Function at 0x10035b44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072e3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
push edi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10035ba0
lea eax, [ebp + 8]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
movzx eax, byte [eax]
test eax, eax
je 0x10035b8c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10035b9b
push 0
push 0x1806
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x10036b45
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x17c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
movzx eax, byte [eax]
test eax, eax
je 0x10036b26
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x60], eax
push 3
lea ecx, [ebp - 0x190]
call fcn.10010e51
and dword [ebp - 4], 0
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x128], 0x457a23a
mov dword [ebp - 0x28], 0
jmp 0x10035bfe
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10035c17
push dword [ebp - 0x28]
lea ecx, [ebp - 0x190]
call fcn.10010f08
or dword [eax], 0xffffffff
jmp 0x10035bf7
mov dword [ebp - 0x28], 0
jmp 0x10035c27
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10035c3d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1c4], 0xefc16765
jmp 0x10035c20
mov byte [ebp - 0x30], 0
push 1
push 1
push 0x2585
push 0x4ab5
lea eax, [ebp - 0x30]
push eax
call fcn.100326da
add esp, 0x14
mov dword [ebp - 0x34], 0
jmp 0x10035c6b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10035d51
mov dword [ebp - 0x7c], 1
push 1
push 0x18c1
push 1
lea eax, [ebp - 0x190]
push eax
push 1
push 0x7454
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.100327a3
add esp, 0x20
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc]
mov dword [ebp + eax - 0x1c4], ecx
cmp dword [ebp - 0xcc], 0
jne 0x10035ce1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c4], 0
jne 0x10035ce1
and dword [ebp - 0x124], 0
jmp 0x10035ceb
mov dword [ebp - 0x124], 1
push 2
lea ecx, [ebp - 0x190]
call fcn.10010f08
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x204], eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x190]
call fcn.10010f08
mov ecx, 0xe994
imul ecx, ecx, 0x9d9e
cmp dword [eax], ecx
jne 0x10035d39
mov dword [ebp - 0x11c], 1
jmp 0x10035d40
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
jmp 0x10035c64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190]
call fcn.10010e8d
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x6c], 0
jmp 0x10035d8c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10035d9f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x24], 0xfffffff8
jmp 0x10035d85
mov dword [ebp - 0x3c], 5
jmp 0x10035daf
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x16
jle 0x1003603f
mov dword [ebp - 0x10], 0x3c69aed2
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x84], 0xfffffff6
mov dword [ebp - 0x16c], 9
mov dword [ebp - 0x10], 0
jmp 0x10035dee
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x10035fa3
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x70], 0
jmp 0x10035e0f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x10035e25
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1ac], 0xdf8e3bf1
jmp 0x10035e08
mov dword [ebp - 0x20], 0
jmp 0x10035e35
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x10035f53
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x20], 0xe80d68f9
jbe 0x10035e77
mov dword [ebp - 0xac], 1
jmp 0x10035e7e
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x24]
cmp dword [ebp - 0xac], eax
je 0x10035e99
mov dword [ebp - 0xb0], 1
jmp 0x10035ea0
and dword [ebp - 0xb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
add eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x10]
add eax, dword [ebp + ecx*4 - 0x24]
je 0x10035ecf
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x24], 0
je 0x10035ecf
mov dword [ebp - 0xf0], 1
jmp 0x10035ed6
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x24]
cmp dword [ebp - 0xf0], eax
je 0x10035ef1
mov dword [ebp - 0x1a4], 1
jmp 0x10035ef8
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
jle 0x10035f1e
mov eax, 0x2ff1
test eax, eax
je 0x10035f1e
mov dword [ebp - 0xb8], 1
jmp 0x10035f25
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 7
jb 0x10035f3a
mov dword [ebp - 0x110], 1
jmp 0x10035f41
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x24], ecx
jmp 0x10035e2e
mov dword [ebp - 0x20], 0
jmp 0x10035f63
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10035f9e
mov eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [ebp + ecx - 0x1ac], eax
push 0x112b
lea eax, [ebp - 0x1a0]
push eax
push 1
lea eax, [ebp - 0x84]
push eax
push 1
call fcn.10032dcf
add esp, 0x14
jmp 0x10035f5c
jmp 0x10035de7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0xfffffff9
jl 0x10035fbc
mov dword [ebp - 0xc0], 1
jmp 0x10035fc3
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x10], eax
jg 0x10035fe6
mov dword [ebp - 0xf8], 1
jmp 0x10035fed
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xf8], eax
je 0x10036004
mov dword [ebp - 0xc8], 1
jmp 0x1003600b
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0x6082f4e5
jle 0x10036023
mov dword [ebp - 0x120], 1
jmp 0x1003602a
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x120]
mov dword [ebp - 0x16c], eax
jmp 0x10035da8
and dword [ebp - 0x94], 0
jmp 0x1003605e
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x18]
add eax, 0x28
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x94], eax
jge 0x10036b24
push 4
lea ecx, [ebp - 0x90]
call fcn.10010e51
mov dword [ebp - 4], 1
mov dword [ebp - 0x158], 0x13d3
cmp dword [ebp - 0x158], 0xc2a
jge 0x100360f6
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x14c]
push eax
push 0x1000e148
call fcn.10058fc2
add esp, 0x14
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x160]
jle 0x100360e0
mov dword [ebp - 0xd0], 0x1000deb8
jmp 0x100360ea
mov dword [ebp - 0xd0], 0x1000dec0
push dword [ebp - 0xd0]
call fcn.10059662
pop ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1bc], 0xbdd7
mov dword [ebp - 0x1b8], 0xbdd7
mov dword [ebp - 0x1b4], 0xbdd7
mov dword [ebp - 0x1b0], 0xbdd7
mov dword [ebp - 0x78], 0xc3997b09
push 1
lea ecx, [ebp - 0x148]
call fcn.10010e51
mov byte [ebp - 4], 2
mov dword [ebp - 0x48], 0
jmp 0x1003614d
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10036169
push dword [ebp - 0x48]
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov dword [eax], 0x3342
jmp 0x10036146
lea eax, [ebp - 0x148]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.100356ac
add esp, 0xc
mov dword [ebp - 0x14], 3
jmp 0x1003618e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100361c9
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x100361c7
push 0x3468
push 0
push 1
push 1
push 0x2323
push 0x75ab
push 0x3e38
push 0x70e6
call fcn.1004ef3b
add esp, 0x20
jmp 0x10036187
mov dword [ebp - 0x14], 3
jmp 0x100361d9
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10036600
mov dword [ebp - 0x194], 0x2681
cmp dword [ebp - 0x194], 0xd99
jge 0x10036299
xor eax, eax
inc eax
je 0x10036299
lea eax, [ebp - 0x100]
push eax
push 0x1000ddc0
call fcn.10058fc2
pop ecx
pop ecx
cmp dword [ebp - 0x100], 0
jne 0x10036224
jmp 0x10036299
mov dword [ebp - 0x40], 2
jmp 0x10036234
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
dec eax
cdq
idiv dword [ebp - 0x54]
mov dword [ebp - 0x80], edx
mov byte [ebp - 0x19], 1
cmp dword [ebp - 0x54], 1
jle 0x10036279
cmp dword [ebp - 0x80], 0
jne 0x1003625f
mov byte [ebp - 0x19], 0
jmp 0x10036279
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x80]
lea eax, [ecx + eax - 1]
cdq
idiv dword [ebp - 0x54]
mov dword [ebp - 0x80], edx
jmp 0x1003624d
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x10036292
push dword [ebp - 0x40]
push 0x1000ddd0
call fcn.10057526
pop ecx
pop ecx
jmp 0x10036294
jmp 0x1003622d
jmp 0x100361fd
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x168], 0xfffffffe
push 1
lea ecx, [ebp - 0x90]
call fcn.10010f08
cmp dword [eax], 0x4b0b4ef6
jg 0x100362cb
mov dword [ebp - 0xd8], 1
jmp 0x100362d2
and dword [ebp - 0xd8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd8]
jge 0x10036340
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.10010f08
cmp dword [eax], 1
jge 0x10036319
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1bc], 0
je 0x10036319
mov dword [ebp - 0x118], 1
jmp 0x10036320
and dword [ebp - 0x118], 0
push 1
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [eax]
jge 0x10036340
and dword [ebp - 0xe0], 0
jmp 0x1003634a
mov dword [ebp - 0xe0], 1
cmp dword [ebp - 0xe0], 0
je 0x1003635f
mov dword [ebp - 0x108], 1
jmp 0x10036366
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
inc eax
jne 0x1003638a
push 1
lea ecx, [ebp - 0x90]
call fcn.10010f08
cmp dword [eax], 0
jne 0x1003638a
and dword [ebp - 0xe8], 0
jmp 0x10036394
mov dword [ebp - 0xe8], 1
cmp dword [ebp - 0xe8], 0x7dcd
jne 0x100363ac
mov dword [ebp - 0xa8], 1
jmp 0x100363b3
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x8f8f
jle 0x100363d1
mov dword [ebp - 0xa4], 1
jmp 0x100363d8
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x214], eax
xor eax, eax
neg eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x2c], 0
jmp 0x10036404
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x100365fb
push 2
lea ecx, [ebp - 0x1d0]
call fcn.10010e51
mov byte [ebp - 4], 3
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x10036439
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10036455
push dword [ebp - 0x64]
lea ecx, [ebp - 0x1d0]
call fcn.10010f08
mov dword [eax], 0xfffffffc
jmp 0x10036432
push 0x3be3
push 0x46ab
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.10048d06
add esp, 0x10
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov esi, eax
mov edi, dword [ebp - 0x2c]
push 3
lea ecx, [ebp - 0x90]
call fcn.10010f08
add edi, dword [eax]
cmp dword [esi], edi
jg 0x100364a2
mov dword [ebp - 0xb4], 1
jmp 0x100364a9
and dword [ebp - 0xb4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov ecx, dword [ebp - 0xb4]
imul ecx, dword [eax]
mov dword [ebp - 0xbc], ecx
push 0
lea ecx, [ebp - 0x1d0]
call fcn.10010f08
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1bc]
cmp dword [ebp - 0xbc], eax
jl 0x100364f9
mov dword [ebp - 0xc4], 1
jmp 0x10036500
and dword [ebp - 0xc4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.10010f08
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc4]
jl 0x10036524
mov dword [ebp - 0xa0], 1
jmp 0x1003652b
and dword [ebp - 0xa0], 0
cmp dword [ebp - 0xa0], 0xfffffffc
jne 0x10036540
mov dword [ebp - 0xd4], 1
jmp 0x10036547
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1bc]
cmp eax, dword [ebp - 0xd4]
jge 0x1003656e
mov eax, 0xd1d9
test eax, eax
je 0x1003656e
mov dword [ebp - 0x198], 1
jmp 0x10036575
and dword [ebp - 0x198], 0
push 0
lea ecx, [ebp - 0x148]
call fcn.10010f08
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jle 0x10036595
mov dword [ebp - 0xdc], 1
jmp 0x1003659c
and dword [ebp - 0xdc], 0
push 0
lea ecx, [ebp - 0x148]
call fcn.10010f08
mov esi, dword [ebp - 0xdc]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x148]
call fcn.10010f08
cmp esi, dword [eax]
jg 0x100365ce
mov dword [ebp - 0xe4], 1
jmp 0x100365d5
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x170], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d0]
call fcn.10010e8d
jmp 0x100363fd
jmp 0x100361d2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.10010e8d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10010e8d
mov dword [ebp - 0x1a8], 0xe08974b6
mov dword [ebp - 0x178], 7
mov dword [ebp - 0x58], 0
jmp 0x10036642
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10036658
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x130], 0x477862fd
jmp 0x1003663b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x130], 0
jmp 0x10036686
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x130]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x130], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x130], 0xc
je 0x100366bb
mov byte [ebp - 0x2f], 0
push 0x4b75
lea eax, [ebp - 0x2f]
push eax
push 1
push 1
push 0x56d9
push 0x7c3
call fcn.10033045
add esp, 0x18
jmp 0x1003666b
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xec]
mov dword [ebp + eax - 0x130], ecx
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x100366ff
mov dword [ebp - 0xf4], 1
jmp 0x10036706
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x1003672b
mov dword [ebp - 0xfc], 1
jmp 0x10036732
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x150], eax
push 4
lea ecx, [ebp - 0x1dc]
call fcn.10010e51
mov dword [ebp - 4], 4
push 1
lea ecx, [ebp - 0x13c]
call fcn.10010e51
mov byte [ebp - 4], 5
mov dword [ebp - 0x21c], 0xcb8ce3e6
mov dword [ebp - 0x224], 8
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x1ec], 0x71247adf
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0x1f4], 5
push 0x351b
push 0xfdc
push 0x47cf
push 0x50c4
push 1
lea eax, [ebp - 0x50]
push eax
push 0
push 0x30e1
lea eax, [ebp - 0x1dc]
push eax
call fcn.100331ac
add esp, 0x24
mov dword [ebp - 0x50], 0
jmp 0x100367df
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x100367fb
push dword [ebp - 0x50]
lea ecx, [ebp - 0x13c]
call fcn.10010f08
mov dword [eax], 0x2ba39464
jmp 0x100367d8
push 0
lea ecx, [ebp - 0x13c]
call fcn.10010f08
mov dword [eax], 3
jmp 0x10036834
push 0
lea ecx, [ebp - 0x13c]
call fcn.10010f08
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13c]
call fcn.10010f08
cmp dword [eax], 0
jl 0x100368fe
mov dword [ebp - 0x44], 0x609c
mov dword [ebp - 0x68], 0x1da622a1
mov dword [ebp - 0x1f8], 0x40ed3c15
mov dword [ebp - 0x184], 0x8e92eda8
mov dword [ebp - 0x74], 0
jmp 0x1003687c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10036892
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x22c], 0x12d2c87a
jmp 0x10036875
push 0x5c96
lea eax, [ebp - 0x184]
push eax
push 0
call fcn.1004f902
add esp, 0xc
mov dword [ebp - 0x68], 0
jmp 0x100368b8
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x100368f9
mov dword [ebp - 0x44], 0
jmp 0x100368ce
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x100368f7
push 0x2185
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.1003b2bb
add esp, 0x14
jmp 0x100368c7
jmp 0x100368b1
jmp 0x10036810
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x2e]
push eax
push 0x3bce
push 1
push 0x724
push 0
push 0x4f28
push 0x4272
call fcn.1004ebb4
add esp, 0x1c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x13c]
call fcn.10010e8d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.10010e8d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x1003695d
mov dword [ebp - 0x10c], 1
jmp 0x10036964
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x100369a6
push 0x4000
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x18]
push dword [eax + 8]
push 0x7f7e
push 0x78c9
call fcn.1002a58c
pop ecx
pop ecx
call eax
jmp 0x10036048
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
push 0
call fcn.1004ef18
add esp, 0x18
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x5c], 0
jmp 0x100369e7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100369fd
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1e8], 0xcff0ea75
jmp 0x100369e0
mov dword [ebp - 0x4c], 0
jmp 0x10036a0d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10036a23
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1e8], 1
jmp 0x10036a06
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10036a54
push 0x2de4
push 1
push 0
push 0x6395
push 0x79c
push 0x7a37
push 0x74dd
call fcn.1003a254
add esp, 0x1c
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.1004e5ec
add esp, 0x10
cmp dword [ebp - 0x114], 0
jbe 0x10036b1f
mov dword [ebp - 0x15c], 0x140a
cmp dword [ebp - 0x15c], 0xfca
jge 0x10036af3
lea eax, [ebp - 0x9c]
push eax
push 0x1000de14
call fcn.10058fc2
pop ecx
pop ecx
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
call fcn.1005d390
add eax, 5
adc edx, 0
push edx
push eax
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
call fcn.1005d390
push 0
push 6
push edx
push eax
call fcn.1005d3d0
push edx
push eax
push 0x1000de1c
call fcn.10057526
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x164]
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x18]
push dword [eax + 8]
push 0x7f7e
push 0x8633
call fcn.1002a58c
pop ecx
pop ecx
call eax
jmp 0x10036048
jmp 0x10036b45
push 0x174a
push 0xfdb
push 0x22f9
push 0xfdb
push 0x14db
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret