Function at 0x1004b01e
Capabilities:
Check for time delay via queryperformancecounter
Check os version
Contain obfuscated stackstrings
Delete file
Get geographical location
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100780d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1210
call fcn.100724d0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x10], 0
jbe 0x1004b422
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004b422
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x6c], 0x378f1e0c
push 2
lea ecx, [ebp - 0xe7c]
call fcn.10025cee
and dword [ebp - 4], 0
mov dword [ebp - 0x644], 2
mov dword [ebp - 0x30c], 0
jmp 0x1004b09f
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x1004b0c1
push dword [ebp - 0x30c]
lea ecx, [ebp - 0xe7c]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x1004b092
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10cc], eax
cmp dword [ebp - 0x18], 0xfffffffa
jle 0x1004b133
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xfb0], eax
cmp dword [ebp - 0x18], 0
jne 0x1004b0ed
xor eax, eax
inc eax
jne 0x1004b0ed
and dword [ebp - 0x7cc], 0
jmp 0x1004b0f7
mov dword [ebp - 0x7cc], 1
mov eax, dword [ebp - 0x7cc]
neg eax
cmp eax, 0xa21e
jle 0x1004b118
cmp dword [ebp - 0x18], 0
je 0x1004b118
mov dword [ebp - 0xa78], 1
jmp 0x1004b11f
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa78], eax
je 0x1004b133
and dword [ebp - 0xa80], 0
jmp 0x1004b13d
mov dword [ebp - 0xa80], 1
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x1004b15b
cmp dword [ebp - 0x18], 0
jne 0x1004b15b
and dword [ebp - 0xa88], 0
jmp 0x1004b165
mov dword [ebp - 0xa88], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa88], eax
jg 0x1004b17c
mov dword [ebp - 0xa90], 1
jmp 0x1004b183
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa90], eax
je 0x1004b19a
mov dword [ebp - 0xad0], 1
jmp 0x1004b1a1
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x1004b1bb
mov dword [ebp - 0xad8], 1
jmp 0x1004b1c2
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xad8], eax
jge 0x1004b1d9
mov dword [ebp - 0xae0], 1
jmp 0x1004b1e0
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xae0], eax
jg 0x1004b1f7
mov dword [ebp - 0xb88], 1
jmp 0x1004b1fe
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x18], 0
je 0x1004b27a
mov dword [ebp - 0x6c], 0
jmp 0x1004b21d
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff3
je 0x1004b275
mov dword [ebp - 0x18], 0xfffffff5
jmp 0x1004b233
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffa
jle 0x1004b273
mov dword [ebp - 0xbc0], 0xbdb88dcf
cmp dword [ebp - 0xbc0], 0
je 0x1004b24e
jmp 0x1004b273
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1004b271
push 0x2366
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1004b22c
jmp 0x1004b216
jmp 0x1004b3ff
mov dword [ebp - 0x378], 0
mov dword [ebp - 0xb18], 0xb8a442f2
mov dword [ebp - 0xbc8], 0xfffffffe
mov dword [ebp - 0xbd0], 0xfffffffc
cmp dword [ebp - 0x378], 8
jne 0x1004b2b7
mov dword [ebp - 0xae8], 1
jmp 0x1004b2be
and dword [ebp - 0xae8], 0
imul eax, dword [ebp - 0xae8], 0xa8d6
cmp eax, 0x35d5
jge 0x1004b2db
mov dword [ebp - 0xaf0], 1
jmp 0x1004b2e2
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xaf0], eax
je 0x1004b2f9
mov dword [ebp - 0xaf8], 1
jmp 0x1004b300
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
cmp eax, dword [ebp - 0x378]
jne 0x1004b329
cmp dword [ebp - 0x18], 0
jne 0x1004b329
and dword [ebp - 0xab4], 0
jmp 0x1004b333
mov dword [ebp - 0xab4], 1
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x8b0], eax
push 0
lea ecx, [ebp - 0xe7c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x8b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0x8b0], eax
jle 0x1004b37a
mov dword [ebp - 0x48c], 1
jmp 0x1004b381
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xffff
ja 0x1004b399
mov dword [ebp - 0x8b8], 1
jmp 0x1004b3a0
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x8b8]
imul eax, dword [ebp - 0xbc8]
cmp dword [ebp - 0x6c], eax
jg 0x1004b3c2
mov dword [ebp - 0x494], 1
jmp 0x1004b3c9
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x378]
imul eax, dword [ebp - 0x494]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff7
jg 0x1004b3eb
mov dword [ebp - 0x8c0], 1
jmp 0x1004b3f2
and dword [ebp - 0x8c0], 0
imul eax, dword [ebp - 0x8c0], 3
mov dword [ebp - 0xbd0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe7c]
call fcn.10025d50
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10046353
pop ecx
pop ecx
jmp 0x10053a93
mov dword [ebp - 0xdc], 0xfffffff7
mov dword [ebp - 0x400], 0xb64b6930
mov dword [ebp - 0x32c], 0x6f62939c
mov dword [ebp - 0xdc], 0
jmp 0x1004b459
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xa
jge 0x1004b860
mov dword [ebp - 0x110], 0xaa9ac70c
mov dword [ebp - 0xbd8], 0xfffffff8
mov dword [ebp - 0x8f8], 0xaa9b2235
mov dword [ebp - 0xbf0], 0xa95a4792
mov dword [ebp - 0x110], 0
jmp 0x1004b4a7
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 6
jg 0x1004b85b
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xbe0], 0x9f33d48
mov dword [ebp - 0xbe8], 0xffffffff
cmp dword [ebp - 0x110], 0
jne 0x1004b548
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xfb8], eax
cmp dword [ebp - 0xdc], 0
je 0x1004b505
cmp dword [ebp - 0x110], 0
je 0x1004b505
mov dword [ebp - 0x49c], 1
jmp 0x1004b50c
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0x626a9d9e
jne 0x1004b524
mov dword [ebp - 0x8c8], 1
jmp 0x1004b52b
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0xbd8]
imul eax, dword [ebp - 0x8c8]
cmp eax, 0x7c2f5a26
je 0x1004b548
and dword [ebp - 0x4a4], 0
jmp 0x1004b552
mov dword [ebp - 0x4a4], 1
imul eax, dword [ebp - 0x4a4], 0x281c
cmp eax, dword [ebp - 0xdc]
jle 0x1004b576
cmp dword [ebp - 0xdc], 0
jne 0x1004b576
and dword [ebp - 0x8d0], 0
jmp 0x1004b580
mov dword [ebp - 0x8d0], 1
cmp dword [ebp - 0x8d0], 0xfe9f4864
jae 0x1004b598
mov dword [ebp - 0x4ac], 1
jmp 0x1004b59f
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x4ac], eax
je 0x1004b5b9
mov dword [ebp - 0x8d8], 1
jmp 0x1004b5c0
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x8d8], eax
jl 0x1004b5da
mov dword [ebp - 0x4b4], 1
jmp 0x1004b5e1
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x4b4], eax
jge 0x1004b5fb
mov dword [ebp - 0x8e0], 1
jmp 0x1004b602
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x8e0]
jge 0x1004b61c
mov dword [ebp - 0x4bc], 1
jmp 0x1004b623
and dword [ebp - 0x4bc], 0
mov eax, 0x67d5
sub eax, dword [ebp - 0x4bc]
add eax, 0xf30
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
imul eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jg 0x1004b65a
mov dword [ebp - 0x8e8], 1
jmp 0x1004b661
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xfff8
jbe 0x1004b679
mov dword [ebp - 0x4c4], 1
jmp 0x1004b680
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xbc]
jne 0x1004b6a1
mov dword [ebp - 0x8f0], 1
jmp 0x1004b6a8
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x8f0], eax
jg 0x1004b6fa
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1004b6d9
push 0x2366
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1004b6f5
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1004b856
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x380], 0
jmp 0x1004b71d
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 3
jge 0x1004b739
mov eax, dword [ebp - 0x380]
mov dword [ebp + eax*4 - 0xe88], 0x76dcb0c7
jmp 0x1004b710
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xe88], 0x8d3f
mov ecx, dword [ebp - 0x3a8]
mov edx, dword [ebp - 0x3a8]
dec edx
mov dword [ebp - 0x3a8], edx
cmp ecx, eax
jg 0x1004b797
cmp dword [ebp - 0xbc], 0
jne 0x1004b778
or eax, 0xffffffff
jne 0x1004b778
and dword [ebp - 0x4cc], 0
jmp 0x1004b782
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 0
jne 0x1004b7d2
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
inc ecx
inc ecx
cmp ecx, dword [ebp + eax - 0xe88]
je 0x1004b7ba
mov dword [ebp - 0x4d4], 1
jmp 0x1004b7c1
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
add eax, 0xb681
sub eax, dword [ebp - 0xbe0]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbc]
cmp ecx, dword [ebp + eax - 0xe88]
jne 0x1004b7f3
mov dword [ebp - 0x900], 1
jmp 0x1004b7fa
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xbe8]
cmp dword [ebp - 0x900], eax
je 0x1004b815
xor eax, eax
jne 0x1004b815
and dword [ebp - 0x4dc], 0
jmp 0x1004b81f
mov dword [ebp - 0x4dc], 1
cmp dword [ebp - 0x4dc], 0x4e19
jg 0x1004b837
mov dword [ebp - 0x908], 1
jmp 0x1004b83e
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xbf0], eax
jmp 0x1004b49a
jmp 0x1004b44c
push 1
lea ecx, [ebp - 0xeac]
call fcn.10025cee
mov dword [ebp - 4], 1
mov dword [ebp - 0x18c], 0x9d01078
mov dword [ebp - 0x1d8], 0xcd33
mov dword [ebp - 0xbf8], 0xfaeb382e
mov dword [ebp - 0x238], 0
jmp 0x1004b8ab
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1004b8cd
push dword [ebp - 0x238]
lea ecx, [ebp - 0xeac]
call fcn.10025d6c
mov dword [eax], 2
jmp 0x1004b89e
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1004b8e7
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, 0xffff
test eax, eax
je 0x1004b90b
imul eax, dword [ebp - 0x18c], 0xfffffffa
add eax, dword [ebp - 0x18c]
je 0x1004b90b
mov dword [ebp - 0x4e4], 1
jmp 0x1004b912
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xffffffff
je 0x1004b927
mov dword [ebp - 0x910], 1
jmp 0x1004b92e
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x910]
jle 0x1004b948
mov dword [ebp - 0x4ec], 1
jmp 0x1004b94f
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x18c]
je 0x1004b96f
mov dword [ebp - 0x918], 1
jmp 0x1004b976
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xfc0], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x10fc], eax
push 0
lea ecx, [ebp - 0xeac]
call fcn.10025d6c
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x408]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x408]
cmp dword [ecx], eax
jne 0x1004b9e6
mov dword [ebp - 0x4f4], 1
jmp 0x1004b9ed
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0x1d8]
test eax, eax
jle 0x1004ba09
mov dword [ebp - 0x920], 1
jmp 0x1004ba10
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
sub eax, 0xe92e
cmp eax, 7
jb 0x1004ba2c
mov dword [ebp - 0x4fc], 1
jmp 0x1004ba33
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0xbf8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.10025d50
cmp dword [ebp + 0x10], 0
jne 0x10050b4a
mov dword [ebp - 0xfc8], 0x5c96dd1e
mov dword [ebp - 0xff4], 0xfffffffe
mov dword [ebp - 0xfd0], 0x8256a9ef
mov dword [ebp - 0xff8], 0xfffffffe
mov dword [ebp - 0xfd8], 0
mov dword [ebp - 0x1000], 0x7d65121a
mov dword [ebp - 0xfe0], 0
mov dword [ebp - 0x2e0], 0xfffffff9
mov dword [ebp - 0xffc], 7
mov dword [ebp - 0x10d8], 1
mov dword [ebp - 0x1004], 0xfffffffb
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x1010], 0x3c407858
mov dword [ebp - 0x1100], 0xfffffffb
mov dword [ebp - 0x101c], 0x6890c544
mov dword [ebp - 0x10f8], 0x8ed4a55f
mov dword [ebp - 0x10f4], 0x8ed4a55f
mov dword [ebp - 0x10f0], 0x8ed4a55f
mov dword [ebp - 0x10ec], 0x8ed4a55f
mov dword [ebp - 0xf18], 0
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x928]
inc eax
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x2e0], 0
jmp 0x1004bb50
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x1a
jne 0x1004bb75
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1004bb73
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x1004bb43
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1003f816
mov dword [ebp - 0x284], eax
mov dword [ebp - 0xc4], 0xfffffff9
mov dword [ebp - 0x194], 0x858f9c25
mov dword [ebp - 0xc4], 0xfffffffe
jmp 0x1004bbb3
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xc
jle 0x1004bed3
mov dword [ebp - 0xb0], 0x17e5c285
mov dword [ebp - 0x1e4], 0xfffffffd
mov dword [ebp - 0x41c], 0x73c12d49
mov dword [ebp - 0x948], 0xb3395cc9
mov dword [ebp - 0xc4c], 0x48c0c84a
cmp dword [ebp - 0xc4], 0
jne 0x1004bc0d
mov eax, 0xbef7d651
test eax, eax
jne 0x1004bc0d
and dword [ebp - 0xc3c], 0
jmp 0x1004bc17
mov dword [ebp - 0xc3c], 1
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf1c], eax
cmp dword [ebp - 0xb0], 0
jge 0x1004bc38
mov dword [ebp - 0x504], 1
jmp 0x1004bc3f
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xfffffffb
jle 0x1004bc54
mov dword [ebp - 0x930], 1
jmp 0x1004bc5b
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x194], 0
je 0x1004be8f
mov dword [ebp - 0x240], 0x9f3c5a4a
mov dword [ebp - 0x940], 0xfffffffd
mov dword [ebp - 0xc5c], 0x5199242
mov dword [ebp - 0x1e4], 0x4957
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xf2c], eax
xor eax, eax
inc eax
je 0x1004be18
push 0xfffffffffffffff9
pop eax
sub eax, dword [ebp - 0xb0]
cmp eax, 1
jle 0x1004bce3
mov dword [ebp - 0x50c], 1
jmp 0x1004bcea
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0xb0]
jle 0x1004bd1c
mov dword [ebp - 0x938], 1
jmp 0x1004bd23
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
sub eax, 0x7a0d7c8a
jne 0x1004bd42
cmp dword [ebp - 0x240], 0
jne 0x1004bd42
and dword [ebp - 0xc44], 0
jmp 0x1004bd4c
mov dword [ebp - 0xc44], 1
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xf34], eax
mov dword [ebp - 0x41c], 0xc553
mov eax, dword [ebp - 0x41c]
imul eax, dword [ebp - 0x240]
test eax, eax
je 0x1004bd88
cmp dword [ebp - 0xb0], 0
je 0x1004bd88
mov dword [ebp - 0x514], 1
jmp 0x1004bd8f
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x940]
cmp eax, dword [ebp - 0xc4]
jl 0x1004bdb5
mov dword [ebp - 0x51c], 1
jmp 0x1004bdbc
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 0
je 0x1004bde6
cmp dword [ebp - 0xb0], 0
je 0x1004bde6
mov dword [ebp - 0x524], 1
jmp 0x1004bded
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
add eax, 0x96ad
je 0x1004be18
cmp dword [ebp - 0x194], 0
je 0x1004be18
cmp dword [ebp - 0xc4c], 0
je 0x1004be18
mov dword [ebp - 0x950], 1
jmp 0x1004be1f
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
sub eax, dword [ebp - 0xb0]
neg eax
jne 0x1004be4a
mov eax, 0xf8ef
test eax, eax
jne 0x1004be4a
cmp dword [ebp - 0x240], 0
jne 0x1004be4a
and dword [ebp - 0x52c], 0
jmp 0x1004be54
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x52c], eax
jle 0x1004be6e
mov dword [ebp - 0xc54], 1
jmp 0x1004be75
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xc5c], eax
jmp 0x1004bece
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1004bece
push 0x64c
push 0
push 0x11a9
push 0x137b
push 0x227b
push 0
push 0xee8
push 0x1b23
push 0x1b25
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x1004bba6
mov dword [ebp - 0x60], 0x57fd5464
mov dword [ebp - 0x248], 0xfffffffc
mov dword [ebp - 0x60], 0x1b
jmp 0x1004bef4
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffe9
jg 0x1004c587
mov dword [ebp - 0x8c], 0xf09cc25f
mov dword [ebp - 0x190], 0xfffffff6
push 3
lea ecx, [ebp - 0x464]
call fcn.10025cee
mov dword [ebp - 4], 2
mov dword [ebp - 0x250], 0xfd574417
mov dword [ebp - 0x2e8], 0
jmp 0x1004bf49
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jge 0x1004bf6b
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x464]
call fcn.10025d6c
mov dword [eax], 0xfffffffa
jmp 0x1004bf3c
push 1
lea ecx, [ebp - 0x464]
call fcn.10025d6c
push 2
lea ecx, [ebp - 0x464]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1004bfa2
cmp dword [ebp - 0x60], 0
je 0x1004bfa2
cmp dword [ebp - 0x60], 0
je 0x1004bfa2
mov dword [ebp - 0x958], 1
jmp 0x1004bfa9
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x958], eax
jl 0x1004bfc3
mov dword [ebp - 0x534], 1
jmp 0x1004bfca
and dword [ebp - 0x534], 0
push 2
lea ecx, [ebp - 0x464]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x534]
jl 0x1004bfed
mov dword [ebp - 0x960], 1
jmp 0x1004bff4
and dword [ebp - 0x960], 0
imul eax, dword [ebp - 0x960], 9
cmp dword [ebp - 0x190], eax
jle 0x1004c01e
cmp dword [ebp - 0x60], 0
je 0x1004c01e
cmp dword [ebp - 0x190], 0
je 0x1004c01e
mov dword [ebp - 0x53c], 1
jmp 0x1004c025
and dword [ebp - 0x53c], 0
mov dword [ebp - 0x8c], 0xbf2b
mov esi, dword [ebp - 0x8c]
imul esi, dword [ebp - 0x53c]
push 0
lea ecx, [ebp - 0x464]
call fcn.10025d6c
sub esi, dword [eax]
je 0x1004c511
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x594], 0x5672fee6
mov dword [ebp - 0x43c], 0xffffffff
mov dword [ebp - 0x9c8], 0x89349839
cmp dword [ebp - 0xe4], 0
je 0x1004c0ab
mov eax, 0x4801465e
test eax, eax
je 0x1004c0ab
mov dword [ebp - 0x554], 1
jmp 0x1004c0b2
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0xe4]
jl 0x1004c0cc
mov dword [ebp - 0x968], 1
jmp 0x1004c0d3
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0x9f8c5172
jae 0x1004c0eb
mov dword [ebp - 0x544], 1
jmp 0x1004c0f2
and dword [ebp - 0x544], 0
push 2
lea ecx, [ebp - 0x464]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x544]
jle 0x1004c115
mov dword [ebp - 0x970], 1
jmp 0x1004c11c
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x970]
jne 0x1004c13c
cmp dword [ebp - 0xe4], 0
jne 0x1004c13c
and dword [ebp - 0x54c], 0
jmp 0x1004c146
mov dword [ebp - 0x54c], 1
cmp dword [ebp - 0x54c], 0x14c2
jle 0x1004c15e
mov dword [ebp - 0x978], 1
jmp 0x1004c165
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x978], 0xfffffffd
jae 0x1004c17a
mov dword [ebp - 0x980], 1
jmp 0x1004c181
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x554]
cmp eax, dword [ebp - 0x980]
jne 0x1004c19f
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1004c19f
and dword [ebp - 0x55c], 0
jmp 0x1004c1a9
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x55c], eax
jle 0x1004c1c3
mov dword [ebp - 0x988], 1
jmp 0x1004c1ca
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xe4], 0x4322e7c6
jl 0x1004c1ee
mov dword [ebp - 0x564], 1
jmp 0x1004c1f5
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x564], eax
je 0x1004c20f
mov dword [ebp - 0x990], 1
jmp 0x1004c216
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x1004c2b5
mov dword [ebp - 0x998], 0x133d4965
mov dword [ebp - 0xa0], 2
jmp 0x1004c25a
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1004c2a4
mov dword [ebp - 0x44c], 0xffffffff
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0xfffffff8
jge 0x1004c28f
mov dword [ebp - 0x56c], 1
jmp 0x1004c296
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x998], eax
jmp 0x1004c24d
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x190], eax
jmp 0x1004c3b3
mov dword [ebp - 0x2f0], 0x950041ac
cmp dword [ebp - 0x248], 0
jne 0x1004c385
cmp dword [ebp - 0x438], 8
jbe 0x1004c2e1
mov dword [ebp - 0x574], 1
jmp 0x1004c2e8
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x574]
jne 0x1004c302
mov dword [ebp - 0x9a0], 1
jmp 0x1004c309
and dword [ebp - 0x9a0], 0
cmp dword [ebp - 0x248], 0
je 0x1004c327
cmp dword [ebp - 0x2f0], 0
je 0x1004c327
mov dword [ebp - 0xc64], 1
jmp 0x1004c32e
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x9a0]
sub eax, dword [ebp - 0x248]
je 0x1004c35d
cmp dword [ebp - 0x594], 0
je 0x1004c35d
mov dword [ebp - 0x57c], 1
jmp 0x1004c364
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x57c], eax
je 0x1004c37b
mov dword [ebp - 0x9a8], 1
jmp 0x1004c382
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf54], eax
imul eax, dword [ebp - 0xa0], 0xd039
sub eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xe4], 0
jne 0x1004c450
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf5c], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0x8c]
dec eax
cmp eax, dword [ebp - 0x43c]
je 0x1004c3f0
mov dword [ebp - 0x584], 1
jmp 0x1004c3f7
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x584], eax
jle 0x1004c411
mov dword [ebp - 0x9b0], 1
jmp 0x1004c418
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x9b0]
jge 0x1004c432
mov dword [ebp - 0x58c], 1
jmp 0x1004c439
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x58c], eax
jg 0x1004c450
and dword [ebp - 0xc6c], 0
jmp 0x1004c45a
mov dword [ebp - 0xc6c], 1
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0xe4]
jle 0x1004c480
mov dword [ebp - 0x9b8], 1
jmp 0x1004c487
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x9b8]
jne 0x1004c49e
mov dword [ebp - 0x9c0], 1
jmp 0x1004c4a5
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x9c0], eax
je 0x1004c4bf
mov dword [ebp - 0x59c], 1
jmp 0x1004c4c6
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 1
jg 0x1004c4db
mov dword [ebp - 0x5a4], 1
jmp 0x1004c4e2
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x5a4], eax
jg 0x1004c4fc
mov dword [ebp - 0x9d0], 1
jmp 0x1004c503
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0xa0], eax
jmp 0x1004c573
mov dword [ebp - 0xc74], 0xfffffffd
mov dword [ebp - 0x8c], 0
jmp 0x1004c534
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1004c556
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x464]
call fcn.10025d6c
mov dword [eax], 0x2b643983
jmp 0x1004c527
cmp dword [ebp - 0xc74], 0
je 0x1004c573
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x464]
call fcn.10025d50
jmp 0x1004beed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x464]
call fcn.10025d50
jmp 0x1004beed
mov dword [ebp - 0xd8c], 0
mov dword [ebp - 0x5f4], 0xffffffff
mov dword [ebp - 0xcd0], 0x73003f86
mov dword [ebp - 0x2f8], 0
jmp 0x1004c5be
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1004c5d7
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x30], 0x64b5f5c1
jmp 0x1004c5b1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x1004c9cd
mov dword [ebp - 0x94], 0x4182bd7b
mov dword [ebp - 0x1a4], 0x1b9c6fec
mov dword [ebp - 0x9f8], 1
mov dword [ebp - 0x258], 0
jmp 0x1004c61f
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1004c63b
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x100c], 0xc2b42d22
jmp 0x1004c612
mov dword [ebp - 0x94], 0
jmp 0x1004c654
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 6
jge 0x1004c9c8
mov dword [ebp - 0x3b4], 0xffffffff
mov dword [ebp - 0x68], 0xe779066
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0xffffffff
jae 0x1004c697
mov dword [ebp - 0xc7c], 1
jmp 0x1004c69e
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xf74], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp + eax - 0x30]
jle 0x1004c6c5
mov dword [ebp - 0x5ac], 1
jmp 0x1004c6cc
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x6eb2
jl 0x1004c6f0
mov dword [ebp - 0x9d8], 1
jmp 0x1004c6f7
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x9d8], eax
jle 0x1004c70e
mov dword [ebp - 0x5b4], 1
jmp 0x1004c715
and dword [ebp - 0x5b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x5b4], eax
jle 0x1004c733
mov dword [ebp - 0xc84], 1
jmp 0x1004c73a
and dword [ebp - 0xc84], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x30]
cmp ecx, dword [ebp + eax - 0x30]
jne 0x1004c75c
mov dword [ebp - 0xc8c], 1
jmp 0x1004c763
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp eax, dword [ebp - 0x94]
jg 0x1004c78a
mov dword [ebp - 0x9e0], 1
jmp 0x1004c791
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x9e0], eax
je 0x1004c7b8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x1004c7b8
mov dword [ebp - 0xc94], 1
jmp 0x1004c7bf
and dword [ebp - 0xc94], 0
cmp dword [ebp - 0x68], 0xd574417f
ja 0x1004c7d4
mov dword [ebp - 0x5bc], 1
jmp 0x1004c7db
and dword [ebp - 0x5bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov ecx, dword [ebp - 0x5bc]
lea eax, [ecx + eax + 1]
cmp eax, dword [ebp - 0x94]
jl 0x1004c803
mov dword [ebp - 0x9e8], 1
jmp 0x1004c80a
and dword [ebp - 0x9e8], 0
imul eax, dword [ebp - 0x9e8], 0xfffd
cmp eax, 0xfaea
jge 0x1004c989
mov dword [ebp - 0xc9c], 0
cmp dword [ebp - 0x68], 0
jne 0x1004c8b3
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x9f8]
jl 0x1004c84d
mov dword [ebp - 0x5c4], 1
jmp 0x1004c854
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
neg eax
cmp eax, 6
jne 0x1004c86d
mov dword [ebp - 0x9f0], 1
jmp 0x1004c874
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xc9c]
cmp eax, dword [ebp - 0x1a4]
jg 0x1004c89a
mov dword [ebp - 0x5cc], 1
jmp 0x1004c8a1
and dword [ebp - 0x5cc], 0
imul eax, dword [ebp - 0x5cc], 0xd890
cmp eax, dword [ebp - 0x9f8]
jge 0x1004c8c6
push 2
pop eax
test eax, eax
je 0x1004c8c6
mov dword [ebp - 0x5d4], 1
jmp 0x1004c8cd
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 0
jne 0x1004c8e2
mov dword [ebp - 0xa00], 1
jmp 0x1004c8e9
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xa00]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x30], eax
jge 0x1004c90b
mov dword [ebp - 0xd6c], 1
jmp 0x1004c912
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xf84], eax
cmp dword [ebp - 0x68], 7
jl 0x1004c930
mov dword [ebp - 0x5dc], 1
jmp 0x1004c937
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
neg eax
cmp eax, 5
jne 0x1004c950
mov dword [ebp - 0xa08], 1
jmp 0x1004c957
and dword [ebp - 0xa08], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa08]
mov dword [ebp + eax - 0x100c], ecx
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1004c987
push 0x14b3
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x1004c9a0
mov dword [ebp - 0x5e4], 0xfffffff8
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x68], 0
jmp 0x1004c9b0
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x14
jg 0x1004c9c3
cmp dword [ebp - 0x94], 0
je 0x1004c9c1
jmp 0x1004c9c3
jmp 0x1004c9a9
jmp 0x1004c647
jmp 0x1004cb49
push 2
lea ecx, [ebp - 0x47c]
call fcn.10025cee
mov dword [ebp - 4], 3
mov dword [ebp - 0x5ec], 0xffffffff
mov dword [ebp - 0x300], 0
jmp 0x1004ca04
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1004ca26
push dword [ebp - 0x300]
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x1004c9f7
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004ca5c
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xa10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa10]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
cmp dword [eax], 0
jg 0x1004cb3a
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0xf8c], eax
mov dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
add eax, 0x80f9
mov dword [ebp - 0xd8c], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x30]
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x30], esi
jle 0x1004cad1
mov dword [ebp - 0xa18], 1
jmp 0x1004cad8
and dword [ebp - 0xa18], 0
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0xa18], eax
jg 0x1004caff
mov dword [ebp - 0xcf8], 1
jmp 0x1004cb06
and dword [ebp - 0xcf8], 0
push 1
lea ecx, [ebp - 0x47c]
call fcn.10025d6c
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0xf94], eax
mov dword [ebp - 0x5f4], 9
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0xcd0], eax
jmp 0x1004ca38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.10025d50
cmp dword [0x10622238], 0
jne 0x10050b18
mov dword [ebp - 0x14], 0xfffffffc
push 2
lea ecx, [ebp - 0xb74]
call fcn.10025cee
mov dword [ebp - 4], 4
mov dword [ebp - 0x624], 0x993911e7
mov dword [ebp - 0xa70], 0x5d33
mov dword [ebp - 0xb94], 1
mov dword [ebp - 0x260], 0
jmp 0x1004cba8
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x1004cbca
push dword [ebp - 0x260]
lea ecx, [ebp - 0xb74]
call fcn.10025d6c
mov dword [eax], 0xfffffff7
jmp 0x1004cb9b
cmp dword [ebp - 0x14], 0
jne 0x1004cd06
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x1004cbe8
mov dword [ebp - 0xa20], 1
jmp 0x1004cbef
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0xffffffff
jle 0x1004cc04
mov dword [ebp - 0x5fc], 1
jmp 0x1004cc0b
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
sub eax, 5
cmp eax, 0x27f0
jne 0x1004cc27
mov dword [ebp - 0xa28], 1
jmp 0x1004cc2e
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xa28]
cmp eax, 0xffffffff
jg 0x1004cc48
mov dword [ebp - 0x604], 1
jmp 0x1004cc4f
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x604]
cmp eax, 0x819d3388
jb 0x1004cc64
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
inc eax
sub eax, dword [ebp - 0x14]
cmp eax, 0x951b
jg 0x1004cc7e
mov dword [ebp - 0xa30], 1
jmp 0x1004cc85
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
sub eax, dword [ebp - 0x14]
jne 0x1004cc94
cmp dword [ebp - 0x14], 0
mov eax, 0x547507a
neg eax
cmp eax, dword [ebp - 0x14]
jl 0x1004ccac
mov dword [ebp - 0x60c], 1
jmp 0x1004ccb3
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x60c], eax
jle 0x1004ccca
mov dword [ebp - 0xa38], 1
jmp 0x1004ccd1
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xa38]
jg 0x1004cce8
mov dword [ebp - 0x614], 1
jmp 0x1004ccef
and dword [ebp - 0x614], 0
imul eax, dword [ebp - 0x614], 0xba56
test eax, eax
jne 0x1004cd06
and dword [ebp - 0xa40], 0
jmp 0x1004cd10
mov dword [ebp - 0xa40], 1
cmp dword [ebp - 0xa40], 9
jge 0x1004cd25
mov dword [ebp - 0x61c], 1
jmp 0x1004cd2c
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x61c]
cmp eax, dword [ebp - 0x14]
jge 0x1004cf37
or eax, 0xffffffff
je 0x1004cf37
mov dword [ebp - 0x1c8], 0x6a4a
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x14], 0
jmp 0x1004cd6f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1004cf35
mov dword [ebp - 0xbb8], 0xfffffff6
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb74]
call fcn.10025d6c
cmp dword [ebp - 0x1c8], 0
je 0x1004cdab
or eax, 0xffffffff
je 0x1004cdab
mov dword [ebp - 0xa48], 1
jmp 0x1004cdb2
and dword [ebp - 0xa48], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb74]
call fcn.10025d6c
mov ecx, dword [ebp - 0xa48]
cmp ecx, dword [eax]
jne 0x1004cdd6
mov dword [ebp - 0xa50], 1
jmp 0x1004cddd
and dword [ebp - 0xa50], 0
mov dword [ebp - 0x624], 0xfffffff8
mov eax, dword [ebp - 0x624]
cmp eax, dword [ebp - 0xa50]
je 0x1004ce01
mov dword [ebp - 0x62c], 1
jmp 0x1004ce08
and dword [ebp - 0x62c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb74]
call fcn.10025d6c
mov ecx, dword [ebp - 0x62c]
imul ecx, dword [eax]
cmp ecx, 0x3d4f39ab
jge 0x1004ce33
mov dword [ebp - 0xa58], 1
jmp 0x1004ce3a
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 0
jne 0x1004ce4f
mov dword [ebp - 0x634], 1
jmp 0x1004ce56
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x634]
jle 0x1004ce6b
cmp dword [ebp - 0xa70], 0
imul eax, dword [ebp - 0xbb8], 0
sub eax, 0x6715623a
cmp eax, 0xa41183d9
jae 0x1004ce8a
mov dword [ebp - 0xa60], 1
jmp 0x1004ce91
and dword [ebp - 0xa60], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb74]
call fcn.10025d6c
mov ecx, dword [ebp - 0xa60]
cmp ecx, dword [eax]
je 0x1004ceb5
mov dword [ebp - 0x63c], 1
jmp 0x1004cebc
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x63c]
jle 0x1004ced6
mov dword [ebp - 0xa68], 1
jmp 0x1004cedd
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 0xe6de11d6
jbe 0x1004cefc
push 5
pop eax
test eax, eax
je 0x1004cefc
mov dword [ebp - 0x8bc], 1
jmp 0x1004cf03
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x8bc], eax
jle 0x1004cf1d
mov dword [ebp - 0x64c], 1
jmp 0x1004cf24
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0xb94], eax
jmp 0x1004cd68
jmp 0x1004cf4a
mov dword [ebp - 0xd4c], 0xfffffffe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.10025d50
mov dword [ebp - 0xb9c], 0x7a1e
lea eax, [ebp - 0xb9c]
push eax
call fcn.10046321
pop ecx
mov dword [ebp - 0xb0c], eax
push 2
lea ecx, [ebp - 0x1048]
call fcn.10025cee
mov dword [ebp - 4], 5
mov dword [ebp - 0x308], 0
jmp 0x1004cfa3
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1004cfc5
push dword [ebp - 0x308]
lea ecx, [ebp - 0x1048]
call fcn.10025d6c
mov dword [eax], 0x2e0c
jmp 0x1004cf96
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x1004cff4
push 0
push 0
push 0
push 0x597
push 0x155c
push 0
push 0x2480
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1004d022
push 0x22ac
push 0x3e9
push 0x23f6
push 0xcc9
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.10025d50
mov dword [ebp - 0xf9c], 0
mov dword [ebp - 0xfa4], 0xd68f985
mov dword [ebp - 0xce0], 0xfffffff9
mov dword [ebp - 0x8c4], 3
mov eax, dword [ebp - 0xce0]
cmp eax, dword [ebp - 0x8c4]
jle 0x1004d073
mov dword [ebp - 0xa94], 1
jmp 0x1004d07a
and dword [ebp - 0xa94], 0
cmp dword [ebp - 0xa94], 0xa115
jl 0x1004d092
mov dword [ebp - 0x654], 1
jmp 0x1004d099
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x8c4], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1004d0c4
push 0
push 0xdaf
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov byte [ebp - 0x204], 0xb
mov byte [ebp - 0x203], 0x5d
mov byte [ebp - 0x202], 4
mov byte [ebp - 0x201], 0x1d
mov byte [ebp - 0x200], 0xa
mov byte [ebp - 0x1ff], 0x20
mov byte [ebp - 0x1fe], 8
mov byte [ebp - 0x1fd], 0x2a
mov byte [ebp - 0x1fc], 3
mov byte [ebp - 0x1fb], 0x39
mov byte [ebp - 0x1fa], 0
mov byte [ebp - 0x1f9], 0x11
mov byte [ebp - 0x1f8], 7
mov byte [ebp - 0x1f7], 0x2e
mov byte [ebp - 0x1f6], 2
mov byte [ebp - 0x1f5], 0x1d
mov byte [ebp - 0x1f4], 1
mov byte [ebp - 0x1f3], 0x11
mov byte [ebp - 0x1f2], 9
mov byte [ebp - 0x1f1], 0xb
mov byte [ebp - 0x1f0], 0xc
mov byte [ebp - 0x1ef], 0x39
mov byte [ebp - 0x1ee], 5
mov byte [ebp - 0x1ed], 0x25
mov byte [ebp - 0x1ec], 2
mov byte [ebp - 0x1eb], 0xa
mov byte [ebp - 0x1ea], 0x95
mov byte [ebp - 0x1e9], 6
mov byte [ebp - 0x1e8], 1
mov dword [ebp - 0x158], 3
mov dword [ebp - 0x1ac], 8
push 3
lea ecx, [ebp - 0xb28]
call fcn.10025cee
mov dword [ebp - 4], 6
mov dword [ebp - 0x38], 0
jmp 0x1004d1c7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1004d1e3
push dword [ebp - 0x38]
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
mov dword [eax], 4
jmp 0x1004d1c0
mov dword [ebp - 0x38], 0
jmp 0x1004d1f3
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004d209
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x268], 0xcc01
jmp 0x1004d1ec
mov dword [ebp - 0x38], 0
jmp 0x1004d219
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004d22f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xcf0], 0xffffffff
jmp 0x1004d212
mov eax, 0x91df82d8
test eax, eax
je 0x1004d24d
cmp dword [ebp - 0x158], 0
je 0x1004d24d
mov dword [ebp - 0xba4], 1
jmp 0x1004d254
and dword [ebp - 0xba4], 0
xor eax, eax
inc eax
je 0x1004d26e
mov eax, 0x26d8d383
test eax, eax
je 0x1004d26e
mov dword [ebp - 0x65c], 1
jmp 0x1004d275
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x65c]
jne 0x1004d28f
mov dword [ebp - 0x9fc], 1
jmp 0x1004d296
and dword [ebp - 0x9fc], 0
cmp dword [ebp - 0x9fc], 1
jbe 0x1004d2ab
mov dword [ebp - 0x664], 1
jmp 0x1004d2b2
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x158]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x664]
jle 0x1004d2e4
cmp dword [ebp - 0x1ac], 0
jne 0x1004d2e4
and dword [ebp - 0x8cc], 0
jmp 0x1004d2ee
mov dword [ebp - 0x8cc], 1
push 2
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
mov ecx, dword [ebp - 0x8cc]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
cmp dword [eax], 0
jne 0x1004d391
mov dword [ebp - 0x1ac], 0x92e6
mov esi, dword [ebp - 0x1ac]
push 2
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
cmp dword [eax], esi
jne 0x1004d343
xor eax, eax
jne 0x1004d343
and dword [ebp - 0x66c], 0
jmp 0x1004d34d
mov dword [ebp - 0x66c], 1
push 2
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
mov ecx, dword [ebp - 0x66c]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xb28]
call fcn.10025d6c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
je 0x1004d391
mov eax, 0xfff8
test eax, eax
jne 0x1004d391
and dword [ebp - 0xd54], 0
jmp 0x1004d39b
mov dword [ebp - 0xd54], 1
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xfac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0x158], 0xfffffff7
jge 0x1004d3cf
mov dword [ebp - 0xab0], 1
jmp 0x1004d3d6
and dword [ebp - 0xab0], 0
cmp dword [ebp - 0xab0], 1
jle 0x1004d3eb
mov dword [ebp - 0xbac], 1
jmp 0x1004d3f2
and dword [ebp - 0xbac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0xfbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcf0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.10025d50
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x204]
and eax, 0x25
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x204]
or ecx, 0x25
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x204]
mov byte [ebp + eax - 0xb84], cl
mov dword [ebp - 0x34], 2
and dword [ebp - 0x1d0], 0
jmp 0x1004d47f
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
jae 0x1004e2ff
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0xcc], 0x622b6078
mov dword [ebp - 0x8d4], 0x5a9390df
mov dword [ebp - 0xaa0], 0x12ef314d
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x68c], 0xa8d6e859
mov dword [ebp - 0x270], 0xd909cc0f
mov dword [ebp - 0x3bc], 0xd4d3380d
mov dword [ebp - 0xbb4], 0x1b17
cmp dword [ebp - 0xbb4], 0x12c9
jge 0x1004d64c
push 0x20
pop eax
imul esi, eax, 0
call fcn.1005e435
add eax, esi
push eax
push 0x10007990
push 0x100099b4
call fcn.1005e8cf
add esp, 0xc
push 0x10622200
push 0x1000888c
call fcn.1005e2fb
pop ecx
pop ecx
and dword [ebp - 0x404], 0
jmp 0x1004d53a
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
cmp eax, dword [0x10622200]
jge 0x1004d64c
lea eax, [ebp - 0x14c]
push eax
push 0x100099b8
call fcn.1005e2fb
pop ecx
pop ecx
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
call fcn.1004acc3
pop ecx
pop ecx
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa98], edx
mov eax, dword [ebp - 0xa9c]
sub eax, 1
mov ecx, dword [ebp - 0xa98]
sbb ecx, 0
push ecx
push eax
call fcn.1004abff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14c]
sub ecx, eax
mov eax, dword [ebp - 0x148]
sbb eax, edx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], eax
push dword [ebp - 0xa98]
push dword [ebp - 0xa9c]
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
call fcn.1004ae47
add esp, 0x10
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xaa4], edx
mov eax, dword [ebp - 0xaa8]
sub eax, 1
mov ecx, dword [ebp - 0xaa4]
sbb ecx, 0
push ecx
push eax
call fcn.1004add2
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14c]
sub ecx, eax
mov eax, dword [ebp - 0x148]
sbb eax, edx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], eax
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
push dword [ebp - 0xaa4]
push dword [ebp - 0xaa8]
call fcn.1004af56
add esp, 0x10
push edx
push eax
push 0x1000889c
call fcn.1005e68c
add esp, 0xc
jmp 0x1004d52d
mov dword [ebp - 0x6ac], 0x3c62ed5b
mov dword [ebp - 0xbbc], 6
mov dword [ebp - 0x310], 0
jmp 0x1004d679
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 3
jge 0x1004d695
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x1144], 0
jmp 0x1004d66c
cmp dword [ebp - 0x118], 0
je 0x1004d7b9
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xcc]
je 0x1004d6bc
mov dword [ebp - 0x674], 1
jmp 0x1004d6c3
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x8d4]
cmp eax, dword [ebp - 0xcc]
jne 0x1004d6e9
mov dword [ebp - 0x67c], 1
jmp 0x1004d6f0
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
neg eax
sub eax, dword [ebp - 0xcc]
jne 0x1004d709
cmp dword [ebp - 0x118], 0
je 0x1004d710
cmp dword [ebp - 0x118], 0
cmp dword [ebp - 0xcc], 1
ja 0x1004d725
mov dword [ebp - 0xa04], 1
jmp 0x1004d72c
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0xa04]
cmp eax, 7
jl 0x1004d74a
mov dword [ebp - 0x684], 1
jmp 0x1004d751
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xffffffff
jl 0x1004d766
mov dword [ebp - 0x8dc], 1
jmp 0x1004d76d
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8dc], eax
jne 0x1004d787
mov dword [ebp - 0xd5c], 1
jmp 0x1004d78e
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xfd4], eax
mov eax, 0x495e
add eax, 0x3cc9
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xfdc], eax
cmp dword [ebp - 0x270], 0
je 0x1004d7f1
cmp dword [ebp - 0x270], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0xaa0]
cmp eax, 4
jb 0x1004d80f
mov dword [ebp - 0x694], 1
jmp 0x1004d816
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x694], eax
jne 0x1004d830
mov dword [ebp - 0x8e4], 1
jmp 0x1004d837
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8e4], eax
jne 0x1004d851
mov dword [ebp - 0x69c], 1
jmp 0x1004d858
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x318]
jl 0x1004d87e
mov dword [ebp - 0xa0c], 1
jmp 0x1004d885
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0xa0c], eax
jg 0x1004d89a
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1004d8ac
cmp dword [ebp - 0x3bc], 0
jne 0x1004d8ac
and dword [ebp - 0x6a4], 0
jmp 0x1004d8b6
mov dword [ebp - 0x6a4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1144]
cmp dword [ebp - 0x6a4], eax
jne 0x1004d8d7
mov dword [ebp - 0x8ec], 1
jmp 0x1004d8de
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x6ac]
jne 0x1004d904
mov dword [ebp - 0xab8], 1
jmp 0x1004d90b
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0xc7f2bac4
jb 0x1004d923
mov dword [ebp - 0x6b4], 1
jmp 0x1004d92a
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0xbbc], eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x204]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1004e26b
mov dword [ebp - 0x3c4], 0x3d8d
mov dword [ebp - 0xa1c], 0xc4c8d3c8
push 3
lea ecx, [ebp - 0xb40]
call fcn.10025cee
mov dword [ebp - 4], 7
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x320], 0x7c14ab65
push 2
lea ecx, [ebp - 0xb68]
call fcn.10025cee
mov byte [ebp - 4], 8
mov dword [ebp - 0x8fc], 1
push 3
lea ecx, [ebp - 0xe94]
call fcn.10025cee
mov byte [ebp - 4], 9
mov dword [ebp - 0x904], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x1004d9d3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1004d9ec
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004d9cc
mov dword [ebp - 0x20], 0
jmp 0x1004d9fc
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1004da18
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb68]
call fcn.10025d6c
mov dword [eax], 3
jmp 0x1004d9f5
mov dword [ebp - 0x20], 0
jmp 0x1004da28
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1004da3e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc04], 1
jmp 0x1004da21
mov dword [ebp - 0x20], 0
jmp 0x1004da4e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1004da6a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe94]
call fcn.10025d6c
mov dword [eax], 0x40b319bd
jmp 0x1004da47
push 1
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
cmp dword [ebp - 0x278], 0xfffffff9
jae 0x1004da8c
mov dword [ebp - 0x8f4], 1
jmp 0x1004da93
and dword [ebp - 0x8f4], 0
mov esi, dword [ebp - 0x320]
push 1
lea ecx, [ebp - 0xb68]
call fcn.10025d6c
mov ecx, dword [ebp - 0x8f4]
add ecx, dword [eax]
neg ecx
cmp ecx, esi
jle 0x1004dac0
mov dword [ebp - 0x6bc], 1
jmp 0x1004dac7
and dword [ebp - 0x6bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc04]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0xbc4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc04]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc04], eax
mov eax, dword [ebp - 0xd64]
cmp eax, dword [ebp - 0xbc4]
jne 0x1004db1b
mov dword [ebp - 0xa14], 1
jmp 0x1004db22
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xa14]
sub eax, 0xffff
mov dword [ebp - 0x8fc], eax
push 1
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
mov esi, eax
push 1
lea ecx, [ebp - 0xb68]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1004db61
mov dword [ebp - 0x6c4], 1
jmp 0x1004db68
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
sub eax, dword [ebp - 0x320]
cmp eax, 0xfffffff6
jg 0x1004db80
cmp dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x320], 0
je 0x1004dba7
push 0
lea ecx, [ebp - 0xe94]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1004dba7
mov dword [ebp - 0x6cc], 1
jmp 0x1004dbae
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
inc eax
cmp eax, 0x1007
jne 0x1004dbda
push 0
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1004dbda
mov dword [ebp - 0xaac], 1
jmp 0x1004dbe1
and dword [ebp - 0xaac], 0
push 1
lea ecx, [ebp - 0xb68]
call fcn.10025d6c
mov ecx, dword [ebp - 0xaac]
cmp ecx, dword [eax]
jle 0x1004dc04
mov dword [ebp - 0x444], 1
jmp 0x1004dc0b
and dword [ebp - 0x444], 0
push 0
lea ecx, [ebp - 0xb68]
call fcn.10025d6c
mov ecx, dword [ebp - 0x444]
mov dword [eax], ecx
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x444], eax
jne 0x1004dc3a
mov dword [ebp - 0x6d4], 1
jmp 0x1004dc41
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x6d4]
cmp eax, 1
je 0x1004dc5e
mov dword [ebp - 0x6dc], 1
jmp 0x1004dc65
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x904]
imul eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xfe4], eax
mov esi, dword [ebp - 0x3c4]
push 1
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
cmp esi, dword [eax]
jl 0x1004dca7
mov dword [ebp - 0x6e4], 1
jmp 0x1004dcae
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp - 0xa1c]
cmp eax, dword [ebp - 0x6e4]
je 0x1004dcd4
mov dword [ebp - 0x90c], 1
jmp 0x1004dcdb
and dword [ebp - 0x90c], 0
push 1
lea ecx, [ebp - 0xb40]
call fcn.10025d6c
mov ecx, dword [ebp - 0x90c]
cmp ecx, dword [eax]
jl 0x1004dcfe
mov dword [ebp - 0x6ec], 1
jmp 0x1004dd05
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x6ec]
je 0x1004dd1f
mov dword [ebp - 0xac0], 1
jmp 0x1004dd26
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe94]
call fcn.10025d50
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb68]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.10025d50
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x204]
inc eax
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x204]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
push 1
lea ecx, [ebp - 0xb08]
call fcn.10025cee
mov dword [ebp - 4], 0xa
push 1
lea ecx, [ebp - 0xcbc]
call fcn.10025cee
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x178], 1
push 3
lea ecx, [ebp - 0xcac]
call fcn.10025cee
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xbd4], 0x7c3b
mov dword [ebp - 0x3c], 0
jmp 0x1004dde0
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004ddf9
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
or dword [eax], 0xffffffff
jmp 0x1004ddd9
mov dword [ebp - 0x3c], 0
jmp 0x1004de09
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004de25
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xcbc]
call fcn.10025d6c
mov dword [eax], 0xf3e76e5b
jmp 0x1004de02
mov dword [ebp - 0x3c], 0
jmp 0x1004de35
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1004de4e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xcac]
call fcn.10025d6c
or dword [eax], 0xffffffff
jmp 0x1004de2e
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1004dfbf
mov dword [ebp - 0x40c], 0x34fda0e6
mov dword [ebp - 0x448], 0xffffffff
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xff0], eax
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
mov eax, dword [eax]
add eax, 0x717a5850
cmp dword [ebp - 0x40c], eax
jge 0x1004deb8
mov dword [ebp - 0x3cc], 1
jmp 0x1004debf
and dword [ebp - 0x3cc], 0
push 0
lea ecx, [ebp - 0xcbc]
call fcn.10025d6c
mov ecx, dword [ebp - 0x3cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x3cc], eax
jl 0x1004deee
mov dword [ebp - 0x6f4], 1
jmp 0x1004def5
and dword [ebp - 0x6f4], 0
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax]
je 0x1004df18
mov dword [ebp - 0x914], 1
jmp 0x1004df1f
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x914]
jge 0x1004df39
mov dword [ebp - 0x6fc], 1
jmp 0x1004df40
and dword [ebp - 0x6fc], 0
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6fc]
je 0x1004df63
mov dword [ebp - 0xd40], 1
jmp 0x1004df6a
and dword [ebp - 0xd40], 0
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
cmp dword [eax], 0
jne 0x1004df89
push 0
lea ecx, [ebp - 0xb08]
call fcn.10025d6c
push 0
lea ecx, [ebp - 0xcbc]
call fcn.10025d6c
cmp dword [eax], 4
jle 0x1004dfa7
mov dword [ebp - 0xa24], 1
jmp 0x1004dfae
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x178], eax
jmp 0x1004e1b6
mov dword [ebp - 0x280], 0
jmp 0x1004dfd8
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x1004dff4
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xfec], 1
jmp 0x1004dfcb
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1004e014
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x704], 0x6d93
mov dword [ebp - 0xd00], 0x100099c0
cmp dword [ebp - 0x704], 0x6e6f
jle 0x1004e11e
push 0x1991
push 0x5cf
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
and dword [ebp - 0x328], 0
jmp 0x1004e05e
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xc7d
jge 0x1004e11e
and dword [ebp - 0x288], 0
jmp 0x1004e084
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x5023
jge 0x1004e119
and dword [ebp - 0x330], 0
jmp 0x1004e0aa
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xef
jge 0x1004e114
mov eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x288]
sub eax, dword [ebp - 0x330]
cdq
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc0c], edx
push dword [ebp - 0xc0c]
push dword [ebp - 0xc10]
lea ecx, [ebp - 0x11fc]
call fcn.1000b1a5
pop ecx
pop ecx
mov dword [ebp - 0xbcc], eax
mov ecx, dword [ebp - 0xbcc]
call fcn.100259bb
push eax
call fcn.1005e68c
pop ecx
lea ecx, [ebp - 0x11fc]
call fcn.1002599d
jmp 0x1004e09d
jmp 0x1004e077
jmp 0x1004e051
mov dword [ebp - 0x178], 0
jmp 0x1004e137
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jg 0x1004e16e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfec], 0
je 0x1004e152
jmp 0x1004e16e
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1004e16c
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1004e12a
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x704], 0x6bee
jge 0x1004e18a
push dword [ebp - 0xd00]
call fcn.1005e68c
pop ecx
jmp 0x1004e1a6
mov dword [ebp - 4], 0xc
jmp 0x1004e1b6
push 1
lea ecx, [ebp - 0xcac]
call fcn.10025d6c
push 0xfffffffffffffffa
pop ecx
sub ecx, dword [eax]
mov dword [ebp - 0xbd4], ecx
push 2
lea ecx, [ebp - 0xcac]
call fcn.10025d6c
mov esi, eax
push 0
lea ecx, [ebp - 0xcbc]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1004e1fc
mov dword [ebp - 0x91c], 1
jmp 0x1004e203
and dword [ebp - 0x91c], 0
push 1
lea ecx, [ebp - 0xcac]
call fcn.10025d6c
mov ecx, dword [ebp - 0x91c]
cmp ecx, dword [eax]
jne 0x1004e226
mov dword [ebp - 0x70c], 1
jmp 0x1004e22d
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x178], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xcac]
call fcn.10025d50
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xcbc]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.10025d50
jmp 0x1004d477
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1d0]
movzx eax, byte [ebp + eax - 0x206]
movsx eax, byte [ebp + eax - 0xb84]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x203]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1d0]
movzx eax, byte [ebp + eax - 0x206]
movsx eax, byte [ebp + eax - 0xb84]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0x203]
and edx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1d0]
movzx eax, byte [ebp + eax - 0x206]
movsx eax, byte [ebp + eax - 0xb84]
mov esi, dword [ebp - 0x34]
movzx ebx, byte [ebp + esi - 0x203]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x204]
mov byte [ebp + eax - 0xb84], bl
and dword [ebp - 0x1d0], 0
jmp 0x1004d477
mov dword [ebp - 0xb4], 0xfffffff7
mov dword [ebp - 0x418], 0xb64b6930
mov dword [ebp - 0x338], 0x6f62939c
mov dword [ebp - 0xb4], 0
jmp 0x1004e336
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xa
jge 0x1004e73d
mov dword [ebp - 0x120], 0xaa9ac70c
mov dword [ebp - 0xd74], 0xfffffff8
mov dword [ebp - 0x744], 0xaa9b2235
mov dword [ebp - 0xbe4], 0xa95a4792
mov dword [ebp - 0x120], 0
jmp 0x1004e384
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 6
jg 0x1004e738
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xbdc], 0x9f33d48
mov dword [ebp - 0xd08], 0xffffffff
cmp dword [ebp - 0x120], 0
jne 0x1004e425
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0xb4], 0
je 0x1004e3e2
cmp dword [ebp - 0x120], 0
je 0x1004e3e2
mov dword [ebp - 0xac8], 1
jmp 0x1004e3e9
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0xac8], 0x626a9d9e
jne 0x1004e401
mov dword [ebp - 0x714], 1
jmp 0x1004e408
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xd74]
imul eax, dword [ebp - 0x714]
cmp eax, 0x7c2f5a26
je 0x1004e425
and dword [ebp - 0x924], 0
jmp 0x1004e42f
mov dword [ebp - 0x924], 1
imul eax, dword [ebp - 0x924], 0x281c
cmp eax, dword [ebp - 0xb4]
jle 0x1004e453
cmp dword [ebp - 0xb4], 0
jne 0x1004e453
and dword [ebp - 0x71c], 0
jmp 0x1004e45d
mov dword [ebp - 0x71c], 1
cmp dword [ebp - 0x71c], 0xfe9f4864
jae 0x1004e475
mov dword [ebp - 0xa2c], 1
jmp 0x1004e47c
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0xa2c], eax
je 0x1004e496
mov dword [ebp - 0x724], 1
jmp 0x1004e49d
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x724], eax
jl 0x1004e4b7
mov dword [ebp - 0x92c], 1
jmp 0x1004e4be
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x92c], eax
jge 0x1004e4d8
mov dword [ebp - 0x72c], 1
jmp 0x1004e4df
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x72c]
jge 0x1004e4f9
mov dword [ebp - 0xaec], 1
jmp 0x1004e500
and dword [ebp - 0xaec], 0
mov eax, 0x67d5
sub eax, dword [ebp - 0xaec]
add eax, 0xf30
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
imul eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jg 0x1004e537
mov dword [ebp - 0x734], 1
jmp 0x1004e53e
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0xfff8
jbe 0x1004e556
mov dword [ebp - 0x934], 1
jmp 0x1004e55d
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x934]
cmp eax, dword [ebp - 0xb8]
jne 0x1004e57e
mov dword [ebp - 0x73c], 1
jmp 0x1004e585
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x73c], eax
jg 0x1004e5d7
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1004e5b6
push 0x2366
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1004e5d2
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1004e733
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x290], 0
jmp 0x1004e5fa
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1004e616
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xe28], 0x76dcb0c7
jmp 0x1004e5ed
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xe28], 0x8d3f
mov ecx, dword [ebp - 0x3d4]
mov edx, dword [ebp - 0x3d4]
dec edx
mov dword [ebp - 0x3d4], edx
cmp ecx, eax
jg 0x1004e674
cmp dword [ebp - 0xb8], 0
jne 0x1004e655
or eax, 0xffffffff
jne 0x1004e655
and dword [ebp - 0xa34], 0
jmp 0x1004e65f
mov dword [ebp - 0xa34], 1
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0
jne 0x1004e6af
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x418]
inc ecx
inc ecx
cmp ecx, dword [ebp + eax - 0xe28]
je 0x1004e697
mov dword [ebp - 0x93c], 1
jmp 0x1004e69e
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
add eax, 0xb681
sub eax, dword [ebp - 0xbdc]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [ebp + eax - 0xe28]
jne 0x1004e6d0
mov dword [ebp - 0x74c], 1
jmp 0x1004e6d7
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xd08]
cmp dword [ebp - 0x74c], eax
je 0x1004e6f2
xor eax, eax
jne 0x1004e6f2
and dword [ebp - 0xabc], 0
jmp 0x1004e6fc
mov dword [ebp - 0xabc], 1
cmp dword [ebp - 0xabc], 0x4e19
jg 0x1004e714
mov dword [ebp - 0x754], 1
jmp 0x1004e71b
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xbe4], eax
jmp 0x1004e377
jmp 0x1004e329
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xb84], 0
mov dword [ebp - 0x160], 0xfe0a8eac
push 3
lea ecx, [ebp - 0x1058]
call fcn.10025cee
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x3dc], 0x16b471df
mov dword [ebp - 0x298], 0
jmp 0x1004e78c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1004e7ae
push dword [ebp - 0x298]
lea ecx, [ebp - 0x1058]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x1004e77f
mov dword [ebp - 0x160], 9
jmp 0x1004e7c7
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 7
jl 0x1004e9b0
mov dword [ebp - 0xd48], 0x6c8cac31
mov dword [ebp - 0x340], 0
jmp 0x1004e7f7
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x1004e813
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x128], 0x76942a1e
jmp 0x1004e7ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x128], 0
jmp 0x1004e841
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x128], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 2
jg 0x1004e9ab
mov dword [ebp - 0x1b4], 0x7a61eefb
mov dword [ebp - 0x944], 3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x1b4]
dec edx
mov dword [ebp - 0x1b4], edx
cmp ecx, eax
jne 0x1004e993
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 0
jl 0x1004e8b2
mov dword [ebp - 0xa3c], 1
jmp 0x1004e8b9
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x3dc]
je 0x1004e8d3
mov dword [ebp - 0x75c], 1
jmp 0x1004e8da
and dword [ebp - 0x75c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp dword [ebp - 0x75c], eax
jne 0x1004e901
cmp dword [ebp - 0x160], 0
jne 0x1004e901
and dword [ebp - 0x764], 0
jmp 0x1004e90b
mov dword [ebp - 0x764], 1
mov eax, dword [ebp - 0xa3c]
add eax, dword [ebp - 0x764]
jne 0x1004e925
mov dword [ebp - 0x94c], 1
jmp 0x1004e92c
and dword [ebp - 0x94c], 0
cmp dword [ebp - 0x94c], 0x2668
jle 0x1004e944
mov dword [ebp - 0x76c], 1
jmp 0x1004e94b
and dword [ebp - 0x76c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
sub ecx, dword [ebp - 0x76c]
cmp ecx, dword [ebp + eax - 0x128]
jl 0x1004e972
mov dword [ebp - 0xb14], 1
jmp 0x1004e979
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0xb14], eax
jne 0x1004e993
mov dword [ebp - 0x774], 1
jmp 0x1004e99a
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0xd48], eax
jmp 0x1004e826
jmp 0x1004e7ba
mov dword [ebp - 0x160], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1058]
call fcn.10025d50
lea eax, [ebp - 0xb84]
push eax
lea ecx, [ebp - 0x11c0]
call fcn.1003efdc
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0xd10], eax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xd10]
call fcn.1003f816
mov dword [0x10622238], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c0]
call fcn.1003791a
mov dword [ebp - 0x954], 0x4cba
mov dword [ebp - 0xbf4], 0x10009a08
cmp dword [ebp - 0x954], 0x4eda
jle 0x1004eab3
and dword [ebp - 0x2a0], 0
jmp 0x1004ea4f
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x1d7c
jge 0x1004eab3
and dword [ebp - 0x348], 0
jmp 0x1004ea71
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x7ea3
jge 0x1004eab1
mov eax, dword [ebp - 0x2a0]
cdq
idiv dword [ebp - 0x348]
mov eax, edx
cdq
mov dword [ebp - 0xc1c], eax
mov dword [ebp - 0xc18], edx
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov ecx, 0x106205d8
call fcn.10025bd9
jmp 0x1004ea64
jmp 0x1004ea42
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x954], 0x48dc
jge 0x1004ead6
mov edx, dword [ebp - 0xbf4]
mov ecx, 0x106205d8
call fcn.100294ba
jmp 0x1004eaf2
or dword [ebp - 4], 0xffffffff
jmp 0x1004eafc
mov dword [ebp - 0x50], 0xac204e2
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x95c], 0xc5764361
mov dword [ebp - 0x1e0], 0xb1b0
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0xd18], 0x93e32883
mov dword [ebp - 0x50], 0
jmp 0x1004eb45
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x15
jl 0x1004ec05
mov dword [ebp - 0x440], 0xbe4
mov eax, 0xfffffd72
test eax, eax
je 0x1004eb74
cmp dword [ebp - 0x50], 0
je 0x1004eb74
mov dword [ebp - 0xd68], 1
jmp 0x1004eb7b
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x50], 0
jne 0x1004eb91
cmp dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
je 0x1004ebae
cmp dword [ebp - 0x440], 0
je 0x1004ebae
mov dword [ebp - 0x77c], 1
jmp 0x1004ebb5
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x77c], eax
jl 0x1004ebcc
mov dword [ebp - 0xa44], 1
jmp 0x1004ebd3
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0xa44]
jg 0x1004ebed
mov dword [ebp - 0x784], 1
jmp 0x1004ebf4
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x2a8], eax
jmp 0x1004eb3e
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1030], eax
imul eax, dword [ebp - 0x2a8], 0xb56c
mov ecx, dword [ebp - 0x1e0]
sub ecx, dword [ebp - 0x1e0]
add ecx, eax
cmp ecx, dword [ebp - 0x1e0]
jl 0x1004ec3d
mov dword [ebp - 0xbfc], 1
jmp 0x1004ec44
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x10a4], eax
xor eax, eax
sub eax, dword [ebp - 0x2a8]
je 0x1004ec8a
cmp dword [ebp - 0x50], 0
je 0x1004ec8a
mov dword [ebp - 0x78c], 1
jmp 0x1004ec91
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xd18], eax
and dword [ebp - 0x358], 0
jmp 0x1004ecbf
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0xe
jae 0x1004ef5b
mov dword [ebp - 0x28], 0x110c93b4
push 3
lea ecx, [ebp - 0x470]
call fcn.10025cee
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x964], 0x8fb0b44c
mov dword [ebp - 0x350], 0
jmp 0x1004ed0a
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x1004ed29
push dword [ebp - 0x350]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004ecfd
mov dword [ebp - 0x28], 0x1b
jmp 0x1004ed39
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
je 0x1004ed8e
mov dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0x1bc], 0xb
jmp 0x1004ed62
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x1b
jge 0x1004ed8c
mov dword [ebp - 0xc08], 0xce3e63e3
cmp dword [ebp - 0x1bc], 0
je 0x1004ed80
jmp 0x1004ed8c
mov dword [ebp - 0xc08], 1
jmp 0x1004ed55
jmp 0x1004ed32
mov dword [ebp - 0x28], 2
jmp 0x1004ed9e
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1004ef39
push 2
lea ecx, [ebp - 0xe40]
call fcn.10025cee
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x2b0], 0
jmp 0x1004edd2
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1004edf4
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xe40]
call fcn.10025d6c
mov dword [eax], 0xfffffffc
jmp 0x1004edc5
mov esi, dword [ebp - 0x28]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
cmp dword [eax], esi
jg 0x1004ee15
mov dword [ebp - 0x794], 1
jmp 0x1004ee1c
and dword [ebp - 0x794], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
mov ecx, dword [ebp - 0x794]
cmp ecx, dword [eax]
je 0x1004ee40
mov dword [ebp - 0x79c], 1
jmp 0x1004ee47
and dword [ebp - 0x79c], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
mov eax, dword [eax]
mov dword [ebp - 0x964], eax
mov esi, dword [ebp - 0x964]
push 2
lea ecx, [ebp - 0x470]
call fcn.10025d6c
add esi, dword [eax]
cmp esi, dword [ebp - 0x79c]
je 0x1004ee86
mov dword [ebp - 0xa4c], 1
jmp 0x1004ee8d
and dword [ebp - 0xa4c], 0
cmp dword [ebp - 0xa4c], 0xd2d9
jg 0x1004eea5
mov dword [ebp - 0x7a4], 1
jmp 0x1004eeac
and dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x7a4], 0
ja 0x1004eec1
mov dword [ebp - 0x96c], 1
jmp 0x1004eec8
and dword [ebp - 0x96c], 0
mov esi, dword [ebp - 0x96c]
sub esi, dword [ebp - 0x28]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
cmp esi, dword [eax]
jge 0x1004eeef
mov dword [ebp - 0xd50], 1
jmp 0x1004eef6
and dword [ebp - 0xd50], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
push 1
lea ecx, [ebp - 0xe40]
call fcn.10025d6c
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x470]
call fcn.10025d6c
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe40]
call fcn.10025d50
jmp 0x1004ed97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.10025d50
mov eax, dword [ebp - 0x358]
mov byte [ebp + eax - 0xb84], 0
jmp 0x1004ecb2
mov dword [ebp - 0x360], 0x91a049fe
mov dword [ebp - 0x10ac], 0x4b1b055c
mov dword [ebp - 0x10b4], 0x591b68de
mov dword [ebp - 0xc14], 0
mov dword [ebp - 0x2b8], 0
jmp 0x1004ef9c
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 4
jge 0x1004efb8
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x1138], 0x7ef5d870
jmp 0x1004ef8f
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1004efd2
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0x360], 0
jmp 0x1004efeb
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x12
je 0x1004f2af
push 4
lea ecx, [ebp - 0xb5c]
call fcn.10025cee
mov dword [ebp - 4], 0x15
push 4
lea ecx, [ebp - 0xb34]
call fcn.10025cee
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x9c], 0
jmp 0x1004f036
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1004f058
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xb5c]
call fcn.10025d6c
mov dword [eax], 0xcd50997
jmp 0x1004f029
mov dword [ebp - 0x9c], 0
jmp 0x1004f071
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1004f093
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xb34]
call fcn.10025d6c
mov dword [eax], 0xfffffffe
jmp 0x1004f064
push 3
lea ecx, [ebp - 0xb5c]
call fcn.10025d6c
cmp dword [eax], 0
jne 0x1004f0b1
mov dword [ebp - 0xa54], 1
jmp 0x1004f0b8
and dword [ebp - 0xa54], 0
push 3
lea ecx, [ebp - 0xb34]
call fcn.10025d6c
cmp dword [eax], 1
jge 0x1004f0d6
mov dword [ebp - 0x7ac], 1
jmp 0x1004f0dd
and dword [ebp - 0x7ac], 0
push 3
lea ecx, [ebp - 0xb5c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x7ac]
cmp ecx, dword [eax]
jle 0x1004f100
mov dword [ebp - 0xaf4], 1
jmp 0x1004f107
and dword [ebp - 0xaf4], 0
push 3
lea ecx, [ebp - 0xb34]
call fcn.10025d6c
mov ecx, dword [ebp - 0xaf4]
cmp ecx, dword [eax]
jle 0x1004f12a
mov dword [ebp - 0x7b4], 1
jmp 0x1004f131
and dword [ebp - 0x7b4], 0
push 2
lea ecx, [ebp - 0xb34]
call fcn.10025d6c
mov ecx, dword [ebp - 0x7b4]
cmp ecx, dword [eax]
je 0x1004f154
mov dword [ebp - 0x974], 1
jmp 0x1004f15b
and dword [ebp - 0x974], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1138]
inc eax
mov dword [ebp - 0x7bc], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7bc]
mov dword [ebp + eax - 0x1138], ecx
mov eax, dword [ebp - 0xc14]
add eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x7bc]
cmp dword [ebp - 0xa54], eax
jg 0x1004f1f2
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1004f1b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 3
lea ecx, [ebp - 0xb5c]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1004f1ed
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb34]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb5c]
call fcn.10025d50
jmp 0x1004f2af
jmp 0x1004f28c
push 2
lea ecx, [ebp - 0xe58]
call fcn.10025cee
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2c0], 0
jmp 0x1004f21c
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1004f23e
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xe58]
call fcn.10025d6c
mov dword [eax], 0xab56
jmp 0x1004f20f
push 1
lea ecx, [ebp - 0xe58]
call fcn.10025d6c
mov esi, eax
push 3
lea ecx, [ebp - 0xb34]
call fcn.10025d6c
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1004f27d
push 0
push 0x111
call dword [sym.imp.GDI32.dll_SetLayout]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xe58]
call fcn.10025d50
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb34]
call fcn.10025d50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb5c]
call fcn.10025d50
jmp 0x1004efde
push 2
lea ecx, [ebp - 0x42c]
call fcn.10025cee
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x130], 9
mov dword [ebp - 0x74], 3
mov dword [ebp - 0xf00], 0xc605f77
mov dword [ebp - 0xefc], 0xc605f77
mov dword [ebp - 0xef8], 0xc605f77
mov dword [ebp - 0xef4], 0xc605f77
mov dword [ebp - 0x368], 0
jmp 0x1004f315
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 2
jge 0x1004f337
push dword [ebp - 0x368]
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov dword [eax], 7
jmp 0x1004f308
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004f36d
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
cmp dword [eax], 2
jne 0x1004f8fc
mov dword [ebp - 0x70], 0xc6f1bf50
mov dword [ebp - 0xee0], 0x2c643d43
mov dword [ebp - 0xedc], 0x2c643d43
mov dword [ebp - 0xed8], 0x2c643d43
mov dword [ebp - 0xed4], 0x2c643d43
push 3
lea ecx, [ebp - 0xed0]
call fcn.10025cee
mov byte [ebp - 4], 0x19
mov dword [ebp - 0xd78], 1
mov dword [ebp - 0x370], 0
jmp 0x1004f3e6
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 3
jge 0x1004f405
push dword [ebp - 0x370]
lea ecx, [ebp - 0xed0]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004f3d9
mov dword [ebp - 0x70], 0
jmp 0x1004f415
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffffc
jle 0x1004f8e8
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x99c], 0x11489d4c
mov dword [ebp - 0xc2c], 0x96ef6a07
xor eax, eax
jne 0x1004f44b
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
cmp dword [ebp - 0x70], 0
jne 0x1004f460
cmp dword [ebp - 0x24], 0
jne 0x1004f460
and dword [ebp - 0x97c], 0
jmp 0x1004f46a
mov dword [ebp - 0x97c], 1
cmp dword [ebp - 0x97c], 1
jne 0x1004f47f
mov dword [ebp - 0x480], 1
jmp 0x1004f486
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x480], eax
jge 0x1004f4a0
mov dword [ebp - 0xacc], 1
jmp 0x1004f4a7
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0xacc]
cmp eax, 0xed99ea7
jge 0x1004f4c3
mov dword [ebp - 0xd20], 1
jmp 0x1004f4ca
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jge 0x1004f4e7
mov dword [ebp - 0x7d4], 1
jmp 0x1004f4ee
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0xfd52a42b
jbe 0x1004f506
mov dword [ebp - 0x984], 1
jmp 0x1004f50d
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0
jl 0x1004f522
mov dword [ebp - 0x7dc], 1
jmp 0x1004f529
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x74], eax
xor eax, eax
inc eax
je 0x1004f5ef
cmp dword [ebp - 0x74], 0
je 0x1004f557
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10c4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xf14], eax
cmp dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x10d4], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x10dc], eax
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov esi, eax
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1004f597
mov dword [ebp - 0xa5c], 1
jmp 0x1004f59e
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xa5c], eax
jge 0x1004f5b5
mov dword [ebp - 0x7e4], 1
jmp 0x1004f5bc
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 1
jle 0x1004f5d1
mov dword [ebp - 0x98c], 1
jmp 0x1004f5d8
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x98c], eax
jge 0x1004f5ef
mov dword [ebp - 0x7ec], 1
jmp 0x1004f5f6
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x7ec], eax
jle 0x1004f67d
mov dword [ebp - 0xc20], 0
mov dword [ebp - 0x130], 0xfffffff5
jmp 0x1004f624
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x18
jl 0x1004f678
mov dword [ebp - 0x24], 0xffffffff
jmp 0x1004f63d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x25
jne 0x1004f66c
mov dword [ebp - 0x74], 0
jmp 0x1004f653
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x1004f66a
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0xee0], 0
je 0x1004f668
jmp 0x1004f66a
jmp 0x1004f64c
jmp 0x1004f636
mov dword [ebp - 0xc20], 0xe497d6a5
jmp 0x1004f617
jmp 0x1004f8e3
mov dword [ebp - 0x3e4], 0x8686b464
push 2
lea ecx, [ebp - 0xeb8]
call fcn.10025cee
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x2cc], 0
jmp 0x1004f6b1
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x1004f6d3
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xeb8]
call fcn.10025d6c
mov dword [eax], 0xb67c402f
jmp 0x1004f6a4
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp dword [ebp - 0x3e4], ecx
jge 0x1004f6f9
mov dword [ebp - 0xb1c], 1
jmp 0x1004f700
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xb1c], eax
jne 0x1004f717
mov dword [ebp - 0x7f4], 1
jmp 0x1004f71e
and dword [ebp - 0x7f4], 0
push 1
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x7f4]
cmp ecx, dword [eax]
jl 0x1004f741
mov dword [ebp - 0x994], 1
jmp 0x1004f748
and dword [ebp - 0x994], 0
push 0
lea ecx, [ebp - 0x42c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x994]
cmp ecx, dword [eax]
jle 0x1004f76b
mov dword [ebp - 0x7fc], 1
jmp 0x1004f772
and dword [ebp - 0x7fc], 0
cmp dword [ebp - 0x7fc], 0xfffffff8
jge 0x1004f787
mov dword [ebp - 0xa64], 1
jmp 0x1004f78e
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa64], eax
je 0x1004f7ab
cmp dword [ebp - 0x24], 0
je 0x1004f7ab
mov dword [ebp - 0x804], 1
jmp 0x1004f7b2
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x99c], 0
je 0x1004f7e3
xor eax, eax
jne 0x1004f7e3
mov eax, 0xe92ecd44
test eax, eax
jne 0x1004f7e3
and dword [ebp - 0x80c], 0
jmp 0x1004f7ed
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x80c]
je 0x1004f810
mov eax, 0x1b10cd78
test eax, eax
je 0x1004f810
mov dword [ebp - 0xad4], 1
jmp 0x1004f817
and dword [ebp - 0xad4], 0
cmp dword [ebp - 0xad4], 0xd05572bf
jne 0x1004f82f
mov dword [ebp - 0x814], 1
jmp 0x1004f836
and dword [ebp - 0x814], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x814]
mov dword [ebp + eax - 0xf00], ecx
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x3e4]
je 0x1004f85b
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x10e4], eax
cmp dword [ebp - 0x24], 0xfffffff8
jg 0x1004f879
mov dword [ebp - 0x420], 1
jmp 0x1004f880
and dword [ebp - 0x420], 0
push 0
lea ecx, [ebp - 0xeb8]
call fcn.10025d6c
mov ecx, dword [ebp - 0x420]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x420], eax
jg 0x1004f8ac
mov dword [ebp - 0x9a4], 1
jmp 0x1004f8b3
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xd78], eax
push 0
lea ecx, [ebp - 0xed0]
call fcn.10025d6c
mov eax, dword [eax]
mov dword [ebp - 0xc2c], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xeb8]
call fcn.10025d50
jmp 0x1004f40e
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xed0]
call fcn.10025d50
jmp 0x1004f349
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.10025d50
mov dword [ebp - 0xe10], 3
mov dword [ebp - 0xe0c], 3
mov dword [ebp - 0xe08], 3
mov dword [ebp - 0xe04], 3
lea ecx, [ebp - 0x3f5]
call fcn.10025d7b
push eax
lea eax, [ebp - 0xe00]
push eax
lea eax, [ebp - 0xe10]
push eax
lea ecx, [ebp - 0x1170]
call fcn.10025d7e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xda8]
call fcn.10025d2a
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x110c], 0x88b9
mov dword [ebp - 0x384], 0
jmp 0x1004f992
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 3
jge 0x1004f9ae
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x1220], 0x624039b6
jmp 0x1004f985
push 2
lea ecx, [ebp - 0xda8]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1004f9e4
push 2
lea ecx, [ebp - 0xda8]
call fcn.10025d6c
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x81c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x81c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xda8]
call fcn.10025d6c
cmp dword [eax], 2
jg 0x1004fb87
push 1
lea ecx, [ebp - 0xccc]
call fcn.10025cee
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x1110], 0x8cf5a8b
mov dword [ebp - 0x10d0], 0x142b9193
mov dword [ebp - 0x10a0], 0xffffffff
mov dword [ebp - 0x824], 0xe40424b9
mov dword [ebp - 0x2d4], 0
jmp 0x1004fa4c
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x1004fa6e
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xccc]
call fcn.10025d6c
mov dword [eax], 0xe1ca2961
jmp 0x1004fa3f
push 0
lea ecx, [ebp - 0xccc]
call fcn.10025d6c
mov dword [eax], 2
jmp 0x1004faa7
push 0
lea ecx, [ebp - 0xccc]
call fcn.10025d6c
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa6c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa6c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xccc]
call fcn.10025d6c
cmp dword [eax], 0
jl 0x1004fb4a
mov dword [ebp - 0x10b0], 0x5a1fa147
mov dword [ebp - 0xf20], 0xffffffff
mov dword [ebp - 0x1024], 1
mov dword [ebp - 0xf28], 0
mov dword [ebp - 0x10e0], 0x1e6e2bfb
mov dword [ebp - 0xf30], 0xf7b6fe6d
mov dword [ebp - 0x102c], 0xf1fdbd01
mov dword [ebp - 0x334], 0
jmp 0x1004fb1c
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x1004fb38
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0x11e4], 5
jmp 0x1004fb0f
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
jmp 0x1004fa83
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1004fb73
push 0xbfa
push 0x228e
push 0
push 0x12f6
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xccc]
call fcn.10025d50
jmp 0x1004f9c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda8]
call fcn.10025d50
mov byte [ebp - 0x22c], 4
mov byte [ebp - 0x22b], 1
mov byte [ebp - 0x22a], 0xd
mov byte [ebp - 0x229], 0x23
mov byte [ebp - 0x228], 0xb
mov byte [ebp - 0x227], 0x24
mov byte [ebp - 0x226], 0
mov byte [ebp - 0x225], 0x30
mov byte [ebp - 0x224], 8
mov byte [ebp - 0x223], 0x2c
mov byte [ebp - 0x222], 3
mov byte [ebp - 0x221], 0x47
mov byte [ebp - 0x220], 0xe6
mov byte [ebp - 0x21f], 0xb7
mov byte [ebp - 0x21e], 9
mov byte [ebp - 0x21d], 0xc
mov byte [ebp - 0x21c], 0xa
mov byte [ebp - 0x21b], 6
mov byte [ebp - 0x21a], 2
mov byte [ebp - 0x219], 0
mov byte [ebp - 0x218], 5
mov byte [ebp - 0x217], 0
mov byte [ebp - 0x216], 1
mov byte [ebp - 0x215], 0x17
mov byte [ebp - 0x214], 6
mov byte [ebp - 0x213], 0x22
mov byte [ebp - 0x212], 3
mov byte [ebp - 0x211], 0x31
mov byte [ebp - 0x210], 7
mov byte [ebp - 0x20f], 0x13
mov byte [ebp - 0x20e], 0xc
mov byte [ebp - 0x20d], 1
mov dword [ebp - 0x2dc], 0
jmp 0x1004fc8f
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1004fcab
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x20c], 0xfffffffc
jmp 0x1004fc82
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20c], 0
jne 0x1004fcc7
mov dword [ebp - 0x9b4], 1
jmp 0x1004fcce
and dword [ebp - 0x9b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov dword [ebp - 0xf38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov dword [ebp - 0x10b8], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x20c]
cmp ecx, dword [ebp + eax - 0x20c]
jne 0x1004fd1c
mov dword [ebp - 0x9ac], 1
jmp 0x1004fd23
and dword [ebp - 0x9ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
cmp eax, dword [ebp - 0x9ac]
je 0x1004fd44
mov dword [ebp - 0x82c], 1
jmp 0x1004fd4b
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0
jle 0x1004fd60
mov dword [ebp - 0xafc], 1
jmp 0x1004fd67
and dword [ebp - 0xafc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
cmp dword [ebp - 0xafc], eax
jne 0x1004fd8d
or eax, 0xffffffff
je 0x1004fd8d
mov dword [ebp - 0x834], 1
jmp 0x1004fd94
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0xfffffffd
jg 0x1004fda9
mov dword [ebp - 0x83c], 1
jmp 0x1004fdb0
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x9b4]
cmp eax, dword [ebp - 0x83c]
jg 0x1004fdca
mov dword [ebp - 0xa74], 1
jmp 0x1004fdd1
and dword [ebp - 0xa74], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa74]
sub ecx, dword [ebp + eax - 0x20c]
je 0x1004fec2
mov dword [ebp - 0x1c0], 2
mov dword [ebp - 0x1c0], 1
jmp 0x1004fe0d
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1004fead
mov dword [ebp - 0x364], 0
jmp 0x1004fe33
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x1004fe4f
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0xde8], 0x314af12a
jmp 0x1004fe26
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xde8], 1
jmp 0x1004fe7d
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xde8]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xde8], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xde8], 0
jl 0x1004fea8
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xde8]
cmp dword [ebp + eax*4 - 0x20c], 0
je 0x1004fea6
jmp 0x1004fea8
jmp 0x1004fe62
jmp 0x1004fe00
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov dword [ebp - 0x1c0], eax
jmp 0x1004fef4
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1004fef4
push 0
push 0x65c
push 0x6a8
push 0x10b1
push 0x778
push 0x24
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x22c]
and eax, 0x75
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x22c]
or ecx, 0x75
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0xd9c], cl
push 3
lea ecx, [ebp - 0x390]
call fcn.10025cee
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x2e4], 0x42f8
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x86c], 0xd33d2afd
mov dword [ebp - 0xc38], 0xfffffffb
mov dword [ebp - 0xf40], 0xffffffff
mov dword [ebp - 0x90], 0
jmp 0x1004ff8c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1004ffae
push dword [ebp - 0x90]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov dword [eax], 0xb9b55bb2
jmp 0x1004ff7f
mov dword [ebp - 0x90], 0
jmp 0x1004ffc7
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1004ffe3
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x3a4], 0
jmp 0x1004ffba
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x3a4], 2
jmp 0x10050011
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3a4]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3a4], 0
jl 0x100503c1
mov dword [ebp - 0x3ec], 0x98d20b50
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x3ec], eax
mov esi, dword [ebp - 0x2e4]
mov edi, dword [ebp - 0x3ec]
push 1
lea ecx, [ebp - 0x390]
call fcn.10025d6c
add edi, dword [eax]
mov eax, dword [ebp - 0x2e4]
imul eax, edi
cmp eax, esi
je 0x10050082
mov dword [ebp - 0x844], 1
jmp 0x10050089
and dword [ebp - 0x844], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x844]
jne 0x100500b7
mov dword [ebp - 0x9bc], 1
jmp 0x100500be
and dword [ebp - 0x9bc], 0
push 1
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov ecx, dword [ebp - 0x9bc]
cmp ecx, dword [eax]
jl 0x100500e7
cmp dword [ebp - 0x1c4], 0
jne 0x100500e7
and dword [ebp - 0x84c], 0
jmp 0x100500f1
mov dword [ebp - 0x84c], 1
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x3a4]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov ecx, dword [ebp - 0x84c]
imul ecx, dword [eax]
cmp ecx, esi
jle 0x1005012f
mov dword [ebp - 0xadc], 1
jmp 0x10050136
and dword [ebp - 0xadc], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov ecx, dword [ebp - 0xadc]
cmp ecx, dword [eax]
jge 0x10050164
mov dword [ebp - 0xd28], 1
jmp 0x1005016b
and dword [ebp - 0xd28], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x1034], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov esi, eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov edi, dword [eax]
imul edi, dword [esi]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
sub edi, dword [eax]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
cmp dword [eax], edi
jne 0x10050208
mov dword [ebp - 0x854], 1
jmp 0x1005020f
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 3
jne 0x10050224
mov dword [ebp - 0x9c4], 1
jmp 0x1005022b
and dword [ebp - 0x9c4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x9c4], eax
jge 0x1005024c
mov dword [ebp - 0x85c], 1
jmp 0x10050253
and dword [ebp - 0x85c], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x3a4]
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov ecx, dword [ebp - 0x85c]
cmp ecx, dword [eax]
jne 0x10050281
mov dword [ebp - 0xa7c], 1
jmp 0x10050288
and dword [ebp - 0xa7c], 0
cmp dword [ebp - 0xa7c], 0xfffffff6
jg 0x1005039a
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0xc40], 0xffffffff
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x100502c5
push 0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xf48], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x1104], eax
mov eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x2e4]
jge 0x100502f7
mov dword [ebp - 0x864], 1
jmp 0x100502fe
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xc38]
cmp eax, dword [ebp - 0x864]
jg 0x10050318
mov dword [ebp - 0xd58], 1
jmp 0x1005031f
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x9cc], eax
push 2
lea ecx, [ebp - 0x390]
call fcn.10025d6c
mov ecx, dword [ebp - 0x9cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x86c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [ebp + eax - 0x3a4]
jle 0x10050385
mov dword [ebp - 0xb10], 1
jmp 0x1005038c
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xc40], eax
jmp 0x100503bc
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x100503bc
push 0x1dff
push 0x219c
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1004fff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.10025d50
mov dword [ebp - 0x58], 2
and dword [ebp - 0x2fc], 0
jmp 0x100503e8
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x20
jae 0x100508ae
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x22c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x58], eax
jne 0x1005070d
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x22c]
inc eax
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x22c]
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x19c], 9
mov dword [ebp - 0x874], 1
mov dword [ebp - 0x37c], 0xac12265e
mov dword [ebp - 0x2f4], 0xfffffffd
mov dword [ebp - 0x19c], 0x4ee
mov dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x874]
jl 0x1005048a
mov dword [ebp - 0x9d4], 1
jmp 0x10050491
and dword [ebp - 0x9d4], 0
mov dword [ebp - 0x37c], 1
cmp dword [ebp - 0x37c], 0xfffffffd
jl 0x100504b9
cmp dword [ebp - 0x37c], 0
je 0x100504b9
mov dword [ebp - 0x87c], 1
jmp 0x100504c0
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x9d4]
cmp eax, dword [ebp - 0x87c]
jg 0x100504da
mov dword [ebp - 0xa84], 1
jmp 0x100504e1
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x2f4]
mov ecx, dword [ebp - 0xa84]
lea eax, [ecx + eax + 3]
test eax, eax
je 0x10050548
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x10050543
push 0
push 0xeda
push 0x15e
push 0
push 0xfc8
push 0xdac
push 0xc1
push 0x42f
push 0x1f2
push 0x2519
push 0x17eb
push 0xc45
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x10050708
mov dword [ebp - 0x3f4], 0x213a
push 2
lea ecx, [ebp - 0xcdc]
call fcn.10025cee
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xd30], 2
mov dword [ebp - 0x2ec], 0
jmp 0x10050589
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x100505ab
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0xcdc]
call fcn.10025d6c
mov dword [eax], 0x61940c9b
jmp 0x1005057c
mov eax, 0x9c23edb3
test eax, eax
je 0x100505da
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x3f4]
jne 0x100505da
mov dword [ebp - 0x434], 1
jmp 0x100505e1
and dword [ebp - 0x434], 0
push 0
lea ecx, [ebp - 0xcdc]
call fcn.10025d6c
mov ecx, dword [ebp - 0x434]
mov dword [eax], ecx
cmp dword [ebp - 0x434], 0
je 0x10050614
cmp dword [ebp - 0x37c], 0
je 0x10050614
mov dword [ebp - 0x884], 1
jmp 0x1005061b
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x884], eax
jl 0x10050630
cmp dword [ebp - 0x2f4], 0
push 0
lea ecx, [ebp - 0xcdc]
call fcn.10025d6c
cmp dword [eax], 0
je 0x10050660
push 0
lea ecx, [ebp - 0xcdc]
call fcn.10025d6c
cmp dword [eax], 0
je 0x10050660
mov dword [ebp - 0x9dc], 1
jmp 0x10050667
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xfffffffe
jne 0x1005067c
mov dword [ebp - 0x88c], 1
jmp 0x10050683
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x2f4]
imul eax, dword [ebp - 0x88c]
cmp dword [ebp - 0x3f4], eax
jl 0x100506a4
mov dword [ebp - 0xae4], 1
jmp 0x100506ab
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0xae4]
jl 0x100506c5
mov dword [ebp - 0x894], 1
jmp 0x100506cc
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x894]
jg 0x100506e6
mov dword [ebp - 0x9e4], 1
jmp 0x100506ed
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xd30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcdc]
call fcn.10025d50
jmp 0x100503e0
mov dword [ebp - 0x89c], 0xffff
mov dword [ebp - 0x430], 0x4c8d
push 1
lea ecx, [ebp - 0xe34]
call fcn.10025cee
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x344], 0
jmp 0x1005074e
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 1
jge 0x10050770
push dword [ebp - 0x344]
lea ecx, [ebp - 0xe34]
call fcn.10025d6c
mov dword [eax], 0x3bd6525
jmp 0x10050741
cmp dword [ebp - 0x89c], 0xffffffff
jge 0x10050785
mov dword [ebp - 0x8a4], 1
jmp 0x1005078c
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x89c]
cmp eax, dword [ebp - 0x430]
je 0x100507a6
mov dword [ebp - 0xc48], 1
jmp 0x100507ad
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xf58], eax
push 0xfffffffffffffffa
pop eax
cmp eax, 0xfffffffd
jbe 0x100507d6
mov eax, 0x6d21
test eax, eax
je 0x100507d6
mov dword [ebp - 0xa8c], 1
jmp 0x100507dd
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0xa8c]
jne 0x100507f7
mov dword [ebp - 0x9ec], 1
jmp 0x100507fe
and dword [ebp - 0x9ec], 0
mov esi, dword [ebp - 0x8a4]
sub esi, dword [ebp - 0x9ec]
push 0
lea ecx, [ebp - 0xe34]
call fcn.10025d6c
mov dword [eax], esi
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10050833
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe34]
call fcn.10025d50
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x2fc]
movzx eax, byte [ebp + eax - 0x22e]
movsx eax, byte [ebp + eax - 0xd9c]
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x22b]
and ecx, eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x2fc]
movzx eax, byte [ebp + eax - 0x22e]
movsx eax, byte [ebp + eax - 0xd9c]
mov edx, dword [ebp - 0x58]
movzx edx, byte [ebp + edx - 0x22b]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0xd9c], dl
and dword [ebp - 0x2fc], 0
jmp 0x100503e0
push 2
lea ecx, [ebp - 0x1068]
call fcn.10025cee
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xd88], 1
mov dword [ebp - 0xd84], 1
mov dword [ebp - 0xd80], 1
mov dword [ebp - 0xd7c], 1
mov dword [ebp - 0x36c], 0
jmp 0x10050903
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 2
jge 0x10050922
push dword [ebp - 0x36c]
lea ecx, [ebp - 0x1068]
call fcn.10025d6c
or dword [eax], 0xffffffff
jmp 0x100508f6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd88], 1
jmp 0x1005094d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd88]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xd88], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd88], 0
jl 0x10050a7c
push 1
lea ecx, [ebp - 0xcec]
call fcn.10025cee
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x304], 0
jmp 0x1005098a
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x100509ac
push dword [ebp - 0x304]
lea ecx, [ebp - 0xcec]
call fcn.10025d6c
mov dword [eax], 0xf25cbd94
jmp 0x1005097d
push 0
lea ecx, [ebp - 0xcec]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x100509e5
push 0
lea ecx, [ebp - 0xcec]
call fcn.10025d6c
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x8ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xcec]
call fcn.10025d6c
cmp dword [eax], 0
jl 0x10050a46
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x34c], 1
jmp 0x10050a1a
mov eax, dword [ebp - 0x34c]
dec eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jl 0x10050a41
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10050a3f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x10050a0d
jmp 0x100509c1
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x10050a68
push 0x17c
push 0x176c
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xcec]
call fcn.10025d50
jmp 0x10050934
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1068]
call fcn.10025d50
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xd9c], 0
lea eax, [ebp - 0xd9c]
push eax
lea ecx, [ebp - 0x1214]
call fcn.1003efdc
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 4], 0x22
mov edx, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xc50]
call fcn.1003f816
mov dword [0x10622414], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1214]
call fcn.1003791a
and dword [ebp - 0x230], 0
jmp 0x10050aff
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xf
jae 0x10050b18
mov eax, dword [ebp - 0x230]
mov byte [ebp + eax - 0xd9c], 0
jmp 0x10050af2
mov eax, dword [0x10622238]
cmp eax, dword [ebp - 0x284]
je 0x10050b32
mov eax, dword [0x10622414]
cmp eax, dword [ebp - 0x284]
jne 0x10050b4a
mov ecx, dword [ebp + 0xc]
call fcn.100259bb
push eax
push dword [ebp + 8]
call fcn.10046353
pop ecx
pop ecx
jmp 0x10053a93
mov dword [ebp - 0x8b4], 0x714d
mov dword [ebp - 0xd38], 0x10009a78
cmp dword [ebp - 0x8b4], 0x7299
jle 0x10050bfc
and dword [ebp - 0x394], 0
jmp 0x10050b84
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x3d8
jge 0x10050be5
and dword [ebp - 0x314], 0
jmp 0x10050ba6
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x717d
jge 0x10050be3
mov eax, dword [ebp - 0x394]
or eax, dword [ebp - 0x314]
cdq
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc24], edx
push dword [ebp - 0xc24]
push dword [ebp - 0xc28]
mov ecx, 0x106205d8
call fcn.10025bd9
jmp 0x10050b99
jmp 0x10050b77
push 0
push 0xa1f
push 0xbc0
push 0x1a5b
call dword [sym.imp.USER32.dll_SetScrollPos]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 4], 0x23
cmp dword [ebp - 0x8b4], 0x70d9
jge 0x10050c29
mov edx, dword [ebp - 0xd38]
mov ecx, 0x106205d8
call fcn.100294ba
jmp 0x10050c45
or dword [ebp - 4], 0xffffffff
jmp 0x10050c4f
mov dword [ebp - 0x670], 0xe6a3735b
push 1
lea ecx, [ebp - 0xec4]
call fcn.10025cee
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x40], 0
jmp 0x10050c7d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10050c93
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x9f4], 4
jmp 0x10050c76
mov dword [ebp - 0x40], 0
jmp 0x10050ca3
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10050cb9
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x648], 0x10e1
jmp 0x10050c9c
mov dword [ebp - 0x40], 0
jmp 0x10050cc9
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10050ce5
push dword [ebp - 0x40]
lea ecx, [ebp - 0xec4]
call fcn.10025d6c
mov dword [eax], 0xc9ca3191
jmp 0x10050cc2
mov dword [ebp - 0xc0], 0
jmp 0x10050cfe
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x10050e6a
mov dword [ebp - 0x354], 0
jmp 0x10050d24
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 2
jge 0x10050d40
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xb48], 0x9cf30836
jmp 0x10050d17
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x648], 0
jne 0x10050d62
cmp dword [ebp - 0xc0], 0
jne 0x10050d62
and dword [ebp - 0x640], 0
jmp 0x10050d6c
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x9f4]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc58]
mov dword [ebp + eax*4 - 0x9f4], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax - 0xb48], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb48], 0
je 0x10050dc3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x648], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb48], 0xfffffff6
jg 0x10050ddf
mov dword [ebp - 0x650], 1
jmp 0x10050de6
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x650]
jl 0x10050e00
mov dword [ebp - 0x658], 1
jmp 0x10050e07
and dword [ebp - 0x658], 0
push 0
lea ecx, [ebp - 0xec4]
call fcn.10025d6c
mov ecx, dword [ebp - 0x658]
cmp ecx, dword [eax]
je 0x10050e2a
mov dword [ebp - 0x660], 1
jmp 0x10050e31
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb48]
cmp dword [ebp - 0x660], eax
jne 0x10050e52
mov dword [ebp - 0x668], 1
jmp 0x10050e59
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x670], eax
jmp 0x10050cf1
mov dword [ebp - 0xc0], 0xf63588c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec4]
call fcn.10025d50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x374], eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x6b0], 0xe6a3735b
push 1
lea ecx, [ebp - 0xe4c]
call fcn.10025cee
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x48], 0
jmp 0x10050ec4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10050eda
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x678], 4
jmp 0x10050ebd
mov dword [ebp - 0x48], 0
jmp 0x10050eea
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10050f00
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x688], 0x10e1
jmp 0x10050ee3
mov dword [ebp - 0x48], 0
jmp 0x10050f10
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10050f2c
push dword [ebp - 0x48]
lea ecx, [ebp - 0xe4c]
call fcn.10025d6c
mov dword [eax], 0xc9ca3191
jmp 0x10050f09
mov dword [ebp - 0xc8], 0
jmp 0x10050f45
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jg 0x100510b1
mov dword [ebp - 0x31c], 0
jmp 0x10050f6b
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x10050f87
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xb50], 0x9cf30836
jmp 0x10050f5e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x688], 0
jne 0x10050fa9
cmp dword [ebp - 0xc8], 0
jne 0x10050fa9
and dword [ebp - 0x680], 0
jmp 0x10050fb3
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x678]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd60]
mov dword [ebp + eax*4 - 0x678], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x680]
mov dword [ebp + eax - 0xb50], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb50], 0
je 0x1005100a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x688], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb50], 0xfffffff6
jg 0x10051026
mov dword [ebp - 0x690], 1
jmp 0x1005102d
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x6b0]
cmp eax, dword [ebp - 0x690]
jl 0x10051047
mov dword [ebp - 0x698], 1
jmp 0x1005104e
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0xe4c]
call fcn.10025d6c
mov ecx, dword [ebp - 0x698]
cmp ecx, dword [eax]
je 0x10051071
mov dword [ebp - 0x6a0], 1
jmp 0x10051078
and dword [ebp - 0x6a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb50]
cmp dword [ebp - 0x6a0], eax
jne 0x10051099
mov dword [ebp - 0x6a8], 1
jmp 0x100510a0
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6b0], eax
jmp 0x10050f38
mov dword [ebp - 0xc8], 0xf63588c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4c]
call fcn.10025d50
cmp dword [ebp - 0x374], 0
je 0x10053a91
mov eax, dword [ebp - 0x374]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10053a91
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x374]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1d4], ecx
mov dword [ebp - 0x188], 0xae355683
mov dword [ebp - 0xcf4], 0
mov dword [ebp - 0xc68], 8
mov dword [ebp - 0x188], 0xf
jmp 0x10051137
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffffa
jle 0x1005123f
mov dword [ebp - 0x6c0], 0xf7bf48c4
mov dword [ebp - 0x3fc], 0xfff9
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10051185
push 0x12f1
push 0
push 0x222e
push 0
push 0
push 0x1393
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x10c0], eax
cmp dword [ebp - 0x3fc], 0xffffffff
jl 0x100511a3
cmp dword [ebp - 0x3fc], 0
je 0x100511b8
mov eax, 0xa9da
test eax, eax
je 0x100511b8
mov dword [ebp - 0x6b8], 1
jmp 0x100511bf
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x6b8], eax
jne 0x100511d9
mov dword [ebp - 0xc60], 1
jmp 0x100511e0
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x6c0]
jg 0x10051206
mov dword [ebp - 0x6c8], 1
jmp 0x1005120d
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0xcf4]
cmp dword [ebp - 0x6c8], eax
jne 0x10051227
mov dword [ebp - 0x6d0], 1
jmp 0x1005122e
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0xc68], eax
jmp 0x1005112a
mov eax, dword [ebp - 0x1d4]
cmp dword [eax], 0x4550
jne 0x10053a91
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + 0x74], 0
jbe 0x10053a91
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d4]
cmp dword [ecx + eax + 0x78], 0
je 0x10053a91
mov dword [ebp - 0xa4], 0xec2e0cf5
mov dword [ebp - 0xcfc], 9
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x100512a6
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0xa4], 0
jmp 0x100512bf
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 8
jge 0x1005145c
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x324], 0
jmp 0x100512ec
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x10051308
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x168], 0xbb11
jmp 0x100512df
mov dword [ebp - 0x78], 0
jmp 0x10051318
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x10051457
cmp dword [ebp - 0xa4], 0
jne 0x10051346
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x168]
cmp eax, dword [ebp - 0xa4]
jne 0x10051346
and dword [ebp - 0x6d8], 0
jmp 0x10051350
mov dword [ebp - 0x6d8], 1
imul eax, dword [ebp - 0x6d8], 0xd0
sub eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp + ecx*4 - 0x168]
imul ecx, eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x168], ecx
jle 0x1005137d
cmp dword [ebp - 0xa4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp + ecx*4 - 0x168]
cmp ecx, dword [ebp + eax - 0x168]
jl 0x100513a2
mov dword [ebp - 0x6e0], 1
jmp 0x100513a9
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x6e0], eax
jge 0x100513c3
mov dword [ebp - 0x6e8], 1
jmp 0x100513ca
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x168]
cmp dword [ebp - 0x6e8], eax
jge 0x10051446
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1005142a
push 0
push 0xeda
push 0x15e
push 0
push 0xfc8
push 0xdac
push 0xc1
push 0x42f
push 0x1f2
push 0x2519
push 0x17eb
push 0xc45
call dword [sym.imp.GDI32.dll_MaskBlt]
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x10051444
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x10051452
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcfc], eax
jmp 0x10051311
jmp 0x100512b2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a0], 0x3cdf98a5
mov dword [ebp - 0x180], 0xfffffffc
push 2
lea ecx, [ebp - 0xdcc]
call fcn.10025cee
mov dword [ebp - 4], 0x27
mov dword [ebp - 0xd04], 0x846c8c5c
mov dword [ebp - 0x35c], 0
jmp 0x100514b0
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jge 0x100514d2
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xdcc]
call fcn.10025d6c
mov dword [eax], 0xfffffffb
jmp 0x100514a3
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x1a0], 0x15
jmp 0x100514f7
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x33
jl 0x100517ab
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x180], 0
jmp 0x10051524
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffffe
jle 0x1005179b
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x3ac], 0xfffffff9
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x6f0], eax
push 1
lea ecx, [ebp - 0xdcc]
call fcn.10025d6c
mov ecx, dword [ebp - 0x6f0]
mov dword [eax], ecx
cmp dword [ebp - 0x6f0], 0
je 0x1005169f
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x104c], eax
mov eax, 0x47f5
cmp eax, 0xc134
jg 0x10051594
mov dword [ebp - 0x6f8], 1
jmp 0x1005159b
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 0xfffa
jae 0x100515b0
cmp dword [ebp - 0xac], 0
jne 0x100515c2
cmp dword [ebp - 0xac], 0
jne 0x100515c2
and dword [ebp - 0x700], 0
jmp 0x100515cc
mov dword [ebp - 0x700], 1
cmp dword [ebp - 0x700], 0xfffffff6
je 0x100515e1
mov dword [ebp - 0x708], 1
jmp 0x100515e8
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0x8777
jle 0x10051600
mov dword [ebp - 0x710], 1
jmp 0x10051607
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x710], eax
jle 0x1005161e
mov dword [ebp - 0xc70], 1
jmp 0x10051625
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xf68], eax
imul eax, dword [ebp - 0x7c], 0x187
test eax, eax
jne 0x1005164e
cmp dword [ebp - 0xac], 0
jne 0x1005164e
and dword [ebp - 0x718], 0
jmp 0x10051658
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0x7c]
jne 0x10051672
mov dword [ebp - 0x720], 1
jmp 0x10051679
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x3ac]
jne 0x1005169f
mov dword [ebp - 0x728], 1
jmp 0x100516a6
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x728]
jne 0x100516c0
mov dword [ebp - 0x730], 1
jmp 0x100516c7
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x730], eax
jle 0x100516e3
xor eax, eax
inc eax
jne 0x100516e3
and dword [ebp - 0x738], 0
jmp 0x100516ed
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x738], eax
jle 0x10051704
mov dword [ebp - 0x740], 1
jmp 0x1005170b
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xd04], eax
mov dword [ebp - 0x7c], 0x12
jmp 0x10051727
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xf
jge 0x10051796
mov dword [ebp - 0xc78], 1
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0xac]
jge 0x10051751
mov dword [ebp - 0x748], 1
jmp 0x10051758
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
dec eax
cmp eax, 0xa0b2b040
jb 0x10051772
mov dword [ebp - 0x750], 1
jmp 0x10051779
and dword [ebp - 0x750], 0
push 0
lea ecx, [ebp - 0xdcc]
call fcn.10025d6c
mov eax, dword [eax]
add eax, dword [ebp - 0x750]
mov dword [ebp - 0xc78], eax
jmp 0x10051720
jmp 0x10051517
cmp dword [ebp - 0x180], 0
je 0x100517a6
jmp 0x100517ab
jmp 0x100514ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdcc]
call fcn.10025d50
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x184]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0x3b0], 0xf4288a13
mov dword [ebp - 0x1a8], 2
mov dword [ebp - 0x1b0], 0x439cb61d
cmp dword [ebp - 0x1a8], 0
jne 0x1005180b
xor eax, eax
inc eax
jne 0x1005180b
and dword [ebp - 0x758], 0
jmp 0x10051815
mov dword [ebp - 0x758], 1
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x758], eax
jne 0x1005182f
mov dword [ebp - 0x760], 1
jmp 0x10051836
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x3b0]
imul eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x760]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x1b0], 0x1a
jmp 0x10051882
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x17
je 0x100518c1
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x100518a5
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x100518bf
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x10051875
mov eax, 0xffff
mov word [ebp - 0xa8], ax
or dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x54], 0x250d
mov dword [ebp - 0x3b8], 2
mov dword [ebp - 0x778], 0xffffffff
push 4
lea ecx, [ebp - 0xe70]
call fcn.10025cee
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x7c0], 0x44381826
mov dword [ebp - 0xc80], 0xb9459240
mov dword [ebp - 0x2c4], 0
jmp 0x10051930
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 4
jge 0x10051952
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xe70]
call fcn.10025d6c
mov dword [eax], 3
jmp 0x10051923
cmp dword [ebp - 0x54], 0x5613717b
jle 0x10051a9c
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
je 0x10051976
mov dword [ebp - 0x768], 1
jmp 0x1005197d
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x100519a5
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x100519a5
mov dword [ebp - 0x770], 1
jmp 0x100519ac
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 0x5739
jl 0x100519d0
mov dword [ebp - 0x780], 1
jmp 0x100519d7
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x780], eax
jl 0x100519f9
mov eax, 0xfffc
test eax, eax
jne 0x100519f9
or eax, 0xffffffff
jne 0x100519f9
and dword [ebp - 0x788], 0
jmp 0x10051a03
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x788], eax
jge 0x10051a1a
mov dword [ebp - 0x790], 1
jmp 0x10051a21
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 1
jne 0x10051a3c
cmp dword [ebp - 0x3b8], 0
jne 0x10051a3c
and dword [ebp - 0x798], 0
jmp 0x10051a46
mov dword [ebp - 0x798], 1
cmp dword [ebp - 0x798], 6
jne 0x10051a5b
mov dword [ebp - 0x7a0], 1
jmp 0x10051a62
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x7a0]
cmp eax, dword [ebp - 0x54]
jg 0x10051a7d
mov dword [ebp - 0x7a8], 1
jmp 0x10051a84
and dword [ebp - 0x7a8], 0
imul eax, dword [ebp - 0x7a8], 0x860b
cmp eax, dword [ebp - 0x54]
je 0x10051a9c
and dword [ebp - 0x7b0], 0
jmp 0x10051aa6
mov dword [ebp - 0x7b0], 1
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x7b0]
imul eax, dword [ebp - 0x54]
add eax, 0xfb96f37d
mov dword [ebp - 0x7b8], eax
push 2
lea ecx, [ebp - 0xe70]
call fcn.10025d6c
mov ecx, dword [ebp - 0x7b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x7c0]
add eax, dword [ebp - 0x54]
cmp eax, 0xe055a24b
jbe 0x10051afc
mov dword [ebp - 0x7c8], 1
jmp 0x10051b03
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x7c8], 0x644b
jge 0x10051b1b
mov dword [ebp - 0xd0c], 1
jmp 0x10051b22
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc80], eax
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x10051b49
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.10025d50
cmp dword [ebp + 0x10], 0
jbe 0x10051b7c
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10051b77
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa8], ax
jmp 0x10052fc9
mov dword [ebp - 0x170], 4
mov dword [ebp - 0x2c8], 0
jmp 0x10051b9f
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x10051bbb
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x1078], 0x204e2db5
jmp 0x10051b92
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x10051be2
push 0x1542
push 0xbf4
push 0x144f
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x170], 0
jmp 0x10051bfb
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jg 0x10051d78
mov dword [ebp - 0xef0], 0x11d01887
mov dword [ebp - 0xeec], 0x11d01887
mov dword [ebp - 0xee8], 0x11d01887
mov dword [ebp - 0xee4], 0x11d01887
mov dword [ebp - 0x2d0], 0
jmp 0x10051c49
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x10051c65
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xdc0], 0xf390197f
jmp 0x10051c3c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xdc0], 2
jmp 0x10051c90
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xdc0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xdc0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdc0], 0
jl 0x10051d73
mov dword [ebp - 0x2d8], 0
jmp 0x10051cbc
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x10051cd8
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x1168], 0x15fdc8df
jmp 0x10051caf
mov eax, dword [ebp - 0x170]
cmp dword [ebp + eax*4 - 0x1078], 0
je 0x10051d25
mov eax, dword [ebp - 0x170]
cmp dword [ebp + eax*4 - 0x1078], 0
jg 0x10051d04
mov dword [ebp - 0x7d0], 1
jmp 0x10051d0b
and dword [ebp - 0x7d0], 0
imul eax, dword [ebp - 0x7d0], 0xffff
test eax, eax
je 0x10051d25
mov dword [ebp - 0x3c0], 1
jmp 0x10051d2c
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x1168], ecx
cmp dword [ebp - 0x3c0], 0xfffffffb
jle 0x10051d54
mov dword [ebp - 0x7d8], 1
jmp 0x10051d5b
and dword [ebp - 0x7d8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7d8]
mov dword [ebp + eax - 0xef0], ecx
jmp 0x10051c77
jmp 0x10051bee
mov dword [ebp - 0x154], 0xf5c184c5
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x98], 0
jmp 0x10051da2
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10051dbe
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x414], 0x47706695
jmp 0x10051d95
mov dword [ebp - 0x98], 0
jmp 0x10051dd7
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x10051df3
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xf10], 1
jmp 0x10051dca
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x154]
jne 0x10051e11
mov dword [ebp - 0x3c8], 1
jmp 0x10051e18
and dword [ebp - 0x3c8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + eax - 0x414], ecx
cmp dword [ebp - 0x3c8], 9
jle 0x10051e47
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10051e47
mov dword [ebp - 0x7e0], 1
jmp 0x10051e4e
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 0x524f
jg 0x10051e66
mov dword [ebp - 0x3d0], 1
jmp 0x10051e6d
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xf10], ecx
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x3d0]
je 0x1005209b
mov dword [ebp - 0xd0], 0x896e
mov dword [ebp - 0x7f0], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffe4
jmp 0x10051eb5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x10052096
mov dword [ebp - 0x808], 5
mov dword [ebp - 0x828], 1
mov dword [ebp - 0x150], 0x1bbbbfef
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0xd0], 0xa81d5f49
ja 0x10051f01
mov dword [ebp - 0xd14], 1
jmp 0x10051f08
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x808]
cmp eax, dword [ebp - 0xd0]
jle 0x10051f22
mov dword [ebp - 0x7e8], 1
jmp 0x10051f29
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
sub eax, dword [ebp - 0xd0]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
cmp eax, dword [ebp - 0x4c]
jge 0x10051f52
mov dword [ebp - 0x7f8], 1
jmp 0x10051f59
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
add eax, 0x2438
neg eax
cmp eax, 0x7e29ac92
je 0x10051f79
mov dword [ebp - 0x800], 1
jmp 0x10051f80
and dword [ebp - 0x800], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf10]
cmp eax, dword [ebp - 0x800]
jle 0x10051fa0
mov dword [ebp - 0x810], 1
jmp 0x10051fa7
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x808]
cmp dword [ebp - 0x810], eax
je 0x10051fc1
mov dword [ebp - 0x818], 1
jmp 0x10051fc8
and dword [ebp - 0x818], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x818]
shl ecx, 1
imul ecx, dword [ebp + eax - 0x414]
add ecx, dword [ebp - 0xd0]
je 0x10051ff9
push 2
pop eax
test eax, eax
je 0x10051ff9
mov dword [ebp - 0x820], 1
jmp 0x10052000
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0x5a63a74a
je 0x10052024
mov dword [ebp - 0x830], 1
jmp 0x1005202b
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x150], 0
jmp 0x10052050
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jg 0x10052091
mov dword [ebp - 0xd0], 1
jmp 0x10052072
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x1005208f
mov eax, dword [ebp - 0x150]
cmp dword [ebp + eax*4 - 0x414], 0
je 0x1005208d
jmp 0x1005208f
jmp 0x10052065
jmp 0x10052043
jmp 0x10051eae
jmp 0x10052285
mov dword [ebp - 0x15c], 0x40774242
mov dword [ebp - 0x4c], 0xfffffff1
jmp 0x100520b5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1c
jge 0x100520d5
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x100520d3
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x100520ae
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf10]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xf78], eax
cmp dword [ebp - 0x4c], 0x8e0d
je 0x10052114
mov dword [ebp - 0x838], 1
jmp 0x1005211b
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0
je 0x10052152
cmp dword [ebp - 0x154], 0
je 0x10052152
cmp dword [ebp - 0x15c], 0
je 0x10052152
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x414], 0
je 0x10052152
mov dword [ebp - 0x840], 1
jmp 0x10052159
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x840], eax
je 0x10052170
mov dword [ebp - 0x848], 1
jmp 0x10052177
and dword [ebp - 0x848], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x414]
imul ecx, dword [ebp - 0x848]
cmp ecx, dword [ebp + eax - 0x414]
jne 0x100521a6
mov dword [ebp - 0x850], 1
jmp 0x100521ad
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 0
je 0x100521c4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x414], 0
cmp dword [ebp - 0x15c], 0
je 0x100521e2
cmp dword [ebp - 0x154], 0
je 0x100521e2
mov dword [ebp - 0x858], 1
jmp 0x100521e9
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x858], eax
jle 0x10052203
mov dword [ebp - 0x860], 1
jmp 0x1005220a
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 0x4640
jle 0x10052222
mov dword [ebp - 0x868], 1
jmp 0x10052229
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
sub eax, dword [ebp - 0x154]
jne 0x10052249
cmp dword [ebp - 0x15c], 0
jne 0x10052249
and dword [ebp - 0x870], 0
jmp 0x10052253
mov dword [ebp - 0x870], 1
cmp dword [ebp - 0x870], 0x14f5c6f0
jne 0x1005226b
mov dword [ebp - 0x878], 1
jmp 0x10052272
and dword [ebp - 0x878], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x878]
mov dword [ebp + eax - 0xf10], ecx
mov eax, dword [0x106223a0]
and eax, 1
jne 0x100522bc
mov eax, dword [0x106223a0]
or eax, 1
mov dword [0x106223a0], eax
mov dword [ebp - 4], 0x29
mov ecx, 0x106223f4
call fcn.100379ad
push 0x10078481
call fcn.1005e662
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0xdfc], 0
and dword [ebp - 0xdf8], 0
and dword [ebp - 0xdf4], 0
and dword [ebp - 0xdf0], 0
lea ecx, [ebp - 0x3ed]
call fcn.10025d7b
push eax
lea eax, [ebp - 0xdec]
push eax
lea eax, [ebp - 0xdfc]
push eax
lea ecx, [ebp - 0x1190]
call fcn.10025d7e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdb4]
call fcn.10025d2a
mov dword [ebp - 4], 0x2a
push 0
lea ecx, [ebp - 0xdb4]
call fcn.10025d6c
and dword [eax], 0
jmp 0x1005234a
push 0
lea ecx, [ebp - 0xdb4]
call fcn.10025d6c
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x880]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xdb4]
call fcn.10025d6c
cmp dword [eax], 5
jle 0x1005237c
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1005237a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x10052326
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb4]
call fcn.10025d50
movzx eax, byte [0x1062223d]
test eax, eax
je 0x10052aec
mov ecx, 0x106223f4
call fcn.10057b05
movzx eax, al
test eax, eax
jne 0x10052aec
mov dword [ebp - 0x5c], 0xa4d0
cmp dword [ebp - 0x5c], 0xfffffff8
jl 0x100523c8
mov dword [ebp - 0x888], 1
jmp 0x100523cf
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x5c]
dec eax
cmp eax, dword [ebp - 0x5c]
jne 0x100523e4
mov dword [ebp - 0x890], 1
jmp 0x100523eb
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x890]
jg 0x10052405
mov dword [ebp - 0x898], 1
jmp 0x1005240c
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x898]
cmp eax, dword [ebp - 0x5c]
je 0x10052426
mov dword [ebp - 0x8a0], 1
jmp 0x1005242d
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x8a0]
jle 0x10052444
mov dword [ebp - 0xc88], 1
jmp 0x1005244b
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10c8], eax
mov eax, dword [ebp - 0x5c]
neg eax
je 0x100525dc
mov dword [ebp - 0x198], 2
push 1
lea ecx, [ebp - 0xe64]
call fcn.10025cee
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x234], 0
jmp 0x10052496
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x100524b5
push dword [ebp - 0x234]
lea ecx, [ebp - 0xe64]
call fcn.10025d6c
and dword [eax], 0
jmp 0x10052489
mov dword [ebp - 0x5c], 0xfffffffe
jmp 0x100524c5
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1b
jne 0x100525cb
mov dword [ebp - 0x1b8], 0xca6c8490
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b8], 0
jmp 0x100524fe
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x100525c6
mov dword [ebp - 0x198], 0
jmp 0x10052524
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jg 0x100525c1
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x23c], 0
jmp 0x10052554
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jl 0x100525a5
mov dword [ebp - 0x244], 0
jmp 0x10052576
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x10052592
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xd1c], 0x2057
jmp 0x10052569
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd1c], 0
jmp 0x10052547
push 0
lea ecx, [ebp - 0xe64]
call fcn.10025d6c
cmp dword [eax], 0
je 0x100525bc
jmp 0x10052517
jmp 0x10052517
jmp 0x100524f1
jmp 0x100524be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe64]
call fcn.10025d50
jmp 0x1005262e
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0x24c], 0
jmp 0x100525ff
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x1005261b
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xd24], 0x6f9a4d91
jmp 0x100525f2
mov eax, dword [ebp - 0xc90]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd24], eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x4d0]
push eax
mov ecx, 0x106223f4
call fcn.10037a64
mov dword [ebp - 0x254], 0x7e2799ac
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1005266a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [ebp - 0x254], 0xffffffe6
jmp 0x10052683
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x10052727
push 2
lea ecx, [ebp - 0xe1c]
call fcn.10025cee
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x25c], 0
jmp 0x100526bd
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x100526df
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xe1c]
call fcn.10025d6c
mov dword [eax], 0xdc75
jmp 0x100526b0
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10052700
push 0
push 0x1a47
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10025d6c
mov dword [eax], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.10025d50
jmp 0x10052676
lea eax, [ebp - 0xf80]
push eax
mov ecx, 0x106223f4
call fcn.10025e7f
push eax
lea ecx, [ebp - 0x4d0]
call fcn.10025ec7
movzx eax, al
test eax, eax
je 0x10052aec
push 3
lea ecx, [ebp - 0x458]
call fcn.10025cee
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x264], 0
jmp 0x10052783
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x100527a2
push dword [ebp - 0x264]
lea ecx, [ebp - 0x458]
call fcn.10025d6c
and dword [eax], 0
jmp 0x10052776
push 2
lea ecx, [ebp - 0x458]
call fcn.10025d6c
cmp dword [eax], 0
je 0x1005296c
mov dword [ebp - 0x1cc], 0x9a971867
mov dword [ebp - 0x3e0], 0x7c9d5fac
mov dword [ebp - 0x3d8], 0x29694d2b
push 1
lea ecx, [ebp - 0x458]
call fcn.10025d6c
imul eax, dword [eax], 0xdcba
cmp dword [ebp - 0x1cc], eax
jg 0x100527fd
mov dword [ebp - 0x490], 1
jmp 0x10052804
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x1cc], 0xffffffff
jg 0x10052819
mov dword [ebp - 0x8a8], 1
jmp 0x10052820
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0
je 0x10052853
push 1
lea ecx, [ebp - 0x458]
call fcn.10025d6c
cmp dword [eax], 0
je 0x10052853
mov dword [ebp - 0x484], 1
jmp 0x1005285a
and dword [ebp - 0x484], 0
push 2
lea ecx, [ebp - 0x458]
call fcn.10025d6c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x484]
jg 0x1005287d
mov dword [ebp - 0xc98], 1
jmp 0x10052884
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x106c], eax
mov esi, dword [ebp - 0x3d8]
add esi, dword [ebp - 0x1cc]
push 2
lea ecx, [ebp - 0x458]
call fcn.10025d6c
cmp esi, dword [eax]
je 0x100528b9
mov dword [ebp - 0x488], 1
jmp 0x100528c0
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0x91f6f49c
je 0x100528d8
mov dword [ebp - 0xd2c], 1
jmp 0x100528df
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xf88], eax
mov esi, dword [ebp - 0x3e0]
imul esi, dword [ebp - 0x1cc]
push 2
lea ecx, [ebp - 0x458]
call fcn.10025d6c
cmp esi, dword [eax]
je 0x10052921
mov dword [ebp - 0x498], 1
jmp 0x10052928
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0xe26595ad
jae 0x10052940
mov dword [ebp - 0x4a0], 1
jmp 0x10052947
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1005296a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100529e0
mov dword [ebp - 0x1108], 0xffffffff
mov dword [ebp - 0xf90], 0x4204102
mov dword [ebp - 0x107c], 1
mov dword [ebp - 0x4a8], 0xfffffffd
mov dword [ebp - 0x80], 2
jmp 0x100529a4
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x100529d3
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x100529d1
push 0x1710
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1005299d
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x80], 0
jmp 0x100529f0
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
je 0x10052ac9
mov dword [ebp - 0x4b0], 0xfffffffe
mov dword [ebp - 0x4b8], 0x1efae07d
mov dword [ebp - 0x4c8], 0x3988f15e
mov dword [ebp - 0x26c], 0
jmp 0x10052a31
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x10052a4d
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1018], 0xffffffff
jmp 0x10052a24
push 2
lea ecx, [ebp - 0x458]
call fcn.10025d6c
mov dword [eax], 0x82bc9063
mov dword [ebp - 0x4b0], 0x82bc9063
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b0]
dec eax
cmp eax, dword [ebp - 0x4b8]
jl 0x10052a8e
mov dword [ebp - 0x4c0], 1
jmp 0x10052a95
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0
push 4
pop eax
imul esi, eax, 0
push 1
lea ecx, [ebp - 0x458]
call fcn.10025d6c
mov eax, dword [eax]
mov dword [ebp + esi - 0x1018], eax
jmp 0x100529e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.10025d50
lea ecx, [ebp - 0x4d0]
call fcn.10057c06
mov eax, dword [eax + 4]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x64], 0x378f1e0c
push 2
lea ecx, [ebp - 0xea0]
call fcn.10025cee
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x540], 2
mov dword [ebp - 0x274], 0
jmp 0x10052b31
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x10052b53
push dword [ebp - 0x274]
lea ecx, [ebp - 0xea0]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x10052b24
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf98], eax
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x10052bc5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x1c], 0
jne 0x10052b7f
xor eax, eax
inc eax
jne 0x10052b7f
and dword [ebp - 0x4d8], 0
jmp 0x10052b89
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x4d8]
neg eax
cmp eax, 0xa21e
jle 0x10052baa
cmp dword [ebp - 0x1c], 0
je 0x10052baa
mov dword [ebp - 0x4e0], 1
jmp 0x10052bb1
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4e0], eax
je 0x10052bc5
and dword [ebp - 0x4e8], 0
jmp 0x10052bcf
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x10052bed
cmp dword [ebp - 0x1c], 0
jne 0x10052bed
and dword [ebp - 0x4f0], 0
jmp 0x10052bf7
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4f0], eax
jg 0x10052c0e
mov dword [ebp - 0x4f8], 1
jmp 0x10052c15
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4f8], eax
je 0x10052c2c
mov dword [ebp - 0x500], 1
jmp 0x10052c33
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x10052c4d
mov dword [ebp - 0x508], 1
jmp 0x10052c54
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x508], eax
jge 0x10052c6b
mov dword [ebp - 0x510], 1
jmp 0x10052c72
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x510], eax
jg 0x10052c89
mov dword [ebp - 0xca0], 1
jmp 0x10052c90
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xfa0], eax
cmp dword [ebp - 0x1c], 0
je 0x10052d0c
mov dword [ebp - 0x64], 0
jmp 0x10052caf
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff3
je 0x10052d07
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x10052cc5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x10052d05
mov dword [ebp - 0xd34], 0xbdb88dcf
cmp dword [ebp - 0xd34], 0
je 0x10052ce0
jmp 0x10052d05
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10052d03
push 0x2366
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10052cbe
jmp 0x10052ca8
jmp 0x10052e91
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x530], 0xb8a442f2
mov dword [ebp - 0xcb0], 0xfffffffe
mov dword [ebp - 0xd3c], 0xfffffffc
cmp dword [ebp - 0x27c], 8
jne 0x10052d49
mov dword [ebp - 0x518], 1
jmp 0x10052d50
and dword [ebp - 0x518], 0
imul eax, dword [ebp - 0x518], 0xa8d6
cmp eax, 0x35d5
jge 0x10052d6d
mov dword [ebp - 0x520], 1
jmp 0x10052d74
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x520], eax
je 0x10052d8b
mov dword [ebp - 0x528], 1
jmp 0x10052d92
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
cmp eax, dword [ebp - 0x27c]
jne 0x10052dbb
cmp dword [ebp - 0x1c], 0
jne 0x10052dbb
and dword [ebp - 0x538], 0
jmp 0x10052dc5
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x548], eax
push 0
lea ecx, [ebp - 0xea0]
call fcn.10025d6c
mov ecx, dword [ebp - 0x548]
mov dword [eax], ecx
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0x548], eax
jle 0x10052e0c
mov dword [ebp - 0x550], 1
jmp 0x10052e13
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xffff
ja 0x10052e2b
mov dword [ebp - 0x558], 1
jmp 0x10052e32
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x558]
imul eax, dword [ebp - 0xcb0]
cmp dword [ebp - 0x64], eax
jg 0x10052e54
mov dword [ebp - 0x560], 1
jmp 0x10052e5b
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x560]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff7
jg 0x10052e7d
mov dword [ebp - 0x568], 1
jmp 0x10052e84
and dword [ebp - 0x568], 0
imul eax, dword [ebp - 0x568], 3
mov dword [ebp - 0xd3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.10025d50
cmp dword [ebp - 0x17c], 0xffffffff
jne 0x10052fc9
mov ecx, 0x106223f4
call fcn.10057b4c
mov ecx, dword [ebp - 0xe8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106223f4
call fcn.10057b50
and dword [ebp - 0x164], 0
jmp 0x10052ee1
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x164]
cmp ecx, dword [eax + 0x18]
jae 0x10052fc9
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x164]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
je 0x10052fc4
mov eax, dword [ebp - 0x570]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1188]
call fcn.1003efdc
mov dword [ebp - 4], 0x2f
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1188]
call fcn.1003f816
mov dword [ebp - 0x578], eax
movzx eax, byte [0x1062223d]
test eax, eax
je 0x10052f72
mov ecx, 0x106223f4
call fcn.10057b05
movzx eax, al
test eax, eax
jne 0x10052f92
lea eax, [ebp - 0x578]
push eax
mov ecx, 0x106223f4
call fcn.10057b0e
mov ecx, dword [ebp - 0x164]
mov dword [eax], ecx
mov byte [0x1062223d], 1
cmp dword [ebp - 0x17c], 0xffffffff
jne 0x10052fb5
mov eax, dword [ebp - 0x578]
cmp eax, dword [ebp - 0x284]
jne 0x10052fb5
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x17c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1188]
call fcn.1003791a
jmp 0x10052ed4
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x16c], 0x30a9bca7
mov dword [ebp - 0xe0], 0x7120dd93
mov dword [ebp - 0xd8], 4
mov dword [ebp - 0x174], 0x412f3a68
push 1
lea ecx, [ebp - 0x1088]
call fcn.10025cee
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x28c], 0
jmp 0x10053025
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x10053047
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x1088]
call fcn.10025d6c
mov dword [eax], 1
jmp 0x10053018
cmp dword [ebp - 0x44], 0
jne 0x100530bb
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jle 0x10053061
mov dword [ebp - 0x580], 1
jmp 0x10053068
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x1005308e
mov dword [ebp - 0x588], 1
jmp 0x10053095
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
sub eax, dword [ebp - 0x44]
cmp eax, 0x39e
jg 0x100530b1
mov dword [ebp - 0x590], 1
jmp 0x100530b8
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x44]
mov eax, 0xb1dab551
test eax, eax
je 0x100530d6
cmp dword [ebp - 0x44], 0
je 0x100530d6
mov dword [ebp - 0x598], 1
jmp 0x100530dd
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x598]
je 0x100530f4
mov dword [ebp - 0x5a0], 1
jmp 0x100530fb
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0x44], 1
jl 0x10053119
mov dword [ebp - 0x5a8], 1
jmp 0x10053120
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5a8], eax
je 0x1005313e
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1005313e
mov dword [ebp - 0x5b0], 1
jmp 0x10053145
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x5b0], eax
je 0x1005315f
mov dword [ebp - 0x5b8], 1
jmp 0x10053166
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x5b8], eax
jle 0x10053180
mov dword [ebp - 0x5c0], 1
jmp 0x10053187
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x5c0]
jg 0x1005319e
mov dword [ebp - 0x5c8], 1
jmp 0x100531a5
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0x51dd2e9
jge 0x100531bd
mov dword [ebp - 0x5d0], 1
jmp 0x100531c4
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5d0], eax
jle 0x100531db
mov dword [ebp - 0x5d8], 1
jmp 0x100531e2
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 1
jge 0x1005346f
mov dword [ebp - 0x5e0], 0x40b319
mov dword [ebp - 0xb8c], 0xffffffff
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1005321d
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [ebp - 0xd8], 0
jmp 0x10053236
cmp dword [ebp - 0xd8], 0xfffffff6
jg 0x1005346a
mov dword [ebp - 0xd44], 0x418eb0ba
mov dword [ebp - 0x2ac], 0x2bfeed1b
mov dword [ebp - 0x608], 0x22b4
mov dword [ebp - 0xb90], 0x10009ae0
cmp dword [ebp - 0x608], 0x25c1
jle 0x10053350
and dword [ebp - 0x294], 0
jmp 0x10053291
cmp dword [ebp - 0x294], 0x12e7
jge 0x10053350
and dword [ebp - 0x29c], 0
jmp 0x100532b7
cmp dword [ebp - 0x29c], 0x6690
jge 0x1005334b
and dword [ebp - 0x2a4], 0
jmp 0x100532dd
jmp 0x10053284
mov eax, dword [ebp - 0xd44]
cmp eax, dword [ebp - 0x5e0]
jle 0x1005336a
mov dword [ebp - 0x5e8], 1
jmp 0x10053371
and dword [ebp - 0x5e8], 0
mov dword [ebp - 0x2ac], 0xf57f54ab
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x5e8], eax
jl 0x100533a7
mov dword [ebp - 0x5f0], 1
jmp 0x100533ae
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x100533de
cmp dword [ebp - 0xe0], 0xffffffff
jge 0x100533de
cmp dword [ebp - 0x2ac], 0
jne 0x100533de
mov dword [ebp - 0x5f8], 1
mov eax, dword [ebp - 0x5f8]
add eax, 0x70c1
je 0x1005340a
cmp dword [ebp - 0x2ac], 0
je 0x1005340a
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0xb8c], eax
mov byte [ebp - 4], 0x31
cmp dword [ebp - 0x608], 0x2026
jge 0x10053439
jmp 0x100535ce
push 1
lea ecx, [ebp - 0xdd8]
call fcn.10025cee
mov byte [ebp - 4], 0x33
mov dword [ebp - 0xb98], 5
mov dword [ebp - 0xba0], 6
mov dword [ebp - 0x2b4], 0
jmp 0x100534ad
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x100534cc
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xdd8]
call fcn.10025d6c
and dword [eax], 0
jmp 0x100534a0
mov esi, dword [ebp - 0x44]
push 0
lea ecx, [ebp - 0xdd8]
call fcn.10025d6c
cmp esi, dword [eax]
jle 0x100534ec
mov dword [ebp - 0x620], 1
jmp 0x100534f3
and dword [ebp - 0x620], 0
cmp dword [ebp - 0xd8], 0
jne 0x1005350e
cmp dword [ebp - 0xb98], 0
jne 0x1005350e
and dword [ebp - 0x610], 0
jmp 0x10053518
mov dword [ebp - 0x610], 1
cmp dword [ebp - 0x610], 0xfffffffc
jle 0x1005352d
mov dword [ebp - 0x618], 1
jmp 0x10053534
and dword [ebp - 0x618], 0
mov dword [ebp - 0x16c], 0xfffffffa
mov eax, dword [ebp - 0x618]
neg eax
mov ecx, dword [ebp - 0x16c]
sub ecx, eax
cmp dword [ebp - 0x620], ecx
jle 0x10053562
mov dword [ebp - 0x628], 1
jmp 0x10053569
and dword [ebp - 0x628], 0
mov eax, 0xff05
sub eax, dword [ebp - 0x628]
jne 0x1005357d
cmp dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x108c], eax
mov esi, dword [ebp - 0x174]
push 0
lea ecx, [ebp - 0xdd8]
call fcn.10025d6c
cmp esi, dword [eax]
jne 0x100535ac
mov dword [ebp - 0x630], 1
jmp 0x100535b3
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0xba0], eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xdd8]
call fcn.10025d50
mov dword [ebp - 0xe0], 0
jmp 0x100535e7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret