Function at 0x1004545c
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources
Get common file path
Get session user name
Identify system language via api
Parse pe header
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100732ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x11220
call fcn.1006e600
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], 0x5a136951
push 3
lea ecx, [ebp - 0xcc8]
call fcn.1000fc7a
and dword [ebp - 4], 0
mov dword [ebp - 0x3e0], 4
mov dword [ebp - 0xd8], 0
jmp 0x100454c0
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x100454dc
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0xb14], 0xec0ae971
jmp 0x100454b3
mov dword [ebp - 0xd8], 0
jmp 0x100454f5
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10045517
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xcc8]
call fcn.1000fd18
mov dword [eax], 0x85fafe44
jmp 0x100454e8
mov dword [ebp - 0x54], 0
jmp 0x10045527
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x100459a9
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x13c], 0x1971
mov dword [ebp - 0x3f4], 0
jmp 0x1004555e
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 2
jge 0x1004557a
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0xb08], 0xd13222c7
jmp 0x10045551
mov eax, dword [ebp - 0x54]
xor ecx, ecx
sub ecx, dword [ebp + eax*4 - 0xb14]
mov dword [ebp - 0x1e8], ecx
mov eax, dword [ebp - 0x1e8]
sub eax, 0x21fa
jne 0x100455a5
mov dword [ebp - 0xa38], 1
jmp 0x100455ac
and dword [ebp - 0xa38], 0
mov esi, dword [ebp - 0xa38]
add esi, 0x198d4
push 2
lea ecx, [ebp - 0xcc8]
call fcn.1000fd18
cmp esi, dword [eax]
je 0x100455d5
mov dword [ebp - 0xa08], 1
jmp 0x100455dc
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0xa08]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xb14]
mov dword [ebp - 0x1068], eax
xor eax, eax
test eax, eax
je 0x10045621
xor eax, eax
inc eax
je 0x10045621
mov dword [ebp - 0xa48], 1
jmp 0x10045628
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xb14]
cmp eax, dword [ebp - 0xa48]
jne 0x10045646
mov dword [ebp - 0xa50], 1
jmp 0x1004564d
and dword [ebp - 0xa50], 0
push 2
lea ecx, [ebp - 0xcc8]
call fcn.1000fd18
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax]
jge 0x1004567d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb08], 0
jne 0x1004567d
and dword [ebp - 0xa58], 0
jmp 0x10045687
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xa58], eax
jg 0x100456a1
mov dword [ebp - 0xa60], 1
jmp 0x100456a8
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xa60]
add ecx, 0xed05
cmp ecx, dword [ebp + eax*4 - 0xb14]
jge 0x10045980
mov dword [ebp - 0xa98], 0xfffffffe
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x474], 0xffffffff
mov dword [ebp - 0x29c], 5
mov dword [ebp - 0x13c], 0
jmp 0x10045705
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jg 0x10045972
mov dword [ebp - 0x134], 0x1dd6b9ec
mov dword [ebp - 0x3fc], 5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb08], 1
jb 0x10045742
mov dword [ebp - 0xb48], 1
jmp 0x10045749
and dword [ebp - 0xb48], 0
cmp dword [ebp - 0x134], 6
jg 0x10045761
cmp dword [ebp - 0x54], 0
je 0x10045761
and dword [ebp - 0xa68], 0
jmp 0x1004576b
mov dword [ebp - 0xa68], 1
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0xa68], eax
jg 0x10045785
mov dword [ebp - 0xa70], 1
jmp 0x1004578c
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xf74], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xb14]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0x3fc]
jg 0x100457da
mov dword [ebp - 0xb90], 1
jmp 0x100457e1
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x1074], eax
cmp dword [ebp - 0x29c], 0
je 0x10045809
push 7
pop eax
test eax, eax
je 0x10045809
mov dword [ebp - 0xa78], 1
jmp 0x10045810
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0xa78], eax
jl 0x1004582a
mov dword [ebp - 0xa80], 1
jmp 0x10045831
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
sub eax, dword [ebp - 0x54]
je 0x10045861
mov eax, 0xa1bd
test eax, eax
je 0x10045861
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb08], 0
je 0x10045861
mov dword [ebp - 0xa88], 1
jmp 0x10045868
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x134]
jne 0x1004588e
mov dword [ebp - 0xaa0], 1
jmp 0x10045895
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0x3fc], 1
jne 0x100458aa
mov dword [ebp - 0xa90], 1
jmp 0x100458b1
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x1e8], eax
mov esi, dword [ebp - 0x29c]
mov edi, dword [ebp - 0xa98]
push 4
pop eax
shl eax, 0
mov ebx, dword [ebp - 0x1e8]
add ebx, dword [ebp + eax - 0xb14]
push 2
lea ecx, [ebp - 0xcc8]
call fcn.1000fd18
sub ebx, dword [eax]
neg ebx
sub ebx, 0x5b75
sub ebx, edi
cmp ebx, esi
jg 0x10045905
mov dword [ebp - 0xb98], 1
jmp 0x1004590c
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xf7c], eax
mov eax, dword [ebp - 0x3fc]
add eax, dword [ebp - 0x3e0]
jne 0x10045944
cmp dword [ebp - 0x3e0], 0
jne 0x10045944
and dword [ebp - 0xae8], 0
jmp 0x1004594e
mov dword [ebp - 0xae8], 1
mov eax, dword [ebp - 0xae8]
sub eax, dword [ebp - 0x420]
imul eax, eax, 0x15db
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + ecx*4 - 0xb08], eax
jmp 0x100456f8
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x29c], eax
jmp 0x100459a4
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x100459a4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10045520
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x100459c6
push 0x24ee
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc8]
call fcn.1000fcfc
cmp dword [ebp + 0x10], 0
jbe 0x10045fdd
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10045fdd
mov dword [ebp - 0x144], 0x24a8c6a5
mov dword [ebp - 0x534], 0x3938
mov dword [ebp - 0x2ac], 0xb000e2e4
mov dword [ebp - 0x3d8], 0xfffffff8
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x144], 0xffffffeb
jmp 0x10045a40
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe6
jge 0x10045fa9
push 4
lea ecx, [ebp - 0x41c]
call fcn.1000fc7a
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], 0x82a1836c
mov dword [ebp - 0xc10], 0xffffffff
mov dword [ebp - 0x1ec], 0x7be2d3d4
mov dword [ebp - 0xc28], 0xd0c6a332
mov dword [ebp - 0xa0], 0
jmp 0x10045a9f
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x10045ac1
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
mov dword [eax], 0xf4288a13
jmp 0x10045a92
mov dword [ebp - 0xa0], 0
jmp 0x10045ada
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10045af6
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x47c], 0x981c5860
jmp 0x10045acd
mov dword [ebp - 0x34], 0
jmp 0x10045b06
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x10045dd0
mov dword [ebp - 0xa2c], 1
mov dword [ebp - 0x960], 0x3e64
mov dword [ebp - 0xc20], 0x10009124
cmp dword [ebp - 0x960], 0x4094
jle 0x10045bb1
and dword [ebp - 0x3a0], 0
jmp 0x10045b50
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x5b25
jge 0x10045bb1
and dword [ebp - 0x2a4], 0
jmp 0x10045b72
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x7ae6
jge 0x10045baf
mov eax, dword [ebp - 0x3a0]
add eax, dword [ebp - 0x2a4]
cdq
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xbb0], edx
push dword [ebp - 0xbb0]
push dword [ebp - 0xbb4]
mov ecx, 0x1061ae38
call fcn.1002b61d
jmp 0x10045b65
jmp 0x10045b43
push dword [ebp - 0x34]
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
cmp dword [eax], 0
je 0x10045c71
push 1
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
cmp dword [eax], 0x7001
jne 0x10045be9
mov dword [ebp - 0xba0], 1
jmp 0x10045bf0
and dword [ebp - 0xba0], 0
mov esi, dword [ebp - 0x34]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
cmp esi, dword [eax]
jne 0x10045c11
mov dword [ebp - 0xadc], 1
jmp 0x10045c18
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0x144]
jne 0x10045c3e
mov dword [ebp - 0xba8], 1
jmp 0x10045c45
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x107c], eax
mov esi, dword [ebp - 0x534]
push 3
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
add esi, dword [eax]
je 0x10045c71
mov dword [ebp - 0x5c4], 1
jmp 0x10045c78
and dword [ebp - 0x5c4], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5c4]
jl 0x10045c9c
mov dword [ebp - 0x948], 1
jmp 0x10045ca3
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x948]
jge 0x10045cbd
mov dword [ebp - 0x514], 1
jmp 0x10045cc4
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x514], eax
jl 0x10045cdb
mov dword [ebp - 0x950], 1
jmp 0x10045ce2
and dword [ebp - 0x950], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [ebp - 0x950]
jl 0x10045d06
mov dword [ebp - 0x51c], 1
jmp 0x10045d0d
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0
cmp dword [ebp - 0xc10], 0xfffffffb
je 0x10045d41
mov dword [ebp - 0x958], 1
jmp 0x10045d48
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x524], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0x47c], ecx
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xc18], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x960], 0x3df3
jge 0x10045d9f
mov edx, dword [ebp - 0xc20]
mov ecx, 0x1061ae38
call fcn.1002cd18
jmp 0x10045dbb
mov dword [ebp - 4], 1
jmp 0x10045dcb
jmp 0x10045aff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x47c], 0
jne 0x10045dec
mov dword [ebp - 0x52c], 1
jmp 0x10045df3
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0x2397bde5
je 0x10045e0b
mov dword [ebp - 0x484], 1
jmp 0x10045e12
and dword [ebp - 0x484], 0
mov esi, dword [ebp - 0x3d8]
push 3
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
sub esi, dword [eax]
mov dword [ebp - 0x34], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax - 0x47c], ecx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x484]
jg 0x10045e54
mov dword [ebp - 0x968], 1
jmp 0x10045e5b
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
sub eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x1ec]
je 0x10045e7b
mov dword [ebp - 0x970], 1
jmp 0x10045e82
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x970], eax
jg 0x10045e9c
mov dword [ebp - 0x53c], 1
jmp 0x10045ea3
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x2ac]
imul eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x54c]
jl 0x10045ec4
mov dword [ebp - 0x978], 1
jmp 0x10045ecb
and dword [ebp - 0x978], 0
push 2
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
mov ecx, dword [ebp - 0x978]
cmp ecx, dword [eax]
jge 0x10045eee
mov dword [ebp - 0x544], 1
jmp 0x10045ef5
and dword [ebp - 0x544], 0
push 1
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
mov ecx, dword [ebp - 0x544]
cmp ecx, dword [eax]
jge 0x10045f18
mov dword [ebp - 0x980], 1
jmp 0x10045f1f
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x1ec], eax
mov esi, dword [ebp - 0x3d8]
mov edi, dword [ebp - 0x1ec]
push 0
lea ecx, [ebp - 0x41c]
call fcn.1000fd18
imul edi, dword [eax]
dec edi
sub edi, esi
jne 0x10045f5e
cmp dword [ebp - 0x54c], 0
jne 0x10045f5e
and dword [ebp - 0x988], 0
jmp 0x10045f68
mov dword [ebp - 0x988], 1
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x988], eax
je 0x10045f82
mov dword [ebp - 0x554], 1
jmp 0x10045f89
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0xc28], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.1000fcfc
jmp 0x10045a33
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x10045fc9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1003fa74
pop ecx
pop ecx
jmp 0x1004e5de
mov dword [ebp - 0xf8], 0xfffffffd
mov dword [ebp - 0xc30], 0xffffffff
mov dword [ebp - 0x470], 0xaa165420
mov dword [ebp - 0x19c], 0x1a969ac5
mov dword [ebp - 0x20c], 0x158018d9
mov dword [ebp - 0x4a0], 0xffff
mov dword [ebp - 0x990], 4
mov dword [ebp - 0xc40], 0x8ef5
mov dword [ebp - 0xec], 0
jmp 0x10046046
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10046062
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0xdcc], 0xffff
jmp 0x10046039
mov dword [ebp - 0xec], 0
jmp 0x1004607b
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x10046097
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x42c], 0xb7518db0
jmp 0x1004606e
mov dword [ebp - 0xf8], 0
jmp 0x100460b0
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x100460d5
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0xdcc]
mov ecx, dword [ebp - 0xf8]
mov dword [ebp + ecx*4 - 0xdcc], eax
jmp 0x100460a3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xdcc]
mov dword [ebp - 0xf84], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10046181
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 0
jne 0x10046119
mov eax, 0xe1b8
test eax, eax
jne 0x10046119
and dword [ebp - 0x55c], 0
jmp 0x10046123
mov dword [ebp - 0x55c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdcc]
cmp dword [ebp - 0x55c], eax
jge 0x1004614d
cmp dword [ebp - 0x19c], 0
je 0x1004614d
mov dword [ebp - 0x998], 1
jmp 0x10046154
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0x998]
test eax, eax
jne 0x1004616c
cmp dword [ebp - 0x470], 0
cmp dword [ebp - 0x20c], 0
je 0x10046181
mov dword [ebp - 0x564], 1
jmp 0x10046188
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x19c]
add eax, dword [ebp - 0x564]
imul eax, eax, 0xc19
test eax, eax
jne 0x100461b0
cmp dword [ebp - 0x20c], 0
jne 0x100461b0
and dword [ebp - 0x9a0], 0
jmp 0x100461ba
mov dword [ebp - 0x9a0], 1
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0xf8]
jg 0x100461e9
cmp dword [ebp - 0x19c], 0
je 0x100461e9
mov dword [ebp - 0xc38], 1
jmp 0x100461f0
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xfa4], eax
push 9
pop eax
sub eax, dword [ebp - 0xc40]
imul eax, eax, 0xf322
cmp eax, 0x5063f373
jge 0x1004621e
mov dword [ebp - 0x56c], 1
jmp 0x10046225
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x56c]
je 0x10046248
cmp dword [ebp - 0x20c], 0
je 0x10046248
mov dword [ebp - 0x9a8], 1
jmp 0x1004624f
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x470]
cmp dword [ebp - 0x9a8], eax
jl 0x10046272
mov eax, 0x36fe5438
test eax, eax
je 0x10046272
mov dword [ebp - 0x574], 1
jmp 0x10046279
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0x574]
jge 0x100462a0
mov dword [ebp - 0x9b0], 1
jmp 0x100462a7
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x42c]
cmp dword [ebp - 0x9b0], eax
jge 0x100462ce
cmp dword [ebp - 0x470], 0
jne 0x100462ce
and dword [ebp - 0x57c], 0
jmp 0x100462d8
mov dword [ebp - 0x57c], 1
mov eax, 0x55cc
sub eax, dword [ebp - 0x57c]
cmp eax, 0x3aabdc9a
jne 0x10046306
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x42c], 0
je 0x10046306
mov dword [ebp - 0x9b8], 1
jmp 0x1004630d
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x9b8]
cmp eax, 0xfffffffe
jae 0x1004632a
mov dword [ebp - 0x584], 1
jmp 0x10046331
and dword [ebp - 0x584], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x584]
mov dword [ebp + eax - 0x42c], ecx
push 4
lea ecx, [ebp - 0x410]
call fcn.1000fc7a
mov dword [ebp - 4], 4
push 1
lea ecx, [ebp - 0xe08]
call fcn.1000fc7a
mov byte [ebp - 4], 5
mov dword [ebp - 0x9c0], 0x511e
mov dword [ebp - 0xc50], 0x10009160
cmp dword [ebp - 0x9c0], 0x532b
jle 0x10046433
and dword [ebp - 0x3a8], 0
jmp 0x100463a3
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x11cc
jge 0x10046433
and dword [ebp - 0x2b4], 0
jmp 0x100463c9
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x359f
jge 0x1004642e
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x2b4]
sar eax, cl
cdq
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbbc], edx
push dword [ebp - 0xbbc]
push dword [ebp - 0xbc0]
lea ecx, [ebp - 0x11e8]
call fcn.1000ac1f
pop ecx
pop ecx
mov dword [ebp - 0xc48], eax
mov ecx, dword [ebp - 0xc48]
call fcn.1000faa9
push eax
call fcn.1005b2bd
pop ecx
lea ecx, [ebp - 0x11e8]
call fcn.1000fa7a
jmp 0x100463bc
jmp 0x10046396
mov dword [ebp - 0x9e0], 0x1826
mov byte [ebp - 4], 6
cmp dword [ebp - 0x9c0], 0x4e69
jge 0x10046459
push dword [ebp - 0xc50]
call fcn.1005b2bd
pop ecx
jmp 0x10046475
mov dword [ebp - 4], 5
jmp 0x10046485
mov dword [ebp - 0x88], 0
jmp 0x1004649e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x100464c0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov dword [eax], 6
jmp 0x10046491
mov dword [ebp - 0x88], 0
jmp 0x100464d9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x100464f8
push dword [ebp - 0x88]
lea ecx, [ebp - 0xe08]
call fcn.1000fd18
and dword [eax], 0
jmp 0x100464cc
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1004653b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x18b9
push 0x604
push 0x4e0
push 0x30b
push 0x16d0
call dword [sym.imp.GDI32.dll_CreateFontA]
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
and dword [eax], 0
jmp 0x10046571
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
cmp dword [eax], 0xc
jg 0x100467cc
mov dword [ebp - 0x59c], 0xfff9
mov dword [ebp - 0x1d8], 0x16ea3de8
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
cmp dword [eax], 0
je 0x100466dc
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
cmp dword [eax], 1
jge 0x100465d3
xor eax, eax
je 0x100465d3
mov dword [ebp - 0x9c8], 1
jmp 0x100465da
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
sub eax, 0xadd6
mov dword [ebp - 0x594], eax
push 0
lea ecx, [ebp - 0xe08]
call fcn.1000fd18
mov ecx, dword [ebp - 0x594]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov esi, dword [ebp - 0x594]
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
cmp dword [eax], esi
jne 0x10046632
mov dword [ebp - 0x9d0], 1
jmp 0x10046639
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0xf8c], eax
push 1
lea ecx, [ebp - 0x410]
call fcn.1000fd18
cmp dword [eax], 0xffffffff
jl 0x1004666f
mov dword [ebp - 0x9d8], 1
jmp 0x10046676
and dword [ebp - 0x9d8], 0
push 2
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9d8]
jle 0x10046699
mov dword [ebp - 0x5a4], 1
jmp 0x100466a0
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x9e0], eax
imul eax, dword [ebp - 0x9e0], 0
cmp eax, dword [ebp - 0x1d8]
jge 0x100466c7
mov dword [ebp - 0x5ac], 1
jmp 0x100466ce
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x5ac], eax
jne 0x100466f7
push 0
lea ecx, [ebp - 0xe08]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x100466f7
and dword [ebp - 0x9e8], 0
jmp 0x10046701
mov dword [ebp - 0x9e8], 1
mov esi, dword [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov ecx, dword [ebp - 0x9e8]
sub ecx, dword [eax]
cmp ecx, esi
jge 0x1004672c
mov dword [ebp - 0x5b4], 1
jmp 0x10046733
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x5b4], eax
jne 0x1004674d
mov dword [ebp - 0x9f0], 1
jmp 0x10046754
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x9f0], eax
jle 0x1004676e
mov dword [ebp - 0x5bc], 1
jmp 0x10046775
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xffffffff
jl 0x1004678a
mov dword [ebp - 0x9f8], 1
jmp 0x10046791
and dword [ebp - 0x9f8], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.1000fd18
mov ecx, dword [ebp - 0x9f8]
cmp ecx, dword [eax]
je 0x100467b4
mov dword [ebp - 0xa00], 1
jmp 0x100467bb
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x1d8], eax
jmp 0x1004654d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe08]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.1000fcfc
cmp dword [ebp + 0x10], 0
jne 0x1004af94
mov dword [ebp - 0x400], 0x41b3c692
mov dword [ebp - 0x400], 4
jmp 0x10046817
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 8
jle 0x10046836
mov dword [ebp - 0xc58], 1
mov dword [ebp - 0xc58], 0xffffffff
jmp 0x1004680a
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x10046854
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1003ba39
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x2bc], 0
jmp 0x10046888
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 2
jge 0x100468a4
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x1158], 0x55459eed
jmp 0x1004687b
mov dword [ebp - 0x3b0], 0x17
jmp 0x100468bd
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0xfffffff1
jg 0x10046a2d
mov dword [ebp - 0x1a4], 0xfff7
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x1a4]
cmp eax, 0xbd0
jge 0x100468f3
mov dword [ebp - 0xa4c], 1
jmp 0x100468fa
and dword [ebp - 0xa4c], 0
cmp dword [ebp - 0xa4c], 0xc5735e4b
jbe 0x10046912
mov dword [ebp - 0x5cc], 1
jmp 0x10046919
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0xffffffff
ja 0x100469b6
mov dword [ebp - 0xc60], 0x2ab76d60
cmp dword [ebp - 0xc60], 0
je 0x10046980
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1004695f
push 0
push 0
push 0x2524
push 0x1370
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x1004697e
push 0
push 0x1b5a
call dword [sym.imp.USER32.dll_GetWindowInfo]
jmp 0x1004699a
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1004699a
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [ebp - 0x18c], 0
movzx eax, byte [ebp - 0x18c]
test eax, eax
je 0x100469b4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100469de
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x100469de
push 0
push 0
push 0x5e9
push 0x1099
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
mov dword [ebp - 0x1a4], 0
jmp 0x100469f7
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jg 0x10046a28
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x10046a26
push 0
push 0
push 0x13b7
push 0x9d1
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x100469ea
jmp 0x100468b0
cmp dword [0x106df4ac], 0
jne 0x1004aae0
mov dword [ebp - 0x85c], 0x4694
mov dword [ebp - 0xc68], 0x100091fc
cmp dword [ebp - 0x85c], 0x49c4
jle 0x10046b37
and dword [ebp - 0x35c], 0
jmp 0x10046a74
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x1e64
jge 0x10046b37
and dword [ebp - 0x2cc], 0
jmp 0x10046a9a
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x38b8
jge 0x10046b32
and dword [ebp - 0x2c4], 0
jmp 0x10046ac0
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x628a
jge 0x10046b2d
and dword [ebp - 0x358], 0
jmp 0x10046ae2
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x1896
jge 0x10046b2b
mov eax, dword [ebp - 0x2c4]
and eax, dword [ebp - 0x358]
xor eax, dword [ebp - 0x2cc]
or eax, dword [ebp - 0x35c]
cdq
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc8], edx
push dword [ebp - 0xbc8]
push dword [ebp - 0xbcc]
mov ecx, 0x1061ae38
call fcn.1002b61d
jmp 0x10046ad5
jmp 0x10046ab3
jmp 0x10046a8d
jmp 0x10046a67
mov dword [ebp - 4], 8
cmp dword [ebp - 0x85c], 0x44d6
jge 0x10046b5a
mov edx, dword [ebp - 0xc68]
mov ecx, 0x1061ae38
call fcn.1002cd18
jmp 0x10046b76
or dword [ebp - 4], 0xffffffff
jmp 0x10046b80
mov dword [ebp - 0x14c], 0x633efc07
mov dword [ebp - 0x1cc], 0xce008fb0
mov dword [ebp - 0x2d4], 0
jmp 0x10046bad
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x10046bc9
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xfbc], 0x2758
jmp 0x10046ba0
xor eax, eax
je 0x10046be8
mov dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xc70], eax
jmp 0x10046c94
mov dword [ebp - 0x5d4], 0
mov dword [ebp - 0xc80], 0x3a6c9cd4
mov dword [ebp - 0x14c], 0
jmp 0x10046c15
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x20
jg 0x10046c34
mov dword [ebp - 0xc78], 0xe672ca3c
mov dword [ebp - 0xc78], 0x1da622a1
jmp 0x10046c08
mov dword [ebp - 0x5d4], 0xfffffff6
mov eax, dword [ebp - 0x5d4]
add eax, dword [ebp - 0x14c]
neg eax
cmp dword [ebp - 0x14c], eax
jle 0x10046c60
mov dword [ebp - 0x9a4], 1
jmp 0x10046c67
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0xc80]
cmp dword [ebp - 0x9a4], eax
jg 0x10046c81
mov dword [ebp - 0x5dc], 1
jmp 0x10046c88
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1cc], 0
jmp 0x10046cad
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x10046cc9
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xfbc], 0xed40
jmp 0x10046ca0
mov dword [ebp - 0xc88], 0x7e6b
lea eax, [ebp - 0xc88]
push eax
call fcn.1003fa20
pop ecx
mov dword [ebp - 0x7c4], eax
push 2
lea ecx, [ebp - 0x4ec]
call fcn.1000fc7a
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x68], 0xbdba76aa
mov dword [ebp - 0xca0], 0xffffffff
push 2
lea ecx, [ebp - 0xec0]
call fcn.1000fc7a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xa8], 0
jmp 0x10046d35
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10046d57
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov dword [eax], 9
jmp 0x10046d28
mov dword [ebp - 0xa8], 0
jmp 0x10046d70
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10046d92
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xec0]
call fcn.1000fd18
mov dword [eax], 0x67bbda73
jmp 0x10046d63
mov dword [ebp - 0x68], 1
jmp 0x10046da2
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1004700c
push 3
lea ecx, [ebp - 0xab0]
call fcn.1000fc7a
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xcb0], 0xffff
mov dword [ebp - 0xcb8], 8
mov dword [ebp - 0x364], 0
jmp 0x10046dea
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x10046e0c
push dword [ebp - 0x364]
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
mov dword [eax], 0xe4b7834d
jmp 0x10046ddd
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x10046e43
push 1
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
cmp dword [eax], 0
je 0x10046e3a
mov eax, 0xb76d
test eax, eax
jne 0x10046e43
and dword [ebp - 0x5ec], 0
jmp 0x10046e4d
mov dword [ebp - 0x5ec], 1
push 2
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
cmp dword [eax], 0x700d
jle 0x10046e6e
mov dword [ebp - 0x864], 1
jmp 0x10046e75
and dword [ebp - 0x864], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov ecx, dword [ebp - 0x864]
cmp ecx, dword [eax]
jg 0x10046e99
mov dword [ebp - 0x5e4], 1
jmp 0x10046ea0
and dword [ebp - 0x5e4], 0
push 1
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [eax]
jge 0x10046ec3
mov dword [ebp - 0xa94], 1
jmp 0x10046eca
and dword [ebp - 0xa94], 0
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov ecx, dword [ebp - 0xa94]
cmp ecx, dword [eax]
jl 0x10046eed
mov dword [ebp - 0xc90], 1
jmp 0x10046ef4
and dword [ebp - 0xc90], 0
push 1
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
mov eax, 0xfdb7b241
add eax, 7
cmp dword [ebp - 0x5ec], eax
jle 0x10046f1d
mov dword [ebp - 0xc98], 1
jmp 0x10046f24
and dword [ebp - 0xc98], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov esi, eax
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [esi], eax
push 0
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov esi, eax
push 1
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x10046f73
mov dword [ebp - 0x86c], 1
jmp 0x10046f7a
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
neg eax
imul eax, dword [ebp - 0x68]
mov dword [ebp - 0xca0], eax
push 1
lea ecx, [ebp - 0xab0]
call fcn.1000fd18
mov esi, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4ec]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x10046fbb
mov dword [ebp - 0xca8], 1
jmp 0x10046fc2
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x5f4], eax
push 0
lea ecx, [ebp - 0xec0]
call fcn.1000fd18
mov ecx, dword [ebp - 0x5f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0xcb8], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xab0]
call fcn.1000fcfc
jmp 0x10046d9b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xec0]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ec]
call fcn.1000fcfc
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0xd50], 0x7812a3cc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
jmp 0x1004705c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x10
jne 0x100471aa
mov dword [ebp - 0x440], 0x91e6
mov dword [ebp - 0x1f4], 0xffffffff
mov dword [ebp - 0x614], 0x1b713623
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf94], eax
cmp dword [ebp - 0x78], 0x15aa961
jge 0x100470a2
mov dword [ebp - 0x9ac], 1
jmp 0x100470a9
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0xda0]
cmp eax, dword [ebp - 0xd94]
jge 0x100470f4
mov dword [ebp - 0x874], 1
jmp 0x100470fb
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x1f4]
jge 0x10047112
mov dword [ebp - 0x604], 1
jmp 0x10047119
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0xd50]
imul eax, dword [ebp - 0x874]
imul eax, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x1f4]
jl 0x10047141
mov dword [ebp - 0xa54], 1
jmp 0x10047148
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xa54], eax
jl 0x1004715f
mov dword [ebp - 0x60c], 1
jmp 0x10047166
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x60c], eax
jne 0x10047180
mov dword [ebp - 0x87c], 1
jmp 0x10047187
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x614]
mov dword [ebp - 0x614], eax
jmp 0x10047055
mov byte [ebp - 0x258], 0xa
mov byte [ebp - 0x257], 0xbd
mov byte [ebp - 0x256], 6
mov byte [ebp - 0x255], 0x36
mov byte [ebp - 0x254], 0xb
mov byte [ebp - 0x253], 0xb
mov byte [ebp - 0x252], 0xc
mov byte [ebp - 0x251], 0x2f
mov byte [ebp - 0x250], 7
mov byte [ebp - 0x24f], 0x3e
mov byte [ebp - 0x24e], 2
mov byte [ebp - 0x24d], 0x1d
mov byte [ebp - 0x24c], 8
mov byte [ebp - 0x24b], 0x1b
mov byte [ebp - 0x24a], 9
mov byte [ebp - 0x249], 1
mov byte [ebp - 0x248], 0
mov byte [ebp - 0x247], 0x29
mov byte [ebp - 0x246], 3
mov byte [ebp - 0x245], 0x11
mov byte [ebp - 0x244], 4
mov byte [ebp - 0x243], 0x33
mov byte [ebp - 0x242], 3
mov byte [ebp - 0x241], 0x50
mov byte [ebp - 0x240], 0x75
mov byte [ebp - 0x23f], 0x6f
mov byte [ebp - 0x23e], 5
mov byte [ebp - 0x23d], 0x17
mov byte [ebp - 0x23c], 1
mov byte [ebp - 0x23b], 0x17
push 3
lea ecx, [ebp - 0xac0]
call fcn.1000fc7a
mov dword [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x284]
call fcn.1000fc7a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x62c], 0x2f20
mov dword [ebp - 0x1ac], 0xfffffffd
mov dword [ebp - 0x894], 0x57f039d3
mov dword [ebp - 0x644], 1
mov dword [ebp - 0xe0], 0
jmp 0x100472e2
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x10047304
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
mov dword [eax], 0x9841b3c6
jmp 0x100472d5
mov dword [ebp - 0xe0], 0
jmp 0x1004731d
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1004733c
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x284]
call fcn.1000fd18
and dword [eax], 0
jmp 0x10047310
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
mov dword [eax], 2
jmp 0x10047375
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x9b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
cmp dword [eax], 0
jl 0x10047708
mov dword [ebp - 0xfb0], 0x593b88a6
mov dword [ebp - 0xf9c], 0xffffffff
mov dword [ebp - 0xb54], 9
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x10047419
mov esi, dword [ebp - 0x62c]
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
cmp dword [eax], esi
jle 0x100473f8
mov dword [ebp - 0x61c], 1
jmp 0x100473ff
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
sub eax, 4
mov dword [ebp - 0x1ac], eax
jne 0x10047419
and dword [ebp - 0x884], 0
jmp 0x10047423
mov dword [ebp - 0x884], 1
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
mov ecx, dword [ebp - 0x884]
cmp ecx, dword [eax]
jl 0x10047453
mov dword [ebp - 0x624], 1
jmp 0x1004745a
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jge 0x1004747d
mov dword [ebp - 0xae4], 1
jmp 0x10047484
and dword [ebp - 0xae4], 0
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
mov ecx, dword [ebp - 0xae4]
cmp ecx, dword [eax]
je 0x100474c6
mov eax, 0x2e88
test eax, eax
je 0x100474c6
cmp dword [ebp - 0x62c], 0
je 0x100474c6
mov dword [ebp - 0x88c], 1
jmp 0x100474cd
and dword [ebp - 0x88c], 0
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
mov ecx, dword [ebp - 0x88c]
cmp ecx, dword [eax]
jne 0x100474f0
mov dword [ebp - 0x634], 1
jmp 0x100474f7
and dword [ebp - 0x634], 0
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
mov eax, dword [eax]
mov ecx, dword [ebp - 0x634]
lea eax, [ecx + eax - 0xad90]
cmp eax, 0xfffffffc
jne 0x10047524
mov dword [ebp - 0x9bc], 1
jmp 0x1004752b
and dword [ebp - 0x9bc], 0
cmp dword [ebp - 0x9bc], 0xa2c9
jg 0x10047543
mov dword [ebp - 0xd3c], 1
jmp 0x1004754a
and dword [ebp - 0xd3c], 0
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
xor eax, eax
inc eax
imul eax, eax, 0xfffe
sub eax, 0x14946227
cmp eax, 1
je 0x10047583
mov dword [ebp - 0x63c], 1
jmp 0x1004758a
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
je 0x100476cd
mov dword [ebp - 0xfac], 0xc29a
mov dword [ebp - 0x1078], 0xfffffffc
push 1
lea ecx, [ebp - 0xea8]
call fcn.1000fc7a
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xa5c], 0xfffffff6
mov dword [ebp - 0xb88], 0xfffffff7
mov dword [ebp - 0x2dc], 0
jmp 0x10047601
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x10047623
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xea8]
call fcn.1000fd18
mov dword [eax], 0xf13e0ca
jmp 0x100475f4
mov dword [ebp - 0x1ac], 0
jmp 0x1004763c
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jg 0x1004768c
mov dword [ebp - 0xfb4], 0x24bfcc0c
mov dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0x2ca
jne 0x10047671
mov dword [ebp - 0x64c], 1
jmp 0x10047678
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0xb88]
add eax, dword [ebp - 0x64c]
mov dword [ebp - 0xb54], eax
jmp 0x1004762f
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xac0]
call fcn.1000fd18
cmp dword [eax], 0
je 0x100476bc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xea8]
call fcn.1000fcfc
jmp 0x10047708
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xea8]
call fcn.1000fcfc
jmp 0x100476ec
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x100476ec
push 0
push 0x955
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
lea ecx, [ebp - 0x284]
call fcn.1000fd18
cmp dword [eax], 0
je 0x10047703
jmp 0x10047351
jmp 0x10047351
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x284]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac0]
call fcn.1000fcfc
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x258]
and eax, 0xf8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x258]
or ecx, 0xf8
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x258]
mov byte [ebp + eax - 0xd88], cl
mov dword [ebp - 0xe64], 0x624
mov dword [ebp - 0xe60], 0x624
mov dword [ebp - 0xe5c], 0x624
mov dword [ebp - 0xe58], 0x624
lea ecx, [ebp - 0x435]
call fcn.1000fd27
push eax
lea eax, [ebp - 0xe54]
push eax
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x1198]
call fcn.1000fd2a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdfc]
call fcn.1000fcd6
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x36c], 0xffffffff
mov dword [ebp - 0x10b8], 7
mov dword [ebp - 0xfc0], 0xffffffff
push 3
lea ecx, [ebp - 0xeb4]
call fcn.1000fc7a
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xb0], 0
jmp 0x10047810
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1004782c
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1080], 0x193c1de6
jmp 0x10047803
mov dword [ebp - 0xb0], 0
jmp 0x10047845
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10047867
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xeb4]
call fcn.1000fd18
mov dword [eax], 0x9c90
jmp 0x10047838
mov dword [ebp - 0x36c], 3
jmp 0x10047880
mov eax, dword [ebp - 0x36c]
dec eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
jl 0x100479d0
mov dword [ebp - 0x110], 0x976ff55e
mov dword [ebp - 0xcb4], 0xfffffffa
mov dword [ebp - 0x110], 3
jmp 0x100478ba
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x100479cb
mov dword [ebp - 0x8a4], 0xfffffffa
mov eax, 0x69ec4279
test eax, eax
je 0x100479b3
push dword [ebp - 0x110]
lea ecx, [ebp - 0xdfc]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x10047900
mov dword [ebp - 0x654], 1
jmp 0x10047907
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x110], 0
jne 0x10047923
mov eax, dword [ebp - 0x110]
neg eax
jne 0x10047923
and dword [ebp - 0x89c], 0
jmp 0x1004792d
mov dword [ebp - 0x89c], 1
push 0
lea ecx, [ebp - 0xdfc]
call fcn.1000fd18
mov ecx, dword [ebp - 0x89c]
cmp ecx, dword [eax]
jl 0x10047950
mov dword [ebp - 0x9c4], 1
jmp 0x10047957
and dword [ebp - 0x9c4], 0
mov esi, dword [ebp - 0x654]
imul esi, dword [ebp - 0x9c4]
push dword [ebp - 0x110]
lea ecx, [ebp - 0xdfc]
call fcn.1000fd18
sub esi, dword [eax]
cmp esi, 0x8d927f7b
jb 0x1004798b
mov dword [ebp - 0x65c], 1
jmp 0x10047992
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 0
je 0x100479b3
mov dword [ebp - 0x664], 1
jmp 0x100479ba
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0xcb4], eax
jmp 0x100478ad
jmp 0x10047873
push 1
lea ecx, [ebp - 0xeb4]
call fcn.1000fd18
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa9c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xeb4]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdfc]
call fcn.1000fcfc
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x304], 0
jmp 0x10047a2a
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1e
jae 0x100482d2
push 3
lea ecx, [ebp - 0x1004]
call fcn.1000fc7a
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x2e4], 0
jmp 0x10047a61
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x10047a83
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x1004]
call fcn.1000fd18
mov dword [eax], 9
jmp 0x10047a54
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x10047aa3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x10047ac2
push 0x1b62
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1004]
call fcn.1000fcfc
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x258]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10047fca
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x258]
inc eax
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x2ec], 0x571177e8
push 1
lea ecx, [ebp - 0x1014]
call fcn.1000fc7a
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xcbc], 4
mov dword [ebp - 0x374], 0
jmp 0x10047b3f
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x10047b61
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1014]
call fcn.1000fd18
mov dword [eax], 0xeccce1e2
jmp 0x10047b32
mov dword [ebp - 0x2ec], 0
jmp 0x10047b7a
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0xffffffef
je 0x10047fa1
mov dword [ebp - 0x37c], 0x351cdcb3
mov dword [ebp - 0x37c], 0
jmp 0x10047baa
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jg 0x10047f9c
mov dword [ebp - 0x384], 0x7909b792
mov dword [ebp - 0xb5c], 0x2273
cmp dword [ebp - 0xb5c], 0xa6b
jge 0x10047f69
xor eax, eax
inc eax
imul eax, eax, 0
push 0x10
pop ecx
imul ecx, ecx, 0
mov edx, 0x100
imul edx, edx, 0
mov esi, 0x1000
imul esi, esi, 0
lea esi, [ebp + esi - 0x11230]
add esi, edx
add esi, ecx
mov byte [esi + eax], 0
and dword [ebp - 0x5c], 0
jmp 0x10047c13
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x10
jge 0x10047e30
and dword [ebp - 0x64], 0
jmp 0x10047c2a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x10
jge 0x10047e2b
and dword [ebp - 0x60], 0
jmp 0x10047c41
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x10
jge 0x10047e26
and dword [ebp - 0x70], 0
jmp 0x10047c58
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x10
jge 0x10047e21
mov eax, dword [ebp - 0x60]
shl eax, 4
mov ecx, dword [ebp - 0x64]
shl ecx, 8
mov edx, dword [ebp - 0x5c]
shl edx, 0xc
lea edx, [ebp + edx - 0x11230]
add edx, ecx
add edx, eax
add edx, dword [ebp - 0x70]
mov dword [ebp - 0x1c4], edx
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 0
cmp dword [ebp - 0x5c], 0
je 0x10047cca
mov eax, dword [ebp - 0x60]
shl eax, 4
mov ecx, dword [ebp - 0x64]
shl ecx, 8
mov edx, 0x1000
imul edx, edx, 0
lea edx, [ebp + edx - 0x11230]
add edx, ecx
add edx, eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [edx + eax]
test eax, eax
jne 0x10047cca
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
cmp dword [ebp - 0x64], 0
je 0x10047d03
mov eax, dword [ebp - 0x60]
shl eax, 4
mov ecx, 0x100
imul ecx, ecx, 0
mov edx, dword [ebp - 0x5c]
shl edx, 0xc
lea edx, [ebp + edx - 0x11230]
add edx, ecx
add edx, eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [edx + eax]
test eax, eax
jne 0x10047d03
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
cmp dword [ebp - 0x60], 0
je 0x10047d3a
push 0x10
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x64]
shl ecx, 8
mov edx, dword [ebp - 0x5c]
shl edx, 0xc
lea edx, [ebp + edx - 0x11230]
add edx, ecx
add edx, eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [edx + eax]
test eax, eax
jne 0x10047d3a
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
cmp dword [ebp - 0x70], 0
je 0x10047d74
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x60]
shl ecx, 4
mov edx, dword [ebp - 0x64]
shl edx, 8
mov esi, dword [ebp - 0x5c]
shl esi, 0xc
lea esi, [ebp + esi - 0x11230]
add esi, edx
add esi, ecx
movzx eax, byte [esi + eax]
test eax, eax
jne 0x10047d74
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
and dword [ebp - 0x108], 0
jmp 0x10047d8a
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x10047e1c
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x108]
shl eax, cl
mov ecx, dword [ebp - 0x5c]
or ecx, dword [ebp - 0x64]
or ecx, dword [ebp - 0x60]
or ecx, dword [ebp - 0x70]
and ecx, eax
je 0x10047e17
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x108]
shl eax, cl
not eax
and eax, dword [ebp - 0x70]
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x108]
shl edx, cl
not edx
and edx, dword [ebp - 0x60]
shl edx, 4
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x108]
shl esi, cl
not esi
and esi, dword [ebp - 0x64]
shl esi, 8
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x108]
shl edi, cl
not edi
and edi, dword [ebp - 0x5c]
shl edi, 0xc
lea ecx, [ebp + edi - 0x11230]
add ecx, esi
add ecx, edx
movzx eax, byte [ecx + eax]
test eax, eax
jne 0x10047e17
mov eax, dword [ebp - 0x1c4]
mov byte [eax], 1
jmp 0x10047d7d
jmp 0x10047c51
jmp 0x10047c3a
jmp 0x10047c23
jmp 0x10047c0c
lea eax, [ebp - 0x434]
push eax
push 0x100077d0
call fcn.1005ac9b
pop ecx
pop ecx
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x434]
dec eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0xd44], 0
je 0x10047f69
and dword [ebp - 0x1b4], 0
jmp 0x10047e7f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x10047efd
mov eax, dword [ebp - 0x1b4]
and dword [ebp + eax*4 - 0xdc0], 0
and dword [ebp - 0x2f4], 0
jmp 0x10047eac
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jge 0x10047ef8
lea eax, [ebp - 0xb64]
push eax
push 0x100077d0
call fcn.1005ac9b
pop ecx
pop ecx
cmp dword [ebp - 0xb64], 1
jne 0x10047ef6
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x2f4]
shl eax, cl
mov ecx, dword [ebp - 0x1b4]
or eax, dword [ebp + ecx*4 - 0xdc0]
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + ecx*4 - 0xdc0], eax
jmp 0x10047e9f
jmp 0x10047e72
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xdc0]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xdc0]
shl ecx, 4
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0xdc0]
shl edx, 8
push 4
pop esi
imul esi, esi, 0
mov esi, dword [ebp + esi - 0xdc0]
shl esi, 0xc
lea esi, [ebp + esi - 0x11230]
add esi, edx
add esi, ecx
movzx eax, byte [esi + eax]
test eax, eax
je 0x10047f59
push 0x10009244
call fcn.1005b6d1
pop ecx
jmp 0x10047f64
push 0x10009248
call fcn.1005b6d1
pop ecx
jmp 0x10047e43
mov dword [ebp - 0x384], 0
jmp 0x10047f82
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jg 0x10047f97
mov dword [ebp - 0xcbc], 0x1a4d63a8
jmp 0x10047f75
jmp 0x10047b9d
jmp 0x10047b6d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1014]
call fcn.1000fcfc
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x258]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10047a22
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0xf4], 0x315362d
mov dword [ebp - 0x2fc], 0
jmp 0x10047ff4
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x10048010
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x1120], 0
jmp 0x10047fe7
xor eax, eax
inc eax
je 0x100480eb
mov dword [ebp - 0x3c], 0
jmp 0x10048029
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x100480e6
mov dword [ebp - 0x38c], 0x32a1
mov dword [ebp - 0xb6c], 5
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x10048078
push 0
push 0
push 0xaab
push 0
push 0xea
push 0
push 0
push 0xaac
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xf4], 2
jmp 0x10048091
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x100480e1
mov dword [ebp - 0x66c], 0xa13b2885
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x38c], 0
jmp 0x100480ca
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 2
jg 0x100480df
mov dword [ebp - 0xb6c], 2
jmp 0x100480bd
jmp 0x10048084
jmp 0x10048022
jmp 0x100481fe
mov dword [ebp - 0xd4c], 0xa1434a93
mov dword [ebp - 0xf3c], 0xcfdfe92
mov dword [ebp - 0xf38], 0xcfdfe92
mov dword [ebp - 0xf34], 0xcfdfe92
mov dword [ebp - 0xf30], 0xcfdfe92
mov dword [ebp - 0x3c], 0
jmp 0x1004812d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x2e
jle 0x100481d5
mov dword [ebp - 0x8ac], 4
mov dword [ebp - 0xf4], 0
jmp 0x1004815a
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x10048177
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0x1120], 0
je 0x10048175
jmp 0x10048177
jmp 0x1004814d
cmp dword [ebp - 0x8ac], 0
jne 0x10048192
cmp dword [ebp - 0xd4c], 0
jne 0x10048192
and dword [ebp - 0x674], 0
jmp 0x1004819c
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x8ac]
cmp dword [ebp - 0x674], eax
je 0x100481b6
mov dword [ebp - 0x9cc], 1
jmp 0x100481bd
and dword [ebp - 0x9cc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x9cc]
mov dword [ebp + eax - 0xf3c], ecx
jmp 0x10048126
mov byte [ebp - 0x118], 0
movzx eax, byte [ebp - 0x118]
test eax, eax
je 0x100481fe
push 0
push 0xa3a
push 0x23d3
push 0xd38
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov dword [ebp - 0x3c], 0x18
jmp 0x1004820e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x2d
jl 0x10048266
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10048264
push 0
push 0x1892
push 0
push 0
push 0xd58
push 0x3b1
push 0x735
push 0x5c1
push 0x10a7
push 0x1364
push 0x13b0
push 0x98d
push 0x1017
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x10048207
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x304]
movzx eax, byte [ebp + eax - 0x25a]
movsx eax, byte [ebp + eax - 0xd88]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x257]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x304]
movzx eax, byte [ebp + eax - 0x25a]
movsx eax, byte [ebp + eax - 0xd88]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x257]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x258]
mov byte [ebp + eax - 0xd88], dl
and dword [ebp - 0x304], 0
jmp 0x10047a22
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xd88], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x394], 0
jmp 0x10048300
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jge 0x1004831c
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x8b4], 0xffffffff
jmp 0x100482f3
mov dword [ebp - 0x6c], 0
jmp 0x1004832c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x100484b9
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1004834e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x100484b4
mov dword [ebp - 0x67c], 0x3091
mov dword [ebp - 0xb74], 0x10009250
cmp dword [ebp - 0x67c], 0x33ef
jle 0x10048463
and dword [ebp - 0x3a4], 0
jmp 0x1004839e
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x449e
jge 0x10048463
and dword [ebp - 0x314], 0
jmp 0x100483c4
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x6bc9
jge 0x1004845e
and dword [ebp - 0x30c], 0
jmp 0x100483ea
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x733
jge 0x10048459
and dword [ebp - 0x39c], 0
jmp 0x1004840c
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x63a8
jge 0x10048457
mov ecx, dword [ebp - 0x30c]
add ecx, dword [ebp - 0x39c]
mov eax, dword [ebp - 0x314]
shl eax, cl
and eax, dword [ebp - 0x3a4]
cdq
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xbd4], edx
push dword [ebp - 0xbd4]
push dword [ebp - 0xbd8]
mov ecx, 0x1061ae38
call fcn.1002b61d
jmp 0x100483ff
jmp 0x100483dd
jmp 0x100483b7
jmp 0x10048391
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x67c], 0x2e4f
jge 0x1004848e
mov edx, dword [ebp - 0xb74]
mov ecx, 0x1061ae38
call fcn.1002cd18
jmp 0x100484aa
or dword [ebp - 4], 0xffffffff
jmp 0x100484b4
jmp 0x10048325
mov dword [ebp - 0x6c], 0
jmp 0x100484c9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x1004850c
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0x8b4]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp + ecx*4 - 0x8b4], eax
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1004850a
push 0x1f82
push 0xd5
push 0x2609
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x100484c2
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x11d0]
call fcn.1000fb61
mov dword [ebp - 0xccc], eax
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 4], 0x16
mov edx, dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0xb7c]
call fcn.1003ba39
mov dword [0x106df4ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11d0]
call fcn.1000fbcc
and dword [ebp - 0x3ac], 0
jmp 0x10048572
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0xe
jae 0x100485ee
mov dword [ebp - 0x31c], 0x41b3c692
mov dword [ebp - 0x31c], 4
jmp 0x1004859e
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 8
jle 0x100485bd
mov dword [ebp - 0xd54], 1
mov dword [ebp - 0xd54], 0xffffffff
jmp 0x10048591
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x100485db
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [ebp - 0x3ac]
mov byte [ebp + eax - 0xd88], 0
jmp 0x10048565
mov byte [ebp - 0x278], 0
mov byte [ebp - 0x277], 0x29
mov byte [ebp - 0x276], 2
mov byte [ebp - 0x275], 0xa1
mov byte [ebp - 0x274], 0xd6
mov byte [ebp - 0x273], 9
mov byte [ebp - 0x272], 0x20
mov byte [ebp - 0x271], 7
mov byte [ebp - 0x270], 0x11
mov byte [ebp - 0x26f], 0xa
mov byte [ebp - 0x26e], 0x17
mov byte [ebp - 0x26d], 1
mov byte [ebp - 0x26c], 0x17
mov byte [ebp - 0x26b], 3
mov byte [ebp - 0x26a], 0x13
mov byte [ebp - 0x269], 6
mov byte [ebp - 0x268], 0x31
mov byte [ebp - 0x267], 0xd
mov byte [ebp - 0x266], 7
mov byte [ebp - 0x265], 4
mov byte [ebp - 0x264], 0x23
mov byte [ebp - 0x263], 0xc
mov byte [ebp - 0x262], 7
mov byte [ebp - 0x261], 2
mov byte [ebp - 0x260], 0x16
mov byte [ebp - 0x25f], 0xb
mov byte [ebp - 0x25e], 0x16
mov byte [ebp - 0x25d], 8
mov byte [ebp - 0x25c], 0x1c
mov byte [ebp - 0x25b], 5
mov byte [ebp - 0x25a], 0xa
mov dword [ebp - 0x694], 0x51ea66e5
mov dword [ebp - 0x8bc], 0x77b568be
mov dword [ebp - 0xd5c], 1
mov dword [ebp - 0x220], 0xd303f024
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x43c], 0xf59f
mov dword [ebp - 0x44c], 0x84365721
mov dword [ebp - 0x9d4], 0xd67a3d58
mov dword [ebp - 0xb8], 0
jmp 0x10048730
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x1004874c
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xe28], 0xfc0
jmp 0x10048723
mov dword [ebp - 0xb8], 0
jmp 0x10048765
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10048781
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1144], 0xffffffff
jmp 0x10048758
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0xfc8], eax
imul eax, dword [ebp - 0x43c], 0xa259
push 4
pop ecx
imul ecx, ecx, 3
cmp dword [ebp + ecx - 0xe28], eax
je 0x100487ad
cmp dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x9d4]
jg 0x100487c7
mov dword [ebp - 0x684], 1
jmp 0x100487ce
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x684]
sub ecx, 8
imul ecx, dword [ebp + eax - 0xe28]
cmp ecx, 0xaac
jg 0x100487f9
mov dword [ebp - 0xa64], 1
jmp 0x10048800
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0xa64], eax
jle 0x10048820
cmp dword [ebp - 0x220], 0
jne 0x10048820
and dword [ebp - 0x68c], 0
jmp 0x1004882a
mov dword [ebp - 0x68c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
cmp dword [ebp - 0x68c], eax
jl 0x1004884b
mov dword [ebp - 0xb84], 1
jmp 0x10048852
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x10e4], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe28]
mov dword [ebp - 0x694], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xe28]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x44c]
add eax, 3
mov ecx, dword [ebp - 0x8bc]
add ecx, eax
mov eax, dword [ebp - 0x694]
sub eax, ecx
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0xcdc]
cmp eax, dword [ebp - 0xb8c]
je 0x100488d6
mov dword [ebp - 0x454], 1
jmp 0x100488dd
and dword [ebp - 0x454], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x454]
mov dword [ebp + eax - 0x1144], ecx
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x454], eax
je 0x10048909
mov dword [ebp - 0x69c], 1
jmp 0x10048910
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x9d4]
cmp dword [ebp - 0x69c], eax
jg 0x1004892a
mov dword [ebp - 0x8c4], 1
jmp 0x10048931
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x8c4]
je 0x10048954
cmp dword [ebp - 0x220], 0
je 0x10048954
mov dword [ebp - 0x6a4], 1
jmp 0x1004895b
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0xd5c], eax
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x278]
and eax, 0x6a
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x278]
or ecx, 0x6a
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x278]
mov byte [ebp + eax - 0xdb0], cl
mov dword [ebp - 0x14], 0xfffffff9
push 4
lea ecx, [ebp - 0x238]
call fcn.1000fc7a
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x324], 0
jmp 0x100489f2
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 4
jge 0x10048a14
push dword [ebp - 0x324]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov dword [eax], 0x51cdcb36
jmp 0x100489e5
cmp dword [ebp - 0x14], 0
je 0x10048d54
mov dword [ebp - 0x218], 0xfffb
push 1
lea ecx, [ebp - 0xecc]
call fcn.1000fc7a
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x3b4], 0
jmp 0x10048a52
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x10048a74
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0xecc]
call fcn.1000fd18
mov dword [eax], 0x2cca7a22
jmp 0x10048a45
mov dword [ebp - 0x14], 0x1d
jmp 0x10048a84
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1e
jg 0x10048ace
mov dword [ebp - 0x32c], 0
jmp 0x10048aa3
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x10048abf
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xfd0], 0xce1e
jmp 0x10048a96
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
jmp 0x10048a7d
mov dword [ebp - 0x14], 0
jmp 0x10048ade
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x19
je 0x10048d40
mov dword [ebp - 0x1fc], 0xfff7
mov dword [ebp - 0x8d4], 0
mov dword [ebp - 0x448], 0x19c36c1d
mov esi, dword [ebp - 0x218]
push 3
lea ecx, [ebp - 0x238]
call fcn.1000fd18
imul esi, dword [eax]
mov eax, 0x3530
sub eax, esi
jne 0x10048b35
push 9
pop eax
test eax, eax
jne 0x10048b35
and dword [ebp - 0xb94], 0
jmp 0x10048b3f
mov dword [ebp - 0xb94], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1088], eax
mov esi, dword [ebp - 0x1fc]
push 0
lea ecx, [ebp - 0x238]
call fcn.1000fd18
cmp dword [eax], esi
jg 0x10048b6b
mov dword [ebp - 0xad4], 1
jmp 0x10048b72
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xad4], eax
je 0x10048b8c
mov dword [ebp - 0x6ac], 1
jmp 0x10048b93
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x6ac], eax
je 0x10048bad
mov dword [ebp - 0x8cc], 1
jmp 0x10048bb4
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0x9bf0bb9a
je 0x10048bcc
mov dword [ebp - 0x6b4], 1
jmp 0x10048bd3
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x6b4], eax
jge 0x10048bed
mov dword [ebp - 0x9dc], 1
jmp 0x10048bf4
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xfffffff9
jne 0x10048c12
cmp dword [ebp - 0x8d4], 0
je 0x10048c12
mov dword [ebp - 0x6bc], 1
jmp 0x10048c19
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x6bc]
jge 0x10048c33
mov dword [ebp - 0x6c4], 1
jmp 0x10048c3a
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x8d4]
cmp dword [ebp - 0x6c4], eax
jg 0x10048c54
mov dword [ebp - 0xcec], 1
jmp 0x10048c5b
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0x1fc], 0xffff
jbe 0x10048c73
mov dword [ebp - 0xa6c], 1
jmp 0x10048c7a
and dword [ebp - 0xa6c], 0
push 1
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa6c]
je 0x10048ca3
cmp dword [ebp - 0x14], 0
je 0x10048ca3
mov dword [ebp - 0x6cc], 1
jmp 0x10048caa
and dword [ebp - 0x6cc], 0
push 2
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov ecx, dword [ebp - 0x6cc]
cmp ecx, dword [eax]
je 0x10048ccd
mov dword [ebp - 0x8dc], 1
jmp 0x10048cd4
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x8dc], eax
jle 0x10048cee
mov dword [ebp - 0x6d4], 1
jmp 0x10048cf5
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x10048d1c
cmp dword [ebp - 0x448], 0
jne 0x10048d1c
and dword [ebp - 0x9e4], 0
jmp 0x10048d26
mov dword [ebp - 0x9e4], 1
push 0
lea ecx, [ebp - 0xecc]
call fcn.1000fd18
mov ecx, dword [ebp - 0x9e4]
mov dword [eax], ecx
jmp 0x10048ad7
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xecc]
call fcn.1000fcfc
jmp 0x100490ee
push 1
lea ecx, [ebp - 0xf20]
call fcn.1000fc7a
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x478], 0x45e4bba
mov dword [ebp - 0x8c], 0
jmp 0x10048d88
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10048daa
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xf20]
call fcn.1000fd18
mov dword [eax], 0x8f9b
jmp 0x10048d7b
mov dword [ebp - 0x8c], 0
jmp 0x10048dc3
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x10048ddf
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x11b0], 0xffffffff
jmp 0x10048db6
mov dword [ebp - 0x14], 0
jmp 0x10048def
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x10049099
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
push 1
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov dword [eax], 0x2a6bc671
mov esi, dword [ebp - 0x3bc]
push 2
lea ecx, [ebp - 0x238]
call fcn.1000fd18
add esi, dword [eax]
cmp esi, 1
je 0x10048e40
mov dword [ebp - 0x6dc], 1
jmp 0x10048e47
and dword [ebp - 0x6dc], 0
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x6dc]
sub edi, 0xcec6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
imul edi, dword [eax]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
sub edi, dword [eax]
cmp edi, esi
jg 0x10048e87
mov dword [ebp - 0x8e4], 1
jmp 0x10048e8e
and dword [ebp - 0x8e4], 0
mov esi, dword [ebp - 0x8e4]
add esi, 4
push 1
lea ecx, [ebp - 0x238]
call fcn.1000fd18
cmp esi, dword [eax]
jle 0x10048eb4
mov dword [ebp - 0x6e4], 1
jmp 0x10048ebb
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0xffffffff
jl 0x10048ed0
mov dword [ebp - 0xaa4], 1
jmp 0x10048ed7
and dword [ebp - 0xaa4], 0
push 0
lea ecx, [ebp - 0xf20]
call fcn.1000fd18
mov ecx, dword [ebp - 0xaa4]
cmp ecx, dword [eax]
je 0x10048efa
mov dword [ebp - 0x6ec], 1
jmp 0x10048f01
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x6ec]
cmp eax, dword [ebp - 0x478]
jge 0x10048f1e
mov dword [ebp - 0x8ec], 1
jmp 0x10048f25
and dword [ebp - 0x8ec], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
je 0x10048f49
mov dword [ebp - 0xb9c], 1
jmp 0x10048f50
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10c0], eax
mov esi, dword [ebp - 0x3bc]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov eax, dword [eax]
sub eax, esi
je 0x10048f94
cmp dword [ebp - 0x478], 0
je 0x10048f94
mov dword [ebp - 0x6f4], 1
jmp 0x10048f9b
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0x7606
jg 0x10048fb3
mov dword [ebp - 0x9ec], 1
jmp 0x10048fba
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0
jne 0x10048fe1
mov eax, 0x2e6c4949
test eax, eax
jne 0x10048fe1
and dword [ebp - 0x6fc], 0
jmp 0x10048feb
mov dword [ebp - 0x6fc], 1
cmp dword [ebp - 0x6fc], 0x2e732266
je 0x10049003
mov dword [ebp - 0x8f4], 1
jmp 0x1004900a
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8f4], eax
jl 0x10049023
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.1000fd18
push 3
lea ecx, [ebp - 0x238]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0xd01d
jl 0x10049056
mov eax, 0x4e24
test eax, eax
jne 0x10049056
and dword [ebp - 0xa74], 0
jmp 0x10049060
mov dword [ebp - 0xa74], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11b0]
cmp dword [ebp - 0xa74], eax
je 0x10049081
mov dword [ebp - 0x70c], 1
jmp 0x10049088
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x204], eax
jmp 0x10048de8
mov dword [ebp - 0x204], 0
jmp 0x100490b2
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xfffffff7
jg 0x100490df
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100490dd
push 0x1da2
push 0x1610
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x100490a5
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xf20]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1000fcfc
mov dword [ebp - 0x28], 2
and dword [ebp - 0x360], 0
jmp 0x10049115
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1f
jae 0x10049c95
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x278]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10049719
mov dword [ebp - 0x50], 0x4e2db58
mov dword [ebp - 0x3c4], 0xfffffffa
mov dword [ebp - 0x50], 0xfffffffe
jmp 0x1004915b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x10
je 0x1004931c
mov dword [ebp - 0x334], 0x188
mov dword [ebp - 0x734], 4
mov dword [ebp - 0xd64], 0xc93e3288
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x100491cc
mov dword [ebp - 0x3c4], 0x5bc4
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x50]
jle 0x100491ab
mov dword [ebp - 0x8fc], 1
jmp 0x100491b2
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x8fc]
je 0x100491cc
mov dword [ebp - 0x714], 1
jmp 0x100491d3
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x714]
jge 0x100491f3
cmp dword [ebp - 0x50], 0
je 0x100491f3
mov dword [ebp - 0x9f4], 1
jmp 0x100491fa
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x9f4]
cmp eax, dword [ebp - 0x50]
jg 0x10049214
mov dword [ebp - 0x71c], 1
jmp 0x1004921b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
add eax, 0x19d8
je 0x1004923d
cmp dword [ebp - 0x3c4], 0
je 0x1004923d
mov dword [ebp - 0x904], 1
jmp 0x10049244
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x904], eax
jle 0x1004925e
mov dword [ebp - 0x724], 1
jmp 0x10049265
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
add eax, 0x4f35204f
cmp eax, 0x8886a6c6
jbe 0x10049283
mov dword [ebp - 0xad8], 1
jmp 0x1004928a
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0xad8]
imul eax, eax, 0
cmp dword [ebp - 0x50], eax
je 0x100492a7
mov dword [ebp - 0x72c], 1
jmp 0x100492ae
and dword [ebp - 0x72c], 0
cmp dword [ebp - 0x72c], 0x53e3f36a
jne 0x100492c6
mov dword [ebp - 0x90c], 1
jmp 0x100492cd
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0
je 0x100492f7
cmp dword [ebp - 0x334], 0
je 0x100492f7
mov dword [ebp - 0x9fc], 1
jmp 0x100492fe
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xd64], eax
mov dword [ebp - 0x3c4], 1
jmp 0x10049154
mov dword [ebp - 0x73c], 0x230a
mov dword [ebp - 0xba4], 0x100092d8
cmp dword [ebp - 0x73c], 0x24ca
jle 0x1004941f
and dword [ebp - 0x33c], 0
jmp 0x10049356
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x2a2d
jge 0x1004941f
and dword [ebp - 0x3cc], 0
jmp 0x1004937c
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x5451
jge 0x1004941a
and dword [ebp - 0x344], 0
jmp 0x100493a2
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x6c3a
jge 0x10049415
and dword [ebp - 0x3d4], 0
jmp 0x100493c4
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x19f4
jge 0x10049413
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x3cc]
shl eax, cl
mov ecx, dword [ebp - 0x344]
sar eax, cl
mov ecx, dword [ebp - 0x3d4]
shl eax, cl
cdq
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbe0], edx
push dword [ebp - 0xbe0]
push dword [ebp - 0xbe4]
mov ecx, 0x1061ae38
call fcn.1002b61d
jmp 0x100493b7
jmp 0x10049395
jmp 0x1004936f
jmp 0x10049349
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x278]
inc eax
mov dword [ebp - 0x360], eax
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x73c], 0x21a2
jge 0x10049454
mov edx, dword [ebp - 0xba4]
mov ecx, 0x1061ae38
call fcn.1002cd18
jmp 0x10049470
or dword [ebp - 4], 0xffffffff
jmp 0x1004947a
mov dword [ebp - 0x914], 2
mov dword [ebp - 0x744], 0x10e164ca
mov dword [ebp - 0xbac], 0xd29729c
mov dword [ebp - 0x34c], 0
jmp 0x100494b1
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x100494cd
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xcfc], 0x7dd68876
jmp 0x100494a4
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x100494f0
push 0
push 0
push 0x1c88
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcfc]
mov dword [ebp - 0x914], eax
imul eax, dword [ebp - 0x914], 0xf34f
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x278]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0xfffffffc
push 3
lea ecx, [ebp - 0xed8]
call fcn.1000fc7a
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x3dc], 0
jmp 0x10049568
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 3
jge 0x1004958a
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xed8]
call fcn.1000fd18
mov dword [eax], 1
jmp 0x1004955b
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x100495ad
push 0
push 0
push 0x1abc
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov dword [ebp - 0x44], 0
jmp 0x100495bd
cmp dword [ebp - 0x44], 0xffffffea
je 0x10049705
mov dword [ebp - 0x1d4], 0xf7921e12
mov dword [ebp - 0x1dc], 0x18bd8502
cmp dword [ebp - 0x44], 0
je 0x100495f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xed8]
call fcn.1000fcfc
jmp 0x1004910d
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x360]
movzx eax, byte [ebp + eax - 0x27a]
movsx eax, byte [ebp + eax - 0xdb0]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x277]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x360]
movzx eax, byte [ebp + eax - 0x27a]
movsx eax, byte [ebp + eax - 0xdb0]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x277]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x278]
mov byte [ebp + eax - 0xdb0], dl
push 2
lea ecx, [ebp - 0x4bc]
call fcn.1000fc7a
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x154], 0xbb743d83
mov dword [ebp - 0xe8], 0
jmp 0x100497b0
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x100497d2
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x4bc]
call fcn.1000fd18
mov dword [eax], 0xfffa
jmp 0x100497a3
mov dword [ebp - 0xe8], 0
jmp 0x100497eb
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x10049807
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xd08], 0xffffffff
jmp 0x100497de
mov dword [ebp - 0x154], 1
jmp 0x10049820
cmp dword [ebp - 0x154], 0
jl 0x10049c7a
mov dword [ebp - 0x934], 0xfffffffa
mov dword [ebp - 0xa04], 0x15d8
mov dword [ebp - 0xbc4], 0x10009328
cmp dword [ebp - 0xa04], 0x1651
jle 0x10049901
and dword [ebp - 0x354], 0
jmp 0x10049871
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x5a88
jge 0x10049901
and dword [ebp - 0x3e4], 0
jmp 0x10049897
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x7e11
jge 0x100498fc
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x3e4]
sar eax, cl
cdq
mov dword [ebp - 0xbf0], eax
mov dword [ebp - 0xbec], edx
push dword [ebp - 0xbec]
push dword [ebp - 0xbf0]
lea ecx, [ebp - 0x1218]
call fcn.1000ac1f
pop ecx
pop ecx
mov dword [ebp - 0xd74], eax
mov ecx, dword [ebp - 0xd74]
call fcn.1000faa9
push eax
call fcn.1005b2bd
pop ecx
lea ecx, [ebp - 0x1218]
call fcn.1000fa7a
jmp 0x1004988a
jmp 0x10049864
mov dword [ebp - 0xd78], 0xe7587697
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0xa04], 0x11f2
jge 0x10049927
push dword [ebp - 0xbc4]
call fcn.1005b2bd
pop ecx
jmp 0x10049943
mov dword [ebp - 4], 0x1d
jmp 0x10049953
mov dword [ebp - 0x3ec], 0
jmp 0x1004996c
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jge 0x10049985
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + eax*4 - 0x1c], 0xfe1ca296
jmp 0x1004995f
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x1004999d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 1
jmp 0x100499c2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jl 0x10049c75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.1000fcfc
and dword [ebp - 0x360], 0
jmp 0x1004910d
mov dword [ebp - 0x48], 0xfffffffc
push 3
lea ecx, [ebp - 0xf08]
call fcn.1000fc7a
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x3b8], 0
jmp 0x10049cc9
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 3
jge 0x10049ceb
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0xf08]
call fcn.1000fd18
mov dword [eax], 1
jmp 0x10049cbc
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x10049d0e
push 0
push 0
push 0x1abc
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov dword [ebp - 0x48], 0
jmp 0x10049d1e
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffea
je 0x10049e66
mov dword [ebp - 0x1bc], 0xf7921e12
mov dword [ebp - 0x228], 0x18bd8502
cmp dword [ebp - 0x48], 0
je 0x10049d57
cmp dword [ebp - 0x228], 0
je 0x10049d57
mov dword [ebp - 0xbdc], 1
jmp 0x10049d5e
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jg 0x10049d7e
mov dword [ebp - 0x784], 1
jmp 0x10049d85
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0x6270
jne 0x10049d9d
mov dword [ebp - 0xa28], 1
jmp 0x10049da4
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x1bc]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x1bc], eax
mov esi, dword [ebp - 0x1bc]
sub esi, dword [ebp - 0xa28]
push 1
lea ecx, [ebp - 0xf08]
call fcn.1000fd18
mov dword [eax], esi
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x48]
jg 0x10049df1
mov dword [ebp - 0x78c], 1
jmp 0x10049df8
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x228]
cmp eax, 0xdd44
jge 0x10049e1c
mov dword [ebp - 0x93c], 1
jmp 0x10049e23
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x228]
imul eax, dword [ebp - 0x93c]
cmp eax, dword [ebp - 0x48]
jge 0x10049e41
mov dword [ebp - 0xd10], 1
jmp 0x10049e48
and dword [ebp - 0xd10], 0
mov eax, 0x522a
test eax, eax
je 0x10049e58
cmp dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x228], eax
jmp 0x10049d17
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.1000fcfc
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xdb0], 0
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x4b0], 0x8fe24307
mov dword [ebp - 0x4ac], 0x8fe24307
mov dword [ebp - 0x4a8], 0x8fe24307
mov dword [ebp - 0x4a4], 0x8fe24307
mov dword [ebp - 0x794], 0xfffaa232
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xff8], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x368], 0
jmp 0x10049f01
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xffffffe8
jle 0x1004a2a2
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x3f8], 0
jmp 0x10049f31
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 2
jge 0x10049f4d
mov eax, dword [ebp - 0x3f8]
mov dword [ebp + eax*4 - 0xa14], 2
jmp 0x10049f24
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x58], 1
jg 0x10049f80
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa14], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x794], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4b0]
cmp eax, dword [ebp - 0x794]
jg 0x10049fb3
mov dword [ebp - 0xa18], 1
jmp 0x10049fba
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 0x82ade89
jl 0x10049fd2
mov dword [ebp - 0xbe8], 1
jmp 0x10049fd9
and dword [ebp - 0xbe8], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa14], 0xfffffffd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4b0], 0xfffffffd
je 0x1004a006
mov dword [ebp - 0x79c], 1
jmp 0x1004a00d
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x1e0], eax
mov eax, 0xcfb861a7
test eax, eax
je 0x1004a287
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0xd18], 0xffffffff
mov dword [ebp - 0x1a0], 8
jmp 0x1004a053
cmp dword [ebp - 0x1a0], 0x20
jl 0x1004a270
mov dword [ebp - 0xc00], 0xffff
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xc00], eax
jmp 0x10049ef4
lea eax, [ebp - 0xdb0]
push eax
lea ecx, [ebp - 0x1200]
call fcn.1000fb61
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 4], 0x21
mov edx, dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0xc0c]
call fcn.1003ba39
mov dword [0x106df67c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1200]
call fcn.1000fbcc
push 3
lea ecx, [ebp - 0xaf4]
call fcn.1000fc7a
mov dword [ebp - 4], 0x22
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x498], 0x707dfe4d
mov dword [ebp - 0x964], 0xe07ea4c5
mov dword [ebp - 0xd20], 7
mov dword [ebp - 0xc0], 0
jmp 0x1004a347
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1004a369
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xaf4]
call fcn.1000fd18
mov dword [eax], 0x8bbc
jmp 0x1004a33a
mov dword [ebp - 0xc0], 0
jmp 0x1004a382
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1004a39e
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1024], 0x39f3
jmp 0x1004a375
mov dword [ebp - 0xf0], 0
jmp 0x1004a3b7
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1004a3d9
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xaf4]
call fcn.1000fd18
mov dword [eax], 0xda43
jmp 0x1004a3aa
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x508], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax - 0x1024], ecx
push 0
lea ecx, [ebp - 0xaf4]
call fcn.1000fd18
mov esi, dword [ebp - 0x508]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0xaf4]
call fcn.1000fd18
cmp dword [eax], esi
jl 0x1004a442
mov dword [ebp - 0x7cc], 1
jmp 0x1004a449
and dword [ebp - 0x7cc], 0
push 2
lea ecx, [ebp - 0xaf4]
call fcn.1000fd18
mov ecx, dword [ebp - 0x7cc]
add ecx, dword [eax]
je 0x1004a47c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1024], 0
je 0x1004a47c
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 1
jne 0x1004a498
push 2
lea ecx, [ebp - 0xb44]
call fcn.1000fc7a
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x378], 0x6d44418
mov dword [ebp - 0x1028], 1
mov dword [ebp - 0xe50], 0x425f5f99
mov dword [ebp - 0xe4c], 0x425f5f99
mov dword [ebp - 0xe48], 0x425f5f99
mov dword [ebp - 0xe44], 0x425f5f99
lea ecx, [ebp - 0x459]
call fcn.1000fd27
push eax
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0xe50]
push eax
lea ecx, [ebp - 0x11b8]
call fcn.1000fd2a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdf0]
call fcn.1000fcd6
mov byte [ebp - 4], 0x28
mov dword [ebp - 0xd60], 0xf4f368a9
mov dword [ebp - 0x3c0], 0
jmp 0x1004ab8c
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 2
jge 0x1004abae
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0xb44]
call fcn.1000fd18
mov dword [eax], 0x57fd5464
jmp 0x1004ab7f
mov dword [ebp - 0x378], 1
jmp 0x1004abc7
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
jl 0x1004af44
mov dword [ebp - 0x94], 9
mov dword [ebp - 0x82c], 0xab5457d6
mov dword [ebp - 0x994], 0
mov dword [ebp - 0xac4], 0x9f8c5172
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x1004ac1f
push 0
push 0
push 0
push 0x757
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x94], 0
jmp 0x1004ac38
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1004af3f
mov dword [ebp - 0xe78], 0xcc25fa5f
mov dword [ebp - 0xe74], 0xcc25fa5f
mov dword [ebp - 0xe70], 0xcc25fa5f
mov dword [ebp - 0xe6c], 0xcc25fa5f
lea ecx, [ebp - 0x469]
call fcn.1000fd27
push eax
lea eax, [ebp - 0xe68]
push eax
lea eax, [ebp - 0xe78]
push eax
lea ecx, [ebp - 0x1178]
call fcn.1000fd2a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb2c]
call fcn.1000fcd6
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x844], 0xffffffff
mov dword [ebp - 0x1f0], 1
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1000fd18
mov dword [eax], 1
jmp 0x1004acf3
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1000fd18
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa8c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1000fd18
cmp dword [eax], 0
jl 0x1004aedf
mov dword [ebp - 0xfc], 0x49a2
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 0
jmp 0x1004ad39
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1004aeda
mov dword [ebp - 0xd28], 0xaead2214
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xb44]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x1004ae2b
mov dword [ebp - 0x82c], 0xe318
mov esi, dword [ebp - 0x82c]
imul esi, dword [ebp - 0xd60]
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1000fd18
push dword [eax]
lea ecx, [ebp - 0xb44]
call fcn.1000fd18
cmp esi, dword [eax]
je 0x1004adb4
mov dword [ebp - 0x98c], 1
jmp 0x1004adbb
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x94]
inc eax
push eax
lea ecx, [ebp - 0xdf0]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [ebp - 0x98c]
jg 0x1004ade4
mov dword [ebp - 0x834], 1
jmp 0x1004adeb
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x834], eax
jle 0x1004ae05
mov dword [ebp - 0xa44], 1
jmp 0x1004ae0c
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xa44]
add eax, 0xe65c
jne 0x1004ae2b
cmp dword [ebp - 0x844], 0
jne 0x1004ae2b
and dword [ebp - 0x83c], 0
jmp 0x1004ae35
mov dword [ebp - 0x83c], 1
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 0
je 0x1004ae51
cmp dword [ebp - 0x94], 0
mov eax, 0x81d5f49d
test eax, eax
jne 0x1004ae6c
cmp dword [ebp - 0x844], 0
jne 0x1004ae6c
and dword [ebp - 0xc1c], 0
jmp 0x1004ae76
mov dword [ebp - 0xc1c], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x10a8], eax
mov eax, dword [ebp - 0x94]
inc eax
push eax
lea ecx, [ebp - 0xdf0]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x84c], eax
push 0
lea ecx, [ebp - 0xdf0]
call fcn.1000fd18
mov ecx, dword [ebp - 0x84c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0xd28], eax
cmp dword [ebp - 0xfc], 0
je 0x1004aed5
jmp 0x1004aeda
jmp 0x1004ad2c
jmp 0x1004accf
mov dword [ebp - 0x1f0], 1
jmp 0x1004aef8
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1004af2b
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xb44]
call fcn.1000fd18
mov esi, eax
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb44]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1004aeeb
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xb2c]
call fcn.1000fcfc
jmp 0x1004ac2b
jmp 0x1004abba
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xdf0]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb44]
call fcn.1000fcfc
mov eax, dword [0x106df4ac]
cmp eax, dword [ebp - 0x308]
je 0x1004af7c
mov eax, dword [0x106df67c]
cmp eax, dword [ebp - 0x308]
jne 0x1004af94
mov ecx, dword [ebp + 0xc]
call fcn.1000faa9
push eax
push dword [ebp + 8]
call fcn.1003fa74
pop ecx
pop ecx
jmp 0x1004e5de
mov dword [ebp - 0x30], 0xdb58e469
mov dword [ebp - 0x5c8], 0xfffffff7
mov dword [ebp - 0xc2c], 0xd66de6b9
mov dword [ebp - 0xd30], 0
mov dword [ebp - 0x3e8], 0
jmp 0x1004afd2
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 4
jge 0x1004afee
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x1114], 0xe45bbbde
jmp 0x1004afc5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jl 0x1004b011
mov dword [ebp - 0x99c], 1
jmp 0x1004b018
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x99c], eax
jle 0x1004b02f
mov dword [ebp - 0x854], 1
jmp 0x1004b036
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x854]
jne 0x1004b04d
mov dword [ebp - 0x5c0], 1
jmp 0x1004b054
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x5d0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5d0]
mov dword [ebp + eax - 0x1114], ecx
cmp dword [ebp - 0x5d0], 0x98f0
je 0x1004b09d
mov eax, 0xa5bc
test eax, eax
jne 0x1004b09d
and dword [ebp - 0x5d8], 0
jmp 0x1004b0a7
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x5d8], eax
jge 0x1004b0be
mov dword [ebp - 0xc24], 1
jmp 0x1004b0c5
and dword [ebp - 0xc24], 0
cmp dword [ebp - 0x30], 0x63b0
je 0x1004b0da
mov dword [ebp - 0xd8c], 1
jmp 0x1004b0e1
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10d0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1114]
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf54], eax
cmp dword [ebp - 0xc2c], 0x97f0
jl 0x1004b11d
mov dword [ebp - 0x5e0], 1
jmp 0x1004b124
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
je 0x1004e52d
mov eax, dword [ebp - 0x390]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1004e52d
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0x18], 0x45fe46c2
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x380], 0xf5f40e13
mov dword [ebp - 0x600], 0x1054d814
push 1
lea ecx, [ebp - 0x494]
call fcn.1000fc7a
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x1f8], 0xfffffffd
mov dword [ebp - 0x460], 0xfffffffa
mov dword [ebp - 0x9c], 0
jmp 0x1004b1d0
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1004b1f2
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov dword [eax], 0xfffffff8
jmp 0x1004b1c3
mov dword [ebp - 0x9c], 0
jmp 0x1004b20b
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1004b227
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xa20], 0xfffffffd
jmp 0x1004b1fe
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf60], eax
mov eax, 0xb6a7
test eax, eax
je 0x1004b25a
cmp dword [ebp - 0x3c8], 0
je 0x1004b25a
mov dword [ebp - 0x5e8], 1
jmp 0x1004b261
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jne 0x1004b2a0
cmp dword [ebp - 0x18], 0
jne 0x1004b2a0
cmp dword [ebp - 0x380], 0
jne 0x1004b2a0
cmp dword [ebp - 0x380], 0
jne 0x1004b2a0
mov eax, 0x237
test eax, eax
jne 0x1004b2a0
and dword [ebp - 0x5f0], 0
jmp 0x1004b2aa
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5f0]
neg eax
cmp dword [ebp - 0xa4], eax
jle 0x1004b2d3
mov dword [ebp - 0xc34], 1
jmp 0x1004b2da
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf68], eax
mov eax, 0x9da97273
neg eax
cmp eax, dword [ebp - 0x18]
jle 0x1004b2fb
mov dword [ebp - 0x5f8], 1
jmp 0x1004b302
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x600], eax
mov esi, dword [ebp - 0x600]
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
cmp esi, dword [eax]
jle 0x1004b340
mov dword [ebp - 0x608], 1
jmp 0x1004b347
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov ecx, dword [ebp - 0x608]
cmp ecx, dword [eax]
jne 0x1004b36a
mov dword [ebp - 0xd68], 1
jmp 0x1004b371
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xf70], eax
mov esi, dword [ebp - 0x3c8]
mov edi, dword [ebp - 0xa4]
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
add edi, dword [eax]
cmp edi, esi
jg 0x1004b3a8
mov dword [ebp - 0x610], 1
jmp 0x1004b3af
and dword [ebp - 0x610], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov ecx, dword [ebp - 0x610]
cmp ecx, dword [eax]
jl 0x1004b3d2
mov dword [ebp - 0x618], 1
jmp 0x1004b3d9
and dword [ebp - 0x618], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov ecx, dword [ebp - 0x618]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1004b40e
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x1004b40e
and dword [ebp - 0x620], 0
jmp 0x1004b418
mov dword [ebp - 0x620], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x620]
imul ecx, dword [ebp + eax - 0xa20]
test ecx, ecx
je 0x1004b450
mov dword [ebp - 0x628], 7
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
jmp 0x1004b5c1
mov dword [ebp - 0x640], 0xce43c7d7
mov dword [ebp - 0xf50], 0xffffffff
mov dword [ebp - 0xf80], 0x2fc3c737
mov dword [ebp - 0xf88], 0xb9349714
mov dword [ebp - 0xf90], 0x29358db
mov dword [ebp - 0xf98], 0x25d0bc5d
mov dword [ebp - 0xfa0], 1
mov dword [ebp - 0xfc4], 0xbc3393a3
mov dword [ebp - 0xfcc], 0
mov dword [ebp - 0xa4], 0
jmp 0x1004b4c3
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1004b5b4
mov dword [ebp - 0x480], 0xfffffffb
mov dword [ebp - 0xd38], 0
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1004b51f
push 0x6a0
push 0x95e
push 0x178b
push 0x117d
push 0x12d4
push 0x25a0
push 0x2679
call dword [sym.imp.GDI32.dll_RoundRect]
cmp dword [ebp - 0x480], 0
je 0x1004b53d
cmp dword [ebp - 0x480], 0
je 0x1004b53d
mov dword [ebp - 0x630], 1
jmp 0x1004b544
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x630], eax
je 0x1004b564
cmp dword [ebp - 0xa4], 0
jne 0x1004b564
and dword [ebp - 0x638], 0
jmp 0x1004b56e
mov dword [ebp - 0x638], 1
cmp dword [ebp - 0x638], 1
jl 0x1004b583
mov dword [ebp - 0xc3c], 1
jmp 0x1004b58a
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0xfd4], eax
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0xd38], eax
jmp 0x1004b4b6
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x18], 0
jmp 0x1004b5d1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1004b882
mov dword [ebp - 0xfdc], 0xfffffffd
mov dword [ebp - 0x660], 0x8c85c7ee
mov dword [ebp - 0xd90], 0x7477
mov dword [ebp - 0xc4c], 0
mov dword [ebp - 0x388], 0
jmp 0x1004b61c
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jge 0x1004b638
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x404], 0xe38f9461
jmp 0x1004b60f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa20], 0
je 0x1004b809
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa20], 0xfffffffd
jl 0x1004b662
mov dword [ebp - 0xc44], 1
jmp 0x1004b669
and dword [ebp - 0xc44], 0
mov eax, 0xb7f3
test eax, eax
jge 0x1004b67e
mov dword [ebp - 0x648], 1
jmp 0x1004b685
and dword [ebp - 0x648], 0
push 0
lea ecx, [ebp - 0x494]
call fcn.1000fd18
mov ecx, dword [ebp - 0x648]
cmp ecx, dword [eax]
jg 0x1004b6a8
mov dword [ebp - 0x650], 1
jmp 0x1004b6af
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x650], eax
jne 0x1004b6c9
mov dword [ebp - 0x658], 1
jmp 0x1004b6d0
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x660], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x660]
sub ecx, dword [ebp - 0x1f8]
cmp ecx, dword [ebp + eax - 0x404]
jl 0x1004b703
mov dword [ebp - 0x668], 1
jmp 0x1004b70a
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x460]
imul ecx, dword [ebp - 0x668]
cmp ecx, dword [ebp + eax - 0x404]
jg 0x1004b73f
mov dword [ebp - 0x670], 1
jmp 0x1004b746
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x670]
cmp eax, 0xd378
jg 0x1004b762
mov dword [ebp - 0x678], 1
jmp 0x1004b769
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0x1f16
jge 0x1004b781
mov dword [ebp - 0x680], 1
jmp 0x1004b788
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x680], eax
je 0x1004b7a2
mov dword [ebp - 0x688], 1
jmp 0x1004b7a9
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xd90]
cmp dword [ebp - 0x688], eax
jne 0x1004b7c3
mov dword [ebp - 0x690], 1
jmp 0x1004b7ca
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x690]
jl 0x1004b7e8
xor eax, eax
je 0x1004b7e8
mov dword [ebp - 0x698], 1
jmp 0x1004b7ef
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0xc4c]
cmp dword [ebp - 0x698], eax
jl 0x1004b809
mov dword [ebp - 0x6a0], 1
jmp 0x1004b810
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa20]
cmp eax, dword [ebp - 0x6a0]
jl 0x1004b82e
mov dword [ebp - 0x6a8], 1
jmp 0x1004b835
and dword [ebp - 0x6a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp dword [ebp - 0x6a8], eax
je 0x1004b863
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa20], 0
je 0x1004b863
mov dword [ebp - 0x6b0], 1
jmp 0x1004b86a
and dword [ebp - 0x6b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6b0]
mov dword [ebp + eax - 0x404], ecx
jmp 0x1004b5ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x494]
call fcn.1000fcfc
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x390]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x22c]
cmp dword [eax], 0x4550
jne 0x1004e52d
mov eax, dword [ebp - 0x22c]
cmp dword [eax + 0x74], 0
jbe 0x1004e52d
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
cmp dword [ecx + eax + 0x78], 0
je 0x1004e52d
push 3
lea ecx, [ebp - 0x290]
call fcn.1000fc7a
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x24], 0xf57a7c2
push 4
lea ecx, [ebp - 0xce8]
call fcn.1000fc7a
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x720], 0xfffffff9
mov dword [ebp - 0xac], 0
jmp 0x1004b92e
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1004b950
push dword [ebp - 0xac]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov dword [eax], 0x77862fd4
jmp 0x1004b921
mov dword [ebp - 0xac], 0
jmp 0x1004b969
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1004b98b
push dword [ebp - 0xac]
lea ecx, [ebp - 0xce8]
call fcn.1000fd18
mov dword [eax], 0xc99cdf9c
jmp 0x1004b95c
mov dword [ebp - 0x24], 2
jmp 0x1004b99b
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1004bb21
mov dword [ebp - 0xf4c], 0x5ac3d6c1
mov dword [ebp - 0xf48], 0x5ac3d6c1
mov dword [ebp - 0xf44], 0x5ac3d6c1
mov dword [ebp - 0xf40], 0x5ac3d6c1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1004b9fd
mov dword [ebp - 0x6c0], 1
jmp 0x1004ba04
and dword [ebp - 0x6c0], 0
push 2
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov esi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov edi, dword [eax]
imul edi, dword [esi]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
cmp edi, dword [eax]
je 0x1004ba44
mov dword [ebp - 0x6b8], 1
jmp 0x1004ba4b
and dword [ebp - 0x6b8], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov ecx, dword [ebp - 0x6b8]
cmp ecx, dword [eax]
jne 0x1004ba82
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
cmp dword [eax], 0
je 0x1004ba82
mov dword [ebp - 0x6c8], 1
jmp 0x1004ba89
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c0]
cmp eax, dword [ebp - 0x6c8]
jge 0x1004baa3
mov dword [ebp - 0x6d0], 1
jmp 0x1004baaa
and dword [ebp - 0x6d0], 0
push 2
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov esi, dword [ebp - 0x6d0]
add esi, dword [eax]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
add esi, dword [eax]
mov dword [ebp - 0x6d8], esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov ecx, dword [ebp - 0x6d8]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xce8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x6d8]
mov dword [eax], ecx
push 4
pop esi
shl esi, 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [ebp + esi - 0xf4c], eax
jmp 0x1004b994
push 2
lea ecx, [ebp - 0x290]
call fcn.1000fd18
cmp dword [eax], 0
je 0x1004bd11
mov dword [ebp - 0xd40], 0xedbec151
mov dword [ebp - 0xfe4], 0xcd43a1e2
mov dword [ebp - 0x3d0], 0
jmp 0x1004bb64
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 2
jge 0x1004bb80
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0x4d0], 1
jmp 0x1004bb57
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4d0], 0
jne 0x1004bb9c
mov dword [ebp - 0x6e0], 1
jmp 0x1004bba3
and dword [ebp - 0x6e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d0]
cmp dword [ebp - 0x6e0], eax
jne 0x1004bbd3
push 3
lea ecx, [ebp - 0xce8]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x1004bbd3
and dword [ebp - 0x6e8], 0
jmp 0x1004bbdd
mov dword [ebp - 0x6e8], 1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x6e8]
jne 0x1004bbf4
mov dword [ebp - 0x6f0], 1
jmp 0x1004bbfb
and dword [ebp - 0x6f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d0]
cmp dword [ebp - 0x6f0], eax
jge 0x1004bc1c
mov dword [ebp - 0x6f8], 1
jmp 0x1004bc23
and dword [ebp - 0x6f8], 0
mov esi, dword [ebp - 0x6f8]
add esi, 0x17b4d2ca
push 1
lea ecx, [ebp - 0xce8]
call fcn.1000fd18
cmp dword [eax], esi
jl 0x1004bc4c
mov dword [ebp - 0x700], 1
jmp 0x1004bc53
and dword [ebp - 0x700], 0
push 0
lea ecx, [ebp - 0x290]
call fcn.1000fd18
mov ecx, dword [ebp - 0x700]
add ecx, dword [eax]
cmp ecx, 0xfffffff9
jge 0x1004bc82
mov eax, 0x2e25
test eax, eax
je 0x1004bc82
mov dword [ebp - 0x708], 1
jmp 0x1004bc89
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xffffffff
jl 0x1004bc9e
mov dword [ebp - 0x710], 1
jmp 0x1004bca5
and dword [ebp - 0x710], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4d0]
add ecx, dword [ebp - 0x710]
imul ecx, dword [ebp + eax - 0x4d0]
test ecx, ecx
jne 0x1004bcec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4d0], 0
jne 0x1004bcec
mov eax, 0x8cd9
test eax, eax
jne 0x1004bcec
and dword [ebp - 0x718], 0
jmp 0x1004bcf6
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
jmp 0x1004bd2f
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x1004bd2f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xce8]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.1000fcfc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x74], 0
push 1
lea ecx, [ebp - 0xcf8]
call fcn.1000fc7a
mov dword [ebp - 4], 0x2d
push 2
lea ecx, [ebp - 0xefc]
call fcn.1000fc7a
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0xfec], 0x725ac950
mov dword [ebp - 0xb4], 0
jmp 0x1004bda5
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1004bdc7
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xcf8]
call fcn.1000fd18
mov dword [eax], 0x59dba5c1
jmp 0x1004bd98
mov dword [ebp - 0xb4], 0
jmp 0x1004bde0
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1004bdff
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xefc]
call fcn.1000fd18
or dword [eax], 0xffffffff
jmp 0x1004bdd3
mov dword [ebp - 0x74], 0
jmp 0x1004be0f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x15
jl 0x1004c1d4
mov dword [ebp - 0x200], 2
mov dword [ebp - 0xe18], 4
mov dword [ebp - 0xe14], 4
mov dword [ebp - 0xe10], 4
mov dword [ebp - 0xe0c], 4
mov dword [ebp - 0xc5c], 0xbfef
mov dword [ebp - 0x788], 0x5e5316d0
mov dword [ebp - 0x770], 1
mov dword [ebp - 0xff4], 0xfffffffe
mov dword [ebp - 0x1084], 6
mov dword [ebp - 0x108c], 1
mov dword [ebp - 0x1094], 0xbc72ea12
mov dword [ebp - 0x109c], 3
mov dword [ebp - 0x10a4], 0x9e59fa6b
push 1
lea ecx, [ebp - 0x1034]
call fcn.1000fc7a
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x10ac], 1
mov dword [ebp - 0x7a0], 1
mov dword [ebp - 0x398], 0
jmp 0x1004bee3
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jge 0x1004bf02
push dword [ebp - 0x398]
lea ecx, [ebp - 0x1034]
call fcn.1000fd18
or dword [eax], 0xffffffff
jmp 0x1004bed6
cmp dword [ebp - 0x200], 0
je 0x1004bf1d
cmp dword [ebp - 0x74], 0
je 0x1004bf1d
mov dword [ebp - 0x728], 1
jmp 0x1004bf24
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x74], 1
jg 0x1004bf36
mov dword [ebp - 0x730], 1
jmp 0x1004bf3d
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x728]
cmp eax, dword [ebp - 0x730]
jle 0x1004bf4f
cmp dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x10b4], eax
cmp dword [ebp - 0x74], 0
je 0x1004bf6a
mov dword [ebp - 0x738], 1
jmp 0x1004bf71
and dword [ebp - 0x738], 0
imul eax, dword [ebp - 0x738], 0xffffffff
test eax, eax
jne 0x1004bf8e
mov eax, 0xd1dc6b79
test eax, eax
jne 0x1004bf8e
and dword [ebp - 0x740], 0
jmp 0x1004bf98
mov dword [ebp - 0x740], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x740]
neg ecx
cmp ecx, dword [ebp + eax - 0xe18]
jge 0x1004bfbb
mov dword [ebp - 0x748], 1
jmp 0x1004bfc2
and dword [ebp - 0x748], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x748]
shl ecx, 3
imul ecx, dword [ebp + eax - 0xe18]
cmp ecx, 0xeffb
jl 0x1004c0ec
mov dword [ebp - 0xc54], 1
mov dword [ebp - 0xd70], 4
mov dword [ebp - 0x200], 0xfffffffc
jmp 0x1004c012
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x19
jge 0x1004c0dd
mov dword [ebp - 0x3f0], 0x650dfa01
mov dword [ebp - 0x758], 0x4307976b
cmp dword [ebp - 0x74], 0
je 0x1004c04e
cmp dword [ebp - 0x3f0], 0
je 0x1004c04e
mov dword [ebp - 0x750], 1
jmp 0x1004c055
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0x10bc], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x10c4], eax
mov eax, 0x5e19f8c5
test eax, eax
je 0x1004c08b
mov eax, 0x9bfaead2
test eax, eax
je 0x1004c08b
mov dword [ebp - 0x760], 1
jmp 0x1004c092
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x3f0]
add eax, dword [ebp - 0x758]
imul eax, dword [ebp - 0x760]
mov dword [ebp - 0x768], eax
push 0
lea ecx, [ebp - 0xcf8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x768]
mov dword [eax], ecx
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x3f0], eax
jmp 0x1004c005
mov dword [ebp - 0xd70], 0
jmp 0x1004c1b3
mov dword [ebp - 0x780], 0x251f
push 0
lea ecx, [ebp - 0xcf8]
call fcn.1000fd18
mov dword [eax], 0x231966ba
mov dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0
je 0x1004c131
cmp dword [ebp - 0x780], 0
je 0x1004c131
mov dword [ebp - 0x778], 1
jmp 0x1004c138
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0xfffa
ja 0x1004c151
push 0
lea ecx, [ebp - 0xcf8]
call fcn.1000fd18
cmp dword [ebp - 0x780], 5
jle 0x1004c166
mov dword [ebp - 0x790], 1
jmp 0x1004c16d
and dword [ebp - 0x790], 0
mov dword [ebp - 0x788], 0x69e8
mov eax, dword [ebp - 0xc5c]
sub eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x790]
jne 0x1004c197
mov dword [ebp - 0x798], 1
jmp 0x1004c19e
and dword [ebp - 0x798], 0
push 1
lea ecx, [ebp - 0xefc]
call fcn.1000fd18
mov ecx, dword [ebp - 0x798]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1034]
call fcn.1000fcfc
jmp 0x1004be08
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xefc]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf8]
call fcn.1000fcfc
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x1c8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x114], edx
mov eax, 0xffff
mov word [ebp - 0x98], ax
mov dword [ebp - 0x298], 0
jmp 0x1004c233
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1004c24f
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xdd8], 0xffffffff
jmp 0x1004c226
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdd8], 0
jmp 0x1004c27d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdd8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xdd8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdd8], 0xfffffff4
jle 0x1004c2d2
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x1004c2a7
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x1004c2d0
push 0x57b
push 0xc6
push 0xbfd
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1004c262
or dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x16c], 0x7f6af112
mov dword [ebp - 0x16c], 0
jmp 0x1004c2fc
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xfffffff1
jge 0x1004c327
mov dword [ebp - 0xd48], 0x9c5a654f
cmp dword [ebp - 0x16c], 0
je 0x1004c31a
jmp 0x1004c327
cmp dword [ebp - 0xd48], 0
je 0x1004c325
jmp 0x1004c327
jmp 0x1004c2ef
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x16c], eax
cmp dword [ebp + 0x10], 0
jbe 0x1004c75d
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1004c758
push 2
lea ecx, [ebp - 0x4c8]
call fcn.1000fc7a
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x174], 0xbb743d83
mov dword [ebp - 0xbc], 0
jmp 0x1004c386
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1004c3a8
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
mov dword [eax], 0xfffa
jmp 0x1004c379
mov dword [ebp - 0xbc], 0
jmp 0x1004c3c1
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1004c3dd
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xc64], 0xffffffff
jmp 0x1004c3b4
mov dword [ebp - 0x174], 1
jmp 0x1004c3f6
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x1004c73e
mov dword [ebp - 0x7f0], 0xfffffffa
mov dword [ebp - 0xc6c], 0xe7587697
mov dword [ebp - 0x2a0], 0
jmp 0x1004c430
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1004c449
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x20], 0xfe1ca296
jmp 0x1004c423
mov byte [ebp - 0x18f], 0
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x1004c461
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20], 1
jmp 0x1004c486
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jl 0x1004c739
mov dword [ebp - 0x17c], 0xfffffff6
mov dword [ebp - 0x17c], 1
jmp 0x1004c4ba
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1004c734
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1004c4f0
push 0x16ff
push 0
push 0xccf
push 0x1c1a
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x10d8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x17c]
imul edx, dword [ebp + ecx - 0x20]
cmp edx, dword [ebp + eax - 0x20]
jle 0x1004c525
mov dword [ebp - 0x7a8], 1
jmp 0x1004c52c
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x7a8]
jg 0x1004c546
mov dword [ebp - 0x7b0], 1
jmp 0x1004c54d
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x7b0], eax
jle 0x1004c567
mov dword [ebp - 0x7b8], 1
jmp 0x1004c56e
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x7b8]
cmp ecx, dword [eax]
jge 0x1004c599
mov dword [ebp - 0x7c0], 1
jmp 0x1004c5a0
and dword [ebp - 0x7c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
imul eax, dword [ebp - 0x7c0]
mov ecx, dword [ebp - 0x174]
imul ecx, eax
test ecx, ecx
jne 0x1004c5d0
mov eax, 0xab6c
test eax, eax
jne 0x1004c5d0
and dword [ebp - 0x7c8], 0
jmp 0x1004c5da
mov dword [ebp - 0x7c8], 1
cmp dword [ebp - 0x7c8], 0xa812c005
ja 0x1004c5f2
mov dword [ebp - 0x7d0], 1
jmp 0x1004c5f9
and dword [ebp - 0x7d0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7d0]
mov dword [ebp + eax - 0xc64], ecx
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
cmp dword [eax], 0x7cd95329
jne 0x1004c64a
mov dword [ebp - 0x7d8], 1
jmp 0x1004c651
and dword [ebp - 0x7d8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
mov esi, dword [ebp - 0x7d8]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
cmp esi, dword [eax]
jge 0x1004c68b
mov dword [ebp - 0xd98], 1
jmp 0x1004c692
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x10e0], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
cmp dword [eax], 7
jle 0x1004c6c4
mov dword [ebp - 0x7e0], 1
jmp 0x1004c6cb
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
mov esi, dword [ebp - 0x7e0]
sub esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x4c8]
call fcn.1000fd18
cmp esi, dword [eax]
jne 0x1004c70d
mov dword [ebp - 0x7e8], 1
jmp 0x1004c714
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
sub eax, 4
mov dword [ebp - 0xc6c], eax
jmp 0x1004c4ad
jmp 0x1004c471
jmp 0x1004c3e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.1000fcfc
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x1004d6ce
push 2
lea ecx, [ebp - 0x1054]
call fcn.1000fc7a
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x208], 1
and dword [ebp - 0xe3c], 0
and dword [ebp - 0xe38], 0
and dword [ebp - 0xe34], 0
and dword [ebp - 0xe30], 0
lea ecx, [ebp - 0x461]
call fcn.1000fd27
push eax
lea eax, [ebp - 0xe2c]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea ecx, [ebp - 0x11a0]
call fcn.1000fd2a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1044]
call fcn.1000fcd6
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x2a8], 0
jmp 0x1004c7e9
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1004c808
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x1054]
call fcn.1000fd18
or dword [eax], 0xffffffff
jmp 0x1004c7dc
mov dword [ebp - 0x208], 0
jmp 0x1004c821
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jg 0x1004c886
mov dword [ebp - 0x10e8], 0x6f97
cmp dword [ebp - 0x208], 1
je 0x1004c849
mov dword [ebp - 0x7f8], 1
jmp 0x1004c850
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0x8f1e0c86
jne 0x1004c868
mov dword [ebp - 0x800], 1
jmp 0x1004c86f
and dword [ebp - 0x800], 0
push 2
lea ecx, [ebp - 0x1044]
call fcn.1000fd18
mov ecx, dword [ebp - 0x800]
mov dword [eax], ecx
jmp 0x1004c814
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1044]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1054]
call fcn.1000fcfc
mov dword [ebp - 0x4c], 0xe83c7730
mov dword [ebp - 0x2b0], 0
jmp 0x1004c8c4
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1004c8e0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x1064], 0xffffffff
jmp 0x1004c8b7
mov dword [ebp - 0x4c], 0
jmp 0x1004c8f0
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1004c945
mov dword [ebp - 0x2b8], 0x532bb11a
mov dword [ebp - 0x2b8], 2
jmp 0x1004c919
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1004c943
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1004c941
push 0
push 0x19e2
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x1004c90c
jmp 0x1004c8e9
mov dword [ebp - 0x4c], 0
jmp 0x1004c955
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1004c979
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x1064]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + ecx*4 - 0x1064], eax
cmp dword [ebp - 0x4c], 0
je 0x1004c977
jmp 0x1004c94e
jmp 0x1004c94e
mov eax, dword [0x106df5d8]
and eax, 1
jne 0x1004c9b0
mov eax, dword [0x106df5d8]
or eax, 1
mov dword [0x106df5d8], eax
mov dword [ebp - 4], 0x33
mov ecx, 0x106df5fc
call fcn.1003abfd
push 0x1007371f
call fcn.1005b293
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0xc7c], 0x7812a3cc
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x7c], 0
jmp 0x1004c9e2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x10
jne 0x1004cc48
mov dword [ebp - 0x808], 0x470d
mov dword [ebp - 0xd00], 0x100093a8
cmp dword [ebp - 0x808], 0x47be
jle 0x1004cabb
and dword [ebp - 0x2c0], 0
jmp 0x1004ca26
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x52db
jge 0x1004cabb
and dword [ebp - 0x2c8], 0
jmp 0x1004ca4c
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x3d15
jge 0x1004cab6
and dword [ebp - 0x2d0], 0
jmp 0x1004ca6e
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x7af4
jge 0x1004cab4
mov eax, dword [ebp - 0x2c0]
cdq
idiv dword [ebp - 0x2c8]
and edx, dword [ebp - 0x2d0]
mov eax, edx
cdq
mov dword [ebp - 0xbfc], eax
mov dword [ebp - 0xbf8], edx
push dword [ebp - 0xbf8]
push dword [ebp - 0xbfc]
mov ecx, 0x1061ae38
call fcn.1002b61d
jmp 0x1004ca61
jmp 0x1004ca3f
jmp 0x1004ca19
mov dword [ebp - 0x49c], 0x91e6
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x808], 0x4550
jge 0x1004cae8
mov edx, dword [ebp - 0xd00]
mov ecx, 0x1061ae38
call fcn.1002cd18
jmp 0x1004cb04
or dword [ebp - 4], 0xffffffff
jmp 0x1004cb0e
mov dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x848], 0x1b713623
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10ec], eax
cmp dword [ebp - 0x7c], 0x15aa961
jge 0x1004cb40
mov dword [ebp - 0x810], 1
jmp 0x1004cb47
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0x49c]
dec eax
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0xc74]
cmp eax, dword [ebp - 0xd04]
jge 0x1004cb92
mov dword [ebp - 0x820], 1
jmp 0x1004cb99
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x214]
jge 0x1004cbb0
mov dword [ebp - 0x828], 1
jmp 0x1004cbb7
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0xc7c]
imul eax, dword [ebp - 0x820]
imul eax, dword [ebp - 0x828]
cmp eax, dword [ebp - 0x214]
jl 0x1004cbdf
mov dword [ebp - 0x830], 1
jmp 0x1004cbe6
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x830], eax
jl 0x1004cbfd
mov dword [ebp - 0x838], 1
jmp 0x1004cc04
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x838], eax
jne 0x1004cc1e
mov dword [ebp - 0x840], 1
jmp 0x1004cc25
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x848]
mov dword [ebp - 0x848], eax
jmp 0x1004c9db
movzx eax, byte [0x106df4a5]
test eax, eax
je 0x1004d15e
mov ecx, 0x106df5fc
call fcn.10052592
movzx eax, al
test eax, eax
jne 0x1004d15e
mov dword [ebp - 0x1a8], 0xd5493e6
mov dword [ebp - 0x2d8], 0
jmp 0x1004cc8f
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1004ccab
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x84], 1
jmp 0x1004cc82
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x84], 0xffffffef
jmp 0x1004ccd9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0x1d
jg 0x1004ce23
mov dword [ebp - 0x860], 0x4c59cdc3
mov dword [ebp - 0x468], 0xb6fd43dd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
mov dword [ebp - 0x1070], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x84]
cmp ecx, dword [ebp + eax - 0x84]
jg 0x1004cd3c
mov dword [ebp - 0x850], 1
jmp 0x1004cd43
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x850], eax
jl 0x1004cd5d
mov dword [ebp - 0x858], 1
jmp 0x1004cd64
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 2
jl 0x1004cd7f
mov eax, 0xf12f
test eax, eax
jne 0x1004cd7f
and dword [ebp - 0x868], 0
jmp 0x1004cd89
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x860], 0x37a5
mov eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x868]
jl 0x1004cdad
mov dword [ebp - 0x870], 1
jmp 0x1004cdb4
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
add eax, dword [ebp - 0x870]
cmp eax, 0x466e9f08
jg 0x1004cdda
mov dword [ebp - 0x878], 1
jmp 0x1004cde1
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x1a8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x84]
imul ecx, dword [ebp - 0x1a8]
imul ecx, dword [ebp - 0x468]
neg ecx
imul ecx, dword [ebp + eax - 0x84]
mov dword [ebp - 0x468], ecx
jmp 0x1004ccbe
mov dword [ebp - 0x1a8], 0
jmp 0x1004ce3c
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x24
jge 0x1004ce61
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x1004ce5f
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1004ce2f
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x898]
push eax
mov ecx, 0x106df5fc
call fcn.1003ab1e
push 1
lea ecx, [ebp - 0xb00]
call fcn.1000fc7a
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0x2e0], 0
jmp 0x1004ceba
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x1004cedc
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
mov dword [eax], 0x6834504c
jmp 0x1004cead
push 0
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x1004cf28
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1004cf23
push 1
push 0x2a5
push 0x1bd5
push 0x1bc
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x1004d053
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x21c], 0xffffffff
mov byte [ebp - 0x18b], 0
movzx eax, byte [ebp - 0x18b]
test eax, eax
je 0x1004cf59
push 0x2f4
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x10d4], eax
cmp dword [ebp - 0x21c], 0
jge 0x1004cf7a
mov dword [ebp - 0x880], 1
jmp 0x1004cf81
and dword [ebp - 0x880], 0
push 0
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
mov ecx, dword [ebp - 0x880]
add ecx, dword [eax]
cmp dword [ebp - 0x21c], ecx
je 0x1004cfaa
mov dword [ebp - 0x888], 1
jmp 0x1004cfb1
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x1b0], 0
jne 0x1004cfcd
cmp dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 6
jge 0x1004cfee
mov dword [ebp - 0xd0c], 1
jmp 0x1004cff5
and dword [ebp - 0xd0c], 0
push 0
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x488], eax
mov esi, dword [ebp - 0x488]
push 0
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
cmp esi, dword [eax]
jg 0x1004d031
mov dword [ebp - 0x890], 1
jmp 0x1004d038
and dword [ebp - 0x890], 0
push 0
lea ecx, [ebp - 0xb00]
call fcn.1000fd18
mov ecx, dword [ebp - 0x890]
add ecx, dword [eax]
mov dword [ebp - 0xc84], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb00]
call fcn.1000fcfc
lea eax, [ebp - 0x10b0]
push eax
mov ecx, 0x106df5fc
call fcn.1002b790
push eax
lea ecx, [ebp - 0x898]
call fcn.1003abea
movzx eax, al
test eax, eax
je 0x1004d15e
mov dword [ebp - 0x2e8], 0x82062403
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1004d0b0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x2e8], 0xfffffff1
jmp 0x1004d0c9
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x10
jne 0x1004d14a
mov dword [ebp - 0x2f8], 8
mov dword [ebp - 0x2f0], 0
jmp 0x1004d0f5
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1004d111
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1150], 3
jmp 0x1004d0e8
mov dword [ebp - 0x2f8], 2
jmp 0x1004d12a
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jl 0x1004d145
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1150], 2
jmp 0x1004d11d
jmp 0x1004d0bc
lea ecx, [ebp - 0x898]
call fcn.1005259b
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c0], eax
push 2
lea ecx, [ebp - 0x504]
call fcn.1000fc7a
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x80], 0xbdba76aa
mov dword [ebp - 0xd1c], 0xffffffff
push 2
lea ecx, [ebp - 0xf14]
call fcn.1000fc7a
mov byte [ebp - 4], 0x38
mov dword [ebp - 0xc4], 0
jmp 0x1004d1ad
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1004d1cf
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov dword [eax], 9
jmp 0x1004d1a0
mov dword [ebp - 0xc4], 0
jmp 0x1004d1e8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1004d20a
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xf14]
call fcn.1000fd18
mov dword [eax], 0x67bbda73
jmp 0x1004d1db
mov dword [ebp - 0x80], 1
jmp 0x1004d21a
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1004d484
push 3
lea ecx, [ebp - 0xad0]
call fcn.1000fc7a
mov byte [ebp - 4], 0x39
mov dword [ebp - 0xd24], 0xffff
mov dword [ebp - 0xc9c], 8
mov dword [ebp - 0x300], 0
jmp 0x1004d262
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x1004d284
push dword [ebp - 0x300]
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
mov dword [eax], 0xe4b7834d
jmp 0x1004d255
push dword [ebp - 0x80]
lea ecx, [ebp - 0x504]
call fcn.1000fd18
cmp dword [eax], 0
jne 0x1004d2bb
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
cmp dword [eax], 0
je 0x1004d2b2
mov eax, 0xb76d
test eax, eax
jne 0x1004d2bb
and dword [ebp - 0x8b8], 0
jmp 0x1004d2c5
mov dword [ebp - 0x8b8], 1
push 2
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
cmp dword [eax], 0x700d
jle 0x1004d2e6
mov dword [ebp - 0x8a0], 1
jmp 0x1004d2ed
and dword [ebp - 0x8a0], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov ecx, dword [ebp - 0x8a0]
cmp ecx, dword [eax]
jg 0x1004d311
mov dword [ebp - 0x8a8], 1
jmp 0x1004d318
and dword [ebp - 0x8a8], 0
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
mov ecx, dword [ebp - 0x8a8]
cmp ecx, dword [eax]
jge 0x1004d33b
mov dword [ebp - 0x8b0], 1
jmp 0x1004d342
and dword [ebp - 0x8b0], 0
push 1
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov ecx, dword [ebp - 0x8b0]
cmp ecx, dword [eax]
jl 0x1004d365
mov dword [ebp - 0xd14], 1
jmp 0x1004d36c
and dword [ebp - 0xd14], 0
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
mov eax, 0xfdb7b241
add eax, 7
cmp dword [ebp - 0x8b8], eax
jle 0x1004d395
mov dword [ebp - 0xc8c], 1
jmp 0x1004d39c
and dword [ebp - 0xc8c], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov esi, eax
push 1
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [esi], eax
push 0
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov esi, eax
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1004d3eb
mov dword [ebp - 0x8c0], 1
jmp 0x1004d3f2
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
neg eax
imul eax, dword [ebp - 0x80]
mov dword [ebp - 0xd1c], eax
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000fd18
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x504]
call fcn.1000fd18
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x1004d433
mov dword [ebp - 0xc94], 1
jmp 0x1004d43a
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0xf5c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8c8], eax
push 0
lea ecx, [ebp - 0xf14]
call fcn.1000fd18
mov ecx, dword [ebp - 0x8c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0xc9c], eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xad0]
call fcn.1000fcfc
jmp 0x1004d213
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xf14]
call fcn.1000fcfc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x504]
call fcn.1000fcfc
cmp dword [ebp - 0x1c0], 0xffffffff
jne 0x1004d6ce
mov dword [ebp - 0xcc], 8
mov dword [ebp - 0xd34], 0x8f3d
mov dword [ebp - 0x8d0], 0xe790e864
mov dword [ebp - 0xcc], 8
jmp 0x1004d4e6
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x16
jne 0x1004d512
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1004d510
push 0
push 0x66c
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x1004d4d9
cmp dword [ebp - 0xcc], 0xfffffffc
jle 0x1004d527
mov dword [ebp - 0xd2c], 1
jmp 0x1004d52e
and dword [ebp - 0xd2c], 0
mov dword [ebp - 0x8d0], 0xfffffffd
mov eax, dword [ebp - 0x8d0]
cmp eax, dword [ebp - 0xcc]
je 0x1004d552
mov dword [ebp - 0x8d8], 1
jmp 0x1004d559
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8d8], eax
jl 0x1004d573
mov dword [ebp - 0x8e0], 1
jmp 0x1004d57a
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x8e0], eax
je 0x1004d594
mov dword [ebp - 0xca4], 1
jmp 0x1004d59b
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x1058], eax
xor eax, eax
add eax, 3
mov dword [ebp - 0xcc], eax
mov ecx, 0x106df5fc
call fcn.100525df
mov ecx, dword [ebp - 0x114]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106df5fc
call fcn.100525e3
and dword [ebp - 0x1b8], 0
jmp 0x1004d5e6
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x1b8]
cmp ecx, dword [eax + 0x18]
jae 0x1004d6ce
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x1c8]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1b8]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 0
je 0x1004d6c9
mov eax, dword [ebp - 0x8e8]
mov ecx, dword [ebp - 0x1c8]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1170]
call fcn.1000fb61
mov dword [ebp - 4], 0x3a
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1170]
call fcn.1003ba39
mov dword [ebp - 0x8f0], eax
movzx eax, byte [0x106df4a5]
test eax, eax
je 0x1004d677
mov ecx, 0x106df5fc
call fcn.10052592
movzx eax, al
test eax, eax
jne 0x1004d697
lea eax, [ebp - 0x8f0]
push eax
mov ecx, 0x106df5fc
call fcn.100525a1
mov ecx, dword [ebp - 0x1b8]
mov dword [eax], ecx
mov byte [0x106df4a5], 1
cmp dword [ebp - 0x1c0], 0xffffffff
jne 0x1004d6ba
mov eax, dword [ebp - 0x8f0]
cmp eax, dword [ebp - 0x308]
jne 0x1004d6ba
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1170]
call fcn.1000fbcc
jmp 0x1004d5d9
mov dword [ebp - 0x4e0], 0xda5043c4
mov dword [ebp - 0x4dc], 0xda5043c4
mov dword [ebp - 0x4d8], 0xda5043c4
mov dword [ebp - 0x4d4], 0xda5043c4
mov dword [ebp - 0xd4], 0x420452a2
mov dword [ebp - 0x104], 0x9ecf4a41
push 2
lea ecx, [ebp - 0x4f8]
call fcn.1000fc7a
mov dword [ebp - 4], 0x3b
mov dword [ebp - 0x224], 0x31fc5313
mov dword [ebp - 0x310], 0
jmp 0x1004d741
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x1004d763
push dword [ebp - 0x310]
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
mov dword [eax], 0x531f145b
jmp 0x1004d734
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x104]
jge 0x1004d789
mov dword [ebp - 0x8f8], 1
jmp 0x1004d790
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x8f8], eax
jne 0x1004d7aa
mov dword [ebp - 0x900], 1
jmp 0x1004d7b1
and dword [ebp - 0x900], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e0]
add eax, 0xe53e
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4e0]
add ecx, eax
mov dword [ebp - 0x908], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x908]
mov dword [ebp + eax - 0x4e0], ecx
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x900]
add ecx, dword [eax]
cmp dword [ebp - 0x908], ecx
jne 0x1004d814
mov dword [ebp - 0x910], 1
jmp 0x1004d81b
and dword [ebp - 0x910], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x910]
cmp ecx, dword [eax]
je 0x1004d83e
mov dword [ebp - 0x918], 1
jmp 0x1004d845
and dword [ebp - 0x918], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
mov esi, dword [ebp - 0x918]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
cmp esi, dword [eax]
jle 0x1004db0f
push 3
lea ecx, [ebp - 0xb20]
call fcn.1000fc7a
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x920], 0x54eb
mov dword [ebp - 0xb4c], 0x1000942c
cmp dword [ebp - 0x920], 0x56b6
jle 0x1004d944
and dword [ebp - 0x318], 0
jmp 0x1004d8ba
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x1a97
jge 0x1004d944
and dword [ebp - 0x320], 0
jmp 0x1004d8dc
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x270a
jge 0x1004d93f
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x320]
cdq
mov dword [ebp - 0xc08], eax
mov dword [ebp - 0xc04], edx
push dword [ebp - 0xc04]
push dword [ebp - 0xc08]
lea ecx, [ebp - 0x1230]
call fcn.1000ac1f
pop ecx
pop ecx
mov dword [ebp - 0xcac], eax
mov ecx, dword [ebp - 0xcac]
call fcn.1000faa9
push eax
call fcn.1005b2bd
pop ecx
lea ecx, [ebp - 0x1230]
call fcn.1000fa7a
jmp 0x1004d8cf
jmp 0x1004d8ad
mov byte [ebp - 4], 0x3d
cmp dword [ebp - 0x920], 0x5483
jge 0x1004d960
push dword [ebp - 0xb4c]
call fcn.1005b2bd
pop ecx
jmp 0x1004d97c
mov dword [ebp - 4], 0x3c
jmp 0x1004d98c
mov dword [ebp - 0x328], 0
jmp 0x1004d9a5
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x1004d9c7
push dword [ebp - 0x328]
lea ecx, [ebp - 0xb20]
call fcn.1000fd18
mov dword [eax], 0xe924
jmp 0x1004d998
push 2
pop eax
test eax, eax
je 0x1004daca
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x4e0], 0
je 0x1004da8e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4e0]
sub eax, dword [ebp - 0x104]
cmp eax, 0xfffffffb
jle 0x1004da09
mov dword [ebp - 0x928], 1
jmp 0x1004da10
and dword [ebp - 0x928], 0
push 2
lea ecx, [ebp - 0xb20]
call fcn.1000fd18
mov esi, dword [eax]
sub esi, dword [ebp - 0x928]
push 2
lea ecx, [ebp - 0xb20]
call fcn.1000fd18
cmp esi, dword [eax]
jg 0x1004da42
mov dword [ebp - 0x930], 1
jmp 0x1004da49
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0xfffffff6
jne 0x1004da5e
mov dword [ebp - 0xb50], 1
jmp 0x1004da65
and dword [ebp - 0xb50], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x4e0], 0
je 0x1004da8e
and dword [ebp - 0x938], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
mov ecx, dword [ebp - 0x938]
cmp ecx, dword [eax]
jne 0x1004daca
push 1
lea ecx, [ebp - 0xb20]
call fcn.1000fd18
cmp dword [eax], 0
je 0x1004daca
mov dword [ebp - 0xb58], 1
jmp 0x1004dad1
and dword [ebp - 0xb58], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000fd18
push 0
lea ecx, [ebp - 0xb20]
call fcn.1000fd18
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e0]
mov dword [ebp - 0x104], eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xb20]
call fcn.1000fcfc
jmp 0x1004db42
mov dword [ebp - 0xb60], 0xfffffffe
mov dword [ebp - 0x940], 5
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x940], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e0]
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x104], 0
jmp 0x1004db5b
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xa
je 0x1004dc2a
mov dword [ebp - 0xd4], 3
jmp 0x1004db81
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1004dbe2
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1004dbae
push 0x12b3
push 0x357
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x4e0]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0x4e0], ecx
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x224], eax
jmp 0x1004db74
mov dword [ebp - 0x224], 0
jmp 0x1004dbfb
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jg 0x1004dc25
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1004dc23
push 0
push 0x20b2
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1004dbee
jmp 0x1004db4e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f8]
call fcn.1000fcfc
cmp dword [ebp + 0x10], 0
jne 0x1004dc68
cmp dword [ebp - 0x1c0], 0xffffffff
je 0x1004dc68
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x1c8]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1c0]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x98], ax
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x10c], 0xfffffffd
mov dword [ebp - 0x560], 0xbadcab3
mov dword [ebp - 0x330], 0
jmp 0x1004dc9c
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x1004dcb8
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0xef0], 0x8aac
jmp 0x1004dc8f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x40], 0
je 0x1004e0d5
push 1
lea ecx, [ebp - 0xb38]
call fcn.1000fc7a
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x338], 0x844a7543
push 2
lea ecx, [ebp - 0xf2c]
call fcn.1000fc7a
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x428], 0xaaf0a9b2
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0xdc], 0
jmp 0x1004dd27
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x1004dd49
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xb38]
call fcn.1000fd18
mov dword [eax], 3
jmp 0x1004dd1a
mov dword [ebp - 0xdc], 0
jmp 0x1004dd62
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x1004dd84
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xf2c]
call fcn.1000fd18
mov dword [eax], 9
jmp 0x1004dd55
push 0
lea ecx, [ebp - 0xb38]
call fcn.1000fd18
cmp dword [eax], 0xe6f7fbf2
jne 0x1004dda5
mov dword [ebp - 0x510], 1
jmp 0x1004ddac
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 7
ja 0x1004ddc1
mov dword [ebp - 0x40], 0
jmp 0x1004e0e5
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x3b
jle 0x1004e115
mov dword [ebp - 0xb68], 0x8ff05c8a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xef0]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xb68], eax
jmp 0x1004e0de
movzx eax, word [ebp - 0x98]
cmp eax, 0xffff
je 0x1004e52d
movzx eax, word [ebp - 0x98]
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x1c8]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xb70], eax
mov eax, dword [ebp - 0xb70]
mov ecx, dword [ebp - 0x1c8]
add ecx, dword [eax]
mov dword [ebp - 0x100], ecx
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x114]
jbe 0x1004e522
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x114]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x100], edx
jae 0x1004e522
mov eax, dword [0x106df5d8]
and eax, 2
jne 0x1004e1c0
mov eax, dword [ebp - 0x100]
jmp 0x1004e5de
push 2
lea ecx, [ebp - 0xe84]
call fcn.1000fc7a
mov dword [ebp - 4], 0x46
mov dword [ebp - 0x210], 5
mov dword [ebp - 0xb80], 0xe2c0d37a
mov dword [ebp - 0x350], 0
jmp 0x1004e56e
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x1004e590
push dword [ebp - 0x350]
lea ecx, [ebp - 0xe84]
call fcn.1000fd18
mov dword [eax], 3
jmp 0x1004e561
mov dword [ebp - 0x210], 1
jmp 0x1004e5a9
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x1004e5cd
push dword [ebp - 0x210]
lea ecx, [ebp - 0xe84]
call fcn.1000fd18
mov eax, dword [eax]
mov dword [ebp - 0xb80], eax
jmp 0x1004e59c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe84]
call fcn.1000fcfc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret