Function at 0x1003137c
Capabilities:
Delete directory
Delete file
Get common file path
Get disk information
Query or enumerate registry key

Disassembly:
mov eax, 0x1006bc0b
call fcn.1006aa48
mov eax, 0x1acc
call fcn.100668d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push esi
mov dword [ebp - 0x20], 0x53b26bdd
mov esi, 0x307a329f
push edi
mov dword [ebp - 0x58], ecx
mov edi, 0x24891023
xor ecx, ecx
mov dword [ebp - 0x2c], 0xf5ecce35
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xfffffffa
push 1
mov byte [ebp - 0x61], dl
pop eax
jg 0x100314d4
mov dword [ebp - 0x10], 0xb999fb0
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 0x28], 0xa2c39d5b
push eax
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x100313fb
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x7e8], 0xfffffffb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100313ea
mov dword [ebp - 0x30], edx
jmp 0x10031416
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4f4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jl 0x10031406
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
mov dword [ebp - 0x7e0], eax
setge cl
cmp ecx, edi
jl 0x1003143e
cmp dword [ebp - 0x10], edx
je 0x1003143e
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10031440
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
xor eax, eax
inc eax
cmp eax, ecx
mov ecx, dword [ebp - 0x20]
sbb eax, eax
add ecx, dword [ebp - 0x20]
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4f4]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x100314b7
push 0xe1f
push eax
push eax
call ebx
lea ecx, [ebp - 0x4f4]
call fcn.1000bcb2
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffa
push 1
pop eax
jle 0x100313c9
xor ecx, ecx
mov dword [ebp - 0x20], 0x53b26bdd
mov dword [ebp - 0x2c], 0xf5ecce35
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xfffffffa
jg 0x100315fa
mov dword [ebp - 0x10], 0xb999fb0
lea ecx, [ebp - 0x4e8]
mov dword [ebp - 0x28], 0xa2c39d5b
push eax
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x10031521
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x800], 0xfffffffb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10031510
mov dword [ebp - 0x30], edx
jmp 0x1003153c
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4e8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jl 0x1003152c
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
mov dword [ebp - 0x7f8], eax
setge cl
cmp ecx, edi
jl 0x10031564
cmp dword [ebp - 0x10], edx
je 0x10031564
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10031566
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
xor eax, eax
inc eax
cmp eax, ecx
mov ecx, dword [ebp - 0x20]
sbb eax, eax
add ecx, dword [ebp - 0x20]
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4e8]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x100315dd
push 0xe1f
push eax
push eax
call ebx
lea ecx, [ebp - 0x4e8]
call fcn.1000bcb2
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffa
push 1
pop eax
jle 0x100314ef
xor ecx, ecx
mov dword [ebp - 0x34], 0xd5e48d32
xor edx, edx
mov dword [ebp - 0x30], 0x91cb4e76
inc edx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x10], ecx
jmp 0x10031628
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a4], 0x66c1932e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10031617
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x34], 0xffffffea
cmp dword [ebp - 0x34], 0xffffffe9
jg 0x10031851
mov dword [ebp - 0x10], edx
mov ecx, 0x30cc2fdc
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
inc eax
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setge cl
neg ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
add eax, 0xc8fc558b
add eax, ecx
je 0x100316bc
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], cl
je 0x10031698
push ecx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10031841
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor ecx, ecx
jmp 0x10031841
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], ecx
jmp 0x10031837
mov dword [ebp - 0x3c], 0xfffffffb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x2c], 0x1e56
cmp dword [ebp - 0x2c], 0xe71
jge 0x1003181f
push ecx
mov dword [ebp - 0x65c], ecx
mov dword [ebp - 0x658], ecx
push ecx
lea ecx, [ebp - 0x66c]
call fcn.1000c006
xor eax, eax
lea ecx, [ebp - 0x640]
push eax
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
call fcn.1000c006
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x128]
push eax
push 0x10009adc
call fcn.10050bab
xor eax, eax
inc eax
mov edi, eax
pop ecx
pop ecx
cmp dword [ebp - 0x128], eax
jl 0x100317fa
lea eax, [ebp - 0x2ec]
push eax
push 0x10009c2c
call fcn.10050bab
pop ecx
pop ecx
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x66c]
call fcn.1000bfe3
lea eax, [ebp - 0x2ec]
push eax
push 0x10009c2c
call fcn.10050bab
pop ecx
pop ecx
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x640]
call fcn.1000bfe3
lea ecx, [ebp - 0x640]
call fcn.10030cd6
lea ecx, [ebp - 0x66c]
mov esi, eax
call fcn.10030cd6
lea ecx, [ebp - 0x8c4]
lea edx, [eax + esi]
call fcn.10030d79
cmp dword [eax + 0x14], 0x10
jb 0x100317c9
mov eax, dword [eax]
push eax
push 0x10009e84
call fcn.10050dc6
pop ecx
pop ecx
xor eax, eax
lea ecx, [ebp - 0x8c4]
xor esi, esi
inc eax
push esi
push eax
call fcn.1000c006
inc edi
cmp edi, dword [ebp - 0x128]
jle 0x10031751
xor eax, eax
inc eax
jmp 0x100317fc
xor esi, esi
push esi
push eax
lea ecx, [ebp - 0x640]
call fcn.1000c006
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x66c]
xor eax, eax
push esi
inc eax
push eax
call fcn.1000c006
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10031834
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor ecx, ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x2e
jle 0x100316cc
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe9
push 1
pop edx
jle 0x10031644
mov dword [ebp - 0x30], 0x16
jmp 0x1003187a
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ecx
jne 0x10031880
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10031877
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
xor edx, edx
xor ecx, ecx
inc edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x26
jl 0x1003185a
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0xf4727cad
mov dword [ebp - 0x24], 0x7bff44ca
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x364]
push 2
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x100318be
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x364]
mov dword [eax + ecx*4], 0x6ea0e402
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100318ab
xor ecx, ecx
mov dword [ebp - 0x30], edx
inc ecx
jmp 0x100318dd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1d8], 5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x100318cc
cmp dword [ebp - 0x34], edx
je 0x1003195e
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, 0xfe3d
setne cl
imul ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x10031918
cmp dword [ebp - 0x24], edx
jne 0x10031918
mov eax, edx
inc ecx
jmp 0x1003191d
xor ecx, ecx
inc ecx
mov eax, ecx
imul eax, eax, 0xa925
test eax, eax
je 0x10031932
mov eax, dword [ebp - 0x364]
cmp dword [eax + 4], edx
jne 0x10031934
mov ecx, edx
mov eax, dword [ebp - 0x38]
add eax, ecx
cmp eax, 7
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
neg ecx
inc dword [ebp - 0x10]
cmp eax, ecx
jne 0x10031951
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10031956
xor ecx, ecx
mov eax, edx
inc ecx
cmp eax, dword [ebp - 0x34]
jne 0x1003195e
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], edx
jne 0x1003196d
mov eax, edx
cmp dword [ebp - 0x10], edx
je 0x1003196f
mov eax, ecx
mov ecx, dword [ebp - 0x38]
imul ecx, eax
mov eax, dword [ebp - 0x364]
mov dword [eax], ecx
test ecx, ecx
jne 0x1003198e
cmp dword [ebp - 0x1d8], edx
jne 0x1003198e
mov eax, edx
inc ecx
jmp 0x10031993
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [ebp - 0x38]
je 0x1003199f
mov eax, ecx
cmp dword [ebp - 0x3c], edx
jne 0x100319a1
mov eax, edx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x364]
call fcn.1000bcb2
mov dword [ebp - 0x18], 0x53b26bdd
lea ecx, [ebp - 0x3b8]
mov dword [ebp - 0x34], 0
push 3
call fcn.1000bc50
xor eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0x6749
mov dword [ebp - 0x28], 0x7a9b65ca
mov dword [ebp - 0x2c], 0x2ab2
mov dword [ebp - 0x44], 0x4b38b4b7
mov dword [ebp - 0x30], edx
jmp 0x10031a04
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x218], 0xfffffffb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100319f3
mov dword [ebp - 0x30], edx
jmp 0x10031a22
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3b8]
mov dword [eax + ecx*4], 0x20ea0c8d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10031a0f
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x218], edx
jne 0x10031a3e
mov eax, dword [ebp - 0x3b8]
cmp dword [eax + 4], edx
je 0x10031a44
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3b8]
push 0xfffffffffffffff7
pop ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x214]
add ecx, eax
mov eax, dword [ebp - 0x214]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
sub edx, eax
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x34], eax
mov byte [ebp - 0x19], al
je 0x10031ac0
cmp byte [ebp - 0x19], al
je 0x10031ad3
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1c32
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10031ad3
cmp byte [ebp - 0x19], al
je 0x10031ad3
push 0x75a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
lea ecx, [ebp - 0x3b8]
call fcn.1000bcb2
mov dword [ebp - 0x2c], 0xf5ecce35
mov dword [ebp - 0x2c], 0x1c60
cmp dword [ebp - 0x2c], 0x1366
jge 0x10031e4e
lea eax, [ebp - 0x124]
push eax
push 0x10009adc
call fcn.10050bab
xor eax, eax
inc eax
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x124], eax
jl 0x10031e51
xor ebx, ebx
lea eax, [ebp - 0x60]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], ebx
lea eax, [ecx*2 + 2]
mov dword [ebp - 0x1f8], eax
dec eax
mov dword [ebp - 0x1f0], eax
test ecx, ecx
jle 0x10031be9
lea edi, [ebp - 0x14f8]
lea edi, [edi + ebx*4]
push edi
lea eax, [ebp - 0xc28]
lea eax, [eax + ebx*4]
push eax
lea esi, [ebp - 0x1ad8]
lea esi, [esi + ebx*4]
lea ecx, [ebp - 0x17e8]
push esi
lea ebx, [ecx + ebx*4]
push ebx
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0x10009e88
call fcn.10050bab
imul eax, dword [ebp - 0x1f4], 0x3c
add esp, 0x1c
mov ecx, dword [ebp - 0x3c]
add eax, dword [ebp - 0x188]
mov dword [ebp + ecx*4 - 0xf18], eax
mov eax, dword [esi]
sub eax, dword [edi]
push eax
call fcn.10053984
pop ecx
mov ecx, dword [ebx]
mov esi, eax
mov ebx, dword [ebp - 0x3c]
sub ecx, dword [ebp + ebx*4 - 0xc28]
push ecx
call fcn.10053984
add esi, eax
add esi, dword [ebp + ebx*4 - 0xf18]
mov dword [ebp + ebx*4 - 0x1208], esi
inc ebx
pop ecx
mov dword [ebp - 0x3c], ebx
cmp ebx, dword [ebp - 0x60]
jl 0x10031b52
push 0x11132
xor ebx, ebx
push ebx
push 0x1141c290
call fcn.10049fa7
add esp, 0xc
push 0x11132
push ebx
push 0x1142d3d0
call fcn.10049fa7
mov ecx, dword [ebp - 0x60]
add esp, 0xc
lea edx, [ecx*2 + 1]
test edx, edx
js 0x10031c38
imul esi, edx, 0xc
dec edx
mov ecx, dword [0x11a1666c]
mov eax, dword [esi + ecx]
lea esi, [esi - 0xc]
mov dword [esi + ecx + 0x10], eax
jns 0x10031c22
mov ecx, dword [ebp - 0x60]
mov edi, ebx
test ecx, ecx
jle 0x10031c90
mov ecx, dword [0x11a1666c]
lea eax, [ebp - 0x190]
lea esi, [edi + 1]
push eax
mov dword [ebp - 0x190], esi
call fcn.1002e3cd
mov ecx, dword [0x11a1666c]
lea eax, [ebp - 0x198]
and dword [ebp - 0x198], 0
add ecx, 0xc
push eax
add ecx, ebx
call fcn.1002e3cd
mov ecx, dword [ebp - 0x60]
xor eax, eax
inc eax
add ebx, 0xc
mov word [edi*2 + 0x1142d3d2], ax
mov edi, esi
cmp edi, ecx
jl 0x10031c3e
xor ebx, ebx
mov esi, ebx
test ecx, ecx
jle 0x10031e04
lea eax, [ecx*2 + 1]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ecx + 1]
add eax, esi
imul ecx, eax, 0xc
add ecx, dword [0x11a1666c]
call fcn.1002e3cd
mov ecx, dword [ebp - 0x60]
lea eax, [ecx + 1]
imul ecx, ecx, 0x18
add eax, esi
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1a8]
push eax
mov eax, dword [0x11a1666c]
add eax, 0xc
add ecx, eax
call fcn.1002e3cd
mov ecx, dword [ebp - 0x60]
xor edx, edx
inc edx
lea eax, [esi + ecx]
imul eax, eax, 0x176
inc esi
mov word [eax + ecx*4 + 0x1142d548], dx
cmp esi, ecx
jl 0x10031c9a
test ecx, ecx
jle 0x10031e04
xor eax, eax
mov edx, ebx
push 0xc
pop esi
mov dword [ebp - 0x40], edx
lea ebx, [eax + 1]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], eax
mov edi, ebx
cmp ebx, ecx
jge 0x10031dde
mov ecx, dword [ebp + eax - 0x1208]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + eax - 0xc28]
sub eax, dword [ebp + edi*4 - 0x17e8]
push eax
call fcn.10053984
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp + ecx - 0x14f8]
sub ecx, dword [ebp + edi*4 - 0x1ad8]
push ecx
call fcn.10053984
add esi, dword [ebp - 0x2c]
add eax, esi
mov esi, dword [ebp - 0x3c]
pop ecx
cmp eax, dword [ebp + edi*4 - 0xf18]
jge 0x10031dcc
mov eax, dword [ebp - 0x60]
mov ecx, dword [0x11a1666c]
inc eax
add eax, edi
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ecx + esi]
call fcn.1002e3cd
lea eax, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], ebx
push eax
mov eax, dword [ebp - 0x60]
inc eax
add eax, edi
imul ecx, eax, 0xc
add ecx, dword [0x11a1666c]
call fcn.1002e3cd
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov edx, dword [ebp - 0x40]
add eax, edi
add eax, edx
inc ecx
mov word [eax*2 + 0x1142d548], cx
jmp 0x10031dcf
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x60]
inc edi
mov eax, dword [ebp - 0x10]
cmp edi, ecx
jl 0x10031d33
add eax, 4
add esi, 0xc
inc ebx
mov dword [ebp - 0x10], eax
add edx, 0xbb
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edx
lea eax, [ebx - 1]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
jl 0x10031d1f
xor ebx, ebx
mov dword [0x10c7aa8c], ebx
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x1f8]
call fcn.10030e61
test al, al
jne 0x10031e0a
mov eax, dword [ebp - 0x60]
sub eax, dword [0x10c7aa8c]
push eax
push 0x10009ae8
call fcn.10050dc6
mov esi, dword [ebp - 0x28]
inc esi
pop ecx
pop ecx
mov dword [ebp - 0x28], esi
cmp esi, dword [ebp - 0x124]
jle 0x10031b20
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x518]
mov dword [ebp - 0x38], 0xfffffffb
push 3
call fcn.1000bc50
mov dword [ebp - 0x10], 0xf8abff5e
xor esi, esi
xor eax, eax
mov dword [ebp - 0x3c], esi
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], esi
jmp 0x10031e95
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x518]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031e82
mov eax, dword [ebp - 0x30]
mov ecx, 0xea28c7ff
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xf32b
setne cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x30], 0xb756
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
imul ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
add eax, 0xa389a919
add eax, edx
jne 0x10031ef8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x518]
mov dword [eax], ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
setg cl
xor eax, eax
cmp ecx, 0x4c9cadcd
setge al
cmp eax, dword [ebp - 0x28]
jne 0x10031fa8
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x38], esi
jmp 0x10031f4f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x500], 0xbb5f37d7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x10031f3e
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
cmp dword [ebp - 0x40], 0xe89b93b3
sbb eax, eax
neg eax
imul edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4fc], eax
jmp 0x10031fbc
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x38], eax
je 0x10031fb7
inc eax
mov dword [ebp - 0x2c], eax
xor esi, esi
lea ecx, [ebp - 0x518]
call fcn.1000bcb2
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], 0xfffffffa
jg 0x100329a2
lea esi, [ebp - 0x784]
lea edi, [ebp - 0x774]
xor ecx, ecx
inc ecx
xor ebx, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0xc5604491
mov dword [ebp - 0x10], ebx
jmp 0x10032005
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x554], 0x847d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031ff4
mov dword [ebp - 0x30], ebx
jmp 0x10032060
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x554]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x554]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x554]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1003205a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
inc dword [ebp - 0x30]
push 1
pop ecx
cmp dword [ebp - 0x30], 2
jle 0x10032010
movdqa xmm0, xmmword [0x1000a260]
push ecx
push edi
mov dword [ebp - 0x38], 0xb999fb0
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x44], 3
push esi
movdqu xmmword [ebp - 0x784], xmm0
call fcn.1000bc8c
mov dword [ebp - 4], 2
mov dword [ebp - 0x2c], 0xfffffff9
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x2c], 0x17d4
cmp dword [ebp - 0x2c], 0x9ab
jge 0x10032121
lea eax, [ebp - 0xa4]
push eax
push 0x10009adc
call fcn.10050bab
pop ecx
pop ecx
jmp 0x10032110
dec eax
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x438]
push eax
push 0x10009d7c
call fcn.10050bab
push dword [ebp - 0x434]
push dword [ebp - 0x438]
call fcn.1003105c
mov eax, dword [0x11a1667c]
push dword [eax - 4]
push dword [eax - 8]
push 0x10009d74
call fcn.10050dc6
add esp, 0x1c
mov eax, dword [ebp - 0xa4]
test eax, eax
jne 0x100320cf
dec eax
mov dword [ebp - 0xa4], eax
cmp byte [ebp - 0x19], 0
je 0x1003212e
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x698]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, 0x39ec
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x698]
or dword [ebp - 4], 0xffffffff
call fcn.1000bcb2
mov dword [ebp - 0x30], 0xb5052061
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], 0xc9d5fac1
mov dword [ebp - 0x24], 0x4e76ab2a
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x28], 5
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp eax, edx
setge cl
xor edx, edx
imul eax, ecx, 0xfffffff8
mov dword [ebp - 0x24], eax
imul ecx, dword [ebp - 0x24], 0xffff
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
sub edx, 0x6568
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x10], ebx
je 0x100321f7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xfffffff9
setge al
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffc
setle cl
imul ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], ecx
je 0x10032249
mov dword [ebp - 0x28], 0x72fa5d87
mov dword [ebp - 0x2c], 0xfc1c5751
mov dword [ebp - 0x28], 0x41022496
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x10032264
mov dword [ebp - 0x2c], 0xe5f58cdc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10032264
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], 0xa2c39d5b
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x10], 0x7f0a
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], 0x95aa
mov dword [ebp - 0x2c], 0x6660
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x44], 0xf2fd
mov dword [ebp - 0x28], ebx
push 2
call fcn.1000bc50
push 2
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x100322bd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3f0], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100322ac
xor ecx, ecx
mov dword [ebp - 0x20], ebx
inc ecx
jmp 0x100322db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc0], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100322ca
mov dword [ebp - 0x20], ebx
jmp 0x100322f6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1bc], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100322e5
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], edx
jge 0x1003231e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0x2932384b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032303
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x24], ebx
jne 0x1003236b
imul ecx, dword [ebp - 0x10], 0x6cc7
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
xor ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0xc0], eax
dec eax
je 0x10032357
mov eax, ecx
cmp dword [ebp - 0xc0], ebx
jne 0x10032359
mov eax, ebx
add eax, 0xffff7c18
neg eax
sbb eax, eax
neg eax
cmp eax, 0xfffffff7
mov eax, ebx
jl 0x1003236d
mov eax, ecx
mov ecx, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0x1ac0
mov dword [ebp - 0x1bc], ecx
setg al
cmp eax, dword [ebp - 0x10]
jg 0x100323a1
cmp dword [ebp - 0xc0], ebx
jne 0x100323a1
mov edx, ebx
jmp 0x100323a6
xor eax, eax
lea edx, [eax + 1]
inc dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
mov ecx, 0xeb6b04c8
mov eax, dword [ebp - 0x40]
sub ecx, eax
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3f0]
cmp eax, 0x58e469ad
mov eax, dword [ebp - 0x56c]
setg cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1bc]
cmp eax, 0x6d9de360
setle cl
mov dword [ebp - 0x1b8], ecx
lea ecx, [ebp - 0x56c]
call fcn.1000bcb2
xor eax, eax
lea ecx, [ebp - 0x5fc]
inc eax
push eax
call fcn.1000bc50
push 3
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], ebx
jmp 0x10032436
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x80c], 0xfffffffb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10032425
mov dword [ebp - 0x10], 0x5020f89b
mov dword [ebp - 0x10], ebx
jmp 0x10032458
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x818], 0x85f70ad6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032447
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10032471
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 3
pop ecx
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
cmp dword [ebp - 0x10], ecx
jge 0x1003248b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x818], edx
inc dword [ebp - 0x10]
jmp 0x10032477
mov dword [ebp - 0x30], ebx
jmp 0x100324a0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5fc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jl 0x10032490
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0x228]
push 2
call fcn.1000bc50
mov dword [ebp - 0x28], 0xee67
mov dword [ebp - 0x3c], 0x40c9ba5b
mov dword [ebp - 0x3c], 0x57511ecb
mov dword [ebp - 0x3c], 0x1fd9ab8a
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x34], ebx
jmp 0x100324f4
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], 0x551b32e2
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x100324e1
cmp dword [ebp - 0x10], 0xffff31c4
jl 0x1003250f
cmp dword [ebp - 0x10], ebx
je 0x1003250f
xor eax, eax
lea edx, [eax + 1]
jmp 0x10032511
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x228]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x228]
setg dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x10]
setl bl
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x228]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setne cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0xfffffffe
setge cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
add ecx, 0x5a278e1
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x100325c0
push eax
push 0x151b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
lea ecx, [ebp - 0x228]
call fcn.1000bcb2
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x307a329f
mov dword [ebp - 0x804], eax
setge cl
cmp ecx, 0x24891023
jl 0x100325f3
cmp dword [ebp - 0x38], 0
je 0x100325f3
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100325f5
xor ecx, ecx
mov eax, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
inc eax
cmp eax, ecx
mov ecx, dword [ebp - 0x18]
push 3
sbb eax, eax
add ecx, dword [ebp - 0x18]
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x5fc]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp eax, edx
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x10], 0x490c4d8e
call fcn.1000bc50
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x30], edx
inc ecx
jmp 0x10032688
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xc4], 0xdf75
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10032677
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 3
jge 0x100326af
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x584]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10032696
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
jl 0x1003279a
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0xe6e836ea
mov dword [ebp - 0x34], 0x2e31d83
cmp dword [ebp - 0x34], edx
je 0x100326f8
mov byte [ebp - 0x19], dl
cmp byte [ebp - 0x19], 0
je 0x10032791
push edx
push edx
push 0x192
push 0x2ce
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
xor edx, edx
jmp 0x1003278e
push 6
mov dword [ebp - 0x3c], 7
pop eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x34], edx
jne 0x10032739
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0xc4]
cmp ecx, 0xfffffffa
jg 0x10032736
xor edx, edx
cmp dword [ebp - 0x10], edx
jne 0x10032736
mov ecx, edx
jmp 0x10032739
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
imul eax, ecx
imul eax, eax, 0x5f4e
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x2c]
sub edx, 0xfcb8f1fe
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, 2
jb 0x1003276b
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x34], 7
test eax, eax
jne 0x10032779
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x584]
mov dword [eax], ecx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x3c], edx
jne 0x1003279a
xor ecx, ecx
inc ecx
dec dword [ebp - 0x10]
jns 0x100326bb
lea ecx, [ebp - 0x584]
call fcn.1000bcb2
mov dword [ebp - 0x20], 0x14b7
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x28], 0x9b65cab4
push 3
call fcn.1000bc50
push 2
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 4
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x30], edx
jmp 0x100327f2
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x5b4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x100327df
mov dword [ebp - 0x30], edx
jmp 0x10032810
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x59c]
mov dword [eax + ecx*4], 0x7b6c411e
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100327fd
mov eax, dword [ebp - 0x20]
mov ecx, 0xa40f2fda
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2eaa
setle al
cmp eax, dword [ebp - 0x20]
jl 0x10032852
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
neg eax
sbb eax, eax
inc eax
sub eax, edx
xor edx, edx
add eax, dword [ebp - 0x20]
cmp eax, 0x28cbd6cd
jl 0x100328b3
cmp dword [ebp - 0x20], edx
jne 0x100328b3
mov ecx, edx
jmp 0x100328b8
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
imul eax, ecx
test eax, eax
je 0x100328ce
cmp dword [ebp - 0x34], edx
je 0x100328ce
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100328d0
mov ecx, edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x5b4]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x59c]
mov dword [eax], ecx
lea ecx, [ebp - 0x59c]
call fcn.1000bcb2
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 3
call fcn.1000bcb2
xor eax, eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10032986
push 6
pop ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x4c], eax
inc eax
mov dword [ebp - 0x4c], 0x8da8e97e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x8c66f5a9
push 4
call fcn.1000bc50
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x3c], 0x3bd6
mov dword [ebp - 0x10], eax
jmp 0x10032960
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6b0]
mov dword [eax + ecx*4], 0xc891c553
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003294d
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x6b0]
dec dword [ebp - 0x3c]
call fcn.1000bcb2
push 0xe1f
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5fc]
call fcn.1000bcb2
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jle 0x10031fe0
mov esi, 0x42c7
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 0x18], esi
mov edi, 0xf8067e3
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x40], 0x441791e6
push 3
call fcn.1000bc50
mov dword [ebp - 0x28], 0xbb1300ca
xor eax, eax
mov dword [ebp - 0x2c], 0x2967684a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
jmp 0x100329f8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5d8]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100329e5
mov dword [ebp - 0x18], 0xfffffff8
mov ecx, 0xfff7
cmp dword [ebp - 0x18], 0xfffffffc
sbb eax, eax
add eax, 0xb8736202
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5d8]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x10032a6e
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10032a6e
mov edx, eax
jmp 0x10032a73
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x18]
jne 0x10032a8e
cmp dword [ebp - 0x40], ecx
je 0x10032a8e
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10032a90
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp ecx, 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
inc edx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
imul ecx, ecx, 0x7279
sub ecx, 0x7279
cmp eax, ecx
lea ecx, [ebp - 0x5d8]
setg dl
add edx, 0x2e8326ad
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.1000bcb2
mov dword [ebp - 0x34], 0xd5e48d32
xor ecx, ecx
mov dword [ebp - 0x18], 0x91cb4e76
xor edx, edx
mov dword [ebp - 0x3c], 0xffffffff
inc edx
mov dword [ebp - 0x10], ecx
jmp 0x10032b06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x200], 0x66c1932e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10032af5
mov dword [ebp - 0x34], 0xffffffea
cmp dword [ebp - 0x34], 0xffffffe9
jg 0x10032bd8
mov dword [ebp - 0x10], edx
mov ecx, 0x30cc2fdc
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
inc eax
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setge cl
neg ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
add eax, 0xc8fc558b
add eax, ecx
je 0x10032b8d
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], cl
je 0x10032b70
push ecx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032bc8
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor ecx, ecx
jmp 0x10032bc8
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], ecx
jmp 0x10032bc2
mov dword [ebp - 0x3c], 0xfffffffb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x200], eax
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032bbf
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
xor ecx, ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2e
jle 0x10032b9a
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe9
push 1
pop edx
jle 0x10032b1c
mov dword [ebp - 0x18], 0x16
jmp 0x10032c01
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ecx
jne 0x10032c07
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032bfe
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
xor edx, edx
xor ecx, ecx
inc edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x26
jl 0x10032be1
mov dword [ebp - 0x4c], 0xaf43
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032c29
push 0x89b
push 0x163f
call dword [sym.imp.USER32.dll_SetCaretPos]
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032c3a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x40], 0x441791e6
push 3
call fcn.1000bc50
mov dword [ebp - 0x28], 0xbb1300ca
xor eax, eax
mov dword [ebp - 0x2c], 0x2967684a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], eax
jmp 0x10032c86
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x464]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10032c73
mov dword [ebp - 0x18], 0xfffffff8
mov ecx, 0xfff7
cmp dword [ebp - 0x18], 0xfffffffc
sbb eax, eax
add eax, 0xb8736202
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x464]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x10032cfc
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10032cfc
mov edx, eax
jmp 0x10032d01
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x18]
jne 0x10032d1c
cmp dword [ebp - 0x40], ecx
je 0x10032d1c
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10032d1e
xor ecx, ecx
mov eax, dword [ebp - 0x18]
or edi, 0xffffffff
cmp ecx, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
imul ecx, ecx, 0x7279
sub ecx, 0x7279
cmp eax, ecx
lea ecx, [ebp - 0x464]
setg dl
add edx, 0x2e8326ad
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.1000bcb2
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10032d8e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], 0x45f1dbec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032d76
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff1
cmp dword [ebp - 0x10], 0xffffffe3
jl 0x10032dc1
mov dword [ebp - 0x208], edi
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x10032db5
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jge 0x10032d9b
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], 0xd5e48d32
push ecx
mov dword [ebp - 0x20], 0xd313dd33
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x4c], 0xdb7b2415
call fcn.1000bc50
xor esi, esi
mov dword [ebp - 4], 5
xor edx, edx
mov dword [ebp - 0x10], esi
inc edx
jmp 0x10032e06
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x75c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10032df3
push 6
pop eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1c
jg 0x100330f2
jmp 0x10032e20
xor edx, edx
inc edx
mov dword [ebp - 0x30], 0xfe01bd97
lea ecx, [ebp - 0x6f4]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0x6e700d62
mov dword [ebp - 0x38], 0xc6076fda
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], edx
push 3
call fcn.1000bc50
push 6
pop eax
push 3
lea ecx, [ebp - 0x6e0]
mov byte [ebp - 4], al
call fcn.1000bc50
mov byte [ebp - 4], 7
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], 3
jge 0x10032e87
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6f4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032e72
mov dword [ebp - 0x18], esi
jmp 0x10032e9f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6e0]
mov dword [eax + ecx*4], 0x4bc4433a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032e8c
mov dword [ebp - 0x30], 0x12
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x100330c8
push 2
pop edi
push 3
lea ecx, [ebp - 0x47c]
call fcn.1000bc50
mov byte [ebp - 4], 8
xor edx, edx
mov dword [ebp - 0x34], 0x35c5735
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edx
jmp 0x10032ef1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x47c]
mov dword [eax + ecx*4], 0x87f2fb5a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032ede
mov dword [ebp - 0x18], edx
jmp 0x10032f09
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x870], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10032efc
mov dword [ebp - 0x34], edx
jmp 0x10033051
mov dword [ebp - 0x10], 0x92f644a
mov dword [ebp - 0x10], edx
jmp 0x10032f33
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x868], 0x1d52aa0a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032f22
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], edx
jl 0x1003304e
xor eax, eax
lea ecx, [ebp - 0x6c8]
inc eax
push eax
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x38], 0
inc edx
jmp 0x10032f6e
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x6c8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x10032f5f
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x47c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x2c], 0x1773
cmp dword [ebp - 0x2c], 0x1329
jge 0x10033032
lea eax, [ebp - 0xa0]
push eax
push 0x100099e8
call fcn.10050bab
pop ecx
pop ecx
jmp 0x10033021
dec eax
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
push eax
push 0x10009aec
call fcn.10050bab
xor eax, eax
add esp, 0xc
mov edi, eax
cmp dword [ebp - 0x130], eax
jle 0x10033021
cmp dword [ebp - 0x12c], 0
mov esi, eax
jle 0x1003300a
lea eax, [esi + edi]
neg eax
sbb eax, eax
and eax, 0xffffffeb
add eax, 0x57
push eax
push 0x10009bd8
call fcn.10050dc6
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x12c]
jl 0x10032fe7
push 0x10009955
call fcn.10050f86
pop ecx
inc edi
push 0
pop eax
cmp edi, dword [ebp - 0x130]
jl 0x10032fdc
mov eax, dword [ebp - 0xa0]
test eax, eax
jne 0x10032fae
dec eax
mov dword [ebp - 0xa0], eax
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x6c8]
call fcn.1000bcb2
dec dword [ebp - 0x10]
jns 0x10032f44
push 2
xor edx, edx
pop edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10032f16
mov dword [ebp - 0x38], edx
xor esi, esi
cmp dword [ebp - 0x38], 0xfffffffd
je 0x100330ac
xor eax, eax
lea ecx, [ebp - 0x548]
inc eax
push eax
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x10], esi
inc edx
jmp 0x1003308f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x548]
mov dword [eax + ecx*4], 0x1290
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003307c
mov eax, dword [ebp - 0x548]
lea ecx, [ebp - 0x548]
mov dword [eax], edi
call fcn.1000bcb2
dec dword [ebp - 0x38]
jmp 0x1003305f
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 7
call fcn.1000bcb2
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jl 0x10032eb9
lea ecx, [ebp - 0x6e0]
call fcn.1000bcb2
lea ecx, [ebp - 0x6f4]
mov byte [ebp - 4], 5
call fcn.1000bcb2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jle 0x10032e1d
or edi, 0xffffffff
lea ecx, [ebp - 0x75c]
mov dword [ebp - 4], edi
call fcn.1000bcb2
mov dword [ebp - 0x30], 0x91cb4e76
xor ecx, ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x20], ecx
je 0x1003311e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
je 0x1003315e
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], cl
je 0x1003319a
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1003319a
xor eax, eax
mov dword [ebp - 0x2c], edi
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x14
jg 0x10033197
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x1003318b
push 0x11cb
push 0x13b9
call ebx
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
xor ecx, ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
jle 0x1003316d
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x2c], 0x180e
cmp dword [ebp - 0x2c], 0x12a0
push 9
pop esi
mov dword [ebp - 0x2c], 0xa
jge 0x10033351
lea eax, [ebp - 0x2b0]
mov edi, 0xf4247
push eax
xor ebx, ebx
lea ecx, [ebp - 0x238]
push edi
mov dword [ebp - 0x2b0], ebx
call fcn.1002e3ab
xor edx, edx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x238]
inc edx
push 0xa
mov ecx, edx
pop esi
cmp ecx, esi
jge 0x100331f9
mov dword [eax + ecx*4], ecx
jmp 0x10033224
mov esi, edx
mov eax, ecx
test ecx, ecx
jle 0x10033210
cdq
idiv dword [ebp - 0x2c]
test edx, edx
jle 0x1003320c
imul esi, edx
test eax, eax
jg 0x10033201
mov edx, dword [ebp - 0x238]
push 0xa
mov eax, dword [edx + esi*4]
mov dword [edx + ecx*4], eax
mov eax, edx
xor edx, edx
inc edx
pop esi
inc ecx
cmp ecx, edi
jl 0x100331f0
lea eax, [ebp - 0x184]
mov dword [ebp - 0x184], ebx
push eax
push 0xa
pop eax
push eax
lea ecx, [ebp - 0x7f4]
call fcn.1002e3ab
push 0xa
pop ecx
mov byte [ebp - 4], cl
push eax
push ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
call fcn.1003dc5a
lea ecx, [ebp - 0x7f4]
call fcn.1000bcb2
mov esi, dword [ebp - 0x16c]
xor eax, eax
mov ebx, dword [ebp - 0x238]
add esi, 0xc
lea edi, [eax + 1]
push 4
pop edx
mov eax, dword [esi - 0xc]
mov ecx, dword [esi]
mov eax, dword [edx + eax]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x28
jl 0x1003328c
mov ecx, dword [ebx + edi*4]
mov eax, dword [esi]
add esi, 0xc
inc dword [eax + ecx*4]
inc edi
cmp edi, 0xf4247
jl 0x10033289
lea eax, [ebp - 0x98]
push eax
push 0x100099e8
call fcn.10050bab
mov ebx, dword [ebp - 0x16c]
pop ecx
pop ecx
jmp 0x10033323
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0x10009dac
call fcn.10050bab
imul eax, dword [ebp - 0x18c], 0xc
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [eax + ebx - 0xc]
imul eax, dword [ebp - 0x29c], 0xc
mov eax, dword [eax + ebx]
mov eax, dword [eax + edx*4]
sub eax, dword [ecx + edx*4]
push eax
push 0x100099ec
call fcn.10050dc6
add esp, 0x18
mov eax, dword [ebp - 0x98]
test eax, eax
jne 0x100332ce
dec eax
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x98], eax
call fcn.1002edc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1000bcb2
push 9
pop esi
mov dword [ebp - 0x24], 0xfffffff9
xor ebx, ebx
mov dword [ebp - 0x28], ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
mov dword [ebp - 0x4c], 0xd2466e9f
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x4c], 0x93e623b4
push 2
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x10033394
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x878], 0x7a5eafb5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033383
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setl dl
sub edx, 0xfffffff7
add edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x40]
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x100333e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], 0x66c1932e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100333d1
mov dword [ebp - 0x34], 0xffffffea
cmp dword [ebp - 0x34], 0xffffffe9
jg 0x10033f2c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x4c], 0x458c458a
mov dword [ebp - 0x18], ebx
jmp 0x100334d0
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003342a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033419
cmp dword [ebp - 0x18], ebx
je 0x10033478
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
xor eax, eax
add ecx, dword [ebp - 0x18]
cmp ecx, 0x11c3fc02
setne al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x3c], ebx
je 0x10033478
xor eax, eax
lea edx, [eax + 1]
jmp 0x1003347a
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0x1c1d
setle al
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x100334c8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], ebx
jmp 0x100334b3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x194], 0x11de2a90
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x100334a2
dec dword [ebp - 0x28]
mov dword [ebp - 0x194], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jge 0x1003349a
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x10033411
mov dword [ebp - 0x10], ecx
xor edx, edx
mov eax, dword [ebp - 0x30]
mov ecx, 0x30cc2fdc
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
inc eax
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setge cl
neg ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
add eax, 0xc8fc558b
add eax, ecx
je 0x10033831
mov dword [ebp - 0x18], 0xde19d29b
mov dword [ebp - 0x38], 0x600d5493
mov dword [ebp - 0x60c], 0xa0122d80
mov dword [ebp - 0x608], 0xa0122d80
mov dword [ebp - 0x604], 0xa0122d80
mov dword [ebp - 0x600], 0xa0122d80
mov dword [ebp - 0x10], ebx
jmp 0x10033567
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x34c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003355a
mov dword [ebp - 0x18], ebx
jmp 0x10033624
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], 0xd2466e9f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34c]
cmp dword [ebp - 0x348], ebx
jne 0x100335a4
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], eax
jne 0x100335a4
mov eax, ebx
jmp 0x100335a7
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], eax
jne 0x100335cc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], ebx
jl 0x10033621
mov dword [ebp - 0x10], ebx
jmp 0x100335fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x648], 0x276cc72b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100335e9
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10033616
mov dword [ebp - 0x644], 0x78ef8a6e
dec dword [ebp - 0x20]
jns 0x10033607
mov dword [ebp - 0x60c], ebx
dec dword [ebp - 0x38]
jns 0x100335e4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10033575
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003363d
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
mov dword [ebp - 0x20], ebx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 0xfffffff9
cmp dword [ebp - 0x20], 0xffffffee
jne 0x100336e9
mov dword [ebp - 0x28], ecx
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x7e4a906
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
neg eax
sub eax, 3
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100336d9
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffee
push 1
pop ecx
je 0x1003365a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003377a
mov dword [ebp - 0x54], 0x3b4e1a36
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 0xa233712
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x1003376d
mov dword [ebp - 0x2c], 0xed3c15d
xor ebx, ebx
mov eax, dword [ebp - 0x40]
cmp eax, 0xe008
setle bl
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setne dl
imul eax, ebx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
jmp 0x10033773
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x28]
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10033f1c
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], eax
xor eax, eax
mov dword [ebp - 0x38], 0x1c1ec2db
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x21afa9b6
mov dword [ebp - 0x38], ebx
jmp 0x10033812
mov dword [ebp - 0x10], ebx
jmp 0x100337d1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2fc], 0x39ed080c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100337c0
mov dword [ebp - 0x2f8], ebx
jmp 0x10033806
mov dword [ebp - 0x28], 0x98764276
xor edx, edx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp + eax*4 - 0x61c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x2f8]
cmp dword [ebp - 0x2f8], 3
jle 0x100337df
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x100337bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x10033f1c
push 4
lea ecx, [ebp - 0x494]
call fcn.1000bc50
mov dword [ebp - 4], 0xb
push 4
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10033861
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x100], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033854
mov dword [ebp - 0x18], ebx
jmp 0x1003387e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x494]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003386b
mov esi, dword [ebp - 0x494]
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x3c], 5
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x28], 0x440e708b
push 3
call fcn.1000bc50
mov dword [ebp - 0x38], ebx
jmp 0x100338bf
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5f0]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jl 0x100338ac
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0x100], ebx
jne 0x100338e4
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0x100], ebx
jne 0x100338e4
xor edx, edx
mov edi, ebx
inc edx
jmp 0x100338e9
xor edx, edx
inc edx
mov edi, edx
cmp dword [ebp - 0xfc], ebx
jne 0x100338fb
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x100]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [ebp - 0x3c], 0x47ea567e
imul eax, dword [ebp - 0x3c], 0x2ad0
test eax, eax
jne 0x10033947
cmp dword [ebp - 0x3c], ebx
jne 0x10033947
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x10033949
mov ecx, edx
mov eax, dword [ebp - 0x5f0]
mov dword [eax + 8], ecx
test ecx, ecx
je 0x1003395e
cmp dword [ebp - 0x100], ebx
jne 0x10033960
mov edx, ebx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [esi + 0xc]
add eax, edx
xor edx, edx
cmp eax, 6
setge dl
mov eax, dword [ebp + ecx*4 - 0x100]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, edi
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x5f0]
call fcn.1000bcb2
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 3
jle 0x1003388c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100339b6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
or esi, 0xffffffff
lea ecx, [ebp - 0x494]
mov dword [ebp - 4], esi
call fcn.1000bcb2
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x3c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x67a876e6
mov dword [ebp - 0x4c], 0x53644469
mov dword [ebp - 0x4c], 0xf25cbd94
mov dword [ebp - 0x4c], 0x7161ab6e
mov dword [ebp - 0x4c], 0x813f1a07
mov dword [ebp - 0x4c], 0x7e67329
mov dword [ebp - 0x4c], 0xfffffff6
push eax
call fcn.1000bc50
xor edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x20], ebx
jmp 0x10033a2e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x774]
mov dword [eax + ecx*4], 0x1015aa96
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033a1b
mov dword [ebp - 0x20], ebx
jmp 0x10033a45
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d0], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10033a38
push 2
mov dword [ebp - 0x20], ebx
pop edi
jmp 0x10033a60
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x420], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033a53
dec dword [ebp - 0x41c]
lea ecx, [ebp - 0x774]
call fcn.1000bcb2
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x2e
jg 0x10033f19
mov dword [ebp - 0x3c], 0xfffffffb
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x10], 0x872d9ee1
mov dword [ebp - 0x28], 0xc2e7ccc8
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x10033abe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033ab0
mov dword [ebp - 0x74], ebx
jmp 0x10033b8f
push edi
lea ecx, [ebp - 0x37c]
call fcn.1000bc50
xor eax, eax
mov dword [ebp - 4], 0xc
inc eax
lea ecx, [ebp - 0x768]
push eax
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10033b06
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x628], 0x5b0e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033af5
mov dword [ebp - 0x20], ebx
jmp 0x10033b1f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x37c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033b10
mov dword [ebp - 0x20], ebx
jmp 0x10033b38
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x768]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033b29
mov eax, dword [ebp - 0x37c]
mov dword [eax], ebx
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x4c], 0x8cf4c59c
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x37c]
inc dword [eax]
cmp dword [eax], 0
jle 0x10033b45
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10033b73
push edx
call dword [sym.imp.USER32.dll_ShowCursor]
lea ecx, [ebp - 0x768]
call fcn.1000bcb2
lea ecx, [ebp - 0x37c]
mov dword [ebp - 4], esi
call fcn.1000bcb2
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 7
jge 0x10033acb
mov dword [ebp - 0x10], ebx
jmp 0x10033bb1
push 9
pop esi
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe9
push 1
pop ecx
jle 0x100333f8
mov dword [ebp - 0x30], 0x16
mov esi, 0xffff
cmp dword [ebp - 0x30], 0x26
jge 0x100345e9
or edi, 0xffffffff
jmp 0x10033f4a
xor ecx, ecx
inc ecx
push ecx
lea ecx, [ebp - 0x4ac]
call fcn.1000bc50
xor eax, eax
mov dword [ebp - 4], 0xd
inc eax
lea ecx, [ebp - 0x70c]
push eax
call fcn.1000bc50
xor edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], ebx
jmp 0x10033f8a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4ac]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033f77
mov dword [ebp - 0x18], ebx
jmp 0x10033fa3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033f94
mov eax, dword [ebp - 0x4ac]
lea ecx, [ebp - 0x70c]
mov dword [eax], ebx
call fcn.1000bcb2
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 4], edi
call fcn.1000bcb2
xor eax, eax
lea ecx, [ebp - 0x394]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x40], 0x2086bd08
mov dword [ebp - 0x28], 0x3e58bfc4
mov dword [ebp - 0x28], 0x3d9b9503
push 4
call fcn.1000bc50
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], 0xb39e2240
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003402a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003401b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034040
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, dword [ebp - 0x38]
neg eax
jne 0x10034056
mov eax, dword [ebp - 0x394]
cmp dword [eax + 0xc], ebx
jne 0x10034056
mov ecx, ebx
jmp 0x1003405b
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x394]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
add eax, ecx
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x394]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
call fcn.1000bcb2
cmp dword [ebp - 0x34], ebx
jne 0x100345ec
mov dword [ebp - 0x2c], 0x187a
cmp dword [ebp - 0x2c], 0x10be
jge 0x10034362
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x10009c74
call fcn.10050bab
add esp, 0xc
mov byte [ebp - 0x6e], bl
lea eax, [ebp - 0x6e]
lea ecx, [ebp - 0x31c]
push eax
push dword [ebp - 0x7c]
call fcn.1000bcf4
lea eax, [ebp - 0x6d]
mov dword [ebp - 4], 0xe
push eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x30c]
mov byte [ebp - 0x6d], bl
call fcn.1000bcf4
lea eax, [ebp - 0x78]
mov edi, 0x10009adc
push eax
push edi
call fcn.10050bab
cmp dword [ebp - 0x78], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x10034172
lea eax, [ebp - 0xcc]
push eax
push edi
call fcn.10050bab
pop ecx
pop ecx
xor eax, eax
inc eax
push eax
push ecx
push dword [ebp - 0xcc]
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x31c]
call fcn.1000bd3b
pop ecx
mov ecx, eax
call fcn.1000bd5a
inc esi
cmp esi, dword [ebp - 0x78]
jl 0x10034138
lea eax, [ebp - 0x78]
push eax
push edi
call fcn.10050bab
cmp dword [ebp - 0x78], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x100341c0
lea eax, [ebp - 0xcc]
push eax
push edi
call fcn.10050bab
pop ecx
pop ecx
xor eax, eax
inc eax
push eax
push ecx
push dword [ebp - 0xcc]
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x30c]
call fcn.1000bd3b
pop ecx
mov ecx, eax
call fcn.1000bd5a
inc esi
cmp esi, dword [ebp - 0x78]
jl 0x10034186
mov edi, dword [ebp - 0x84]
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x7c]
mov eax, ebx
imul eax, ebx
imul eax, edi
imul eax, edi
test eax, eax
jle 0x100342a0
mov eax, esi
lea ecx, [ebp - 0x31c]
cdq
idiv ebx
lea eax, [ebp - 0x858]
push edx
push eax
call fcn.1000bd3b
xor ecx, ecx
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
shl edx, cl
lea ecx, [ebp - 0x30c]
test dword [esi], edx
cdq
setne byte [ebp - 0x11]
idiv edi
lea eax, [ebp - 0x860]
mov ebx, edx
push ebx
push eax
call fcn.1000bd3b
xor ecx, ecx
mov edi, dword [eax]
lea esi, [ecx + 1]
mov ecx, dword [eax + 4]
shl esi, cl
test dword [edi], esi
setne al
or al, byte [ebp - 0x11]
movzx eax, al
push eax
push ecx
push ebx
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x30c]
call fcn.1000bd3b
pop ecx
mov ecx, eax
call fcn.1000bd5a
mov esi, dword [ebp - 0x3c]
push eax
mov eax, esi
cdq
idiv dword [ebp - 0x7c]
push ecx
push edx
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x31c]
call fcn.1000bd3b
pop ecx
mov ecx, eax
call fcn.1003d943
mov ebx, dword [ebp - 0x7c]
inc esi
mov edi, dword [ebp - 0x84]
mov eax, ebx
imul eax, ebx
mov dword [ebp - 0x3c], esi
imul eax, edi
imul eax, edi
cmp esi, eax
jl 0x100341e1
xor eax, eax
mov dword [ebp - 0x28], eax
test ebx, ebx
jle 0x100342eb
push eax
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0x31c]
call fcn.1000bd3b
xor ecx, ecx
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
test dword [esi], edx
jne 0x100342da
push 0x10009e9c
call fcn.10050f86
mov ebx, dword [ebp - 0x7c]
pop ecx
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, ebx
jl 0x100342a9
mov edi, dword [ebp - 0x84]
xor ebx, ebx
test edi, edi
jle 0x1003432a
push ebx
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x30c]
call fcn.1000bd3b
xor ecx, ecx
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
test dword [esi], edx
jne 0x10034325
push 0x10009e9c
call fcn.10050f86
mov edi, dword [ebp - 0x84]
pop ecx
inc ebx
cmp ebx, edi
jl 0x100342f1
push 0x10009ea0
call fcn.10050f86
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x300], ebx
call fcn.1000bcb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x310], ebx
call fcn.1000bcb2
mov esi, 0xffff
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10034381
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x700], 0xa8c6a53d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034370
mov dword [ebp - 0x18], ebx
jmp 0x10034399
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7dc], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003438c
push 2
pop edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x10034408
mov dword [ebp - 0x38], esi
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7d8], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x6fc]
mov eax, dword [ebp - 0x700]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setg dl
inc edx
neg edx
push 1
sbb edx, edx
neg eax
inc edx
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
imul ecx, ecx, 0x9740
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x18]
jns 0x100343aa
mov dword [ebp - 0x18], ebx
jmp 0x1003446a
push 3
lea ecx, [ebp - 0x5c0]
call fcn.1000bc50
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 3
jge 0x1003443b
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034426
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034451
push 0xe1f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0x5c0]
mov eax, dword [ecx]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x5c0]
call fcn.1000bcb2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1003440d
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x3ac]
xor eax, eax
mov dword [ebp - 0x4c], 0xcf5720e8
inc eax
mov dword [ebp - 0x28], 0xf94f3783
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0x11accbad
push eax
call fcn.1000bc50
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x10], 0x9dbea522
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x3c], 0x16aac895
mov dword [ebp - 0x2c], 3
push 4
call fcn.1000bc50
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x100344e4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 0x8cb4c23a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100344d1
mov dword [ebp - 0x20], ebx
jmp 0x100344ff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x17c], 0xd35da2a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100344ee
mov dword [ebp - 0x20], ebx
jmp 0x1003451c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c4]
mov dword [eax + ecx*4], 0x9cbc21b0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10034509
dec dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3ac]
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
sete cl
cmp dword [ebp - 0x24], ecx
jne 0x10034550
mov eax, dword [ebp - 0x3ac]
cmp dword [eax], ebx
je 0x10034550
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10034552
mov ecx, ebx
cmp dword [ebp - 0x3c], ebx
je 0x1003455a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
sub eax, 3
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
dec dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
sub ecx, eax
imul edx, ecx
xor ecx, ecx
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x4c4]
setg dl
xor eax, eax
imul edx, dword [ebp - 0x10]
cmp edx, 0x69dd
setne al
mov dword [ebp - 0x40], eax
call fcn.1000bcb2
or edi, 0xffffffff
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 4], edi
call fcn.1000bcb2
cmp byte [ebp - 0x11], 0
je 0x100345da
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x26
jl 0x10033f47
jmp 0x100345ec
or edi, 0xffffffff
mov dword [ebp - 0x4c], 0xaf43
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003460c
push 0x89b
push 0x163f
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003461d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10034639
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20c], 0x45f1dbec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034628
mov dword [ebp - 0x10], 0xfffffff1
jmp 0x10034666
mov dword [ebp - 0x20c], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034663
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jge 0x10034647
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x3c], 0x7e4fc228
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x30], ebx
push 4
call fcn.1000bc50
push 4
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 4], 0x10
call fcn.1000bc50
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 4
jge 0x100346da
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x248]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100346c5
mov dword [ebp - 0x18], ebx
jmp 0x100346f2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], 0x5b1b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100346df
cmp dword [ebp - 0x24], ebx
jne 0x10034768
mov eax, dword [ebp - 0x3c4]
inc dword [eax + 0xc]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x34]
test eax, eax
je 0x10034713
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
cmp eax, 0x752b
mov eax, dword [ebp - 0x24]
setge bl
xor ecx, ecx
cmp eax, 0x2728
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x248]
setl cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
setge dl
dec dword [ebp - 0x3c]
xor ebx, ebx
add eax, edx
jne 0x10034768
mov edx, ebx
jmp 0x1003476d
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0x35
je 0x10034885
mov edi, dword [ebp - 0x248]
mov esi, dword [ebp - 0x3c4]
mov dword [ebp - 0x18], 0x50d5
mov dword [ebp - 0x28], 0xbc3393a3
mov dword [ebp - 0x2c], 0x6030033
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x10], ebx
jmp 0x100347f8
xor eax, eax
mov dword [ebp - 0x28], 0xf7cd3e5c
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], ebx
jl 0x100347e9
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x248]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
cmp dword [ebp - 0x28], ebx
jne 0x100347e9
dec dword [ebp - 0x30]
jns 0x100347cd
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jg 0x100347b4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], 0x256f
cmp dword [esi + 0xc], ebx
jne 0x10034813
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, 0x5de30ea3
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0x17c9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, dword [esi + 8]
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
imul eax, ecx, 7
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x35
jne 0x10034793
or edi, 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.1000bcb2
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], edi
call fcn.1000bcb2
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], ebx
jmp 0x100348c6
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], ebx
jmp 0x100348bd
mov dword [ebp - 0x2c], 0xc891c553
cmp dword [ebp - 0x2c], ebx
jne 0x100348c3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jg 0x100348ae
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 7
jl 0x100348a6
mov dword [ebp - 0x30], 0x42c7
mov dword [ebp - 0x28], 0xf8067e3
mov dword [ebp - 0x4c], 0x4e2d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100348f6
push 0x13b4
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034914
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov dword [ebp - 0x3c], 4
xor eax, eax
push 6
pop ecx
mov dword [ebp - 0x28], ecx
inc eax
mov dword [ebp - 0x3c], 0x3fcb50bf
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], 0x35b263d1
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x4c], 0x5b14f4e7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
push 2
pop esi
cmp dword [ebp - 0x28], ebx
je 0x10034995
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 0xe164caf
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x28], 0xe57f6cc9
mov dword [ebp - 0x10], ebx
jmp 0x10034988
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x828], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034977
dec dword [ebp - 0x28]
jmp 0x10034a21
mov dword [ebp - 0x5c], 0xcb302aff
lea ecx, [ebp - 0x578]
push esi
call fcn.1000bc50
xor eax, eax
mov dword [ebp - 0x28], 0x9339b884
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], ebx
jmp 0x100349cd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x578]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100349ba
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100349e6
push 0xce8
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov eax, dword [ebp - 0x578]
xor ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x578]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
call fcn.1000bcb2
push 6
pop ecx
mov dword [ebp - 0x40], 0x441791e6
mov dword [ebp - 0x18], 0x571177e8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 7
je 0x10034ad9
push 0xa
pop eax
mov dword [ebp - 0x34], 0x3245f1db
mov dword [ebp - 0x34], 0x1a
jmp 0x10034ac4
mov dword [ebp - 0x38], 0xcdcb363f
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 0xc
je 0x10034aab
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], 5
cmp dword [ebp - 0x10], 0xfffffffa
jl 0x10034a9f
mov dword [ebp - 0x2c], 3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034a8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
mov dword [ebp - 0x2c], 0x8e00f680
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
jge 0x10034a6f
push 6
pop ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xc
jne 0x10034a5f
push 0xa
pop eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034abe
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0xa
pop eax
dec dword [ebp - 0x34]
push 6
pop ecx
cmp dword [ebp - 0x34], eax
jg 0x10034a4f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
push 6
pop ecx
jne 0x10034a3f
push 3
lea ecx, [ebp - 0x50c]
call fcn.1000bc50
push esi
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 4], 0x11
call fcn.1000bc50
mov dword [ebp - 0x28], 0x3c61c71b
mov dword [ebp - 0x10], ebx
jmp 0x10034b18
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4dc]
mov dword [eax + ecx*4], 0x11738ab6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034b05
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10034b2c
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov edi, dword [ebp - 0x4dc]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x28]
neg edx
mov ebx, dword [edi + 4]
mov eax, ebx
mov esi, dword [edi]
sbb edx, edx
sub eax, esi
inc edx
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp esi, ebx
sete al
cmp eax, ecx
jg 0x10034b61
test esi, esi
je 0x10034b61
xor eax, eax
inc eax
jmp 0x10034b63
xor eax, eax
sub eax, ebx
lea ecx, [ebp - 0x4dc]
mov dword [edi + 4], eax
call fcn.1000bcb2
mov dword [ebp - 0x28], 0xbb1300ca
xor ebx, ebx
mov dword [ebp - 0x2c], 0x2967684a
mov dword [ebp - 0x18], 0xa61928c1
push 6
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
inc eax
or edi, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], 0xfffffffc
cmp dword [ebp - 0x18], 0xfffffff1
jne 0x10034cc6
mov dword [ebp - 0x10], 0x4822b165
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x10], ebx
jne 0x10034cb2
cmp dword [ebp - 0x18], ebx
jne 0x10034cb2
mov dword [ebp - 0x24], 0xfffffff7
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp eax, 0xf7c2f5a2
setne cl
xor eax, eax
add ecx, dword [ebp - 0x10]
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x10]
jne 0x10034c14
cmp dword [ebp - 0x18], ebx
jne 0x10034c14
mov ecx, ebx
jmp 0x10034c19
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x28], eax
inc edx
mov eax, dword [ebp - 0x3c]
add eax, ecx
xor ecx, ecx
cmp eax, edx
mov eax, 0xffff
setg cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x5d06
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
neg eax
cmp eax, edx
setge cl
xor edx, edx
sub ecx, 0x6c63fefb
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
inc ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, 0x23e2
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x10034cbe
mov dword [ebp - 0x2c], 0xbc66
cmp dword [ebp - 0x2c], ebx
jne 0x10034cc6
dec dword [ebp - 0x18]
jmp 0x10034ba3
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 0x18], 0x5e17ca00
push 4
call fcn.1000bc50
mov dword [ebp - 0x10], ebx
jmp 0x10034cf5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5cc]
mov dword [eax + ecx*4], 0x9d66de6b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10034ce2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10034d1c
xor eax, eax
inc eax
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov ecx, dword [ebp - 0x18]
xor edx, edx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, 0xf889e022
setne dl
sub edx, 0x5bbb
cmp eax, edx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x18]
jl 0x10034d45
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 6
setge dl
imul edx, dword [ebp - 0x18]
pop eax
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x5cc]
setl dl
inc edx
mov dword [eax], edx
call fcn.1000bcb2
mov dword [ebp - 0x54], 0x3b4e1a36
xor ecx, ecx
mov dword [ebp - 0x28], edi
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], 0xa233712
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x10034dfa
mov dword [ebp - 0x2c], 0xed3c15d
xor ebx, ebx
mov eax, dword [ebp - 0x40]
cmp eax, 0xe008
setle bl
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setne dl
imul eax, ebx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
jmp 0x10034e00
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x28]
mov dword [ebp - 0x10], ebx
jmp 0x10034e18
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034e05
mov dword [ebp - 0x34], 0x15a1
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x24], 0xadacd7d3
mov dword [ebp - 0x28], 0xb59229a2
mov dword [ebp - 0x18], 0xc7128abf
push 3
call fcn.1000bc50
mov dword [ebp - 0x10], ebx
jmp 0x10034e5f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44c]
mov dword [eax + ecx*4], 0x5ec35211
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034e4c
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ebx, ebx
cmp edx, 0x44401d1b
push 2
setge bl
xor ecx, ecx
cmp ebx, eax
pop esi
setge cl
mov dword [ebp - 0x24], ecx
mov ecx, esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x28], ecx
jne 0x10034eb3
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
jne 0x10034eb5
mov edx, ebx
jmp 0x10034eba
xor ebx, ebx
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10034f01
mov dword [ebp - 0x2c], 0x3c9534ce
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x44c]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + esi*4]
setne dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x18]
jns 0x10034ecf
push 2
pop esi
lea ecx, [ebp - 0x44c]
call fcn.1000bcb2
xor ecx, ecx
mov dword [ebp - 0x30], 0xfffffff8
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10034f32
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x654], 0xa8c6a53d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034f21
mov dword [ebp - 0x18], ebx
jmp 0x10034f4a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7d0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034f3d
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10034fbb