Function at 0x1003153b
Capabilities:
Accept command line arguments
Check os version
Create pipe
Create thread
Delete file
Delete registry key
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Get memory capacity
Identify system language via api
Query environment variable
Query or enumerate registry key
Query service status
Set registry value

Disassembly:
mov eax, 0x1007dabd
call fcn.1007d448
mov eax, 0x1450
call fcn.10079c00
push ebx
push esi
push edi
push 0xfffffffffffffff8
pop esi
push 0xfffffffffffffffa
mov byte [ebp - 0xbd], dl
xor eax, eax
pop edx
push 4
pop edi
push 1
mov dword [ebp - 0x70], ecx
mov ecx, 0x37ad4351
mov dword [ebp - 0x24], 0xe1757117
mov dword [ebp - 0x24], eax
pop ebx
jmp 0x100315b9
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc08], edx
mov dword [ebp - 0xc04], edx
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100315b1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003159d
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100315be
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
je 0x1003157a
mov dword [ebp - 0x24], 0xe1757117
mov dword [ebp - 0x24], eax
jmp 0x10031609
mov dword [ebp - 0xbec], edx
mov dword [ebp - 0xbe8], edx
mov dword [ebp - 0xbe4], edx
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10031601
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbec], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100315ed
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003160e
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
je 0x100315ca
mov dword [ebp - 0x3c], 0x3ae35568
mov dword [ebp - 0x18], 0x7ab61b58
push 3
mov dword [ebp - 0x50], ebx
pop esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], 0xd0ae446f
mov dword [ebp - 0x54], 0xa87
mov dword [ebp - 0x10], eax
push 0xfffffffffffffffc
pop ecx
cmp dword [ebp - 0x10], edi
jge 0x10031652
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8a4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003163e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031674
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdfc], 0x25f1a37c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003165b
xor eax, eax
mov dword [ebp - 0x3c], 0x1a
cmp dword [ebp - 0x3c], 0xffffffef
jle 0x10031901
jmp 0x10031689
xor eax, eax
mov dword [ebp - 0x10], 0x1738ab65
mov dword [ebp - 0x28], 0xe7631615
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x58], 0x2e71cc54
mov dword [ebp - 0x68], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100316c8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x348], 0x3eb905d0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100316b0
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10031859
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffe
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x8a4], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x89c]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10031730
cmp dword [ebp - 0x40], eax
je 0x10031732
mov eax, ebx
cmp dword [ebp - 0x10], eax
jg 0x10031745
xor eax, eax
cmp dword [ebp - 0x898], eax
je 0x10031747
mov edx, ebx
jmp 0x10031749
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x348]
cmp eax, edx
sete cl
cmp ecx, dword [ebp - 0x3c]
je 0x10031788
mov dword [ebp - 0x28], esi
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x1003184d
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003177e
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x1003176d
jmp 0x1003184d
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x4c], 0x68b63c96
mov eax, dword [ebp - 0x8a4]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
imul ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2d9b
cmp dword [ebp - 0x28], eax
je 0x1003182e
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x348]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x89c]
mov eax, dword [ebp - 0x1c]
imul ecx, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x100317f6
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x344]
xor ecx, ecx
mov eax, dword [ebp - 0x8a4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x348]
mov eax, dword [ebp - 0x40]
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x1003182c
cmp dword [ebp - 0x2c], eax
je 0x1003182c
mov ecx, ebx
jmp 0x10031830
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x10]
push 0xfffffffffffffffa
pop edx
jns 0x100316d8
mov eax, dword [ebp - 0x348]
xor edx, edx
mov dword [ebp - 0x58], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp edx, 0x14f04b5a
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
add edx, 0x64400d43
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x100318a7
xor eax, eax
cmp dword [ebp - 0x344], eax
je 0x100318a9
mov eax, ebx
jmp 0x100318a9
xor eax, eax
xor ecx, ecx
add eax, 0x9f13
test eax, eax
push 0xfffffffffffffff8
setle cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp ecx, eax
pop ecx
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x348]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0x2beb
jl 0x100318e9
xor eax, eax
cmp dword [ebp - 0x340], eax
je 0x100318eb
mov eax, ebx
mov dword [ebp - 0xdf8], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
push 0xfffffffffffffffa
pop edx
jg 0x10031687
mov dword [ebp - 0x28], 0xc85f70ad
xor eax, eax
mov dword [ebp - 0x38], 0x5e314a5e
mov dword [ebp - 0x48], 0x90c6d21c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], eax
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x50], 0xfd03b15a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003194d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xde8], 0xe780ca9f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031934
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003196f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1200], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031956
xor eax, eax
mov dword [ebp - 0x28], eax
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x28], ebx
jne 0x10031a53
mov dword [ebp - 0x1c], 0x58d32ffa
mov dword [ebp - 0x48], 0xb28787d
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], 0x1462ccd2
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x100319dd
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], 0x1d
jmp 0x100319c2
cmp byte [ebp - 0x2d], 0
je 0x100319bf
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
mov byte [ebp - 0x2d], al
jg 0x100319af
cmp byte [ebp - 0x2d], 0
je 0x100319da
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jne 0x1003199f
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x40], edx
or edx, 0xffffffff
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
cmp eax, edx
setl cl
imul eax, ecx, 0xfffd
cmp dword [ebp - 0x50], eax
jle 0x10031a1c
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031a1e
mov ecx, ebx
jmp 0x10031a20
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, 7
neg eax
sbb eax, eax
inc eax
add eax, ecx
cmp dword [ebp - 0xde8], eax
jg 0x10031a38
mov eax, dword [ebp - 0x44]
push 0xfffffffffffffff9
pop eax
cmp dword [ebp - 0x40], eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
je 0x1003197e
mov dword [ebp - 0x20], 0xe1757117
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0xd0c], ecx
mov dword [ebp - 0xd08], ecx
mov dword [ebp - 0xd04], ecx
mov dword [ebp - 0xd00], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10031ac8
mov dword [ebp - 0x24], 0xd3f46721
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10031aa4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf6c], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10031a8c
xor eax, eax
dec dword [ebp - 0xf68]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x10031ac5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd08], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10031ab2
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
jne 0x10031a7d
mov esi, dword [sym.imp.USER32.dll_GetWindow]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xfffffffffffffff8
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
je 0x10031b6d
push 4
pop ecx
mov dword [ebp - 0x3c], 0x3ae35568
mov dword [ebp - 0x18], 0x7ab61b58
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x44], 0xd0ae446f
mov dword [ebp - 0x54], 0xa87
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10031b32
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x884], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031b1a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031b54
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe70], 0x25f1a37c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10031b3b
xor eax, eax
mov dword [ebp - 0x3c], 0x1a
cmp dword [ebp - 0x3c], 0xffffffef
jle 0x10032051
jmp 0x10031dd2
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x10], 0x42c70bb7
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10031b9c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5d0], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10031b87
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10031ccc
mov dword [ebp - 0x3c], 0xff55e00f
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10031c6f
mov dword [ebp - 0x28], 0x478c9dff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], 0xe1a0e1c2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ebx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031be8
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x10031bea
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 0x7857
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5d0]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5d0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5d0]
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
jmp 0x10031c59
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10031c56
dec dword [ebp - 0x50]
dec dword [ebp - 0x1c]
jns 0x10031c4e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10031c42
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
push 0
pop eax
jle 0x10031bc3
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10031cc0
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x10031ca3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x5d0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5d0], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 2
jle 0x10031c84
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10031cbb
push eax
push 0xb54
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10031c7b
dec dword [ebp - 0x10]
jns 0x10031bac
or edx, 0xffffffff
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xc24], eax
mov dword [ebp - 0xc20], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xf7bf
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], 0xfffe
mov dword [ebp - 0x50], 0xd3e99730
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10031d23
push 0xae3
call edi
push eax
call esi
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, ebx
setg al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc71b
imul eax, dword [ebp - 0x50]
test eax, eax
jne 0x10031d61
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp eax, 0x91a8
setne cl
xor eax, eax
dec ecx
dec ecx
je 0x10031d84
cmp dword [ebp - 0x2c], eax
je 0x10031d84
mov eax, ebx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x37ad4351
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10031daf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc2c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031d9b
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10031dc9
dec dword [ebp - 0x20]
push 0xfffffffffffffff8
pop eax
cmp dword [ebp - 0x20], eax
push 0
pop eax
push 0xffffffffffffffff
pop edx
je 0x10031b6a
xor eax, eax
jmp 0x10031aec
xor eax, eax
mov dword [ebp - 0x10], 0x1738ab65
mov dword [ebp - 0x28], 0xe7631615
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], 0x2e71cc54
mov dword [ebp - 0x68], 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10031e13
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x36c], 0x3eb905d0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10031dfa
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10031fa9
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffe
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x884], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x87c]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10031e7f
cmp dword [ebp - 0x40], eax
je 0x10031e81
mov eax, ebx
cmp dword [ebp - 0x10], eax
jg 0x10031e94
xor eax, eax
cmp dword [ebp - 0x878], eax
je 0x10031e96
mov edx, ebx
jmp 0x10031e98
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x36c]
cmp eax, edx
sete cl
cmp ecx, dword [ebp - 0x3c]
je 0x10031edb
mov dword [ebp - 0x28], 3
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10031fa0
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10031ed1
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x10031ec0
jmp 0x10031fa0
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x4c], 0x68b63c96
mov eax, dword [ebp - 0x884]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
imul ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2d9b
cmp dword [ebp - 0x28], eax
je 0x10031f81
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x36c]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x87c]
mov eax, dword [ebp - 0x1c]
imul ecx, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x10031f49
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x368]
xor ecx, ecx
mov eax, dword [ebp - 0x884]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x36c]
mov eax, dword [ebp - 0x40]
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x10031f7f
cmp dword [ebp - 0x2c], eax
je 0x10031f7f
mov ecx, ebx
jmp 0x10031f83
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x10]
jns 0x10031e23
mov eax, dword [ebp - 0x36c]
xor edx, edx
mov dword [ebp - 0x58], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp edx, 0x14f04b5a
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setg dl
add edx, 0x64400d43
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x10031ff7
xor eax, eax
cmp dword [ebp - 0x368], eax
je 0x10031ff9
mov eax, ebx
jmp 0x10031ff9
xor eax, eax
xor ecx, ecx
add eax, 0x9f13
test eax, eax
push 0xfffffffffffffff8
setle cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp ecx, eax
pop ecx
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x36c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0x2beb
jl 0x10032039
xor eax, eax
cmp dword [ebp - 0x364], eax
je 0x1003203b
mov eax, ebx
mov dword [ebp - 0xe6c], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
push 4
pop ecx
jg 0x10031dd0
mov dword [ebp - 0x28], 8
mov eax, 0xc6f0d4a7
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2f0], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100320a5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb8], 0x1928c176
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003208d
xor eax, eax
mov dword [ebp - 0xb8], eax
mov ecx, 0xffff
cmp dword [ebp - 0xb8], 0x16
je 0x100323e0
push 0xfffffffffffffff9
pop edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100320f4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3a4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100320db
xor eax, eax
mov ecx, 0xffff
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], 0xfffffff0
cmp dword [ebp - 0x28], 9
jl 0x100323c5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003212a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10032115
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032141
push 0xf57
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10032239
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x3a4]
mov eax, dword [ebp - 0x15c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xb8]
cmp edx, eax
mov eax, dword [ebp - 0x15c]
setge cl
xor edx, edx
cmp ecx, 0x68dacb31
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x39c0
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xdf11
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0x3a4]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xb8]
setg cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xd579deb4
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xb8]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb8]
setge dl
sub edx, eax
xor eax, eax
cmp edx, 2
setg al
cmp eax, 0xeb7bfbc3
je 0x10032228
xor eax, eax
cmp dword [ebp - 0x2f0], eax
je 0x1003222a
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1003222d
xor eax, eax
xor ebx, ebx
inc ebx
cmp eax, dword [ebp - 0x15c]
jne 0x10032239
xor eax, eax
jmp 0x1003223b
mov eax, ebx
add eax, 0xfffffffd
je 0x10032335
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10032266
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x330], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003224e
xor eax, eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x100323ad
mov dword [ebp - 0x44], 0x22c2
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x2fc]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x2fc]
cmp ecx, 0xb0debf6
jg 0x100322ae
mov eax, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x330]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2fc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2fc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2fc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x158]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10032301
mov edx, ebx
cmp dword [ebp - 0x15c], eax
jne 0x10032303
mov edx, eax
mov eax, dword [ebp - 0x158]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003232a
push ebx
push 0x136f
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 0x10]
jns 0x10032276
jmp 0x100323ad
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jae 0x1003237a
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, 0xac5da298
mov eax, dword [ebp - 0x44]
setne cl
xor edx, edx
cmp ecx, 0xf019d465
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x7411
je 0x1003237a
mov eax, ebx
jmp 0x1003237c
xor eax, eax
mov ecx, dword [ebp - 0xb8]
imul ecx, eax
mov eax, ebx
sub eax, ecx
je 0x10032399
xor eax, eax
cmp dword [ebp - 0x15c], eax
je 0x1003239b
mov edx, ebx
jmp 0x1003239d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2f8], ecx
inc dword [ebp - 0x28]
mov ecx, 0xffff
cmp dword [ebp - 0x28], 9
push 0
pop eax
jge 0x1003210c
push 0xfffffffffffffff9
pop edx
inc dword [ebp - 0xb8]
mov ecx, 0xffff
cmp dword [ebp - 0xb8], 0x16
push 0
pop eax
jne 0x100320c0
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100323f2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [ebp - 0x28], 0x92758e92
or edx, 0xffffffff
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x4c], 0x88a9
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0xb4ff
mov dword [ebp - 0x54], 0xfffffffe
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003244b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x450], 0x4e1a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032433
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003246b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x758], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032453
xor eax, eax
cmp dword [ebp - 0x44c], eax
je 0x100324ed
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x24], eax
jmp 0x1003248c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb04], 0x8edfe012
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003247b
mov eax, dword [ebp - 0x44c]
xor edx, edx
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb00]
mov eax, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setne dl
cmp edx, 0xda62
je 0x100324dc
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x754], ebx
mov dword [ebp - 0x5c], ebx
jmp 0x1003265b
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x54], 0x941993e3
mov dword [ebp - 0x18], 0x120b879b
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], 6
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x1003265d
mov dword [ebp - 0x24], eax
jmp 0x10032534
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2b4], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10032527
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x448]
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x2b4]
push 0xfffffffffffffff9
pop edx
cmp eax, edx
mov eax, dword [ebp - 0x2b0]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sete bl
xor edx, edx
mov dword [ebp + eax*4 - 0x758], 0xe1580eb6
mov eax, dword [ebp - 0x5c]
cmp ebx, eax
mov eax, dword [ebp - 0x2b0]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x54]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x40]
sub eax, 0xe1580eb6
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
jl 0x100325cb
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x758], 0
je 0x100325cb
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x100325d0
xor ebx, ebx
xor eax, eax
inc ebx
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x2b0]
cmp ecx, eax
setg dl
neg edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
cmp eax, dword [ebp - 0x5c]
je 0x10032608
xor eax, eax
cmp dword [ebp - 0x750], eax
jne 0x10032608
cmp dword [ebp - 0x754], eax
je 0x1003260a
mov eax, ebx
add dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x68]
setg dl
sub edx, eax
push 0
sub edx, 0x18828597
pop eax
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x28]
push 0xffffffffffffffff
pop edx
jns 0x10032522
xor eax, eax
mov dword [ebp - 0x54], 0xcd53bc6e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10032684
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdec], 0xc0ae9714
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003266c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100326a6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1170], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003268d
xor eax, eax
dec dword [ebp - 0x54]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100326cb
push eax
push 0xd09
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor eax, eax
mov dword [ebp - 0x34], 0xe1757117
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100326f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d8], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100326de
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032719
push 0xfffffffffffffff9
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032705
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003272c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10032805
mov dword [ebp - 0x68], 0xcadfb1a
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032755
push eax
push 0x15e3
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x7d8], 0
je 0x100327ec
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], 0x52027495
mov dword [ebp - 0x54], 0x22a5bc42
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x7d8]
cmp eax, 0xfffc
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, 0x986e
mov eax, dword [ebp + eax*4 - 0x7d8]
setl dl
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
sub eax, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
mov ecx, 0xffff
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x7d8], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x68]
mov dword [ebp - 0x11c8], ecx
jmp 0x100327f5
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x68], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
push 0
pop eax
jle 0x10032739
push 0xfffffffffffffff8
mov dword [ebp - 0x34], eax
pop edx
cmp dword [ebp - 0x34], edx
jne 0x10032d17
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
mov dword [ebp - 0xc44], eax
mov dword [ebp - 0xc40], eax
mov dword [ebp - 0x1c], 0xce9d05ba
mov dword [ebp - 0x50], 0x60cbeb96
cmp dword [ebp - 0x1c], 0x84217059
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 7
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
sub edx, 0x15f2fe73
cmp edx, ebx
mov edx, dword [ebp - 0x1c]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, ebx
setge cl
imul eax, dword [ebp - 0x1c]
cmp eax, ecx
jl 0x100328ef
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100328ae
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaec], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10032899
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100328bf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0xaec]
mov eax, dword [ebp - 0xaec]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
cmp ecx, 0x45cb
setg dl
add eax, edx
mov dword [ebp - 0xaec], eax
jmp 0x10032903
mov dword [ebp - 0x38], 0xfff8
mov dword [ebp - 0x44], 0xccedb775
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0x37ad4351
xor eax, eax
mov dword [ebp - 0x28], 0xc85f70ad
mov dword [ebp - 0x38], 0x5e314a5e
mov dword [ebp - 0x48], 0x90c6d21c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], eax
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x50], 0xfd03b15a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032956
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdf4], 0xe780ca9f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003293d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10032978
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1180], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003295f
xor eax, eax
mov dword [ebp - 0x28], eax
or edx, 0xffffffff
cmp dword [ebp - 0x28], ebx
jne 0x10032a5c
mov dword [ebp - 0x1c], 0x58d32ffa
mov dword [ebp - 0x48], 0xb28787d
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x40], 0x1462ccd2
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x100329e6
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], 0x1d
jmp 0x100329cb
cmp byte [ebp - 0x2d], 0
je 0x100329c8
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
mov byte [ebp - 0x2d], al
jg 0x100329b8
cmp byte [ebp - 0x2d], 0
je 0x100329e3
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jne 0x100329a8
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x40], edx
or edx, 0xffffffff
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
cmp eax, edx
setl cl
imul eax, ecx, 0xfffd
cmp dword [ebp - 0x50], eax
jle 0x10032a25
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10032a27
mov ecx, ebx
jmp 0x10032a29
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, 7
neg eax
sbb eax, eax
inc eax
add eax, ecx
cmp dword [ebp - 0xdf4], eax
jg 0x10032a41
mov eax, dword [ebp - 0x44]
push 0xfffffffffffffff9
pop eax
cmp dword [ebp - 0x40], eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
je 0x10032987
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xccc], ecx
mov dword [ebp - 0xcc8], ecx
mov dword [ebp - 0xcc4], ecx
mov dword [ebp - 0xcc0], ecx
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], 0xfffffff1
je 0x10032ad5
mov dword [ebp - 0x24], 0xd3f46721
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10032aad
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf3c], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032a95
xor eax, eax
dec dword [ebp - 0xf38]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10032ad0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc8], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10032abc
xor eax, eax
dec dword [ebp - 0x1c]
jmp 0x10032a80
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10032b97
mov dword [ebp - 0x1c], 0xf7bf
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], 0xfffe
mov dword [ebp - 0x50], 0xd3e99730
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032b16
push 0xae3
call edi
push eax
call esi
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, ebx
setg al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0xc71b
imul eax, dword [ebp - 0x50]
test eax, eax
jne 0x10032b54
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
cmp eax, 0x91a8
setne cl
xor eax, eax
dec ecx
dec ecx
je 0x10032b77
cmp dword [ebp - 0x2c], eax
je 0x10032b77
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp + eax*4 - 0xc4c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
pop eax
push 0xffffffffffffffff
pop edx
jl 0x10032ae1
mov dword [ebp - 0x10], 0x42c70bb7
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10032bcc
push 0xfffffffffffffff8
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5ac], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10032bb7
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10032cf9
mov dword [ebp - 0x3c], 0xff55e00f
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10032c9f
mov dword [ebp - 0x28], 0x478c9dff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], 0xe1a0e1c2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ebx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10032c18
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x10032c1a
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 0x7857
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5ac]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5ac]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5ac]
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
jmp 0x10032c89
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10032c86
dec dword [ebp - 0x50]
dec dword [ebp - 0x1c]
jns 0x10032c7e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x10032c72
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
push 0
pop eax
jle 0x10032bf3
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x10032cf0
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x10032cd3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x5ac]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5ac], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 2
jle 0x10032cb4
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10032ceb
push eax
push 0xb54
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10032cab
dec dword [ebp - 0x10]
jns 0x10032bdc
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
xor eax, eax
push 0xfffffffffffffff8
pop edx
cmp dword [ebp - 0x20], eax
jne 0x10032d15
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
je 0x10032814
xor eax, eax
mov dword [ebp - 0x58], 0x17ca4e86
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0xcb7be74f
mov dword [ebp - 0x54], ebx
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x10032d51
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfc], 0x5b57
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032d39
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10032d71
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x84], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032d59
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10032d93
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfdc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10032d7a
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], ebx
jg 0x10033071
jmp 0x10032daa
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x10], eax
jmp 0x10032ddb
mov dword [ebp - 0x1c], 0x2b29949d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10032dd8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfc], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032dc4
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10032db5
mov eax, dword [ebp - 0x84]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xfc]
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xf8]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp + eax*4 - 0xfc]
imul eax, dword [ebp - 0x34], 0x6d54
cmp eax, 0xb474
mov eax, dword [ebp - 0x84]
setne cl
imul edx, ecx
imul ecx, edx, 0x6fdd
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xfc]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x84]
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x3c]
add eax, esi
cmp eax, ecx
mov eax, dword [ebp - 0x84]
setg dl
cmp dword [ebp + eax*4 - 0xfc], edx
jne 0x10032e91
xor eax, eax
cmp dword [ebp - 0x84], eax
jne 0x10032e91
xor ebx, ebx
inc ebx
jmp 0x10032e96
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x58], 0x8f4f
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xfdc]
mov eax, dword [ebp - 0xf8]
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xfc]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
je 0x10032f97
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], eax
jmp 0x10032f03
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x548], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10032ef6
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, dword [ebp - 0xf8]
cmp eax, 0x3212
mov eax, dword [ebp - 0x84]
setne cl
xor ebx, ebx
cmp ecx, 0x251f81f1
mov edx, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x10]
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp edx, ecx
jle 0x10032f55
cmp dword [ebp - 0x544], eax
je 0x10032f55
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10032f5a
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x544]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, edx
mov eax, dword [ebp - 0x544]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x544]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setge cl
imul eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x10033059
mov dword [ebp - 0x48], 0x42427020
push 4
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x10032fc1
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x13ac], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10032fa9
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x10033050
mov dword [ebp - 0x54], 0xd3184ba
mov dword [ebp - 0x38], 0x1fe44aad
mov dword [ebp - 0x10], eax
jmp 0x10032fe2
inc dword [ebp - 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10032fdc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jg 0x1003304d
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xfc]
sub eax, ecx
jne 0x10033038
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0xfc], 0xfff7
je 0x10033038
xor eax, eax
jmp 0x1003303a
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x10032fef
xor eax, eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], ebx
jle 0x10032fc9
inc dword [ebp - 0x84]
push 0
pop eax
push 0xfffffffffffffff8
pop edx
cmp dword [ebp - 0x84], ebx
jle 0x10032da7
mov dword [ebp - 0x3c], 0x3ae35568
mov dword [ebp - 0x18], 0x7ab61b58
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x44], 0xd0ae446f
mov dword [ebp - 0x54], 0xa87
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100330ba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100330a2
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100330da
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea8], 0x25f1a37c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100330c2
xor eax, eax
mov dword [ebp - 0x3c], 0x1a
cmp dword [ebp - 0x3c], 0xffffffef
jle 0x1003336b
jmp 0x100330ef
xor eax, eax
mov dword [ebp - 0x10], 0x1738ab65
mov dword [ebp - 0x28], 0xe7631615
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], 0x2e71cc54
mov dword [ebp - 0x68], 5
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10033130
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x380], 0x3eb905d0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10033117
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x100332c3
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffe
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x8bc]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10033196
cmp dword [ebp - 0x40], eax
je 0x10033198
mov eax, ebx
cmp dword [ebp - 0x10], eax
jg 0x100331ab
xor eax, eax
cmp dword [ebp - 0x8b8], eax
je 0x100331ad
mov edx, ebx
jmp 0x100331af
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x380]
cmp eax, edx
sete cl
cmp ecx, dword [ebp - 0x3c]
je 0x100331f2
mov dword [ebp - 0x28], 3
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x100332b7
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100331e8
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x100331d7
jmp 0x100332b7
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x4c], 0x68b63c96
mov eax, dword [ebp - 0x8c4]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
imul ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2d9b
cmp dword [ebp - 0x28], eax
je 0x10033298
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + eax*4 - 0x380]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, esi
setne al
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8bc]
imul ecx, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x10033260
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x37c]
xor ecx, ecx
mov eax, dword [ebp - 0x8c4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x380]
mov eax, dword [ebp - 0x40]
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x10033296
cmp dword [ebp - 0x2c], eax
je 0x10033296
mov ecx, ebx
jmp 0x1003329a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x10]
jns 0x1003313c
push 2
pop esi
mov eax, dword [ebp - 0x380]
xor edx, edx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp edx, 0x14f04b5a
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
add edx, 0x64400d43
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x10033311
xor eax, eax
cmp dword [ebp - 0x37c], eax
je 0x10033313
mov eax, ebx
jmp 0x10033313
xor eax, eax
xor ecx, ecx
add eax, 0x9f13
test eax, eax
push 0xfffffffffffffff8
setle cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp ecx, eax
pop ecx
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x380]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0x2beb
jl 0x10033353
xor eax, eax
cmp dword [ebp - 0x378], eax
je 0x10033355
mov eax, ebx
mov dword [ebp - 0xea4], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
push 4
pop ecx
jg 0x100330ed
mov dword [ebp - 0x10], 0xe387fb0b
mov ecx, 0x2ae8
mov dword [ebp - 0x54], 0x228d5fea
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x38], 0xd08f4923
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x12
je 0x1003344c
mov dword [ebp - 0xd4c], ecx
mov dword [ebp - 0xd48], ecx
mov dword [ebp - 0xd44], ecx
mov dword [ebp - 0xd40], ecx
mov dword [ebp - 0x34], eax
jmp 0x100333cb
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4ec], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100333ba
mov eax, dword [ebp - 0x4ec]
xor edx, edx
mov eax, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push 0
setl dl
mov ecx, 0x2ae8
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0xd4c]
mov eax, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x10]
sub eax, 0xee05243b
neg eax
sbb eax, eax
add eax, 0xffff7c16
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
pop eax
jne 0x1003339d
mov dword [ebp - 0x28], 8
mov ecx, 0xc6f0d4a7
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x308], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003349e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xb4], 0x1928c176
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10033486
xor eax, eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x16
je 0x100337bb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0xfffffffa
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x100334e3
or ecx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3e4], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x100334cf
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x1003379b
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10033513
mov ecx, 0xffff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x174], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100334ff
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003352a
push 0xf57
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10033621
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x174]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xb4]
cmp edx, eax
mov eax, dword [ebp - 0x174]
setge cl
xor edx, edx
cmp ecx, 0x68dacb31
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x39c0
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xdf11
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x3e4]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xb4]
setg cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xd579deb4
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0xb4]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
setge dl
sub edx, eax
xor eax, eax
cmp edx, esi
setg al
cmp eax, 0xeb7bfbc3
je 0x10033610
xor eax, eax
cmp dword [ebp - 0x308], eax
je 0x10033612
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10033615
xor eax, eax
xor ebx, ebx
inc ebx
cmp eax, dword [ebp - 0x174]
jne 0x10033621
xor eax, eax
jmp 0x10033623
mov eax, ebx
add eax, 0xfffffffd
je 0x1003371d
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003364e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x400], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10033636
xor eax, eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x10033795
mov dword [ebp - 0x44], 0x22c2
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x314]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x314]
cmp ecx, 0xb0debf6
jg 0x10033696
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0x400]
mov eax, dword [ebp - 0x400]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x314]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x314]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x314]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x314]
mov eax, dword [ebp - 0x170]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100336e9
mov edx, ebx
cmp dword [ebp - 0x174], eax
jne 0x100336eb
mov edx, eax
mov eax, dword [ebp - 0x170]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10033712
push ebx
push 0x136f
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 0x10]
jns 0x1003365e
jmp 0x10033795
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jae 0x10033762
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp eax, 0xac5da298
mov eax, dword [ebp - 0x44]
setne cl
xor edx, edx
cmp ecx, 0xf019d465
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x7411
je 0x10033762
mov eax, ebx
jmp 0x10033764
xor eax, eax
mov ecx, dword [ebp - 0xb4]
imul ecx, eax
mov eax, ebx
sub eax, ecx
je 0x10033781
xor eax, eax
cmp dword [ebp - 0x174], eax
je 0x10033783
mov edx, ebx
jmp 0x10033785
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x310], ecx
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], 9
jge 0x100334f2
inc dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], 0x16
push 0
pop eax
jne 0x100334b1
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100337cd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [ebp - 0x1c], 0x5020f89b
mov dword [ebp - 0x2c], 0x4309642e
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x44], 0xcc5c6a3f
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003380b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xb1c], 0xdc85f70a
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x100337f2
xor eax, eax
mov dword [ebp - 0x1c], eax
push 4
pop edx
cmp dword [ebp - 0x1c], esi
jg 0x100338ac
mov dword [ebp - 0x54], edx
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0xdfadf628
mov dword [ebp - 0x54], 0xb8b78acc
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], eax
jmp 0x10033846
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x130c], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10033839
mov eax, dword [ebp - 0x1c]
push 0
mov eax, dword [ebp + eax*4 - 0xb1c]
xor eax, eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
add eax, 0xffff19fa
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x2c], 0xfab8
mov eax, dword [ebp - 0x1c]
sub ecx, 0x25ff0688
mov dword [ebp + eax*4 - 0xb1c], ecx
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], esi
jle 0x1003381a
mov dword [ebp - 0x58], 0x17ca4e86
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0xcb7be74f
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100338e3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf4], 0x5b57
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100338cb
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033900
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7c], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100338eb
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10033922
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1018], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10033909
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], ebx
jg 0x10033bcc
jmp 0x10033933
or ecx, 0xffffffff
push 0xfffffffffffffff8
mov dword [ebp - 0x10], ecx
pop edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x10], eax
jmp 0x10033967
mov dword [ebp - 0x1c], 0x2b29949d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10033964
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf4], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10033950
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10033941
mov eax, dword [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xf4]
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x7c]
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp + eax*4 - 0xf4]
imul eax, dword [ebp - 0x34], 0x6d54
cmp eax, 0xb474
mov eax, dword [ebp - 0x7c]
setne cl
imul edx, ecx
imul ecx, edx, 0x6fdd
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x7c]
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x3c]
add eax, esi
cmp eax, ecx
mov eax, dword [ebp - 0x7c]
setg dl
cmp dword [ebp + eax*4 - 0xf4], edx
jne 0x10033a05
xor eax, eax
cmp dword [ebp - 0x7c], eax
jne 0x10033a05
xor ebx, ebx
inc ebx
jmp 0x10033a0a
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x58], 0x8f4f
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0xf0]
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xf4]
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], eax
je 0x10033b01
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], eax
jmp 0x10033a6e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x560], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10033a61
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x7c]
sub ecx, eax
xor eax, eax
cmp ecx, 0x3212
setne al
xor ebx, ebx
cmp eax, 0x251f81f1
mov eax, dword [ebp - 0x7c]
setg bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
setl cl
xor eax, eax
cmp edx, ecx
jle 0x10033abc
cmp dword [ebp - 0x55c], eax
je 0x10033abc
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x10033ac1
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x55c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp eax, edx
mov eax, dword [ebp - 0x55c]
push 4
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x55c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf4]
pop edx
setge cl
imul eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x10033bbd
mov dword [ebp - 0x48], 0x42427020
push 4
mov dword [ebp - 0x34], eax
pop edx
cmp dword [ebp - 0x34], edx
jge 0x10033b2b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x13cc], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10033b13
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x10033bb4
mov dword [ebp - 0x54], 0xd3184ba
mov dword [ebp - 0x38], 0x1fe44aad
mov dword [ebp - 0x10], eax
jmp 0x10033b4c
inc dword [ebp - 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10033b46
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jg 0x10033bb1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xf4]
sub eax, ecx
jne 0x10033b9c
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0xf4], 0xfff7
je 0x10033b9c
xor eax, eax
jmp 0x10033b9e
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x10033b59
xor eax, eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], ebx
jle 0x10033b33
inc dword [ebp - 0x7c]
push 0
pop eax
cmp dword [ebp - 0x7c], ebx
jle 0x10033930
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x48], 0xb7d8cf4c
mov dword [ebp - 0x48], 0x959310c1
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10033c07
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xa30], 0xfffc
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10033bef
xor eax, eax
cmp dword [ebp - 0xa30], eax
je 0x10033cb7
mov dword [ebp - 0x24], 0x9d29be1d
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x48], 0x45fe46c2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10033c48
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd60], 0x5ccb9725
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10033c30
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033c68
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa88], 0x64a11600
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033c50
xor eax, eax
mov dword [ebp - 0x24], 0x14
jmp 0x10033caf
mov dword [ebp - 0x48], 0xafe30f58
mov dword [ebp - 0x48], 0x1c97412d
mov dword [ebp - 0x34], eax
jmp 0x10033c95
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1190], 0x8e9646b8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10033c84
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0xa84]
dec dword [ebp - 0x24]
push 0
pop eax
cmp dword [ebp - 0x24], 0xfffffff7
jge 0x10033c71
jmp 0x10033cdd
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10033cdd
push eax
push 0x1287
push 0xbd3
push eax
push 0x124e
push 0x141c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033d0c
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x570], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033cf8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10033d2e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbdc], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10033d15
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10033d44
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x570], 0x6fe7
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10033d33
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x3c], eax
jle 0x10033d96
mov eax, dword [ebp - 0xbd4]
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebp - 0xbdc]
mov eax, dword [ebp - 0x56c]
cmp ecx, eax
mov eax, dword [ebp - 0xbd4]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x570]
sete bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x3c], ecx
jl 0x10033d96
mov eax, ebx
jmp 0x10033d98
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x3ae35568
mov dword [ebp - 0x18], 0x7ab61b58
push 3
mov dword [ebp - 0x50], ebx
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x44], 0xd0ae446f
mov dword [ebp - 0x54], 0xa87
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10033de5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x864], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10033dcd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10033e05
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe04], 0x25f1a37c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033ded
xor eax, eax
mov dword [ebp - 0x3c], 0x1a
cmp dword [ebp - 0x3c], 0xffffffef
jle 0x10034099
jmp 0x10033e1a
xor eax, eax
mov dword [ebp - 0x10], 0x1738ab65
mov dword [ebp - 0x28], 0xe7631615
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x1c], 0x2e71cc54
mov dword [ebp - 0x68], 5
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10033e59
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x390], 0x3eb905d0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10033e41
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10033fee
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffffe
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x864], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x85c]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10033ec1
cmp dword [ebp - 0x40], eax
je 0x10033ec3
mov eax, ebx
cmp dword [ebp - 0x10], eax
jg 0x10033ed6
xor eax, eax
cmp dword [ebp - 0x858], eax
je 0x10033ed8
mov edx, ebx
jmp 0x10033eda
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x390]
cmp eax, edx
sete cl
cmp ecx, dword [ebp - 0x3c]
je 0x10033f1d
mov dword [ebp - 0x28], 3
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10033fe2
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10033f13
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x10033f02
jmp 0x10033fe2
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x4c], 0x68b63c96
mov eax, dword [ebp - 0x864]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
sub ecx, eax
imul ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2d9b
cmp dword [ebp - 0x28], eax
je 0x10033fc3
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + eax*4 - 0x390]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, esi
setne al
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x85c]
mov eax, dword [ebp - 0x24]
imul ecx, eax
cmp ecx, dword [ebp - 0x3c]
jge 0x10033f8b
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38c]
xor ecx, ecx
mov eax, dword [ebp - 0x864]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x390]
mov eax, dword [ebp - 0x40]
test eax, eax
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x10033fc1
cmp dword [ebp - 0x2c], eax
je 0x10033fc1
mov ecx, ebx
jmp 0x10033fc5
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x10]
jns 0x10033e65
push 2
pop esi
mov eax, dword [ebp - 0x390]
xor edx, edx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp edx, 0x14f04b5a
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
add edx, 0x64400d43
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x1003403c
xor eax, eax
cmp dword [ebp - 0x38c], eax
je 0x1003403e
mov eax, ebx
jmp 0x1003403e
xor eax, eax
xor ecx, ecx
add eax, 0x9f13
test eax, eax
push 0xfffffffffffffff8
setle cl
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp ecx, eax
pop ecx
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x390]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0x2beb
jl 0x1003407e
xor eax, eax
cmp dword [ebp - 0x388], eax
je 0x10034080
mov eax, ebx
push 3
mov dword [ebp - 0xe00], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
pop ecx
push 4
pop edx
jg 0x10033e18
mov dword [ebp - 0x1c], 0x3ae35568
or edx, 0xffffffff
mov dword [ebp - 0x2c], 0x8d4081c2
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x48], 0x34678dc2
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x48], 0xb6b0e1b1
mov dword [ebp - 0x48], 0x33c2251
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100340eb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11a0], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100340d3
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034107
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x139c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100340f3
xor eax, eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1003414f
mov dword [ebp - 0x48], 0x751c76d7
mov dword [ebp - 0x48], 0x59b8bc5
mov dword [ebp - 0x48], 0xa421
mov dword [ebp - 0x54], 0x59b5
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10034147
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1330], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10034133
xor eax, eax
dec dword [ebp - 0x54]
dec dword [ebp - 0x2c]
jns 0x1003410f
mov dword [ebp - 0x40], 0x7ab61b58
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x54], 0xbb1bb30b
mov dword [ebp - 0x28], eax
mov eax, 0xa6f57610
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x868], eax
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003419e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xe8], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1003418a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10034344
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x1c], 0x6082f4e5
mov dword [ebp - 0x3c], 0xd7c5
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x20]
cmp ecx, dword [ebp + eax*4 - 0xe8]
jne 0x10034258
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x20]
cmp eax, 0xc5f93be4
ja 0x1003424f
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1003424f
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x444]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x3c]
test eax, eax
setg cl
add edx, ecx
add edx, dword [ebp - 0x3c]
je 0x1003427f
mov dword [ebp - 0x1c], 0xd9d65fe9
jmp 0x10034333
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10034320
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, 0x5ebae88b
mov eax, dword [ebp + eax*4 - 0x444]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x444]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x440]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
inc eax
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x86c], ecx
test ecx, ecx
je 0x100342fb
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100342e9
push 0x1376
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034311
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10034311
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], eax
jmp 0x1003430b
cmp dword [ebp - 0x38], eax
jne 0x10034311
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jne 0x10034303
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jle 0x1003428e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034333
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
dec dword [ebp - 0x20]
push 0xffffffffffffffff
pop edx
jns 0x100341aa
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
jl 0x1003436a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x874]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x874], ecx
dec dword [ebp - 0x28]
jns 0x1003434c
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x50], 0x8146cdea
mov dword [ebp - 0x54], 0x32b7b88c
mov dword [ebp - 0x2c], 0x455f
mov dword [ebp - 0x38], 0xcec02dfc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100343a9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x228], 0x9b2cfb63
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10034391
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100343c9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x950], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100343b1
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x100343ec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11e0], 0x5b61
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100343d4
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003440c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1030], 0x6a9b03be
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100343f4
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003441b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [ebp - 0x50], 0xfff6
sbb eax, eax
inc eax
add eax, dword [ebp - 0x50]
jne 0x1003445f
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x2c]
test eax, eax
je 0x1003443d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
xor eax, eax
cmp dword [ebp - 0x102c], eax
jne 0x1003444c
cmp dword [ebp - 0x54], eax
je 0x1003444e
mov eax, ebx
cmp eax, ebx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x94c]
jge 0x1003445f
xor eax, eax
jmp 0x10034461
mov eax, ebx
xor edx, edx
cmp eax, 0xd69
mov eax, dword [ebp - 0x94c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x228]
setle cl
xor edx, edx
cmp ecx, 0x422f
setg dl
dec dword [ebp - 0x228]
cmp eax, edx
jne 0x100344a1
xor eax, eax
cmp dword [ebp - 0x11d8], eax
je 0x100344a3
mov eax, ebx
jmp 0x100344a3
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x48], 7
push 0xfffffffffffffff8
mov dword [ebp - 0x48], eax
pop ecx
mov dword [ebp - 0x48], 0xe1d925b0
mov dword [ebp - 0x54], ecx
push 4
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x100344e2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x144c], 0x5db34e6d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100344ca
xor eax, eax
dec dword [ebp - 0x54]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100344f6
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor eax, eax
push 3
pop edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003451f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x834], 0x99ac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034507
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003453f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x258], 0x897a4a12
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034527
xor eax, eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], eax
jl 0x10034567
mov eax, dword [ebp - 0x258]
cmp dword [ebp + eax*4 - 0x834], 0
jne 0x10034565
dec dword [ebp - 0x258]
jns 0x1003454d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x100345fb
mov dword [ebp - 0x34], eax
jmp 0x10034589
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x768], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10034578
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x258]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x258], ecx
xor eax, eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], eax
jg 0x100345ec
mov dword [ebp - 0x28], 0x19570a50
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x100345d9
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x100345cb
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x768]
xor eax, eax
cmp dword [ebp - 0x768], eax
jle 0x100345b2
inc dword [ebp - 0x1c]
push 0
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x10034573
mov dword [ebp - 0x64], 0xd0ae446f
mov dword [ebp - 0x20], 0xb871c7bf
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x54], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xa025ec56
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jge 0x1003463c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1e4], 0x847d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10034624
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034662
push eax
push 0x2b4
push 0xb3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x1003479c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003468e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x718], 0xdef906d8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034676
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100346a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x76c], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034693
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e4]
add eax, dword [ebp - 0x1e4]
je 0x100346c6
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100346c8
mov eax, ebx
jmp 0x100346c8
xor eax, eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
imul ecx, eax
mov dword [ebp - 0x718], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1e4], ecx
jl 0x100346ff
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 3
mov ecx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x1dc]
add ecx, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
mov ecx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x20]
sub ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xe53e
setne al
xor ecx, ecx
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x20]
sub edx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
pop edx
setne cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10034788
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e4], 0x42ad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10034777
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], esi
jle 0x1003466e
mov dword [ebp - 0x44], 0xa87
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x54], 0xb844a754
mov dword [ebp - 0x1c], eax
jmp 0x1003483f
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x100347df
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x11b0], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100347c7
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10034837
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003480b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x75c], 0x8108531d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x100347f3
xor eax, eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x10034834
mov dword [ebp - 0x54], 0xf307d7c1
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
test eax, eax
setg cl
mov dword [ebp - 0x75c], ecx
dec dword [ebp - 0x34]
jns 0x10034813
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x100347e4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jge 0x100347b8
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034869
push 0x21fe
push 0x1cf0
push 0x16cc
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
jmp 0x10034892
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x17c], 0xfff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10034881
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
cmp eax, 6
mov eax, dword [ebp - 0x178]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setge cl
xor edx, edx
cmp ecx, 0x5bf2
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x17c]
setg cl
add eax, 0x6c74aa0d
add eax, ecx
mov ecx, dword [ebp - 0x3c]
imul ecx, eax
test ecx, ecx
je 0x10034a68
push 7
pop eax
mov dword [ebp - 0x7fc], eax
mov dword [ebp - 0x7f8], eax
mov dword [ebp - 0x7f4], eax
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x36
jg 0x10034a79
jmp 0x10034922
xor eax, eax
mov dword [ebp - 0x50], 0xfffffffe
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x54], 0x501494d8
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10034959
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x7bc], 0x8c2afe24
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10034941
xor eax, eax
cmp dword [ebp - 0x7f8], eax
je 0x100349ea
mov dword [ebp - 0x34], eax
jmp 0x10034977
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xd9c], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x1003496a
mov eax, dword [ebp - 0xd98]
sub eax, 0x1718
mov dword [ebp - 0x50], eax
je 0x10034993
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x178]
mov edx, dword [ebp - 0xd98]
push 3
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
imul edx, ecx
xor ecx, ecx
cmp eax, 0xf19716e2
setne cl
xor eax, eax
cmp edx, ecx
sete al
imul eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], 0xc
jl 0x10034a59
xor eax, eax
cmp dword [ebp - 0x7b8], eax
jne 0x10034a59
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0xc
jge 0x100349d7
jmp 0x10034a59
mov dword [ebp - 0x44], 0xc717898a
xor edx, edx
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x7f0]
cmp eax, ecx
push 0xfffffffffffffff8
setge dl
mov dword [ebp - 0x54], edx
mov ecx, dword [ebp - 0x54]
pop eax
sub ecx, eax
mov eax, 0xe848967c
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x17c]
sub eax, ecx
mov dword [ebp - 0x44], eax
imul eax, dword [ebp - 0x6c], 0x146b
test eax, eax
jne 0x10034a3f
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x178]
mov eax, dword [ebp - 0x7f8]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x178]
xor eax, eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x36
jle 0x10034920
jmp 0x10034a79
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10034a79
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x58]
cmp eax, 5
push 6
setne cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x50], 0xd490c4d8
pop esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x2c], 0x11e7bff4
mov dword [ebp - 0x54], eax
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x38], 0x50730467
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10034ad7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x190], 0xa3a11c15
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10034ac6
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10034b2a
cmp dword [ebp - 0x190], 0x8cf1d65f
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
push 0
setle cl
sub ecx, 0x3f15
pop eax
sets al
cmp eax, 3
jg 0x10034b28
mov ecx, ebx
jmp 0x10034b2c
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, esi
setne al
mov dword [ebp - 0x54], eax
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10034b47
mov edx, ebx
cmp dword [ebp - 0x190], eax
jne 0x10034b49
mov edx, eax
mov eax, dword [ebp - 0x190]
xor ecx, ecx
push 0xfffffffffffffff8
pop esi
cmp eax, esi
push 4
setl cl
xor eax, eax
cmp ecx, edx
pop ecx
setne al
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034b88
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x894], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034b70
xor eax, eax
mov dword [ebp - 0x38], 0x8901f2c2
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], eax
jmp 0x10034ba8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1048], 0xfffffff6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10034b97
mov eax, dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1044], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10034bd3
push eax
push eax
call esi
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10034bf6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe88], 0x25f1a37c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034bde
xor eax, eax
mov dword [ebp - 0x18], 0x897a4a12
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10034c1e
or edx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1390], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10034c09
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x10034d36
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10034c4d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2bc], 0x55b7cefa
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10034c35
xor eax, eax
mov dword [ebp - 0x2bc], eax
jmp 0x10034c70
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034c6a
cmp dword [ebp - 0x2bc], ecx
jle 0x10034c55
mov dword [ebp - 0x1c], eax
jmp 0x10034d24
mov dword [ebp - 0x1c], 0x1a
cmp dword [ebp - 0x1c], 0xffffffef
jle 0x100366a0
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10034d51
mov dword [ebp - 0x28], 6
mov ecx, 0xffff
mov dword [ebp - 0x38], 0xf2887cf2
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
jmp 0x10034da3
cmp dword [ebp - 0x28], 8
jg 0x10034d6c
mov dword [ebp - 0x10], 0xe387fb0b
mov dword [ebp - 0x44], 0x228d5fea
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x64], 0xd08f4923
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x12
je 0x1003677c
mov ecx, 0x2ae8
mov dword [ebp - 0xcac], ecx
mov dword [ebp - 0xca8], ecx
mov dword [ebp - 0xca4], ecx
mov dword [ebp - 0xca0], ecx
mov dword [ebp - 0x18], eax
jmp 0x10036700
cmp dword [ebp - 0x18], 3
jl 0x100366ef
mov dword [ebp - 0x1c], 8
mov ecx, 0xc6f0d4a7
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100367ce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0x1928c176
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100367b6
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x16
je 0x10036af8