Function at 0x1003a6af
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1006157f
call fcn.1005fa90
sub esp, 0x258
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], 0xfe0a8eac
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1003a6f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1003a6e2
push 4
mov dword [ebp - 0x24], ebx
pop esi
cmp dword [ebp - 0x24], 0xffffffe5
je 0x1003a986
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xaf14186e
mov dword [ebp - 0x34], 0x46fa
cmp dword [ebp - 0x34], 0x47a9
jle 0x1003a79f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edi, edi
mov dword [ebp - 0x30], ebx
inc edi
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov eax, esi
mov dword [ebp - 0x38], 0x5229
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
and eax, esi
lea ecx, [ebp - 0x260]
cdq
push edx
push eax
call fcn.10004d43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a75f
mov eax, dword [eax]
push eax
call fcn.10047823
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x260]
call fcn.100031ae
mov eax, dword [ebp - 0x28]
dec eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
jne 0x1003a745
mov esi, dword [ebp - 0x40]
inc esi
mov dword [ebp - 0x40], esi
cmp esi, 0x3960
jl 0x1003a736
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x1730
jl 0x1003a731
push 4
pop esi
mov dword [ebp - 0x2c], 0x1dba1dd7
cmp dword [ebp - 0x34], 0x469c
jge 0x1003a7ba
push str.vdhhjy_mwjfxoyi_hdz_sem_ieapnux_icepk_zmsyiwdg_ilxevorez_vvq
call fcn.10047823
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 1
jg 0x1003a97e
push esi
lea ecx, [ebp - 0xb8]
call fcn.100022ea
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
jmp 0x1003a7f6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003a7e3
mov eax, dword [ebp - 0xb8]
mov dword [eax], ebx
cmp dword [eax], 1
jg 0x1003a967
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x7c]
cmp eax, 1
setle cl
cmp ecx, dword [ebp - 0x78]
je 0x1003a82c
cmp dword [ebp - 0x78], ebx
jne 0x1003a839
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x7c], ebx
jne 0x1003a839
mov edx, ebx
jmp 0x1003a83c
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x7c]
cmp edx, eax
mov eax, dword [ebp - 0xb8]
setl cl
sub ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xfffffff6
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], ebx
jl 0x1003a95a
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 1
jg 0x1003a952
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003a94a
mov dword [ebp - 0x40], 0x4381
cmp dword [ebp - 0x40], 0x43e9
jle 0x1003a8ff
mov edi, ebx
mov esi, ebx
mov eax, edi
mov ecx, ebx
cdq
idiv esi
mov dword [ebp - 0x38], ecx
mov eax, edx
mov dword [ebp - 0x30], eax
mov edx, ebx
and eax, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], eax
or eax, edx
mov ecx, 0x1007fc58
cdq
push edx
push eax
call fcn.10002dd1
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x5786
jl 0x1003a8b7
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x1676
jl 0x1003a8ad
inc esi
cmp esi, 0x4f18
jl 0x1003a89e
inc edi
cmp edi, 0x7ddb
jl 0x1003a89c
push 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x40], 0x41dd
jge 0x1003a943
mov edx, str.caupe_dleqs_hyp_vozay_nppux_wlay_lktimvx_ndmvyjfi_vdhrfsh_qxedz_grzri_fkuxbe_zxdwlf_mkybg
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x1003a943
mov dword [ebp - 4], 2
inc dword [ebp - 0x2c]
jmp 0x1003a873
dec dword [ebp - 0x1c]
jmp 0x1003a867
mov eax, dword [ebp - 0xb8]
inc dword [eax]
jmp 0x1003a803
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.10002347
inc dword [ebp - 0x18]
jmp 0x1003a7c1
dec dword [ebp - 0x24]
jmp 0x1003a6fc
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003a99b
push ebx
push 0x833
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x18], 0x1bf2
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x28], 0xec7e318b
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], 0xaaf75d59
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x1003aa06
cmp dword [ebp - 0x34], ebx
je 0x1003aa06
xor ecx, ecx
inc ecx
jmp 0x1003aa08
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 3
setl dl
xor eax, eax
cmp ecx, 0x7790
setg al
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
cmp esi, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
je 0x1003aa3e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], ebx
je 0x1003aa4b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
jmp 0x1003aa9a
mov dword [ebp - 0x24], 0x24380d33
mov dword [ebp - 0x28], 0x231966ba
cmp dword [ebp - 0x24], ebx
jne 0x1003aa6d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
sub edx, 0x6409
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 0x4d5c
cmp dword [ebp - 0x40], 0x5087
jle 0x1003aad4
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007fc58
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10002dd1
inc edi
cmp edi, 0x18b2
jl 0x1003aaae
inc esi
cmp esi, 0x6fee
jl 0x1003aaac
push 4
pop ecx
mov word [ebp - 0x68], 0xc400
mov byte [ebp - 0x66], cl
mov dword [ebp - 0x65], 0x7e38773d
mov dword [ebp - 0x61], 0x30051b06
mov dword [ebp - 0x5d], 0x3010302
mov word [ebp - 0x59], 0xe03
mov byte [ebp - 0x57], cl
mov byte [ebp - 0x56], 3
mov dword [ebp - 0x18], ebx
jmp 0x1003ab18
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003ab07
mov dword [ebp - 0x18], ebx
jmp 0x1003ab33
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1c8], 0xe1265ab3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003ab22
mov dword [ebp - 0x144], ebx
jmp 0x1003ab51
mov dword [ebp - 0x1c8], 1
inc dword [ebp - 0x144]
cmp dword [ebp - 0x144], 0xf
jg 0x1003ab41
push 0x47
pop eax
mov word [ebp - 0x15c], ax
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x18], 0xb7c7ce53
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x1c], 0xe17b844a
push 2
call fcn.100022ea
xor edi, edi
mov dword [ebp - 4], 5
mov dword [ebp - 0x18], ebx
inc edi
cmp dword [ebp - 0x18], 3
jge 0x1003aba8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], edi
inc dword [ebp - 0x18]
jmp 0x1003ab93
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1003abc3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0x1ba6b42b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003abb0
mov dword [ebp - 0x18], ebx
jmp 0x1003acf9
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x38], ebx
push edx
call fcn.100022ea
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], ebx
jmp 0x1003ac02
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0xf1912530
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1003abef
mov dword [ebp - 0x24], ebx
jmp 0x1003acda
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x2c], 0x46b43d27
push 4
call fcn.100022ea
mov dword [ebp - 0x2c], ebx
jmp 0x1003ac3f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], 0x5bb08661
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1003ac2c
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x118]
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
jne 0x1003ac6f
mov eax, dword [ebp - 0x118]
mov ecx, ebx
cmp dword [eax], ebx
je 0x1003ac71
mov ecx, edi
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xac]
sub ecx, eax
je 0x1003ac8f
cmp dword [ebp - 0x2c], ebx
je 0x1003ac8f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xac]
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x1c]
add eax, 0xef3b
mov dword [ebp - 0x38], eax
call fcn.10002347
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1003ac10
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.10002347
inc dword [ebp - 0x18]
push 2
pop edx
cmp dword [ebp - 0x18], edx
jle 0x1003abd0
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x1003ad44
mov dword [ebp - 0x18], ebx
jmp 0x1003ad1e
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xac], ebx
jne 0x1003ad23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1003ad0f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003ad3f
push 0x1ed1
push 0x24f2
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 2
pop edx
dec dword [ebp - 0x1c]
jns 0x1003ad0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10002347
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], ebx
push 4
pop esi
push esi
lea ecx, [ebp - 0xd4]
call fcn.100022ea
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x1c], 0xfffffff8
push esi
call fcn.100022ea
push 3
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 8
call fcn.100022ea
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], ebx
jmp 0x1003adb3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003ada3
mov dword [ebp - 0x18], ebx
jmp 0x1003add0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x87fce6bb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003adbd
mov dword [ebp - 0x18], ebx
jmp 0x1003aded
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xc5265879
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003adda
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0xcad2086b
mov esi, dword [eax + 0xc]
mov ecx, esi
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, esi
cmp esi, ecx
mov ecx, dword [ebp - 0x10c]
sete dl
mov dword [ecx], edx
mov eax, dword [eax + 0xc]
imul eax, edx
cmp eax, dword [ecx + 8]
jne 0x1003ae3f
cmp dword [ebp - 0x1c], ebx
je 0x1003ae3f
mov esi, dword [ebp - 0xc4]
jmp 0x1003ae4b
mov esi, dword [ebp - 0xc4]
cmp dword [esi], ebx
jne 0x1003ae4b
mov edi, ebx
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [eax + 4]
mov edx, dword [edx + 0xc]
imul eax, edi
lea ecx, [edx - 1]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x994a
setne al
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
imul ecx, dword [esi + 4]
mov dword [esi], ecx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
cmp ecx, dword [eax]
setge dl
cmp edx, 0x2e7c525a
jg 0x1003aead
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 8], ebx
je 0x1003aead
xor ecx, ecx
inc ecx
jmp 0x1003aeaf
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add eax, ecx
mov ecx, dword [ebp - 0x10c]
add eax, dword [ecx]
je 0x1003aecb
cmp dword [edx + 4], ebx
je 0x1003aecb
xor eax, eax
inc eax
jmp 0x1003aecd
mov eax, ebx
mov dword [ecx + 4], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0xc], ebx
setne cl
xor eax, eax
cmp ecx, dword [edx + 4]
lea ecx, [ebp - 0xc4]
setne al
mov dword [ebp - 0x1c], eax
call fcn.10002347
lea ecx, [ebp - 0x10c]
call fcn.10002347
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.10002347
push 2
pop esi
cmp dword [ebp - 0x24], esi
jne 0x1003af28
push 5
xor edi, edi
mov dword [ebp - 0x30], 5
pop eax
inc edi
jmp 0x1003b01c
push esi
lea ecx, [ebp - 0x168]
call fcn.100022ea
mov dword [ebp - 0x34], 0xaafe30f5
mov dword [ebp - 0x28], 0xef8a6ebb
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1003af5b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x18c], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003af4a
mov dword [ebp - 0x18], ebx
jmp 0x1003af79
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xf9c28ade
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003af66
mov ecx, dword [ebp - 0x168]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
cmp dword [ecx + 4], 3
mov dword [ebp + eax*4 - 0x18c], 0xffffffff
jl 0x1003af87
xor edi, edi
mov dword [ebp - 0x34], 0x9ed9ba07
mov eax, dword [ebp - 0x34]
inc edi
mov dword [ecx], edi
xor ecx, ecx
test eax, eax
sets cl
xor edx, edx
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18c]
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
dec ecx
cmp ecx, 0x4d81
lea ecx, [ebp - 0x168]
setne al
mov dword [ebp - 0x28], eax
call fcn.10002347
mov eax, dword [ebp - 0x24]
movzx edx, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], ebx
movzx eax, byte [ebp + eax - 0x6a]
movzx eax, word [ebp + eax*2 - 0x15c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x68]
mov word [ebp + eax*2 - 0x15c], cx
mov eax, dword [ebp - 0x24]
add eax, esi
mov dword [ebp - 0x24], eax
cmp eax, 0x13
jb 0x1003ad5d
xor eax, eax
mov dword [ebp - 4], 9
cmp dword [ebp - 0x40], 0x4c8f
mov word [ebp - 0x14e], ax
jge 0x1003b052
mov edx, str.kijxqued_vebb_oiopmtj_xoxpf_mmzcaxu_vcelyaub_szzua_wcadl_nnjnvweln_tvdfer
mov ecx, 0x1007fc58
call fcn.10004788
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c0]
call fcn.100022ea
xor edi, edi
mov dword [ebp - 0x24], ebx
inc edi
jmp 0x1003b0a3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x75dc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003b090
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b0ce
push ebx
push 0x1c2a
push 0x206
push ebx
push 0x1fbb
push 0x7c2
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b0f3
push 0x70d
push ebx
push 0x3a8
push 0x1511
push ebx
push 0xaee
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
lea ecx, [ebp - 0x1c0]
call fcn.10002347
xor eax, eax
mov dword [ebp - 0x1a0], 7
mov word [ebp - 0x1b4], ax
lea ecx, [ebp - 0x1b4]
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x1a4], ebx
push eax
call fcn.1001e2bf
push edi
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xb
call fcn.100022ea
mov dword [ebp - 0x1c], 0x53d8da8e
mov dword [ebp - 0x24], ebx
jmp 0x1003b15b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003b148
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1003b17f
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x100]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x1c]
jns 0x1003b168
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
call fcn.10002347
xor eax, eax
lea edi, [ebp - 0x15c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x180]
push 3
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x38], 0x7ad95e17
mov dword [ebp - 0x28], 0xf390197f
mov dword [ebp - 0x28], 0x43e9
call fcn.100022ea
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x1003b1dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8], 0x4e2db58
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003b1cb
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1003b1fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d4], 0xe4438bea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003b1e9
mov dword [ebp - 0x18], ebx
jmp 0x1003b215
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], 0xc42206dd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003b204
mov dword [ebp - 0x18], ebx
jmp 0x1003b22e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003b21f
mov eax, dword [ebp - 0x180]
inc dword [eax]
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x1d4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc8]
mov edx, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x78029323
lea ecx, [ebp - 0x180]
setne al
mov dword [ebp - 0x28], eax
call fcn.10002347
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x210]
call fcn.1001164d
mov byte [ebp - 4], 0xc
xor edx, edx
mov dword [ebp - 0x24], 0xfffffffa
inc edx
mov dword [ebp - 0x3c], 0x6e85fcb4
mov dword [ebp - 0x2c], 0xbbbc254e
mov dword [ebp - 0x38], 0xcf59f89f
mov dword [ebp - 0x28], 0x305aba9a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x3c], 0xfc24489b
mov dword [ebp - 0x40], 0x2dd8607f
mov dword [ebp - 0x1c], 0x48792891
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x18], ebx
jmp 0x1003b2fc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0x2ff40fc0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003b2eb
mov dword [ebp - 0x18], ebx
jmp 0x1003b314
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003b307
cmp dword [ebp - 0x94], ebx
je 0x1003b3df
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x24]
imul eax, eax, 0x8be7
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
je 0x1003b340
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov ecx, 0x6d70
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x30]
sub ecx, eax
xor eax, eax
cmp ecx, 0xcefc
setg al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub eax, 0x5ad7a4a1
jne 0x1003b39d
cmp dword [ebp - 0x94], ebx
je 0x1003b3a0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x94]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x94]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], 0xc86e89be
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x9c]
cmp eax, 0xa718
mov eax, edx
setne cl
cmp ecx, 0x9ce
je 0x1003b3e1
mov eax, ebx
xor edx, edx
cmp eax, 0xb88c8eca
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor edi, edi
mov dword [ebp - 0x1c], ecx
inc edi
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1003b406
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x198]
push esi
call fcn.100022ea
mov dword [ebp - 0x24], 0x3532fe22
mov dword [ebp - 0x24], ebx
jmp 0x1003b430
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1003b421
mov dword [ebp - 0x24], ebx
jmp 0x1003b44e
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b44b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1003b43a
lea ecx, [ebp - 0x198]
call fcn.10002347
push 0x5c
pop eax
push 2
mov dword [ebp - 0x4c], 0xf1023200
mov ecx, ebx
mov byte [ebp - 0x48], 0x7d
mov word [ebp - 0x50], ax
pop esi
cmp esi, 2
jne 0x1003b481
push 3
pop ecx
push ecx
pop esi
jmp 0x1003b4aa
movzx edx, byte [ebp + esi - 0x4b]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x4e]
movzx ecx, word [ebp + eax*2 - 0x50]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x4c]
add ecx, edx
mov word [ebp + eax*2 - 0x50], cx
mov ecx, ebx
add esi, 2
cmp esi, 5
jb 0x1003b475
xor eax, eax
mov dword [ebp - 0x12c], ebx
push 7
mov word [ebp - 0x4e], ax
lea ecx, [ebp - 0x13c]
pop esi
mov word [ebp - 0x13c], ax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x128], esi
call fcn.1001e2bf
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x124]
push 3
mov dword [ebp - 0x50], ebx
call fcn.100022ea
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x1c], esi
push 3
call fcn.100022ea
mov dword [ebp - 0x18], ebx
jmp 0x1003b518
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003b50a
mov dword [ebp - 0x18], ebx
jmp 0x1003b534
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x220], 0xb5d1cb6a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003b523
mov dword [ebp - 0x18], ebx
jmp 0x1003b54e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003b53f
mov dword [ebp - 0x18], ebx
jmp 0x1003b56c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003b559
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], 0xf
jg 0x1003b6df
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xe46c
mov dword [ebp - 0x28], 0x927db404
mov dword [ebp - 0x18], ebx
jmp 0x1003b5a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], 0x37ae9f90
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003b59b
mov dword [ebp - 0x18], ebx
jmp 0x1003b5c5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x22c], 0xfc6a3f0b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003b5b4
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setg dl
xor edi, edi
mov dword [ebp - 0x218], edx
inc edi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setne al
imul ecx, eax, 0xbd79
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x124]
setne cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
setg dl
add eax, edx
mov dword [esi + 8], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x2f
jge 0x1003b6d0
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x30], 0x67d3
mov dword [ebp - 0x3c], 0xc826ffea
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x70]
mov dword [ecx + 4], eax
xor ecx, ecx
mov dword [ebp - 0x70], esi
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x30]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x124]
setl dl
xor ecx, ecx
cmp dword [eax], edx
setg cl
xor eax, eax
cmp esi, ecx
setge al
sub eax, 0x20ba2c16
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jg 0x1003b6bc
mov eax, ebx
cmp dword [ebp - 0x44], ebx
je 0x1003b6be
mov eax, edi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x2f
jl 0x1003b64f
mov esi, dword [ebp - 0x38]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xf
jle 0x1003b588
jmp 0x1003b6e2
xor edi, edi
inc edi
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b6f8
push 0xb19
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0xe8]
call fcn.10002347
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0xd
call fcn.10002347
mov dword [ebp - 0x3c], 0xa6847dfa
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b728
call dword [sym.imp.KERNEL32.dll_GetACP]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003b73e
push ebx
push 0x1dd1
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov dword [ebp - 0x28], 0x5677
cmp dword [ebp - 0x28], 0x5966
jle 0x1003b779
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov eax, ebx
mov ecx, 0x1007fc58
or eax, esi
cdq
push edx
push eax
call fcn.10002dd1
inc ebx
cmp ebx, 0x40c8
jl 0x1003b753
inc esi
push 0
pop ebx
cmp esi, 0x6fbd
jl 0x1003b750
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x28], 0x5407
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], 0x88
jge 0x1003b7bd
mov edx, str.opsszwx_euomp_ymut_oluoa_wga_oawxnjbzc
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x1003b7bd
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x1f8]
push 0x5f
pop eax
mov word [ebp - 0x6c], ax
xor eax, eax
mov word [ebp - 0x6a], ax
mov word [ebp - 0x1f8], ax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x1e4], 7
mov dword [ebp - 0x1e8], ebx
call fcn.1001e2bf
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xf4]
push 3
mov dword [ebp - 0x6c], ebx
call fcn.100022ea
mov dword [ebp - 0x1c], 0xffffffff
push 3
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x24], ebx
pop edx
jmp 0x1003b834
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xfddd3f46
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003b821
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1003b85f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003b84f
lea ecx, [ebp - 0xf4]
call fcn.10002347
push dword [ebp - 0x12c]
cmp dword [ebp - 0x128], 8
lea eax, [ebp - 0x13c]
push ebx
cmovae eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0x210]
push eax
call fcn.10039e1e
cmp eax, 0xffffffff
je 0x1003b8b4
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x1f8]
push ecx
push edi
push eax
lea ecx, [ebp - 0x210]
call fcn.10012af6
jmp 0x1003b86f
push 2
lea ecx, [ebp - 0x90]
call fcn.100022ea
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x24], ebx
jmp 0x1003b8e3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003b8d0
mov eax, dword [ebp - 0x90]
xor ecx, ecx
cmp dword [eax], 0x4df6
sete cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
sub eax, 0x2c32
je 0x1003b9e8
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x54], 0x65e4bc79
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0x3e1fe01a
mov dword [ebp - 0x3c], 0x3b8cd6c3
mov dword [ebp - 0x18], ebx
jmp 0x1003b946
mov dword [ebp - 0x28], 0xc4f4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
inc dword [ebp - 0x28]
cmp eax, ecx
mov eax, edi
cmovle eax, ebx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x90]
call fcn.10002347
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x210]
push eax
lea edx, [ebp - 0x1b4]
call fcn.1003bc17
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1f8]
call fcn.10011e0e
push ebx
push edi
lea ecx, [ebp - 0x13c]
call fcn.10011e0e
push ebx
push edi
lea ecx, [ebp - 0x210]
call fcn.10011e0e
push ebx
push edi
lea ecx, [ebp - 0x1b4]
call fcn.10011e0e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret