Function at 0x1002fc60
Capabilities:
Create pipe
Create thread
Create two anonymous pipes
Delete registry key
Get graphical window text
Get keyboard layout
Get session user name
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov eax, 0x1007ef7d
call fcn.1007e908
mov eax, 0x1538
call fcn.1007a030
mov dword [ebp - 0x3c], 0x60477862
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
mov byte [ebp - 0x85], dl
mov dword [ebp - 0xa8], ecx
jge 0x1002fcb2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x570], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fc99
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x1002fccc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffff
je 0x1002fcbb
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_UnionRect]
mov ecx, 0xd07ddbf4
push esi
mov esi, dword [sym.imp.GDI32.dll_Ellipse]
push edi
mov dword [ebp - 0x30], 2
push 1
pop edi
cmp dword [ebp - 0x30], eax
jl 0x1002fe63
mov dword [ebp - 0x9cc], ecx
mov dword [ebp - 0x9c8], ecx
mov dword [ebp - 0x9c4], ecx
mov dword [ebp - 0x9c0], ecx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x18], eax
jmp 0x1002fd28
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x690], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fd17
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x570], 0
jne 0x1002fd79
mov eax, dword [ebp - 0x30]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0x570]
mov dword [ebp - 0x690], 0x56df
mov eax, dword [ebp - 0x9c4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x570]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x570]
mov eax, dword [ebp - 0x48]
sub ecx, eax
cmp ecx, edi
jge 0x1002fd79
xor eax, eax
mov ecx, eax
jmp 0x1002fd7b
mov ecx, edi
mov eax, dword [ebp - 0x30]
xor edx, edx
add ecx, 0x955205
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
sub edx, 0xe26b5cfd
mov eax, dword [ebp + eax*4 - 0x570]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, edx, 0xffff
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jle 0x1002fe0a
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], eax
jl 0x1002fe3b
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1002fdf2
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002fdd7
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x9cc], 0
jne 0x1002fdf0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
push 0
pop eax
jle 0x1002fdc9
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002fe03
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002fdc0
jmp 0x1002fe3b
cmp dword [ebp - 0x3c], eax
jne 0x1002fe5c
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1002fe3b
push 0x110c
push 0x1530
push 0xd6d
push 0x1152
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x30]
mov ecx, 0xd07ddbf4
push 0
mov eax, dword [ebp + eax*4 - 0x570]
mov dword [ebp - 0x568], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002fcf3
xor eax, eax
mov ecx, 0xd07ddbf4
mov dword [ebp - 0x3c], 0x60477862
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002fe93
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x558], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fe7a
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x1002fead
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffff
je 0x1002fe9c
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x10030028
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x18], eax
jmp 0x1002fef2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x704], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002fee1
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x558], 0
jne 0x1002ff43
mov eax, dword [ebp - 0x30]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x704], 0x56df
mov eax, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x558]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x558]
mov eax, dword [ebp - 0x48]
sub ecx, eax
cmp ecx, edi
jge 0x1002ff43
xor eax, eax
mov ecx, eax
jmp 0x1002ff45
mov ecx, edi
mov eax, dword [ebp - 0x30]
xor edx, edx
add ecx, 0x955205
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
sub edx, 0xe26b5cfd
mov eax, dword [ebp + eax*4 - 0x558]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, edx, 0xffff
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jle 0x1002ffd4
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], eax
jl 0x10030005
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1002ffbc
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ffa1
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xaac], 0
jne 0x1002ffba
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
push 0
pop eax
jle 0x1002ff93
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1002ffcd
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x1002ff8a
jmp 0x10030005
cmp dword [ebp - 0x3c], eax
jne 0x10030026
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10030005
push 0x110c
push 0x1530
push 0xd6d
push 0x1152
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x30]
mov ecx, 0xd07ddbf4
push 0
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x550], eax
dec dword [ebp - 0x30]
pop eax
jns 0x1002febd
xor eax, eax
mov dword [ebp - 0x24], 0x92443250
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], 0xfd66c4a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10030059
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x698], 0xf57440e7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030041
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030078
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
je 0x100300af
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x100300a0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0x2401dbda
jne 0x100300ad
mov eax, edi
jmp 0x100300af
xor eax, eax
xor edx, edx
mov ecx, 0xffff
cmp eax, ecx
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x95610a1
cmp ecx, dword [ebp - 0x24]
jl 0x100300df
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100300df
cmp dword [ebp - 0x24], eax
je 0x100300df
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x698], edi
xor eax, eax
mov dword [ebp - 0x3c], 0x60477862
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003011d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x588], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10030104
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x10030137
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffff
je 0x10030126
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x100302b2
mov ecx, 0xd07ddbf4
mov dword [ebp - 0x9ec], ecx
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x9e4], ecx
mov dword [ebp - 0x9e0], ecx
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x18], eax
jmp 0x10030181
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x714], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10030170
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x588], 0
jne 0x100301d2
mov eax, dword [ebp - 0x30]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0x588]
mov dword [ebp - 0x714], 0x56df
mov eax, dword [ebp - 0x9e4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x588]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x588]
mov eax, dword [ebp - 0x48]
sub ecx, eax
cmp ecx, edi
jge 0x100301d2
xor eax, eax
mov ecx, eax
jmp 0x100301d4
mov ecx, edi
mov eax, dword [ebp - 0x30]
xor edx, edx
add ecx, 0x955205
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
sub edx, 0xe26b5cfd
mov eax, dword [ebp + eax*4 - 0x588]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, edx, 0xffff
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x3c]
jle 0x10030263
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], eax
jl 0x10030294
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1003024b
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030230
push eax
push eax
push eax
call ebx
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x9ec], 0
jne 0x10030249
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
push 0
pop eax
jle 0x10030222
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003025c
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x10030219
jmp 0x10030294
cmp dword [ebp - 0x3c], eax
jne 0x100302b0
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10030294
push 0x110c
push 0x1530
push 0xd6d
push 0x1152
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x30]
push 0
mov eax, dword [ebp + eax*4 - 0x588]
mov dword [ebp - 0x580], eax
dec dword [ebp - 0x30]
pop eax
jns 0x10030147
xor eax, eax
mov dword [ebp - 0x24], 0x92443250
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], 0xfd66c4a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100302e3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a0], 0xf57440e7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100302cb
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030306
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
jmp 0x1003030c
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
je 0x10030343
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x10030334
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0x2401dbda
jne 0x10030341
mov eax, edi
jmp 0x10030343
xor eax, eax
xor edx, edx
mov ecx, 0xffff
cmp eax, ecx
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x95610a1
cmp ecx, dword [ebp - 0x24]
jl 0x10030373
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10030373
cmp dword [ebp - 0x24], eax
je 0x10030373
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x84cb8f6c
push 7
pop eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100303ba
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x240], 0x3638ecf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100303a2
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100303cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1160], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100303bf
mov ecx, dword [ebp - 0x240]
xor edx, edx
mov eax, dword [ebp - 0x240]
mov ebx, 0x31c587c7
cmp ecx, eax
mov eax, dword [ebp - 0x240]
push 8
setne dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x115c], ecx
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jg 0x1003050f
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x14], 0xf576c516
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x38], 0x5fe96f77
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1003045d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1314], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10030445
xor eax, eax
mov dword [ebp - 0x14], 0x19
jmp 0x100304e3
mov dword [ebp - 0x28], 0x4b0b4ef6
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100304a5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x82c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030491
xor eax, eax
mov dword [ebp - 0x82c], 0xffffffef
jmp 0x100304d7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x28], 0xce7aebb
mov dword [ebp - 0x28], 0xc4b79a97
inc dword [ebp - 0x38]
inc dword [ebp - 0x82c]
cmp dword [ebp - 0x82c], 0xfffffff4
jne 0x100304b1
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
je 0x10030466
mov dword [ebp - 0x14], 0xc
jmp 0x100304fe
cmp dword [ebp - 0x34], eax
jne 0x10030503
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
je 0x100304f6
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10030414
xor eax, eax
mov dword [ebp - 0x58], 0x2b9193c1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030538
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 0x624039b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030520
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030558
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030540
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10030578
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x724], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030560
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030596
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], eax
jl 0x1003064c
push 9
pop ebx
mov dword [ebp - 0x38], 0xfffffff6
xor edx, edx
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp ecx, eax
mov eax, dword [ebp - 0x94]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp eax, 0xffff3833
mov eax, dword [ebp - 0x94]
setg cl
xor edx, edx
cmp ecx, 0xbd3aeb59
mov eax, dword [ebp + eax*4 - 0x1a4]
setne dl
add eax, edx
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
add edx, ebx
cmp edx, eax
setne cl
mov dword [ebp - 0x724], ecx
dec dword [ebp - 0x94]
jns 0x100305ab
xor eax, eax
mov ebx, 0x31c587c7
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x34], 0x6ebbfad0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1003067a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd04], 0x15e0c0a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030662
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, 0xfffc
cmp dword [ebp - 0x14], edi
jge 0x1003069b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x430], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030687
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100306a8
cmp dword [ebp - 0x1c], eax
jne 0x100306ae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jg 0x100306a0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff7
jne 0x100307c8
push 3
pop ecx
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x28], 0x58d83f7c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], 0x27a4ef21
mov dword [ebp - 0x28], 0x167d3d8e
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0xf0bde8af
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x30], 0xf
cmp dword [ebp - 0x30], 0x12
jl 0x10030769
mov dword [ebp - 0x38], 4
cmp dword [ebp - 0x1c], eax
jne 0x10030731
cmp dword [ebp - 0x30], eax
jne 0x10030722
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
neg edx
push 0
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x9034e105
setne al
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x12
pop eax
jge 0x1003070e
push 3
pop ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jl 0x100307bb
mov dword [ebp - 0x28], 0xd4e2095e
mov dword [ebp - 0x28], 0x16e074f0
mov dword [ebp - 0x28], 0x8307b364
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100307b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1390], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030798
xor eax, eax
inc dword [ebp - 0x430]
dec dword [ebp - 0x30]
jns 0x10030771
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
je 0x100306be
mov dword [ebp - 0x50], 0x60477862
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100307e7
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003080d
push eax
push 0x6ed
push 0x5d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x3c], 0x8ee41b66
mov dword [ebp - 0x18], 0x20274952
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10030854
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0c], 0xcc9105fa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003083b
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030870
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x45c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003085c
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10030898
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0x45bbbdeb
setg al
cmp eax, dword [ebp - 0x3c]
jne 0x10030898
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003089a
mov eax, edi
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x100308b9
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x100308e2
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x45c]
mov eax, dword [ebp - 0xb04]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb08]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030910
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6a8], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100308f8
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10030930
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd10], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10030918
xor eax, eax
mov dword [ebp - 0x6a8], 0x64a6847d
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030963
push eax
push eax
push 0x25b8
push eax
push 0xc41
push eax
push 0xd88
push 0x1fd
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10030986
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x528], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003096e
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x34], 0xdfdaf0b5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100309b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeec], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003099d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100309d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x204], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100309bf
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100309f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x734], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100309dc
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030a0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x204], ecx
cmp dword [ebp - 0x204], eax
jl 0x10030ac2
mov dword [ebp - 0x20], 0xc3d21462
xor edx, edx
mov dword [ebp - 0x38], 0x15a8df04
mov dword [ebp - 0x18], 6
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0xeec]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0xee8]
setl dl
xor ecx, ecx
cmp edx, eax
push 3
setl cl
xor eax, eax
test ecx, ecx
pop ecx
sets al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp + eax*4 - 0xeec]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x204]
xor eax, eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x10030ab4
mov dword [ebp - 0x18], eax
jmp 0x10030aaa
cmp dword [ebp - 0x34], eax
jne 0x10030aaf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x10030aa2
dec dword [ebp - 0x2c]
jns 0x10030a9d
dec dword [ebp - 0x204]
jns 0x10030a20
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x10030c31
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x76df7e44
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], eax
jmp 0x10030af9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7b0], 0x9b642c70
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030ae8
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x7a4], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10030c11
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x34], 0xd9c7279c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10030b46
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10d0], 0x93c1de6f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10030b2e
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030b62
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jg 0x10030c0e
mov dword [ebp - 0x28], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x58], 0xfffffff6
mov eax, dword [ebp - 0x7ac]
mov eax, dword [ebp - 0x24]
push 3
mov eax, dword [ebp + eax*4 - 0x7b0]
test eax, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
sub edx, 0xba5e
neg edx
sbb edx, edx
or eax, 0xffffffff
inc edx
sub eax, edx
xor edx, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x20]
mov ecx, dword [ebp - 0x7ac]
mov eax, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0x58]
cmp ecx, eax
sete dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x7b0]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x7a4], edx
mov dword [ebp - 0x10cc], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10030b6e
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
jl 0x10030b15
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xffffffff
push 0
pop eax
je 0x10030acf
mov dword [ebp - 0x18], 0x13532fe2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030c5a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd38], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030c41
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030c7c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcf8], 0x5010f7a7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10030c63
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x10030ca6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd38]
cmp eax, 5
setle cl
mov dword [ebp - 0xcf8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10030c84
xor eax, eax
mov dword [ebp - 0x14], 2
mov ecx, 0x81c37f5e
cmp dword [ebp - 0x14], eax
jl 0x10032b46
jmp 0x10030cbf
xor eax, eax
mov dword [ebp - 0x30], 0x3fcb50bf
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xa6c], ecx
mov dword [ebp - 0xa68], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10030d0d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x494], 0xa8eac8b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10030cf4
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x10030f3d
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10030d3c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x51c], 0x8876942a
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10030d24
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x10030d5c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1ac], 0xc9f196e6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x10030d44
xor eax, eax
mov dword [ebp - 0x514], ebx
cmp dword [ebp - 0x514], eax
jl 0x10030ed7
mov dword [ebp - 0x28], 0xf22a1efe
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x96a9cbd
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], 0xfffb
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10030db0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1354], 0x1401cea0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10030d98
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10030dd2
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xa8c], 0x438
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x10030db9
xor eax, eax
cmp dword [ebp - 0x488], eax
jne 0x10030e34
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x494]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x494]
mov eax, dword [ebp - 0x514]
mov ecx, dword [ebp - 0x48c]
mov eax, dword [ebp - 0x518]
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
inc edx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1ac], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x494]
add eax, dword [ebp - 0x494]
jne 0x10030e34
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x494]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x494]
mov eax, dword [ebp - 0x514]
mov eax, dword [ebp - 0x30]
inc eax
je 0x10030e83
mov dword [ebp - 0x28], 0x9a488d5
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x72f2599
mov dword [ebp - 0x18], eax
jmp 0x10030e76
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x136c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10030e65
dec dword [ebp - 0xa8c]
jmp 0x10030ec8
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10030e9b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6e4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10030e8a
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x1ac], eax
dec dword [ebp - 0x514]
push 0
pop eax
jns 0x10030d6e
mov eax, dword [ebp - 0xa70]
xor edx, edx
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x30]
push 0
mov eax, dword [ebp + eax*4 - 0x494]
cmp eax, edi
mov eax, dword [ebp - 0x30]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x494]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, 0x15e7
setge dl
sub edx, 0x947
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0x494]
add edx, dword [ebp - 0xa74]
mov dword [ebp - 0x1ac], edx
dec dword [ebp - 0x30]
pop eax
jns 0x10030d1c
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030f56
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10030fae
push eax
push 0x269f
push 0x1368
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10030fd4
push eax
push 0x16b
push 0x231f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
xor eax, eax
mov ecx, 0xd07ddbf4
mov dword [ebp - 0xa0c], ecx
mov dword [ebp - 0xa08], ecx
mov dword [ebp - 0xa04], ecx
mov dword [ebp - 0xa00], ecx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xcd33
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], 0x25739271
mov dword [ebp - 0x28], 0x31bb000e
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x58], 0xa9c1c73b
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10031047
push 9
pop ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2e0], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10031033
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003105d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1384], 6
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x1003104c
mov eax, dword [ebp - 0x2d8]
xor ecx, ecx
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x2d8]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2dc]
setg dl
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
cmp edx, ecx
jle 0x1003109b
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2d8], eax
je 0x1003109d
mov ecx, edi
mov eax, dword [ebp - 0x2d8]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2d8]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x2d8]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2d8]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2dc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xffffffff
setl al
mov dword [ebp - 0x38], eax
xor eax, eax
inc dword [ebp - 0x58]
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x2c], 0x3ae35568
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x5571
mov dword [ebp - 0x58], 0x4d94
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10031155
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd8], 0xfffffff7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1003113c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 6
je 0x10031425
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jne 0x10031404
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jg 0x1003131c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
jmp 0x100311bc
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x127c], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x100311ab
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xd8], 0
je 0x10031218
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 0xd8]
jge 0x1003120c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edi
push 0xc
setge cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ebx, ebx
cmp edx, 0x6fc33146
mov eax, dword [ebp + eax*4 - 0xd8]
setle bl
xor ecx, ecx
sub ebx, 6
cmp ebx, eax
mov eax, dword [ebp - 0x48]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
add edx, dword [ebp + eax*4 - 0xd8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x3843afee
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setge dl
mov dword [ebp - 0x1274], edx
xor edx, edx
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x3c]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0xd4]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 2
pop ecx
setne al
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0xfffffffb
cmp dword [ebp - 0x44], ecx
je 0x1003130d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100312fc
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], ecx
je 0x100312f9
mov dword [ebp - 0x34], 0xb0e3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xd8]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jne 0x100312db
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x100312d3
dec dword [ebp - 0x20]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ecx
jne 0x100312ce
inc dword [ebp - 0x30]
push 0
pop eax
cmp dword [ebp - 0x30], edi
jle 0x100311a3
mov dword [ebp - 0x1c], 0x13
jmp 0x100313eb
mov dword [ebp - 0x48], 0x7c80
mov dword [ebp - 0x34], 0x52606bde
mov dword [ebp - 0x3c], eax
jmp 0x1003136f
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
cmp eax, 0x325e6b71
setl cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x1003133b
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10031393
mov ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
inc eax
add eax, ecx
je 0x10031391
mov eax, edi
jmp 0x10031393
xor eax, eax
cmp eax, dword [ebp - 0x3c]
jg 0x100313a3
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100313a5
mov edx, edi
jmp 0x100313a7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x58]
jle 0x100313bf
mov ecx, edi
cmp dword [ebp - 0x30], eax
jne 0x100313c1
mov ecx, eax
xor eax, eax
cmp ecx, 0x6c5b50a7
push 0
sete al
xor edx, edx
add eax, 0x354e
cmp eax, edi
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jne 0x10031328
inc dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], edi
je 0x10031189
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031415
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jne 0x10031162
push 3
pop ebx
mov dword [ebp - 0x2c], 0xc29a3df6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1003144c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6b0], 0x1124f01c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031434
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031467
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10031488
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x6b0], 0
jne 0x10031486
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1003146f
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x100314a8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6b8], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031490
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x100314cf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x744], 0xc2e0cf57
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100314b7
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x100314ef
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x744], 0xf94f3783
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100314d7
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031500
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x528], 0
jne 0x1003154c
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0x528]
mov dword [ebp - 0x6b8], 0x56df
mov eax, dword [ebp - 0xa04]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x528]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x528]
mov eax, dword [ebp - 0x18]
sub ecx, eax
cmp ecx, edi
jge 0x1003154c
xor eax, eax
mov ecx, eax
jmp 0x1003154e
mov ecx, edi
mov eax, dword [ebp - 0x14]
xor edx, edx
add ecx, 0x955205
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
sub edx, 0xe26b5cfd
mov eax, dword [ebp + eax*4 - 0x528]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, edx, 0xffff
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x50]
jle 0x10032387
mov dword [ebp - 0x48], 0x7fd5464b
mov dword [ebp - 0x48], eax
jmp 0x100316b9
mov dword [ebp - 0x2c], 0xb1c2a2c7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x274cb070
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100315cb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6d0], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100315b3
xor eax, eax
mov dword [ebp - 0x2c], 0xa
jmp 0x100316ac
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x28], 0xafc8d679
mov dword [ebp - 0x4f4], eax
jmp 0x1003168c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 0xec62d7f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1003166e
push 9
pop ecx
push 0xfffffffffffffffe
pop edx
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x38], 0xf8c51723
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x58], 0x42353725
cmp dword [ebp - 0x40], eax
je 0x1003163f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4f4]
mov dword [ebp + eax*4 - 0x6d0], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1003161c
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031686
push 0x2611
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
inc dword [ebp - 0x4f4]
cmp dword [ebp - 0x4f4], eax
jle 0x10031604
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100316a9
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jg 0x100315d7
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe9
jne 0x1003159a
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x50], eax
jl 0x10032261
push 2
pop esi
mov dword [ebp - 0x38], 0x9e923e64
mov dword [ebp - 0x34], 0x9b7928f
mov dword [ebp - 0x18], eax
jmp 0x100316f6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x610], 0xe1757117
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100316e5
mov dword [ebp - 0x608], 0xfffffff3
jmp 0x1003172d
mov dword [ebp - 0x34], 0xfffffffb
xor edx, edx
mov ecx, dword [ebp - 0x60c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setl dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x608]
cmp dword [ebp - 0x608], 0xd
jl 0x10031707
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10031c86
mov dword [ebp - 0x28], 0x11d9
mov dword [ebp - 0x38], 0xe86f8c7b
mov dword [ebp - 0x28], 0x369bd69
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031775
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x139c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031761
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10031795
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd1c], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003177d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x100317b7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14b4], 0xc58f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1003179e
xor eax, eax
inc dword [ebp - 0x38]
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100317dd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdc], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100317c9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100317fd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe4], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100317e5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003181d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10031805
xor eax, eax
mov dword [ebp - 0xe0], eax
jmp 0x1003185b
mov dword [ebp - 0x34], 0x5c285ce9
xor ecx, ecx
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0xdc], ecx
jne 0x1003184e
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0xdc], ecx
mov eax, ecx
je 0x10031850
mov eax, edi
mov dword [ebp - 0x34], eax
inc dword [ebp - 0xe0]
xor eax, eax
cmp dword [ebp - 0xe0], eax
jle 0x10031825
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
sub ecx, eax
mov dword [ebp - 0xe0], ecx
cmp dword [ebp - 0xdc], ecx
jg 0x10031891
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x38], 8
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x6d4], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xb0b5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x100318e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x84], 0x4e2db58
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100318c8
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100318fe
push eax
push 0x20f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x100319e0
mov dword [ebp - 0x34], ebx
xor edx, edx
mov eax, dword [ebp - 0x30]
push 3
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x84]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x84]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor ebx, ebx
cmp ecx, 0xe022
mov eax, dword [ebp + eax*4 - 0x84]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x84]
setge dl
xor ecx, ecx
cmp edx, eax
pop ebx
setl cl
xor eax, eax
cmp ecx, edi
setl al
xor ecx, ecx
imul esi, eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x34]
sub esi, eax
cmp esi, edx
mov eax, edi
setge cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0xfffe
mov eax, dword [ebp - 0x30]
setne cl
add ecx, 0x35204e51
sub ecx, dword [ebp + eax*4 - 0x84]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x1003190a
mov byte [ebp - 0xd], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xb0b5
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x10031a0a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x78], 0x4e2db58
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x100319f5
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10031a28
push eax
push 0x20f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10031ae9
mov dword [ebp - 0x34], ebx
xor edx, edx
mov eax, dword [ebp - 0x30]
push 3
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x78]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor ebx, ebx
cmp ecx, 0xe022
mov eax, dword [ebp + eax*4 - 0x78]
setle bl
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x78]
mov esi, dword [ebp - 0x78]
setge dl
xor ecx, ecx
cmp edx, eax
pop ebx
setl cl
xor eax, eax
cmp ecx, edi
setl al
xor ecx, ecx
imul esi, eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x34]
sub esi, eax
cmp esi, edx
mov eax, edi
setge cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0xfffe
mov eax, dword [ebp - 0x30]
setne cl
add ecx, 0x35204e51
sub ecx, dword [ebp + eax*4 - 0x78]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10031a34
cmp byte [ebp - 0xd], 0
push 3
pop ebx
je 0x10031b5f
mov ecx, 0xffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031b1a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x11d8], 0xe52d8cb4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031b02
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031b3a
push 0x12da
push 0x727
push eax
push eax
push 0xda0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x2a43
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x40]
push eax
push eax
push eax
mov dword [ebp - 0x11d8], ecx
call dword [sym.imp.USER32.dll_UnionRect]
xor eax, eax
mov dword [ebp - 0x24], 0x136951ad
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031b88
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd4c], 0xec0ae971
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031b70
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop esi
jmp 0x10031bbd
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031bba
push eax
push 0x20f0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10031b90
mov dword [ebp - 0x24], eax
jmp 0x10031c5f
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031bea
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x510], 0x1328f6c7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031bd2
xor eax, eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], esi
jg 0x10031c5c
mov dword [ebp - 0x2c], eax
jmp 0x10031c0e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe04], 0x3f5047c4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10031bfd
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebp + eax*4 - 0xd4c]
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0xd4c], ecx
xor eax, eax
mov dword [ebp - 0xe04], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031c4b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
inc dword [ebp - 0x50c]
push 0
pop eax
cmp dword [ebp - 0x50c], esi
jle 0x10031bf8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10031bca
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa0c], 0
jne 0x10031c84
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x10031744
xor eax, eax
mov dword [ebp - 0x1c], 0x93b4e1a3
mov dword [ebp - 0x88c], 0x71e9942c
mov dword [ebp - 0x888], 0x71e9942c
mov dword [ebp - 0x884], 0x71e9942c
mov dword [ebp - 0x880], 0x71e9942c
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], 0xe78d
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10031ce9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfd0], 0x5ab1361
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10031cd1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc
jge 0x10031d41
mov dword [ebp - 0x18], 0x1da622a1
cmp dword [ebp - 0x18], eax
jne 0x10031d23
mov edx, dword [ebp - 0x18]
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x18]
jg 0x10031d16
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, 0x1a82
je 0x10031d25
mov eax, edi
mov ecx, 0xf759609c
cmp ecx, eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
pop eax
jl 0x10031cf2
push 4
pop ecx
mov dword [ebp - 0x1c], 0xffffffeb
cmp dword [ebp - 0x1c], 0xfffffffb
jl 0x10031eab
jmp 0x10031d56
xor eax, eax
mov dword [ebp - 0x7c8], ecx
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7c0], ecx
mov dword [ebp - 0x7bc], ecx
mov ecx, 0xffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], 0x62c80f3b
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
jmp 0x10031d92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x61c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031d85
mov eax, dword [ebp - 0x884]
inc dword [ebp - 0x614]
mov eax, dword [ebp - 0x614]
jne 0x10031df3
xor eax, eax
cmp dword [ebp - 0x884], eax
je 0x10031db8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x7c0], 0xd71021f5
mov eax, dword [ebp - 0x614]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
xor eax, eax
cmp dword [ebp - 0x7c0], ecx
je 0x10031de6
cmp dword [ebp - 0x34], eax
je 0x10031de6
mov eax, edi
cmp edi, eax
sbb eax, eax
neg eax
cmp eax, 0x3c34f970
jne 0x10031df6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7c0]
xor edx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xfc4]
mov eax, dword [ebp - 0x884]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x38]
je 0x10031e26
mov ecx, edi
cmp dword [ebp - 0x618], eax
jne 0x10031e28
mov ecx, eax
xor eax, eax
cmp ecx, 0x23ee1e16
setne al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x7c0]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x614]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xfc8], eax
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], al
je 0x10031e79
cmp byte [ebp - 0xd], al
je 0x10031e9b
push 0x201e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x10031e9b
cmp byte [ebp - 0xd], al
je 0x10031e9b
push edi
push 0x1f2f
push 0x1ba
push 0x3ba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
push 4
pop ecx
jge 0x10031d54
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10031ecd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10031eb5
xor eax, eax
mov dword [ebp - 0xd0], eax
jmp 0x10031f37
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031ef1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x710], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031edd
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031f03
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor eax, eax
mov dword [ebp - 0x70c], 0xfffffffe
jmp 0x10031f28
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031f22
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor eax, eax
dec dword [ebp - 0x70c]
cmp dword [ebp - 0x70c], 0xfffffffa
jl 0x10031f0f
dec dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], 0xfffffff7
jne 0x10031ed5
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd0], eax
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x10031f71
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x3e0], 0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10031f59
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x10031f91
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xd60], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10031f79
xor eax, eax
cmp dword [ebp - 0x3e0], eax
je 0x10031ff4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x38], 0x5d2d9150
mov dword [ebp - 0x38], edi
mov edx, dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x3e0]
neg edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
sbb edx, edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3e0]
cmp eax, ecx
mov eax, dword [ebp - 0x3dc]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x38], ecx
jmp 0x10032000
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xd58], eax
mov dword [ebp - 0xd5c], 0x1874da8
cmp byte [ebp - 0xd], 0
je 0x1003224d
mov dword [ebp - 0x1c], 0x7a876e6b
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10032047
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1c4], 0x99ff6065
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003202f
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x100321b1
mov dword [ebp - 0x30], 0xbd94543b
mov dword [ebp - 0x2c], eax
jmp 0x10032070
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x40c], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003205f
dec dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ebx, ebx
cmp edx, 0xff68e1
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c4]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
imul ecx, edx, 0xdfc
xor edx, edx
cmp ecx, eax
sete dl
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jge 0x100320df
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
mov eax, dword [ebp - 0x30]
add ecx, 0xffff8a23
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40c]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x1c0]
je 0x1003219b
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032145
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6e8], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10032138
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6e8], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100321a5
push 0xa5b
push 0x2295
push 0x1815
push 0x1b5e
push 0x21c0
push 0x18d0
push 0x22bb
push 0x1c3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x100321a5
mov dword [ebp - 0x408], 0xfffffff6
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x10032053
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x100321ce
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x772a
mov eax, dword [ebp - 0x1c4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
sete bl
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, ebx
setl dl
add eax, 0x3d06
add edx, eax
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c0]
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 3
pop ebx
dec dword [ebp - 0x50]
push 0
pop eax
jns 0x100316d2
mov esi, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032284
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x780], 0xec0ae971
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003226c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100322a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13e4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003228c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100322c4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3bc], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100322ac
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10032b08
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1003231d
mov dword [ebp - 0x28], 0x2276b87d
mov dword [ebp - 0x38], 0x3051ebf0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10032315
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x13fc], 0xc9a57b5b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100322fd
xor eax, eax
dec dword [ebp - 0x38]
dec dword [ebp - 0x18]
jns 0x100322e7
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x780]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x780]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3bc]
cmp eax, ecx
mov eax, dword [ebp - 0x3bc]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x780]
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setle cl
imul ecx, ecx, 0x43e2
cmp dword [ebp + eax*4 - 0x780], ecx
je 0x10032ac5
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10032ac7
mov edx, edi
jmp 0x10032ac9
mov dword [ebp - 0x24], 0x4c506d44
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x44d1878a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100323b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10e8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100323a0
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
jmp 0x10032559
mov dword [ebp - 0x3c], 0xa6b950ba
mov dword [ebp - 0x38], 0xd5f49dcb
mov dword [ebp - 0x58], 0x3b947e29
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x10032556
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xa5fef9d7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032542
mov dword [ebp - 0xbcc], 0x50ba
mov dword [ebp - 0xbc8], 0x50ba
mov dword [ebp - 0xbc4], 0x50ba
mov dword [ebp - 0xbc0], 0x50ba
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x48], eax
jmp 0x10032536
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x10032514
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x38], 0x60be6286
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x100324e9
mov dword [ebp - 0x44], eax
jmp 0x1003247f
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1178], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x1003246e
mov eax, dword [ebp - 0x18]
xor edx, edx
push 0
mov ecx, dword [ebp + eax*4 - 0x10e8]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setl dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x18]
sub edx, 0x92d1
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0xbcc], edx
mov eax, dword [ebp - 0x5c]
cmp edx, eax
setne cl
imul eax, ecx, 3
xor ecx, ecx
cmp eax, 0xbbbb
pop eax
setle cl
mov dword [ebp - 0x1174], ecx
dec dword [ebp - 0x18]
jns 0x10032469
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032508
push eax
push eax
push 0xef5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor eax, eax
dec dword [ebp - 0x20]
push 2
pop ecx
jns 0x10032448
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032533
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ecx
jle 0x10032435
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10032402
dec dword [ebp - 0x3c]
jns 0x100323e4
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x100323c3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003257a
push eax
push 0x22c4
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x10032b41
mov dword [ebp - 0x3c], 0x33fc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0x8e85a7b0
mov dword [ebp - 0x1c], 0x53589fe5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0x1dd79339
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x100325c5
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x250], 0xaa08
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x100325ad
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100325e5
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x13b4], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100325cd
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10032600
mov eax, dword [ebp - 0x250]
inc dword [ebp - 0x250]
test eax, eax
je 0x100325fe
mov esi, edi
jmp 0x10032602
xor eax, eax
mov esi, eax
mov dword [ebp - 0x30], 0x1880
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle bl
imul eax, esi
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x44]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
cmp ecx, 0x1f0dfbc4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
setne bl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x44]
cmp ebx, eax
sete cl
xor eax, eax
add ecx, dword [ebp - 0x18]
cmp ecx, edi
setg al
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x3c]
test eax, eax
je 0x1003276e
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x3c], 0x1c
jmp 0x10032731
mov dword [ebp - 0x58], 0xffffffff
xor eax, eax
mov dword [ebp - 0x38], 0x6ae2ad21
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x30], eax
jmp 0x100326de
mov dword [ebp - 0x44], eax
jmp 0x100326d3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100326d0
push 0x205b
push 0x530
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jle 0x100326b4
inc dword [ebp - 0x20]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe2
jle 0x100326af
cmp dword [ebp - 0x30], eax
je 0x1003270a
mov ecx, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x38], eax
je 0x10032708
mov ecx, edi
jmp 0x1003270c
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x5c]
xor edx, edx
sub ecx, eax
add ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jge 0x10032697
mov dword [ebp - 0x1c], 6
cmp dword [ebp - 0x1c], 0x17
jne 0x100327a1
push 9
pop eax
mov dword [ebp - 0x30], eax
jmp 0x1003275d
mov dword [ebp - 0x38], 0x1904383
dec dword [ebp - 0x38]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff0
jl 0x10032750
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
je 0x1003274b
jmp 0x100327a1
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003279b
mov dword [ebp - 0x38], 0x785b
dec dword [ebp - 0x38]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032798
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x12
je 0x10032775
mov dword [ebp - 0x18], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x34], 0xff23b1a9
mov dword [ebp - 0x5c], 0xfffffff7
mov dword [ebp - 0x38], 0x576c5165
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x40], 0xb0b4ef66
push 3
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x100327ec
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd74], 0x5b2906c9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100327db
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0xd70]
mov eax, dword [ebp - 0x58]
cmp eax, edi
setge cl
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jne 0x10032815
mov esi, eax
cmp dword [ebp - 0x58], eax
je 0x10032817
mov esi, edi
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x40], 0xffffffff
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setge al
neg eax
mov dword [ebp - 0xd74], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032259
mov dword [ebp - 0x24], 0xa5043c4a
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x40], 0x1434a938
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], 0x82f744ed
push 2
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], 0xe6f96354
mov dword [ebp - 0x28], 0xad33dc28
mov dword [ebp - 0x28], 0x66fa41d
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x28], 0x98c3
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100328bd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x458], 0xa26f3f17
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100328a5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100328dd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13cc], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100328c5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100328fd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x123c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100328e5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032913
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb30], 0xf3c8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032902
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x450]
mov eax, dword [ebp - 0x450]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10032937
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003294e
cmp dword [ebp - 0x454], eax
je 0x1003294e
mov eax, edi
mov dword [ebp - 0x458], eax
cmp eax, dword [ebp - 0x24]
je 0x1003296a
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003296a
mov edx, eax
cmp dword [ebp - 0x454], eax
je 0x1003296c
mov edx, edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
sub ecx, 0x5b01
cmp ecx, edi
setl al
add eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x5879
setne cl
cmp ecx, 0xefc7127b
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [ebp - 0x458]
setle dl
xor ebx, ebx
cmp esi, edx
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x450]
jle 0x10032a05
cmp dword [ebp - 0x2c], eax
je 0x10032a05
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10032a93
push 0x11e6
push eax
push 0x2296
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x10032a93
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x28], 0xa684085e
mov dword [ebp - 0x28], 0x28a21817
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032a42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12e4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032a29
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10032a84
mov ecx, dword [ebp - 0x58]
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setge bl
inc dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xb2c]
xor edx, edx
imul ecx, eax, 0x9b58
mov eax, dword [ebp - 0x450]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, ebx
setle al
cmp eax, edi
jle 0x10032a84
xor eax, eax
mov edx, eax
jmp 0x10032a86
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
push 0x110c
push 0x1530
push 0xd6d
push 0x1152
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 3
pop ebx
jmp 0x1003225f
xor eax, eax
mov edx, eax
mov dword [ebp - 0x38], 0xa017
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp edx, 8
push 0
setg cl
mov dword [ebp + eax*4 - 0x780], edx
mov eax, dword [ebp - 0x38]
add eax, 0xffff8fd2
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
pop eax
push 3
pop ebx
jle 0x100322d1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032b23
push 0x201e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [ebp - 0x14]
mov ecx, 0x81c37f5e
mov eax, dword [ebp + eax*4 - 0x528]
mov dword [ebp - 0x520], eax
dec dword [ebp - 0x14]
jns 0x10030cbd
mov ebx, 0x31c587c7
mov dword [ebp - 0x48], 0x5baf43b7
mov dword [ebp - 0x24], 0x3d8da8e9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10032c8c
mov dword [ebp - 0x34], 0xe1c5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032b8e
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xae4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032b79
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10032c89
mov dword [ebp - 0x2c], 0x210ec320
mov dword [ebp - 0x18], 0xca7b5cf1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032bc7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x534], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032bb3
xor eax, eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], ecx
jg 0x10032c80
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xae4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0xae4]
mov eax, dword [ebp - 0x52c]
add edx, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0xae4]
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp + eax*4 - 0xae4]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
sbb eax, eax
neg eax
add ecx, eax
xor eax, eax
cmp ecx, esi
setne al
imul eax, dword [ebp - 0x52c]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032c63
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032c60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xae4], 0x42be
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032c47
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jle 0x10032c3e
inc dword [ebp - 0x52c]
push 3
pop ecx
cmp dword [ebp - 0x52c], ecx
jle 0x10032bd9
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10032b9d
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xe
jl 0x10032b64
mov dword [ebp - 0x44], 0x92443250
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], 0xfd66c4a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10032cc7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a4], 0xf57440e7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10032caf
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032ce6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
je 0x10032d1d
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jl 0x10032d0e
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x44], 0x2401dbda
jne 0x10032d1b
mov eax, edi
jmp 0x10032d1d
xor eax, eax
xor edx, edx
mov ecx, 0xffff
cmp eax, ecx
mov eax, dword [ebp - 0x44]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x95610a1
cmp ecx, dword [ebp - 0x44]
jl 0x10032d4d
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032d4d
cmp dword [ebp - 0x44], eax
je 0x10032d4d
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x6a4], edi
xor eax, eax
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032d84
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x324], 0x9b3198a8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032d6b
xor eax, eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 2
jle 0x10032ef2
push 9
pop ebx
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0x788afb1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10032dcd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa3c], 0xfe5f36f6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032db4
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10032eed
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jg 0x10032eda
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0x23e629ba
mov dword [ebp - 0x18], eax
jmp 0x10032ebc
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0xa3c]
add eax, dword [ebp - 0x14]
je 0x10032e16
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10032ec5
jmp 0x10032eb9
mov dword [ebp - 0x20], edi
inc dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032e5a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x324]
mov edx, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
mov eax, dword [ebp - 0x14]
test eax, eax
setle cl
xor eax, eax
cmp ecx, edx
setl al
imul ecx, eax, 0xa42b
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
je 0x10032e23
xor edx, edx
mov dword [ebp - 0x58], 0xfffffff8
mov ecx, dword [ebp - 0x38]
mov esi, edi
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x2b0a
setle al
xor edx, edx
sub esi, eax
sub esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, esi
setge al
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10032df7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x44]
push 0
pop eax
cmp dword [ebp - 0x44], edi
jle 0x10032de2
inc dword [ebp - 0x324]
cmp dword [ebp - 0x324], 2
jg 0x10032d9a
mov ebx, 0x31c587c7
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x84cb8f6c
push 7
pop ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10032f2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x22c], 0x3638ecf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10032f13
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop esi
jmp 0x10032f40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1100], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10032f33
mov ecx, dword [ebp - 0x22c]
xor edx, edx
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
mov eax, dword [ebp - 0x22c]
setne dl
xor ecx, ecx
cmp edx, eax
push 2
setg cl
mov dword [ebp - 0x10fc], ecx
mov dword [ebp - 0x2c], 8
pop ecx
cmp dword [ebp - 0x2c], esi
jg 0x1003306e
xor eax, eax
mov dword [ebp - 0x24], 0xf576c516
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x38], 0x5fe96f77
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032fc9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124c], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032fb1
xor eax, eax
mov dword [ebp - 0x24], 0x19
cmp dword [ebp - 0x24], 0xf
jne 0x1003304c
or edx, 0xffffffff
mov dword [ebp - 0x28], 0x4b0b4ef6
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033008
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x720], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032ff4
xor eax, eax
mov dword [ebp - 0x720], 0xffffffef
jmp 0x1003303a
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x28], 0xce7aebb
mov dword [ebp - 0x28], 0xc4b79a97
inc dword [ebp - 0x38]
inc dword [ebp - 0x720]
cmp dword [ebp - 0x720], 0xfffffff4
jne 0x10033014
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
je 0x10032fd9
mov dword [ebp - 0x24], 0xc
jmp 0x1003305d
cmp dword [ebp - 0x34], eax
jne 0x10033062
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
je 0x10033055
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10032f80
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10033090
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11c0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10033078
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100330ac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x32c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10033098
xor eax, eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], esi
jge 0x100330db
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x11c0], 0xfffffffd
inc dword [ebp - 0x32c]
cmp dword [ebp - 0x32c], esi
jl 0x100330ba
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0xfcb143e9
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x48b08158
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x48], 0x884515fd
mov dword [ebp - 0x2c], 0xe974a520
mov dword [ebp - 0x40], 0xf9986e3e
mov dword [ebp - 0x18], 0x559653e3
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x93c], edi
mov dword [ebp - 0x938], edi
mov dword [ebp - 0x934], edi
mov dword [ebp - 0x930], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10033158
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x59c], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033140
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10033178
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3ec], 0x2f34111d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033160
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10033198
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x438], 0xaeb8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10033180
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100331b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcd8], 0x964b5ad8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100331a0
xor eax, eax
cmp dword [ebp - 0x24], 0xbf5c
jl 0x100331cd
cmp dword [ebp - 0x24], eax
je 0x100331cd
mov edx, edi
cmp dword [ebp - 0x48], eax
jne 0x100331cf
mov edx, eax
inc dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x598]
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x598]
neg esi
sbb esi, esi
neg esi
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x598]
cmp eax, 0xfffffff7
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
setle cl
add edx, ecx
sub eax, esi
inc dword [ebp - 0x40]
cmp edx, eax
jge 0x1003322e
mov eax, edi
jmp 0x10033230
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
cmp eax, 0xfffffff8
jbe 0x10033242
xor eax, eax
mov edi, eax
dec dword [ebp - 0x438]
xor edx, edx
mov esi, dword [ebp - 0xcd4]
mov dword [ebp - 0x938], esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xb3fa
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3e8]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3e8]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor eax, eax
sub esi, ecx
je 0x100332a1
cmp dword [ebp - 0x20], eax
je 0x100332a1
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x100332a6
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0x8960
setne al
cmp dword [ebp - 0x3e8], eax
jne 0x100332c1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp edi, eax
setg cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
inc edx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x3e8]
jl 0x100332ed
mov eax, dword [ebp - 0x938]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
add eax, 0x4b00f59f
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x598]
cmp edx, eax
push 3
setne cl
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], 0x5baf43b7
mov dword [ebp - 0x24], 0x3d8da8e9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], eax
pop edi
cmp dword [ebp - 0x48], 0xe
jge 0x10033460
mov dword [ebp - 0x34], 0xe1c5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10033363
mov ecx, 0xffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x954], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003334e
xor eax, eax
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x10033458
mov dword [ebp - 0x2c], 0x210ec320
mov dword [ebp - 0x18], 0xca7b5cf1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033399
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033385
xor eax, eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], edi
jg 0x1003344f
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x954]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x954]
mov eax, dword [ebp - 0x544]
add edx, eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0x954]
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp + eax*4 - 0x954]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
sbb eax, eax
neg eax
add ecx, eax
xor eax, eax
cmp ecx, esi
setne al
imul eax, dword [ebp - 0x544]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10033435
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10033432
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x954], 0x42be
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10033419
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jle 0x10033410
inc dword [ebp - 0x544]
cmp dword [ebp - 0x544], edi
jle 0x100333ab
xor eax, eax
dec dword [ebp - 0x24]
jns 0x1003336f
inc dword [ebp - 0x48]
jmp 0x1003332f
mov ecx, 0xf112
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x624], ecx
mov dword [ebp - 0x620], ecx
mov ecx, 0xcc254292
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x850], ecx
mov dword [ebp - 0x34], 0xfffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100334c0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x264], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100334ac
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x100334e3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf04], 0xf6a08376
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100334cb
xor eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], edi
jg 0x100335b0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], 0xa47cdedf
mov dword [ebp - 0x14], eax
jmp 0x10033592
mov dword [ebp - 0x40], 0xfffffff9
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x62c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x264]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x62c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x62c], edx
mov eax, dword [ebp - 0x40]
cmp eax, 0x356a
mov dword [ebp - 0x85c], eax
setle cl
add ecx, edx
jne 0x1003355a
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x62c], ecx
mov eax, ecx
je 0x1003355c
mov eax, ebx
mov dword [ebp - 0x38], eax
mov ecx, 0xa41449c9
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x624]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0xf04], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003358f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10033501
mov eax, dword [ebp - 0xf04]
inc dword [ebp - 0x50]
push 0
pop eax
cmp dword [ebp - 0x50], edi
jle 0x100334ef
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff8
je 0x1003367e
mov dword [ebp - 0x24], 0x8ffd
mov dword [ebp - 0x38], 0x8610f121
mov dword [ebp - 0x38], 0x571e9572
mov dword [ebp - 0x18], eax
jmp 0x100335e8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100335d7
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x854], eax
jne 0x10033628
mov ecx, dword [ebp - 0x264]
xor edx, edx
mov dword [ebp - 0x3c4], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0xa40a7b48
setge dl
imul edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x24]
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x24]
add eax, 4
add eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jne 0x1003364c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x264]
mov eax, dword [ebp - 0xf04]
cmp dword [ebp - 0x34], esi
push 0
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xf75b
pop eax
setne cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffff8
jne 0x100335bd
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x84cb8f6c
push 7
pop ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100336b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x234], 0x3638ecf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003369f
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100336c9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1118], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100336bc
mov ecx, dword [ebp - 0x234]
xor edx, edx
mov eax, dword [ebp - 0x234]
cmp ecx, eax
mov eax, dword [ebp - 0x234]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1114], ecx
mov dword [ebp - 0x2c], 8
cmp dword [ebp - 0x2c], edi
jg 0x100337fb
xor eax, eax
mov ecx, 0x31c587c7
mov dword [ebp - 0x24], 0xf576c516
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x38], 0x5fe96f77
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10033756
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12b4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003373d
xor eax, eax
mov dword [ebp - 0x24], 0x19
cmp dword [ebp - 0x24], 0xf
jne 0x100337d9
or edx, 0xffffffff
mov dword [ebp - 0x28], 0x4b0b4ef6
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033795
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7d4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033781
xor eax, eax
mov dword [ebp - 0x7d4], 0xffffffef
jmp 0x100337c7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x28], 0xce7aebb
mov dword [ebp - 0x28], 0xc4b79a97
inc dword [ebp - 0x38]
inc dword [ebp - 0x7d4]
cmp dword [ebp - 0x7d4], 0xfffffff4
jne 0x100337a1
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
je 0x10033766
mov dword [ebp - 0x24], 0xc
jmp 0x100337ea
cmp dword [ebp - 0x34], eax
jne 0x100337ef
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
je 0x100337e2
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1003370b
mov dword [ebp - 0x34], 2
xor eax, eax
mov dword [ebp - 0x28], 0xa149cec7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003382b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x184], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033813
xor eax, eax
mov dword [ebp - 0x184], 0xd
cmp dword [ebp - 0x184], 0xfffffff6
jle 0x1003387a
push 9
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jne 0x1003386b
mov dword [ebp - 0x34], 0x1551
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
je 0x1003384d
xor eax, eax
dec dword [ebp - 0x184]
cmp dword [ebp - 0x184], 0xfffffff6
jg 0x10033841
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100338a3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x34c], 0x9b3198a8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1003388a
xor eax, eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jle 0x10033a0f
mov dword [ebp - 0x44], 6
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0x788afb1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100338e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x994], 0xfe5f36f6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100338d0
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10033a0c
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x100339f9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0x23e629ba
mov dword [ebp - 0x18], eax
jmp 0x100339db
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x994]
add eax, dword [ebp - 0x14]
je 0x10033932
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100339e4
jmp 0x100339d8
mov dword [ebp - 0x20], ebx
inc dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033976
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
mov eax, dword [ebp - 0x14]
test eax, eax
setle cl
xor eax, eax
cmp ecx, edx
setl al
imul ecx, eax, 0xa42b
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x994], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
je 0x1003393f
xor edx, edx
mov dword [ebp - 0x58], 0xfffffff8
mov ecx, dword [ebp - 0x38]
mov esi, ebx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
push 9
setne dl
add edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x2b0a
setle al
xor edx, edx
sub esi, eax
sub esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
pop ecx
setge dl
xor eax, eax
cmp edx, esi
setge al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10033913
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x44]
push 0
pop eax
cmp dword [ebp - 0x44], ebx
jle 0x100338fe
inc dword [ebp - 0x34c]
cmp dword [ebp - 0x34c], 2
jg 0x100338b6
push 4
pop esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x34], 6
mov dword [ebp - 0xc8c], eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xc84], eax
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033a51
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1414], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033a3d
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10033aa2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033a76
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0x53aa9ac7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033a5e
xor eax, eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xffffffe3
jle 0x10033a9f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc80], eax
dec dword [ebp - 0x1a8]
cmp dword [ebp - 0x1a8], 0xffffffe3
jg 0x10033a85
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jg 0x10033a56
mov dword [ebp - 0x28], 0x8cccddd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10033acb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1190], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10033ab7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10033aeb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8e8], 0x15252cb1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10033ad3
xor eax, eax
mov dword [ebp - 0x8e0], 2
cmp dword [ebp - 0x8e0], eax
jl 0x10033b29
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x10033b21
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1190], 0
jne 0x10033b1f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10033b09
xor eax, eax
dec dword [ebp - 0x8e0]
jns 0x10033afd
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10033b4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x144], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033b38
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10033b6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xec], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10033b55
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10033b8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x784], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033b76
xor eax, eax
mov dword [ebp - 0xe8], eax
jmp 0x10033bcc
mov dword [ebp - 0x34], 0x5c285ce9
xor ecx, ecx
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x144], ecx
jne 0x10033bbf
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x144], ecx
mov eax, ecx
je 0x10033bc1
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0xe8]
xor eax, eax
cmp dword [ebp - 0xe8], eax
jle 0x10033b96
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
sub ecx, eax
mov dword [ebp - 0xe8], ecx
cmp dword [ebp - 0x144], ecx
jg 0x10033c02
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
push 8
pop ecx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x38]
mov dword [ebp - 0x784], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x92443250
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x76df7e44
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], eax
jmp 0x10033c57
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7e4], 0x9b642c70
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033c46
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x7d8], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10033d6e
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x34], 0xd9c7279c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033ca3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11e4], 0x93c1de6f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033c8b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033cbf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 8
xor eax, eax
pop ecx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jg 0x10033d6b
mov dword [ebp - 0x28], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x58], 0xfffffff6
mov eax, dword [ebp - 0x7e0]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x7e4]
test eax, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setl dl
sub edx, 0xba5e
neg edx
sbb edx, edx
or eax, 0xffffffff
inc edx
sub eax, edx
xor edx, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7e0]
add ecx, eax
mov eax, dword [ebp - 0x58]
cmp ecx, eax
sete dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x7e4]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
mov dword [ebp - 0x7d8], edx
mov dword [ebp - 0x11e0], edx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jle 0x10033ccb
push 8
xor eax, eax
pop ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10033c72
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 0xfd66c4a8
mov dword [ebp - 0x48], 0x3532fe22
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10033db0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5ec], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10033d97
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x10033ebb
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], eax
jmp 0x10033eaf
mov dword [ebp - 0x44], 0x795010f7
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033df1
cmp dword [ebp - 0x2c], ebx
jle 0x10033dc7
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jle 0x10033db8
or edi, 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xfffffffa
jmp 0x10033efb
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
jmp 0x10033ef2
cmp dword [ebp - 0x2c], edi
jne 0x10033ed3
mov esi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x2c], 0xa61928c1
mov dword [ebp - 0x2c], 0xfffffff4
jmp 0x10034052