Function at 0x100400e9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007930d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe34
push esi
push edi
mov dword [ebp - 0x114], 0
push 2
lea ecx, [ebp - 0xbe8]
call fcn.10008dd5
and dword [ebp - 4], 0
mov dword [ebp - 0xae8], 0xfffffffd
mov dword [ebp - 0x848], 0x9637
mov dword [ebp - 0xcbc], 0x2d800f4d
mov dword [ebp - 0xba8], 0x76ac116e
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x268], 0xfffffffe
mov dword [ebp - 0xd68], 0x37ec
push 3
lea ecx, [ebp - 0xa30]
call fcn.10008dd5
mov byte [ebp - 4], 1
mov dword [ebp - 0x2ec], 0x2fc23faa
mov dword [ebp - 0x704], 0xfffffff7
mov dword [ebp - 0x858], 3
mov dword [ebp - 0x24], 0
jmp 0x100401a9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100401c5
push dword [ebp - 0x24]
lea ecx, [ebp - 0xbe8]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
jmp 0x100401a2
mov dword [ebp - 0x24], 0
jmp 0x100401d5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100401eb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbcc], 0x9310c13f
jmp 0x100401ce
mov dword [ebp - 0x24], 0
jmp 0x100401fb
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10040217
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa30]
call fcn.10008e46
mov dword [eax], 8
jmp 0x100401f4
cmp dword [ebp - 0x114], 0
je 0x100402d8
mov dword [ebp - 0x114], 1
jmp 0x1004023d
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x100402d3
mov dword [ebp - 0x1f4], 0x87cf2e56
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x10040293
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x1f4], 0
jmp 0x100402ac
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jg 0x100402ce
mov dword [ebp - 0x420], 0x872d9ee1
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
jmp 0x1004029f
jmp 0x10040230
jmp 0x10040402
mov dword [ebp - 0x8c8], 0xfffffffe
mov dword [ebp - 0xbb0], 1
mov dword [ebp - 0xccc], 0xfffffffa
mov dword [ebp - 0xbb8], 0xb6fd43dd
mov dword [ebp - 0xbd0], 1
mov dword [ebp - 0xbc0], 0x664a1160
mov dword [ebp - 0xbd8], 0x3e623b47
and dword [ebp - 0x9d4], 0
and dword [ebp - 0x9d0], 0
and dword [ebp - 0x9cc], 0
and dword [ebp - 0x9c8], 0
lea ecx, [ebp - 0x2e1]
call fcn.10008e55
push eax
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0xdb0]
call fcn.10008e58
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd90]
call fcn.10008e17
mov dword [ebp - 0xd38], 1
mov dword [ebp - 0xbdc], 0x91f9
mov dword [ebp - 0x6f4], 0xffffffff
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x100403b1
push 0x5eb
push 0x203d
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x8c8], eax
jle 0x100403d8
mov dword [ebp - 0x6ec], 1
jmp 0x100403df
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0xd90]
call fcn.10008e41
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x850], 0xfffffff9
je 0x1004043c
mov dword [ebp - 0x72c], 1
jmp 0x10040443
and dword [ebp - 0x72c], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x114]
cmp dword [ebp - 0x268], eax
jl 0x10040460
mov dword [ebp - 0x6fc], 1
jmp 0x10040467
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
add eax, dword [ebp - 0x268]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xbcc]
jle 0x10040499
mov dword [ebp - 0x70c], 1
jmp 0x100404a0
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x70c]
cmp dword [ebp - 0x72c], eax
jg 0x100404c7
mov eax, 0xb5251bb3
test eax, eax
jne 0x100404c7
and dword [ebp - 0x734], 0
jmp 0x100404d1
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0x734]
add eax, 0xc6ce
cmp eax, 0xffff
je 0x10040501
push 1
lea ecx, [ebp - 0xa30]
call fcn.10008e46
cmp dword [eax], 0
je 0x10040501
mov dword [ebp - 0x73c], 1
jmp 0x10040508
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x858]
cmp dword [ebp - 0x73c], eax
jne 0x10040522
mov dword [ebp - 0x6e4], 1
jmp 0x10040529
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6e4]
mov dword [ebp + eax - 0xbcc], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa30]
call fcn.10008e41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe8]
call fcn.10008e41
mov dword [ebp - 0x120], 0
push 2
lea ecx, [ebp - 0xc08]
call fcn.10008dd5
mov dword [ebp - 4], 2
mov dword [ebp - 0xacc], 0xfffffffd
mov dword [ebp - 0x868], 0x9637
mov dword [ebp - 0xad4], 0x2d800f4d
mov dword [ebp - 0xadc], 0x76ac116e
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x270], 0xfffffffe
mov dword [ebp - 0xae4], 0x37ec
push 3
lea ecx, [ebp - 0xa48]
call fcn.10008dd5
mov byte [ebp - 4], 3
mov dword [ebp - 0x2a8], 0x2fc23faa
mov dword [ebp - 0x30c], 0xfffffff7
mov dword [ebp - 0x878], 3
mov dword [ebp - 0x2c], 0
jmp 0x100405fc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10040618
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc08]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
jmp 0x100405f5
mov dword [ebp - 0x2c], 0
jmp 0x10040628
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004063e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbf8], 0x9310c13f
jmp 0x10040621
mov dword [ebp - 0x2c], 0
jmp 0x1004064e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004066a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa48]
call fcn.10008e46
mov dword [eax], 8
jmp 0x10040647
cmp dword [ebp - 0x120], 0
je 0x1004072b
mov dword [ebp - 0x120], 1
jmp 0x10040690
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x10040726
mov dword [ebp - 0x1e8], 0x87cf2e56
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100406e6
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x1e8], 0
jmp 0x100406ff
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jg 0x10040721
mov dword [ebp - 0x2fc], 0x872d9ee1
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
jmp 0x100406f2
jmp 0x10040683
jmp 0x10040855
mov dword [ebp - 0x860], 0xfffffffe
mov dword [ebp - 0xaec], 1
mov dword [ebp - 0xaf4], 0xfffffffa
mov dword [ebp - 0xafc], 0xb6fd43dd
mov dword [ebp - 0xb04], 1
mov dword [ebp - 0xb0c], 0x664a1160
mov dword [ebp - 0xb14], 0x3e623b47
and dword [ebp - 0x998], 0
and dword [ebp - 0x994], 0
and dword [ebp - 0x990], 0
and dword [ebp - 0x98c], 0
lea ecx, [ebp - 0x2c1]
call fcn.10008e55
push eax
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x998]
push eax
lea ecx, [ebp - 0xdc0]
call fcn.10008e58
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xda8]
call fcn.10008e17
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0xb24], 0x91f9
mov dword [ebp - 0x304], 0xffffffff
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10040804
push 0x5eb
push 0x203d
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x860], eax
jle 0x1004082b
mov dword [ebp - 0x52c], 1
jmp 0x10040832
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0xda8]
call fcn.10008e41
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x870], 0xfffffff9
je 0x1004088f
mov dword [ebp - 0x314], 1
jmp 0x10040896
and dword [ebp - 0x314], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x120]
cmp dword [ebp - 0x270], eax
jl 0x100408b3
mov dword [ebp - 0x6b8], 1
jmp 0x100408ba
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0x270]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xbf8]
jle 0x100408ec
mov dword [ebp - 0x530], 1
jmp 0x100408f3
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x530]
cmp dword [ebp - 0x314], eax
jg 0x1004091a
mov eax, 0xb5251bb3
test eax, eax
jne 0x1004091a
and dword [ebp - 0x638], 0
jmp 0x10040924
mov dword [ebp - 0x638], 1
mov eax, dword [ebp - 0x638]
add eax, 0xc6ce
cmp eax, 0xffff
je 0x10040954
push 1
lea ecx, [ebp - 0xa48]
call fcn.10008e46
cmp dword [eax], 0
je 0x10040954
mov dword [ebp - 0x31c], 1
jmp 0x1004095b
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x878]
cmp dword [ebp - 0x31c], eax
jne 0x10040975
mov dword [ebp - 0x538], 1
jmp 0x1004097c
and dword [ebp - 0x538], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x538]
mov dword [ebp + eax - 0xbf8], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa48]
call fcn.10008e41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.10008e41
push 1
lea ecx, [ebp - 0x8e8]
call fcn.10008dd5
mov dword [ebp - 4], 4
mov dword [ebp - 0x98], 0x53d8da8e
mov dword [ebp - 0x898], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x100409ed
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x10040a0f
push dword [ebp - 0x218]
lea ecx, [ebp - 0x8e8]
call fcn.10008e46
mov dword [eax], 0x5d6c05ba
jmp 0x100409e0
mov dword [ebp - 0x98], 0
jmp 0x10040a28
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x10040ac8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb34], eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x8e8]
call fcn.10008e46
mov ecx, 0x3bd
imul ecx, ecx, 0
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x898]
jl 0x10040a71
mov dword [ebp - 0x324], 1
jmp 0x10040a78
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 5
je 0x10040a94
push 2
pop eax
test eax, eax
je 0x10040a94
mov dword [ebp - 0x8a0], 1
jmp 0x10040a9b
and dword [ebp - 0x8a0], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x8e8]
call fcn.10008e46
mov esi, eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x8e8]
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10040a1b
mov dword [ebp - 0x98], 0x5befa1e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8e8]
call fcn.10008e41
mov dword [ebp - 0x970], 1
mov dword [ebp - 0x96c], 1
mov dword [ebp - 0x968], 1
mov dword [ebp - 0x964], 1
mov dword [ebp - 0xd0], 0x53aa9ac7
mov dword [ebp - 0xd0], 3
jmp 0x10040b2c
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10040b8c
mov dword [ebp - 0x730], 0xcabfc393
mov dword [ebp - 0x730], 5
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp + eax*4 - 0x970]
sub eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0xd0]
jl 0x10040b70
mov dword [ebp - 0x32c], 1
jmp 0x10040b77
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x970], ecx
jmp 0x10040b1f
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x10040bb7
push 0x7f9
push 0x15e1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x128], 0
push 2
lea ecx, [ebp - 0xc28]
call fcn.10008dd5
mov dword [ebp - 4], 5
push 1
lea ecx, [ebp - 0x90c]
call fcn.10008dd5
mov byte [ebp - 4], 6
mov dword [ebp - 0xb3c], 6
mov dword [ebp - 0x198], 0
jmp 0x10040c09
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x10040c2b
push dword [ebp - 0x198]
lea ecx, [ebp - 0x90c]
call fcn.10008e46
mov dword [eax], 0x7a7c2039
jmp 0x10040bfc
push 0
lea ecx, [ebp - 0x90c]
call fcn.10008e46
cmp dword [eax], 0
jne 0x10040c5e
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x10040c59
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x10040d54
mov dword [ebp - 0x118], 0x62e08974
mov dword [ebp - 0x118], 0
jmp 0x10040c81
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x10040d54
mov dword [ebp - 0x1f0], 0
jmp 0x10040ca7
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x10040cc3
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x744], 0x4c000111
jmp 0x10040c9a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x744], 0
jmp 0x10040cf1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x744]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x744], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x744], 0
jg 0x10040d33
push dword [ebp - 0x118]
lea ecx, [ebp - 0x90c]
call fcn.10008e46
cmp dword [eax], 0
je 0x10040d19
jmp 0x10040d33
push dword [ebp - 0x118]
lea ecx, [ebp - 0x90c]
call fcn.10008e46
cmp dword [eax], 0
je 0x10040d31
jmp 0x10040d33
jmp 0x10040cd6
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x10040d4f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10040c74
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x10040d7a
push 0
push 0x2f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x90c]
call fcn.10008e41
mov dword [ebp - 0xb44], 0xfffffffd
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x344], 0x86fa66fa
mov dword [ebp - 0x548], 0xfff8
mov dword [ebp - 0x8c0], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb54], eax
cmp dword [ebp - 0x14], 0
jne 0x10040e60
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10040dec
xor eax, eax
jne 0x10040dec
and dword [ebp - 0x540], 0
jmp 0x10040df6
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x540]
add eax, dword [ebp - 0x14]
je 0x10040e08
cmp dword [ebp - 0x14], 0
xor eax, eax
cmp eax, 0x770
jne 0x10040e20
cmp dword [ebp - 0x14], 0
jne 0x10040e20
and dword [ebp - 0x334], 0
jmp 0x10040e2a
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x334], eax
jle 0x10040e41
mov dword [ebp - 0x8a8], 1
jmp 0x10040e48
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0x14], 0
jne 0x10040e60
and dword [ebp - 0x640], 0
jmp 0x10040e6a
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x640], eax
jne 0x10040e81
mov dword [ebp - 0x8b0], 1
jmp 0x10040e88
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x548]
sub eax, 0xf844
jne 0x10040ebf
mov dword [ebp - 0x33c], 1
jmp 0x10040ec6
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
sub eax, 0x6f83b184
cmp eax, dword [ebp - 0x548]
je 0x10040ee5
mov dword [ebp - 0x6c0], 1
jmp 0x10040eec
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x6c0], eax
jle 0x10040f29
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10040f24
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x100410a5
mov dword [ebp - 0x3c], 0x7bc77562
cmp dword [ebp - 0x3c], 0
je 0x10040f49
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10040f49
mov dword [ebp - 0x34c], 1
jmp 0x10040f50
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0
jmp 0x10040f69
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x20
je 0x100410a5
mov dword [ebp - 0x8d8], 0xdd88ba54
mov dword [ebp - 0x1a0], 0
jmp 0x10040f96
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x10040fb2
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x8d0], 0x9117a540
jmp 0x10040f89
mov dword [ebp - 0x3c], 0
jmp 0x10040fc2
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x10040fd4
mov dword [ebp - 0x8c0], 0xffffffff
jmp 0x10040fbb
mov dword [ebp - 0x3c], 0
jmp 0x10040fe4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x100410a0
mov dword [ebp - 0x774], 0x86397847
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10041012
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb7c], eax
cmp dword [ebp - 0x774], 0
je 0x10041039
mov eax, 0x3245
test eax, eax
je 0x10041039
mov dword [ebp - 0x550], 1
jmp 0x10041040
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x8d0], 0x4ec6f913
mov eax, 0x4ec6f913
add eax, 0xe06dfe53
cmp eax, dword [ebp - 0x550]
jge 0x1004106c
mov dword [ebp - 0x354], 1
jmp 0x10041073
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0
jl 0x10041088
mov dword [ebp - 0x648], 1
jmp 0x1004108f
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x8d8], eax
jmp 0x10040fdd
jmp 0x10040f62
push 2
lea ecx, [ebp - 0x720]
call fcn.10008dd5
mov byte [ebp - 4], 7
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x230], 0
jmp 0x100410ea
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1004110c
push dword [ebp - 0x230]
lea ecx, [ebp - 0x720]
call fcn.10008e46
mov dword [eax], 0xec0a
jmp 0x100410dd
mov dword [ebp - 0x44], 1
jmp 0x1004111c
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10041280
mov dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x840], 0x1b6eab3c
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
mov eax, dword [eax]
dec eax
jne 0x1004117b
mov dword [ebp - 0x35c], 1
jmp 0x10041182
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x35c], eax
jg 0x1004119c
mov dword [ebp - 0x700], 1
jmp 0x100411a3
and dword [ebp - 0x700], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
cmp dword [eax], 6
ja 0x100411c2
mov dword [ebp - 0x558], 1
jmp 0x100411c9
and dword [ebp - 0x558], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
mov ecx, dword [ebp - 0x558]
cmp ecx, dword [eax]
jl 0x100411ed
mov dword [ebp - 0x364], 1
jmp 0x100411f4
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
dec eax
jne 0x1004120d
cmp dword [ebp - 0x2c8], 0
jne 0x1004120d
cmp dword [ebp - 0x2c8], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x720]
call fcn.10008e46
cmp dword [eax], 0x9a7b445a
jne 0x1004122f
mov dword [ebp - 0x36c], 1
jmp 0x10041236
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x560], eax
jle 0x10041268
mov dword [ebp - 0x374], 1
jmp 0x1004126f
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x840], eax
jmp 0x10041115
mov dword [ebp - 0x278], 0xffffffff
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x720]
call fcn.10008e41
mov dword [ebp - 0x8b8], 0x9637
mov dword [ebp - 0x148], 0x75b57fd5
mov dword [ebp - 0x650], 0x49dfcf09
mov dword [ebp - 0x1a8], 0xa5fef9d7
mov dword [ebp - 0x84c], 0xc1b16eb2
mov dword [ebp - 0x148], 0
jmp 0x100412e4
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffec
jle 0x1004149a
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x60], 0
jmp 0x1004130b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10041321
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xa84], 0xffffffff
jmp 0x10041304
mov dword [ebp - 0x60], 0
jmp 0x10041331
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x10041347
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xd50], 0xca955a63
jmp 0x1004132a
mov dword [ebp - 0x650], 0x950ba1bf
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xb84], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd50]
cmp dword [ebp - 0x1a8], eax
jne 0x1004138a
mov dword [ebp - 0x37c], 1
jmp 0x10041391
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x37c]
test eax, eax
jne 0x100413bb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd50], 0
jne 0x100413bb
and dword [ebp - 0x568], 0
jmp 0x100413c5
mov dword [ebp - 0x568], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd50]
cmp dword [ebp - 0x568], eax
jge 0x100413e6
mov dword [ebp - 0x384], 1
jmp 0x100413ed
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xfffffffc
jbe 0x10041402
mov dword [ebp - 0x6c8], 1
jmp 0x10041409
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
sub eax, dword [ebp - 0x7d8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa84]
jl 0x10041430
mov dword [ebp - 0x784], 1
jmp 0x10041437
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xb8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa84]
push 4
pop ecx
imul ecx, ecx, 0
imul ecx, dword [ebp + ecx - 0xa84], 0xf996
imul eax, ecx
mov dword [ebp - 0x84c], eax
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10041495
push 0x25a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x100412d7
mov dword [ebp - 0xb94], 0x2d800f4d
mov dword [ebp - 0xb9c], 0x76ac116e
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x280], 0xfffffffe
mov dword [ebp - 0xba4], 0x37ec
push 3
lea ecx, [ebp - 0xa60]
call fcn.10008dd5
mov byte [ebp - 4], 8
mov dword [ebp - 0x2b0], 0x2fc23faa
mov dword [ebp - 0x39c], 0xfffffff7
mov dword [ebp - 0x854], 3
mov dword [ebp - 0x28], 0
jmp 0x1004150b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10041527
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc28]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
jmp 0x10041504
mov dword [ebp - 0x28], 0
jmp 0x10041537
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1004154d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc18], 0x9310c13f
jmp 0x10041530
mov dword [ebp - 0x28], 0
jmp 0x1004155d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10041579
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa60]
call fcn.10008e46
mov dword [eax], 8
jmp 0x10041556
cmp dword [ebp - 0x128], 0
je 0x1004163a
mov dword [ebp - 0x128], 1
jmp 0x1004159f
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x10041635
mov dword [ebp - 0x1f8], 0x87cf2e56
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x100415f5
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x1f8], 0
jmp 0x1004160e
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jg 0x10041630
mov dword [ebp - 0x38c], 0x872d9ee1
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
jmp 0x10041601
jmp 0x10041592
jmp 0x10041764
mov dword [ebp - 0x78c], 0xfffffffe
mov dword [ebp - 0xbac], 1
mov dword [ebp - 0xbb4], 0xfffffffa
mov dword [ebp - 0xbbc], 0xb6fd43dd
mov dword [ebp - 0xd34], 1
mov dword [ebp - 0xd3c], 0x664a1160
mov dword [ebp - 0xd6c], 0x3e623b47
and dword [ebp - 0x9c0], 0
and dword [ebp - 0x9bc], 0
and dword [ebp - 0x9b8], 0
and dword [ebp - 0x9b4], 0
lea ecx, [ebp - 0x2b1]
call fcn.10008e55
push eax
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x9c0]
push eax
lea ecx, [ebp - 0xdb8]
call fcn.10008e58
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd9c]
call fcn.10008e17
mov dword [ebp - 0xd74], 1
mov dword [ebp - 0xd7c], 0x91f9
mov dword [ebp - 0x394], 0xffffffff
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x10041713
push 0x5eb
push 0x203d
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x78c], eax
jle 0x1004173a
mov dword [ebp - 0x570], 1
jmp 0x10041741
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0xd9c]
call fcn.10008e41
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x794], 0xfffffff9
je 0x1004179e
mov dword [ebp - 0x3a4], 1
jmp 0x100417a5
and dword [ebp - 0x3a4], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x128]
cmp dword [ebp - 0x280], eax
jl 0x100417c2
mov dword [ebp - 0x658], 1
jmp 0x100417c9
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
add eax, dword [ebp - 0x280]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xc18]
jle 0x100417fb
mov dword [ebp - 0x578], 1
jmp 0x10041802
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x578]
cmp dword [ebp - 0x3a4], eax
jg 0x10041829
mov eax, 0xb5251bb3
test eax, eax
jne 0x10041829
and dword [ebp - 0x728], 0
jmp 0x10041833
mov dword [ebp - 0x728], 1
mov eax, dword [ebp - 0x728]
add eax, 0xc6ce
cmp eax, 0xffff
je 0x10041863
push 1
lea ecx, [ebp - 0xa60]
call fcn.10008e46
cmp dword [eax], 0
je 0x10041863
mov dword [ebp - 0x3ac], 1
jmp 0x1004186a
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x854]
cmp dword [ebp - 0x3ac], eax
jne 0x10041884
mov dword [ebp - 0x580], 1
jmp 0x1004188b
and dword [ebp - 0x580], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x580]
mov dword [ebp + eax - 0xc18], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa60]
call fcn.10008e41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.10008e41
mov dword [ebp - 0x3b4], 9
mov dword [ebp - 0x220], 0
jmp 0x100418de
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x100418fa
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xe10], 5
jmp 0x100418d1
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x10041919
push 0x247e
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
push 1
lea ecx, [ebp - 0x91c]
call fcn.10008dd5
mov dword [ebp - 4], 9
mov dword [ebp - 0x88], 0x53d8da8e
mov dword [ebp - 0x79c], 0xffffffff
mov dword [ebp - 0x1b8], 0
jmp 0x10041967
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x10041989
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x91c]
call fcn.10008e46
mov dword [eax], 0x5d6c05ba
jmp 0x1004195a
mov dword [ebp - 0x88], 0
jmp 0x100419a2
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10041a42
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xd54], eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x91c]
call fcn.10008e46
mov ecx, 0x3bd
imul ecx, ecx, 0
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x79c]
jl 0x100419eb
mov dword [ebp - 0x660], 1
jmp 0x100419f2
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 5
je 0x10041a0e
push 2
pop eax
test eax, eax
je 0x10041a0e
mov dword [ebp - 0x8bc], 1
jmp 0x10041a15
and dword [ebp - 0x8bc], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x91c]
call fcn.10008e46
mov esi, eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x91c]
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10041995
mov dword [ebp - 0x88], 0x5befa1e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x91c]
call fcn.10008e41
mov dword [ebp - 0x3bc], 9
mov dword [ebp - 0x200], 0
jmp 0x10041a7e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x10041a9a
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xe20], 5
jmp 0x10041a71
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10041ab9
push 0x247e
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [ebp - 0x3bc]
dec eax
mov dword [ebp - 0x3bc], eax
push 1
lea ecx, [ebp - 0x92c]
call fcn.10008dd5
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x68], 0x53d8da8e
mov dword [ebp - 0x7a4], 0xffffffff
mov dword [ebp - 0x1c0], 0
jmp 0x10041b04
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x10041b26
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x92c]
call fcn.10008e46
mov dword [eax], 0x5d6c05ba
jmp 0x10041af7
mov dword [ebp - 0x68], 0
jmp 0x10041b36
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10041bc7
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xbd4], eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x92c]
call fcn.10008e46
mov ecx, 0x3bd
imul ecx, ecx, 0
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x7a4]
jl 0x10041b76
mov dword [ebp - 0x588], 1
jmp 0x10041b7d
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 5
je 0x10041b99
push 2
pop eax
test eax, eax
je 0x10041b99
mov dword [ebp - 0x85c], 1
jmp 0x10041ba0
and dword [ebp - 0x85c], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x92c]
call fcn.10008e46
mov esi, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x92c]
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10041b2f
mov dword [ebp - 0x68], 0x5befa1e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.10008e41
mov dword [ebp - 0x3c4], 9
mov dword [ebp - 0x238], 0
jmp 0x10041c00
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 4
jge 0x10041c1c
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xe40], 5
jmp 0x10041bf3
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x10041c3b
push 0x247e
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
push 3
lea ecx, [ebp - 0x944]
call fcn.10008dd5
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x168], 0x4d00693e
mov dword [ebp - 0x7ac], 0xc383
mov dword [ebp - 0x2e0], 0xca968364
mov dword [ebp - 0x668], 0xfffffffa
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0x1c8], 0
jmp 0x10041ca7
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x10041cc9
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x944]
call fcn.10008e46
mov dword [eax], 0xceafd94
jmp 0x10041c9a
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x2e0], eax
jge 0x10041cfb
mov dword [ebp - 0x6d0], 1
jmp 0x10041d02
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x6d0], eax
jne 0x10041d1c
mov dword [ebp - 0x3cc], 1
jmp 0x10041d23
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x168], eax
jne 0x10041d49
mov dword [ebp - 0x590], 1
jmp 0x10041d50
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0
jbe 0x10041d65
mov dword [ebp - 0x3d4], 1
jmp 0x10041d6c
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0xad0], eax
push 0
lea ecx, [ebp - 0x944]
call fcn.10008e46
mov dword [eax], 0x85c6
mov eax, 0x85c6
cmp eax, 0x7847
jl 0x10041dc1
push 0
lea ecx, [ebp - 0x944]
call fcn.10008e46
cmp dword [eax], 0
je 0x10041dc1
mov dword [ebp - 0x3dc], 1
jmp 0x10041dc8
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x8fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.10008e41
push 2
lea ecx, [ebp - 0xa78]
call fcn.10008dd5
mov dword [ebp - 4], 0xc
push 4
lea ecx, [ebp - 0x764]
call fcn.10008dd5
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xa8], 0
jmp 0x10041e21
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10041e43
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xa78]
call fcn.10008e46
mov dword [eax], 0xf0ea75c9
jmp 0x10041e14
mov dword [ebp - 0xa8], 0
jmp 0x10041e5c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x10041e7e
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x764]
call fcn.10008e46
mov dword [eax], 0x87df2f4a
jmp 0x10041e4f
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x10041ea0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
lea ecx, [ebp - 0x764]
call fcn.10008e46
and dword [eax], 0
jmp 0x10041ed6
push 0
lea ecx, [ebp - 0x764]
call fcn.10008e46
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x598]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x764]
call fcn.10008e46
cmp dword [eax], 2
jge 0x10041f07
push 0
lea ecx, [ebp - 0x764]
call fcn.10008e46
push dword [eax]
lea ecx, [ebp - 0xa78]
call fcn.10008e46
and dword [eax], 0
jmp 0x10041eb2
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x764]
call fcn.10008e41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.10008e41
push 3
lea ecx, [ebp - 0x950]
call fcn.10008dd5
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x170], 0x4d00693e
mov dword [ebp - 0x7b4], 0xc383
mov dword [ebp - 0x288], 0xca968364
mov dword [ebp - 0x3f4], 0xfffffffa
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x208], 0
jmp 0x10041f84
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x10041fa6
push dword [ebp - 0x208]
lea ecx, [ebp - 0x950]
call fcn.10008e46
mov dword [eax], 0xceafd94
jmp 0x10041f77
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x288], eax
jge 0x10041fd8
mov dword [ebp - 0x3e4], 1
jmp 0x10041fdf
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x3e4], eax
jne 0x10041ff9
mov dword [ebp - 0x708], 1
jmp 0x10042000
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x170], eax
jne 0x10042026
mov dword [ebp - 0x3ec], 1
jmp 0x1004202d
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0
jbe 0x10042042
mov dword [ebp - 0x5a0], 1
jmp 0x10042049
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0xad8], eax
push 0
lea ecx, [ebp - 0x950]
call fcn.10008e46
mov dword [eax], 0x85c6
mov eax, 0x85c6
cmp eax, 0x7847
jl 0x1004209e
push 0
lea ecx, [ebp - 0x950]
call fcn.10008e46
cmp dword [eax], 0
je 0x1004209e
mov dword [ebp - 0x670], 1
jmp 0x100420a5
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x864], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x950]
call fcn.10008e41
push 4
lea ecx, [ebp - 0xc48]
call fcn.10008dd5
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1d0], 0
push 1
lea ecx, [ebp - 0xc38]
call fcn.10008dd5
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x54], 0
jmp 0x100420ff
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10042118
push dword [ebp - 0x54]
lea ecx, [ebp - 0xc48]
call fcn.10008e46
and dword [eax], 0
jmp 0x100420f8
mov dword [ebp - 0x54], 0
jmp 0x10042128
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10042144
push dword [ebp - 0x54]
lea ecx, [ebp - 0xc38]
call fcn.10008e46
mov dword [eax], 0x73d2d672
jmp 0x10042121
mov dword [ebp - 0x1d0], 0
jmp 0x1004215d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jg 0x1004217c
mov dword [ebp - 0x7bc], 0x17be1879
mov dword [ebp - 0x7bc], 1
jmp 0x10042150
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xc38]
call fcn.10008e41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc48]
call fcn.10008e41
push 3
lea ecx, [ebp - 0x938]
call fcn.10008dd5
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x16c], 0x4d00693e
mov dword [ebp - 0x8c4], 0xc383
mov dword [ebp - 0x2b8], 0xca968364
mov dword [ebp - 0x40c], 0xfffffffa
mov dword [ebp - 0x7c4], 1
mov dword [ebp - 0x228], 0
jmp 0x100421f9
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1004221b
push dword [ebp - 0x228]
lea ecx, [ebp - 0x938]
call fcn.10008e46
mov dword [eax], 0xceafd94
jmp 0x100421ec
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x2b8], eax
jge 0x1004224d
mov dword [ebp - 0x3fc], 1
jmp 0x10042254
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x3fc], eax
jne 0x1004226e
mov dword [ebp - 0x5a8], 1
jmp 0x10042275
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x16c], eax
jne 0x1004229b
mov dword [ebp - 0x404], 1
jmp 0x100422a2
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0
jbe 0x100422b7
mov dword [ebp - 0x6d8], 1
jmp 0x100422be
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xae0], eax
push 0
lea ecx, [ebp - 0x938]
call fcn.10008e46
mov dword [eax], 0x85c6
mov eax, 0x85c6
cmp eax, 0x7847
jl 0x10042313
push 0
lea ecx, [ebp - 0x938]
call fcn.10008e46
cmp dword [eax], 0
je 0x10042313
mov dword [ebp - 0x5b0], 1
jmp 0x1004231a
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x7c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.10008e41
movzx eax, byte [0x11eee64c]
test eax, eax
je 0x10042353
mov esi, 0x1066a108
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10046268
push 2
lea ecx, [ebp - 0xa90]
call fcn.10008dd5
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x154], 0x9bdba76a
mov dword [ebp - 0x1d8], 0
jmp 0x1004238a
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x100423ac
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xa90]
call fcn.10008e46
mov dword [eax], 0xfffffff7
jmp 0x1004237d
mov dword [ebp - 0x154], 0
jmp 0x100423c5
cmp dword [ebp - 0x154], 1
jg 0x100423f8
mov dword [ebp - 0x86c], 0xf1d8987
push dword [ebp - 0x154]
lea ecx, [ebp - 0xa90]
call fcn.10008e46
or dword [eax], 0xffffffff
mov dword [ebp - 0x86c], 0xffffffff
jmp 0x100423b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.10008e41
push 2
lea ecx, [ebp - 0xaa8]
call fcn.10008dd5
mov dword [ebp - 4], 0x13
push 4
lea ecx, [ebp - 0x770]
call fcn.10008dd5
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x90], 0
jmp 0x10042445
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret