Function at 0x1003de74
Capabilities:
Allocate thread local storage
Delete directory
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073ec3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x72c
push esi
push edi
mov dword [ebp - 0x6c], 0x6326
mov dword [ebp - 0x5ec], 0xa21e1d82
mov dword [ebp - 0x5e8], 0xa21e1d82
mov dword [ebp - 0x5e4], 0xa21e1d82
mov dword [ebp - 0x5e0], 0xa21e1d82
mov dword [ebp - 0x550], 0xc863cc1d
mov dword [ebp - 0x54c], 0xc863cc1d
mov dword [ebp - 0x548], 0xc863cc1d
mov dword [ebp - 0x544], 0xc863cc1d
lea ecx, [ebp - 0x145]
call fcn.1002d803
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x718]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x628]
call fcn.1002d7c0
and dword [ebp - 4], 0
mov dword [ebp - 0xd8], 0xa60915bb
push 4
lea ecx, [ebp - 0x504]
call fcn.1002d70f
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0
jmp 0x1003df4f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003df65
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x700], 0xe6bacd79
jmp 0x1003df48
mov dword [ebp - 0x1c], 0
jmp 0x1003df75
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003df8b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x684], 0xffffffff
jmp 0x1003df6e
mov dword [ebp - 0x1c], 0
jmp 0x1003df9b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003dfb7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x504]
call fcn.1002d7f4
mov dword [eax], 0xca0e2c23
jmp 0x1003df94
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x6c], eax
jl 0x1003dfce
mov dword [ebp - 0x2dc], 1
jmp 0x1003dfd5
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x278
je 0x1003dfed
mov dword [ebp - 0x3ec], 1
jmp 0x1003dff4
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x700], ecx
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jne 0x1003e0fc
mov dword [ebp - 0x154], 0x2b60
mov dword [ebp - 0x3fc], 0x6e311378
push 3
lea ecx, [ebp - 0x504]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e05b
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003e05b
mov dword [ebp - 0x3f4], 1
jmp 0x1003e062
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
neg eax
cmp eax, 0x390d
jl 0x1003e089
mov dword [ebp - 0x1b0], 1
jmp 0x1003e090
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x1b0]
jle 0x1003e0aa
mov dword [ebp - 0x340], 1
jmp 0x1003e0b1
and dword [ebp - 0x340], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x154]
imul ecx, dword [ebp - 0x340]
cmp dword [ebp + eax - 0x5ec], ecx
jl 0x1003e0d8
mov dword [ebp - 0x1b8], 1
jmp 0x1003e0df
and dword [ebp - 0x1b8], 0
mov esi, dword [ebp - 0x154]
add esi, dword [ebp - 0x1b8]
push 3
lea ecx, [ebp - 0x628]
call fcn.1002d7f4
mov dword [eax], esi
jmp 0x1003e14c
mov dword [ebp - 0xd8], 0
jmp 0x1003e115
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jg 0x1003e14c
mov dword [ebp - 0x6c], 0
jmp 0x1003e12e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1003e14a
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x504]
call fcn.1002d7f4
mov dword [eax], 0x52275dd3
jmp 0x1003e127
jmp 0x1003e108
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x504]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x628]
call fcn.1002d7e6
mov dword [ebp - 0x74], 0x6326
mov dword [ebp - 0x5fc], 0xa21e1d82
mov dword [ebp - 0x5f8], 0xa21e1d82
mov dword [ebp - 0x5f4], 0xa21e1d82
mov dword [ebp - 0x5f0], 0xa21e1d82
mov dword [ebp - 0x578], 0xc863cc1d
mov dword [ebp - 0x574], 0xc863cc1d
mov dword [ebp - 0x570], 0xc863cc1d
mov dword [ebp - 0x56c], 0xc863cc1d
lea ecx, [ebp - 0x13d]
call fcn.1002d803
push eax
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x728]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x638]
call fcn.1002d7c0
mov dword [ebp - 4], 2
mov dword [ebp - 0xe0], 0xa60915bb
push 4
lea ecx, [ebp - 0x528]
call fcn.1002d70f
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], 0
jmp 0x1003e228
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003e23e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x710], 0xe6bacd79
jmp 0x1003e221
mov dword [ebp - 0x20], 0
jmp 0x1003e24e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1003e264
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x690], 0xffffffff
jmp 0x1003e247
mov dword [ebp - 0x20], 0
jmp 0x1003e274
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003e290
push dword [ebp - 0x20]
lea ecx, [ebp - 0x528]
call fcn.1002d7f4
mov dword [eax], 0xca0e2c23
jmp 0x1003e26d
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x74], eax
jl 0x1003e2a7
mov dword [ebp - 0x348], 1
jmp 0x1003e2ae
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 0x278
je 0x1003e2c6
mov dword [ebp - 0x350], 1
jmp 0x1003e2cd
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + eax - 0x710], ecx
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x350]
jne 0x1003e3d5
mov dword [ebp - 0x158], 0x2b60
mov dword [ebp - 0x358], 0x6e311378
push 3
lea ecx, [ebp - 0x528]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e334
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003e334
mov dword [ebp - 0x1c8], 1
jmp 0x1003e33b
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
neg eax
cmp eax, 0x390d
jl 0x1003e362
mov dword [ebp - 0x1d0], 1
jmp 0x1003e369
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x1d0]
jle 0x1003e383
mov dword [ebp - 0x360], 1
jmp 0x1003e38a
and dword [ebp - 0x360], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x158]
imul ecx, dword [ebp - 0x360]
cmp dword [ebp + eax - 0x5fc], ecx
jl 0x1003e3b1
mov dword [ebp - 0x1d8], 1
jmp 0x1003e3b8
and dword [ebp - 0x1d8], 0
mov esi, dword [ebp - 0x158]
add esi, dword [ebp - 0x1d8]
push 3
lea ecx, [ebp - 0x638]
call fcn.1002d7f4
mov dword [eax], esi
jmp 0x1003e425
mov dword [ebp - 0xe0], 0
jmp 0x1003e3ee
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x1003e425
mov dword [ebp - 0x74], 0
jmp 0x1003e407
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1003e423
push dword [ebp - 0x74]
lea ecx, [ebp - 0x528]
call fcn.1002d7f4
mov dword [eax], 0x52275dd3
jmp 0x1003e400
jmp 0x1003e3e1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x528]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x638]
call fcn.1002d7e6
push 4
lea ecx, [ebp - 0x5b8]
call fcn.1002d70f
mov dword [ebp - 4], 4
mov dword [ebp - 0xd4], 0xe5ccc90a
mov dword [ebp - 0xf8], 0
jmp 0x1003e47a
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jge 0x1003e49c
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x5b8]
call fcn.1002d7f4
mov dword [eax], 0xf75dcec3
jmp 0x1003e46d
mov dword [ebp - 0xd4], 3
jmp 0x1003e4b5
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1003e4d8
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x5b8]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e4d6
jmp 0x1003e4d8
jmp 0x1003e4a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.1002d7e6
push 4
lea ecx, [ebp - 0x5ac]
call fcn.1002d70f
mov dword [ebp - 4], 5
mov dword [ebp - 0xdc], 0xe5ccc90a
mov dword [ebp - 0x138], 0
jmp 0x1003e51e
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x1003e540
push dword [ebp - 0x138]
lea ecx, [ebp - 0x5ac]
call fcn.1002d7f4
mov dword [eax], 0xf75dcec3
jmp 0x1003e511
mov dword [ebp - 0xdc], 3
jmp 0x1003e559
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x1003e57c
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x5ac]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e57a
jmp 0x1003e57c
jmp 0x1003e54c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5ac]
call fcn.1002d7e6
push 2
lea ecx, [ebp - 0xb4]
call fcn.1002d70f
mov dword [ebp - 4], 6
mov dword [ebp - 0x7c], 0x4157736d
mov dword [ebp - 0x478], 0x4faf
mov dword [ebp - 0x200], 0xffffffff
push 3
lea ecx, [ebp - 0x5dc]
call fcn.1002d70f
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], 0xfffffffe
mov dword [ebp - 0xe4], 5
mov dword [ebp - 0x38], 0
jmp 0x1003e5ef
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1003e60b
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov dword [eax], 0xda0e60f9
jmp 0x1003e5e8
mov dword [ebp - 0x38], 0
jmp 0x1003e61b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1003e637
push dword [ebp - 0x38]
lea ecx, [ebp - 0x5dc]
call fcn.1002d7f4
mov dword [eax], 0xb8821692
jmp 0x1003e614
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov esi, eax
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1003e699
mov dword [ebp - 0x368], 1
jmp 0x1003e6a0
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x7c]
dec esi
push 0
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
cmp esi, dword [eax]
jle 0x1003e6ca
mov dword [ebp - 0x1e0], 1
jmp 0x1003e6d1
and dword [ebp - 0x1e0], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1e0]
cmp ecx, dword [eax]
jl 0x1003e6f4
mov dword [ebp - 0x370], 1
jmp 0x1003e6fb
and dword [ebp - 0x370], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jge 0x1003e71e
mov dword [ebp - 0x1e8], 1
jmp 0x1003e725
and dword [ebp - 0x1e8], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1e8]
add ecx, dword [eax]
jne 0x1003e748
mov dword [ebp - 0x458], 1
jmp 0x1003e74f
and dword [ebp - 0x458], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov eax, 0xac31
imul esi, eax, 0x6e6c
push 0
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
cmp esi, dword [eax]
jle 0x1003e784
mov dword [ebp - 0x378], 1
jmp 0x1003e78b
and dword [ebp - 0x378], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x378]
cmp ecx, dword [eax]
jne 0x1003e7ae
mov dword [ebp - 0x1f0], 1
jmp 0x1003e7b5
and dword [ebp - 0x1f0], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
jg 0x1003e7d8
mov dword [ebp - 0x380], 1
jmp 0x1003e7df
and dword [ebp - 0x380], 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x380]
sub ecx, dword [eax]
jns 0x1003e802
mov dword [ebp - 0x1f8], 1
jmp 0x1003e809
and dword [ebp - 0x1f8], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1f8]
cmp ecx, dword [eax]
jg 0x1003e82c
mov dword [ebp - 0x470], 1
jmp 0x1003e833
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x614], eax
push 1
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
cmp dword [eax], 0x79339b88
jg 0x1003e860
mov dword [ebp - 0x388], 1
jmp 0x1003e867
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
je 0x1003e89a
push 1
lea ecx, [ebp - 0x5dc]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e89a
mov dword [ebp - 0x3a0], 1
jmp 0x1003e8a1
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x3a0], eax
je 0x1003e8bb
mov dword [ebp - 0x208], 1
jmp 0x1003e8c2
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xc8], 0
jmp 0x1003e8e7
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jg 0x1003e95a
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
mov dword [eax], 0xdcf4a941
mov dword [ebp - 0xe4], 1
jmp 0x1003e920
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x1003e958
mov dword [ebp - 0x7c], 0
jmp 0x1003e939
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x1003e956
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xb4]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003e954
jmp 0x1003e956
jmp 0x1003e932
jmp 0x1003e913
jmp 0x1003e8da
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5dc]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.1002d7e6
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x178], 0x86335c0d
mov dword [ebp - 0x160], 0x355c
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x23c], 0xf8169c14
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1002d70f
mov dword [ebp - 4], 8
mov dword [ebp - 0x498], 0xb704
mov dword [ebp - 0x6ac], 9
mov dword [ebp - 0x100], 0
jmp 0x1003e9f9
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x1003ea1b
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
mov dword [eax], 0xe96bb645
jmp 0x1003e9ec
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x3c], 1
jl 0x1003ea36
mov dword [ebp - 0x3a8], 1
jmp 0x1003ea3d
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x180], eax
jl 0x1003ea60
mov dword [ebp - 0x210], 1
jmp 0x1003ea67
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffff
jge 0x1003ea88
mov dword [ebp - 0x3b0], 1
jmp 0x1003ea8f
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3b0], eax
jle 0x1003eaa6
mov dword [ebp - 0x3b8], 1
jmp 0x1003eaad
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3b8], eax
jg 0x1003eacd
cmp dword [ebp - 0x160], 0
je 0x1003eacd
mov dword [ebp - 0x21c], 1
jmp 0x1003ead4
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x21c]
jge 0x1003eaeb
mov dword [ebp - 0x314], 1
jmp 0x1003eaf2
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jb 0x1003eb13
mov dword [ebp - 0x38c], 1
jmp 0x1003eb1a
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
dec eax
cmp eax, dword [ebp - 0x160]
jne 0x1003eb35
mov dword [ebp - 0x22c], 1
jmp 0x1003eb3c
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
je 0x1003eb51
mov dword [ebp - 0x31c], 1
jmp 0x1003eb58
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0xfffffffb
jl 0x1003eb6d
mov dword [ebp - 0x234], 1
jmp 0x1003eb74
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003eb95
cmp dword [ebp - 0x3c], 0
je 0x1003eb95
mov dword [ebp - 0x3e0], 1
jmp 0x1003eb9c
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
sub eax, 0x5b39c7d7
mov dword [ebp - 0x23c], eax
jne 0x1003ebc1
mov eax, 0xa9c79ebe
test eax, eax
jne 0x1003ebc1
and dword [ebp - 0x324], 0
jmp 0x1003ebcb
mov dword [ebp - 0x324], 1
push 6
pop eax
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x324]
jg 0x1003edcd
push 4
lea ecx, [ebp - 0x51c]
call fcn.1002d70f
mov byte [ebp - 4], 9
mov dword [ebp - 0x24c], 0x77e2192f
mov dword [ebp - 0x120], 0
jmp 0x1003ec11
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x1003ec30
push dword [ebp - 0x120]
lea ecx, [ebp - 0x51c]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1003ec04
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1003ec55
push 0xba4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [ebp - 0x14], 0
jmp 0x1003ec65
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003edb9
mov dword [ebp - 0x488], 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
cmp dword [eax], 0xcd43
jne 0x1003ecc9
push 0
lea ecx, [ebp - 0x51c]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003ecc9
mov dword [ebp - 0x244], 1
jmp 0x1003ecd0
and dword [ebp - 0x244], 0
mov esi, dword [ebp - 0x180]
imul esi, dword [ebp - 0x244]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
cmp esi, dword [eax]
jl 0x1003ecfe
cmp dword [ebp - 0x3c], 0
jne 0x1003ecfe
and dword [ebp - 0x3a4], 0
jmp 0x1003ed08
mov dword [ebp - 0x3a4], 1
push 0
lea ecx, [ebp - 0x51c]
call fcn.1002d7f4
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x3a4]
jl 0x1003ed2d
mov dword [ebp - 0x480], 1
jmp 0x1003ed34
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jne 0x1003ed5e
mov eax, 0xba54
test eax, eax
je 0x1003ed5e
mov dword [ebp - 0x32c], 1
jmp 0x1003ed65
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x32c], eax
jge 0x1003ed7f
mov dword [ebp - 0x254], 1
jmp 0x1003ed86
and dword [ebp - 0x254], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x254]
mov dword [eax], ecx
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1003edb4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1003ec5e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x51c]
call fcn.1002d7e6
jmp 0x1003eebd
mov dword [ebp - 0x108], 0
jmp 0x1003ede6
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1003ee02
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x6c4], 0x8dfe
jmp 0x1003edd9
mov dword [ebp - 0x14], 0
jmp 0x1003ee12
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003eebd
mov dword [ebp - 0x168], 0xa6696b49
cmp dword [ebp - 0x178], 0xfffffff6
ja 0x1003ee3b
mov dword [ebp - 0x45c], 1
jmp 0x1003ee42
and dword [ebp - 0x45c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
mov eax, dword [eax]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x68c], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x168]
push 4
pop edx
shl edx, 1
add ecx, dword [ebp + edx - 0x6c4]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x498]
jne 0x1003ee9b
mov dword [ebp - 0x400], 1
jmp 0x1003eea2
and dword [ebp - 0x400], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
jmp 0x1003ee0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a4]
call fcn.1002d7e6
push 2
lea ecx, [ebp - 0xa8]
call fcn.1002d70f
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x84], 0x4157736d
mov dword [ebp - 0x4b0], 0x4faf
mov dword [ebp - 0x344], 0xffffffff
push 3
lea ecx, [ebp - 0x5c4]
call fcn.1002d70f
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xb8], 0xfffffffe
mov dword [ebp - 0xd0], 5
mov dword [ebp - 0x40], 0
jmp 0x1003ef33
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1003ef4f
push dword [ebp - 0x40]
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov dword [eax], 0xda0e60f9
jmp 0x1003ef2c
mov dword [ebp - 0x40], 0
jmp 0x1003ef5f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003ef7b
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5c4]
call fcn.1002d7f4
mov dword [eax], 0xb8821692
jmp 0x1003ef58
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov esi, eax
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1003efdd
mov dword [ebp - 0x25c], 1
jmp 0x1003efe4
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x84], eax
mov esi, dword [ebp - 0x84]
dec esi
push 0
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
cmp esi, dword [eax]
jle 0x1003f014
mov dword [ebp - 0x334], 1
jmp 0x1003f01b
and dword [ebp - 0x334], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [eax]
jl 0x1003f03e
mov dword [ebp - 0x264], 1
jmp 0x1003f045
and dword [ebp - 0x264], 0
push 0
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [eax]
jge 0x1003f068
mov dword [ebp - 0x3ac], 1
jmp 0x1003f06f
and dword [ebp - 0x3ac], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x3ac]
add ecx, dword [eax]
jne 0x1003f092
mov dword [ebp - 0x4a0], 1
jmp 0x1003f099
and dword [ebp - 0x4a0], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov eax, 0xac31
imul esi, eax, 0x6e6c
push 0
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
cmp esi, dword [eax]
jle 0x1003f0ce
mov dword [ebp - 0x26c], 1
jmp 0x1003f0d5
and dword [ebp - 0x26c], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
jne 0x1003f0f8
mov dword [ebp - 0x33c], 1
jmp 0x1003f0ff
and dword [ebp - 0x33c], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x33c]
cmp ecx, dword [eax]
jg 0x1003f122
mov dword [ebp - 0x274], 1
jmp 0x1003f129
and dword [ebp - 0x274], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x274]
sub ecx, dword [eax]
jns 0x1003f14c
mov dword [ebp - 0x3e8], 1
jmp 0x1003f153
and dword [ebp - 0x3e8], 0
push 0
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [eax]
jg 0x1003f176
mov dword [ebp - 0x4a8], 1
jmp 0x1003f17d
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x62c], eax
push 1
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
cmp dword [eax], 0x79339b88
jg 0x1003f1aa
mov dword [ebp - 0x27c], 1
jmp 0x1003f1b1
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
je 0x1003f1e4
push 1
lea ecx, [ebp - 0x5c4]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003f1e4
mov dword [ebp - 0x284], 1
jmp 0x1003f1eb
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x284], eax
je 0x1003f205
mov dword [ebp - 0x3b4], 1
jmp 0x1003f20c
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xb8], 0
jmp 0x1003f231
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x1003f2b6
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
mov dword [eax], 0xdcf4a941
mov dword [ebp - 0xd0], 1
jmp 0x1003f26a
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x1003f2b1
mov dword [ebp - 0x84], 0
jmp 0x1003f28c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x1003f2af
push dword [ebp - 0x84]
lea ecx, [ebp - 0xa8]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003f2ad
jmp 0x1003f2af
jmp 0x1003f27f
jmp 0x1003f25d
jmp 0x1003f224
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5c4]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.1002d7e6
movzx eax, byte [0x1190443c]
test eax, eax
je 0x1003f2f2
mov esi, 0x10079848
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100411ce
mov dword [ebp - 0x6a4], 0x10079848
push 1
lea ecx, [ebp - 0x4d0]
call fcn.1002d70f
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x1003f333
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x1003f355
push dword [ebp - 0x130]
lea ecx, [ebp - 0x4d0]
call fcn.1002d7f4
mov dword [eax], 0x9f9b3198
jmp 0x1003f326
mov dword [ebp - 0x8c], 0
jmp 0x1003f36e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x1003f75e
mov dword [ebp - 0x110], 0xb0ceafd
mov dword [ebp - 0xc0], 0x37c5b151
mov dword [ebp - 0x110], 0
jmp 0x1003f3a8
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x1003f734
push 3
lea ecx, [ebp - 0x40c]
call fcn.1002d70f
mov byte [ebp - 4], 0xd
and dword [ebp - 0x5a0], 0
and dword [ebp - 0x59c], 0
and dword [ebp - 0x598], 0
and dword [ebp - 0x594], 0
lea ecx, [ebp - 0x14d]
call fcn.1002d803
push eax
lea eax, [ebp - 0x590]
push eax
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x738]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x648]
call fcn.1002d7c0
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x128], 0
jmp 0x1003f434
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x1003f453
push dword [ebp - 0x128]
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
or dword [eax], 0xffffffff
jmp 0x1003f427
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x1003f46e
push 0
push 0x54b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1003f4a4
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
cmp dword [eax], 0
jg 0x1003f711
mov dword [ebp - 0x5c], 0x815cbcef
mov dword [ebp - 0xf0], 0
jmp 0x1003f4da
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x1003f4f6
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x4c0], 0xfffffffa
jmp 0x1003f4cd
mov dword [ebp - 0x5c], 0
jmp 0x1003f506
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003f691
mov dword [ebp - 0xf4], 0
jmp 0x1003f529
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1003f545
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x4b8], 1
jmp 0x1003f51c
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
push dword [eax]
lea ecx, [ebp - 0x4d0]
call fcn.1002d7f4
cmp dword [eax], 0x9ea7eb8e
je 0x1003f573
mov dword [ebp - 0x3c4], 1
jmp 0x1003f57a
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
lea eax, [eax + ecx + 0xbd4a]
cmp eax, dword [ebp - 0x5c]
jg 0x1003f598
mov dword [ebp - 0x29c], 1
jmp 0x1003f59f
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x34c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x4b8], ecx
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
push dword [eax]
lea ecx, [ebp - 0x4d0]
call fcn.1002d7f4
mov eax, dword [eax]
sub eax, dword [ebp - 0x34c]
mov dword [ebp - 0x294], eax
push 0
lea ecx, [ebp - 0x648]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x3c4]
sub eax, dword [ebp - 0x29c]
cmp dword [ebp - 0xc0], eax
je 0x1003f624
mov dword [ebp - 0x354], 1
jmp 0x1003f62b
and dword [ebp - 0x354], 0
push 1
lea ecx, [ebp - 0x40c]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x354]
cmp ecx, dword [eax]
jle 0x1003f64e
mov dword [ebp - 0x2a4], 1
jmp 0x1003f655
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
sub eax, 8
cmp eax, dword [ebp - 0x8c]
jg 0x1003f672
mov dword [ebp - 0x3bc], 1
jmp 0x1003f679
and dword [ebp - 0x3bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0x4c0], ecx
jmp 0x1003f4ff
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x4d0]
call fcn.1002d7f4
cmp dword [eax], 0
jl 0x1003f6f3
mov eax, dword [ebp - 0x8c]
sub eax, 0xffff
sub eax, dword [ebp - 0xc0]
cmp eax, 0xb676bd76
ja 0x1003f6cb
mov dword [ebp - 0x2ac], 1
jmp 0x1003f6d2
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0x2e166580
jg 0x1003f6f3
cmp dword [ebp - 0xc0], 0
je 0x1003f6f3
mov dword [ebp - 0x35c], 1
jmp 0x1003f6fa
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
sub eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc0], eax
jmp 0x1003f480
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x648]
call fcn.1002d7e6
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x40c]
call fcn.1002d7e6
jmp 0x1003f39b
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x1003f759
push 0
push 0x1b21
push 0x5fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x1003f361
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.1002d7e6
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x14c], 0x86335c0d
mov dword [ebp - 0x144], 0x355c
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x2e4], 0xf8169c14
push 1
lea ecx, [ebp - 0x198]
call fcn.1002d70f
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x490], 0xb704
mov dword [ebp - 0x63c], 9
mov dword [ebp - 0xfc], 0
jmp 0x1003f7ee
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x1003f810
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
mov dword [eax], 0xe96bb645
jmp 0x1003f7e1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x4c], 1
jl 0x1003f82b
mov dword [ebp - 0x2b4], 1
jmp 0x1003f832
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x188], eax
jl 0x1003f855
mov dword [ebp - 0x3c0], 1
jmp 0x1003f85c
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jge 0x1003f87d
mov dword [ebp - 0x2bc], 1
jmp 0x1003f884
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2bc], eax
jle 0x1003f89b
mov dword [ebp - 0x364], 1
jmp 0x1003f8a2
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x364], eax
jg 0x1003f8c2
cmp dword [ebp - 0x144], 0
je 0x1003f8c2
mov dword [ebp - 0x2c4], 1
jmp 0x1003f8c9
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x2c4]
jge 0x1003f8e0
mov dword [ebp - 0x3dc], 1
jmp 0x1003f8e7
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jb 0x1003f908
mov dword [ebp - 0x36c], 1
jmp 0x1003f90f
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
dec eax
cmp eax, dword [ebp - 0x144]
jne 0x1003f92a
mov dword [ebp - 0x2d4], 1
jmp 0x1003f931
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0
je 0x1003f946
mov dword [ebp - 0x3d4], 1
jmp 0x1003f94d
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0xfffffffb
jl 0x1003f962
mov dword [ebp - 0x1a8], 1
jmp 0x1003f969
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1003f98a
cmp dword [ebp - 0x4c], 0
je 0x1003f98a
mov dword [ebp - 0x374], 1
jmp 0x1003f991
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
sub eax, 0x5b39c7d7
mov dword [ebp - 0x2e4], eax
jne 0x1003f9b6
mov eax, 0xa9c79ebe
test eax, eax
jne 0x1003f9b6
and dword [ebp - 0x3f8], 0
jmp 0x1003f9c0
mov dword [ebp - 0x3f8], 1
push 6
pop eax
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x3f8]
jg 0x1003fbbc
push 4
lea ecx, [ebp - 0x510]
call fcn.1002d70f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x2f4], 0x77e2192f
mov dword [ebp - 0x104], 0
jmp 0x1003fa06
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jge 0x1003fa25
push dword [ebp - 0x104]
lea ecx, [ebp - 0x510]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1003f9f9
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x1003fa4a
push 0xba4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [ebp - 0x10], 0
jmp 0x1003fa5a
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1003fba8
mov dword [ebp - 0x464], 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
cmp dword [eax], 0xcd43
jne 0x1003fabe
push 0
lea ecx, [ebp - 0x510]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1003fabe
mov dword [ebp - 0x2ec], 1
jmp 0x1003fac5
and dword [ebp - 0x2ec], 0
mov esi, dword [ebp - 0x188]
imul esi, dword [ebp - 0x2ec]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
cmp esi, dword [eax]
jl 0x1003faf3
cmp dword [ebp - 0x4c], 0
jne 0x1003faf3
and dword [ebp - 0x37c], 0
jmp 0x1003fafd
mov dword [ebp - 0x37c], 1
push 0
lea ecx, [ebp - 0x510]
call fcn.1002d7f4
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x37c]
jl 0x1003fb22
mov dword [ebp - 0x4ec], 1
jmp 0x1003fb29
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jne 0x1003fb53
mov eax, 0xba54
test eax, eax
je 0x1003fb53
mov dword [ebp - 0x3d8], 1
jmp 0x1003fb5a
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x3d8], eax
jge 0x1003fb74
mov dword [ebp - 0x2fc], 1
jmp 0x1003fb7b
and dword [ebp - 0x2fc], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x1003fba3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1003fa53
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x510]
call fcn.1002d7e6
jmp 0x1003fcac
mov dword [ebp - 0xe8], 0
jmp 0x1003fbd5
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1003fbf1
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x6dc], 0x8dfe
jmp 0x1003fbc8
mov dword [ebp - 0x10], 0
jmp 0x1003fc01
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1003fcac
mov dword [ebp - 0x15c], 0xa6696b49
cmp dword [ebp - 0x14c], 0xfffffff6
ja 0x1003fc2a
mov dword [ebp - 0x468], 1
jmp 0x1003fc31
and dword [ebp - 0x468], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
mov eax, dword [eax]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x64c], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x15c]
push 4
pop edx
shl edx, 1
add ecx, dword [ebp + edx - 0x6dc]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x490]
jne 0x1003fc8a
mov dword [ebp - 0x384], 1
jmp 0x1003fc91
and dword [ebp - 0x384], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x198]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x384]
mov dword [eax], ecx
jmp 0x1003fbfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.1002d7e6
mov dword [ebp - 0x6b4], 0x1007984c
push 3
lea ecx, [ebp - 0x424]
call fcn.1002d70f
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x48], 0
jmp 0x1003fce9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1003fcff
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x658], 0x7117
jmp 0x1003fce2
mov dword [ebp - 0x48], 0
jmp 0x1003fd0f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1003fd2b
push dword [ebp - 0x48]
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
mov dword [eax], 1
jmp 0x1003fd08
push 0
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
mov dword [eax], 2
jmp 0x1003fd64
push 0
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x304]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
cmp dword [eax], 0
jl 0x1003fdbe
push 0
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x424]
call fcn.1002d7f4
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x658]
mov dword [ebp + eax*4 - 0x658], ecx
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1003fdbc
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1003fd40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.1002d7e6
mov byte [0x1190443c], 1
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10079638
mov dword [ebp - 0x1c4], eax
push 1
lea ecx, [ebp - 0x4e0]
call fcn.1002d70f
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x10c], 0
jmp 0x1003fe1f
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x1003fe41
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x4e0]
call fcn.1002d7f4
mov dword [eax], 0x9f9b3198
jmp 0x1003fe12
mov dword [ebp - 0x94], 0
jmp 0x1003fe5a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jg 0x1004024a
mov dword [ebp - 0x114], 0xb0ceafd
mov dword [ebp - 0xc4], 0x37c5b151
mov dword [ebp - 0x114], 0
jmp 0x1003fe94
cmp dword [ebp - 0x114], 0
jg 0x10040220
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002d70f
mov byte [ebp - 4], 0x13
and dword [ebp - 0x564], 0
and dword [ebp - 0x560], 0
and dword [ebp - 0x55c], 0
and dword [ebp - 0x558], 0
lea ecx, [ebp - 0x181]
call fcn.1002d803
push eax
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x730]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x668]
call fcn.1002d7c0
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x11c], 0
jmp 0x1003ff20
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x1003ff3f
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x3d0]
call fcn.1002d7f4
or dword [eax], 0xffffffff
jmp 0x1003ff13
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x1003ff5a
push 0
push 0x54b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 1
lea ecx, [ebp - 0x3d0]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1003ff90
push 1
lea ecx, [ebp - 0x3d0]
call fcn.1002d7f4
cmp dword [eax], 0
jg 0x100401fd
mov dword [ebp - 0x58], 0x815cbcef
mov dword [ebp - 0x124], 0
jmp 0x1003ffc6
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x668]
call fcn.1002d7e6
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3d0]
call fcn.1002d7e6
jmp 0x1003fe87
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x10040245
push 0
push 0x1b21
push 0x5fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x1003fe4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.1002d7e6
mov dword [ebp - 0x28], 0xbd035c57
mov dword [ebp - 0x4b4], 0x6fda0246
mov dword [ebp - 0x280], 0xbc35
mov dword [ebp - 0x268], 0xfffffffa
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x58c], 0x7f17245c
mov dword [ebp - 0x588], 0x7f17245c
mov dword [ebp - 0x584], 0x7f17245c
mov dword [ebp - 0x580], 0x7f17245c
lea ecx, [ebp - 0x189]
call fcn.1002d803
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x58c]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6d0]
call fcn.1002d7c0
cmp dword [ebp - 0x28], 0
je 0x10040300
mov eax, 0xffff
test eax, eax
je 0x10040300
mov dword [ebp - 0x250], 1
jmp 0x10040307
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 4
jne 0x1004031c
mov dword [ebp - 0x258], 1
jmp 0x10040323
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0x52aa
jg 0x1004033b
mov dword [ebp - 0x260], 1
jmp 0x10040342
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x280]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jg 0x10040378
mov dword [ebp - 0x270], 1
jmp 0x1004037f
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x270]
je 0x10040396
mov dword [ebp - 0x278], 1
jmp 0x1004039d
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 0xfffffffa
jge 0x100403b2
mov dword [ebp - 0x474], 1
jmp 0x100403b9
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0xcc], 0
jne 0x100403cf
cmp dword [ebp - 0x28], 0
cmp dword [ebp - 0xcc], 0
je 0x100403ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret