Function at 0x10031afb
Capabilities:
Accept command line arguments
Connect pipe
Create process on windows
Get keyboard layout
Parse pe header
Set environment variable
Terminate process

Disassembly:
mov eax, 0x1008fa25
call fcn.1008e0e8
mov eax, 0x16fc
call fcn.10088c80
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x64], ecx
inc edi
mov dword [ebp - 0x38], 0xfffffffc
push edi
lea ecx, [ebp - 0xd6c]
mov byte [ebp - 0x71], dl
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031b59
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd6c]
call fcn.1001ac88
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031b3b
xor eax, eax
mov dword [ebp - 0x38], eax
mov ebx, 0xe6da504
mov esi, 0x6ca2cb51
jmp 0x10031b71
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe8
jg 0x10031b68
mov dword [ebp - 0x38], 0xffffffe2
jmp 0x10031bab
mov dword [ebp - 0x1c], 0xfffffffe
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x38], eax
jne 0x10031bb1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x14
jge 0x10031b80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd6c]
call fcn.1001ac6c
mov dword [ebp - 0x38], 0xfffffffc
lea ecx, [ebp - 0x1070]
push edi
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031bfe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1070]
call fcn.1001ac88
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031be0
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10031c0c
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe8
jg 0x10031c03
mov dword [ebp - 0x38], 0xffffffe2
jmp 0x10031c46
mov dword [ebp - 0x1c], 0xfffffffe
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x38], eax
jne 0x10031c4c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x14
jge 0x10031c1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1070]
call fcn.1001ac6c
movdqa xmm0, xmmword [0x1000b150]
lea eax, [ebp - 0x10f4]
push eax
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1558]
movdqu xmmword [ebp - 0x1104], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1d2]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x450]
push dword [esi]
call fcn.1001ac46
push edi
lea ecx, [ebp - 0x148]
mov dword [ebp - 4], 2
call fcn.1001abea
push 3
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x48], 0x48abb75d
mov dword [ebp - 0x40], 0x5c22c920
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0x21a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031cfe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x148]
call fcn.1001ac88
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031ce0
xor eax, eax
push eax
lea ecx, [ebp - 0x148]
call fcn.1001ac88
lea ecx, [ebp - 0x148]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001ac88
push 3
pop esi
jmp 0x10031e4a
mov dword [ebp - 0x44], edi
xor eax, eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x50], 0xffffffff
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x450]
push dword [eax]
call fcn.1001ac88
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x450]
push dword [eax]
call fcn.1001ac88
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x148]
setne dl
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], edi
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x450]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x148]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x450]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x148]
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.1001ac88
xor ecx, ecx
imul eax, dword [eax], 6
cmp eax, 0xe9d0
setle cl
sub ecx, 0x3821
je 0x10031e11
push esi
lea ecx, [ebp - 0x450]
call fcn.1001ac88
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], 8
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031e2e
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
push eax
lea ecx, [ebp - 0x148]
call fcn.1001ac88
lea ecx, [ebp - 0x148]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x148]
cmp dword [eax], esi
jle 0x10031d23
call fcn.1001ac6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.1001ac6c
mov dword [ebp - 0x38], 0xfffffffc
lea ecx, [ebp - 0xd80]
push edi
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031eae
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd80]
call fcn.1001ac88
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031e90
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x10031ec0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x6ca2cb51
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe8
jg 0x10031eb3
mov dword [ebp - 0x38], 0xffffffe2
jmp 0x10031efa
mov dword [ebp - 0x1c], 0xfffffffe
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x38], eax
jne 0x10031f00
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x14
jge 0x10031ecf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd80]
call fcn.1001ac6c
movdqa xmm0, xmmword [0x1000b150]
lea eax, [ebp - 0x1214]
push eax
lea eax, [ebp - 0x1224]
push eax
lea ecx, [ebp - 0x1568]
movdqu xmmword [ebp - 0x1224], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1bd]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x48c]
push dword [esi]
call fcn.1001ac46
push edi
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 5
call fcn.1001abea
mov byte [ebp - 4], 6
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], 0x48abb75d
mov dword [ebp - 0x40], 0x5c22c920
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0x21a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10031fb3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x130]
call fcn.1001ac88
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10031f95
xor eax, eax
push eax
lea ecx, [ebp - 0x130]
call fcn.1001ac88
and dword [eax], 0
jmp 0x100320e0
mov dword [ebp - 0x44], edi
xor eax, eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x50], 0xffffffff
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x48c]
push dword [eax]
call fcn.1001ac88
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x48c]
push dword [eax]
call fcn.1001ac88
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x130]
setne dl
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], edi
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x48c]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x48c]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.1001ac88
xor ecx, ecx
imul eax, dword [eax], 6
cmp eax, 0xe9d0
setle cl
sub ecx, 0x3821
je 0x100320b5
push esi
lea ecx, [ebp - 0x48c]
call fcn.1001ac88
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], 8
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100320d2
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
push eax
lea ecx, [ebp - 0x130]
call fcn.1001ac88
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x130]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x130]
cmp dword [eax], esi
jle 0x10031fc7
call fcn.1001ac6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.1001ac6c
mov dword [ebp - 0x24], 8
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x1c], 0xc5ec
mov dword [ebp - 0x50], 0xfffffff6
push esi
call fcn.1001abea
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x48], 0xf9a4d91f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10032168
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x132c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10032150
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003218a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9c4]
call fcn.1001ac88
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10032170
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100321a4
push 0x10f2
push 0x204c
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub edx, 0xfc0fdbb4
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x24]
cmp edx, 0xffffffff
setne cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add eax, 0xb81e
add ecx, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, 0x14af
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x9c4]
setge dl
mov dword [ebp - 0x1328], edx
mov esi, dword [ebp - 0x1c]
call fcn.1001ac88
lea ecx, [ebp - 0x9c4]
mov dword [eax], esi
mov dword [ebp - 0x34], esi
or dword [ebp - 4], 0xffffffff
call fcn.1001ac6c
push 2
xor eax, eax
mov dword [ebp - 0x14], 0x5c8094a1
pop esi
mov dword [ebp - 0x14], eax
push 0xfffffffffffffffd
pop ecx
cmp dword [ebp - 0x14], esi
jge 0x1003227b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1578], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10032267
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032295
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032292
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10032280
mov dword [ebp - 0x50], 0xc8094a18
mov ecx, 0x36f6dd8d
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x938], ecx
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x1c], edi
push 3
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x100322e4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x13ec], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100322cc
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032306
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf20], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x100322ed
xor eax, eax
cmp dword [ebp - 0x930], 0xafb
jle 0x10032319
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x1003231b
mov ecx, edi
xor eax, eax
cmp ecx, edx
setge al
add eax, 0x70ed99ea
je 0x10032337
xor eax, eax
cmp dword [ebp - 0xf20], eax
je 0x10032339
mov eax, edi
jmp 0x10032339
xor eax, eax
dec dword [ebp - 0x1c]
mov edx, dword [ebp - 0xf20]
sub edx, eax
mov eax, dword [ebp - 0xf20]
neg edx
push esi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0x93dda37b
setne dl
xor eax, eax
cmp edx, 0xfffffff6
mov dword [ebp - 0x930], edx
setl al
xor edx, edx
cmp eax, 7
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setle cl
sub eax, ecx
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x13ec], eax
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x24], 0x6dd1e1e8
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], eax
jmp 0x100323cb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x854]
call fcn.1001ac88
mov dword [eax], 0x999d94b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100323b4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xf2f4a8b1
mov dword [ebp - 0x24], 0xfffffff8
jmp 0x10032559
mov dword [ebp - 0x2c], 0xfffffffc
lea ecx, [ebp - 0xfe0]
push 4
call fcn.1001abea
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032425
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfe0]
call fcn.1001ac88
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10032409
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003245f
push eax
lea ecx, [ebp - 0x854]
call fcn.1001ac88
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10032547
push 0xea4
push 0x557
push eax
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x10032547
movdqa xmm0, xmmword [0x1000b150]
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x1144]
mov dword [ebp - 0x1c], 0xffffffff
push eax
lea ecx, [ebp - 0x1570]
movdqu xmmword [ebp - 0x1144], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1bf]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x135c]
push dword [esi]
call fcn.1001ac46
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x50], 0xfffffff9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0xffffb50c
neg eax
sbb eax, eax
add eax, 0xffffb036
neg eax
sbb eax, eax
inc eax
cmp eax, 0x1dda
jg 0x100324e4
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100324e6
jmp 0x100324e8
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x854]
call fcn.1001ac88
mov ecx, dword [ebp - 0x2c]
xor edx, edx
sub edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x24]
cmp edi, ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, 0x2c4e
setne cl
xor edx, edx
cmp ecx, 0xffffffff
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
add eax, 0xfffffffb
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
lea ecx, [ebp - 0x135c]
setne dl
mov dword [esi], edx
inc dword [ebp - 0x50]
call fcn.1001ac6c
xor edi, edi
inc edi
lea ecx, [ebp - 0xfe0]
mov byte [ebp - 4], 8
call fcn.1001ac6c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe3
jg 0x100323e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.1001ac6c
push edi
lea ecx, [ebp - 0x10e0]
call fcn.1001abea
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x40], 0x77e8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100325b1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e4], 0xfff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032599
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100325de
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003269b
push 0x68d
push eax
push 0xcdd
push 0x1909
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x1003269b
mov dword [ebp - 0x20], 0x63f9e923
mov dword [ebp - 0x1c], 0x796840e
mov dword [ebp - 0x50], 0xe819d338
cmp dword [ebp - 0x40], eax
jne 0x1003263d
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x1e4]
imul ecx, eax
mov eax, dword [ebp - 0x1e4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x1e4]
jl 0x10032642
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032645
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003269b
push eax
push 0x105f
push 0x527
push 0xe4a
push 0x2570
push 0x93d
push 0x145c
push 0x95d
push 0x1eb2
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x24], 0xe1757117
mov esi, 0xf9beab1d
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x34], 0xbff1eb7e
mov dword [ebp - 0x24], 0xfffffff0
cmp dword [ebp - 0x24], 0xffffffe2
jne 0x1003283a
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x4a4]
call fcn.1001abea
push ebx
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0xc
call fcn.1001abea
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x50], 0xa9d2e819
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032726
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4a4]
call fcn.1001ac88
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003270b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1003273f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x62c]
call fcn.1001ac88
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003272b
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4a4]
xor eax, eax
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x62c]
cmp esi, dword [eax]
sbb esi, esi
xor eax, eax
push eax
neg esi
call fcn.1001ac88
xor ecx, ecx
cmp esi, dword [eax]
sete cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x1003278c
xor eax, eax
lea ecx, [ebp - 0x62c]
push eax
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x4a4]
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x50], 0x5616
push edi
call fcn.1001ac88
mov edx, dword [ebp - 0x50]
xor ebx, ebx
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
push edi
setle bl
xor ecx, ecx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x44]
dec ebx
cmp eax, ebx
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x4a4]
call fcn.1001ac88
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x34]
setg cl
xor eax, eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x62c]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x62c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
call fcn.1001ac6c
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xb
call fcn.1001ac6c
dec dword [ebp - 0x24]
mov esi, 0xf9beab1d
cmp dword [ebp - 0x24], 0xffffffe2
je 0x100326d0
mov ebx, 0xe6da504
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10032862
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10e0]
call fcn.1001ac88
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032844
xor eax, eax
mov dword [ebp - 0x18], 0xd313dd33
mov dword [ebp - 0x48], 0x46c38250
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], 0x5a83d87e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x8185f187
mov dword [ebp - 0x54], 0xfffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100328b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8bc], 0x59ea4d59
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003289b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff6
jne 0x10032a8a
mov dword [ebp - 0x38], 0x2afe01bd
lea ecx, [ebp - 0x704]
mov dword [ebp - 0x24], 0xfffffffa
push 2
call fcn.1001abea
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
jmp 0x10032905
push dword [ebp - 0x14]
lea ecx, [ebp - 0x704]
call fcn.1001ac88
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100328f1
mov dword [ebp - 0x38], 0x15
jmp 0x10032a5d
movdqa xmm0, xmmword [0x1000b1e0]
lea eax, [ebp - 0x1294]
push eax
lea eax, [ebp - 0x12a4]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x58], 0x3a3dbc56
lea ecx, [ebp - 0x14c8]
mov dword [ebp - 0x44], 0x5251c607
push eax
movdqu xmmword [ebp - 0x12a4], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1c1]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1464]
push dword [esi]
call fcn.1001ac46
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x20], 0x4ba9
lea ecx, [ebp - 0x704]
push eax
call fcn.1001ac88
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100329c3
mov ecx, edi
cmp dword [ebp - 0x8b4], eax
jne 0x100329c5
mov ecx, eax
mov eax, dword [ebp - 0x28]
add eax, ecx
push 3
mov dword [ebp - 0x50], eax
xor eax, eax
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x10032a4b
mov dword [ebp - 0x1c], 0x71521f00
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], eax
jmp 0x10032a34
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jg 0x10032a31
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8bc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x8bc]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8bc], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x100329f1
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x100329e9
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x8bc]
dec dword [ebp - 0x20]
pop eax
jns 0x100329da
lea ecx, [ebp - 0x1464]
mov byte [ebp - 4], 0xe
call fcn.1001ac6c
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x14
je 0x10032917
xor eax, eax
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x704]
call fcn.1001ac6c
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
je 0x100328c1
xor eax, eax
mov dword [ebp - 0x18], eax
mov esi, 0x59b
cmp dword [ebp - 0x18], 0xffffffe8
jle 0x10032cea
push 2
lea ecx, [ebp - 0xd94]
call fcn.1001abea
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x2c], 0x8d4081c2
push 3
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], 0x34215e1a
mov dword [ebp - 0x48], 0x9d4346
mov dword [ebp - 0x48], 0xffffffff
push 2
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0xbc044b0b
mov dword [ebp - 0x48], 0x3860a421
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x50], 0x562b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10032b2a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd94]
call fcn.1001ac88
push 2
pop ecx
mov dword [eax], 0x1713
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032b09
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032b64
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10032b5e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x14d8], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032b46
xor eax, eax
inc dword [ebp - 0x50]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x10032b2f
lea ecx, [ebp - 0xd94]
mov byte [ebp - 4], 0xb
call fcn.1001ac6c
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x20], 0x7a4bedcc
mov dword [ebp - 0x14], 0x7bc8b421
push 2
call fcn.1001abea
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9a0]
mov dword [ebp - 0x34], 0x4bca925f
push edi
call fcn.1001abea
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10032bdb
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4bc]
call fcn.1001ac88
mov dword [eax], 0xfff6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10032bbc
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10032bf7
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9a0]
call fcn.1001ac88
mov dword [eax], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10032be0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10032c11
cmp dword [ebp - 0x14], eax
jne 0x10032c11
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x4bc]
push edi
call fcn.1001ac88
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x4bc]
push edi
call fcn.1001ac88
mov ecx, dword [ebp - 0x14]
mov esi, eax
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [ebp - 0x14]
test ecx, ecx
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
cmp edx, 0xfffffff8
setle cl
xor eax, eax
cmp ecx, 7
setg al
cmp eax, dword [esi]
jl 0x10032c73
push edi
lea ecx, [ebp - 0x4bc]
call fcn.1001ac88
cmp dword [eax], 0
jne 0x10032c73
xor eax, eax
mov ecx, eax
jmp 0x10032c75
mov ecx, edi
mov eax, dword [ebp - 0x34]
imul eax, ecx
test eax, eax
jne 0x10032c88
cmp dword [ebp - 0x20], eax
jne 0x10032c8a
mov esi, eax
jmp 0x10032c8c
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1001ac88
lea ecx, [ebp - 0x9a0]
sub esi, dword [eax]
sub esi, 0xffff
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001ac88
lea ecx, [ebp - 0x9a0]
mov dword [eax], esi
call fcn.1001ac6c
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0xb
call fcn.1001ac6c
mov dword [ebp - 0x34], 0x6ca2cb51
mov esi, 0x59b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jg 0x10032a9c
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x10032d07
cmp byte [ebp - 0x2d], 0
je 0x10032d04
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
mov byte [ebp - 0x2d], al
jg 0x10032cf6
cmp byte [ebp - 0x2d], 0
je 0x10032d2d
push 0xe76
push 0x111f
push 0x1e77
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], 0xffffffe2
cmp dword [ebp - 0x18], 0x14
jl 0x1003329a
mov dword [ebp - 0x2c], 0xd313dd33
mov dword [ebp - 0x48], 0x46c38250
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], 0x5a83d87e
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], 0x8185f187
mov dword [ebp - 0x54], 0xfffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032d96
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x91c], 0x59ea4d59
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10032d7d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032f5b
mov dword [ebp - 0x38], 0x2afe01bd
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x24], 0xfffffffa
push 2
call fcn.1001abea
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
jmp 0x10032de2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x818]
call fcn.1001ac88
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10032dce
mov dword [ebp - 0x38], 0x15
jmp 0x10032f3a
movdqa xmm0, xmmword [0x1000b1e0]
lea eax, [ebp - 0x1154]
push eax
lea eax, [ebp - 0x1164]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x58], 0x3a3dbc56
lea ecx, [ebp - 0x14a8]
mov dword [ebp - 0x44], 0x5251c607
push eax
movdqu xmmword [ebp - 0x1164], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1d4]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1374]
push dword [esi]
call fcn.1001ac46
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], 0x4ba9
lea ecx, [ebp - 0x818]
push eax
call fcn.1001ac88
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10032ea0
mov ecx, edi
cmp dword [ebp - 0x914], eax
jne 0x10032ea2
mov ecx, eax
mov eax, dword [ebp - 0x28]
add eax, ecx
push 3
mov dword [ebp - 0x50], eax
xor eax, eax
pop edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x10032f28
mov dword [ebp - 0x1c], 0x71521f00
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], eax
jmp 0x10032f11
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jg 0x10032f0e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x91c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x91c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x91c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x10032ece
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10032ec6
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x91c]
dec dword [ebp - 0x20]
pop eax
jns 0x10032eb7
lea ecx, [ebp - 0x1374]
mov byte [ebp - 4], 0x13
call fcn.1001ac6c
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x14
je 0x10032df4
xor eax, eax
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x818]
call fcn.1001ac6c
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
je 0x10032d9e
mov dword [ebp - 0x40], 0xfffffffe
lea ecx, [ebp - 0x534]
push 4
call fcn.1001abea
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10032fa7
push dword [ebp - 0x28]
lea ecx, [ebp - 0x534]
call fcn.1001ac88
mov dword [eax], 0xbbca
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10032f88
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10032fc4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6c], 0xada439be
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10032faf
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032fde
push eax
push eax
call ebx
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
push 3
pop esi
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], esi
jg 0x10033230
jmp 0x10032ff1
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x38], eax
jmp 0x10033184
mov dword [ebp - 0x2c], 0x7ab3921d
lea ecx, [ebp - 0x71c]
mov dword [ebp - 0x24], edi
push esi
call fcn.1001abea
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10033048
push dword [ebp - 0x14]
lea ecx, [ebp - 0x71c]
call fcn.1001ac88
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003302d
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jg 0x10033156
mov dword [ebp - 0x14], 0xf4a1d2da
mov dword [ebp - 0x1c], 0x99ff93f8
mov dword [ebp - 0x4c], 0xfffffff7
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003307c
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x28], 0x8cff26af
lea ecx, [ebp - 0x71c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
push 2
call fcn.1001ac88
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x534]
mov eax, dword [ebp - 0x1c]
push 2
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x71c]
push eax
call fcn.1001ac88
xor ecx, ecx
cmp dword [eax], ecx
setne cl
lea eax, [ecx + 0x1d4c3f0]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100330de
cmp dword [ebp - 0x24], eax
je 0x100330de
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
lea ecx, [ebp - 0x534]
call fcn.1001ac88
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x100330fb
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x100330fd
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
test ecx, ecx
sets al
cmp eax, dword [ebp - 0x1c]
jl 0x1003311f
push esi
lea ecx, [ebp - 0x534]
call fcn.1001ac88
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x38]
push 0
setle cl
xor edx, edx
cmp ecx, 0x58a4122e
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], esi
jle 0x10033054
mov dword [ebp - 0x24], eax
jmp 0x1003316d
mov dword [ebp - 0x50], 0xffff
dec dword [ebp - 0x50]
cmp dword [ebp - 0x38], eax
jne 0x10033172
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1003315b
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0x15
call fcn.1001ac6c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jle 0x10033009
mov dword [ebp - 0x20], 8
cmp dword [ebp - 0x6c], 0xdbe56f63
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, 0x7d66
cmp eax, 0x58b9
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
sub edx, 0x80627dbd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
add eax, edx
cmp eax, dword [ebp - 0x6c]
jle 0x100331e8
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100331ea
mov eax, edi
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100331f7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x38], edi
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10033210
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
mov ecx, 0x33086262
sub ecx, eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], esi
jle 0x10032fef
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0xb
call fcn.1001ac6c
mov eax, dword [ebp - 0x40]
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
jmp 0x1003326e
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
jne 0x1003328f
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff0
je 0x10033263
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003329a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jl 0x1003329a
jmp 0x10032d44
push 0x7c6
call dword [sym.imp.KERNEL32.dll_ExitProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e0]
call fcn.1001ac6c
mov dword [ebp - 0x18], 0xe0648261
xor eax, eax
mov dword [ebp - 0x1c], 0xb1b6fd43
mov dword [ebp - 0x4c], 0xbda99da9
mov dword [ebp - 0x34], 0x8ef8a6eb
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x100332fc
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100332f9
push 0xacb
push 0x1fef
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
je 0x100332d3
cmp dword [ebp - 0x18], eax
je 0x1003333f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jle 0x10033327
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4c], 0xffffffff
ja 0x1003333d
mov eax, edi
jmp 0x1003333f
xor eax, eax
movdqa xmm0, xmmword [0x1000b150]
xor edx, edx
mov dword [ebp - 0x18], eax
imul ecx, dword [ebp - 0x18], 0x9034
mov eax, dword [ebp - 0x34]
movdqu xmmword [ebp - 0x1244], xmm0
cmp ecx, eax
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x1244]
setle dl
mov dword [ebp - 0x3c], edx
lea ecx, [ebp - 0x15d8]
push eax
call fcn.1001ac97
lea ecx, [ebp - 0x1dd]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x4d4]
push dword [esi]
call fcn.1001ac46
push edi
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0x17
call fcn.1001abea
mov byte [ebp - 4], 0x18
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], 0x48abb75d
mov dword [ebp - 0x40], 0x5c22c920
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0x21a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100333fa
push dword [ebp - 0x14]
lea ecx, [ebp - 0x118]
call fcn.1001ac88
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100333dc
xor eax, eax
push eax
lea ecx, [ebp - 0x118]
call fcn.1001ac88
and dword [eax], 0
jmp 0x10033527
mov dword [ebp - 0x44], edi
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x50], 0xffffffff
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x4d4]
push dword [eax]
call fcn.1001ac88
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x4d4]
push dword [eax]
call fcn.1001ac88
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x118]
setne dl
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], edi
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x4d4]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x118]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x4d4]
push dword [eax]
call fcn.1001ac88
xor eax, eax
lea ecx, [ebp - 0x118]
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.1001ac88
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001ac88
xor ecx, ecx
imul eax, dword [eax], 6
cmp eax, 0xe9d0
setle cl
sub ecx, 0x3821
je 0x100334fc
push ebx
lea ecx, [ebp - 0x4d4]
call fcn.1001ac88
mov eax, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], 8
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10033519
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
push eax
lea ecx, [ebp - 0x118]
call fcn.1001ac88
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x118]
push eax
call fcn.1001ac88
lea ecx, [ebp - 0x118]
cmp dword [eax], ebx
jle 0x1003340e
call fcn.1001ac6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d4]
call fcn.1001ac6c
xor eax, eax
mov dword [ebp - 0x20], 0x2fafd11d
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0xbc8]
mov dword [ebp - 0x4c], 0xd2e84cbf
push ebx
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100335a1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x15a0], 0x62cf9e8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10033588
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x100335bd
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbc8]
call fcn.1001ac88
mov dword [eax], 0x72cb566e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100335a6
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, 0xfffffff7
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x10033602
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10033604
jmp 0x10033606
xor eax, eax
mov edi, eax
xor ebx, ebx
lea ecx, [ebp - 0xbc8]
inc ebx
push ebx
call fcn.1001ac88
mov ecx, dword [ebp - 0x4c]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x15a0]
sete al
xor edx, edx
add eax, 0xfffa
cmp eax, ecx
setge dl
xor eax, eax
mov dword [esi], edx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10033646
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.1001ac6c
push 3
pop esi
mov dword [ebp - 0x24], 8
lea ecx, [ebp - 0x9b8]
mov edi, 0xc5ec
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x50], 0xfffffff6
push esi
call fcn.1001abea
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x48], 0xf9a4d91f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100336b1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1404], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033699
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100336d3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9b8]
call fcn.1001ac88
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100336b9
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100336ed
push 0x10f2
push 0x204c
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub edx, 0xfc0fdbb4
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x24]
cmp edx, 0xffffffff
setne cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add eax, 0xb81e
add ecx, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, 0x14af
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0x9b8]
setge dl
mov dword [ebp - 0x1400], edx
mov esi, dword [ebp - 0x1c]
call fcn.1001ac88
lea ecx, [ebp - 0x9b8]
mov dword [eax], esi
mov dword [ebp - 0x4c], esi
or dword [ebp - 4], 0xffffffff
call fcn.1001ac6c
mov dword [ebp - 0x2c], 0x5b57fd54
lea ecx, [ebp - 0xff8]
push ebx
call fcn.1001abea
push 3
pop esi
push esi
lea ecx, [ebp - 0xda8]
mov dword [ebp - 4], 0x1b
call fcn.1001abea
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100337e8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10b0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100337d0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003380e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xff8]
call fcn.1001ac88
mov dword [eax], 0xfd57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100337f0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033834
push dword [ebp - 0x18]
lea ecx, [ebp - 0xda8]
call fcn.1001ac88
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033816
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10033893
mov dword [ebp - 0x50], 0xf09cc25f
mov dword [ebp - 0x48], 0x5925ef2c
mov dword [ebp - 0x48], 0x17ca4e8
mov dword [ebp - 0x48], 0x49a2f381
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0x6c8a81d5
mov dword [ebp - 0x44], 0x9ef3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003388a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd58], 0xc106ec6e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10033872
xor eax, eax
inc dword [ebp - 0x50]
inc dword [ebp - 0x44]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffea
jne 0x10033839
lea ecx, [ebp - 0xda8]
call fcn.1001ac6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff8]
call fcn.1001ac6c
mov dword [ebp - 0x18], 0xe0648261
xor eax, eax
mov dword [ebp - 0x1c], 0xb1b6fd43
mov dword [ebp - 0x4c], 0xbda99da9
mov dword [ebp - 0x34], 0x8ef8a6eb
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x1003390a
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10033907
push 0xacb
push 0x1fef
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
je 0x100338dd
cmp dword [ebp - 0x18], eax
je 0x1003394d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jle 0x10033935
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4c], 0xffffffff
ja 0x1003394b
mov eax, ebx
jmp 0x1003394d
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
imul ecx, dword [ebp - 0x18], 0x9034
mov eax, dword [ebp - 0x34]
push esi
cmp ecx, eax
lea ecx, [ebp - 0xb20]
setle dl
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x50], 0xfffffff6
call fcn.1001abea
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x48], 0xf9a4d91f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100339b8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x138c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100339a0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100339da
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb20]
call fcn.1001ac88
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100339c0
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100339f4
push 0x10f2
push 0x204c
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub edx, 0xfc0fdbb4
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
pop edi
setge cl
xor edx, edx
cmp eax, ecx
push edi
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x24]
cmp edx, 0xffffffff
setne cl
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add eax, 0xb81e
add ecx, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, 0x14af
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
lea ecx, [ebp - 0xb20]
setge dl
mov dword [ebp - 0x1388], edx
mov esi, dword [ebp - 0x1c]
call fcn.1001ac88
lea ecx, [ebp - 0xb20]
mov dword [eax], esi
mov dword [ebp - 0x4c], esi
or dword [ebp - 4], 0xffffffff
call fcn.1001ac6c
push edi
lea ecx, [ebp - 0x9d0]
call fcn.1001abea
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x4c], 0xf4a8b108
mov dword [ebp - 0x14], eax
jmp 0x10033ad4
push dword [ebp - 0x14]
call fcn.1001ac88
mov dword [eax], 0x5c96
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x9d0]
cmp dword [ebp - 0x14], edi
jl 0x10033ac3
push ebx
call fcn.1001ac88
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10033b05
push eax
push 0x1c7b
push 0x1722
call dword [sym.imp.GDI32.dll_CreatePen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.1001ac6c
push 3
xor eax, eax
mov dword [ebp - 0x20], 0x2fafd11d
pop ebx
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0x4c], 0xd2e84cbf
push ebx
call fcn.1001abea
xor eax, eax
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10033b61
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x15b8], 0x62cf9e8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10033b48
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10033b7d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc28]
call fcn.1001ac88
mov dword [eax], 0x72cb566e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033b66
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, 0xfffffff7
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x10033bc7
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10033bc9
xor ebx, ebx
inc ebx
mov edi, ebx
jmp 0x10033bce
xor eax, eax
xor ebx, ebx
mov edi, eax
inc ebx
push ebx
lea ecx, [ebp - 0xc28]
call fcn.1001ac88
mov ecx, dword [ebp - 0x4c]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x15b8]
sete al
xor edx, edx
add eax, 0xfffa
cmp eax, ecx
setge dl
xor eax, eax
mov dword [esi], edx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10033c0b
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.1001ac6c
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
jmp 0x10033c33
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
jne 0x1003328f
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff0
je 0x10033c24
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1520]
movdqa xmm0, xmmword [0x1000b150]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1174]
push eax
lea eax, [ebp - 0x1184]
push eax
movdqu xmmword [ebp - 0x1184], xmm0
call fcn.1001ac97
lea ecx, [ebp - 0x1d1]
mov esi, eax
call fcn.1000c653
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x4ec]
push dword [esi]
call fcn.1001ac46
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x2c], 0x8d963785
mov dword [ebp - 0x1c], 0x972737ae
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x4c], 0x5e40c883
push 3
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], esi
jge 0x10033cca
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x270], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033cb6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10033cea
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdbc], 0xefb659ba
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033cd2
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10033d03
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10033d43
mov eax, dword [ebp - 0x26c]
xor ecx, ecx
cmp eax, 0x13f5e3d1
setge cl
imul eax, ecx, 0xfffb
mov ecx, dword [ebp - 0x2c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x124]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0xdb4]
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x270]
sub eax, dword [ebp - 0xdb4]
neg eax
push ebx
sbb eax, eax
add eax, 0xffff1a3a
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x4c], eax
call fcn.1001abea
push 2
lea ecx, [ebp - 0x7f4]
mov byte [ebp - 4], 0x21
call fcn.1001abea
push esi
lea ecx, [ebp - 0x1088]
mov byte [ebp - 4], 0x22
call fcn.1001abea
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 0x34], 0x34886255
mov eax, 0x3bdf78b1
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xca0], eax
push 4
mov dword [ebp - 0x44], 0x8e00457a
pop eax
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x4c], 0x5e45
mov dword [ebp - 0x3c], eax
push eax
call fcn.1001abea
mov byte [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x54], 0xc875ff9b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10033e46
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7f4]
call fcn.1001ac88
mov dword [eax], 0xd2c87a75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10033e27
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033e6c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1088]
call fcn.1001ac88
mov dword [eax], 0x4cf59275
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033e4e
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10033e88
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9e8]
call fcn.1001ac88
mov dword [eax], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10033e71
push ebx
lea ecx, [ebp - 0x7f4]
call fcn.1001ac88
xor ecx, ecx
cmp dword [eax], ecx
setne cl
imul eax, ecx, 0x7000
test eax, eax
je 0x10033eb1