Function at 0x10039e3c
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get geographical location
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f107
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1270
call fcn.1006a8b0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x150], 0xbcef
mov dword [ebp - 0x70], 0xfffffff7
push 3
lea ecx, [ebp - 0x404]
call fcn.100235ae
and dword [ebp - 4], 0
mov dword [ebp - 0x2fc], 0x36dc9922
or dword [ebp - 0xee8], 0xffffffff
or dword [ebp - 0xee4], 0xffffffff
or dword [ebp - 0xee0], 0xffffffff
or dword [ebp - 0xedc], 0xffffffff
lea ecx, [ebp - 0x3d9]
call fcn.1002365b
push eax
lea eax, [ebp - 0xed8]
push eax
lea eax, [ebp - 0xee8]
push eax
lea ecx, [ebp - 0x1200]
call fcn.1002365e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10ac]
call fcn.1002360a
mov byte [ebp - 4], 1
mov dword [ebp - 0x1e4], 0x4bdbaf9e
mov dword [ebp - 0x240], 0
mov dword [ebp - 0xbbc], 0xfffffff8
mov dword [ebp - 0xc78], 0xafe0a4d2
mov dword [ebp - 0x324], 0
jmp 0x10039f27
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x10039f49
push dword [ebp - 0x324]
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov dword [eax], 1
jmp 0x10039f1a
cmp dword [ebp - 0x150], 6
jae 0x10039f5e
mov dword [ebp - 0xab8], 1
jmp 0x10039f65
and dword [ebp - 0xab8], 0
push 0
lea ecx, [ebp - 0x404]
call fcn.1002364c
cmp dword [eax], 0xfffffff6
ja 0x10039f83
mov dword [ebp - 0x7d4], 1
jmp 0x10039f8a
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x1e4], eax
mov esi, dword [ebp - 0x1e4]
push 2
lea ecx, [ebp - 0x404]
call fcn.1002364c
cmp esi, dword [eax]
jg 0x10039fb9
mov dword [ebp - 0xa78], 1
jmp 0x10039fc0
and dword [ebp - 0xa78], 0
push 0
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1030], eax
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x150], 0xa41a
jl 0x1003a009
mov dword [ebp - 0xc68], 1
jmp 0x1003a010
and dword [ebp - 0xc68], 0
push 0
lea ecx, [ebp - 0x10ac]
call fcn.1002364c
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x374]
mov dword [ecx], eax
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x150]
jle 0x1003a068
mov eax, 0x5b676bd7
test eax, eax
jne 0x1003a068
and dword [ebp - 0xaa8], 0
jmp 0x1003a072
mov dword [ebp - 0xaa8], 1
imul eax, dword [ebp - 0xaa8], 0xf3e2
cmp eax, 0x5806
je 0x1003a08f
mov dword [ebp - 0xab0], 1
jmp 0x1003a096
and dword [ebp - 0xab0], 0
push 1
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov ecx, dword [ebp - 0xab0]
cmp ecx, dword [eax]
jl 0x1003a0b9
mov dword [ebp - 0xc70], 1
jmp 0x1003a0c0
and dword [ebp - 0xc70], 0
push 0
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov eax, dword [ebp - 0xab8]
add eax, 0x7662
cmp eax, dword [ebp - 0x150]
je 0x1003a0ec
mov dword [ebp - 0xac0], 1
jmp 0x1003a0f3
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xac0], eax
jne 0x1003a10d
mov dword [ebp - 0xac8], 1
jmp 0x1003a114
and dword [ebp - 0xac8], 0
push 1
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov ecx, dword [ebp - 0xac8]
cmp ecx, dword [eax]
jg 0x1003a137
mov dword [ebp - 0xad0], 1
jmp 0x1003a13e
and dword [ebp - 0xad0], 0
mov esi, dword [ebp - 0x150]
push 2
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov ecx, dword [ebp - 0xad0]
imul ecx, dword [eax]
cmp ecx, esi
jle 0x1003a16a
mov dword [ebp - 0xa84], 1
jmp 0x1003a171
and dword [ebp - 0xa84], 0
cmp dword [ebp - 0xa84], 1
je 0x1003a186
mov dword [ebp - 0x89c], 1
jmp 0x1003a18d
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x89c], eax
jge 0x1003a1a7
mov dword [ebp - 0x438], 1
jmp 0x1003a1ae
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x438], eax
je 0x1003a1c8
mov dword [ebp - 0x8a0], 1
jmp 0x1003a1cf
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
sub eax, dword [ebp - 0xc78]
je 0x1003a334
mov dword [ebp - 0x1b8], 0xcf74
mov dword [ebp - 0x8b8], 4
mov eax, 0xe497d6a5
test eax, eax
je 0x1003a2cb
cmp dword [ebp - 0x1b8], 0
jne 0x1003a22b
xor eax, eax
jne 0x1003a219
cmp dword [ebp - 0x1b8], 0x9320
cmp dword [ebp - 0x1b8], 0xfffffff8
jne 0x1003a22b
and dword [ebp - 0x440], 0
jmp 0x1003a235
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x440]
lea eax, [ecx + eax + 1]
imul eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xcb0], eax
push 0
lea ecx, [ebp - 0x404]
call fcn.1002364c
mov ecx, dword [ebp - 0xcb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x2fc], 0xffffffff
jl 0x1003a285
mov dword [ebp - 0x8a8], 1
jmp 0x1003a28c
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1064], eax
push 1
lea ecx, [ebp - 0x404]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003a2cb
mov dword [ebp - 0x448], 1
jmp 0x1003a2d2
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x448], eax
jl 0x1003a2ec
mov dword [ebp - 0x8b0], 1
jmp 0x1003a2f3
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x8b0], eax
jl 0x1003a310
cmp dword [ebp - 0x70], 0
jne 0x1003a310
and dword [ebp - 0x450], 0
jmp 0x1003a31a
mov dword [ebp - 0x450], 1
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x240], eax
jmp 0x1003a38b
mov dword [ebp - 0x1044], 0xc44f
mov dword [ebp - 0x458], 0xffffffff
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x70], 0
jmp 0x1003a36b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xd
jge 0x1003a38b
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1003a389
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003a364
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10ac]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x404]
call fcn.10023630
cmp dword [ebp + 0x10], 0
jbe 0x1003a3cb
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003a3cb
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10034dee
pop ecx
pop ecx
jmp 0x10042887
mov dword [ebp - 0x54], 0x7b1c2a2c
mov dword [ebp - 0xb68], 0xfcf09cc2
mov dword [ebp - 0xb64], 0xfcf09cc2
mov dword [ebp - 0xb60], 0xfcf09cc2
mov dword [ebp - 0xb5c], 0xfcf09cc2
mov dword [ebp - 0x3ec], 0x6f377cc4
mov dword [ebp - 0x2e0], 0
jmp 0x1003a41d
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x1003a439
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1ac], 8
jmp 0x1003a410
cmp dword [ebp - 0x54], 0
jne 0x1003a44d
xor eax, eax
inc eax
jne 0x1003a44d
and dword [ebp - 0x8c8], 0
jmp 0x1003a457
mov dword [ebp - 0x8c8], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1060], eax
mov eax, 0x87f6fb80
test eax, eax
jne 0x1003a481
cmp dword [ebp - 0x54], 0
jne 0x1003a481
and dword [ebp - 0x8c0], 0
jmp 0x1003a48b
mov dword [ebp - 0x8c0], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x460], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x460]
mov dword [ebp + eax - 0xb68], ecx
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x460], eax
jle 0x1003a4cd
mov dword [ebp - 0x468], 1
jmp 0x1003a4d4
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x8c8]
cmp eax, dword [ebp - 0x468]
jne 0x1003a4f6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb68], 0
je 0x1003a612
mov dword [ebp - 0x478], 0x49a2f381
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0xcc0], 0x18b47430
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1003a530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0x111c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp + eax - 0xb68]
je 0x1003a561
mov dword [ebp - 0x8d0], 1
jmp 0x1003a568
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x8d0], eax
jle 0x1003a582
mov dword [ebp - 0x470], 1
jmp 0x1003a589
and dword [ebp - 0x470], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
dec eax
mov dword [ebp - 0x8d8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8d8]
mov dword [ebp + eax - 0x1ac], ecx
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x478]
jl 0x1003a5dc
mov dword [ebp - 0xcb8], 1
jmp 0x1003a5e3
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x1068], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0x10ec], eax
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x3ec], eax
jmp 0x1003a779
mov dword [ebp - 0xbc], 0x69e7721c
mov dword [ebp - 0xcc8], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ac], 1
jg 0x1003a642
mov dword [ebp - 0x8e0], 1
jmp 0x1003a649
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0xcc8]
cmp dword [ebp - 0x8e0], eax
jg 0x1003a663
mov dword [ebp - 0x480], 1
jmp 0x1003a66a
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0
jl 0x1003a67f
mov dword [ebp - 0x8e8], 1
jmp 0x1003a686
and dword [ebp - 0x8e8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8e8]
sub ecx, dword [ebp + eax - 0xb68]
je 0x1003a6bf
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1003a6ba
push 0
push 0xed6
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x1003a753
mov dword [ebp - 0x54], 0
jmp 0x1003a6cf
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1003a753
mov dword [ebp - 0xbc], 0
jmp 0x1003a6ee
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x1003a70d
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x1ac]
mov ecx, dword [ebp - 0x54]
mov dword [ebp + ecx*4 - 0x1ac], eax
jmp 0x1003a6e1
mov dword [ebp - 0xbc], 0
jmp 0x1003a726
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x1003a74e
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1003a74c
push 0xf58
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x1003a719
jmp 0x1003a6c8
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1003a779
push 0
push 0x23a7
push 0
push 0x1b35
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x2e8], 0xfffffff8
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xcd0], 0x24ec
cmp dword [ebp - 0xcd0], 0xed5
jge 0x1003a8d5
lea ecx, [ebp - 0x1174]
call fcn.1002323f
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1154]
call fcn.1002323f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11c8]
call fcn.1002323f
mov byte [ebp - 4], 4
lea edx, [ebp - 0x1174]
mov ecx, 0x10616650
call fcn.10044348
lea edx, [ebp - 0x1154]
mov ecx, eax
call fcn.10044348
lea edx, [ebp - 0x11c8]
mov ecx, eax
call fcn.10044348
push 0
lea ecx, [ebp - 0x1154]
call fcn.10024fbf
movsx esi, byte [eax]
lea ecx, [ebp - 0x1174]
call fcn.1002c56c
dec eax
push eax
lea ecx, [ebp - 0x1174]
call fcn.10024fbf
movsx eax, byte [eax]
cmp eax, esi
jne 0x1003a88d
push 0
lea ecx, [ebp - 0x11c8]
call fcn.10024fbf
movsx esi, byte [eax]
lea ecx, [ebp - 0x1154]
call fcn.1002c56c
dec eax
push eax
lea ecx, [ebp - 0x1154]
call fcn.10024fbf
movsx eax, byte [eax]
cmp eax, esi
jne 0x1003a88d
push 0x10026fcf
mov edx, 0x10007d6c
mov ecx, 0x10616598
call fcn.10026d57
mov ecx, eax
call fcn.1002348d
jmp 0x1003a8a8
push 0x10026fcf
mov edx, 0x10007d70
mov ecx, 0x10616598
call fcn.10026d57
mov ecx, eax
call fcn.1002348d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11c8]
call fcn.100232a2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1154]
call fcn.100232a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1174]
call fcn.100232a2
mov dword [ebp - 0x928], 0xf0e4f200
push 3
lea ecx, [ebp - 0xb20]
call fcn.100235ae
mov dword [ebp - 4], 5
mov dword [ebp - 0xcf0], 1
push 2
lea ecx, [ebp - 0xd48]
call fcn.100235ae
mov byte [ebp - 4], 6
mov dword [ebp - 0xcf8], 0x9f010208
mov dword [ebp - 0xd18], 0x227af464
mov dword [ebp - 0xd28], 0xfffffffc
mov dword [ebp - 0x34], 0
jmp 0x1003a93c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1003a94f
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3c], 0xffffffff
jmp 0x1003a935
mov dword [ebp - 0x34], 0
jmp 0x1003a95f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003a97b
push dword [ebp - 0x34]
lea ecx, [ebp - 0xb20]
call fcn.1002364c
mov dword [eax], 1
jmp 0x1003a958
mov dword [ebp - 0x34], 0
jmp 0x1003a98b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1003a9a7
push dword [ebp - 0x34]
lea ecx, [ebp - 0xd48]
call fcn.1002364c
mov dword [eax], 0xc160ec25
jmp 0x1003a984
mov dword [ebp - 0x18], 0
jmp 0x1003a9b7
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1003ad25
mov dword [ebp - 0xc8], 0x46df37d4
mov dword [ebp - 0xeb0], 0xb659baaa
mov dword [ebp - 0xeac], 0xb659baaa
mov dword [ebp - 0xea8], 0xb659baaa
mov dword [ebp - 0xea4], 0xb659baaa
mov dword [ebp - 0xce8], 0xfc6a3f0b
push 1
lea ecx, [ebp - 0xd38]
call fcn.100235ae
mov byte [ebp - 4], 7
mov dword [ebp - 0x248], 0
jmp 0x1003aa27
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1003aa49
push dword [ebp - 0x248]
lea ecx, [ebp - 0xd38]
call fcn.1002364c
mov dword [eax], 0xfffffffe
jmp 0x1003aa1a
mov dword [ebp - 0xc8], 0
jmp 0x1003aa62
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1003ab23
mov dword [ebp - 0x488], 0xfffffffe
mov dword [ebp - 0xcd8], 0x9646b8d9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x1158], eax
mov dword [ebp - 0x488], 0x4c59cdc3
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x3c], eax
je 0x1003aad9
mov eax, 0xd43ddca2
test eax, eax
je 0x1003aad9
mov dword [ebp - 0x8f0], 1
jmp 0x1003aae0
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x8f0], eax
jg 0x1003aafa
mov dword [ebp - 0xce0], 1
jmp 0x1003ab01
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x1078], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
mov ecx, dword [ebp - 0xc8]
mov dword [ebp + ecx*4 - 0x3c], eax
jmp 0x1003aa55
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x10f4], eax
push 1
lea ecx, [ebp - 0xd48]
call fcn.1002364c
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x1080], eax
mov eax, dword [ebp - 0x490]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x490]
mov dword [ecx], eax
mov eax, 0x6aaf
cmp eax, 0xc1c5
jle 0x1003ab79
mov dword [ebp - 0x8f8], 1
jmp 0x1003ab80
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xce8]
cmp dword [ebp - 0x8f8], eax
je 0x1003ab9a
mov dword [ebp - 0x498], 1
jmp 0x1003aba1
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x498], eax
jg 0x1003abc5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x1003abc5
and dword [ebp - 0x900], 0
jmp 0x1003abcf
mov dword [ebp - 0x900], 1
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8]
cmp ecx, dword [ebp + eax - 0xeb0]
jl 0x1003abfc
mov dword [ebp - 0x4a0], 1
jmp 0x1003ac03
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xeb0]
cmp dword [ebp - 0x4a0], eax
jle 0x1003ac24
mov dword [ebp - 0x908], 1
jmp 0x1003ac2b
and dword [ebp - 0x908], 0
mov esi, dword [ebp - 0xcf0]
push 0
lea ecx, [ebp - 0xd38]
call fcn.1002364c
mov ecx, dword [ebp - 0x908]
imul ecx, dword [eax]
cmp ecx, esi
jg 0x1003ac57
mov dword [ebp - 0x4a8], 1
jmp 0x1003ac5e
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0xcf8]
cmp dword [ebp - 0x4a8], eax
jne 0x1003ac78
mov dword [ebp - 0xd00], 1
jmp 0x1003ac7f
and dword [ebp - 0xd00], 0
push 0
lea ecx, [ebp - 0xd38]
call fcn.1002364c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x910], eax
push 0
lea ecx, [ebp - 0xd38]
call fcn.1002364c
mov ecx, dword [ebp - 0x910]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3c]
add eax, 0xaa12
imul eax, eax, 0xd77c
cmp eax, dword [ebp - 0x910]
jl 0x1003acd4
mov dword [ebp - 0xd08], 1
jmp 0x1003acdb
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1124], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4b0], eax
push 0
lea ecx, [ebp - 0xb20]
call fcn.1002364c
mov ecx, dword [ebp - 0x4b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x928], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd38]
call fcn.10023630
jmp 0x1003a9b0
mov dword [ebp - 0xd8], 0
jmp 0x1003ad3e
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffee
jge 0x1003b1ae
mov dword [ebp - 0x88], 0xbc5de30
mov dword [ebp - 0xb0], 0x72ee8ff
cmp dword [ebp - 0x88], 0
je 0x1003ada3
mov dword [ebp - 0x18], 0
jmp 0x1003ad78
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff0
je 0x1003ad9e
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1003ad9c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x1003ad71
jmp 0x1003aee9
mov dword [ebp - 0x41c], 0x46fedea8
mov eax, dword [ebp - 0x88]
sub eax, 0x385fae11
jne 0x1003adc6
mov dword [ebp - 0x918], 1
jmp 0x1003adcd
and dword [ebp - 0x918], 0
mov eax, 0xaab93b57
sub eax, dword [ebp - 0x918]
jne 0x1003aebb
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1088], eax
cmp dword [ebp - 0x41c], 0x5251bb39
je 0x1003ae02
mov dword [ebp - 0x4b8], 1
jmp 0x1003ae09
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x4b8], eax
jne 0x1003ae23
mov dword [ebp - 0x3f4], 1
jmp 0x1003ae2a
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0xb20]
call fcn.1002364c
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3c]
add ecx, dword [ebp - 0x3f4]
cmp ecx, dword [ebp + eax - 0x3c]
jne 0x1003ae67
mov dword [ebp - 0x920], 1
jmp 0x1003ae6e
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
sub eax, dword [ebp - 0x88]
je 0x1003ae91
mov eax, 0x4618
test eax, eax
je 0x1003ae91
mov dword [ebp - 0xd10], 1
jmp 0x1003ae98
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x88]
jge 0x1003aebb
and dword [ebp - 0x4c0], 0
jmp 0x1003aec5
mov dword [ebp - 0x4c0], 1
mov esi, dword [ebp - 0x41c]
push 1
lea ecx, [ebp - 0xd48]
call fcn.1002364c
mov ecx, dword [ebp - 0x4c0]
sub ecx, dword [eax]
imul ecx, esi
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x88], 1
cmp dword [ebp - 0x88], 0
jne 0x1003b044
mov eax, 0xb6624e94
test eax, eax
jne 0x1003b044
mov dword [ebp - 0xd18], 0xfffffffd
mov eax, dword [ebp - 0x928]
sub eax, 0x73bc
cmp eax, 0x3dc5
jl 0x1003af3b
cmp dword [ebp - 0x88], 0
jne 0x1003af3b
and dword [ebp - 0x4c8], 0
jmp 0x1003af45
mov dword [ebp - 0x4c8], 1
cmp dword [ebp - 0x4c8], 0xe505
jle 0x1003af5d
mov dword [ebp - 0x930], 1
jmp 0x1003af64
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x930], eax
jle 0x1003af7e
mov dword [ebp - 0x4d0], 1
jmp 0x1003af85
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 1
jg 0x1003af9a
mov dword [ebp - 0x938], 1
jmp 0x1003afa1
and dword [ebp - 0x938], 0
push 0
lea ecx, [ebp - 0xd48]
call fcn.1002364c
mov ecx, dword [ebp - 0x938]
sub ecx, dword [eax]
je 0x1003afcd
cmp dword [ebp - 0xd8], 0
je 0x1003afcd
mov dword [ebp - 0x4d8], 1
jmp 0x1003afd4
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x4d8], eax
jge 0x1003afee
mov dword [ebp - 0x940], 1
jmp 0x1003aff5
and dword [ebp - 0x940], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x940]
sub ecx, dword [ebp + eax - 0x3c]
cmp ecx, dword [ebp - 0x18]
jg 0x1003b016
mov dword [ebp - 0x4e0], 1
jmp 0x1003b01d
and dword [ebp - 0x4e0], 0
mov esi, dword [ebp - 0x88]
imul esi, dword [ebp - 0x4e0]
push 0
lea ecx, [ebp - 0xb20]
call fcn.1002364c
cmp esi, dword [eax]
je 0x1003b044
and dword [ebp - 0x948], 0
jmp 0x1003b04e
mov dword [ebp - 0x948], 1
cmp dword [ebp - 0x948], 0x375b
jl 0x1003b066
mov dword [ebp - 0x4e8], 1
jmp 0x1003b06d
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x4e8], eax
jne 0x1003b087
mov dword [ebp - 0xd20], 1
jmp 0x1003b08e
and dword [ebp - 0xd20], 0
push 0
lea ecx, [ebp - 0xb20]
call fcn.1002364c
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb0]
jl 0x1003b0be
cmp dword [ebp - 0xb0], 0
je 0x1003b0be
mov dword [ebp - 0x950], 1
jmp 0x1003b0c5
and dword [ebp - 0x950], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb0]
add ecx, dword [ebp - 0x950]
add ecx, dword [ebp + eax - 0x3c]
cmp ecx, dword [ebp - 0x18]
jg 0x1003b0ec
mov dword [ebp - 0x4f0], 1
jmp 0x1003b0f3
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x4f0]
sub eax, dword [ebp - 0xb0]
mov dword [ebp - 0x958], eax
push 1
lea ecx, [ebp - 0xb20]
call fcn.1002364c
mov ecx, dword [ebp - 0x958]
mov dword [eax], ecx
cmp dword [ebp - 0x958], 0
jne 0x1003b13b
mov eax, 0x7d3b8750
test eax, eax
jne 0x1003b13b
and dword [ebp - 0x4f8], 0
jmp 0x1003b145
mov dword [ebp - 0x4f8], 1
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0xb0]
jne 0x1003b175
mov dword [ebp - 0x960], 1
jmp 0x1003b17c
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x960], eax
jg 0x1003b196
mov dword [ebp - 0x500], 1
jmp 0x1003b19d
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xd28], eax
jmp 0x1003ad31
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd48]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb20]
call fcn.10023630
cmp dword [ebp + 0x10], 0
jne 0x1003e398
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1002d49e
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x968], 0xf73838a
mov dword [ebp - 0x1c0], 0x64a53aa9
mov dword [ebp - 0xe20], 0xe124
mov dword [ebp - 0xe30], 0xfffffffd
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
je 0x1003b2b6
mov dword [ebp - 0x3c8], 0xaef6
mov eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0xe20]
jne 0x1003b24c
mov dword [ebp - 0xe28], 1
jmp 0x1003b253
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x968]
jle 0x1003b285
mov dword [ebp - 0x508], 1
jmp 0x1003b28c
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 1
jle 0x1003b2a1
mov dword [ebp - 0x970], 1
jmp 0x1003b2a8
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0xe30], eax
jmp 0x1003b2d3
mov dword [ebp - 0x510], 0x65786371
mov eax, dword [ebp - 0x510]
imul eax, dword [ebp - 0x510]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x250], 0x13b91020
mov dword [ebp - 0xe38], 5
mov dword [ebp - 0x250], 0
jmp 0x1003b300
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffe3
je 0x1003b35b
mov dword [ebp - 0x2f0], 0
jmp 0x1003b322
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1003b33e
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1198], 0x7d8e
jmp 0x1003b315
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1198], 0
je 0x1003b34f
jmp 0x1003b35b
mov dword [ebp - 0xe38], 0xc76d7be7
jmp 0x1003b2f3
cmp dword [0x107f7884], 0
jne 0x1003e096
mov dword [ebp - 0xc0], 0xc62e
mov dword [ebp - 0x528], 0xb666a756
mov dword [ebp - 0x988], 0x80fc3a06
push 4
lea ecx, [ebp - 0xf48]
call fcn.100235ae
mov dword [ebp - 4], 8
mov dword [ebp - 0x258], 0
jmp 0x1003b3b3
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1003b3d5
push dword [ebp - 0x258]
lea ecx, [ebp - 0xf48]
call fcn.1002364c
mov dword [eax], 0xc99cdf9c
jmp 0x1003b3a6
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc0]
jg 0x1003b3ef
mov dword [ebp - 0x978], 1
jmp 0x1003b3f6
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x978], eax
jle 0x1003b41c
mov dword [ebp - 0x518], 1
jmp 0x1003b423
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x518], eax
jl 0x1003b43d
mov dword [ebp - 0x980], 1
jmp 0x1003b444
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 2
jle 0x1003b459
mov dword [ebp - 0x520], 1
jmp 0x1003b460
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 0xfffa
jne 0x1003b484
mov dword [ebp - 0x990], 1
jmp 0x1003b48b
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
add eax, dword [ebp - 0x990]
add eax, dword [ebp - 0xc0]
jne 0x1003b4bd
mov eax, 0xb66f
test eax, eax
jne 0x1003b4bd
and dword [ebp - 0x530], 0
jmp 0x1003b4c7
mov dword [ebp - 0x530], 1
mov esi, dword [ebp - 0x530]
sub esi, dword [ebp - 0xc0]
push 1
lea ecx, [ebp - 0xf48]
call fcn.1002364c
mov dword [eax], esi
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1003b506
push 0x6c0
push 0x1849
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf48]
call fcn.10023630
mov dword [ebp - 0xe1c], 0x3c15
lea eax, [ebp - 0xe1c]
push eax
call fcn.10034dba
pop ecx
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0x380], 3
mov dword [ebp - 0x260], 7
mov dword [ebp - 0xbc4], 0xfffffffb
mov dword [ebp - 0x998], 0
mov dword [ebp - 0xfb0], 0xf2d3
mov dword [ebp - 0x388], 0xc4d1454b
mov dword [ebp - 0x3f0], 3
mov dword [ebp - 0xc60], 0xc4dd
mov dword [ebp - 0x2f8], 0
jmp 0x1003b59b
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1003b5b7
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x9b0], 0x44401d1b
jmp 0x1003b58e
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xfb8], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xfc0], eax
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0xffff
jb 0x1003b618
mov dword [ebp - 0x9a0], 1
jmp 0x1003b61f
and dword [ebp - 0x9a0], 0
mov dword [ebp - 0x998], 0xc299e885
cmp dword [ebp - 0x998], 0
jne 0x1003b63e
mov dword [ebp - 0x538], 1
jmp 0x1003b645
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b0]
cmp dword [ebp - 0x538], eax
je 0x1003b666
mov dword [ebp - 0x540], 1
jmp 0x1003b66d
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x9a0]
cmp eax, dword [ebp - 0x540]
jl 0x1003b6be
cmp dword [ebp - 0x388], 0
jne 0x1003b696
cmp dword [ebp - 0xc60], 0
jne 0x1003b696
and dword [ebp - 0x9a8], 0
jmp 0x1003b6a0
mov dword [ebp - 0x9a8], 1
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x1003b6be
and dword [ebp - 0x548], 0
jmp 0x1003b6c8
mov dword [ebp - 0x548], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x548]
mov dword [ebp + eax - 0x9b0], ecx
mov dword [ebp - 0x64], 0x6dd1e1e8
mov dword [ebp - 0x9f0], 0x4eb0a117
mov dword [ebp - 0x300], 0
jmp 0x1003b705
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x1003b721
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xae0], 0xffffffff
jmp 0x1003b6f8
mov dword [ebp - 0x64], 0
jmp 0x1003b731
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1003b747
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xae0], 0xfffffffc
jmp 0x1003b72a
mov dword [ebp - 0x64], 0x10
jmp 0x1003b757
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff6
jl 0x1003ba85
mov dword [ebp - 0x6c], 0x801fc3ee
mov dword [ebp - 0xf0], 4
mov dword [ebp - 0x9e8], 0xb9d37639
mov dword [ebp - 0x6c], 2
jmp 0x1003b78c
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x1003b929
mov dword [ebp - 0x268], 0
jmp 0x1003b7af
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x1003b7cb
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xbcc], 0xfffffffb
jmp 0x1003b7a2
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp + ecx*4 - 0xae0]
cmp ecx, dword [ebp + eax - 0xae0]
je 0x1003b7ef
mov dword [ebp - 0x550], 1
jmp 0x1003b7f6
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [ebp + eax*4 - 0xae0]
jne 0x1003b811
mov dword [ebp - 0x9b8], 1
jmp 0x1003b818
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x9b8]
jl 0x1003b832
mov dword [ebp - 0x558], 1
jmp 0x1003b839
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x558], eax
jl 0x1003b850
mov dword [ebp - 0x9c0], 1
jmp 0x1003b857
and dword [ebp - 0x9c0], 0
cmp dword [ebp - 0x9c0], 0xe2db80eb
ja 0x1003b86f
mov dword [ebp - 0x560], 1
jmp 0x1003b876
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 1
jl 0x1003b88b
mov dword [ebp - 0x9c8], 1
jmp 0x1003b892
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xae0]
cmp eax, dword [ebp - 0x9c8]
jl 0x1003b8b0
mov dword [ebp - 0xd1c], 1
jmp 0x1003b8b7
and dword [ebp - 0xd1c], 0
cmp dword [ebp - 0x64], 7
jge 0x1003b8c9
mov dword [ebp - 0x568], 1
jmp 0x1003b8d0
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf0]
add ecx, dword [ebp + eax - 0xae0]
jns 0x1003b8fd
mov dword [ebp - 0x9d0], 1
jmp 0x1003b904
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x9d0]
sub ecx, dword [ebp - 0x6c]
add ecx, dword [ebp + eax*4 - 0xae0]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbcc], ecx
jmp 0x1003b785
mov dword [ebp - 0xf0], 0
jmp 0x1003b942
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff3
jge 0x1003ba80
mov dword [ebp - 0x3d0], 0xdf39f3c5
mov dword [ebp - 0x570], 0xfffffff9
mov dword [ebp - 0x9f0], 0x3d4752e4
mov dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0x653649d9
jne 0x1003b98f
mov dword [ebp - 0xdb4], 1
jmp 0x1003b996
and dword [ebp - 0xdb4], 0
mov eax, 0xcc9e
sub eax, 0xc3d8
cmp eax, dword [ebp - 0x3d0]
jle 0x1003b9b4
mov dword [ebp - 0x9d8], 1
jmp 0x1003b9bb
and dword [ebp - 0x9d8], 0
cmp dword [ebp - 0x9d8], 8
jl 0x1003b9d0
mov dword [ebp - 0x578], 1
jmp 0x1003b9d7
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x9e8]
cmp dword [ebp - 0x578], eax
jge 0x1003b9f1
mov dword [ebp - 0x9e0], 1
jmp 0x1003b9f8
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x3d0]
cmp eax, dword [ebp - 0x9e0]
jg 0x1003ba12
mov dword [ebp - 0xbd4], 1
jmp 0x1003ba19
and dword [ebp - 0xbd4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [ebp + eax - 0xae0]
jge 0x1003ba39
mov dword [ebp - 0x580], 1
jmp 0x1003ba40
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
sub eax, dword [ebp - 0x9e8]
mov ecx, dword [ebp - 0xf0]
sub ecx, 0xb38e
cmp ecx, eax
jle 0x1003ba68
mov dword [ebp - 0x588], 1
jmp 0x1003ba6f
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x9f0], eax
jmp 0x1003b935
jmp 0x1003b750
mov byte [ebp - 0x218], 1
mov byte [ebp - 0x217], 0x84
mov byte [ebp - 0x216], 0xc
mov byte [ebp - 0x215], 0x32
mov byte [ebp - 0x214], 1
mov byte [ebp - 0x213], 0x3a
mov byte [ebp - 0x212], 2
mov byte [ebp - 0x211], 0x23
mov byte [ebp - 0x210], 0xb
mov byte [ebp - 0x20f], 0xc
mov byte [ebp - 0x20e], 8
mov byte [ebp - 0x20d], 0x17
mov byte [ebp - 0x20c], 7
mov byte [ebp - 0x20b], 6
mov byte [ebp - 0x20a], 6
mov byte [ebp - 0x209], 0x1a
mov byte [ebp - 0x208], 3
mov byte [ebp - 0x207], 0x25
mov byte [ebp - 0x206], 0xa
mov byte [ebp - 0x205], 0x13
mov byte [ebp - 0x204], 9
mov byte [ebp - 0x203], 0x2b
mov byte [ebp - 0x202], 5
mov byte [ebp - 0x201], 0x1c
mov byte [ebp - 0x200], 4
mov byte [ebp - 0x1ff], 0x17
mov byte [ebp - 0x1fe], 0
mov byte [ebp - 0x1fd], 0x22
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x218]
and eax, 0xe1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x218]
or ecx, 0xe1
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0xe18], cl
mov dword [ebp - 0x40], 0
mov dword [ebp - 0xa0], 0xdc99cdf9
mov dword [ebp - 0xdbc], 0xffffffff
push 2
lea ecx, [ebp - 0xe58]
call fcn.100235ae
mov dword [ebp - 4], 9
mov dword [ebp - 0x308], 0
jmp 0x1003bbcf
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1003bbf1
push dword [ebp - 0x308]
lea ecx, [ebp - 0xe58]
call fcn.1002364c
mov dword [eax], 0xa741263
jmp 0x1003bbc2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xfc8], eax
cmp dword [ebp - 0x40], 1
jg 0x1003bc0c
mov dword [ebp - 0x590], 1
jmp 0x1003bc13
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x40]
jle 0x1003bc2e
mov dword [ebp - 0x9f8], 1
jmp 0x1003bc35
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x9f8], eax
je 0x1003bc4c
mov dword [ebp - 0x598], 1
jmp 0x1003bc53
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x598], eax
jg 0x1003bf43
mov dword [ebp - 0x310], 9
mov dword [ebp - 0x420], 0xcb0befcd
mov dword [ebp - 0x390], 0xfffffffb
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0xbe4], 0
cmp dword [ebp - 0x310], 0
jne 0x1003bcb3
mov dword [ebp - 0xa00], 1
jmp 0x1003bcba
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
inc eax
inc eax
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xd24]
cmp eax, dword [ebp - 0xbdc]
jg 0x1003bcfb
mov dword [ebp - 0x5a0], 1
jmp 0x1003bd02
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x5a0], eax
jl 0x1003bd1c
mov dword [ebp - 0x5a8], 1
jmp 0x1003bd23
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xfd0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xfe0], eax
mov eax, 0xac3a6081
cmp eax, 1
jbe 0x1003bd5d
mov dword [ebp - 0xa08], 1
jmp 0x1003bd64
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0xa08], eax
jg 0x1003bd7e
mov dword [ebp - 0xa10], 1
jmp 0x1003bd85
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0xa10]
jne 0x1003bd9f
mov dword [ebp - 0x5b0], 1
jmp 0x1003bda6
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0x270]
jl 0x1003bdcc
mov dword [ebp - 0xa18], 1
jmp 0x1003bdd3
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa18], eax
jge 0x1003bded
mov dword [ebp - 0x5b8], 1
jmp 0x1003bdf4
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x5b8]
jl 0x1003be0e
mov dword [ebp - 0xa20], 1
jmp 0x1003be15
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xdbc]
cmp dword [ebp - 0xa20], eax
jge 0x1003be2f
mov dword [ebp - 0x5c0], 1
jmp 0x1003be36
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x5c0]
cmp dword [ebp - 0x310], eax
jle 0x1003be56
mov dword [ebp - 0xa28], 1
jmp 0x1003be5d
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa28]
jle 0x1003be7d
mov eax, 0x997e
test eax, eax
jne 0x1003be7d
and dword [ebp - 0x5c8], 0
jmp 0x1003be87
mov dword [ebp - 0x5c8], 1
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x5c8], eax
jg 0x1003bea1
mov dword [ebp - 0xa30], 1
jmp 0x1003bea8
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0xa30], eax
je 0x1003bec2
mov dword [ebp - 0x5d0], 1
jmp 0x1003bec9
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0xbe4]
cmp dword [ebp - 0x5d0], eax
jg 0x1003bee3
mov dword [ebp - 0xa38], 1
jmp 0x1003beea
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x310]
sub eax, dword [ebp - 0xa38]
cmp eax, dword [ebp - 0x5d8]
jle 0x1003bf0a
mov dword [ebp - 0xa40], 1
jmp 0x1003bf11
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0xa40], eax
jg 0x1003bf2b
mov dword [ebp - 0x5e0], 1
jmp 0x1003bf32
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0xa0], eax
jmp 0x1003bffc
mov dword [ebp - 0xa48], 0xa8a7e8b7
mov dword [ebp - 0x40], 0
jmp 0x1003bf5d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x1003bfd1
mov dword [ebp - 0xd2c], 0xd9132e88
mov esi, dword [ebp - 0xa48]
push dword [ebp - 0x40]
lea ecx, [ebp - 0xe58]
call fcn.1002364c
imul esi, dword [eax]
push dword [ebp - 0x40]
lea ecx, [ebp - 0xe58]
call fcn.1002364c
mov eax, dword [eax]
sub eax, 6
cmp eax, esi
jge 0x1003bfa7
mov dword [ebp - 0x5e8], 1
jmp 0x1003bfae
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xfe8], eax
mov eax, dword [ebp - 0xa48]
add eax, dword [ebp - 0x5e8]
imul eax, eax, 0x10f1
mov dword [ebp - 0xd2c], eax
jmp 0x1003bf56
cmp dword [ebp - 0xa0], 0xc9199ed1
jne 0x1003bfe9
mov dword [ebp - 0xa50], 1
jmp 0x1003bff0
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0xa0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe58]
call fcn.10023630
mov dword [ebp - 0x48], 2
and dword [ebp - 0x330], 0
jmp 0x1003c023
mov eax, dword [ebp - 0x48]
inc eax
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1c
jae 0x1003ca02
mov dword [ebp - 0xff0], 0x3342eb90
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1003c05d
push 0
push 0x1829
push 0
push 0x2328
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1003c077
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x218]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x48], eax
jne 0x1003c7cd
mov dword [ebp - 0x14], 0xf34f
mov dword [ebp - 0xed4], 0x951f
mov dword [ebp - 0xed0], 0x951f
mov dword [ebp - 0xecc], 0x951f
mov dword [ebp - 0xec8], 0x951f
lea ecx, [ebp - 0x3d1]
call fcn.1002365b
push eax
lea eax, [ebp - 0xec4]
push eax
lea eax, [ebp - 0xed4]
push eax
lea ecx, [ebp - 0x11d0]
call fcn.1002365e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xaf0]
call fcn.1002360a
mov dword [ebp - 4], 0xa
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1003c120
push 0x3aa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [ebp - 0x14]
sub eax, 0x74ec135c
je 0x1003c5e1
push 1
lea ecx, [ebp - 0xe94]
call fcn.100235ae
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x3d8], 0x209a488d
mov dword [ebp - 0x278], 0
jmp 0x1003c162
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1003c181
push dword [ebp - 0x278]
lea ecx, [ebp - 0xe94]
call fcn.1002364c
and dword [eax], 0
jmp 0x1003c155
mov dword [ebp - 0x14], 0
jmp 0x1003c191
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1003c1ad
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov dword [eax], 8
jmp 0x1003c18a
mov dword [ebp - 0x14], 0
jmp 0x1003c1bd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1003c5d0
mov dword [ebp - 0x398], 0xf196e6c8
mov dword [ebp - 0xa70], 0x22a1efe0
mov dword [ebp - 0x5f0], 0x28b1
mov dword [ebp - 0xdc4], 0x10008818
cmp dword [ebp - 0x5f0], 0x2972
jle 0x1003c31a
push 0xf58
call dword [sym.imp.USER32.dll_SetCapture]
and dword [ebp - 0x318], 0
jmp 0x1003c220
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x3767
jge 0x1003c31a
and dword [ebp - 0x280], 0
jmp 0x1003c246
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x70b8
jge 0x1003c315
and dword [ebp - 0x320], 0
jmp 0x1003c26c
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x73a6
jge 0x1003c310
and dword [ebp - 0x288], 0
jmp 0x1003c292
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x732b
jge 0x1003c30b
mov eax, dword [ebp - 0x318]
cdq
idiv dword [ebp - 0x280]
mov ecx, dword [ebp - 0x320]
shl edx, cl
mov ecx, dword [ebp - 0x288]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0xc84], eax
mov dword [ebp - 0xc80], edx
push dword [ebp - 0xc80]
push dword [ebp - 0xc84]
lea ecx, [ebp - 0x1250]
call fcn.1000a5d5
pop ecx
pop ecx
mov dword [ebp - 0xbec], eax
mov ecx, dword [ebp - 0xbec]
call fcn.100232ac
push eax
call fcn.10056e26
pop ecx
lea ecx, [ebp - 0x1250]
call fcn.100232a2
jmp 0x1003c285
jmp 0x1003c25f
jmp 0x1003c239
jmp 0x1003c213
mov dword [ebp - 0x328], 0
jmp 0x1003c333
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1003c34f
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x1050], 0xca4d9a54
jmp 0x1003c326
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x5f0], 0x286c
jge 0x1003c36b
push dword [ebp - 0xdc4]
call fcn.10056e26
pop ecx
jmp 0x1003c387
mov dword [ebp - 4], 0xb
jmp 0x1003c397
cmp dword [ebp - 0x14], 5
jle 0x1003c3a9
mov dword [ebp - 0x8a4], 1
jmp 0x1003c3b0
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x14], 0x83d1
je 0x1003c3c5
mov dword [ebp - 0xa58], 1
jmp 0x1003c3cc
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x5f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5f8]
mov dword [ebp + eax - 0x1050], ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov esi, dword [ebp - 0x5f8]
sub esi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
cmp esi, dword [eax]
je 0x1003c42b
mov dword [ebp - 0xa60], 1
jmp 0x1003c432
and dword [ebp - 0xa60], 0
push 0
lea ecx, [ebp - 0xe94]
call fcn.1002364c
mov ecx, dword [ebp - 0xa60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0xff8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3d8]
jle 0x1003c47c
push 0
lea ecx, [ebp - 0xe94]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003c47c
mov dword [ebp - 0x600], 1
jmp 0x1003c483
and dword [ebp - 0x600], 0
push 3
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov ecx, dword [ebp - 0x600]
cmp ecx, dword [eax]
jle 0x1003c4a6
mov dword [ebp - 0xa68], 1
jmp 0x1003c4ad
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 0
jne 0x1003c4d4
cmp dword [ebp - 0x398], 0
jne 0x1003c4d4
and dword [ebp - 0x60c], 0
jmp 0x1003c4de
mov dword [ebp - 0x60c], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov ecx, dword [ebp - 0x60c]
sub ecx, dword [eax]
cmp ecx, 0xfffffff7
jg 0x1003c505
mov dword [ebp - 0xa8c], 1
jmp 0x1003c50c
and dword [ebp - 0xa8c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov ecx, dword [ebp - 0xa8c]
cmp ecx, dword [eax]
jl 0x1003c530
mov dword [ebp - 0x614], 1
jmp 0x1003c537
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0x6928694a
je 0x1003c54f
mov dword [ebp - 0x61c], 1
jmp 0x1003c556
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x61c]
jge 0x1003c570
mov dword [ebp - 0x9ec], 1
jmp 0x1003c577
and dword [ebp - 0x9ec], 0
imul eax, dword [ebp - 0x9ec], 0x4698
test eax, eax
jne 0x1003c5a5
or eax, 0xffffffff
jne 0x1003c5a5
mov eax, 0xaea
test eax, eax
jne 0x1003c5a5
mov eax, 0xd505bc98
test eax, eax
jne 0x1003c5a5
and dword [ebp - 0x624], 0
jmp 0x1003c5af
mov dword [ebp - 0x624], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0xaf0]
call fcn.1002364c
mov eax, dword [eax]
add eax, dword [ebp - 0x624]
mov dword [ebp - 0x3d8], eax
jmp 0x1003c1b6
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe94]
call fcn.10023630
jmp 0x1003c60d
mov dword [ebp - 0xbf4], 0xb786
mov dword [ebp - 0x14], 0
jmp 0x1003c5fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1003c60d
mov dword [ebp - 0xbf4], 1
jmp 0x1003c5f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf0]
call fcn.10023630
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x218]
inc eax
mov dword [ebp - 0x330], eax
push 1
lea ecx, [ebp - 0xb44]
call fcn.100235ae
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x8c], 0
jmp 0x1003c65b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1003c677
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x62c], 1
jmp 0x1003c64e
mov dword [ebp - 0x8c], 0
jmp 0x1003c690
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1003c6af
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xb44]
call fcn.1002364c
or dword [eax], 0xffffffff
jmp 0x1003c683
push 0
lea ecx, [ebp - 0xb44]
call fcn.1002364c
and dword [eax], 0
jmp 0x1003c6e5
push 0
lea ecx, [ebp - 0xb44]
call fcn.1002364c
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x8ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb44]
call fcn.1002364c
cmp dword [eax], 0
jl 0x1003c725
push 0
lea ecx, [ebp - 0xb44]
call fcn.1002364c
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x62c]
push 0
lea ecx, [ebp - 0xb44]
call fcn.1002364c
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x62c], esi
jmp 0x1003c6c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb44]
call fcn.10023630
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x218]
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1e0], 0x8cff0ea7
mov dword [ebp - 0x1e0], 0x1a
jmp 0x1003c76c
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xfffffff3
jne 0x1003c7c8
mov dword [ebp - 0x290], 0x108f8256
mov dword [ebp - 0x290], 0
jmp 0x1003c798
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xb
jne 0x1003c7bb
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1003c7b9
call dword [sym.imp.USER32.dll_GetCapture]
jmp 0x1003c78b
cmp dword [ebp - 0x1e0], 0
je 0x1003c7c6
jmp 0x1003c75f
jmp 0x1003c75f
jmp 0x1003c01b
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x330]
movzx eax, byte [ebp + eax - 0x21a]
movsx eax, byte [ebp + eax - 0xe18]
mov ecx, dword [ebp - 0x48]
movzx ecx, byte [ebp + ecx - 0x217]
and ecx, eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x330]
movzx eax, byte [ebp + eax - 0x21a]
movsx eax, byte [ebp + eax - 0xe18]
mov edx, dword [ebp - 0x48]
movzx edx, byte [ebp + edx - 0x217]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0xe18], dl
mov dword [ebp - 0x1000], 1
mov dword [ebp - 0x1008], 0xffffffff
mov dword [ebp - 0x1010], 1
mov dword [ebp - 0xd4c], 0xfffffffd
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0x3a0], 1
mov dword [ebp - 0xb8], 0
jmp 0x1003c882
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1003c89e
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xb14], 0xfffffff6
jmp 0x1003c875
mov dword [ebp - 0xb8], 0
jmp 0x1003c8b7
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1003c8d3
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xc90], 0xfffffffe
jmp 0x1003c8aa
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xb14], 0
mov dword [ebp - 0xd3c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd3c]
mov dword [ebp + eax - 0xb14], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc90], 0x9ef4a042
ja 0x1003c919
mov dword [ebp - 0x634], 1
jmp 0x1003c920
and dword [ebp - 0x634], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xc90]
imul ecx, dword [ebp - 0x634]
cmp ecx, dword [ebp + eax - 0xc90]
jge 0x1003c94f
mov dword [ebp - 0xbfc], 1
jmp 0x1003c956
and dword [ebp - 0xbfc], 0
push 7
pop eax
cmp eax, 6
jb 0x1003c96a
mov dword [ebp - 0x8b4], 1
jmp 0x1003c971
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xdcc], eax
mov eax, dword [ebp - 0x8b4]
neg eax
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0xdcc]
cmp eax, dword [ebp - 0xc04]
jge 0x1003c9b2
mov dword [ebp - 0x63c], 1
jmp 0x1003c9b9
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x9f4], eax
cmp dword [ebp - 0x9f4], 0
jne 0x1003c9e0
mov eax, 0xa2c3
test eax, eax
jne 0x1003c9e0
and dword [ebp - 0x644], 0
jmp 0x1003c9ea
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0xd4c], eax
and dword [ebp - 0x330], 0
jmp 0x1003c01b
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xe18], 0
mov dword [ebp - 0xe4c], 0x61928c17
mov dword [ebp - 0xe48], 0x61928c17
mov dword [ebp - 0xe44], 0x61928c17
mov dword [ebp - 0xe40], 0x61928c17
mov dword [ebp - 0x1018], 0xb1658084
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe4c], 0
jmp 0x1003ca70
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe4c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe4c], 0xffffffe8
jne 0x1003cab6
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x8bc]
dec eax
mov dword [ebp - 0x8bc], eax
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1003cab4
push 0x1809
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x1003ca55
lea eax, [ebp - 0xe18]
push eax
lea ecx, [ebp - 0x1238]
call fcn.1002c4eb
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xdd4], eax
mov dword [ebp - 4], 0xf
mov edx, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xdd4]
call fcn.1002d49e
mov dword [0x107f7884], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1238]
call fcn.1002c533
and dword [ebp - 0x298], 0
jmp 0x1003cb1c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0xe
jae 0x1003cb35
mov eax, dword [ebp - 0x298]
mov byte [ebp + eax - 0xe18], 0
jmp 0x1003cb0f
push 3
lea ecx, [ebp - 0x358]
call fcn.100235ae
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x65c], 0xa028ea38
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x67c], 0xfffffff7
mov dword [ebp - 0xc14], 1
mov dword [ebp - 0x338], 0
jmp 0x1003cb8a
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x1003cbac
push dword [ebp - 0x338]
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov dword [eax], 0x5aad8530
jmp 0x1003cb7d
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp dword [eax], 0
jne 0x1003cbcc
xor eax, eax
inc eax
jne 0x1003cbcc
and dword [ebp - 0x64c], 0
jmp 0x1003cbd6
mov dword [ebp - 0x64c], 1
mov esi, dword [ebp - 0x64c]
add esi, 0x9d87
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp esi, dword [eax]
je 0x1003cbff
mov dword [ebp - 0xa94], 1
jmp 0x1003cc06
and dword [ebp - 0xa94], 0
push 0
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov ecx, dword [ebp - 0xa94]
cmp ecx, dword [eax]
jne 0x1003cc4d
mov eax, 0xcadf
test eax, eax
je 0x1003cc4d
mov eax, 0x6de6
test eax, eax
je 0x1003cc4d
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003cc4d
mov dword [ebp - 0x654], 1
jmp 0x1003cc54
and dword [ebp - 0x654], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov ecx, dword [ebp - 0x654]
cmp ecx, dword [eax]
jg 0x1003cc77
mov dword [ebp - 0x8c4], 1
jmp 0x1003cc7e
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
add eax, 0x6cef
cmp eax, 1
jne 0x1003cc9a
mov dword [ebp - 0x9fc], 1
jmp 0x1003cca1
and dword [ebp - 0x9fc], 0
mov dword [ebp - 0x65c], 0x1589
mov eax, dword [ebp - 0x65c]
cmp eax, dword [ebp - 0x9fc]
je 0x1003ccc5
mov dword [ebp - 0x664], 1
jmp 0x1003cccc
and dword [ebp - 0x664], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov eax, dword [eax]
add eax, dword [ebp - 0x664]
cmp eax, 7
jle 0x1003ccf2
mov dword [ebp - 0x8cc], 1
jmp 0x1003ccf9
and dword [ebp - 0x8cc], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov ecx, dword [ebp - 0x8cc]
sub ecx, dword [eax]
mov dword [ebp - 0xf8], ecx
mov esi, dword [ebp - 0xf8]
push 0
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp esi, dword [eax]
jg 0x1003cd37
mov dword [ebp - 0x66c], 1
jmp 0x1003cd3e
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x66c], 0x3901
jle 0x1003cd56
mov dword [ebp - 0xad4], 1
jmp 0x1003cd5d
and dword [ebp - 0xad4], 0
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
mov ecx, dword [ebp - 0xad4]
cmp ecx, dword [eax]
jge 0x1003cd80
mov dword [ebp - 0x674], 1
jmp 0x1003cd87
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0
jne 0x1003cd9c
mov dword [ebp - 0x8d4], 1
jmp 0x1003cda3
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jne 0x1003cdd3
push 1
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp dword [eax], 0
jne 0x1003cdd3
and dword [ebp - 0xa04], 0
jmp 0x1003cddd
mov dword [ebp - 0xa04], 1
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xf8], 0
jmp 0x1003ce02
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x1003ce25
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x358]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003ce23
jmp 0x1003ce25
jmp 0x1003cdf5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x358]
call fcn.10023630
mov byte [ebp - 0x234], 0xc
mov byte [ebp - 0x233], 2
mov byte [ebp - 0x232], 7
mov byte [ebp - 0x231], 1
mov byte [ebp - 0x230], 0
mov byte [ebp - 0x22f], 0x31
mov byte [ebp - 0x22e], 5
mov byte [ebp - 0x22d], 0x26
mov byte [ebp - 0x22c], 1
mov byte [ebp - 0x22b], 0x17
mov byte [ebp - 0x22a], 8
mov byte [ebp - 0x229], 0x1d
mov byte [ebp - 0x228], 2
mov byte [ebp - 0x227], 0xa
mov byte [ebp - 0x226], 4
mov byte [ebp - 0x225], 0x11
mov byte [ebp - 0x224], 0xa
mov byte [ebp - 0x223], 0x11
mov byte [ebp - 0x222], 0xd
mov byte [ebp - 0x221], 0x32
mov byte [ebp - 0x220], 3
mov byte [ebp - 0x21f], 0x36
mov byte [ebp - 0x21e], 9
mov byte [ebp - 0x21d], 2
mov byte [ebp - 0x21c], 0xb
mov byte [ebp - 0x21b], 0x10
mov byte [ebp - 0x21a], 6
mov byte [ebp - 0x219], 0x23
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x234]
and eax, 0x71
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x234]
or ecx, 0x71
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x234]
mov byte [ebp + eax - 0xbb8], cl
mov dword [ebp - 0xb4], 0x1d925b0e
mov dword [ebp - 0x15c], 0xffff
mov dword [ebp - 0xc4], 0x1aa12afd
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0xb78], 0xffffffff
mov dword [ebp - 0xb74], 0xffffffff
mov dword [ebp - 0xb70], 0xffffffff
mov dword [ebp - 0xb6c], 0xffffffff
push 4
lea ecx, [ebp - 0xd58]
call fcn.100235ae
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xc24], 0
mov dword [ebp - 0x340], 0
jmp 0x1003cfb8
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 4
jge 0x1003cfda
push dword [ebp - 0x340]
lea ecx, [ebp - 0xd58]
call fcn.1002364c
mov dword [eax], 0x9c82
jmp 0x1003cfab
mov eax, dword [ebp - 0x15c]
inc eax
cmp eax, 0xfffffffb
jne 0x1003cffb
cmp dword [ebp - 0xb4], 0
je 0x1003cffb
mov dword [ebp - 0xd5c], 1
jmp 0x1003d002
and dword [ebp - 0xd5c], 0
push 0xfffffffffffffffc
pop eax
cmp eax, 0xafb5
jg 0x1003d018
mov dword [ebp - 0x684], 1
jmp 0x1003d01f
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x684], eax
jge 0x1003d039
mov dword [ebp - 0xc1c], 1
jmp 0x1003d040
and dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xb4], 0xee1c9741
jne 0x1003d058
mov dword [ebp - 0x8dc], 1
jmp 0x1003d05f
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x8dc], eax
je 0x1003d079
mov dword [ebp - 0x68c], 1
jmp 0x1003d080
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x68c], eax
jne 0x1003d09a
mov dword [ebp - 0xa9c], 1
jmp 0x1003d0a1
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0xb4]
test eax, eax
jne 0x1003d0ca
mov dword [ebp - 0x694], 1
jmp 0x1003d0d1
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x694]
jne 0x1003d0eb
mov dword [ebp - 0x8e4], 1
jmp 0x1003d0f2
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x8e4]
je 0x1003d10c
mov dword [ebp - 0x69c], 1
jmp 0x1003d113
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x69c]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x194], 0
jmp 0x1003d13f
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xa
jl 0x1003d423
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0xac], 0x3164c116
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1020], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
mov dword [ebp - 0x1028], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb78], 0x752bf390
jle 0x1003d2e2
mov dword [ebp - 0xb10], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x60]
jge 0x1003d1c4
mov dword [ebp - 0xa0c], 1
jmp 0x1003d1cb
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xb10]
cmp dword [ebp - 0xa0c], eax
jg 0x1003d1e5
mov dword [ebp - 0x6a4], 1
jmp 0x1003d1ec
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x6a4], eax
jg 0x1003d203
mov dword [ebp - 0x8ec], 1
jmp 0x1003d20a
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x8ec]
cmp eax, 0xce17c927
jb 0x1003d226
mov dword [ebp - 0x6ac], 1
jmp 0x1003d22d
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 6
je 0x1003d242
mov dword [ebp - 0xddc], 1
jmp 0x1003d249
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1038], eax
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0xb10]
mov ebx, dword [ebp - 0xc4]
push 2
lea ecx, [ebp - 0xd58]
call fcn.1002364c
mov eax, dword [eax]
add eax, ebx
add eax, edi
cmp eax, esi
jne 0x1003d284
mov dword [ebp - 0x6b4], 1
jmp 0x1003d28b
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0xb4], eax
jl 0x1003d2a8
mov dword [ebp - 0x8f4], 1
jmp 0x1003d2af
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xac], eax
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1003d2dd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x1003d3f0
mov dword [ebp - 0xac], 0
jmp 0x1003d2fb
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jg 0x1003d3f0
mov dword [ebp - 0x15c], 0
jmp 0x1003d321
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jg 0x1003d3bc
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1003d34b
push 0x1e92
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov dword [ebp - 0x60], 0
jmp 0x1003d35b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jg 0x1003d3b7
mov dword [ebp - 0xc4], 0
jmp 0x1003d37a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x1003d3b5
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xb78], 0x140da8f9
mov dword [ebp - 0xc24], 0x140da8f9
push dword [ebp - 0xac]
lea ecx, [ebp - 0xd58]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003d3b3
jmp 0x1003d36d
jmp 0x1003d36d
jmp 0x1003d354
jmp 0x1003d314
mov eax, dword [ebp - 0xac]
mov esi, dword [ebp + eax*4 - 0xb78]
push dword [ebp - 0xac]
lea ecx, [ebp - 0xd58]
call fcn.1002364c
mov eax, dword [eax]
sub eax, esi
mov ecx, dword [ebp - 0xac]
mov dword [ebp + ecx*4 - 0xb78], eax
jmp 0x1003d2ee
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1003d41e
push 0x44c
push 0x1ab6
push 0x20d3
push 0x20b0
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x1003d132
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd58]
call fcn.10023630
mov dword [ebp - 0x78], 2
and dword [ebp - 0x3b0], 0
jmp 0x1003d44a
mov eax, dword [ebp - 0x78]
inc eax
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1c
jae 0x1003daec
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x71c], 0xfc42ff18
mov dword [ebp - 0x1040], 0x77dcda72
mov dword [ebp - 0xd7c], 0x62c4df8e
mov dword [ebp - 0xa1c], 0x966c4779
mov dword [ebp - 0x1048], 0xfcc8af95
mov dword [ebp - 0x1054], 0xb30477ae
mov dword [ebp - 0x1c8], 0x5b65ab4d
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0xc3c], 0x835a7ab5
mov dword [ebp - 0xdf4], 0xffffffff
mov dword [ebp - 0x6d4], 0
push 2
lea ecx, [ebp - 0xe64]
call fcn.100235ae
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x3f8], 0x997
mov dword [ebp - 0xde4], 0xdc4d
mov dword [ebp - 0x2a4], 0
jmp 0x1003d50d
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1003d52f
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xe64]
call fcn.1002364c
mov dword [eax], 1
jmp 0x1003d500
mov dword [ebp - 0x100], 0
jmp 0x1003d548
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1a
je 0x1003da50
mov dword [ebp - 0xdec], 0x9b37
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0x3a8], 0x28eaf608
mov dword [ebp - 0x184], 0x28c040c8
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x32c], 0
jmp 0x1003d5aa
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x1003d5c6
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xb58], 3
jmp 0x1003d59d
mov eax, dword [ebp - 0x100]
neg eax
cmp eax, dword [ebp - 0x100]
je 0x1003d6df
mov eax, 0x29ac
test eax, eax
je 0x1003d6ae
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
jne 0x1003d60b
cmp dword [ebp - 0xa14], 0x561
jle 0x1003d60b
and dword [ebp - 0x6bc], 0
jmp 0x1003d615
mov dword [ebp - 0x6bc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb58]
cmp dword [ebp - 0x6bc], eax
jle 0x1003d636
mov dword [ebp - 0xd6c], 1
jmp 0x1003d63d
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0x1c8], 1
jne 0x1003d652
mov dword [ebp - 0x6c4], 1
jmp 0x1003d659
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0xa14]
cmp dword [ebp - 0x6c4], eax
je 0x1003d673
mov dword [ebp - 0x8fc], 1
jmp 0x1003d67a
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x3a8]
imul eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x6cc]
cmp eax, dword [ebp - 0x3a8]
jle 0x1003d6ae
mov dword [ebp - 0xaa4], 1
jmp 0x1003d6b5
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 0
jne 0x1003d6d3
cmp dword [ebp - 0xa1c], 0
je 0x1003d6df
mov dword [ebp - 0xc2c], 1
jmp 0x1003d6e6
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x107c], eax
cmp dword [ebp - 0xde4], 0xae88
jg 0x1003d70a
mov dword [ebp - 0x904], 1
jmp 0x1003d711
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x904], eax
je 0x1003d72b
mov dword [ebp - 0x6dc], 1
jmp 0x1003d732
and dword [ebp - 0x6dc], 0
push 1
lea ecx, [ebp - 0xe64]
call fcn.1002364c
mov ecx, dword [ebp - 0x6dc]
cmp ecx, dword [eax]
jl 0x1003d755
mov dword [ebp - 0x6e4], 1
jmp 0x1003d75c
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0xa1c]
cmp dword [ebp - 0x6e4], eax
jl 0x1003d776
mov dword [ebp - 0xc34], 1
jmp 0x1003d77d
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x90c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x90c]
mov dword [ebp + eax - 0xb58], ecx
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xc3c], eax
mov dword [ebp - 0x184], 0
jmp 0x1003d7cd
cmp dword [ebp - 0x184], 0x1d
jne 0x1003da4b
mov dword [ebp - 0xaac], 0xfffffffe
mov dword [ebp - 0x1c8], 0
jmp 0x1003d7fd
cmp dword [ebp - 0x1c8], 0xfffffffb
jg 0x1003da46
jmp 0x1003d53b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe64]
call fcn.10023630
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x3b0]
movzx eax, byte [ebp + eax - 0x236]
movsx eax, byte [ebp + eax - 0xbb8]
mov ecx, dword [ebp - 0x78]
movzx ecx, byte [ebp + ecx - 0x233]
and ecx, eax
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x3b0]
movzx eax, byte [ebp + eax - 0x236]
movsx eax, byte [ebp + eax - 0xbb8]
mov edx, dword [ebp - 0x78]
movzx edx, byte [ebp + edx - 0x233]
and edx, eax
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x3b0]
movzx eax, byte [ebp + eax - 0x236]
movsx eax, byte [ebp + eax - 0xbb8]
mov esi, dword [ebp - 0x78]
movzx ebx, byte [ebp + esi - 0x233]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x78]
movzx eax, byte [ebp + eax - 0x234]
mov byte [ebp + eax - 0xbb8], bl
jmp 0x1003d442
mov dword [ebp - 0xa2c], 6
mov dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f4], 0
jmp 0x1003db25
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xffffffe2
jge 0x1003db58
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x1003db4b
push 0x1978
call dword [sym.imp.GDI32.dll_UpdateColors]
cmp dword [ebp - 0xa2c], 0
je 0x1003db56
jmp 0x1003db18
jmp 0x1003db18
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xbb8], 0
mov dword [ebp - 0x4c], 0x7b1c2a2c
mov dword [ebp - 0xb90], 0xfcf09cc2
mov dword [ebp - 0xb8c], 0xfcf09cc2
mov dword [ebp - 0xb88], 0xfcf09cc2
mov dword [ebp - 0xb84], 0xfcf09cc2
mov dword [ebp - 0x3b8], 0x6f377cc4
mov dword [ebp - 0x304], 0
jmp 0x1003dbb8
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1003dbd4
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1d0], 8
jmp 0x1003dbab
cmp dword [ebp - 0x4c], 0
jne 0x1003dbe8
xor eax, eax
inc eax
jne 0x1003dbe8
and dword [ebp - 0x72c], 0
jmp 0x1003dbf2
mov dword [ebp - 0x72c], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10d8], eax
mov eax, 0x87f6fb80
test eax, eax
jne 0x1003dc1c
cmp dword [ebp - 0x4c], 0
jne 0x1003dc1c
and dword [ebp - 0x724], 0
jmp 0x1003dc26
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x92c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x92c]
mov dword [ebp + eax - 0xb90], ecx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x92c], eax
jle 0x1003dc68
mov dword [ebp - 0xb08], 1
jmp 0x1003dc6f
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0xb08]
jne 0x1003dc91
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb90], 0
je 0x1003ddad
mov dword [ebp - 0xa34], 0x49a2f381
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0xd9c], 0x18b47430
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1003dccb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb90]
mov dword [ebp - 0x10e0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + eax - 0xb90]
je 0x1003dcfc
mov dword [ebp - 0x734], 1
jmp 0x1003dd03
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x734], eax
jle 0x1003dd1d
mov dword [ebp - 0x934], 1
jmp 0x1003dd24
and dword [ebp - 0x934], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
dec eax
mov dword [ebp - 0x73c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x73c]
mov dword [ebp + eax - 0x1d0], ecx
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0x73c]
cmp eax, dword [ebp - 0xa34]
jl 0x1003dd77
mov dword [ebp - 0xc54], 1
jmp 0x1003dd7e
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x10e8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb90]
mov dword [ebp - 0x10f0], eax
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x3b8], eax
jmp 0x1003df14
mov dword [ebp - 0xcc], 0x69e7721c
mov dword [ebp - 0xc5c], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d0], 1
jg 0x1003dddd
mov dword [ebp - 0x744], 1
jmp 0x1003dde4
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xc5c]
cmp dword [ebp - 0x744], eax
jg 0x1003ddfe
mov dword [ebp - 0x93c], 1
jmp 0x1003de05
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0
jl 0x1003de1a
mov dword [ebp - 0x74c], 1
jmp 0x1003de21
and dword [ebp - 0x74c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x74c]
sub ecx, dword [ebp + eax - 0xb90]
je 0x1003de5a
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x1003de55
push 0
push 0xed6
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x1003deee
mov dword [ebp - 0x4c], 0
jmp 0x1003de6a
cmp dword [ebp - 0x4c], 0
jg 0x1003deee
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0x1280]
call fcn.1002c4eb
mov dword [ebp - 0xdfc], eax
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0xc64], eax
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xc64]
call fcn.1002d49e
mov dword [0x107f79d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1280]
call fcn.1002c533
mov dword [ebp - 0x1ec], 0x13b91020
mov dword [ebp - 0x1ec], 0
jmp 0x1003df87
cmp dword [ebp - 0x1ec], 0x13
jg 0x1003dfbb
mov eax, dword [0x107f7884]
cmp eax, dword [ebp - 0x264]
je 0x1003e0b4
mov eax, dword [0x107f79d4]
cmp eax, dword [ebp - 0x264]
jne 0x1003e398
mov dword [ebp - 0x78c], 0x7ce5
push 3
lea ecx, [ebp - 0xf24]
call fcn.100235ae
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1110], 0xffffffff
mov dword [ebp - 0x75c], 7
mov dword [ebp - 0x1d8], 0xfffffffe
mov dword [ebp - 0x774], 0xffffffff
mov dword [ebp - 0xe04], 8
push 3
lea ecx, [ebp - 0xef4]
call fcn.100235ae
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x95c], 5
mov dword [ebp - 0xa3c], 0xf68d270c
mov dword [ebp - 0xaf4], 0
mov dword [ebp - 0xa44], 0
mov dword [ebp - 0x38], 0
jmp 0x1003e14d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1003e169
push dword [ebp - 0x38]
lea ecx, [ebp - 0xf24]
call fcn.1002364c
mov dword [eax], 0xb1943c6f
jmp 0x1003e146
mov dword [ebp - 0x38], 0
jmp 0x1003e179
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1003e195
push dword [ebp - 0x38]
lea ecx, [ebp - 0xef4]
call fcn.1002364c
mov dword [eax], 0x19bd
jmp 0x1003e172
mov dword [ebp - 0x38], 0
jmp 0x1003e1a5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1003e1bb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x11f8], 0xa061fa4
jmp 0x1003e19e
cmp dword [ebp - 0x78c], 0
jne 0x1003e209
push 2
lea ecx, [ebp - 0xef4]
call fcn.1002364c
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov eax, dword [eax]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x3e8]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x3e8]
mov dword [edx], ecx
test eax, eax
jne 0x1003e209
and dword [ebp - 0x764], 0
jmp 0x1003e213
mov dword [ebp - 0x764], 1
push 0
lea ecx, [ebp - 0xf24]
call fcn.1002364c
mov dword [eax], 0xfffffff9
push 0xfffffffffffffff9
pop eax
sub eax, 0xfff9
mov ecx, dword [ebp - 0x95c]
sub ecx, eax
sub ecx, dword [ebp - 0xe04]
mov dword [ebp - 0xa3c], ecx
mov eax, dword [ebp - 0xa3c]
cmp dword [ebp - 0x764], eax
jle 0x1003e25c
mov dword [ebp - 0x94c], 1
jmp 0x1003e263
and dword [ebp - 0x94c], 0
cmp dword [ebp - 0x94c], 0xb844a754
jae 0x1003e27b
mov dword [ebp - 0x76c], 1
jmp 0x1003e282
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0x774]
cmp eax, dword [ebp - 0x774]
jg 0x1003e2b4
mov eax, 0x9856
test eax, eax
jne 0x1003e2b4
and dword [ebp - 0x954], 0
jmp 0x1003e2be
mov dword [ebp - 0x954], 1
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x954], eax
jg 0x1003e2d8
mov dword [ebp - 0x77c], 1
jmp 0x1003e2df
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 1
ja 0x1003e300
mov dword [ebp - 0x784], 1
jmp 0x1003e307
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x95c]
mov ecx, dword [ebp - 0x78c]
imul ecx, eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x11f8], ecx
mov dword [ebp - 0x1d8], 0xfffffffe
jmp 0x1003e342
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x1d
jne 0x1003e362
mov dword [ebp - 0xc6c], 0x6fac5adf
cmp dword [ebp - 0xc6c], 0
je 0x1003e360
jmp 0x1003e362
jmp 0x1003e335
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xef4]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf24]
call fcn.10023630
mov ecx, dword [ebp + 0xc]
call fcn.100232ac
push eax
push dword [ebp + 8]
call fcn.10034dee
pop ecx
pop ecx
jmp 0x10042887
mov dword [ebp - 0x164], 2
mov dword [ebp - 0x108], 0x93dda37b
cmp dword [ebp - 0x164], 0x815cbcef
jae 0x1003e3c4
mov dword [ebp - 0xabc], 1
jmp 0x1003e3cb
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x164]
imul eax, dword [ebp - 0xabc]
imul eax, eax, 0xd130
cmp eax, dword [ebp - 0x164]
jne 0x1003e3f2
mov dword [ebp - 0x794], 1
jmp 0x1003e3f9
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x794], eax
jle 0x1003e413
mov dword [ebp - 0x964], 1
jmp 0x1003e41a
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x964], eax
jge 0x1003e434
mov dword [ebp - 0x79c], 1
jmp 0x1003e43b
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xfff6
jbe 0x1003e45f
mov dword [ebp - 0xa4c], 1
jmp 0x1003e466
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0xa4c], eax
jle 0x1003e536
push 1
lea ecx, [ebp - 0xf6c]
call fcn.100235ae
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x30c], 0
jmp 0x1003e4a5
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x1003e4c7
push dword [ebp - 0x30c]
lea ecx, [ebp - 0xf6c]
call fcn.1002364c
mov dword [eax], 0x56e348cc
jmp 0x1003e498
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x1003e4ea
push 0
push 0xad7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x108], 0
jmp 0x1003e503
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x1003e525
push dword [ebp - 0x108]
lea ecx, [ebp - 0xf6c]
call fcn.1002364c
mov dword [eax], 3
jmp 0x1003e4f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf6c]
call fcn.10023630
jmp 0x1003e550
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1003e550
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
je 0x1004259d
mov eax, dword [ebp - 0x2c4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1004259d
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x2c4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1f0], ecx
push 3
lea ecx, [ebp - 0x364]
call fcn.100235ae
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x1b0], 0x8a1f9496
mov dword [ebp - 0x7a4], 0xe9f48648
mov dword [ebp - 0x97c], 1
mov dword [ebp - 0xdf0], 0xffffffff
mov dword [ebp - 0x334], 0
jmp 0x1003e5e4
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x1003e606
push dword [ebp - 0x334]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov dword [eax], 0x28c1
jmp 0x1003e5d7
mov dword [ebp - 0x1b0], 0
jmp 0x1003e61f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x1003e950
mov dword [ebp - 0x44], 0xb1658084
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1003e651
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x44], 2
jmp 0x1003e661
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1003e94b
mov dword [ebp - 0x68], 0xfffffffb
mov dword [ebp - 0xc74], 0x7c76
mov dword [ebp - 0x68], 2
jmp 0x1003e68c
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1003e946
mov dword [ebp - 0x2cc], 0xfffffff9
push dword [ebp - 0x68]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov eax, dword [eax]
mov dword [esi], eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
imul eax, dword [ebp - 0x2cc]
test eax, eax
jne 0x1003e6fc
cmp dword [ebp - 0x2cc], 0
jne 0x1003e6fc
and dword [ebp - 0x96c], 0
jmp 0x1003e706
mov dword [ebp - 0x96c], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x96c], eax
je 0x1003e71d
mov dword [ebp - 0x7ac], 1
jmp 0x1003e724
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0xf30385d0
jbe 0x1003e73c
mov dword [ebp - 0xb0c], 1
jmp 0x1003e743
and dword [ebp - 0xb0c], 0
push 1
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov ecx, dword [ebp - 0xb0c]
cmp ecx, dword [eax]
jle 0x1003e76f
cmp dword [ebp - 0x2cc], 0
je 0x1003e76f
mov dword [ebp - 0x7b4], 1
jmp 0x1003e776
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x7b4], eax
jge 0x1003e78d
mov dword [ebp - 0x974], 1
jmp 0x1003e794
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x974], eax
je 0x1003e7ae
mov dword [ebp - 0xda8], 1
jmp 0x1003e7b5
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x1118], eax
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xc74]
cmp eax, dword [ebp - 0x1b0]
jle 0x1003e7df
mov dword [ebp - 0x7bc], 1
jmp 0x1003e7e6
and dword [ebp - 0x7bc], 0
mov esi, dword [ebp - 0x68]
sub esi, dword [ebp - 0x7bc]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x364]
call fcn.1002364c
cmp dword [eax], esi
jne 0x1003e80d
mov dword [ebp - 0xa54], 1
jmp 0x1003e814
and dword [ebp - 0xa54], 0
mov esi, dword [ebp - 0xa54]
sub esi, dword [ebp - 0x44]
add esi, dword [ebp - 0x44]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x364]
call fcn.1002364c
cmp esi, dword [eax]
jne 0x1003e83e
mov dword [ebp - 0x7c4], 1
jmp 0x1003e845
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0xdf0]
add eax, 5
jne 0x1003e864
push dword [ebp - 0x44]
lea ecx, [ebp - 0x364]
call fcn.1002364c
push dword [ebp - 0x44]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov esi, eax
push 0
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1003e893
mov dword [ebp - 0x7cc], 1
jmp 0x1003e89a
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x7cc], eax
jne 0x1003e8b4
mov dword [ebp - 0xac4], 1
jmp 0x1003e8bb
and dword [ebp - 0xac4], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x364]
call fcn.1002364c
mov esi, dword [ebp - 0xac4]
sub esi, dword [eax]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x364]
call fcn.1002364c
cmp esi, dword [eax]
jge 0x1003e8ef
mov dword [ebp - 0x430], 1
jmp 0x1003e8f6
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
add eax, 4
cmp eax, 0xd193e05
jl 0x1003e922
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1003e920
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1003e941
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1003e941
push 0
push 0x2113
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x1003e685
jmp 0x1003e65a
jmp 0x1003e612
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x1003e96a
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10023630
mov eax, dword [ebp - 0x1f0]
cmp dword [eax], 0x4550
jne 0x1004259d
mov eax, dword [ebp - 0x1f0]
cmp dword [eax + 0x74], 0
jbe 0x1004259d
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f0]
cmp dword [ecx + eax + 0x78], 0
je 0x1004259d
mov dword [ebp - 0x984], 0x503a
mov dword [ebp - 0xc7c], 0x10008888
cmp dword [ebp - 0x984], 0x52fe
jle 0x1003ea49
and dword [ebp - 0x314], 0
jmp 0x1003e9e8
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x4855
jge 0x1003ea49
and dword [ebp - 0x2d4], 0
jmp 0x1003ea0a
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xf4a
jge 0x1003ea47
mov eax, dword [ebp - 0x314]
add eax, dword [ebp - 0x2d4]
cdq
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xc98], edx
push dword [ebp - 0xc98]
push dword [ebp - 0xc9c]
mov ecx, 0x10616598
call fcn.10023499
jmp 0x1003e9fd
jmp 0x1003e9db
mov dword [ebp - 0x2dc], 0x5c68ec0a
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x984], 0x4f73
jge 0x1003ea76
mov edx, dword [ebp - 0xc7c]
mov ecx, 0x10616598
call fcn.10026d57
jmp 0x1003ea92
or dword [ebp - 4], 0xffffffff
jmp 0x1003ea9c
push 2
lea ecx, [ebp - 0x10bc]
call fcn.100235ae
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x34c], 0
jmp 0x1003eac9
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x1003eaeb
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x10bc]
call fcn.1002364c
mov dword [eax], 0x1ad386cc
jmp 0x1003eabc
mov dword [ebp - 0x2dc], 0
jmp 0x1003eb04
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x17
je 0x1003eb7d
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x7dc], 0x6c74aa0d
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1003eb47
push 0x1b47
push 0
push 0
push 0x1ec2
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov dword [ebp - 0x31c], 1
jmp 0x1003eb60
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jl 0x1003eb78
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
jmp 0x1003eb53
jmp 0x1003eaf7
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1003eb9e
push 0x2488
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10bc]
call fcn.10023630
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0xa74], 0xfc42ff18
mov dword [ebp - 0x1120], 0x77dcda72
mov dword [ebp - 0xdb8], 0x62c4df8e
mov dword [ebp - 0x804], 0x966c4779
mov dword [ebp - 0x1128], 0xfcc8af95
mov dword [ebp - 0x1130], 0xb30477ae
mov dword [ebp - 0x1b4], 0x5b65ab4d
mov dword [ebp - 0x1138], 0
mov dword [ebp - 0xca0], 0x835a7ab5
mov dword [ebp - 0xcbc], 0xffffffff
mov dword [ebp - 0x994], 0
push 2
lea ecx, [ebp - 0xe70]
call fcn.100235ae
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x3c0], 0x997
mov dword [ebp - 0xe3c], 0xdc4d
mov dword [ebp - 0x2e4], 0
jmp 0x1003ec6f
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x1003ec91
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xe70]
call fcn.1002364c
mov dword [eax], 1
jmp 0x1003ec62
mov dword [ebp - 0x110], 0
jmp 0x1003ecaa
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x1a
je 0x1003f349
mov dword [ebp - 0xcac], 0x9b37
mov dword [ebp - 0xb04], 0
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x408], 0x28eaf608
mov dword [ebp - 0x1a4], 0x28c040c8
mov dword [ebp - 0xa80], 0
mov dword [ebp - 0x33c], 0
jmp 0x1003ed0c
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x1003ed28
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0xb80], 3
jmp 0x1003ecff
mov eax, dword [ebp - 0x110]
neg eax
cmp eax, dword [ebp - 0x110]
je 0x1003ee41
mov eax, 0x29ac
test eax, eax
je 0x1003ee10
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
jne 0x1003ed6d
cmp dword [ebp - 0x7e4], 0x561
jle 0x1003ed6d
and dword [ebp - 0xa5c], 0
jmp 0x1003ed77
mov dword [ebp - 0xa5c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0xa5c], eax
jle 0x1003ed98
mov dword [ebp - 0xdb0], 1
jmp 0x1003ed9f
and dword [ebp - 0xdb0], 0
cmp dword [ebp - 0x1b4], 1
jne 0x1003edb4
mov dword [ebp - 0x98c], 1
jmp 0x1003edbb
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x7e4]
cmp dword [ebp - 0x98c], eax
je 0x1003edd5
mov dword [ebp - 0x7ec], 1
jmp 0x1003eddc
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x408]
imul eax, dword [ebp - 0x7ec]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x110]
imul eax, dword [ebp - 0xb04]
cmp eax, dword [ebp - 0x408]
jle 0x1003ee10
mov dword [ebp - 0x7f4], 1
jmp 0x1003ee17
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 0
jne 0x1003ee35
cmp dword [ebp - 0x804], 0
je 0x1003ee41
mov dword [ebp - 0xc88], 1
jmp 0x1003ee48
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x110c], eax
cmp dword [ebp - 0xe3c], 0xae88
jg 0x1003ee6c
mov dword [ebp - 0x7fc], 1
jmp 0x1003ee73
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x7fc], eax
je 0x1003ee8d
mov dword [ebp - 0xa64], 1
jmp 0x1003ee94
and dword [ebp - 0xa64], 0
push 1
lea ecx, [ebp - 0xe70]
call fcn.1002364c
mov ecx, dword [ebp - 0xa64]
cmp ecx, dword [eax]
jl 0x1003eeb7
mov dword [ebp - 0x99c], 1
jmp 0x1003eebe
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0x99c], eax
jl 0x1003eed8
mov dword [ebp - 0xc94], 1
jmp 0x1003eedf
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0x80c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80c]
mov dword [ebp + eax - 0xb80], ecx
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0x844], 0x1cea
mov dword [ebp - 0xdc8], 0x100088d8
cmp dword [ebp - 0x844], 0x1f41
jle 0x1003f065
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
and dword [ebp - 0x2f4], 0
jmp 0x1003ef5c
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x23b4
jge 0x1003f054
and dword [ebp - 0x348], 0
jmp 0x1003ef82
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x5bca
jge 0x1003f04f
and dword [ebp - 0x2ec], 0
jmp 0x1003efa8
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x43ca
jge 0x1003f04a
and dword [ebp - 0x238], 0
jmp 0x1003efce
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x6af0
jge 0x1003f045
mov ecx, dword [ebp - 0x2ec]
add ecx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x2f4]
cdq
idiv dword [ebp - 0x348]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xca4], edx
push dword [ebp - 0xca4]
push dword [ebp - 0xca8]
lea ecx, [ebp - 0x1268]
call fcn.1000a5d5
pop ecx
pop ecx
mov dword [ebp - 0xdf8], eax
mov ecx, dword [ebp - 0xdf8]
call fcn.100232ac
push eax
call fcn.10056e26
pop ecx
lea ecx, [ebp - 0x1268]
call fcn.100232a2
jmp 0x1003efc1
jmp 0x1003ef9b
jmp 0x1003ef75
jmp 0x1003ef4f
push 0
push 0
push 0
push 0x8a5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x1a4], 0
jmp 0x1003f07e
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x1d
jne 0x1003f2fc
mov dword [ebp - 0x834], 0xfffffffe
mov dword [ebp - 0x1b4], 0
jmp 0x1003f0ae
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffffb
jg 0x1003f2f7
mov dword [ebp - 0xa6c], 0x5672
push 2
lea ecx, [ebp - 0xf3c]
call fcn.100235ae
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x29c], 0
jmp 0x1003f0ef
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1003f111
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xf3c]
call fcn.1002364c
mov dword [eax], 0x865e429b
jmp 0x1003f0e2
cmp dword [ebp - 0xcac], 1
jb 0x1003f126
mov dword [ebp - 0x824], 1
jmp 0x1003f12d
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xfac], eax
cmp dword [ebp - 0xa80], 0
jne 0x1003f15a
mov dword [ebp - 0x814], 1
jmp 0x1003f161
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x814], eax
jne 0x1003f17b
mov dword [ebp - 0x9a4], 1
jmp 0x1003f182
and dword [ebp - 0x9a4], 0
cmp dword [ebp - 0x9a4], 1
ja 0x1003f197
mov dword [ebp - 0x81c], 1
jmp 0x1003f19e
and dword [ebp - 0x81c], 0
push 0
lea ecx, [ebp - 0xf3c]
call fcn.1002364c
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov eax, dword [eax]
sub eax, dword [ebp - 0x81c]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0x378]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x378]
mov dword [ecx], eax
mov eax, dword [ebp - 0xdc0]
cmp eax, dword [ebp - 0xcb4]
jl 0x1003f1fc
mov dword [ebp - 0x9ac], 1
jmp 0x1003f203
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x824]
cmp eax, dword [ebp - 0x9ac]
jle 0x1003f21d
mov dword [ebp - 0x82c], 1
jmp 0x1003f224
and dword [ebp - 0x82c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0x82c], eax
jg 0x1003f245
mov dword [ebp - 0xa88], 1
jmp 0x1003f24c
and dword [ebp - 0xa88], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0xa88], eax
jge 0x1003f26d
mov dword [ebp - 0xe24], 1
jmp 0x1003f274
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x9b4], eax
push 1
lea ecx, [ebp - 0xe70]
call fcn.1002364c
mov ecx, dword [ebp - 0x9b4]
mov dword [eax], ecx
cmp dword [ebp - 0x9b4], 1
jle 0x1003f2b6
mov dword [ebp - 0x83c], 1
jmp 0x1003f2bd
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xa74], eax
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1003f2e3
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xf3c]
call fcn.10023630
jmp 0x1003f0a1
jmp 0x1003f071
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x844], 0x1a0f
jge 0x1003f318
push dword [ebp - 0xdc8]
call fcn.10056e26
pop ecx
jmp 0x1003f334
mov dword [ebp - 4], 0x1c
jmp 0x1003f344
jmp 0x1003ec9d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.10023630
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x198]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x7c], 0xffffffff
cmp dword [ebp - 0x7c], 0
je 0x1003f3a0
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1003f39b
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x1003f5bb
mov dword [ebp - 0x37c], 0xffffffff
push 1
lea ecx, [ebp - 0xea0]
call fcn.100235ae
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xccc], 0xdfc1f7b4
mov dword [ebp - 0x2a0], 0
jmp 0x1003f3e1
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1003f403
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xea0]
call fcn.1002364c
mov dword [eax], 6
jmp 0x1003f3d4
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x113c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1098], eax
cmp dword [ebp - 0x37c], 0
je 0x1003f43c
mov eax, 0x1e0c863c
test eax, eax
je 0x1003f43c
mov dword [ebp - 0x9bc], 1
jmp 0x1003f443
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x9bc]
jge 0x1003f45a
mov dword [ebp - 0x84c], 1
jmp 0x1003f461
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
shl eax, 3
test eax, eax
je 0x1003f480
mov eax, 0x737e0d1b
test eax, eax
je 0x1003f480
and dword [ebp - 0xa90], 0
jmp 0x1003f48a
mov dword [ebp - 0xa90], 1
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0xa90], eax
jl 0x1003f4a4
mov dword [ebp - 0xcc4], 1
jmp 0x1003f4ab
and dword [ebp - 0xcc4], 0
or eax, 0xffffffff
cmp eax, 1
jae 0x1003f4bf
mov dword [ebp - 0x854], 1
jmp 0x1003f4c6
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x854], eax
jle 0x1003f4dd
mov dword [ebp - 0x9c4], 1
jmp 0x1003f4e4
and dword [ebp - 0x9c4], 0
imul eax, dword [ebp - 0x9c4], 0
cmp eax, dword [ebp - 0x7c]
jl 0x1003f4fc
mov dword [ebp - 0x85c], 1
jmp 0x1003f503
and dword [ebp - 0x85c], 0
push 0
lea ecx, [ebp - 0xea0]
call fcn.1002364c
mov ecx, dword [ebp - 0x85c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x37c]
jge 0x1003f52f
mov dword [ebp - 0xa7c], 1
jmp 0x1003f536
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xa7c]
sub eax, 9
jne 0x1003f551
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1003f551
and dword [ebp - 0x864], 0
jmp 0x1003f55b
mov dword [ebp - 0x864], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x864], eax
je 0x1003f572
mov dword [ebp - 0x9cc], 1
jmp 0x1003f579
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x9cc], eax
je 0x1003f590
mov dword [ebp - 0xe00], 1
jmp 0x1003f597
and dword [ebp - 0xe00], 0
push 0
lea ecx, [ebp - 0xea0]
call fcn.1002364c
mov eax, dword [eax]
mov dword [ebp - 0xccc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea0]
call fcn.10023630
mov eax, 0xffff
mov word [ebp - 0x98], ax
push 1
lea ecx, [ebp - 0x414]
call fcn.100235ae
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x74], 0xf845d811
mov dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0xdd8], 0x1a659e80
mov dword [ebp - 0x2a8], 0
jmp 0x1003f60f
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x1003f631
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov dword [eax], 0x1928c176
jmp 0x1003f602
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov dword [eax], 0xfffffff2
jmp 0x1003f66a
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x86c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
cmp dword [eax], 0xffffffe5
jle 0x1003fc0a
mov dword [ebp - 0x16c], 0x4822b165
mov dword [ebp - 0x1c4], 6
push 2
lea ecx, [ebp - 0xb9c]
call fcn.100235ae
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x620], 0xfffffff8
mov dword [ebp - 0xa4], 0
jmp 0x1003f6c8
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1003f6e4
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xf30], 0x4edc0223
jmp 0x1003f6bb
mov dword [ebp - 0xa4], 0
jmp 0x1003f6fd
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1003f71f
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xb9c]
call fcn.1002364c
mov dword [eax], 0x385d06f6
jmp 0x1003f6f0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x1003f75e
mov dword [ebp - 0xdd0], 0xffffffff
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov eax, dword [eax]
mov dword [ebp - 0xdd0], eax
jmp 0x1003fbe4
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x384], 1
mov dword [ebp - 0xf7c], 0x5731
mov dword [ebp - 0xf78], 0x5731
mov dword [ebp - 0xf74], 0x5731
mov dword [ebp - 0xf70], 0x5731
mov dword [ebp - 0xcdc], 0x4c8a
mov dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x1bc]
jle 0x1003f7c2
mov dword [ebp - 0xa98], 1
jmp 0x1003f7c9
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xfbc], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
jge 0x1003f7e6
mov dword [ebp - 0xcd4], 1
jmp 0x1003f7ed
and dword [ebp - 0xcd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf30]
mov dword [ebp - 0x1104], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x58]
jge 0x1003f81a
mov dword [ebp - 0x874], 1
jmp 0x1003f821
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0xa98]
cmp eax, dword [ebp - 0x874]
je 0x1003f83b
mov dword [ebp - 0x9d4], 1
jmp 0x1003f842
and dword [ebp - 0x9d4], 0
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x74]
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov eax, dword [eax]
imul eax, dword [ebp - 0x9d4]
imul eax, edi
cmp eax, esi
jl 0x1003f871
mov dword [ebp - 0x87c], 1
jmp 0x1003f878
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x87c], eax
jl 0x1003f88f
mov dword [ebp - 0xe34], 1
jmp 0x1003f896
and dword [ebp - 0xe34], 0
push 0
lea ecx, [ebp - 0xb9c]
call fcn.1002364c
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0x58], 0
je 0x1003f8c4
cmp dword [ebp - 0x58], 0
je 0x1003f8c4
mov dword [ebp - 0xaa0], 1
jmp 0x1003f8cb
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0x74], eax
mov esi, dword [ebp - 0x74]
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
cmp esi, dword [eax]
jge 0x1003f8f1
cmp dword [ebp - 0x1bc], 0
jne 0x1003f902
or eax, 0xffffffff
jne 0x1003f902
mov dword [ebp - 0x884], 1
jmp 0x1003f909
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
sub eax, 5
je 0x1003f967
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1003f93d
push 0xae9
push 0xce6
push 0
push 0x179
call dword [sym.imp.USER32.dll_CreateCaret]
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1003f965
push 0
push 0
push 0x2092
push 0x8a0
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x1003f99e
mov dword [ebp - 0x16c], 0
jmp 0x1003f980
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x34
jg 0x1003f99e
push 0
lea ecx, [ebp - 0xb9c]
call fcn.1002364c
mov dword [eax], 0x3b1067dc
jmp 0x1003f973
imul eax, dword [ebp - 0x74], 0x792d
test eax, eax
je 0x1003f9be
mov eax, 0x161dbfa2
test eax, eax
je 0x1003f9be
mov dword [ebp - 0x9dc], 1
jmp 0x1003f9c5
and dword [ebp - 0x9dc], 0
push 0
lea ecx, [ebp - 0xb9c]
call fcn.1002364c
mov ecx, dword [ebp - 0x9dc]
cmp ecx, dword [eax]
jg 0x1003f9e8
mov dword [ebp - 0x88c], 1
jmp 0x1003f9ef
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
cmp eax, dword [ebp - 0x58]
jne 0x1003fa12
mov dword [ebp - 0xacc], 1
jmp 0x1003fa19
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0xacc], eax
jle 0x1003fa33
mov dword [ebp - 0x894], 1
jmp 0x1003fa3a
and dword [ebp - 0x894], 0
cmp dword [ebp - 0x894], 7
jbe 0x1003fa4f
mov dword [ebp - 0x9e4], 1
jmp 0x1003fa56
and dword [ebp - 0x9e4], 0
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov ecx, dword [ebp - 0x9e4]
add ecx, dword [eax]
cmp ecx, 0x9f33
jge 0x1003fa7f
mov dword [ebp - 0x604], 1
jmp 0x1003fa86
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0
jle 0x1003faad
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
cmp dword [eax], 0
je 0x1003faad
mov dword [ebp - 0x608], 1
jmp 0x1003fab4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x608], eax
je 0x1003facb
mov dword [ebp - 0x610], 1
jmp 0x1003fad2
and dword [ebp - 0x610], 0
imul eax, dword [ebp - 0x610], 0xfabe
test eax, eax
jne 0x1003faef
cmp dword [ebp - 0x58], 0
jne 0x1003faef
and dword [ebp - 0x618], 0
jmp 0x1003faf9
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x620], 0
jg 0x1003fb17
mov dword [ebp - 0x628], 1
jmp 0x1003fb1e
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 7
jbe 0x1003fb51
cmp dword [ebp - 0x384], 0
jne 0x1003fb51
and dword [ebp - 0x630], 0
jmp 0x1003fb5b
mov dword [ebp - 0x630], 1
cmp dword [ebp - 0x630], 0xfd6ffbba
jae 0x1003fb73
mov dword [ebp - 0x638], 1
jmp 0x1003fb7a
and dword [ebp - 0x638], 0
imul esi, dword [ebp - 0x638], 0xd905
push 0
lea ecx, [ebp - 0xb9c]
call fcn.1002364c
mov dword [eax], esi
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf7c]
mov dword [ebp - 0x10a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf30]
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xfd4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf30]
mov dword [ebp - 0xdd8], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.1002364c
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xb9c]
call fcn.10023630
jmp 0x1003f646
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10023630
or dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x18c], 3
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x394], 0
mov dword [ebp - 0xcfc], 1
mov dword [ebp - 0x2b0], 0
jmp 0x1003fc68
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1003fc84
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x370], 1
jmp 0x1003fc5b
mov dword [ebp - 0x2c], 0
jmp 0x1003fc94
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1003ffa5
push 3
lea ecx, [ebp - 0xd68]
call fcn.100235ae
mov dword [ebp - 4], 0x23
mov dword [ebp - 0xe08], 0x9bdd
mov dword [ebp - 0xcec], 0xbd55adb5
mov dword [ebp - 0x2b8], 0
jmp 0x1003fcdf
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x1003fd01
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xd68]
call fcn.1002364c
mov dword [eax], 0x4ba8b35e
jmp 0x1003fcd2
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x370], 0
je 0x1003fdf4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x370], 1
jl 0x1003fd2b
mov dword [ebp - 0x640], 1
jmp 0x1003fd32
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 0xe3edfa83
jne 0x1003fd4a
mov dword [ebp - 0x648], 1
jmp 0x1003fd51
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x370]
cmp eax, dword [ebp - 0x648]
jl 0x1003fd6f
mov dword [ebp - 0x650], 1
jmp 0x1003fd76
and dword [ebp - 0x650], 0
mov eax, 0x1867b8f5
sub eax, dword [ebp - 0x650]
jne 0x1003fd8f
mov dword [ebp - 0x658], 1
jmp 0x1003fd96
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x18c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18c]
sub edx, dword [ebp + ecx*4 - 0x370]
add edx, 0x4c40
cmp edx, dword [ebp + eax - 0x370]
jl 0x1003fdd3
mov dword [ebp - 0x660], 1
jmp 0x1003fdda
and dword [ebp - 0x660], 0
push 2
lea ecx, [ebp - 0xd68]
call fcn.1002364c
mov ecx, dword [ebp - 0x660]
mov dword [eax], ecx
jmp 0x1003ff91
mov dword [ebp - 0x38c], 0x1932e3ca
mov dword [ebp - 0x668], 0xffffffff
mov dword [ebp - 0x678], 0xe67b38eb
mov dword [ebp - 0xce4], 0x9ba5b042
mov dword [ebp - 0xde0], 0x63832542
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x370], 0
jne 0x1003fe8d
push 1
lea ecx, [ebp - 0xd68]
call fcn.1002364c
mov dword [ebp - 0x668], 0xfffffffd
cmp dword [ebp - 0x668], 0
jne 0x1003fe5f
mov dword [ebp - 0x670], 1
jmp 0x1003fe66
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 0
je 0x1003fe84
cmp dword [ebp - 0xce4], 1
jne 0x1003fe8d
and dword [ebp - 0x680], 0
jmp 0x1003fe97
mov dword [ebp - 0x680], 1
cmp dword [ebp - 0x680], 0xfff8
ja 0x1003feaf
mov dword [ebp - 0x688], 1
jmp 0x1003feb6
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x688]
jge 0x1003fed0
mov dword [ebp - 0x690], 1
jmp 0x1003fed7
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xffff
jne 0x1003feef
mov dword [ebp - 0x698], 1
jmp 0x1003fef6
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
sub eax, dword [ebp - 0x38c]
jne 0x1003ff19
mov eax, 0x11ecbfcf
test eax, eax
je 0x1003ff19
mov dword [ebp - 0x6a0], 1
jmp 0x1003ff20
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0xe08]
cmp dword [ebp - 0x6a0], eax
jl 0x1003ff3a
mov dword [ebp - 0x6a8], 1
jmp 0x1003ff41
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xcec]
cmp dword [ebp - 0x6a8], eax
jg 0x1003ff5b
mov dword [ebp - 0x6b0], 1
jmp 0x1003ff62
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x38c]
add eax, dword [ebp - 0x6b0]
mov dword [ebp - 0xde0], eax
cmp dword [ebp - 0x174], 0
je 0x1003ff91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.10023630
jmp 0x1003fc8d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.10023630
jmp 0x1003fc8d
cmp dword [ebp - 0x174], 0
je 0x1003ffda
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0x394]
je 0x1003ffda
mov dword [ebp - 0x6b8], 1
jmp 0x1003ffe1
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0x2c]
jne 0x1003fffb
mov dword [ebp - 0x6c0], 1
jmp 0x10040002
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6c0], eax
je 0x10040011
cmp dword [ebp - 0x2c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp + eax - 0x370]
xor eax, eax
imul eax, eax, 9
cmp eax, dword [ebp - 0x174]
jl 0x10040039
mov dword [ebp - 0xcf4], 1
jmp 0x10040040
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x10b0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
je 0x1004006e
mov dword [ebp - 0x6c8], 1
jmp 0x10040075
and dword [ebp - 0x6c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
cmp eax, dword [ebp - 0x6c8]
jne 0x10040096
mov dword [ebp - 0x6d0], 1
jmp 0x1004009d
and dword [ebp - 0x6d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x174]
imul ecx, dword [ebp - 0x6d0]
cmp ecx, dword [ebp + eax - 0x370]
jne 0x100400cb
cmp dword [ebp - 0x18c], 0
jne 0x100400cb
and dword [ebp - 0xe2c], 0
jmp 0x100400d5
mov dword [ebp - 0xe2c], 1
imul eax, dword [ebp - 0x18c], 0xfff8
cmp eax, 0x438e2136
jne 0x100400fb
cmp dword [ebp - 0x174], 0
je 0x100400fb
mov dword [ebp - 0x6d8], 1
jmp 0x10040102
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0x4c0dd78f
jne 0x1004011a
mov dword [ebp - 0x6e0], 1
jmp 0x10040121
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x6e0], eax
jne 0x1004013b
mov dword [ebp - 0x6e8], 1
jmp 0x10040142
and dword [ebp - 0x6e8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x394]
imul ecx, dword [ebp - 0x6e8]
cmp ecx, dword [ebp + eax - 0x370]
jl 0x10040169
mov dword [ebp - 0x6f0], 1
jmp 0x10040170
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp + 0x10], 0
jbe 0x100401a0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1004019b
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x10041606
push 2
lea ecx, [ebp - 0xd78]
call fcn.100235ae
mov dword [ebp - 4], 0x24
mov dword [ebp - 0xa8], 0
jmp 0x100401cd
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x100401e9
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1220], 0x6a53d06c
jmp 0x100401c0
mov dword [ebp - 0xa8], 0
jmp 0x10040202
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10040224
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xd78]
call fcn.1002364c
mov dword [eax], 1
jmp 0x100401f5
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10040247
push 0
push 0x75e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 1
lea ecx, [ebp - 0xd78]
call fcn.1002364c
and dword [eax], 0
jmp 0x1004027d
push 1
lea ecx, [ebp - 0xd78]
call fcn.1002364c
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6f8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xd78]
call fcn.1002364c
cmp dword [eax], 1
jg 0x1004030c
mov dword [ebp - 0x1cc], 0xfffffff8
cmp dword [ebp - 0x1cc], 0
je 0x100402a4
jmp 0x1004030c
mov dword [ebp - 0x1cc], 0
jmp 0x100402bd
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x10040307
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x10040305
push 0x1183
push 0
push 0x13e1
push 0x83d
push 0x19f1
push 0
push 0x51e
push 0x2375
push 0x2458
call dword [sym.imp.USER32.dll_DrawIconEx]
jmp 0x100402b0
jmp 0x10040259
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd78]
call fcn.10023630
mov eax, dword [0x107f79b0]
and eax, 1
jne 0x10040352
mov eax, dword [0x107f79b0]
or eax, 1
mov dword [0x107f79b0], eax
mov dword [ebp - 4], 0x25
mov ecx, 0x107f79b4
call fcn.10043b0e
push 0x1006f732
call fcn.10056dfc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x154], 5
mov dword [ebp - 0xda0], 0xffffffff
mov dword [ebp - 0x154], 0xf
jmp 0x1004037f
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffff1
jg 0x100408dc
push 3
lea ecx, [ebp - 0xb2c]
call fcn.100235ae
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x94], 4
push 4
lea ecx, [ebp - 0xe7c]
call fcn.100235ae
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x740], 1
mov dword [ebp - 0x90], 0
jmp 0x100403de
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10040400
push dword [ebp - 0x90]
lea ecx, [ebp - 0xb2c]
call fcn.1002364c
mov dword [eax], 4
jmp 0x100403d1
mov dword [ebp - 0x90], 0
jmp 0x10040419
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10040438
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe7c]
call fcn.1002364c
or dword [eax], 0xffffffff
jmp 0x1004040c
mov dword [ebp - 0x94], 2
jmp 0x10040451
cmp dword [ebp - 0x94], 0
jl 0x1004089f
mov dword [ebp - 0xde8], 0x21f8
cmp dword [ebp - 0xde8], 0x6ac
jge 0x1004064d
lea eax, [ebp - 0x39c]
push eax
push 0x100077c8
call fcn.10056c0b
pop ecx
pop ecx
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0xd04], 0
je 0x1004064d
lea eax, [ebp - 0x2c8]
push eax
push 0x100077c8
call fcn.10056c0b
pop ecx
pop ecx
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xba8]
call fcn.10043be9
mov byte [ebp - 4], 0x28
and dword [ebp - 0x2c0], 0
jmp 0x100404ef
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x2c8]
jge 0x1004051d
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0xba8]
call fcn.1002364c
push eax
push 0x100077c8
call fcn.10056c0b
pop ecx
pop ecx
jmp 0x100404e2
and dword [ebp - 0x17c], 0
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x19c], eax
jmp 0x10040547
cmp dword [ebp - 0x19c], 0
jl 0x100405e9
push 1
lea ecx, [ebp - 0xd88]
call fcn.100235ae
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x2d8], 0
jmp 0x10040677
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x10040699
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xd88]
call fcn.1002364c
mov dword [eax], 0xd0e72ee7
jmp 0x1004066a
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb2c]
call fcn.1002364c
cmp dword [eax], 1
jle 0x100406bb
mov dword [ebp - 0x710], 1
jmp 0x100406c2
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0x710]
neg eax
mov dword [ebp - 0x718], eax
push 0
lea ecx, [ebp - 0xe7c]
call fcn.1002364c
mov ecx, dword [ebp - 0x718]
mov dword [eax], ecx
cmp dword [ebp - 0x718], 0xff8cd3be
jae 0x10040704
mov dword [ebp - 0x720], 1
jmp 0x1004070b
and dword [ebp - 0x720], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb2c]
call fcn.1002364c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x720]
jne 0x10040732
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x100408b9
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xe7c]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb2c]
call fcn.10023630
jmp 0x10040372
movzx eax, byte [0x107f7891]
test eax, eax
je 0x10040948
mov ecx, 0x107f79b4
call fcn.10043bc5
movzx eax, al
test eax, eax
jne 0x10040948
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x760]
push eax
mov ecx, 0x107f79b4
call fcn.10043bce
lea eax, [ebp - 0x10c4]
push eax
mov ecx, 0x107f79b4
call fcn.10023709
push eax
lea ecx, [ebp - 0x760]
call fcn.10043aa8
movzx eax, al
test eax, eax
je 0x10040948
lea ecx, [ebp - 0x760]
call fcn.10043be3
mov eax, dword [eax + 4]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x158], 0x2bd7b1c2
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x778], 1
mov dword [ebp - 0x780], 0xab5457d6
mov dword [ebp - 0x790], 7
push 1
lea ecx, [ebp - 0xf60]
call fcn.100235ae
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x23c], 0
jmp 0x100409b1
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x100409d3
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xf60]
call fcn.1002364c
mov dword [eax], 5
jmp 0x100409a4
cmp dword [ebp - 0x158], 0
jne 0x10040a97
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x158]
jle 0x100409fa
mov dword [ebp - 0x768], 1
jmp 0x10040a01
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x770]
imul eax, dword [ebp - 0x778]
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x10c0], eax
mov eax, 0xf048
test eax, eax
je 0x10040a6e
cmp dword [ebp - 0x244], 0
je 0x10040a6e
mov dword [ebp - 0xd0c], 1
jmp 0x10040a75
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x244]
add eax, 0x5d0c7e83
jne 0x10040a97
and dword [ebp - 0x788], 0
jmp 0x10040aa1
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0x788]
neg eax
mov dword [ebp - 0x790], eax
mov esi, dword [ebp - 0x790]
push 0
lea ecx, [ebp - 0xf60]
call fcn.1002364c
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf60]
call fcn.10023630
cmp dword [ebp - 0x180], 0xffffffff
jne 0x10041606
mov ecx, 0x107f79b4
call fcn.10043c63
mov ecx, dword [ebp - 0xdc]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x107f79b4
call fcn.10043c67
mov dword [ebp - 0x1d4], 0x4e064826
mov dword [ebp - 0x7a0], 0xf2887cf2
push 1
lea ecx, [ebp - 0xf18]
call fcn.100235ae
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x24c], 0
jmp 0x10040b3f
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x10040b61
push dword [ebp - 0x24c]
lea ecx, [ebp - 0xf18]
call fcn.1002364c
mov dword [eax], 0x9ed9ba07
jmp 0x10040b32
mov dword [ebp - 0x1d4], 0x19
jmp 0x10040b7a
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffff3
jle 0x10040c0a
mov dword [ebp - 0x798], 5
mov dword [ebp - 0xf9c], 1
mov dword [ebp - 0xf98], 1
mov dword [ebp - 0xf94], 1
mov dword [ebp - 0xf90], 1
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x7a8], eax
push 0
lea ecx, [ebp - 0xf18]
call fcn.1002364c
mov ecx, dword [ebp - 0x7a8]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp + eax - 0xf9c], ecx
jmp 0x10040b6d
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10040c29
push 0x32e
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf18]
call fcn.10023630
and dword [ebp - 0x168], 0
jmp 0x10040c4e
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x168]
cmp ecx, dword [eax + 0x18]
jae 0x10041606
mov dword [ebp - 0x20], 0xe0648261
mov dword [ebp - 0x3b4], 0x1cb6
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x10041627
cmp dword [ebp - 0x20], 6
jge 0x10041771
mov dword [ebp - 0x5c], 0x925b0e44
mov dword [ebp - 0x170], 0x9ee1
mov dword [ebp - 0x5c], 0
jmp 0x10041652
cmp dword [ebp - 0x5c], 0xfffffff3
je 0x1004171d
push 4
lea ecx, [ebp - 0xf00]
call fcn.100235ae
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x26c], 0
jmp 0x10041689
cmp dword [ebp - 0x26c], 4
jge 0x100416ab
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xf00]
call fcn.1002364c
mov dword [eax], 0x37a5
jmp 0x1004167c
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x5c]
jl 0x100416cf
mov dword [ebp - 0x170], 0xfffffff2
jmp 0x10041736
cmp dword [ebp - 0x170], 0xffffffef
jle 0x1004176c
mov dword [ebp - 0x5c], 0
jmp 0x1004174f
jmp 0x10041620
cmp dword [ebp - 0x20], 0
je 0x10041888
mov dword [ebp - 0x20], 0xffffffee
jmp 0x1004178b
cmp dword [ebp - 0x20], 0xffffffe6
jg 0x1004185f
push 2
lea ecx, [ebp - 0xf54]
call fcn.100235ae
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x1e8], 0xccd2466e
mov dword [ebp - 0x274], 0
jmp 0x100417cc
cmp dword [ebp - 0x274], 2
jge 0x100417ee
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x10041883
push 0x1dec
push 0xe43
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x10041a6c
mov dword [ebp - 0x178], 1
mov dword [ebp - 0x3b4], 0x4709ba87
cmp dword [ebp - 0x3b4], 0
je 0x100418b2
cmp dword [ebp - 0x178], 0
je 0x100419c1
cmp dword [ebp - 0x178], 1
ja 0x100418c7
mov dword [ebp - 0x49c], 1
jmp 0x100418ce
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x49c], eax
jle 0x100418e8
mov dword [ebp - 0x4a4], 1
jmp 0x100418ef
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0
jge 0x10041904
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x3b4]
imul eax, dword [ebp - 0x4dc]
cmp eax, 0xbc75
jle 0x100419ee
cmp dword [ebp - 0x20], 0
je 0x100419ee
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xffff
je 0x10041a0d
mov dword [ebp - 0x130], 0xbac64a68
mov dword [ebp - 0x1024], 1
mov dword [ebp - 0xc50], 7
mov dword [ebp - 0x130], 0
jmp 0x100425d4
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jl 0x10042868
mov dword [ebp - 0x1fc], 0xb51dba33
mov dword [ebp - 0xc30], 0x9ecf
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0x1134], 0
mov dword [ebp - 0x1fc], 0xffffffe7
jmp 0x10042622
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x10042863
mov dword [ebp - 0x1a0], 0xc4ab274b
mov dword [ebp - 0xc40], 8
mov dword [ebp - 0xc48], 0xfffa
push 2
lea ecx, [ebp - 0xe88]
call fcn.100235ae
mov dword [ebp - 4], 0x37
mov dword [ebp - 0xc58], 0xcbadbefc
mov dword [ebp - 0x294], 0
jmp 0x10042684
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x100426a6
push dword [ebp - 0x294]
lea ecx, [ebp - 0xe88]
call fcn.1002364c
mov dword [eax], 1
jmp 0x10042677
mov dword [ebp - 0x1a0], 0
jmp 0x100426bf
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffffb
jge 0x1004284f
mov dword [ebp - 0x5ec], 0
cmp dword [ebp - 0xc30], 0xfffb
jne 0x100426f2
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x100426f2
and dword [ebp - 0x5dc], 0
jmp 0x100426fc
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x130], 0
jne 0x1004271c
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x1a0]
jg 0x1004271c
and dword [ebp - 0x5bc], 0
jmp 0x10042726
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x5bc]
shl eax, 2
cmp eax, 0x4f9dbc9b
jg 0x10042742
mov dword [ebp - 0x5c4], 1
jmp 0x10042749
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xfff8
jae 0x10042761
mov dword [ebp - 0xc38], 1
jmp 0x10042768
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0x1fc]
jl 0x1004278e
mov dword [ebp - 0x5cc], 1
jmp 0x10042795
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
sub eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xc48]
jl 0x100427c4
push 1
lea ecx, [ebp - 0xe88]
call fcn.1002364c
cmp dword [eax], 0
jne 0x100427c4
and dword [ebp - 0x5d4], 0
jmp 0x100427ce
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0x5e4]
cmp eax, 1
jle 0x10042800
cmp dword [ebp - 0x1a0], 0
je 0x10042800
mov dword [ebp - 0x5f4], 1
jmp 0x10042807
and dword [ebp - 0x5f4], 0
mov esi, dword [ebp - 0x5ec]
imul esi, dword [ebp - 0x5f4]
push 1
lea ecx, [ebp - 0xe88]
call fcn.1002364c
cmp esi, dword [eax]
jle 0x1004283e
mov dword [ebp - 0x5fc], 9
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
jmp 0x1004284a
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0xc58], eax
jmp 0x100426b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe88]
call fcn.10023630
jmp 0x10042615
jmp 0x100425c7
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x10042885
push 0x8de
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret