mov dword [ebp - 0x680], 1
jmp 0x10045068
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 5
jne 0x1004507d
mov dword [ebp - 0x828], 1
jmp 0x10045084
and dword [ebp - 0x828], 0
mov esi, dword [ebp - 0x828]
sub esi, 0xa130
push dword [ebp - 0x44]
lea ecx, [ebp - 0x484]
call fcn.100163a4
mov eax, dword [eax]
sub eax, esi
mov dword [ebp - 0xc1c], eax
jmp 0x10044f80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.10016388
push 2
lea ecx, [ebp - 0xd88]
call fcn.10016326
mov dword [ebp - 4], 0x17
push 2
lea ecx, [ebp - 0xa40]
call fcn.10016326
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x74], 0
jmp 0x100450f1
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1004510a
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd88]
call fcn.100163a4
and dword [eax], 0
jmp 0x100450ea
mov dword [ebp - 0x74], 0
jmp 0x1004511a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10045133
push dword [ebp - 0x74]
lea ecx, [ebp - 0xa40]
call fcn.100163a4
and dword [eax], 0
jmp 0x10045113
push 0
lea ecx, [ebp - 0xa40]
call fcn.100163a4
and dword [eax], 0
jmp 0x10045169
push 0
lea ecx, [ebp - 0xa40]
call fcn.100163a4
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x688]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x688]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa40]
call fcn.100163a4
cmp dword [eax], 2
jge 0x1004519d
push 0
lea ecx, [ebp - 0xa40]
call fcn.100163a4
push dword [eax]
lea ecx, [ebp - 0xd88]
call fcn.100163a4
mov dword [eax], 6
jmp 0x10045145
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa40]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd88]
call fcn.10016388
push 2
lea ecx, [ebp - 0x9d0]
call fcn.10016326
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x78], 0x18d4081c
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x274], 0
jmp 0x100451f9
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x10045218
push dword [ebp - 0x274]
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
or dword [eax], 0xffffffff
jmp 0x100451ec
mov dword [ebp - 0x78], 0
jmp 0x10045228
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jg 0x1004546b
mov dword [ebp - 0x374], 0xbf2465cd
mov dword [ebp - 0xe00], 1
mov dword [ebp - 0xe08], 0x2ba8d7d2
mov dword [ebp - 0xe10], 0x98737a30
mov dword [ebp - 0xe18], 0x18de0f4c
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
mov esi, eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
mov eax, dword [eax]
sub eax, dword [esi]
jne 0x100452a4
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
cmp dword [eax], 0
jne 0x100452a4
and dword [ebp - 0x9a8], 0
jmp 0x100452ae
mov dword [ebp - 0x9a8], 1
mov esi, dword [ebp - 0x78]
push 1
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
mov eax, dword [eax]
add eax, 0xb74c
cmp eax, esi
jl 0x100452d5
mov dword [ebp - 0xba0], 1
jmp 0x100452dc
and dword [ebp - 0xba0], 0
cmp dword [ebp - 0x9a8], 0x33c2251
jle 0x100452f4
mov dword [ebp - 0x690], 1
jmp 0x100452fb
and dword [ebp - 0x690], 0
mov esi, dword [ebp - 0x690]
add esi, 6
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d0]
call fcn.100163a4
mov dword [eax], esi
mov dword [ebp - 0x374], 0
jmp 0x1004532d
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jle 0x10045466
mov dword [ebp - 0x27c], 0x6ebf4d39
mov dword [ebp - 0xe20], 0x69be541
mov dword [ebp - 0xe28], 0xbed562b9
mov dword [ebp - 0xe30], 0x2910a83a
mov dword [ebp - 0xe38], 0x56a218f0
mov dword [ebp - 0xe40], 7
mov dword [ebp - 0xe48], 0x7a2e4284
mov dword [ebp - 0xe50], 0x5fe57b6a
mov dword [ebp - 0xe58], 1
mov dword [ebp - 0xe60], 0x3ed86378
mov dword [ebp - 0xe68], 0x325a46e4
mov dword [ebp - 0x27c], 0
jmp 0x100453c1
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jg 0x10045443
mov dword [ebp - 0xe70], 0xabb75da2
mov dword [ebp - 0xe78], 0xfffffffe
mov dword [ebp - 0xe80], 0x9b6cd04c
mov dword [ebp - 0xe88], 0xfffffff8
mov dword [ebp - 0xe90], 8
mov dword [ebp - 0x2fc], 0
jmp 0x10045415
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x10045431
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xe98], 0xfffffff7
jmp 0x10045408
mov eax, dword [ebp - 0x830]
dec eax
mov dword [ebp - 0x830], eax
jmp 0x100453b4
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10045461
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x10045320
jmp 0x10045221
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.10016388
mov byte [ebp - 0x1fc], 0xb
mov byte [ebp - 0x1fb], 0xa1
mov byte [ebp - 0x1fa], 0xa
mov byte [ebp - 0x1f9], 0x16
mov byte [ebp - 0x1f8], 3
mov byte [ebp - 0x1f7], 4
mov byte [ebp - 0x1f6], 4
mov byte [ebp - 0x1f5], 0x15
mov byte [ebp - 0x1f4], 7
mov byte [ebp - 0x1f3], 6
mov byte [ebp - 0x1f2], 1
mov byte [ebp - 0x1f1], 0
mov byte [ebp - 0x1f0], 9
mov byte [ebp - 0x1ef], 0x11
mov byte [ebp - 0x1ee], 5
mov byte [ebp - 0x1ed], 6
mov byte [ebp - 0x1ec], 2
mov byte [ebp - 0x1eb], 0
mov byte [ebp - 0x1ea], 8
mov byte [ebp - 0x1e9], 0xa
mov byte [ebp - 0x1e8], 0
mov byte [ebp - 0x1e7], 0x2c
mov byte [ebp - 0x1e6], 0xc
mov byte [ebp - 0x1e5], 0x30
mov byte [ebp - 0x1e4], 4
mov byte [ebp - 0x1e3], 0x2c
mov byte [ebp - 0x1e2], 0x1f
mov byte [ebp - 0x1e1], 0xb3
mov byte [ebp - 0x1e0], 0xb8
mov byte [ebp - 0x1df], 0xd
mov byte [ebp - 0x1de], 0x24
mov byte [ebp - 0x1dd], 6
mov byte [ebp - 0x1dc], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1fc]
and eax, 0xd2
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1fc]
or ecx, 0xd2
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1fc]
mov byte [ebp + eax - 0xc70], cl
mov dword [ebp - 0x698], 0x281a
mov dword [ebp - 0xb38], 0x10008dd0
cmp dword [ebp - 0x698], 0x2a3b
jle 0x100456ab
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
and dword [ebp - 0x28c], 0
jmp 0x100455e5
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x4b46
jge 0x100456ab
and dword [ebp - 0x304], 0
jmp 0x1004560b
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x2bfc
jge 0x100456a6
and dword [ebp - 0x284], 0
jmp 0x10045631
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0x5569
jge 0x100456a1
and dword [ebp - 0x33c], 0
jmp 0x10045653
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x6aa4
jge 0x1004569f
mov eax, dword [ebp - 0x284]
imul eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x28c]
and ecx, dword [ebp - 0x304]
or eax, ecx
cdq
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb8c], edx
push dword [ebp - 0xb8c]
push dword [ebp - 0xb90]
mov ecx, 0x106127f8
call fcn.1001600c
jmp 0x10045646
jmp 0x10045624
jmp 0x100455fe
jmp 0x100455d8
mov dword [ebp - 0x80], 0
jmp 0x100456bb
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x100456d1
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x980], 8
jmp 0x100456b4
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x698], 0x24df
jge 0x100456f4
mov edx, dword [ebp - 0xb38]
mov ecx, 0x106127f8
call fcn.1001a94a
jmp 0x10045710
or dword [ebp - 4], 0xffffffff
jmp 0x1004571a
mov dword [ebp - 0x80], 0
jmp 0x1004572a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10045740
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x95c], 0xd976ff55
jmp 0x10045723
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x980], 0
jmp 0x1004576e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x980]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x980], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x980], 0xffffffe6
jl 0x10045ad5
mov dword [ebp - 0xd4], 0x2961c0f8
mov dword [ebp - 0x6c8], 0xb49
mov dword [ebp - 0x6b8], 0x7ab83de3
mov dword [ebp - 0x914], 0
mov dword [ebp - 0xd4], 0
jmp 0x100457c3
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x10045ad0
mov dword [ebp - 0x1b0], 0x4279c418
mov dword [ebp - 0x838], 0x44184eb3
mov dword [ebp - 0xa80], 0xdf20be86
mov dword [ebp - 0x1b0], 0
jmp 0x10045807
cmp dword [ebp - 0x1b0], 0
jg 0x10045acb
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x6c0], 0x56e3f0e2
mov dword [ebp - 0x9a0], 0xfffffff7
mov dword [ebp - 0x6e0], 0xf577
mov dword [ebp - 0x6c], 0
jmp 0x10045849
cmp dword [ebp - 0x6c], 0
jl 0x10045aa5
jmp 0x100457b6
jmp 0x10045753
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10045aef
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x38], 2
and dword [ebp - 0x2c4], 0
jmp 0x10045b07
cmp dword [ebp - 0x38], 0x21
jae 0x10046462
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1fc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x38], eax
jne 0x10046238
mov dword [ebp - 0x294], 0x9b55bb2c
mov dword [ebp - 0xeec], 0xfffffff6
push 2
lea ecx, [ebp - 0xdb8]
call fcn.10016326
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x90], 0
jmp 0x10045b6d
cmp dword [ebp - 0x90], 1
jge 0x10045b89
push 3
lea ecx, [ebp - 0xf3c]
call fcn.10016326
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x1a4], 9
mov dword [ebp - 0x36c], 0
jmp 0x1004626f
cmp dword [ebp - 0x36c], 3
jge 0x10046291
mov dword [ebp - 0xfb0], 0x5e7a
mov dword [ebp - 0xddc], 0xfffffff6
mov dword [ebp - 0xf00], 0xffffffff
mov dword [ebp - 0xd5c], 0x2304b25b
mov dword [ebp - 0xd58], 0x2304b25b
mov dword [ebp - 0xd54], 0x2304b25b
mov dword [ebp - 0xd50], 0x2304b25b
lea ecx, [ebp - 0x411]
call fcn.100163b3
push eax
lea eax, [ebp - 0xd4c]
push eax
lea eax, [ebp - 0xd5c]
push eax
lea ecx, [ebp - 0x1110]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1080]
call fcn.10016362
mov dword [ebp - 4], 0x24
push 3
lea ecx, [ebp - 0xf5c]
call fcn.10016326
mov byte [ebp - 4], 0x25
mov dword [ebp - 0xde4], 0x57ea
mov dword [ebp - 0x710], 0xfffffffe
mov dword [ebp - 0x1044], 1
mov dword [ebp - 0x20c], 0
jmp 0x1004652c
cmp dword [ebp - 0x20c], 3
jge 0x1004654e
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xf5c]
call fcn.100163a4
mov dword [eax], 0x58d020bd
jmp 0x1004651f
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xf5c]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1080]
call fcn.10016388
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xc70], 0
mov dword [ebp - 0xa90], 1
mov dword [ebp - 0xbc0], 0x6915a136
push 1
lea ecx, [ebp - 0xf6c]
call fcn.10016326
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x218], 0
jmp 0x100465c8
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x924], 0x55ebda18
mov dword [ebp - 0xaa8], 0xae73598
mov dword [ebp - 0xab0], 0xfffffffd
mov dword [ebp - 0x238], 0
jmp 0x10046802
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1004681e
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x380], 0xfffffffe
jmp 0x100467f5
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10046836
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x40], 0
jmp 0x10046846
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x100469f2
mov dword [ebp - 0xd8], 0x7a81a82e
mov dword [ebp - 0xc30], 0x45beac3e
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x380]
mov dword [ebp - 0xdec], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x380]
mov dword [ebp - 0xf10], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x380]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x380], 3
jae 0x100468ad
mov dword [ebp - 0x3e8], 1
jmp 0x100468b4
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x380], ecx
cmp dword [ebp - 0x3e8], 0xfffffff9
jne 0x100468d9
mov dword [ebp - 0xaa0], 1
jmp 0x100468e0
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xfd0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x380]
imul eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0xd8]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
add eax, dword [ebp - 0xd8]
jne 0x10046925
xor eax, eax
inc eax
jne 0x10046925
and dword [ebp - 0x720], 0
jmp 0x1004692f
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x720], eax
jne 0x10046949
mov dword [ebp - 0xbd0], 1
jmp 0x10046950
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x380]
cmp eax, dword [ebp - 0x40]
jg 0x1004697e
push 9
pop eax
test eax, eax
je 0x1004697e
mov dword [ebp - 0x878], 1
jmp 0x10046985
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0xc30]
cmp dword [ebp - 0x878], eax
jle 0x1004699f
mov dword [ebp - 0x728], 1
jmp 0x100469a6
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x728], eax
jg 0x100469c0
mov dword [ebp - 0x974], 1
jmp 0x100469c7
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xd8], 0xb8e00457
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x40]
mov dword [ebp + ecx*4 - 0x380], eax
jmp 0x1004683f
mov eax, dword [0x108f0060]
cmp eax, dword [ebp - 0x340]
je 0x10046a0c
mov eax, dword [0x108f0248]
cmp eax, dword [ebp - 0x340]
jne 0x10046a24
mov ecx, dword [ebp + 0xc]
call fcn.10015d52
push eax
push dword [ebp + 8]
call fcn.1003e06d
pop ecx
pop ecx
jmp 0x10049fd7
push 3
lea ecx, [ebp - 0xb74]
call fcn.10016326
mov dword [ebp - 4], 0x29
mov dword [ebp - 0xa0], 0
jmp 0x10046a51
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10046a73
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xb74]
call fcn.100163a4
mov dword [eax], 0xff0ea75c
jmp 0x10046a44
mov dword [ebp - 0xa0], 0
jmp 0x10046a8c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x10046aa8
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x470], 0x7df2f4a8
jmp 0x10046a7f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x470], 0
jmp 0x10046ad6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x470]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x470], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x470], 2
jg 0x10046bc9
mov dword [ebp - 0x240], 0xc3eee2fd
mov dword [ebp - 0x240], 0
jmp 0x10046b0d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x10046b8e
mov dword [ebp - 0x248], 0x8999d94b
mov dword [ebp - 0x248], 2
jmp 0x10046b39
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x10046b89
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x1a8], 0
jmp 0x10046b65
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x10046b87
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xb74]
call fcn.100163a4
mov dword [eax], 0xfffffff8
jmp 0x10046b58
jmp 0x10046b2c
jmp 0x10046b00
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x470]
lea ecx, [ebp - 0xb74]
call fcn.100163a4
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x470]
lea ecx, [ebp - 0xb74]
call fcn.100163a4
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10046abb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.10016388
mov eax, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x250], 0
jmp 0x10046bfa
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x10046c16
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x258], 2
jmp 0x10046bed
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10046c32
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x258], 0
jmp 0x10046c60
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x258], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x258], 0xffffffe3
jl 0x10046d0d
mov dword [ebp - 0x194], 0x5cd53bc6
mov dword [ebp - 0x260], 0
jmp 0x10046c97
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x10046cb3
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xc38], 0xffff
jmp 0x10046c8a
mov dword [ebp - 0x194], 0
jmp 0x10046ccc
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x10046ce9
mov eax, dword [ebp - 0x194]
cmp dword [ebp + eax*4 - 0xc38], 0
je 0x10046ce7
jmp 0x10046ce9
jmp 0x10046cbf
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10046d08
push 0
push 0x1a4a
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10046c45
cmp dword [ebp - 0x270], 0
je 0x10049e3f
mov eax, dword [ebp - 0x270]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10049e3f
push 3
lea ecx, [ebp - 0x448]
call fcn.10016326
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xe0], 0xb1cecb45
mov dword [ebp - 0xbe4], 0
mov dword [ebp - 0x268], 0
jmp 0x10046d6f
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x10046d91
push dword [ebp - 0x268]
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov dword [eax], 0xb3c6
jmp 0x10046d62
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10046dab
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xe0], 2
jmp 0x10046dc4
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x100471ec
or dword [ebp - 0xce4], 0xffffffff
or dword [ebp - 0xce0], 0xffffffff
or dword [ebp - 0xcdc], 0xffffffff
or dword [ebp - 0xcd8], 0xffffffff
lea ecx, [ebp - 0x3e9]
call fcn.100163b3
push eax
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0xce4]
push eax
lea ecx, [ebp - 0x1118]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x490]
call fcn.10016362
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0xab8], 0xc1464f16
mov dword [ebp - 0xac0], 3
mov dword [ebp - 0xc3c], 2
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
mov dword [eax], 2
jmp 0x10046e7d
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x730]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x730]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
cmp dword [eax], 0
jl 0x100471cc
push 2
lea ecx, [ebp - 0xca0]
call fcn.10016326
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0xac8], 0xa4087b33
mov dword [ebp - 0xa8], 0
jmp 0x10046ec7
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10046ee9
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xca0]
call fcn.100163a4
mov dword [eax], 0x82b357f0
jmp 0x10046eba
mov dword [ebp - 0xa8], 0
jmp 0x10046f02
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10046f1e
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xeac], 0xb416c28c
jmp 0x10046ef5
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
push dword [eax]
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0xab8], eax
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
push dword [eax]
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov eax, dword [eax]
neg eax
cmp eax, 0xffffffff
jle 0x10046f6f
mov dword [ebp - 0xbdc], 1
jmp 0x10046f76
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf20], eax
push 2
lea ecx, [ebp - 0x448]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10046fb6
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10046fb6
push 1
lea ecx, [ebp - 0x490]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10046fb6
and dword [ebp - 0x498], 0
jmp 0x10046fc0
mov dword [ebp - 0x498], 1
cmp dword [ebp - 0x498], 0x534a
je 0x10046fd8
mov dword [ebp - 0x49c], 1
jmp 0x10046fdf
and dword [ebp - 0x49c], 0
push 0
lea ecx, [ebp - 0xca0]
call fcn.100163a4
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [eax]
jne 0x10047008
cmp dword [ebp - 0xac0], 0
jne 0x10047008
and dword [ebp - 0x4a4], 0
jmp 0x10047012
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0xc3c]
cmp dword [ebp - 0x4a4], eax
jl 0x1004702c
mov dword [ebp - 0x494], 1
jmp 0x10047033
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0x688c
jg 0x1004704b
mov dword [ebp - 0x4b4], 1
jmp 0x10047052
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov ecx, dword [ebp - 0x4b4]
add ecx, dword [eax]
je 0x10047094
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
push dword [eax]
lea ecx, [ebp - 0x448]
call fcn.100163a4
cmp dword [eax], 0
je 0x10047094
mov dword [ebp - 0x4bc], 1
jmp 0x1004709b
and dword [ebp - 0x4bc], 0
push 0
lea ecx, [ebp - 0x490]
call fcn.100163a4
mov ecx, dword [ebp - 0x4bc]
cmp ecx, dword [eax]
jg 0x100470be
mov dword [ebp - 0x3f0], 1
jmp 0x100470c5
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp + eax - 0xeac], ecx
cmp dword [ebp - 0x3f0], 0
jne 0x100470fc
push 0
lea ecx, [ebp - 0x448]
call fcn.100163a4
cmp dword [eax], 0
jne 0x100470fc
and dword [ebp - 0x4c4], 0
jmp 0x10047106
mov dword [ebp - 0x4c4], 1
cmp dword [ebp - 0x4c4], 0
jg 0x1004711b
mov dword [ebp - 0x4cc], 1
jmp 0x10047122
and dword [ebp - 0x4cc], 0
push 2
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov ecx, dword [ebp - 0x4cc]
cmp ecx, dword [eax]
jg 0x10047145
mov dword [ebp - 0x4d4], 1
jmp 0x1004714c
and dword [ebp - 0x4d4], 0
push 1
lea ecx, [ebp - 0xca0]
call fcn.100163a4
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [eax]
jg 0x1004716f
mov dword [ebp - 0x4dc], 1
jmp 0x10047176
and dword [ebp - 0x4dc], 0
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x448]
call fcn.100163a4
mov eax, dword [eax]
sub eax, dword [ebp - 0x4dc]
push 6
pop ecx
sub ecx, eax
cmp ecx, 0xfffffffd
jb 0x100471a5
mov dword [ebp - 0x4e4], 1
jmp 0x100471ac
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0xac8], eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xca0]
call fcn.10016388
jmp 0x10046e59
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xbe4], eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x490]
call fcn.10016388
jmp 0x10046db7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.10016388
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x270]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x198]
cmp dword [eax], 0x4550
jne 0x10049e3f
mov eax, dword [ebp - 0x198]
cmp dword [eax + 0x74], 0
jbe 0x10049e3f
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x198]
cmp dword [ecx + eax + 0x78], 0
je 0x10049e3f
mov dword [ebp - 0x1ac], 0x2e31d832
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0xcf8], 0x8f4727ca
mov dword [ebp - 0xcf4], 0x8f4727ca
mov dword [ebp - 0xcf0], 0x8f4727ca
mov dword [ebp - 0xcec], 0x8f4727ca
lea ecx, [ebp - 0x38d]
call fcn.100163b3
push eax
lea eax, [ebp - 0xce8]
push eax
lea eax, [ebp - 0xcf8]
push eax
lea ecx, [ebp - 0x10f0]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x990]
call fcn.10016362
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x53c], 0x13f4b1a2
mov dword [ebp - 0xe04], 7
cmp dword [ebp - 0x1ac], 0xffffffff
jl 0x1004732b
cmp dword [ebp - 0x1ac], 0
jne 0x10047303
cmp dword [ebp - 0x1ac], 0
jne 0x10047303
and dword [ebp - 0x4ec], 0
jmp 0x1004730d
mov dword [ebp - 0x4ec], 1
imul eax, dword [ebp - 0x4ec], 0xc590
cmp dword [ebp - 0x1ac], eax
jge 0x1004732b
mov dword [ebp - 0x4f4], 1
jmp 0x10047332
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0xec3d
jne 0x100473da
mov dword [ebp - 0xdd4], 0xfffffffb
mov dword [ebp - 0xe0c], 0xa278c007
mov dword [ebp - 0xf30], 0x26c12a7b
mov dword [ebp - 0xe14], 0x3f1571c0
mov dword [ebp - 0x4fc], 0xfffffff9
mov dword [ebp - 0x278], 0
jmp 0x1004738d
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 4
jge 0x100473a9
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x1194], 0x421dd2eb
jmp 0x10047380
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x100473c8
push 0x1ad7
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
jmp 0x1004781b
mov dword [ebp - 0x2a8], 0x3f36fc75
mov dword [ebp - 0x574], 0x1ca0702d
mov dword [ebp - 0xbec], 0
mov byte [ebp - 0xf4], 0
mov dword [ebp - 0x504], 0x7c7e
mov dword [ebp - 0xad0], 0x10008ebc
cmp dword [ebp - 0x504], 0x7cef
jle 0x100474cb
and dword [ebp - 0x280], 0
jmp 0x10047439
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x490d
jge 0x100474cb
and dword [ebp - 0x288], 0
jmp 0x1004745f
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x3342
jge 0x100474c6
and dword [ebp - 0x290], 0
jmp 0x10047481
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x54d7
jge 0x100474c4
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x288]
xor eax, dword [ebp - 0x290]
cdq
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xa68], edx
push dword [ebp - 0xa68]
push dword [ebp - 0xa6c]
mov ecx, 0x106127f8
call fcn.1001600c
jmp 0x10047474
jmp 0x10047452
jmp 0x1004742c
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x100474ee
push 0x288
push 0
push 0
push 0
push 0
push 0x2003
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x2e
cmp dword [ebp - 0x504], 0x7ae9
jge 0x1004750e
mov edx, dword [ebp - 0xad0]
mov ecx, 0x106127f8
call fcn.1001a94a
jmp 0x1004752a
mov dword [ebp - 4], 0x2d
jmp 0x1004753a
cmp dword [ebp - 0x298], 0
jne 0x100475f8
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x298]
jge 0x10047561
mov dword [ebp - 0x50c], 1
jmp 0x10047568
and dword [ebp - 0x50c], 0
push 2
lea ecx, [ebp - 0x990]
call fcn.100163a4
cmp dword [eax], 0
jbe 0x10047586
mov dword [ebp - 0x514], 1
jmp 0x1004758d
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x514]
jge 0x100475a7
mov dword [ebp - 0x51c], 1
jmp 0x100475ae
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
add eax, 0x63c3455a
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x9c]
je 0x100475eb
push 0
lea ecx, [ebp - 0x990]
call fcn.100163a4
cmp dword [eax], 0
je 0x100475eb
mov dword [ebp - 0x524], 1
jmp 0x100475f2
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x298], 0x3767
jne 0x10047650
mov dword [ebp - 0xc24], 0xe816
mov dword [ebp - 0x9c], 0
jmp 0x10047627
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1004764b
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x990]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0xc24], eax
jmp 0x1004761a
jmp 0x1004781b
mov dword [ebp - 0x2a0], 0xfffffffe
cmp dword [ebp - 0x298], 0
jne 0x1004772c
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x53c]
jne 0x10047681
mov dword [ebp - 0x52c], 1
jmp 0x10047688
and dword [ebp - 0x52c], 0
push 3
lea ecx, [ebp - 0x990]
call fcn.100163a4
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jg 0x100476ab
mov dword [ebp - 0x534], 1
jmp 0x100476b2
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
sub eax, 0xe5d
cmp eax, dword [ebp - 0x53c]
cmp dword [ebp - 0x2a0], 0xfffffff6
jle 0x100476d8
mov dword [ebp - 0x544], 1
jmp 0x100476df
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x9c], eax
mov esi, dword [ebp - 0x9c]
push 3
lea ecx, [ebp - 0x990]
call fcn.100163a4
cmp dword [eax], esi
jg 0x1004770e
mov dword [ebp - 0x54c], 1
jmp 0x10047715
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x54c], eax
jg 0x1004772c
and dword [ebp - 0x554], 0
jmp 0x10047736
mov dword [ebp - 0x554], 1
push 3
lea ecx, [ebp - 0x990]
call fcn.100163a4
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
je 0x10047759
mov dword [ebp - 0x55c], 1
jmp 0x10047760
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x55c], eax
jne 0x1004777a
mov dword [ebp - 0xad8], 1
jmp 0x10047781
and dword [ebp - 0xad8], 0
mov esi, dword [ebp - 0x2a0]
push 0
lea ecx, [ebp - 0x990]
call fcn.100163a4
add esi, dword [eax]
cmp dword [ebp - 0x2a8], esi
jge 0x100477aa
mov dword [ebp - 0x564], 1
jmp 0x100477b1
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x564], eax
jle 0x100477cb
mov dword [ebp - 0x56c], 1
jmp 0x100477d2
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xfffffff8
jle 0x100477e7
mov dword [ebp - 0x57c], 1
jmp 0x100477ee
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x57c], eax
jge 0x10047808
mov dword [ebp - 0x584], 1
jmp 0x1004780f
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xbec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x990]
call fcn.10016388
mov eax, dword [ebp + 8]
mov dword [ebp - 0x158], eax
push 1
lea ecx, [ebp - 0x460]
call fcn.10016326
mov dword [ebp - 4], 0x30
push 1
lea ecx, [ebp - 0xa00]
call fcn.10016326
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x144], 0
mov dword [ebp - 0xae0], 1
push 3
lea ecx, [ebp - 0xc88]
call fcn.10016326
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x18], 0
jmp 0x1004788d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100478a9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x460]
call fcn.100163a4
mov dword [eax], 0xfffd
jmp 0x10047886
mov dword [ebp - 0x18], 0
jmp 0x100478b9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100478d5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa00]
call fcn.100163a4
mov dword [eax], 0x2e56
jmp 0x100478b2
mov dword [ebp - 0x18], 0
jmp 0x100478e5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10047901
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc88]
call fcn.100163a4
mov dword [eax], 0xfffffffc
jmp 0x100478de
mov dword [ebp - 0x18], 0
jmp 0x10047911
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10047927
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xecc], 0x8aff
jmp 0x1004790a
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
cmp dword [eax], 0
je 0x10047946
push 0
lea ecx, [ebp - 0xa00]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
mov esi, eax
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10047981
mov dword [ebp - 0x58c], 1
jmp 0x10047988
and dword [ebp - 0x58c], 0
push 0
lea ecx, [ebp - 0xa00]
call fcn.100163a4
mov ecx, dword [ebp - 0x58c]
add ecx, dword [eax]
mov dword [ebp - 0x144], ecx
cmp dword [ebp - 0xae0], 0
je 0x100479b5
mov eax, 0x5b1b
test eax, eax
jne 0x100479d0
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
cmp dword [eax], 0
jne 0x100479d0
and dword [ebp - 0x594], 0
jmp 0x100479da
mov dword [ebp - 0x594], 1
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
mov esi, dword [ebp - 0x594]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xa00]
call fcn.100163a4
add esi, dword [eax]
imul esi, esi, 0x2466
push 1
lea ecx, [ebp - 0xc88]
call fcn.100163a4
mov dword [eax], esi
mov dword [ebp - 0x144], 0
jmp 0x10047a2c
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x13
jge 0x10047ca6
push 4
lea ecx, [ebp - 0x9e8]
call fcn.10016326
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x59c], 1
mov dword [ebp - 0x5d4], 0xc7d8169b
mov dword [ebp - 0x5dc], 0xfff6
mov dword [ebp - 0xae8], 0xe43c7d75
mov dword [ebp - 0x2b0], 0
jmp 0x10047a8b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x10047aad
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
mov dword [eax], 0x972737ae
jmp 0x10047a7e
push 0
lea ecx, [ebp - 0xa00]
call fcn.100163a4
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
push 3
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
mov eax, dword [eax]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0xfd8], eax
mov esi, dword [ebp - 0x144]
push 0
lea ecx, [ebp - 0x460]
call fcn.100163a4
cmp dword [eax], esi
jne 0x10047b1a
push 2
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10047b1a
and dword [ebp - 0x5a4], 0
jmp 0x10047b24
mov dword [ebp - 0x5a4], 1
mov eax, dword [ebp - 0x5a4]
neg eax
mov dword [ebp - 0x5ac], eax
push 2
lea ecx, [ebp - 0xc88]
call fcn.100163a4
mov ecx, dword [ebp - 0x5ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x5ac], eax
je 0x10047b61
mov dword [ebp - 0x5b4], 1
jmp 0x10047b68
and dword [ebp - 0x5b4], 0
mov esi, dword [ebp - 0x5dc]
push 0
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
mov ecx, dword [ebp - 0x5b4]
add ecx, dword [eax]
cmp ecx, esi
jle 0x10047b98
xor eax, eax
inc eax
je 0x10047b98
mov dword [ebp - 0x5bc], 1
jmp 0x10047b9f
and dword [ebp - 0x5bc], 0
push 0
lea ecx, [ebp - 0xa00]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5bc]
jge 0x10047bc2
mov dword [ebp - 0x5c4], 1
jmp 0x10047bc9
and dword [ebp - 0x5c4], 0
push 3
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
mov eax, dword [eax]
add eax, dword [ebp - 0x5c4]
jne 0x10047bee
xor eax, eax
inc eax
jne 0x10047bee
and dword [ebp - 0x3e4], 0
jmp 0x10047bf8
mov dword [ebp - 0x3e4], 1
push 3
lea ecx, [ebp - 0x9e8]
call fcn.100163a4
mov ecx, dword [ebp - 0x3e4]
mov dword [eax], ecx
cmp dword [ebp - 0x3e4], 0
jne 0x10047c22
mov dword [ebp - 0x5cc], 1
jmp 0x10047c29
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
sub eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x5dc]
jne 0x10047c49
mov dword [ebp - 0xc4c], 1
jmp 0x10047c50
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xe1c], eax
push 5
pop eax
test eax, eax
je 0x10047c78
mov eax, 0x4860c01e
test eax, eax
je 0x10047c78
mov dword [ebp - 0x5e4], 1
jmp 0x10047c7f
and dword [ebp - 0x5e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax - 0xecc], ecx
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x9e8]
call fcn.10016388
jmp 0x10047a1f
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xc88]
call fcn.10016388
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa00]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.10016388
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xc0], edx
mov eax, 0xffff
mov word [ebp - 0x70], ax
or dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0xf40], 1
mov dword [ebp - 0xe24], 0
mov dword [ebp - 0x1054], 0x61f6656
mov dword [ebp - 0xe2c], 0xffffffff
push 2
lea ecx, [ebp - 0xf7c]
call fcn.10016326
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x5ec], 0
mov dword [ebp - 0x204], 0
jmp 0x10047d5e
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x10047d80
push dword [ebp - 0x204]
lea ecx, [ebp - 0xf7c]
call fcn.100163a4
mov dword [eax], 0xe7d214c4
jmp 0x10047d51
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10047daf
push 0
push 0
push 0x23
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf7c]
call fcn.10016388
cmp dword [ebp + 0x10], 0
jbe 0x100481b3
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x100481ae
push 1
lea ecx, [ebp - 0x13c]
call fcn.10016326
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x208], 0
jmp 0x10047e18
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x10047e3a
push dword [ebp - 0x208]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov dword [eax], 0xa8ea
jmp 0x10047e0b
mov dword [ebp - 0x14], 0
jmp 0x10047e4a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10048190
mov dword [ebp - 0xc2c], 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], 0
je 0x10047e90
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10047e8b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1004818b
push 3
lea ecx, [ebp - 0xd94]
call fcn.10016326
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x624], 0x51dba1dd
mov dword [ebp - 0x2b8], 0
jmp 0x10047ec4
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10047ee6
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xd94]
call fcn.100163a4
mov dword [eax], 0xa1e94870
jmp 0x10047eb7
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov dword [ebp - 0x5f4], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov ecx, dword [ebp - 0x5f4]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd94]
call fcn.100163a4
mov ecx, dword [ebp - 0x5f4]
mov ecx, dword [ecx]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], esi
jg 0x10047f66
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10047f66
and dword [ebp - 0xbf4], 0
jmp 0x10047f70
mov dword [ebp - 0xbf4], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp esi, dword [eax]
jg 0x10047f9f
mov dword [ebp - 0x5fc], 1
jmp 0x10047fa6
and dword [ebp - 0x5fc], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov esi, dword [ebp - 0x5fc]
add esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp esi, dword [eax]
jg 0x10047fed
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], 0
je 0x10047fed
mov dword [ebp - 0x604], 1
jmp 0x10047ff4
and dword [ebp - 0x604], 0
mov esi, dword [ebp - 0x624]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov edi, dword [ebp - 0x604]
imul edi, dword [eax]
imul edi, esi
inc edi
push 0
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], edi
jle 0x10048032
mov dword [ebp - 0x60c], 1
jmp 0x10048039
and dword [ebp - 0x60c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov ecx, dword [ebp - 0x60c]
cmp ecx, dword [eax]
jge 0x1004805d
mov dword [ebp - 0x614], 1
jmp 0x10048064
and dword [ebp - 0x614], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x614]
jle 0x10048088
mov dword [ebp - 0x61c], 1
jmp 0x1004808f
and dword [ebp - 0x61c], 0
mov esi, dword [ebp - 0x61c]
sub esi, 0xcc90
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], esi
jle 0x100480b9
mov dword [ebp - 0xaf0], 1
jmp 0x100480c0
and dword [ebp - 0xaf0], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.100163a4
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0xf50], eax
mov eax, 0xefb6f65e
cmp eax, 0x219909d0
jbe 0x100480f1
mov dword [ebp - 0x62c], 1
jmp 0x100480f8
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x634], eax
mov esi, dword [ebp - 0x634]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp esi, dword [eax]
jne 0x10048138
push dword [ebp - 0x14]
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp dword [eax], 0
jne 0x10048138
and dword [ebp - 0x63c], 0
jmp 0x10048142
mov dword [ebp - 0x63c], 1
mov esi, dword [ebp - 0x63c]
neg esi
push 0
lea ecx, [ebp - 0x13c]
call fcn.100163a4
cmp esi, dword [eax]
je 0x10048167
mov dword [ebp - 0x644], 1
jmp 0x1004816e
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
neg eax
mov dword [ebp - 0xc2c], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xd94]
call fcn.10016388
jmp 0x10047e43
mov dword [ebp - 0x14], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.10016388
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x70], ax
jmp 0x1004939d
mov eax, dword [0x108f023c]
and eax, 1
jne 0x100481ea
mov eax, dword [0x108f023c]
or eax, 1
mov dword [0x108f023c], eax
mov dword [ebp - 4], 0x37
mov ecx, 0x108f01f0
call fcn.100164b7
push 0x1006bbd3
call fcn.10053659
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2d0], 0xfffffff7
mov dword [ebp - 0x48], 0x5cc48b16
mov dword [ebp - 0x19c], 0x5e3b372b
push 4
lea ecx, [ebp - 0xb9c]
call fcn.10016326
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x69c], 3
mov dword [ebp - 0x6a4], 0x71808adc
mov dword [ebp - 0xbfc], 0xda314325
mov dword [ebp - 0x2c0], 0
jmp 0x10048250
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 4
jge 0x10048272
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xb9c]
call fcn.100163a4
mov dword [eax], 0xf746e33
jmp 0x10048243
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x2d0]
jge 0x10048289
mov dword [ebp - 0x64c], 1
jmp 0x10048290
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xfffffffc
jle 0x100482b1
mov dword [ebp - 0x654], 1
jmp 0x100482b8
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
sub eax, dword [ebp - 0x48]
cmp eax, 7
jbe 0x100482d2
mov dword [ebp - 0x65c], 1
jmp 0x100482d9
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0x9b3a00d0
jne 0x100482f1
mov dword [ebp - 0xaf8], 1
jmp 0x100482f8
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0x48], 3
jbe 0x1004830a
mov dword [ebp - 0x664], 1
jmp 0x10048311
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x66c], eax
push 0
lea ecx, [ebp - 0xb9c]
call fcn.100163a4
mov ecx, dword [ebp - 0x66c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2d0]
add eax, dword [ebp - 0x66c]
cmp eax, dword [ebp - 0x2d0]
jne 0x10048355
mov dword [ebp - 0x674], 1
jmp 0x1004835c
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x674], eax
jne 0x10048373
mov dword [ebp - 0x67c], 1
jmp 0x1004837a
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
neg eax
jne 0x1004838e
cmp dword [ebp - 0x48], 0
je 0x10048514
push 2
lea ecx, [ebp - 0xb88]
call fcn.10016326
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x2c8], 0
jmp 0x100483b8
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x100483d7
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xb88]
call fcn.100163a4
and dword [eax], 0
jmp 0x100483ab
push 0
lea ecx, [ebp - 0xb88]
call fcn.100163a4
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xe34], eax
mov esi, dword [ebp - 0x2d0]
push 1
lea ecx, [ebp - 0xb88]
call fcn.100163a4
add esi, dword [eax]
cmp esi, 0xe511
je 0x10048419
mov dword [ebp - 0x684], 1
jmp 0x10048420
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
sub eax, dword [ebp - 0x48]
js 0x10048437
mov dword [ebp - 0x68c], 1
jmp 0x1004843e
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x68c], eax
jl 0x10048455
mov dword [ebp - 0x694], 1
jmp 0x1004845c
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0xffffffff
jb 0x10048489
mov dword [ebp - 0x6ac], 1
jmp 0x10048490
and dword [ebp - 0x6ac], 0
push 0
lea ecx, [ebp - 0xb88]
call fcn.100163a4
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax]
jne 0x100484b3
mov dword [ebp - 0x388], 1
jmp 0x100484ba
and dword [ebp - 0x388], 0
push 3
lea ecx, [ebp - 0xb9c]
call fcn.100163a4
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x388], eax
jle 0x100484e9
mov dword [ebp - 0x6b4], 1
jmp 0x100484f0
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x6b4]
mov dword [ebp - 0xbfc], eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xb88]
call fcn.10016388
jmp 0x10048562
push 1
lea ecx, [ebp - 0xb9c]
call fcn.100163a4
mov dword [eax], 0xf3922cbd
mov dword [ebp - 0x48], 0
jmp 0x10048537
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jne 0x10048562
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10048560
push 0
push 0
push 0xe2c
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x10048530
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.10016388
movzx eax, byte [0x108f0068]
test eax, eax
je 0x1004895a
mov ecx, 0x108f01f0
call fcn.1004c506
movzx eax, al
test eax, eax
jne 0x1004895a
mov dword [ebp - 0x2e0], 0x6cce57bf
mov dword [ebp - 0x2e8], 0xffffffff
mov dword [ebp - 0xfec], 0xeec299e
mov dword [ebp - 0x704], 8
mov dword [ebp - 0xe3c], 0x81320f2d
mov dword [ebp - 0xf60], 0xfffffff8
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xe44], 0xffffffff
mov dword [ebp - 0xd20], 0x7c869b7d
mov dword [ebp - 0xd1c], 0x7c869b7d
mov dword [ebp - 0xd18], 0x7c869b7d
mov dword [ebp - 0xd14], 0x7c869b7d
lea ecx, [ebp - 0x3c9]
call fcn.100163b3
push eax
lea eax, [ebp - 0xd10]
push eax
lea eax, [ebp - 0xd20]
push eax
lea ecx, [ebp - 0x1130]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf8c]
call fcn.10016362
mov dword [ebp - 4], 0x3a
mov dword [ebp - 0x38c], 0x9ca4f06
mov dword [ebp - 0x6d4], 1
mov dword [ebp - 0x6fc], 0x2afe2499
mov dword [ebp - 0x2d8], 0
jmp 0x10048680
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1004869c
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x178], 0
jmp 0x10048673
cmp dword [ebp - 0x2e0], 0
jne 0x100486d6
mov dword [ebp - 0x2e8], 0xfffe
cmp dword [ebp - 0x2e8], 0
jne 0x100486d6
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x1034], eax
cmp dword [ebp - 0x2e0], 0
jne 0x100486d6
and dword [ebp - 0x6bc], 0
jmp 0x100486e0
mov dword [ebp - 0x6bc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp + eax - 0x178], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x2e0]
jne 0x10048714
mov dword [ebp - 0x6dc], 1
jmp 0x1004871b
and dword [ebp - 0x6dc], 0
mov esi, dword [ebp - 0x38c]
push 2
lea ecx, [ebp - 0xf8c]
call fcn.100163a4
sub esi, dword [eax]
mov dword [ebp - 0xb00], esi
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0xb00]
cmp eax, dword [ebp - 0xc44]
jg 0x10048770
mov dword [ebp - 0x6c4], 1
jmp 0x10048777
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0xb187
je 0x1004878f
mov dword [ebp - 0x6cc], 1
jmp 0x10048796
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x6d4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6d4]
sub ecx, dword [ebp + eax - 0x178]
neg ecx
cmp ecx, dword [ebp - 0x704]
jl 0x100487cb
mov dword [ebp - 0x6e4], 1
jmp 0x100487d2
and dword [ebp - 0x6e4], 0
mov eax, 0xfff8
sub eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x6e4]
jl 0x100487fd
mov dword [ebp - 0x6ec], 1
jmp 0x10048804
and dword [ebp - 0x6ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x6ec]
je 0x10048825
mov dword [ebp - 0x6f4], 1
jmp 0x1004882c
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 0
je 0x10048856
cmp dword [ebp - 0x704], 0
je 0x10048856
mov dword [ebp - 0x70c], 1
jmp 0x1004885d
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xb08], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8c]
call fcn.10016388
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x714]
push eax
mov ecx, 0x108f01f0
call fcn.1001648f
mov dword [ebp - 0x2f0], 0xfffffff8
mov dword [ebp - 0x2f0], 0
jmp 0x100488b3
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x19
je 0x10048922
mov dword [ebp - 0x2f8], 0
jmp 0x100488d5
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x100488f1
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xc08], 0x654fddd3
jmp 0x100488c8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc08], 0xdf603fa7
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x10048920
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x100488a6
lea eax, [ebp - 0xe4c]
push eax
mov ecx, 0x108f01f0
call fcn.10016481
push eax
lea ecx, [ebp - 0x714]
call fcn.100164a4
movzx eax, al
test eax, eax
je 0x1004895a
lea ecx, [ebp - 0x714]
call fcn.1004c50f
mov eax, dword [eax + 4]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0xe8], 0x462d5e48
mov dword [ebp - 0x50], 0x76ab2aee
mov dword [ebp - 0x188], 0x8b166c19
mov dword [ebp - 0x300], 0
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0xd44], 1
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0xd3c], 1
lea ecx, [ebp - 0x3f5]
call fcn.100163b3
push eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0xd48]
push eax
lea ecx, [ebp - 0x10b8]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbac]
call fcn.10016362
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0xcbc], 0
mov dword [ebp - 0xcb8], 0
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0xcb0], 0
and dword [ebp - 0xd70], 0
and dword [ebp - 0xd6c], 0
and dword [ebp - 0xd68], 0
and dword [ebp - 0xd64], 0
lea ecx, [ebp - 0x3fd]
call fcn.100163b3
push eax
lea eax, [ebp - 0xd60]
push eax
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x1128]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd7c]
call fcn.10016362
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0xb20], 0x6cd9
mov dword [ebp - 0xe8], 0xd
jmp 0x10048a83
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff0
jl 0x10048aab
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10048aa9
push 0xaab
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x10048a76
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jg 0x10048ad1
mov dword [ebp - 0x734], 1
jmp 0x10048ad8
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x50], 7
jg 0x10048aea
mov dword [ebp - 0x71c], 1
jmp 0x10048af1
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x71c], eax
jne 0x10048b08
mov dword [ebp - 0x724], 1
jmp 0x10048b0f
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x188]
add eax, dword [ebp - 0x50]
cmp eax, 1
jne 0x10048b39
mov dword [ebp - 0x72c], 1
jmp 0x10048b40
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x734], eax
jl 0x10048b66
mov dword [ebp - 0x73c], 1
jmp 0x10048b6d
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x73c], eax
jle 0x10048b84
mov dword [ebp - 0x744], 1
jmp 0x10048b8b
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x300]
push 3
lea ecx, [ebp - 0xbac]
call fcn.100163a4
cmp esi, dword [eax]
jl 0x10048bb7
mov dword [ebp - 0x74c], 1
jmp 0x10048bbe
and dword [ebp - 0x74c], 0
push 1
lea ecx, [ebp - 0xbac]
call fcn.100163a4
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [eax]
je 0x10048be1
mov dword [ebp - 0x754], 1
jmp 0x10048be8
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0x940c9ba5
jne 0x10048c00
mov dword [ebp - 0x75c], 1
jmp 0x10048c07
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 4
je 0x10048c1c
mov dword [ebp - 0x764], 1
jmp 0x10048c23
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0x687f
jg 0x10048c3b
mov dword [ebp - 0x394], 1
jmp 0x10048c42
and dword [ebp - 0x394], 0
push 3
lea ecx, [ebp - 0xbac]
call fcn.100163a4
mov ecx, dword [ebp - 0x394]
mov dword [eax], ecx
cmp dword [ebp - 0x394], 0
je 0x10048d9e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcbc], 0
je 0x10048d9e
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x180], 0x5af849fb
push 7
pop eax
test eax, eax
je 0x10048d11
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0xf70], eax
cmp dword [ebp - 0x188], 0x7df7dc23
jg 0x10048cb7
mov dword [ebp - 0x774], 1
jmp 0x10048cbe
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x76c]
cmp eax, dword [ebp - 0x774]
jle 0x10048cd8
mov dword [ebp - 0x39c], 1
jmp 0x10048cdf
and dword [ebp - 0x39c], 0
push 0
lea ecx, [ebp - 0xd7c]
call fcn.100163a4
mov ecx, dword [ebp - 0x39c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x300]
add eax, dword [ebp - 0x39c]
cmp eax, 7
jl 0x10048d11
mov dword [ebp - 0x77c], 1
jmp 0x10048d18
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0xffff
ja 0x10048d30
mov dword [ebp - 0xb10], 1
jmp 0x10048d37
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0x180], 0xe7a32987
mov dword [ebp - 0x180], 0
jmp 0x10048d63
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffee
jle 0x10048d99
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x10048d97
push 0x64
push 0x262e
push 0x63e
push 0xb1c
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x10048d56
jmp 0x100490ea
mov dword [ebp - 0x784], 0x5e73
mov dword [ebp - 0xb18], 0x10008f1c
cmp dword [ebp - 0x784], 0x616e
jle 0x10048ec8
and dword [ebp - 0x320], 0
jmp 0x10048dd8
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x11ea
jge 0x10048ec8
and dword [ebp - 0x308], 0
jmp 0x10048dfe
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x14fb
jge 0x10048ec3
and dword [ebp - 0x310], 0
jmp 0x10048e24
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x6208
jge 0x10048ebe
and dword [ebp - 0x318], 0
jmp 0x10048e4a
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x72d5
jge 0x10048eb9
mov eax, dword [ebp - 0x308]
sub eax, dword [ebp - 0x310]
sub eax, dword [ebp - 0x318]
xor eax, dword [ebp - 0x320]
cdq
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa70], edx
push dword [ebp - 0xa70]
push dword [ebp - 0xa74]
lea ecx, [ebp - 0x1160]
call fcn.1000a593
pop ecx
pop ecx
mov dword [ebp - 0xc34], eax
mov ecx, dword [ebp - 0xc34]
call fcn.10015d52
push eax
call fcn.10053683
pop ecx
lea ecx, [ebp - 0x1160]
call fcn.10015d48
jmp 0x10048e3d
jmp 0x10048e17
jmp 0x10048df1
jmp 0x10048dcb
mov dword [ebp - 0xc14], 0xfffffff9
mov byte [ebp - 4], 0x3d
cmp dword [ebp - 0x784], 0x5bef
jge 0x10048eee
push dword [ebp - 0xb18]
call fcn.10053683
pop ecx
jmp 0x10048f0a
mov dword [ebp - 4], 0x3c
jmp 0x10048f1a
mov dword [ebp - 0xc48], 0x4440db5b
mov dword [ebp - 0x328], 0
jmp 0x10048f3d
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 4
jge 0x10048f59
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x10c8], 0xffffffff
jmp 0x10048f30
mov eax, 0xf904
test eax, eax
je 0x10048f80
push 2
lea ecx, [ebp - 0xbac]
call fcn.100163a4
cmp dword [eax], 0
je 0x10048f80
mov dword [ebp - 0x7a4], 1
jmp 0x10048f87
and dword [ebp - 0x7a4], 0
push 4
pop eax
imul eax, eax, 3
imul ecx, dword [ebp - 0x50], 0
cmp ecx, dword [ebp + eax - 0x10c8]
jge 0x10048fa6
mov dword [ebp - 0x78c], 1
jmp 0x10048fad
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0x50ec
jge 0x10048fc5
mov dword [ebp - 0x794], 1
jmp 0x10048fcc
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xfffffff8
jg 0x10048fea
cmp dword [ebp - 0xc14], 0
je 0x10048fea
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffff
jne 0x10049012
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xd7c]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbac]
call fcn.10016388
cmp dword [ebp - 0x150], 0xffffffff
jne 0x1004939d
push 2
lea ecx, [ebp - 0xda0]
call fcn.10016326
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0xa60], 0xbb743d83
mov dword [ebp - 0xa5c], 0xbb743d83
mov dword [ebp - 0xa58], 0xbb743d83
mov dword [ebp - 0xa54], 0xbb743d83
mov dword [ebp - 0x330], 0
jmp 0x1004916a
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 2
jge 0x10049189
push dword [ebp - 0x330]
lea ecx, [ebp - 0xda0]
call fcn.100163a4
or dword [eax], 0xffffffff
jmp 0x1004915d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa60], 0
jmp 0x100491b7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa60], 1
jg 0x10049272
mov dword [ebp - 0x348], 0x1824a8c6
mov dword [ebp - 0x7f4], 5
mov dword [ebp - 0x348], 0
jmp 0x100493ca
cmp dword [ebp - 0x348], 7
jg 0x1004947c
push 1
lea ecx, [ebp - 0xbbc]
call fcn.10016326
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x350], 0
jmp 0x10049404
cmp dword [ebp - 0x350], 1
jge 0x10049426
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10049494
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [ebp + 0x10], 0
jne 0x100494c0
push 3
lea ecx, [ebp - 0xbcc]
call fcn.10016326
mov dword [ebp - 4], 0x48
mov dword [ebp - 0x68], 0
jmp 0x10049e63
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10049e7f
push dword [ebp - 0x68]
lea ecx, [ebp - 0xbcc]
call fcn.100163a4
mov dword [eax], 0xff0ea75c
jmp 0x10049e5c
mov dword [ebp - 0x68], 0
jmp 0x10049e8f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10049ea5
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x478], 0x7df2f4a8
jmp 0x10049e88
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x478], 0
jmp 0x10049ed3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x478]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x478], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x478], 2
jg 0x10049fc6
mov dword [ebp - 0x378], 0xc3eee2fd
mov dword [ebp - 0x378], 0
jmp 0x10049f0a
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jg 0x10049f8b
mov dword [ebp - 0x214], 0x8999d94b
mov dword [ebp - 0x214], 2
jmp 0x10049f36
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x10049f86
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x1a0], 0
jmp 0x10049f62
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10049f84
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xbcc]
call fcn.100163a4
mov dword [eax], 0xfffffff8
jmp 0x10049f55
jmp 0x10049f29
jmp 0x10049efd
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x478]
lea ecx, [ebp - 0xbcc]
call fcn.100163a4
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x478]
lea ecx, [ebp - 0xbcc]
call fcn.100163a4
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10049eb8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbcc]
call fcn.10016388
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret