Function at 0x100319da
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file size
Identify system language via api
Query or enumerate registry key
Read .ini file
Start service

Disassembly:
mov eax, 0x1008680d
call fcn.10086198
mov eax, 0x1318
call fcn.1006ebe0
mov dword [ebp - 0x60], ecx
xor eax, eax
or ecx, 0xffffffff
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0xffff
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 0x81ff7b51
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031a33
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x304], 0x18ab9c27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031a1a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031a55
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa80], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031a3c
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe6
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jle 0x10031c7f
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x321210cb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x136b8055
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xffffa476
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
setl cl
sub edx, ecx
imul edx, eax
mov dword [ebp - 0x2fc], edx
cmp edx, dword [ebp - 0x34]
je 0x10031baf
mov dword [ebp - 0x10], 0xc013
xor edx, edx
mov dword [ebp - 0x28], 0x62cf9e8b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa78]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
add eax, 0x95a2
imul eax, dword [ebp - 0x28]
push 6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x28]
imul eax, eax, 0x44f8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp ecx, eax
jl 0x10031b5a
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10031c7a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10031b8a
push eax
push eax
push eax
call edi
jmp 0x10031b88
mov dword [ebp - 0x50], 0xcede
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10031c64
push 0x1415
push 0x1244
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10031c64
mov dword [ebp - 0x10], 0x6c42336f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 0xc454
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xcd53b18
setle al
imul eax, dword [ebp - 0x38]
cmp eax, 0x1ef3
jne 0x10031be7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x5c]
xor edx, edx
cmp eax, 0x73e
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x2fc]
jne 0x10031c11
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10031c11
mov edx, eax
jmp 0x10031c16
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x300]
xor ecx, ecx
cmp edx, eax
setle cl
lea edx, [ecx + 0x5946]
xor ecx, ecx
mov dword [ebp - 0x2fc], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xa78]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10031c64
push 1
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe6
push 0
pop eax
push 0xffffffffffffffff
pop ecx
jg 0x10031a77
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov edx, 0xffff
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 0x81ff7b51
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031cba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x340], 0x18ab9c27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031ca1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031cdc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031cc3
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe6
jle 0x10031ef6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x321210cb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x136b8055
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xffffa476
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
setl cl
sub edx, ecx
imul edx, eax
mov dword [ebp - 0x338], edx
cmp edx, dword [ebp - 0x34]
je 0x10031e21
mov dword [ebp - 0x10], 0xc013
xor edx, edx
mov dword [ebp - 0x28], 0x62cf9e8b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
add eax, 0x95a2
imul eax, dword [ebp - 0x28]
push 6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x28]
imul eax, eax, 0x44f8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp ecx, eax
jl 0x10031dcc
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10031eec
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10031dfc
push eax
push eax
push eax
call edi
jmp 0x10031dfa
mov dword [ebp - 0x50], 0xcede
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x338]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10031ed6
push 0x1415
push 0x1244
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10031ed6
mov dword [ebp - 0x10], 0x6c42336f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 0xc454
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xcd53b18
setle al
imul eax, dword [ebp - 0x38]
cmp eax, 0x1ef3
jne 0x10031e59
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp eax, 0x73e
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x338]
jne 0x10031e83
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10031e83
mov edx, eax
jmp 0x10031e88
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x33c]
xor ecx, ecx
cmp edx, eax
setle cl
lea edx, [ecx + 0x5946]
xor ecx, ecx
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xbbc]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10031ed6
push 1
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe6
push 0
pop eax
push 0xffffffffffffffff
pop ecx
jg 0x10031ce9
xor eax, eax
mov edx, 0xffff
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 0x81ff7b51
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031f2c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], 0x18ab9c27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031f13
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031f4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa94], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10031f35
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe6
jle 0x10032163
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0x321210cb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x136b8055
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xffffa476
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
setl cl
sub edx, ecx
imul edx, eax
mov dword [ebp - 0x350], edx
cmp edx, dword [ebp - 0x34]
je 0x10032093
mov dword [ebp - 0x10], 0xc013
xor edx, edx
mov dword [ebp - 0x28], 0x62cf9e8b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa8c]
mov eax, dword [ebp - 0x358]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
add eax, 0x95a2
imul eax, dword [ebp - 0x28]
push 6
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x350]
add eax, dword [ebp - 0x28]
imul eax, eax, 0x44f8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp ecx, eax
jl 0x1003203e
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003215e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003206e
push eax
push eax
push eax
call edi
jmp 0x1003206c
mov dword [ebp - 0x50], 0xcede
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x350]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032148
push 0x1415
push 0x1244
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10032148
mov dword [ebp - 0x10], 0x6c42336f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add eax, 0xc454
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xcd53b18
setle al
imul eax, dword [ebp - 0x38]
cmp eax, 0x1ef3
jne 0x100320cb
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp eax, 0x73e
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x350]
jne 0x100320f5
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100320f5
mov edx, eax
jmp 0x100320fa
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x354]
xor ecx, ecx
cmp edx, eax
setle cl
lea edx, [ecx + 0x5946]
xor ecx, ecx
mov dword [ebp - 0x350], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xa8c]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032148
push 1
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe6
push 0
pop eax
push 0xffffffffffffffff
pop ecx
jg 0x10031f5b
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x10], 0x76820624
mov dword [ebp - 0x44], 1
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10032194
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcb8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003217c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100321b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1058], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003219c
xor eax, eax
mov dword [ebp - 0x10], 0xffffffe9
cmp dword [ebp - 0x10], 0x1b
jl 0x100322e1
xor edi, edi
jmp 0x100321c7
xor eax, eax
mov dword [ebp - 0x1c], 0xf55e00fe
mov dword [ebp - 0x58], 0x277ebd00
cmp dword [ebp - 0x1c], eax
je 0x10032222
mov dword [ebp - 0x40], 0x8d92
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100321f1
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
add ecx, 0x1de6
cmp eax, ecx
setg dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setle al
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
jmp 0x100322ce
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x50], 0xfffffff8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10032252
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe84], 0xd8d34108
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10032239
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x100322c2
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
or eax, 0xffffffff
inc ecx
mov dword [ebp - 0xcb0], eax
mov dword [ebp - 0x58], ecx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setne dl
or eax, 0xffffffff
cmp edx, eax
jg 0x10032290
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10032292
lea eax, [edi + 1]
jmp 0x10032292
xor eax, eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
mov dword [ebp - 0x1050], ecx
cmp ecx, 0x59785734
je 0x100322c2
xor eax, eax
jmp 0x100322c5
lea eax, [edi + 1]
mov dword [ebp - 0xe7c], eax
or ecx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x100321c5
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcac], eax
xor eax, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x1c], 0xe071
mov dword [ebp - 0x10], 0xe4cf
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x50], 0xf51885a1
mov dword [ebp - 0x40], 0x4eb856a7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003232b
push eax
push 0x60
call ebx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003233f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, 0x9031
je 0x1003234f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp eax, 0x59515ed
setl cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], 0x2e91a049
mov dword [ebp - 0x64], 0x3ac16b40
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100323c1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x370], 0x6b5b3847
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100323a8
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100323d2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], 0x10
inc ebx
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x1003254a
push 0xfffffffffffffffd
pop edi
jmp 0x100323ed
xor eax, eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10032423
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc48], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1003240a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10032445
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x85c], 0x237f4a7d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1003242c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10032464
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x614], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10032451
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x100324e6
inc dword [ebp - 0x854]
xor ecx, ecx
mov dword [ebp - 0x38], 0x243b
mov eax, dword [ebp - 0x38]
cmp eax, 0x6194
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x30]
je 0x10032494
cmp dword [ebp - 0x10], eax
jne 0x10032499
cmp dword [ebp - 0x10], eax
je 0x1003249b
mov eax, ebx
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x38]
test eax, eax
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0x368]
setne cl
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
mov dword [ebp - 0x614], edx
mov eax, dword [ebp - 0x858]
cmp eax, dword [ebp - 0x36c]
jl 0x100324da
mov eax, dword [ebp - 0x614]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x614], eax
je 0x100324e8
mov edx, ebx
mov eax, dword [ebp - 0x368]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x368]
setge cl
add eax, ecx
je 0x1003250a
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1003250c
mov edx, ebx
jmp 0x1003250e
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x368]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x10]
setge cl
lea eax, [ecx - 1]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x36c]
cmp edx, eax
setne cl
mov dword [ebp - 0x368], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
je 0x100323eb
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov eax, 0xffff
mov edx, 0xad816f93
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0x1f7d9671
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
mov dword [ebp - 0x64], edx
jge 0x100325db
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jle 0x100325d0
mov dword [ebp - 0x50], 0x65786371
cmp dword [ebp - 0x30], eax
jne 0x10032599
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
cmp edx, eax
push 0
sbb eax, eax
neg eax
cmp eax, 0xdb5cabfc
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, 0x270f9e3d
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
pop eax
jg 0x10032581
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x10032572
jmp 0x100325de
or ecx, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], 0x4cf59275
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032612
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x84], 7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100325fa
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xd
jge 0x1003271f
or esi, 0xffffffff
mov dword [ebp - 0x50], 0xda622a14
mov dword [ebp - 0x30], 0x2ca3c0bf
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x28], eax
jmp 0x10032653
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc58], 0xb15b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10032642
mov eax, dword [ebp - 0x84]
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x84]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp eax, 0xbc40
setle cl
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub edx, eax
xor eax, eax
cmp edx, ecx
jle 0x1003269f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100326e4
push eax
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x100326e2
mov dword [ebp - 0x50], 0xc877
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x30], eax
je 0x100326df
mov dword [ebp - 0x30], 0xcfbc
cmp dword [ebp - 0x30], eax
je 0x100326df
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x50]
sub eax, 0x6a243d5b
je 0x100326dd
mov eax, ebx
jmp 0x100326df
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100326fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc58], 0xefc1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100326e9
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], 0xd
push 0
pop eax
jl 0x10032628
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0x81ff7b51
mov dword [ebp - 0x30], 0x5c380a38
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032757
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032742
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003276d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8a4], 0x1d89e177
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003275c
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x68]
jne 0x1003280b
mov eax, dword [ebp - 0x68]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xf68e
mov eax, dword [ebp - 0x68]
setl cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
setg dl
imul ecx, edx
imul eax, ecx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x8a0]
mov eax, dword [ebp - 0x8a0]
mov eax, dword [ebp - 0x68]
cmp eax, 0x43d9c8c7
setl cl
xor eax, eax
cmp ecx, 0xe522
mov dword [ebp - 0x8a0], ecx
setne al
sub eax, dword [ebp - 0x68]
je 0x100327ee
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x100327f0
mov eax, ebx
jmp 0x100327f0
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x68]
push 2
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ebx, ebx
cmp edx, eax
setge bl
xor ecx, ecx
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
pop ebx
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032886
or ecx, 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x10c8], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032872
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x100328ac
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100328a4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10032891
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100328ce
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x388], 0x18ab9c27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100328b5
xor eax, eax
mov dword [ebp - 0x10], 0xd4e06482
mov dword [ebp - 0x10], 0xffffffeb
jmp 0x1003292d
mov dword [ebp - 0x14], 0xd45db34e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10032905
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb40], 0x25b0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100328ed
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1003292a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032922
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1003290d
xor ecx, ecx
inc ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jge 0x100328de
cmp dword [ebp - 0x10], eax
je 0x10032983
mov dword [ebp - 0x28], eax
jmp 0x1003294e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc6c], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003293d
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032a08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x10032a06
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100329ac
or edx, 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe9c], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10032999
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jl 0x100329c0
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100329c2
jmp 0x100329c4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100329d6
cmp dword [ebp - 0x10], eax
je 0x100329d9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
add ecx, eax
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x10]
cmp ecx, 0xfffffffb
setg al
mov dword [ebp - 0xe9c], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032a2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbd4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032a13
xor eax, eax
mov dword [ebp - 0x28], 0x6eb6
mov dword [ebp - 0x40], 0xad901516
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10032a5b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x594], 0x841b3c69
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10032a42
xor eax, eax
xor edx, edx
mov dword [ebp - 0x20], eax
inc edx
cmp dword [ebp - 0x20], edx
jge 0x10032a7e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x238], 0xe96f8f9e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032a66
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10032a9e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfa4], 0xd3cd3624
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032a86
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032ab4
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor edx, edx
inc edx
mov dword [ebp - 0x58c], 0xfffffff4
cmp dword [ebp - 0x58c], 0xfffffff5
je 0x10032b6c
or edi, 0xffffffff
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 0x881826fb
mov eax, dword [ebp - 0x594]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10032aed
cmp eax, dword [ebp - 0x238]
je 0x10032af7
mov eax, edx
cmp eax, dword [ebp - 0x238]
jg 0x10032b00
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x10032b02
mov ecx, edx
xor eax, eax
cmp ecx, 8
setle al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x58c]
mov dword [ebp - 0x40], eax
je 0x10032b23
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
inc dword [ebp - 0x28]
cmp eax, ecx
jne 0x10032b3d
mov eax, edx
jmp 0x10032b41
xor esi, esi
mov eax, esi
imul eax, eax, 0x2b35
mov dword [ebp - 0xfa0], eax
inc dword [ebp - 0x58c]
cmp dword [ebp - 0x58c], 0xfffffff5
jne 0x10032ace
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov ebx, 0xf43b
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe6
jle 0x100349bb
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x44], 0x4ab462a7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jle 0x10032bf7
xor ebx, ebx
mov dword [ebp - 0x14], 0x29bf3901
mov dword [ebp - 0x28], ebx
jmp 0x10032bc0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1008], 0x57ad
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10032baf
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10032be7
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x10032bdf
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
dec dword [ebp - 0x14]
jns 0x10032bce
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jg 0x10032ba3
mov ebx, 0xf43b
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10032c26
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032c0e
cmp dword [ebp - 0x1c], 9
ja 0x10032c0e
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x10]
jne 0x10032c20
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10032c69
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4c], 0x5b57fd54
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032c51
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10032c88
push 6
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032c74
xor eax, eax
mov dword [ebp - 0xe8], eax
jmp 0x10032cb5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032caf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], eax
jle 0x10032c90
mov dword [ebp - 0x30], 0x321210cb
or ecx, 0xffffffff
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x40], 0x37ad4351
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032d10
push eax
push 0xbee
push 0x1e09
push 0x17f0
push 0x305
push 0x26f9
push 0x17c
push 0xf8a
push 0x2427
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x58], 0xfffffff9
jmp 0x10032d23
mov dword [ebp - 0x40], 0xdbed
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0xd
jg 0x10032d19
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0xf3690f1d
mov dword [ebp - 0x2c], 0xbd035c5
push 0xfffffffffffffffd
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xeda58528
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xb8c105a8
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10032d80
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x818], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10032d6b
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x20], eax
inc ecx
cmp dword [ebp - 0x20], ecx
jge 0x10032da3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb58], 0xca7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032d8b
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10032dc6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1220], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10032dae
xor eax, eax
mov dword [ebp - 0x810], 0xfffffff9
jmp 0x10032e27
mov dword [ebp - 0x2c], 0xa888
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x51d52aa0
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0x62e65251
mov dword [ebp - 0x2c], 0xd5fec46b
mov dword [ebp - 0x50], 0xf1fc
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], ecx
jge 0x10032e1e
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xb64], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], ecx
jl 0x10032e0a
xor eax, eax
dec dword [ebp - 0x50]
inc dword [ebp - 0x810]
cmp dword [ebp - 0x810], edx
jge 0x10032dd2
mov dword [ebp - 0x48], 0x136b8055
or edx, 0xffffffff
mov dword [ebp - 0x1c], 0x3248c66
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x40], ecx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032e6f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f4], 0xc8210466
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032e57
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10032e8f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160], 0x5051dd2e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032e77
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10032f20
mov eax, dword [ebp - 0x1c]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
cmp ecx, 0xca7b5cf1
jbe 0x10032ec4
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10032ec7
xor eax, eax
inc eax
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x1f0]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, 8
setne cl
xor eax, eax
mov dword [ebp - 0x160], ecx
test ecx, ecx
je 0x10032f20
inc eax
mov ecx, dword [ebp - 0x1f4]
imul ecx, eax
mov eax, ebx
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x14]
neg edx
sub eax, 0x67268f57
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setg cl
xor eax, eax
imul ecx, dword [ebp - 0x160]
or edx, 0xffffffff
cmp ecx, edx
setne al
cmp eax, 0xcb06a9be
jbe 0x10032f79
xor eax, eax
cmp dword [ebp - 0x1f0], eax
je 0x10032f7b
lea ecx, [eax + 1]
jmp 0x10032f7d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x15c]
imul eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x160]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp dword [ebp - 0x160], ecx
jle 0x10032fb8
mov eax, dword [ebp - 0x160]
xor eax, eax
cmp dword [ebp - 0x1f0], eax
jne 0x10032fc7
cmp dword [ebp - 0x1c], eax
je 0x10032fca
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
sub ecx, 0xffffa476
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
setl cl
sub edx, ecx
imul edx, eax
mov dword [ebp - 0x380], edx
cmp edx, dword [ebp - 0x54]
je 0x10034164
mov dword [ebp - 0x58], 0xc013
xor ecx, ecx
push 9
pop eax
mov dword [ebp - 0x10], eax
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x14], 0x136
mov dword [ebp - 0x1c], 0x18bd2e84
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003305f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x420], 0x546158d3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10033046
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1003307e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5b0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003306a
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10033094
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d4], 0x6c0f1a0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033083
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x414]
imul eax, dword [ebp - 0x414]
test eax, eax
jne 0x100330b9
cmp dword [ebp - 0x418], eax
jne 0x100330bb
mov edx, eax
jmp 0x100330bd
xor eax, eax
mov edx, ecx
mov dword [ebp - 0x5ac], eax
xor ecx, ecx
mov eax, dword [ebp - 0x414]
cmp edx, eax
setg cl
xor edx, edx
test ecx, ecx
setle dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setle al
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x34]
add edx, 0x705472dd
add edx, ecx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x414]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0x50]
setg dl
imul edx, eax
mov eax, dword [ebp - 0x1d0]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x1d0], edx
mov eax, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x1c], edx
je 0x100331fa
mov dword [ebp - 0x34], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x40], 0xceaa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jle 0x1003321f
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x44], 0x59f7c1ae
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
jge 0x10033188
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x518], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10033175
cmp dword [ebp - 0x34], ebx
je 0x10033198
cmp dword [ebp - 0x414], ebx
je 0x10033198
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x518], ebx
jne 0x100331b3
mov eax, ebx
cmp dword [ebp - 0x5b0], ebx
je 0x100331b6
lea eax, [edi + 1]
xor ecx, ecx
cmp eax, 0x74e6a83b
mov eax, dword [ebp - 0x518]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x518]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jg 0x10033162
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, 0xf43b
jmp 0x1003321d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
je 0x1003321d
mov dword [ebp - 0x40], 0xf3d0097e
mov dword [ebp - 0x44], 0x1350d55f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
jne 0x10033204
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
cmp dword [ebp - 0x1c], edx
jg 0x100332ba
xor edi, edi
inc edi
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], eax
jl 0x100332a4
xor ebx, ebx
mov dword [ebp - 0x40], 0xac96aae1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x1d4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d4], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x420], 0xe87198b9
jbe 0x10033278
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x41c], ebx
je 0x1003327a
mov ecx, edi
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x5ac]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x34]
jns 0x1003323f
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10033231
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor edx, edx
mov ebx, 0xf43b
inc edx
mov dword [ebp - 0x20], 0x62cf9e8b
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x7b7e80d6
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
jmp 0x100332e4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100332d3
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, ecx
jne 0x100332fd
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xe4], 0x84cb8f6c
mov eax, dword [ebp - 0xe4]
sbb ecx, ecx
neg ecx
imul eax, ecx
push 6
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
setl cl
sub ecx, 0xb4e
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
sub edx, 0xeac4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033378
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0x388]
mov eax, dword [ebp - 0x58]
dec dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
add eax, 0x95a2
imul eax, dword [ebp - 0x20]
push 6
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x380]
imul eax, eax, 0x44f8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp ecx, eax
jl 0x1003383d
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x100349b9
mov dword [ebp - 0x2c], 0xdfa860b4
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100333fc
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033411
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor eax, eax
mov dword [ebp - 0x10], 0x63e8
mov dword [ebp - 0x50], 0xad9bacc5
mov dword [ebp - 0x14], 0x329e
mov dword [ebp - 0x40], 0xa28c7fff
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10033450
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9b4], 0x3f23e93d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033438
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10033472
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc64], 0x60a22152
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10033459
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10033488
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1070], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033477
mov eax, dword [ebp - 0x9b4]
add eax, dword [ebp - 0xc5c]
jne 0x1003349e
mov eax, dword [ebp - 0x14]
xor eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
setg cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x9b4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9b4]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100334ee
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033521
push 0x1306
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
or edx, 0xffffffff
jmp 0x10033521
mov dword [ebp - 0x14], 0x55f992db
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xc
jle 0x1003351f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x10]
jmp 0x1003350b
xor eax, eax
mov byte [ebp - 0x15], al
xor ecx, ecx
mov dword [ebp - 0x28], edx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0xbc], 0xfffffffd
mov dword [ebp - 0xb8], 0xfffffffd
mov dword [ebp - 0xb4], 0xfffffffd
mov dword [ebp - 0xb0], 0xfffffffd
mov dword [ebp - 0x2c], 0xb963ab1
mov dword [ebp - 0x28], 0xffffffeb
jmp 0x100335a8
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100335a2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1214], 0x88e17b84
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10033589
xor eax, eax
dec dword [ebp - 0x50]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003356c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100335ce
push 0x21be
push eax
push 0xced
push 0x167b
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
cmp byte [ebp - 0x15], 0
je 0x10033cf1
mov dword [ebp - 0x20], 0x94f37831
mov dword [ebp - 0x50], 0x5367
mov dword [ebp - 0x28], 0x7b3925b
mov dword [ebp - 0x1c], 0x37a762a
mov dword [ebp - 0x40], 0xbb416c01
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003361d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0x2e0cf572
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10033604
xor eax, eax
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], eax
jl 0x1003380f
push 6
xor esi, esi
pop edi
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x1c], 0xbc9fc22f
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x14], eax
jmp 0x1003365d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x788], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003364c
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x218], esi
jne 0x100337fc
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003369e
push eax
push 0x1512
push 0x1d38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x100337f0
mov dword [ebp - 0x58], 0x8382bdb9
mov dword [ebp - 0x14], 0x2b82c447
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x218], ecx
test ecx, ecx
je 0x1003374a
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
imul ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x218]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
imul edx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x218]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
imul ebx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x218], esi
jne 0x10033762
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x10033765
lea edx, [esi + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffff8
setl cl
xor edx, edx
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
imul ecx, ecx, 0x618e
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
sub edx, edi
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x10]
sub ecx, 0x541ccca6
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x784], edx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec eax
neg eax
pop ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x788]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x10]
jns 0x100336ae
dec dword [ebp - 0x20]
push 0
pop eax
jns 0x10033632
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, 0xf43b
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10033833
push eax
push eax
push 0xe39
push 0x22b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
push eax
push eax
push eax
call edi
jmp 0x10033cf1
xor edx, edx
mov dword [ebp - 0x10], 0xfff7
inc edx
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10033875
push 0x168d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edx, edx
xor eax, eax
inc edx
cmp dword [ebp - 0x10], eax
jne 0x100338d9
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x28f6
setne cl
cmp ecx, dword [ebp - 0x1c]
jle 0x100338a4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100338d7
mov dword [ebp - 0x50], 0xe12fd89d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf
jne 0x1003390b
cmp dword [ebp - 0x50], eax
jne 0x1003390b
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
push 0
pop eax
je 0x100338c1
jmp 0x10033909
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0x35f19716
cmp dword [ebp - 0x10], eax
je 0x100338fd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x44], 0xcede
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0x73838a1f
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0x3099cfe0
mov dword [ebp - 0x2c], 0xfecafe8
mov dword [ebp - 0x50], 0x1fd9
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003395b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1010], 0x580849f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033943
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003397d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1238], 0xbaef6e22
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10033964
xor eax, eax
inc dword [ebp - 0x50]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100339a1
push 0x937
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor edx, edx
push 2
inc edx
pop ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x34], 0x60b4ffb8
mov dword [ebp - 0x1c], 0x854c3ebe
mov dword [ebp - 0x50], 0x492233ff
mov dword [ebp - 0x40], 0x76f2a9e5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100339e3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100339ce
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100339ff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4d4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100339eb
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
jl 0x10033a84
xor ebx, ebx
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xab72b21a
xor edx, edx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 4
setle cl
cmp dword [ebp + eax*4 - 0x124], ecx
jge 0x10033a6c
cmp dword [ebp - 0x34], ebx
je 0x10033a6c
xor edx, edx
inc edx
mov eax, edx
jmp 0x10033a71
xor edx, edx
mov eax, ebx
inc edx
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x34]
jns 0x10033a0c
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, 0xf43b
mov eax, dword [ebp - 0x34]
sub eax, 0xe6bb
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfd5d
jle 0x10033b35
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 4
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10033ac4
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x34]
jle 0x10033b21
mov dword [ebp - 0x14], 0x1434
xor edx, edx
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x120]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x4f8d
mov ecx, dword [ebp - 0x1c]
setne al
neg ecx
imul eax, eax, 0xbc6a
sub ecx, eax
xor eax, eax
cmp ecx, 0xdbef
setge al
sub eax, 0x127b
cmp dword [ebp - 0x14], eax
jne 0x10033b21
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10033b25
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x34]
imul eax, ecx
neg eax
mov dword [ebp - 0x34], eax
jmp 0x10033cd0
mov dword [ebp - 0x14], 0x663317a7
xor eax, eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x40], 0xc15dc1c4
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10033b6b
push 0xfffffffffffffffd
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10033b5a
xor eax, eax
cmp dword [ebp - 0x120], eax
jne 0x10033c8f
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x124]
sub ecx, eax
mov edx, dword [ebp - 0x78]
neg ecx
mov eax, dword [ebp - 0x11c]
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
add edx, 0xfffffff8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 1
setle al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, 8
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0xffff752a
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 1
setg al
xor edx, edx
imul ecx, eax, 0xb0bf
mov eax, dword [ebp - 0x120]
cmp ecx, eax
mov eax, dword [ebp - 0x124]
setg dl
add eax, edx
jne 0x10033c16
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x78]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x11c]
setne dl
imul ecx, edx
add eax, ecx
je 0x10033c4d
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10033c4f
inc eax
jmp 0x10033c4f
xor eax, eax
imul ecx, eax, 0x3a44
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x50], edx
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x50]
add ecx, eax
mov dword [ebp - 0x4d4], ecx
mov eax, dword [ebp - 0x120]
sub ecx, eax
add ecx, 0x1126
mov dword [ebp - 0x40], ecx
jne 0x10033c8c
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
jmp 0x10033c91
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x78]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0xfff8
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
imul eax, dword [ebp - 0x78], 0xb1a554f9
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10033cd0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x380]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x14], eax
or eax, 0xffffffff
mov dword [ebp - 0x7e8], eax
mov dword [ebp - 0x7e4], eax
mov dword [ebp - 0x7e0], eax
mov dword [ebp - 0x7dc], eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10033d36
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x168], 0xf0ea75c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10033d1d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033d58
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xeb4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10033d3f
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10033d74
push 0x14ff
push 0x20d1
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x10
jle 0x10033e8e
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], 0x6801fc3e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], 0xc0f1
mov dword [ebp - 0x10], 0xf099275c
cmp dword [ebp - 0x10], ebx
jne 0x10033daf
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10033db2
lea eax, [esi + 1]
imul eax, eax, 0x8367
cmp eax, dword [ebp - 0x1c]
jle 0x10033dc3
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xeb4], 0x311e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x7e8]
jl 0x10033e52
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10033e08
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10033e02
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x1c], ebx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
jle 0x10033df3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x168]
sub eax, 7
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
jmp 0x10033e6e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10033e6e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
inc dword [ebp - 0x168]
cmp dword [ebp - 0x168], 0x10
jg 0x10033d8b
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
mov ebx, 0xf43b
xor eax, eax
push 6
mov byte [ebp - 0x15], al
xor edx, edx
pop ecx
mov dword [ebp - 0x10], 0x622ba394
inc edx
mov dword [ebp - 0x48], ecx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10033ec0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x528], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033eac
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10033ee0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4b8], 0x7e17f759
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10033ec8
xor eax, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
jl 0x10033f3f
mov dword [ebp - 0x44], 0x63e3
xor ecx, ecx
mov dword [ebp - 0x50], 0xfffffffe
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x528]
cmp eax, 0xffffffff
setg cl
mov dword [ebp - 0x4b8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x528]
cmp eax, edx
mov eax, dword [ebp - 0x10]
setne cl
sub ecx, dword [ebp + eax*4 - 0x528]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x10]
jns 0x10033ee8
push 2
xor eax, eax
pop ecx
cmp byte [ebp - 0x15], 0
je 0x100348f0
mov dword [ebp - 0x58], 0x4c506d44
mov dword [ebp - 0x48], 0x457d6700
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x8a9017ca
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0xc124
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10033f92
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x230], 0x5b57fd54
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033f7a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10033fb2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x644], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033f9a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10033fd4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xaa8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10033fbb
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10033ff4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x670], 0x27f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10033fdc
xor eax, eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], eax
jl 0x10034148
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x44], 0x2d14b432
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ebx
jmp 0x10034027
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5a8], 0xa6b950ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10034016
mov dword [ebp - 0x10], ebx
jmp 0x10034043
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf5c], 0xb807cfaf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034032
mov dword [ebp - 0x59c], ebx
jmp 0x10034122
mov dword [ebp - 0x40], 0xc4247706
mov dword [ebp - 0x2c], 0x24f20479
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10034077
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1244], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003406a
mov eax, dword [ebp - 0x670]
lea esi, [edi + 1]
dec dword [ebp - 0x670]
test eax, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x59c]
cmovne esi, ebx
add eax, 0x6dac
xor ecx, ecx
cmp eax, 2
setne cl
cmp ecx, 0x861e
jg 0x100340b9
mov eax, ebx
cmp dword [ebp - 0x644], ebx
je 0x100340bc
lea eax, [edi + 1]
mov edx, dword [ebp - 0xaa8]
xor ecx, ecx
cmp eax, 0xa9bed5d2
sete cl
add edx, ecx
xor ecx, ecx
mov dword [ebp - 0xf58], edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x230]
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
test eax, eax
mov eax, dword [ebp - 0x59c]
setns cl
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x230]
cmp eax, edx
setg cl
mov dword [ebp - 0xaa0], ecx
inc dword [ebp - 0x59c]
cmp dword [ebp - 0x59c], ebx
jle 0x10034054
dec dword [ebp - 0x58]
jns 0x10034004
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, 0xf43b
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
push 0x1415
push 0x1244
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x100348ed
mov dword [ebp - 0x58], 0xc3f30b9
xor eax, eax
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10034196
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003417d
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100341ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8d4], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003419b
or eax, 0xffffffff
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x1b
jg 0x1003426b
xor ebx, ebx
or edi, eax
mov dword [ebp - 0x1c], 0xdc4b4e12
mov dword [ebp - 0x14], 0x4307
mov dword [ebp - 0x1c], edi
jmp 0x10034201
mov dword [ebp - 0x48], 0x21de
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100341f8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
jne 0x100341df
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c4]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1c0]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x8d4], ecx
inc dword [ebp - 0x1c0]
cmp dword [ebp - 0x1c0], 0x1b
jle 0x100341cc
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, 0xf43b
mov dword [ebp - 0x58], 0x14
xor edx, edx
cmp dword [ebp - 0x58], 0x18
jle 0x10034340
xor ebx, ebx
inc edx
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x10], ebx
jmp 0x1003429e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], 0x627e80a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003428d
mov dword [ebp - 0x10], ebx
jmp 0x100342b9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc80], 0xed761e7f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100342a8
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x94]
add eax, ecx
mov dword [ebp - 0xc80], eax
je 0x100342f9
mov eax, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x94], 0xb4ab19f8
jbe 0x10034327
mov eax, edx
cmp dword [ebp - 0x58], ebx
jne 0x10034329
mov eax, ebx
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0x18
jg 0x10034281
mov ebx, 0xf43b
jmp 0x10034341
inc edx
mov dword [ebp - 0x58], 0x6c42336f
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x7b7e80d6
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
jmp 0x1003436d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003435c
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, ecx
jne 0x10034386
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xe0], 0x84cb8f6c
mov eax, dword [ebp - 0xe0]
sbb ecx, ecx
neg ecx
imul eax, ecx
push 6
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
setl cl
sub ecx, 0xb4e
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
sub edx, 0xeac4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10034401
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x30]
add eax, 0xc454
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xcd53b18
setle al
imul eax, dword [ebp - 0x24]
cmp eax, 0x1ef3
jne 0x10034432
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp eax, 0x73e
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x380]
jne 0x1003445c
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1003445c
mov edx, eax
jmp 0x10034461
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x384]
xor ecx, ecx
cmp edx, eax
push 9
setle cl
lea edx, [ecx + 0x5946]
xor ecx, ecx
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x58]
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
inc ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xbcc]
mov dword [ebp - 0x30], eax
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x58], 0x136
mov dword [ebp - 0x1c], 0x18bd2e84
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100344de
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x430], 0x546158d3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100344c5
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x100344fd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5c8], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100344e9
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10034513
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x20c], 0x6c0f1a0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10034502
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x424]
imul eax, dword [ebp - 0x424]
test eax, eax
jne 0x10034538
cmp dword [ebp - 0x428], eax
jne 0x1003453a
mov edx, eax
jmp 0x1003453c
xor eax, eax
mov edx, ecx
mov dword [ebp - 0x5c4], eax
xor ecx, ecx
mov eax, dword [ebp - 0x424]
cmp edx, eax
setg cl
xor edx, edx
test ecx, ecx
setle dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setle al
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x28]
add edx, 0x705472dd
add edx, ecx
sub edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x424]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x58]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x44]
setg dl
imul edx, eax
mov eax, dword [ebp - 0x208]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x58]
sub edx, eax
mov dword [ebp - 0x1c], edx
je 0x10034679
mov dword [ebp - 0x28], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x48], 0xceaa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jle 0x1003469e
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x40], 0x59f7c1ae
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x10034607
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x538], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100345f4
cmp dword [ebp - 0x28], ebx
je 0x10034617
cmp dword [ebp - 0x424], ebx
je 0x10034617
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x538], ebx
jne 0x10034632
mov eax, ebx
cmp dword [ebp - 0x5c8], ebx
je 0x10034635
lea eax, [esi + 1]
xor ecx, ecx
cmp eax, 0x74e6a83b
mov eax, dword [ebp - 0x538]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x538]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jg 0x100345e1
mov esi, dword [sym.imp.USER32.dll_SetWindowRgn]
mov ebx, 0xf43b
jmp 0x1003469c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
je 0x1003469c
mov dword [ebp - 0x48], 0xf3d0097e
mov dword [ebp - 0x40], 0x1350d55f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1c]
jne 0x10034683
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jg 0x10034739
xor edi, edi
inc edi
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x10034723
xor ebx, ebx
mov dword [ebp - 0x48], 0xac96aae1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x20c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x20c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x430], 0xe87198b9
jbe 0x100346f7
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x42c], ebx
je 0x100346f9
mov ecx, edi
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x208]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x5c4]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x28]
jns 0x100346be
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x100346b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor ecx, ecx
mov ebx, 0xf43b
inc ecx
mov byte [ebp - 0x39], al
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x44], 0x478c9dff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003476c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc90], 0x17cd9532
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10034753
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jge 0x1003481a
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x44], 0x2f67ab6c
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffffa
jge 0x10034806
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], 0xb597
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x2c512dc6
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x8b9b
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
imul edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
mov dword [ebp - 0xc8c], ecx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jl 0x1003478e
xor ecx, ecx
inc ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jl 0x1003477b
mov ebx, 0xf43b
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x1003482e
push 0x1c7c
call dword [sym.imp.USER32.dll_GetQueueStatus]
cmp byte [ebp - 0x39], 0
je 0x100348ed
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x2c], 0xa6b42be1
mov dword [ebp - 0x1c], 0xfffffffc
cmp dword [ebp - 0x1c], 0x11
jge 0x100348dd
xor ebx, ebx
mov dword [ebp - 0x10], 0xeede0b40
mov dword [ebp - 0x14], ebx
jmp 0x10034876
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1088], 0x6b43d271
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10034865
mov dword [ebp - 0x10], ebx
jmp 0x100348c9
mov dword [ebp - 0x14], ebx
jmp 0x10034897
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xabc], 0xa754320e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10034886
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xabc]
cmp dword [ebp - 0x1c], ebx
je 0x100348b4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xabc]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x107c], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
jle 0x10034881
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jl 0x10034859
mov ebx, 0xf43b
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor edx, edx
inc edx
mov dword [ebp - 0x44], edx
xor eax, eax
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x2c], 0xed99ea7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1003492a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb70], 0x3fc4b03e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10034912
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x1003494b
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10034937
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10034969
mov eax, dword [ebp - 0x134]
inc dword [ebp - 0x134]
push 6
pop ecx
sub eax, ecx
je 0x10034967
mov ecx, edx
jmp 0x1003496b
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5c], eax
sbb eax, eax
inc eax
sub eax, ecx
mov ecx, 0xa9683648
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x885c6f1b
setne cl
xor eax, eax
imul ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x100349a3
cmp dword [ebp - 0x134], eax
je 0x100349a3
mov eax, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0xffffffe6
push 0
pop eax
jg 0x10032b80
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x56e
mov dword [ebp - 0x2c], 0xfffffff7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100349dc
push edi
push eax
call ebx
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100349f8
push eax
push 0x1d5f
push eax
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034a0e
push edi
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034a24
push eax
push 0x1d5f
push eax
push eax
push eax
call esi
xor eax, eax
mov dword [ebp - 0x10], 0x4c266d8f
mov edi, 0x680d
mov dword [ebp - 0x6f0], edi
mov dword [ebp - 0x6ec], edi
mov dword [ebp - 0x6e8], edi
mov dword [ebp - 0x6e4], edi
mov dword [ebp - 0x44], 0xa08d
mov dword [ebp - 0x50], 0xc888bc06
mov dword [ebp - 0x48], 0xee692d35
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10034a80
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf4], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034a68
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034aa0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c0], 0x9a67
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034a88
xor eax, eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], ecx
jle 0x10034bf4
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x6edad94e
xor ecx, ecx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x30], 0x945ad33d
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xd20b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
imul edx, eax
mov eax, dword [ebp - 0x1c]
push 0
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
pop edx
setne cl
cmp ecx, 0xc34ccbb2
sbb eax, eax
neg eax
imul eax, eax, 0xc9fe
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
sub eax, 0x486c
mov eax, dword [ebp - 0x30]
sets dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
sub ecx, 7
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x38]
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x6ec]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf0]
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6ec]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c0]
setne dl
add eax, edx
je 0x10034bc0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x40], edi
jl 0x10034bc8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0xf0]
push 0xfffffffffffffffd
pop eax
cmp dword [ebp - 0xf0], eax
push 0
pop eax
jg 0x10034ab8
mov edi, 0x680d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe5
je 0x10034c53
mov dword [ebp - 0x24], 0x8ffe
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 1
setl cl
imul eax, ecx, 0x6156
mov dword [ebp - 0xf0], eax
test eax, eax
jne 0x10034c25
mov eax, dword [ebp - 0x4c0]
mov eax, dword [ebp - 0x4c0]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jne 0x10034bfd
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034c6d
push 0x56e
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034c83
push eax
push 0x1d5f
push eax
push eax
push eax
call esi
xor eax, eax
push 4
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x369bd69
mov dword [ebp - 0x44], 0xca9f8d19
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], 0xd21462cc
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10034cc7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xecc], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034caf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10034ce7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12d4], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034ccf
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x10034d00
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xca0], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10034cef
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
test eax, eax
je 0x10034d1f
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10034d1f
mov eax, dword [ebp - 0xc9c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x24]
add eax, 0x5a8df044
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], 0x4c266d8f
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6cc], edi
mov dword [ebp - 0x6c8], edi
mov dword [ebp - 0x6c4], edi
mov dword [ebp - 0x44], 0xa08d
mov dword [ebp - 0x50], 0xc888bc06
mov dword [ebp - 0x48], 0xee692d35
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034d92
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034d7a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034db2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x470], 0x9a67
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034d9a
xor eax, eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xcc], eax
or esi, 0xffffffff
cmp dword [ebp - 0xcc], ecx
jle 0x10034f05
push ecx
pop edi
mov dword [ebp - 0x1c], 0x6edad94e
xor ecx, ecx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x30], 0x945ad33d
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xd20b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
imul edx, eax
mov eax, dword [ebp - 0x1c]
push 0
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
pop edx
setne cl
cmp ecx, 0xc34ccbb2
sbb eax, eax
neg eax
imul eax, eax, 0xc9fe
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd0]
sub eax, 0x486c
mov eax, dword [ebp - 0x30]
sets dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
sub ecx, 7
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x38]
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x6cc]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xcc]
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6cc]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x470]
setne dl
add eax, edx
je 0x10034ed4
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x40], esi
jl 0x10034edc
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0xcc]
push 0
pop eax
cmp dword [ebp - 0xcc], edi
jg 0x10034dcc
mov edi, 0x680d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe5
je 0x10034f64
mov dword [ebp - 0x24], 0x8ffe
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 1
setl cl
imul eax, ecx, 0x6156
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x10034f36
mov eax, dword [ebp - 0x470]
mov eax, dword [ebp - 0x470]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jne 0x10034f0e
xor eax, eax
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034f79
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10034fa7
push eax
push 0x84f
push 0xe0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
jmp 0x10034fad
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], 0x4c266d8f
mov dword [ebp - 0x710], edi
mov dword [ebp - 0x70c], edi
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x704], edi
mov dword [ebp - 0x44], 0xa08d
mov dword [ebp - 0x50], 0xc888bc06
mov dword [ebp - 0x48], 0xee692d35
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10035004
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034fec
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10035024
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x478], 0x9a67
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003500c
xor eax, eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], ecx
jle 0x10035173
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x6edad94e
xor ecx, ecx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x30], 0x945ad33d
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xd20b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x1c]
imul edx, eax
mov eax, dword [ebp - 0x1c]
push 0
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
pop edx
setne cl
cmp ecx, 0xc34ccbb2
sbb eax, eax
neg eax
imul eax, eax, 0xc9fe
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x100]
sub eax, 0x486c
mov eax, dword [ebp - 0x30]
sets dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
sub ecx, 7
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x38]
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x70c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70c]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x478]
setne dl
add eax, edx
je 0x10035144
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x40], edi
jl 0x1003514c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0xfc]
push 0xfffffffffffffffd
pop eax
cmp dword [ebp - 0xfc], eax
push 0
pop eax
jg 0x1003503c
xor edi, edi
mov dword [ebp - 0x10], eax
inc edi
cmp dword [ebp - 0x10], 0xffffffe5
je 0x100351d4
mov dword [ebp - 0x24], 0x8ffe
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, edi
setl cl
imul eax, ecx, 0x6156
mov dword [ebp - 0xfc], eax
test eax, eax
jne 0x100351a6
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x478]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jne 0x1003517f
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x10], 0xffffffee
cmp dword [ebp - 0x10], 0xe
je 0x10035289
or edx, 0xffffffff
mov dword [ebp - 0x24], 0x7008b15e
mov dword [ebp - 0x48], 0x6d21cd43
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10035226
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x240], 0x4615
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003520d
xor eax, eax
cmp dword [ebp - 0x23c], eax
jne 0x10035289
mov eax, dword [ebp - 0x23c]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10035241
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
push 0
setne cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x69bd697e
setle cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
imul eax, dword [ebp - 0x23c]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
pop eax
jne 0x100351f6
mov dword [ebp - 0x2c], 0x62fd41e5
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100352bb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x125c], 0x398070ad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100352a2
xor eax, eax
inc dword [ebp - 0x24]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100352d2
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x5c], 0x94a1888
mov dword [ebp - 0x5c], 3
cmp dword [ebp - 0x5c], eax
jl 0x10035343
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x1003533e
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035339
push eax
push 0x10c1
push 0x761
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10035313
dec dword [ebp - 0x5c]
jns 0x10035300
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xced45b0e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
mov eax, 0x28de637c
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x2c], 0x5b3d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100353ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x154], 0x26de0d61
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035395
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100353be
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x154]
dec dword [ebp - 0x154]
test eax, eax
je 0x100353e0
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x694]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, 4
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x28]
je 0x10035417
mov edx, edi
cmp dword [ebp - 0x694], eax
jne 0x10035419
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setge cl
sub ecx, 0xa
mov dword [ebp - 0x694], ecx
mov dword [ebp - 0x1c], 0xc405b401
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x34], 0x919adb82
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10035461
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003544c
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035470
call dword [sym.imp.USER32.dll_CreateMenu]
mov eax, dword [ebp - 0x1c]
mov ecx, 0xf72b5725
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x6c], eax
cmp eax, dword [ebp - 0x1c]
jl 0x100355e0
xor eax, eax
cmp dword [ebp - 0x6c], eax
jne 0x100355e2
or eax, 0xffffffff
mov edx, edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x28], 0xad50a0c
mov dword [ebp - 0x10], 0xfffffffc
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6c]
xor eax, eax
cmp dword [ebp - 0x6c], eax
jne 0x1003550a
mov edx, eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x58]
jge 0x1003559d
mov dword [ebp - 0x14], 0x676cd856
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x6c], 0xfffffffb
jne 0x10035540
cmp dword [ebp - 0x10], eax
je 0x10035585
cmp dword [ebp - 0x14], eax
je 0x10035551
cmp dword [ebp - 0x54], eax
je 0x10035551
cmp dword [ebp - 0x6c], eax
je 0x10035551
mov eax, edi
cmp eax, 4
sbb eax, eax
add eax, 0xf66244a9
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10035566
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10035583
mov ecx, edi
jmp 0x10035587
xor eax, eax
mov ecx, eax
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setne al
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x6c], eax
jmp 0x10035693
xor eax, eax
mov dword [ebp - 0x24], 5
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x100355bf
push 0x349
push 0x1f17
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100355d8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
jmp 0x10035693
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x38], 0xd88c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff9
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], edi
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x6c], eax
jle 0x1003563a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x1003563c
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp edx, eax
setl cl
imul edx, ecx, 0x633e
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setg dl
add eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10035695
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x10], 0x2e91a049
mov dword [ebp - 0x2c], 0x3ac16b40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100356c8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x31c], 0x6b5b3847
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100356af
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100356d9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
mov dword [ebp - 0x10], 0x10
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x10035847
jmp 0x100356ee
xor eax, eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], 9
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10035728
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcc8], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035710
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003574a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8c8], 0x237f4a7d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035731
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10035767
or edx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x468], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035755
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100357e9
inc dword [ebp - 0x8c0]
xor ecx, ecx
mov dword [ebp - 0x44], 0x243b
mov eax, dword [ebp - 0x44]
cmp eax, 0x6194
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x50]
je 0x10035797
cmp dword [ebp - 0x10], eax
jne 0x1003579c
cmp dword [ebp - 0x10], eax
je 0x1003579e
mov eax, edi
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
test eax, eax
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0x314]
setne cl
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setg dl
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x8c4]
cmp eax, dword [ebp - 0x318]
jl 0x100357dd
mov eax, dword [ebp - 0x468]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x468], eax
je 0x100357eb
mov edx, edi
mov eax, dword [ebp - 0x314]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x314]
setge cl
add eax, ecx
je 0x1003580d
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1003580f
mov edx, edi
jmp 0x10035811
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x314]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x10]
setge cl
lea eax, [ecx - 1]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x318]
cmp edx, eax
setne cl
mov dword [ebp - 0x314], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
je 0x100356ec
cmp byte [ebp - 0x39], 0
je 0x10035a15
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0xb6fe
mov dword [ebp - 0x14], eax
jmp 0x10035876
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x188], 0x58fe4de5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035865
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100358b5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100358d0
mov dword [ebp - 0x1c], 0x9bacc5d9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
je 0x100358d0
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100358d2
mov dword [ebp - 0x48], 0x23e9
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x10035a0b
xor eax, eax
mov dword [ebp - 0x1c], 0x41720348
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x100358fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xce4], 0x4307a329
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100358e4
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035957
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10035921
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xce4], 0x6a7609fa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10035909
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1003594c
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035949
push eax
push 0x13d6
push 0xe3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10035926
jmp 0x10035a0b
mov dword [ebp - 0x38], 0x92db756f
mov dword [ebp - 0x48], 0xe89b93b3
mov dword [ebp - 0x34], 0xffffffeb
cmp dword [ebp - 0x34], 0xffffffe8
jne 0x10035a0b
jmp 0x1003597a
xor eax, eax
mov dword [ebp - 0x24], 0xce35
cmp dword [ebp - 0x188], eax
jne 0x1003598c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0x34]
add eax, 0xfffffff7
add ecx, eax
je 0x100359b3
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100359b5
mov ecx, edi
jmp 0x100359b7
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
add eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
jl 0x100359d7
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x188], eax
je 0x100359d9
mov ecx, edi
mov eax, dword [ebp - 0x10]
add ecx, 0x9bb6
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x1cd5ccfd
setg al
imul eax, dword [ebp - 0xcdc]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe8
je 0x10035978
push 0x56e
xor eax, eax
push eax
call ebx
mov dword [ebp - 0x30], 0xada439be
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], 0xe4d9edbd
mov dword [ebp - 0x14], 0x9e2a8d3a
mov dword [ebp - 0x24], 0xfff8
mov dword [ebp - 0x2c], 0x45c8100c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10035a64
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb7c], 0xca63
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035a4c
xor eax, eax
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x10035a98
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0x3921ded6
dec dword [ebp - 0x24]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035a93
push eax
call edi
push 0xfffffffffffffffd
xor eax, eax
pop ecx
dec dword [ebp - 0x30]
jns 0x10035a75
mov dword [ebp - 0x14], eax
jmp 0x10035ab2
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10035aaf
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jne 0x10035a9d
mov dword [ebp - 0x1c], 0xba4d3ec9
xor ebx, ebx
mov dword [ebp - 0x48], 0xadf890ba
inc ebx
mov dword [ebp - 0x2c], ebx
or edx, 0xffffffff
mov dword [ebp - 0x2c], 0x2d9caaf
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x2c], eax
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 0x7203fca5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035b13
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x80], 0xf6af1124
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035afe
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035b35
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd08], 0xf5349dda
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035b1c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10035b57
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1118], 0xa33fe686
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10035b3e
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x16
je 0x10035d32
mov edi, 0xfff9
mov dword [ebp - 0x10], 0xf4672159
xor ecx, ecx
mov dword [ebp - 0x30], 0xe76d238e
mov dword [ebp - 0x2c], 0xa8663c10
mov dword [ebp - 0x2c], 2
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
cmp eax, ebx
mov eax, dword [ebp - 0x80]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x80]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
sete cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
add eax, edi
je 0x10035bda
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x10035bdc
mov ecx, ebx
jmp 0x10035bde
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
add eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x10035d10
mov eax, 0xaba4a2c6
mov dword [ebp - 0x5c], 0xfffffff6
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
or edx, 0xffffffff
cmp dword [ebp - 0x14], 3
jge 0x10035c3d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x880], edx
inc dword [ebp - 0x14]
jmp 0x10035c28
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10035c4c
cmp dword [ebp - 0x10], eax
je 0x10035c53
cmp dword [ebp - 0x10], eax
je 0x10035c53
mov eax, ebx
cmp edi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x5b4]
test ecx, ecx
jne 0x10035c6d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
xor edx, edx
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x878]
mov eax, dword [ebp - 0x5b8]
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xd08]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x87c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0x5992
setne al
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x6b4]
mov eax, dword [ebp - 0x110c]
mov eax, dword [ebp - 0xd04]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5bc]
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x5b4], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10035d0d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
je 0x10035bfc
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0x16
jne 0x10035b69
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
xor eax, eax
or edx, 0xffffffff
mov byte [ebp - 0x39], al
push 6
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0x3e4c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10035d67
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0x93b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035d4e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10035e1b
mov dword [ebp - 0x14], 0x3ed4
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov dword [ebp - 0x24], 0xed40
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x48], 0xfffa
cmp eax, dword [ebp - 0x14]
jl 0x10035e04
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10035e0a
push 0x10c3
push eax
push 0x1854
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
or edx, 0xffffffff
jmp 0x10035e0a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10035d73
xor eax, eax
cmp byte [ebp - 0x39], 0
je 0x10035f1b
mov dword [ebp - 0x30], 0x62e08974
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x24], 0xbef9f3b0
mov dword [ebp - 0x24], 0x93d7f28
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0xe255bb5f
mov dword [ebp - 0x14], eax
jmp 0x10035e60
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb24], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035e53
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x30]
test eax, eax
je 0x10035ef9
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10035e7f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10035e93
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
imul ecx, dword [ebp - 0x10]
add ecx, 0xce3
imul eax, ecx, 0xbbe2
sub eax, 0x3a4c6382
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0x77a1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0xb24], edx
cmp dword [ebp - 0x44], eax
je 0x10035efb
mov edx, ebx
jmp 0x10035efd
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
push eax
push 0x1d5f
push eax
push eax
push eax
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x24], 4
xor eax, eax
mov dword [ebp - 0x40], eax
mov ecx, 0x369bd69
mov dword [ebp - 0x50], ecx
mov edx, 0xca9f8d19
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x48], 0xd21462cc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035f67
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfd4], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035f4e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035f89
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12c8], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035f70
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10035f9f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa24], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10035f8e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
test eax, eax
je 0x10035fbf
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10035fbf
mov eax, dword [ebp - 0xa20]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xfd0], eax
mov eax, dword [ebp - 0x24]
add eax, 0x5a8df044
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x44], edx
push 4
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x48], 0xd21462cc
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1003601e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xee4], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036006
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003603e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1274], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036026
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10036054
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc40], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036043
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
test eax, eax
je 0x10036074
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10036074
mov eax, dword [ebp - 0xc3c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xee0], eax
mov eax, dword [ebp - 0x24]
add eax, 0x5a8df044
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x38], 0xfff9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100360c8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11f8], 0xdb856137
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100360b0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100360ea
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1020], 0xe55a4419
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100360d1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12
jne 0x1003611a
mov dword [ebp - 0x48], 0x1836
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
push 0
pop eax
je 0x100360f3
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x100361b0
mov dword [ebp - 0x2c], 0xda7bc999
mov dword [ebp - 0x24], 0xfdb69689
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xcea2ff3e
mov dword [ebp - 0x30], 0xbd53
mov dword [ebp - 0x48], 0x1c73
mov dword [ebp - 0x14], eax
jmp 0x10036169
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa1c], 0xe6b6cd33
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036158
dec dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x1c]
push 0
mov eax, dword [ebp + eax*4 - 0x11f8]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xa18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
pop eax
setle dl
mov dword [ebp - 0x24], edx
dec dword [ebp - 0x1c]
jns 0x10036126
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100361c8
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100361ee
push eax
push 0x84f
push 0xe0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x44], 0xc369
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1003621d
push 6
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x768], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10036208
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003623b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1138], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10036226
xor eax, eax
mov dword [ebp - 0x28], 0x1b
cmp dword [ebp - 0x28], 0xfffffff5
jl 0x1003636f
push 2
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10036275
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], 0x770
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003625d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10036295
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb9c], 0x23758185
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003627d
xor eax, eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jl 0x1003635c
mov dword [ebp - 0x24], 0xfffffff7
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x768]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e4]
cmp eax, 0x451d77f1
mov eax, dword [ebp - 0x1e4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x768]
cmp eax, edx
mov eax, dword [ebp - 0x1e4]
setl bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x768]
cmp eax, ebx
setle cl
mov dword [ebp - 0x1138], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x768]
mov dword [ebp - 0x24], 0x3a15
imul eax, dword [ebp - 0x24], 0x7557
mov dword [ebp - 0xb98], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x1003634e
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
dec dword [ebp - 0x10]
jns 0x100362a1
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x44]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff5
jge 0x1003624f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], 7
push 0xe
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x10], 0xffffffee
pop edx
jmp 0x10036416
mov dword [ebp - 0x24], 0x7008b15e
mov dword [ebp - 0x48], 0x6d21cd43
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100363bc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x25c], 0x4615
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100363a3
xor eax, eax
cmp dword [ebp - 0x258], eax
jne 0x1003641f
mov eax, dword [ebp - 0x258]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x100363d7
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
push 0
setne cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x69bd697e
setle cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
imul eax, dword [ebp - 0x258]
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], edx
jne 0x1003638c
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x10], 0xffffffee
jmp 0x100364c3
mov dword [ebp - 0x24], 0x7008b15e
mov dword [ebp - 0x48], 0x6d21cd43
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10036469
cmp dword [ebp - 0x10], edx
jne 0x10036439
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x100364e4