Function at 0x1003d104
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070f44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x980
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [0x10619504], 0
jne 0x1004084f
mov dword [ebp - 0x188], 0xd4e06482
mov dword [ebp - 0x188], 0xffffffeb
jmp 0x1003d159
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffed
jl 0x1003d1d5
push 1
lea ecx, [ebp - 0x734]
call fcn.10021bd6
and dword [ebp - 4], 0
mov dword [ebp - 0x134], 0
jmp 0x1003d18c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x1003d1ae
push dword [ebp - 0x134]
lea ecx, [ebp - 0x734]
call fcn.10021c54
mov dword [eax], 0x34e6d4f2
jmp 0x1003d17f
push 0
lea ecx, [ebp - 0x734]
call fcn.10021c54
mov dword [eax], 0x25b0e446
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x734]
call fcn.10021c38
jmp 0x1003d14c
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1003d1f1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 4
lea ecx, [ebp - 0x814]
call fcn.10021bd6
mov dword [ebp - 4], 1
mov dword [ebp - 0xe4], 0x22ba3946
mov dword [ebp - 0x190], 0
jmp 0x1003d228
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x1003d24a
push dword [ebp - 0x190]
lea ecx, [ebp - 0x814]
call fcn.10021c54
mov dword [eax], 6
jmp 0x1003d21b
mov dword [ebp - 0xe4], 0
jmp 0x1003d263
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x1003d28e
mov dword [ebp - 0x60c], 1
cmp dword [ebp - 0xe4], 0
je 0x1003d281
jmp 0x1003d28e
cmp dword [ebp - 0x60c], 0
je 0x1003d28c
jmp 0x1003d256
jmp 0x1003d256
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.10021c38
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0xa0], 0xd8339896
push 4
lea ecx, [ebp - 0x260]
call fcn.10021bd6
mov dword [ebp - 4], 2
mov dword [ebp - 0x700], 0xe3202f60
mov dword [ebp - 0x6fc], 0xe3202f60
mov dword [ebp - 0x6f8], 0xe3202f60
mov dword [ebp - 0x6f4], 0xe3202f60
lea ecx, [ebp - 0x209]
call fcn.10021c63
push eax
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x904]
call fcn.10021c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x68c]
call fcn.10021c12
mov byte [ebp - 4], 3
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x40], 0
jmp 0x1003d33d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1003d359
push dword [ebp - 0x40]
lea ecx, [ebp - 0x260]
call fcn.10021c54
mov dword [eax], 0x6709e149
jmp 0x1003d336
mov dword [ebp - 0x40], 0
jmp 0x1003d369
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003d37f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x824], 0x2d78bea
jmp 0x1003d362
mov dword [ebp - 0x28], 0x19
jmp 0x1003d38f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x19
jle 0x1003d5e6
mov dword [ebp - 0x5a4], 0x38e5161e
mov dword [ebp - 0x1fc], 0
jmp 0x1003d3bc
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1003d3d8
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x278], 0xffffffff
jmp 0x1003d3af
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1003d3ea
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x278], 0
jmp 0x1003d415
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x278]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x278], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x278], 0xffffffee
je 0x1003d5e1
mov dword [ebp - 0x518], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x278]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xb5e4
jge 0x1003d45c
mov dword [ebp - 0x2c0], 1
jmp 0x1003d463
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x518]
cmp dword [ebp - 0x2c0], eax
je 0x1003d47d
mov dword [ebp - 0x508], 1
jmp 0x1003d484
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0xe24b
jg 0x1003d49c
mov dword [ebp - 0x510], 1
jmp 0x1003d4a3
and dword [ebp - 0x510], 0
mov eax, 0x373a4c92
sub eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x518]
jne 0x1003d4c2
mov dword [ebp - 0x520], 1
jmp 0x1003d4c9
and dword [ebp - 0x520], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x278]
imul eax, dword [ebp - 0x520]
cmp eax, dword [ebp - 0x28]
je 0x1003d4ee
mov dword [ebp - 0x54c], 1
jmp 0x1003d4f5
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x80335900
jae 0x1003d50d
mov dword [ebp - 0x284], 1
jmp 0x1003d514
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x28]
je 0x1003d52e
mov dword [ebp - 0x500], 1
jmp 0x1003d535
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x500]
add ecx, dword [ebp + eax - 0x278]
je 0x1003d562
mov eax, 0x51f0
test eax, eax
je 0x1003d562
mov dword [ebp - 0x3f4], 1
jmp 0x1003d569
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x3f4], eax
jne 0x1003d58c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x278], 0
jne 0x1003d58c
and dword [ebp - 0x28c], 0
jmp 0x1003d596
mov dword [ebp - 0x28c], 1
imul eax, dword [ebp - 0x28c], 0
cmp eax, dword [ebp - 0x28]
jne 0x1003d5ae
mov dword [ebp - 0x4ac], 1
jmp 0x1003d5b5
and dword [ebp - 0x4ac], 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
mov ecx, dword [ebp - 0x4ac]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x278]
mov dword [ebp - 0x5a4], eax
jmp 0x1003d3fc
jmp 0x1003d388
mov dword [ebp - 0xa0], 0
jmp 0x1003d5ff
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x12
jl 0x1003d916
mov dword [ebp - 0xa8], 0xa9711f64
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x238], 0xfffffffd
mov dword [ebp - 0x664], 0x5b60aa07
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xa0]
jg 0x1003d654
mov dword [ebp - 0x294], 1
jmp 0x1003d65b
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x294]
cmp dword [ebp - 0x28], eax
je 0x1003d67f
mov dword [ebp - 0x3fc], 1
jmp 0x1003d686
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
neg eax
mov dword [ebp - 0x29c], eax
push 2
lea ecx, [ebp - 0x68c]
call fcn.10021c54
mov ecx, dword [ebp - 0x29c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x29c], eax
jle 0x1003d6c3
mov dword [ebp - 0x544], 1
jmp 0x1003d6ca
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x544], eax
jne 0x1003d6e4
mov dword [ebp - 0x644], 1
jmp 0x1003d6eb
and dword [ebp - 0x644], 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
push 2
lea ecx, [ebp - 0x260]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003d71f
cmp dword [ebp - 0xd4], 0
je 0x1003d71f
mov dword [ebp - 0x64c], 1
jmp 0x1003d726
and dword [ebp - 0x64c], 0
push 0
lea ecx, [ebp - 0x260]
call fcn.10021c54
mov eax, 0x642ee1e3
test eax, eax
je 0x1003d751
cmp dword [ebp - 0x654], 0
je 0x1003d751
mov dword [ebp - 0x2a4], 1
jmp 0x1003d758
and dword [ebp - 0x2a4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x824], ecx
mov esi, dword [ebp - 0xa8]
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
sub esi, dword [eax]
test esi, esi
jle 0x1003d78f
mov dword [ebp - 0x404], 1
jmp 0x1003d796
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0
jne 0x1003d7af
push 2
pop eax
test eax, eax
jne 0x1003d7af
and dword [ebp - 0x2ac], 0
jmp 0x1003d7b9
mov dword [ebp - 0x2ac], 1
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x2ac], eax
jl 0x1003d7d3
mov dword [ebp - 0x4b4], 1
jmp 0x1003d7da
and dword [ebp - 0x4b4], 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
mov eax, dword [eax]
imul eax, dword [ebp - 0x4b4]
test eax, eax
je 0x1003d801
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
push 1
lea ecx, [ebp - 0x260]
call fcn.10021c54
mov esi, eax
push 2
lea ecx, [ebp - 0x68c]
call fcn.10021c54
mov eax, dword [eax]
mov dword [esi], eax
push 2
lea ecx, [ebp - 0x68c]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003d873
cmp dword [ebp - 0xa8], 0x9045
jne 0x1003d84b
mov dword [ebp - 0x2b4], 1
jmp 0x1003d852
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x1003d873
mov dword [ebp - 0x40c], 1
jmp 0x1003d87a
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x40c], eax
jne 0x1003d895
xor eax, eax
jne 0x1003d895
and dword [ebp - 0x65c], 0
jmp 0x1003d89f
mov dword [ebp - 0x65c], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x824]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x87c], eax
push 2
lea ecx, [ebp - 0x68c]
call fcn.10021c54
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x77c], eax
mov eax, 0x4638b1aa
test eax, eax
je 0x1003d8fe
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1003d8fe
mov dword [ebp - 0x2bc], 1
jmp 0x1003d905
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x664], eax
jmp 0x1003d5f2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68c]
call fcn.10021c38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.10021c38
mov byte [ebp - 0x114], 8
mov byte [ebp - 0x113], 0xd8
mov byte [ebp - 0x112], 2
mov byte [ebp - 0x111], 0x5c
mov byte [ebp - 0x110], 1
mov byte [ebp - 0x10f], 0x17
mov byte [ebp - 0x10e], 4
mov byte [ebp - 0x10d], 0
mov byte [ebp - 0x10c], 0
mov byte [ebp - 0x10b], 0x2e
mov byte [ebp - 0x10a], 0xa
mov byte [ebp - 0x109], 0x27
mov byte [ebp - 0x108], 5
mov byte [ebp - 0x107], 0
mov byte [ebp - 0x106], 7
mov byte [ebp - 0x105], 0x5e
mov byte [ebp - 0x104], 6
mov byte [ebp - 0x103], 1
mov byte [ebp - 0x102], 2
mov byte [ebp - 0x101], 0x5d
mov byte [ebp - 0x100], 0x3d
mov byte [ebp - 0xff], 3
mov byte [ebp - 0xfe], 0x5d
mov byte [ebp - 0xfd], 9
mov byte [ebp - 0xfc], 0xa
mov byte [ebp - 0xfb], 0xb
mov byte [ebp - 0xfa], 8
mov dword [ebp - 0x58], 0x60477862
push 3
lea ecx, [ebp - 0x530]
call fcn.10021bd6
mov dword [ebp - 4], 4
mov dword [ebp - 0x54], 0x80fc3a06
mov dword [ebp - 0x14c], 0
jmp 0x1003da2c
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x1003da4e
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x530]
call fcn.10021c54
mov dword [eax], 0x3367f5ed
jmp 0x1003da1f
mov dword [ebp - 0x58], 0x17
jmp 0x1003da5e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x1a
jl 0x1003df64
mov dword [ebp - 0x68], 6
mov dword [ebp - 0x1ac], 0
jmp 0x1003da88
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x1003daa4
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x26c], 0x398070a
jmp 0x1003da7b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x26c], 0xffffffed
jmp 0x1003dad2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c], 0
jl 0x1003dd88
mov dword [ebp - 0x66c], 1
mov dword [ebp - 0x154], 0
jmp 0x1003db09
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x1003db25
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x5a0], 0x1151c3c3
jmp 0x1003dafc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5a0], 2
jmp 0x1003db53
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5a0], 0
jl 0x1003dd83
mov dword [ebp - 0xbc], 0x9f6d4a0d
mov dword [ebp - 0xbc], 0
jmp 0x1003db8a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1003db9c
mov dword [ebp - 0x54], 0x8dc5336d
jmp 0x1003db7d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a0]
mov dword [ebp - 0x780], eax
xor eax, eax
cmp eax, 0xffff
jne 0x1003dbc4
mov dword [ebp - 0x50c], 1
jmp 0x1003dbcb
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x50c], eax
jg 0x1003dbe5
mov dword [ebp - 0x2c4], 1
jmp 0x1003dbec
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x2c4]
cmp eax, 0xeb6652f0
ja 0x1003dc08
mov dword [ebp - 0x414], 1
jmp 0x1003dc0f
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5a0]
lea ecx, [ebp - 0x530]
call fcn.10021c54
mov eax, dword [eax]
cmp eax, dword [ebp - 0x414]
jne 0x1003dc3d
mov dword [ebp - 0x2cc], 1
jmp 0x1003dc44
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
neg eax
cmp eax, 3
jg 0x1003dc5d
mov dword [ebp - 0x4bc], 1
jmp 0x1003dc64
and dword [ebp - 0x4bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a0]
cmp dword [ebp - 0x4bc], eax
jg 0x1003dc85
mov dword [ebp - 0x2d4], 1
jmp 0x1003dc8c
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d4]
neg ecx
cmp ecx, dword [ebp + eax - 0x26c]
jl 0x1003dcaf
mov dword [ebp - 0x41c], 1
jmp 0x1003dcb6
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x5a0]
lea ecx, [ebp - 0x530]
call fcn.10021c54
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jge 0x1003dce4
mov dword [ebp - 0x2dc], 1
jmp 0x1003dceb
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 3
ja 0x1003dd00
mov dword [ebp - 0x550], 1
jmp 0x1003dd07
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x550], eax
jne 0x1003dd21
mov dword [ebp - 0x2e4], 1
jmp 0x1003dd28
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x26c]
cmp dword [ebp - 0x2e4], eax
je 0x1003dd51
cmp dword [ebp - 0x66c], 0
je 0x1003dd51
mov dword [ebp - 0x424], 1
jmp 0x1003dd58
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x68], eax
imul esi, dword [ebp - 0x68], 0xa2e2
sub esi, 7
push 1
lea ecx, [ebp - 0x530]
call fcn.10021c54
imul esi, dword [eax]
mov dword [ebp - 0x54], esi
jmp 0x1003db38
jmp 0x1003dab7
mov eax, 0x21b7
test eax, eax
je 0x1003decf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c], 0
je 0x1003decf
mov dword [ebp - 0x218], 0x81b2
cmp dword [ebp - 0x218], 5
jae 0x1003ddc8
mov dword [ebp - 0x4c4], 1
jmp 0x1003ddcf
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x788], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x26c], 0xffff
jbe 0x1003ddf7
mov dword [ebp - 0x2ec], 1
jmp 0x1003ddfe
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x2ec]
je 0x1003de18
mov dword [ebp - 0x2f4], 1
jmp 0x1003de1f
and dword [ebp - 0x2f4], 0
mov esi, dword [ebp - 0x4c4]
sub esi, dword [ebp - 0x2f4]
push 2
lea ecx, [ebp - 0x530]
call fcn.10021c54
cmp esi, dword [eax]
jne 0x1003de48
mov dword [ebp - 0x42c], 1
jmp 0x1003de4f
and dword [ebp - 0x42c], 0
push 2
lea ecx, [ebp - 0x530]
call fcn.10021c54
mov eax, dword [eax]
cmp eax, dword [ebp - 0x42c]
jge 0x1003de72
mov dword [ebp - 0x674], 1
jmp 0x1003de79
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x218]
jle 0x1003de99
mov dword [ebp - 0x2fc], 1
jmp 0x1003dea0
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
dec eax
jne 0x1003deb7
or eax, 0xffffffff
jne 0x1003deb7
and dword [ebp - 0x514], 0
jmp 0x1003dec1
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x68], eax
jmp 0x1003df5f
mov dword [ebp - 0x68], 0xe
jmp 0x1003dedf
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xfffffff6
jle 0x1003df5f
mov dword [ebp - 0x54], 0
jmp 0x1003def5
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1003df49
mov dword [ebp - 0x1dc], 0xff24264a
mov dword [ebp - 0x1dc], 2
jmp 0x1003df1e
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x1003df47
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1003df45
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x1003df11
jmp 0x1003deee
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x26c], 0xa929efcf
jmp 0x1003ded8
jmp 0x1003da57
cmp dword [ebp - 0x54], 0
je 0x1003df88
push 1
lea ecx, [ebp - 0x530]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003df88
mov dword [ebp - 0x304], 1
jmp 0x1003df8f
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x58], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x530]
call fcn.10021c38
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x114]
and eax, 0xf6
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x114]
or ecx, 0xf6
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x114]
mov word [ebp + eax*2 - 0x774], cx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x15c], 0x8f9ed02e
push 2
lea ecx, [ebp - 0x540]
call fcn.10021bd6
mov dword [ebp - 4], 5
mov dword [ebp - 0x344], 0x624b6749
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x48], 0
jmp 0x1003e02c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1003e042
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xc4], 0x520ea0c8
jmp 0x1003e025
mov dword [ebp - 0x48], 0
jmp 0x1003e052
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1003e06b
push dword [ebp - 0x48]
lea ecx, [ebp - 0x540]
call fcn.10021c54
or dword [eax], 0xffffffff
jmp 0x1003e04b
xor eax, eax
inc eax
je 0x1003e0d9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7ac], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc4], 0
xor eax, eax
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
jge 0x1003e0a3
mov dword [ebp - 0x434], 1
jmp 0x1003e0aa
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
dec eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
dec eax
je 0x1003e0d9
mov dword [ebp - 0x30c], 1
jmp 0x1003e0e0
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30c], eax
jg 0x1003e0f7
mov dword [ebp - 0x4cc], 1
jmp 0x1003e0fe
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
neg eax
jne 0x1003e11a
cmp dword [ebp - 0x15c], 0
jne 0x1003e11a
and dword [ebp - 0x314], 0
jmp 0x1003e124
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x314], eax
jle 0x1003e13b
mov dword [ebp - 0x67c], 1
jmp 0x1003e142
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x43c], eax
push 1
lea ecx, [ebp - 0x540]
call fcn.10021c54
mov ecx, dword [ebp - 0x43c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x43c], eax
jl 0x1003e18a
mov dword [ebp - 0x31c], 1
jmp 0x1003e191
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x31c], eax
jl 0x1003e1a8
mov dword [ebp - 0x558], 1
jmp 0x1003e1af
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x558]
jge 0x1003e1c6
mov dword [ebp - 0x324], 1
jmp 0x1003e1cd
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
sub eax, 0x67d4ca81
sub eax, dword [ebp - 0x344]
mov dword [ebp - 0x18], eax
je 0x1003e40f
mov dword [ebp - 0xec], 0xfffffffe
mov dword [ebp - 0x6c8], 0xa0dc
mov dword [ebp - 0x18], 0
jmp 0x1003e20b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1003e3f2
mov dword [ebp - 0x6ec], 0xe9a03a1b
mov dword [ebp - 0x6e8], 0xe9a03a1b
mov dword [ebp - 0x6e4], 0xe9a03a1b
mov dword [ebp - 0x6e0], 0xe9a03a1b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4], 0xfffffff8
push 0xfffffffffffffff8
pop eax
cmp eax, 0xffffffff
jb 0x1003e25f
mov dword [ebp - 0x444], 1
jmp 0x1003e266
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x1dea
jl 0x1003e27e
mov dword [ebp - 0x32c], 1
jmp 0x1003e285
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0xfff8eeb4
jle 0x1003e2aa
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xc4], 0
je 0x1003e2aa
mov dword [ebp - 0x6cc], 1
jmp 0x1003e2b1
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xc4]
cmp eax, dword [ebp - 0xec]
jg 0x1003e2cf
mov dword [ebp - 0x4d4], 1
jmp 0x1003e2d6
and dword [ebp - 0x4d4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4d4]
imul ecx, dword [ebp + eax - 0x6ec]
mov dword [ebp - 0x334], ecx
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea ecx, [ebp - 0x540]
call fcn.10021c54
mov ecx, dword [ebp - 0x334]
mov dword [eax], ecx
imul eax, dword [ebp - 0x334], 0x4a52
add eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xec]
jg 0x1003e32b
mov dword [ebp - 0x6c0], 1
jmp 0x1003e332
and dword [ebp - 0x6c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6ec]
mov dword [ebp - 0x7c4], eax
mov esi, dword [ebp - 0xec]
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea ecx, [ebp - 0x540]
call fcn.10021c54
cmp dword [eax], esi
je 0x1003e36a
mov dword [ebp - 0x44c], 1
jmp 0x1003e371
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x44c], eax
jne 0x1003e38b
mov dword [ebp - 0x33c], 1
jmp 0x1003e392
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
neg eax
cmp eax, 0x76f0
jl 0x1003e3bf
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea ecx, [ebp - 0x540]
call fcn.10021c54
cmp dword [eax], 0
jne 0x1003e3bf
and dword [ebp - 0x51c], 0
jmp 0x1003e3c9
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea ecx, [ebp - 0x540]
call fcn.10021c54
mov eax, dword [eax]
mov dword [ebp - 0x6c8], eax
jmp 0x1003e204
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1003e40a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x1003e682
push 2
lea ecx, [ebp - 0x578]
call fcn.10021bd6
mov byte [ebp - 4], 6
mov dword [ebp - 0xdc], 0xbb1ca982
mov dword [ebp - 0x35c], 8
mov dword [ebp - 0x55c], 0xb14
mov dword [ebp - 0x658], 0xe9da1234
mov dword [ebp - 0x1b4], 0
jmp 0x1003e461
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1003e483
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x578]
call fcn.10021c54
mov dword [eax], 1
jmp 0x1003e454
xor eax, eax
jne 0x1003e5bb
push 1
lea ecx, [ebp - 0x578]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003e517
cmp dword [ebp - 0x344], 0
jne 0x1003e4b8
mov eax, 0xda102f31
test eax, eax
jne 0x1003e4b8
and dword [ebp - 0x454], 0
jmp 0x1003e4c2
mov dword [ebp - 0x454], 1
push 0
lea ecx, [ebp - 0x578]
call fcn.10021c54
mov eax, dword [eax]
cmp eax, dword [ebp - 0x454]
je 0x1003e4e5
mov dword [ebp - 0x6b4], 1
jmp 0x1003e4ec
and dword [ebp - 0x6b4], 0
push 0
lea ecx, [ebp - 0x578]
call fcn.10021c54
push 0
lea ecx, [ebp - 0x540]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003e517
mov dword [ebp - 0x604], 1
jmp 0x1003e51e
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x18], 0
jne 0x1003e548
push 1
lea ecx, [ebp - 0x578]
call fcn.10021c54
cmp dword [eax], 0
jne 0x1003e548
and dword [ebp - 0x34c], 0
jmp 0x1003e552
mov dword [ebp - 0x34c], 1
push 1
lea ecx, [ebp - 0x578]
call fcn.10021c54
mov eax, dword [eax]
cmp eax, dword [ebp - 0x34c]
jg 0x1003e575
mov dword [ebp - 0x4dc], 1
jmp 0x1003e57c
and dword [ebp - 0x4dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x4dc], eax
jle 0x1003e59d
mov dword [ebp - 0x354], 1
jmp 0x1003e5a4
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x354], eax
jge 0x1003e5bb
and dword [ebp - 0x5b0], 0
jmp 0x1003e5c5
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7d4], eax
mov eax, 0x3f149c99
cmp eax, 3
je 0x1003e5e9
or eax, 0xffffffff
je 0x1003e5e9
mov dword [ebp - 0x45c], 1
jmp 0x1003e5f0
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x30ee
jg 0x1003e620
mov dword [ebp - 0x364], 1
jmp 0x1003e627
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x658], eax
mov dword [ebp - 0xdc], 0
jmp 0x1003e64c
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffff1
je 0x1003e673
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1003e671
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x1003e63f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x578]
call fcn.10021c38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x540]
call fcn.10021c38
mov dword [ebp - 0x20], 2
and dword [ebp - 0x1a4], 0
jmp 0x1003e6a9
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b
jae 0x1003efda
mov dword [ebp - 0x7dc], 1
mov dword [ebp - 0x464], 0xffff
mov dword [ebp - 0x164], 0
jmp 0x1003e6e0
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x1003e6fc
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x91c], 0xfffffffe
jmp 0x1003e6d3
mov eax, dword [ebp - 0x464]
dec eax
mov dword [ebp - 0x464], eax
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1003e725
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x114]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1003ed69
mov dword [ebp - 0x36c], 0x2ddc
mov dword [ebp - 0x6ac], 0x10008cf8
cmp dword [ebp - 0x36c], 0x2e4f
jle 0x1003e86a
and dword [ebp - 0x1f4], 0
jmp 0x1003e77a
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x18e2
jge 0x1003e86a
and dword [ebp - 0x16c], 0
jmp 0x1003e7a0
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x4d4c
jge 0x1003e865
and dword [ebp - 0x1bc], 0
jmp 0x1003e7c6
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x5db4
jge 0x1003e860
and dword [ebp - 0x174], 0
jmp 0x1003e7ec
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x6d36
jge 0x1003e85b
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x1bc]
or eax, dword [ebp - 0x174]
cdq
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], edx
push dword [ebp - 0x614]
push dword [ebp - 0x618]
lea ecx, [ebp - 0x954]
call fcn.1000ab5a
pop ecx
pop ecx
mov dword [ebp - 0x5b8], eax
mov ecx, dword [ebp - 0x5b8]
call fcn.10021680
push eax
call fcn.10057a16
pop ecx
lea ecx, [ebp - 0x954]
call fcn.10021676
jmp 0x1003e7df
jmp 0x1003e7b9
jmp 0x1003e793
jmp 0x1003e76d
mov dword [ebp - 0x1e4], 0
jmp 0x1003e883
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x1003e89f
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x8e4], 0xe2db58e4
jmp 0x1003e876
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1003e8c4
push 0
push 0
push 0x2639
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1003e8e2
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 4], 7
cmp dword [ebp - 0x36c], 0x2c55
jge 0x1003e901
push dword [ebp - 0x6ac]
call fcn.10057a16
pop ecx
jmp 0x1003e91d
or dword [ebp - 4], 0xffffffff
jmp 0x1003e927
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x114]
inc eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1c], 0x4e064826
mov dword [ebp - 0x374], 0xdf37d45d
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x564], 0
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x4e4], 0x6bba
mov dword [ebp - 0x660], 0x10008d6c
cmp dword [ebp - 0x4e4], 0x6ca7
jle 0x1003ea89
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
and dword [ebp - 0x17c], 0
jmp 0x1003e9b8
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x3911
jge 0x1003ea79
and dword [ebp - 0x1c4], 0
jmp 0x1003e9de
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x2135
jge 0x1003ea74
and dword [ebp - 0x184], 0
jmp 0x1003ea04
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x7582
jge 0x1003ea6f
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x184]
cdq
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], edx
push dword [ebp - 0x620]
push dword [ebp - 0x624]
lea ecx, [ebp - 0x93c]
call fcn.1000ab5a
pop ecx
pop ecx
mov dword [ebp - 0x5c0], eax
mov ecx, dword [ebp - 0x5c0]
call fcn.10021680
push eax
call fcn.10057a16
pop ecx
lea ecx, [ebp - 0x93c]
call fcn.10021676
jmp 0x1003e9f7
jmp 0x1003e9d1
jmp 0x1003e9ab
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc0], 0xfff9
mov dword [ebp - 4], 9
cmp dword [ebp - 0x4e4], 0x6a86
jge 0x1003eab2
push dword [ebp - 0x660]
call fcn.10057a16
pop ecx
jmp 0x1003eace
or dword [ebp - 4], 0xffffffff
jmp 0x1003ead8
mov dword [ebp - 0x1c], 0
jmp 0x1003eae8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 9
jl 0x1003eafa
mov dword [ebp - 0x374], 0xfffffffb
jmp 0x1003eae1
mov dword [ebp - 0x1c], 3
jmp 0x1003eb0a
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1003ecb6
mov dword [ebp - 0xf8], 0x2df3d37a
mov dword [ebp - 0x5c8], 0xffffffff
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf8]
inc ecx
mov dword [ebp - 0xf8], ecx
test eax, eax
jne 0x1003ec49
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x56c], 0
jne 0x1003ec18
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x56c]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x56c], 0
je 0x1003ebbf
cmp dword [ebp - 0x374], 0
je 0x1003eba1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x56c], 0
je 0x1003eba1
mov dword [ebp - 0x46c], 1
jmp 0x1003eba8
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
sub eax, 5
je 0x1003ebbf
mov dword [ebp - 0x37c], 1
jmp 0x1003ebc6
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0x7a5e
jle 0x1003ebde
mov dword [ebp - 0x524], 1
jmp 0x1003ebe5
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 3
mov edx, dword [ebp - 0x1c]
mov edx, dword [ebp + edx*4 - 0x56c]
imul edx, dword [ebp - 0x524]
sub edx, dword [ebp + ecx - 0x56c]
cmp edx, dword [ebp + eax*4 - 0x56c]
jge 0x1003ec18
and dword [ebp - 0x384], 0
jmp 0x1003ec22
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp + eax*4 - 0x56c]
jl 0x1003ec49
and dword [ebp - 0x474], 0
jmp 0x1003ec53
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0xc0], 0
jmp 0x1003ec78
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1003ecb1
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1003eca4
push 0
push 0
push 0
push 0x3c9
call dword [sym.imp.GDI32.dll_PolyPolyline]
cmp dword [ebp - 0xf8], 0
je 0x1003ecaf
jmp 0x1003ec6b
jmp 0x1003ec6b
jmp 0x1003eb03
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x114]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xcc], 0x871c
mov dword [ebp - 0x7f4], 0xfffc
mov dword [ebp - 0x204], 0
jmp 0x1003ecf8
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1003ed14
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x8c4], 0xffffffff
jmp 0x1003eceb
mov eax, dword [ebp - 0xcc]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8c4], eax
mov dword [ebp - 0xcc], 0
jmp 0x1003ed3f
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff1
jge 0x1003ed64
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1003ed62
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x1003ed32
jmp 0x1003e6a1
mov dword [ebp - 0x1cc], 1
mov dword [ebp - 0x18c], 0
jmp 0x1003ed8c
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1003eda8
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x7fc], 0x8eac8b13
jmp 0x1003ed7f
mov dword [ebp - 0x1cc], 0
jmp 0x1003edc1
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x1003ee8c
mov dword [ebp - 0x1ec], 5
mov dword [ebp - 0x804], 0x3d4210e1
mov dword [ebp - 0x194], 0
jmp 0x1003edfb
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1003ee17
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x960], 0xe864896
jmp 0x1003edee
mov dword [ebp - 0x1ec], 0
jmp 0x1003ee30
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x1003ee87
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x19c], 0
jmp 0x1003ee5c
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x1003ee78
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x90c], 0x4c90d297
jmp 0x1003ee4f
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
jmp 0x1003ee23
jmp 0x1003edb4
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1003eeab
push 0
push 0x72b
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1a4]
movzx eax, byte [ebp + eax - 0x116]
movzx eax, word [ebp + eax*2 - 0x774]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x113]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1a4]
movzx eax, byte [ebp + eax - 0x116]
movzx eax, word [ebp + eax*2 - 0x774]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x113]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x114]
mov word [ebp + eax*2 - 0x774], dx
push 4
lea ecx, [ebp - 0x740]
call fcn.10021bd6
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x6bc], 2
mov dword [ebp - 0x1d4], 0
jmp 0x1003ef43
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 4
jge 0x1003ef65
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x740]
call fcn.10021c54
mov dword [eax], 0x43b7c7ce
jmp 0x1003ef36
push 1
lea ecx, [ebp - 0x740]
call fcn.10021c54
cmp dword [eax], 0
je 0x1003ef9b
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1003ef99
push 0x21c8
push 0x8b9
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1003efb5
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1003efb5
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x6bc], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x740]
call fcn.10021c38
and dword [ebp - 0x1a4], 0
jmp 0x1003e6a1
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x774], cx
lea eax, [ebp - 0x774]
push eax
lea ecx, [ebp - 0x990]
call fcn.1004af95
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x668], eax
mov dword [ebp - 4], 0xc
push dword [ebp - 0x668]
call fcn.10034fcb
pop ecx
mov dword [ebp - 0x3f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x990]
call fcn.10032dd5
push 3
lea ecx, [ebp - 0x590]
call fcn.10021bd6
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x880], 0xe71cc545
mov dword [ebp - 0x888], 0xfffffff8
mov dword [ebp - 0x890], 0x2fc53d8b
mov dword [ebp - 0x898], 2
mov dword [ebp - 0x8a0], 0x46aa1dd5
mov dword [ebp - 0x8a8], 0x7054f86f
mov dword [ebp - 0x8b0], 0xb7228d0
mov dword [ebp - 0x8b8], 0xc50133ec
push 3
lea ecx, [ebp - 0x834]
call fcn.10021bd6
mov byte [ebp - 4], 0xe
push 1
lea ecx, [ebp - 0x74c]
call fcn.10021bd6
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x14], 0
jmp 0x1003f0cc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003f0e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x794], 0xae355683
jmp 0x1003f0c5
mov dword [ebp - 0x14], 0
jmp 0x1003f0f2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003f10e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x590]
call fcn.10021c54
mov dword [eax], 8
jmp 0x1003f0eb
mov dword [ebp - 0x14], 0
jmp 0x1003f11e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003f13a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x834]
call fcn.10021c54
mov dword [eax], 0x678d5680
jmp 0x1003f117
mov dword [ebp - 0x14], 0
jmp 0x1003f14a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003f166
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74c]
call fcn.10021c54
mov dword [eax], 0x9ffbdd2a
jmp 0x1003f143
push 2
lea ecx, [ebp - 0x590]
call fcn.10021c54
mov dword [eax], 1
jmp 0x1003f19f
push 2
lea ecx, [ebp - 0x590]
call fcn.10021c54
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4ec]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x590]
call fcn.10021c54
cmp dword [eax], 0
jl 0x1003f428
mov dword [ebp - 0x34], 0x11738ab6
mov dword [ebp - 0x554], 0xabac89d7
mov dword [ebp - 0x3b4], 0x711a53fd
mov dword [ebp - 0x894], 0xa6d786ff
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x79c], 0x8a57461d
mov dword [ebp - 0x778], 0xc4142545
mov dword [ebp - 0x818], 0xfffffffe
mov dword [ebp - 0x78c], 5
mov dword [ebp - 0x884], 0xcfb64730
mov dword [ebp - 0x798], 0xfffffff9
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x7a0], 0xc3978d11
mov dword [ebp - 0x8ac], 0x9efecf47
mov dword [ebp - 0x34], 1
jmp 0x1003f24e
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1003f3ff
mov dword [ebp - 0x5d8], 3
mov dword [ebp - 0x6c4], 0x6a1c3d07
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1003f28a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x34], 0xfff8
je 0x1003f29f
mov dword [ebp - 0x394], 1
jmp 0x1003f2a6
and dword [ebp - 0x394], 0
mov esi, dword [ebp - 0x394]
inc esi
push 2
lea ecx, [ebp - 0x590]
call fcn.10021c54
cmp esi, dword [eax]
jl 0x1003f2ca
mov dword [ebp - 0x47c], 1
jmp 0x1003f2d1
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0x15d3e997
jl 0x1003f2e9
mov dword [ebp - 0x39c], 1
jmp 0x1003f2f0
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x39c]
imul eax, eax, 0x62a0
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jg 0x1003f321
mov dword [ebp - 0x3a4], 1
jmp 0x1003f328
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3a4]
je 0x1003f33f
mov dword [ebp - 0x484], 1
jmp 0x1003f346
and dword [ebp - 0x484], 0
push 2
lea ecx, [ebp - 0x590]
call fcn.10021c54
mov eax, dword [eax]
cmp eax, dword [ebp - 0x484]
jg 0x1003f36f
cmp dword [ebp - 0x5d8], 0
jne 0x1003f36f
and dword [ebp - 0x3ac], 0
jmp 0x1003f379
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x3ac], eax
jg 0x1003f396
cmp dword [ebp - 0x3b4], 0
jne 0x1003f396
and dword [ebp - 0x4f4], 0
jmp 0x1003f3a0
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x4f4]
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x794]
sub ecx, eax
cmp ecx, 1
jne 0x1003f3c6
mov dword [ebp - 0x48c], 1
jmp 0x1003f3cd
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x48c], eax
jl 0x1003f3e7
mov dword [ebp - 0x3bc], 1
jmp 0x1003f3ee
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x6c4], eax
jmp 0x1003f247
push 0
lea ecx, [ebp - 0x74c]
call fcn.10021c54
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x534]
mov dword [ecx], eax
jmp 0x1003f17b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x74c]
call fcn.10021c38
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x834]
call fcn.10021c38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x590]
call fcn.10021c38
and dword [ebp - 0x158], 0
jmp 0x1003f46b
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xd
jae 0x1003f883
mov dword [ebp - 0x78], 0x871c7bf0
mov dword [ebp - 0x670], 0x39e22401
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x5e0], 1
mov dword [ebp - 0x140], 0
jmp 0x1003f4b6
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x1003f4d2
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x150], 0x4a6847df
jmp 0x1003f4a9
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1003f4f0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x78], 0
jmp 0x1003f500
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x1003f86e
mov dword [ebp - 0x44], 0x443250e6
mov dword [ebp - 0x7a8], 0xf9dbc9b7
mov dword [ebp - 0x70], 0xf8609561
mov dword [ebp - 0x5e8], 1
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x1003f546
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x1003f857
mov dword [ebp - 0x3c4], 9
mov dword [ebp - 0x838], 0xffffffff
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x244], 0xfffffffc
mov dword [ebp - 0x148], 0
jmp 0x1003f591
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x1003f5ad
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x5f0], 6
jmp 0x1003f584
mov dword [ebp - 0x3c4], 8
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x3c4]
jg 0x1003f5ce
mov dword [ebp - 0x3ec], 1
jmp 0x1003f5d5
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x44]
jne 0x1003f5e9
mov dword [ebp - 0x494], 1
jmp 0x1003f5f0
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x150]
imul eax, dword [ebp - 0x494]
cmp eax, 1
je 0x1003f612
mov dword [ebp - 0x3cc], 1
jmp 0x1003f619
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x3cc], eax
jg 0x1003f630
mov dword [ebp - 0x4fc], 1
jmp 0x1003f637
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x4fc], eax
jl 0x1003f65a
cmp dword [ebp - 0x670], 0
je 0x1003f65a
mov dword [ebp - 0x3d4], 1
jmp 0x1003f661
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x9cba
jge 0x1003f679
mov dword [ebp - 0x49c], 1
jmp 0x1003f680
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x49c], eax
je 0x1003f69a
mov dword [ebp - 0x3dc], 1
jmp 0x1003f6a1
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x265879a2
jg 0x1003f6b9
mov dword [ebp - 0x548], 1
jmp 0x1003f6c0
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x70]
cmp dword [ebp - 0x248], eax
jge 0x1003f6ea
mov dword [ebp - 0x3e4], 1
jmp 0x1003f6f1
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x3e4]
cmp eax, 0xd994
jl 0x1003f70d
mov dword [ebp - 0x4a4], 1
jmp 0x1003f714
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x3ec], eax
jle 0x1003f73a
mov dword [ebp - 0x504], 1
jmp 0x1003f741
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0x3f85
jge 0x1003f759
mov dword [ebp - 0x280], 1
jmp 0x1003f760
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x1003f781
cmp dword [ebp - 0x70], 0
jne 0x1003f793
cmp dword [ebp - 0x5e8], 0
jne 0x1003f793
and dword [ebp - 0x288], 0
jmp 0x1003f79d
mov dword [ebp - 0x288], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x288], eax
jne 0x1003f7be
mov dword [ebp - 0x290], 1
jmp 0x1003f7c5
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 5
je 0x1003f7da
mov dword [ebp - 0x298], 1
jmp 0x1003f7e1
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x298]
jg 0x1003f7f8
mov dword [ebp - 0x6b8], 1
jmp 0x1003f7ff
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x150]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x78]
jne 0x1003f83c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5f0], 0
jne 0x1003f83c
and dword [ebp - 0x2a0], 0
jmp 0x1003f846
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x678], eax
jmp 0x1003f53f
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x150], 0
je 0x1003f869
jmp 0x1003f4f9
jmp 0x1003f4f9
xor eax, eax
mov ecx, dword [ebp - 0x158]
mov word [ebp + ecx*2 - 0x774], ax
jmp 0x1003f45e
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x60], 0xe6aa1654
mov dword [ebp - 0x694], 0xffffffff
cmp dword [ebp - 0x228], 1
jge 0x1003f8b3
mov dword [ebp - 0x2b0], 1
jmp 0x1003f8ba
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x228], 1
jne 0x1003f8cf
mov dword [ebp - 0x2a8], 1
jmp 0x1003f8d6
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x60]
cmp eax, 8
jae 0x1003f8f0
mov dword [ebp - 0x2b8], 1
jmp 0x1003f8f7
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x2b8]
cmp eax, 0xfffc
jbe 0x1003f916
mov dword [ebp - 0x27c], 1
jmp 0x1003f91d
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
sub eax, dword [ebp - 0x60]
jne 0x1003f93a
cmp dword [ebp - 0x228], 0
jne 0x1003f93a
and dword [ebp - 0x2c8], 0
jmp 0x1003f944
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2c8], eax
jge 0x1003f95b
mov dword [ebp - 0x5f8], 1
jmp 0x1003f962
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x7b8], eax
mov eax, 0xf23e5250
add eax, 0x7fb0b029
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x60], 0xffffffea
jmp 0x1003f98b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 8
jg 0x1003f9b6
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x1003f9b4
push 0x1386
push 0x171e
push 0x1dba
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1003f984
cmp dword [ebp - 0x3f0], 0
je 0x1004084f
push 1
lea ecx, [ebp - 0x844]
call fcn.10021bd6
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x168], 0x90c4d8e5
mov dword [ebp - 0x2d0], 0xfffffff9
mov dword [ebp - 0x600], 0x5f0ed1ad
mov dword [ebp - 0x160], 0
jmp 0x1003fa0e
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x1003fa30
push dword [ebp - 0x160]
lea ecx, [ebp - 0x844]
call fcn.10021c54
mov dword [eax], 0x75dc
jmp 0x1003fa01
mov dword [ebp - 0x168], 0
jmp 0x1003fa49
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x1003fc2a
push 2
lea ecx, [ebp - 0x758]
call fcn.10021bd6
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x170], 0
jmp 0x1003fa80
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x1003faa2
push dword [ebp - 0x170]
lea ecx, [ebp - 0x758]
call fcn.10021c54
mov dword [eax], 0xa11c
jmp 0x1003fa73
mov dword [ebp - 0x2d8], 0x68f8
mov dword [ebp - 0x680], 0x10008dcc
cmp dword [ebp - 0x2d8], 0x6a74
jle 0x1003fba1
and dword [ebp - 0x178], 0
jmp 0x1003fadc
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x7cd5
jge 0x1003fba1
and dword [ebp - 0x180], 0
jmp 0x1003fb02
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x7501
jge 0x1003fb9c
and dword [ebp - 0x138], 0
jmp 0x1003fb28
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x7512
jge 0x1003fb97
and dword [ebp - 0x13c], 0
jmp 0x1003fb4a
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x2011
jge 0x1003fb95
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x180]
shl eax, cl
and eax, dword [ebp - 0x138]
and eax, dword [ebp - 0x13c]
cdq
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], edx
push dword [ebp - 0x62c]
push dword [ebp - 0x630]
mov ecx, 0x10617a78
call fcn.10021ac1
jmp 0x1003fb3d
jmp 0x1003fb1b
jmp 0x1003faf5
jmp 0x1003facf
push 1
lea ecx, [ebp - 0x758]
call fcn.10021c54
mov dword [eax], 6
mov dword [ebp - 0x2d0], 6
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x600], eax
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x2d8], 0x67e5
jge 0x1003fbea
mov edx, dword [ebp - 0x680]
mov ecx, 0x10617a78
call fcn.100250d0
jmp 0x1003fc06
mov dword [ebp - 4], 0x11
jmp 0x1003fc16
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x758]
call fcn.10021c38
jmp 0x1003fa3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.10021c38
mov byte [ebp - 0x130], 1
mov byte [ebp - 0x12f], 0xd2
mov byte [ebp - 0x12e], 3
mov byte [ebp - 0x12d], 0x35
mov byte [ebp - 0x12c], 2
mov byte [ebp - 0x12b], 0x24
mov byte [ebp - 0x12a], 0xb
mov byte [ebp - 0x129], 0x11
mov byte [ebp - 0x128], 0xa
mov byte [ebp - 0x127], 0x17
mov byte [ebp - 0x126], 7
mov byte [ebp - 0x125], 0x33
mov byte [ebp - 0x124], 6
mov byte [ebp - 0x123], 0x22
mov byte [ebp - 0x122], 8
mov byte [ebp - 0x121], 7
mov byte [ebp - 0x120], 4
mov byte [ebp - 0x11f], 0x16
mov byte [ebp - 0x11e], 9
mov byte [ebp - 0x11d], 0x16
mov byte [ebp - 0x11c], 5
mov byte [ebp - 0x11b], 0xb
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x119], 0x28
mov byte [ebp - 0x118], 0xd
mov byte [ebp - 0x117], 0x34
mov byte [ebp - 0x116], 0xc
mov byte [ebp - 0x115], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x130]
and eax, 0xb7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x130]
or ecx, 0xb7
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x130]
mov byte [ebp + eax - 0x6dc], cl
mov dword [ebp - 0x4c], 2
and dword [ebp - 0x2e0], 0
jmp 0x1003fd53
mov eax, dword [ebp - 0x4c]
inc eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1c
jae 0x1003fe81
mov dword [ebp - 0x714], 7
mov dword [ebp - 0x710], 7
mov dword [ebp - 0x70c], 7
mov dword [ebp - 0x708], 7
lea ecx, [ebp - 0x231]
call fcn.10021c63
push eax
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x914]
call fcn.10021c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8dc]
call fcn.10021c12
mov dword [ebp - 0x198], 0x4081c290
mov dword [ebp - 0x198], 3
jmp 0x1003fddd
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1003fe11
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1003fe0f
push 0x25ad
push 0
push 0xea9
push 0xbe8
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x1003fdd0
lea ecx, [ebp - 0x8dc]
call fcn.10021c38
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x2e0]
movzx eax, byte [ebp + eax - 0x132]
movsx eax, byte [ebp + eax - 0x6dc]
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x12f]
and ecx, eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x2e0]
movzx eax, byte [ebp + eax - 0x132]
movsx eax, byte [ebp + eax - 0x6dc]
mov edx, dword [ebp - 0x4c]
movzx edx, byte [ebp + edx - 0x12f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x130]
mov byte [ebp + eax - 0x6dc], dl
jmp 0x1003fd4b
mov dword [ebp - 0x1a0], 0
jmp 0x1003fe9a
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jge 0x1003feb6
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x240], 0x8bbca631
jmp 0x1003fe8d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x240], 0xfffffff8
jmp 0x1003fee4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x240]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x240], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x240], 3
jle 0x1003fff6
mov dword [ebp - 0x1b0], 0xaaeb9ae7
mov dword [ebp - 0x1a8], 0
jmp 0x1003ff1b
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1003ff37
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x8d0], 0x5ab3e90a
jmp 0x1003ff0e
mov dword [ebp - 0x1b0], 0
jmp 0x1003ff50
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x1003fff1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x1003ff9b
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1003ff87
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x1003ff99
jmp 0x1003ff43
jmp 0x1003ffda
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0xf4], 0
jmp 0x1003ffbe
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x1003ffda
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x8d0], 3
jmp 0x1003ffb1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x1003ffec
jmp 0x1003fff1
jmp 0x1003ff43
jmp 0x1003fec9
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x6dc], 0
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x370], 0x2a911815
mov dword [ebp - 0xd0], 8
mov dword [ebp - 0x1b8], 0
jmp 0x1004003b
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x10040057
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x584], 0xffffffff
jmp 0x1004002e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x584], 0xfffffff6
jmp 0x10040082
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x584]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x584], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x584], 0xffffffed
jg 0x10040430
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x698], 0x7c264f89
mov dword [ebp - 0x230], 4
mov dword [ebp - 0x358], 0xfffffff6
mov dword [ebp - 0x360], 9
mov dword [ebp - 0x61c], 0xb92b2c22
mov dword [ebp - 0x1c0], 0
jmp 0x100400e7
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x10040103
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x854], 0xffffffff
jmp 0x100400da
mov dword [ebp - 0x5c], 0
jmp 0x10040113
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe7
jg 0x1004042b
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x80], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x584]
mov dword [ebp - 0x848], eax
or eax, 0xffffffff
je 0x100401aa
cmp dword [ebp - 0x370], 0xb5c4ce10
ja 0x1004015d
mov dword [ebp - 0x2e8], 1
jmp 0x10040164
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x2e8], eax
jle 0x1004017b
mov dword [ebp - 0x24c], 1
jmp 0x10040182
and dword [ebp - 0x24c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp + eax - 0x854], ecx
cmp dword [ebp - 0x24c], 0
je 0x100401aa
mov dword [ebp - 0x2f0], 1
jmp 0x100401b1
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 1
jg 0x100401c6
mov dword [ebp - 0x2f8], 1
jmp 0x100401cd
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x2f8]
test eax, eax
je 0x100401ed
cmp dword [ebp - 0x5c], 0
je 0x100401ed
mov dword [ebp - 0x608], 1
jmp 0x100401f4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x5c], 0
jne 0x10040228
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x854], 0
jne 0x10040228
and dword [ebp - 0x300], 0
jmp 0x10040232
mov dword [ebp - 0x300], 1
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x300]
cmp dword [ebp - 0x1c8], eax
jg 0x1004025c
mov dword [ebp - 0x308], 1
jmp 0x10040263
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0
ja 0x10040278
mov dword [ebp - 0x310], 1
jmp 0x1004027f
and dword [ebp - 0x310], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x584]
cmp dword [ebp - 0x310], eax
jg 0x1004029f
mov dword [ebp - 0x318], 1
jmp 0x100402a6
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x80]
jne 0x100402d6
cmp dword [ebp - 0x698], 0
jne 0x100402d6
xor eax, eax
jne 0x100402d6
mov eax, 0xaea381e1
test eax, eax
jne 0x100402d6
cmp dword [ebp - 0x80], 0
jne 0x100402d6
and dword [ebp - 0x320], 0
jmp 0x100402e0
mov dword [ebp - 0x320], 1
cmp dword [ebp - 0x320], 0
jg 0x100402f7
xor eax, eax
inc eax
jne 0x100402f7
and dword [ebp - 0x328], 0
jmp 0x10040301
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], 0x56a6d983
jl 0x10040319
mov dword [ebp - 0x610], 1
jmp 0x10040320
and dword [ebp - 0x610], 0
mov eax, 0xa064f577
test eax, eax
je 0x1004033b
cmp dword [ebp - 0x5c], 0
je 0x1004033b
mov dword [ebp - 0x330], 1
jmp 0x10040342
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x330], eax
jl 0x1004035c
mov dword [ebp - 0x690], 1
jmp 0x10040363
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x230], 0
jbe 0x10040381
mov dword [ebp - 0x338], 1
jmp 0x10040388
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x46ed4d34
jge 0x100403a0
mov dword [ebp - 0x340], 1
jmp 0x100403a7
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x340], eax
jle 0x100403c1
mov dword [ebp - 0x348], 1
jmp 0x100403c8
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 0xfff9
jae 0x100403e6
cmp dword [ebp - 0x1c8], 0
jne 0x100403e6
and dword [ebp - 0x350], 0
jmp 0x100403f0
mov dword [ebp - 0x350], 1
xor eax, eax
sub eax, dword [ebp - 0x350]
mov dword [ebp - 0x358], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x358]
sub ecx, dword [ebp + eax - 0x584]
add ecx, dword [ebp - 0x80]
mov dword [ebp - 0x360], ecx
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x61c], eax
jmp 0x1004010c
jmp 0x10040069
mov dword [ebp - 0xd0], 0xf
jmp 0x10040449
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x31
jle 0x1004048d
mov dword [ebp - 0x6a0], 1
mov eax, dword [ebp - 0x6a0]
cmp eax, dword [ebp - 0x628]
jge 0x10040476
mov dword [ebp - 0x368], 1
jmp 0x1004047d
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
neg eax
mov dword [ebp - 0x370], eax
jmp 0x1004043c
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x8fc]
call fcn.1004afba
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x38], 0xc75b57fd
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x38], 0
jmp 0x100404c7
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
jge 0x100407f3
mov dword [ebp - 0x1d8], 6
mov dword [ebp - 0x378], 0xffffffff
mov dword [ebp - 0x390], 0xdfa0148
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x728], 0x1ca7bc41
mov dword [ebp - 0x724], 0x1ca7bc41
mov dword [ebp - 0x720], 0x1ca7bc41
mov dword [ebp - 0x71c], 0x1ca7bc41
lea ecx, [ebp - 0x24d]
call fcn.10021c63
push eax
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x728]
push eax
lea ecx, [ebp - 0x924]
call fcn.10021c83
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x864]
call fcn.10021c12
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1d0], 0
jmp 0x10040573
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1004058f
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x69c], 1
jmp 0x10040566
cmp dword [ebp - 0x1d8], 0
jne 0x10040773
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x378]
jne 0x100405c8
mov dword [ebp - 0x380], 1
jmp 0x100405cf
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xec1b16eb
jne 0x100405e7
mov dword [ebp - 0x388], 1
jmp 0x100405ee
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
add eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
imul ecx, eax
cmp ecx, dword [ebp - 0x254]
jle 0x1004061d
mov dword [ebp - 0x398], 1
jmp 0x10040624
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 1
jge 0x10040639
mov dword [ebp - 0x3a0], 1
jmp 0x10040640
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x1d8]
jge 0x1004065e
mov dword [ebp - 0x3a8], 1
jmp 0x10040665
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0x6689
jne 0x1004067d
mov dword [ebp - 0x3b0], 1
jmp 0x10040684
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0xbe6286c8
jae 0x1004069c
mov dword [ebp - 0x3b8], 1
jmp 0x100406a3
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x3b8], eax
jg 0x100406bd
mov dword [ebp - 0x6a8], 1
jmp 0x100406c4
and dword [ebp - 0x6a8], 0
mov eax, 0xe19f
sub eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x38]
cmp eax, 0xfffffff9
jb 0x100406e3
mov dword [ebp - 0x3c0], 1
jmp 0x100406ea
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x2214
jl 0x10040702
mov dword [ebp - 0x634], 1
jmp 0x10040709
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x7d0], eax
mov eax, 0xb947e29a
cmp eax, 0xfffffffc
jbe 0x10040731
cmp dword [ebp - 0x3c8], 0
jne 0x10040731
and dword [ebp - 0x3d0], 0
jmp 0x1004073b
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x3d0]
jl 0x10040755
mov dword [ebp - 0x3d8], 1
jmp 0x1004075c
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x3d8]
test eax, eax
jne 0x10040773
and dword [ebp - 0x3e0], 0
jmp 0x1004077d
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3e0], eax
jg 0x10040794
mov dword [ebp - 0x210], 1
jmp 0x1004079b
and dword [ebp - 0x210], 0
push 1
lea ecx, [ebp - 0x864]
call fcn.10021c54
mov ecx, dword [ebp - 0x210]
mov dword [eax], ecx
cmp dword [ebp - 0x210], 0xfffffffe
je 0x100407c5
mov dword [ebp - 0x3e8], 1
jmp 0x100407cc
and dword [ebp - 0x3e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax - 0x69c], ecx
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x864]
call fcn.10021c38
jmp 0x100404c0
and dword [ebp - 0x1e0], 0
jmp 0x10040809
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xf
jae 0x10040822
mov eax, dword [ebp - 0x1e0]
mov byte [ebp + eax - 0x6dc], 0
jmp 0x100407fc
push 1
push 0
lea eax, [ebp - 0x8fc]
push eax
push dword [ebp - 0x3f0]
call fcn.100413be
add esp, 0x10
mov dword [0x10619504], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8fc]
call fcn.10032e9e
mov dword [ebp - 0x90], 9
mov dword [ebp - 0x1e8], 0
jmp 0x10040872
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1004088e
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x88], 0xdd33
jmp 0x10040865
mov dword [ebp - 0x90], 0
jmp 0x100408a7
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10040b84
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x3c], 0
jmp 0x100408d2
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10040b7f
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x640], 0xffffffff
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10040914
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc8], 0
jmp 0x1004092d
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jg 0x10040b7a
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x6b0], 0xfffffffd
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x88]
imul eax, dword [ebp - 0xc8]
test eax, eax
jne 0x10040aa1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
imul eax, dword [ebp - 0x50]
test eax, eax
je 0x100409b2
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x100409b2
mov dword [ebp - 0x3f8], 1
jmp 0x100409b9
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x88]
cmp dword [ebp - 0x3f8], eax
jge 0x100409d7
mov dword [ebp - 0x400], 1
jmp 0x100409de
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xd8]
jl 0x100409fe
mov dword [ebp - 0x408], 1
jmp 0x10040a05
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x408]
test eax, eax
jne 0x10040a28
cmp dword [ebp - 0x90], 0
jne 0x10040a28
and dword [ebp - 0x410], 0
jmp 0x10040a32
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x410], eax
je 0x10040a4c
mov dword [ebp - 0x418], 1
jmp 0x10040a53
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x1f0]
jne 0x10040aa1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
jne 0x10040aa1
and dword [ebp - 0x420], 0
jmp 0x10040aab
mov dword [ebp - 0x420], 1
cmp dword [ebp - 0x420], 8
jle 0x10040ac0
mov dword [ebp - 0x428], 1
jmp 0x10040ac7
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x428], eax
jne 0x10040b61
mov dword [ebp - 0xd8], 0
jmp 0x10040aef
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10040b5f
mov dword [ebp - 0x50], 0
jmp 0x10040b08
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x10040b39
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x88], 0
je 0x10040b1d
jmp 0x10040b39
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x10040b37
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x10040b01
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x10040b5d
push 0x1687
push 0
push 0x1a98
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10040ae2
jmp 0x10040b6b
mov dword [ebp - 0x640], 0xfffffffb
mov dword [ebp - 0x6b0], 0
jmp 0x10040920
jmp 0x100408cb
jmp 0x1004089a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x90], eax
cmp dword [0x10619504], 0
je 0x10041058
mov dword [ebp - 0x2c], 0x97f6af11
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x214], 0xedfc3e8c
mov dword [ebp - 0x6a4], 3
mov dword [ebp - 0x2c], 0
jmp 0x10040bd9
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffe
jl 0x10040d4e
mov dword [ebp - 0x430], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x430]
sub eax, 0x76d238e4
cmp eax, dword [ebp - 0x2c]
jle 0x10040c12
mov dword [ebp - 0x648], 1
jmp 0x10040c19
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jge 0x10040c36
mov dword [ebp - 0x438], 1
jmp 0x10040c3d
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x438]
imul eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x440], eax
jg 0x10040c6b
mov dword [ebp - 0x448], 1
jmp 0x10040c72
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x448], eax
jge 0x10040c89
mov dword [ebp - 0x450], 1
jmp 0x10040c90
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x450], eax
jge 0x10040ca7
mov dword [ebp - 0x458], 1
jmp 0x10040cae
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0x6a0b
jl 0x10040cc6
mov dword [ebp - 0x460], 1
jmp 0x10040ccd
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x460], eax
jl 0x10040ce7
mov dword [ebp - 0x468], 1
jmp 0x10040cee
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x214], eax
push 3
pop eax
sub eax, dword [ebp - 0x214]
jne 0x10040d11
mov dword [ebp - 0x470], 1
jmp 0x10040d18
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x6a4], eax
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x10040d49
push 0
push 0
push 0x1b43
push 0x1954
push 0x254f
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x10040bd2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x24], 0x97f6af11
mov dword [ebp - 0x488], 0xffffffff
mov dword [ebp - 0x21c], 0xedfc3e8c
mov dword [ebp - 0x5a8], 3
mov dword [ebp - 0x24], 0
jmp 0x10040d8c
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffe
jl 0x10041014
mov dword [ebp - 0x478], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x478]
sub eax, 0x76d238e4
cmp eax, dword [ebp - 0x24]
jle 0x10040dc5
mov dword [ebp - 0x650], 1
jmp 0x10040dcc
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jge 0x10040de9
mov dword [ebp - 0x480], 1
jmp 0x10040df0
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x480]
imul eax, dword [ebp - 0x24]
cmp dword [ebp - 0x488], eax
jg 0x10040e1e
mov dword [ebp - 0x490], 1
jmp 0x10040e25
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x490], eax
jge 0x10040e3c
mov dword [ebp - 0x498], 1
jmp 0x10040e43
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x498], eax
jge 0x10040e5a
mov dword [ebp - 0x4a0], 1
jmp 0x10040e61
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0x6a0b
jl 0x10040e79
mov dword [ebp - 0x4a8], 1
jmp 0x10040e80
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x4a8], eax
jl 0x10040e9a
mov dword [ebp - 0x4b0], 1
jmp 0x10040ea1
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x21c], eax
push 3
pop eax
sub eax, dword [ebp - 0x21c]
jne 0x10040ec4
mov dword [ebp - 0x4b8], 1
jmp 0x10040ecb
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5ac], 0x1d22
cmp dword [ebp - 0x5ac], 0x10ac
jge 0x10040fe4
push 0x10008e30
call fcn.10057a16
pop ecx
xor ecx, ecx
call fcn.10034d3b
push eax
call fcn.10059c6e
pop ecx
push 0x10618bbc
push 0x10007730
call fcn.100577fb
pop ecx
pop ecx
push 0x10008e44
call fcn.10057a16
pop ecx
and dword [ebp - 0x1f8], 0
jmp 0x10040f3c
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [0x10618bbc]
jge 0x10040f66
mov eax, dword [ebp - 0x1f8]
lea eax, [eax*8 + 0x10618ef8]
push eax
push 0x10008e60
call fcn.100577fb
pop ecx
pop ecx
jmp 0x10040f2f
and dword [ebp - 0xe0], 0
jmp 0x10040f7c
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
cmp eax, dword [0x10618bbc]
jge 0x10040fc3
call fcn.10059c4d
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x100095b0]
divsd xmm0, qword [0x100095c0]
mov eax, dword [ebp - 0xe0]
addsd xmm0, qword [eax*8 + 0x10618ef8]
mov eax, dword [ebp - 0xe0]
movsd qword [eax*8 + 0x10618ef8], xmm0
jmp 0x10040f6f
mov eax, dword [0x10618bbc]
dec eax
push eax
push 0
push 0x10618ef8
call fcn.1003cf4d
add esp, 0xc
push 0x10618ef8
call fcn.1003cddc
pop ecx
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1004100f
push 0
push 0
push 0x1b43
push 0x1954
push 0x254f
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x10040d85
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c4], eax
push dword [ebp - 0x5c4]
push dword [ebp - 0x5cc]
call dword [0x10619504]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
jmp 0x100413ad
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x98], 0xbb743d8
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x4f8], 1
mov dword [ebp - 0x5fc], 0xfffffffb
mov dword [ebp - 0x4c0], 0x45fa
mov dword [ebp - 0x5e4], 0x10008e64
cmp dword [ebp - 0x4c0], 0x4730
jle 0x10041154
and dword [ebp - 0x200], 0
jmp 0x100410c4
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x474
jge 0x10041154
and dword [ebp - 0x208], 0
jmp 0x100410ea
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x7859
jge 0x1004114f
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x208]
sar eax, cl
cdq
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], edx
push dword [ebp - 0x638]
push dword [ebp - 0x63c]
lea ecx, [ebp - 0x978]
call fcn.1000ab5a
pop ecx
pop ecx
mov dword [ebp - 0x5dc], eax
mov ecx, dword [ebp - 0x5dc]
call fcn.10021680
push eax
call fcn.10057a16
pop ecx
lea ecx, [ebp - 0x978]
call fcn.10021676
jmp 0x100410dd
jmp 0x100410b7
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x4c0], 0x4384
jge 0x10041173
push dword [ebp - 0x5e4]
call fcn.10057a16
pop ecx
jmp 0x1004118f
or dword [ebp - 4], 0xffffffff
jmp 0x10041199
mov dword [ebp - 0x144], 0
jmp 0x100411b2
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x100411ce
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0xf0], 0x8c9dffbe
jmp 0x100411a5
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0xe8], 0
je 0x10041202
push 4
pop eax
test eax, eax
je 0x10041202
mov dword [ebp - 0x4c8], 1
jmp 0x10041209
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0xffffffff
jg 0x1004121e
mov dword [ebp - 0x4d0], 1
jmp 0x10041225
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
imul ecx, dword [ebp - 0x4d0]
add ecx, dword [ebp + eax - 0xf0]
jne 0x10041253
mov eax, 0xfff9
test eax, eax
jne 0x10041253
and dword [ebp - 0x4d8], 0
jmp 0x1004125d
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x224]
add eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x5ec], 0xca3c47
jge 0x10041294
mov dword [ebp - 0x4e0], 1
jmp 0x1004129b
and dword [ebp - 0x4e0], 0
imul eax, dword [ebp - 0x4e0], 0x2967
test eax, eax
je 0x100412b5
mov dword [ebp - 0x4e8], 1
jmp 0x100412bc
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x4e8], eax
jle 0x100412df
cmp dword [ebp - 0x98], 0
je 0x100412df
mov dword [ebp - 0x22c], 1
jmp 0x100412e6
and dword [ebp - 0x22c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov dword [ebp + eax - 0xf0], ecx
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x98], eax
mov eax, 0x1815
sub eax, 0xc4ce
add eax, dword [ebp - 0xe8]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov dword [ebp - 0x8b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
imul eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xe8]
imul ecx, eax
test ecx, ecx
je 0x10041354
xor eax, eax
inc eax
jne 0x10041366
cmp dword [ebp - 0x98], 0
jne 0x10041366
and dword [ebp - 0x4f0], 0
jmp 0x10041370
mov dword [ebp - 0x4f0], 1
cmp dword [ebp - 0x4f0], 1
je 0x10041385
mov dword [ebp - 0x5f4], 1
jmp 0x1004138c
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x800], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov dword [ebp - 0x5fc], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret