Function at 0x100330c7
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Get session user name
Identify system language via api
Modify service
Read .ini file

Disassembly:
mov eax, 0x1007ae46
call fcn.1007a800
mov eax, 0x14f0
call fcn.10076fb0
push 0xfffffffffffffffe
mov byte [ebp - 0xb1], dl
xor eax, eax
pop edx
mov dword [ebp - 0x18], edx
push 3
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003310b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1464], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100330f7
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1003312e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x135c], 0xff55e00f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10033116
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
push edi
mov dword [ebp - 0x18], eax
jmp 0x1003315b
cmp byte [ebp - 0x51], 0
je 0x10033158
push eax
push 0x14b3
call ebx
push eax
call esi
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
mov byte [ebp - 0x51], al
jle 0x10033142
cmp byte [ebp - 0x51], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
je 0x10033176
call edi
push 2
xor eax, eax
pop edx
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x18], ecx
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003319f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1434], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033187
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100331bf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1304], 0xff55e00f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100331a7
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100331dd
cmp byte [ebp - 0x51], 0
je 0x100331da
push eax
push 0x14b3
call ebx
push eax
call esi
push 2
xor eax, eax
pop edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
mov byte [ebp - 0x51], al
jle 0x100331c4
cmp byte [ebp - 0x51], 0
je 0x100331ef
call edi
xor eax, eax
mov dword [ebp - 0x10], 0x69b2e414
xor edx, edx
mov dword [ebp - 0x24], 0xdd5d0881
mov dword [ebp - 0x18], 0xaad90151
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x74], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 4
setne dl
xor eax, eax
test edx, edx
setg al
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
pop eax
mov dword [ebp - 0x28], 0x10
cmp dword [ebp - 0x28], 0x14
push 1
pop edx
jge 0x100333f1
or esi, 0xffffffff
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], esi
push 3
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033291
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1088], 0xa0d1f89
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033280
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x74]
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100332cb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x44]
cmp eax, 0xfffffff7
jne 0x100332da
mov ecx, edx
jmp 0x100332de
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x74]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x100333d2
push 0xfffffffffffffffa
xor edi, edi
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x3c], 0xdda102f3
mov dword [ebp - 0x30], 0x24ced0f2
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x10
jle 0x100333c5
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033340
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x918], 0xea989989
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003332f
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x914], eax
jne 0x10033359
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x1003335c
lea edx, [edi + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x10033378
lea edx, [edi + 1]
cmp dword [ebp - 0x64], eax
jne 0x1003337a
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
push 0
setl cl
cmp ecx, 0xfff9
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x914]
cmp eax, 0xe27a
setl cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1084], eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x10
pop eax
jg 0x10033327
push 0xfffffffffffffffa
pop ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jg 0x10033309
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x14
push 1
pop edx
push 4
pop eax
jl 0x1003326d
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], eax
jmp 0x10033411
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x20c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033404
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20c], eax
xor eax, eax
push 6
mov dword [ebp - 0x28], eax
pop ecx
mov dword [ebp - 0x70], 0x6c902da
mov dword [ebp - 0xbc], 0x8f6c
jmp 0x10033572
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xb17b722b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x1003356f
mov dword [ebp - 0x4c], 0xf23b1a95
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x10033544
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10033485
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x320], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033471
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x100334b0
push 0x886
push eax
push 0xab4
push 0x205b
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], eax
jg 0x10033535
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], eax
jg 0x10033527
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x20c], ecx
mov eax, dword [ebp - 0x498]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10033514
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc dword [ebp - 0x498]
cmp dword [ebp - 0x498], eax
jle 0x100334e7
mov ecx, dword [ebp - 0x70]
xor eax, eax
inc dword [ebp - 0x31c]
cmp dword [ebp - 0x31c], eax
jle 0x100334c1
inc dword [ebp - 0x4c]
push 1
pop edx
cmp dword [ebp - 0x4c], eax
jle 0x10033466
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10033560
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x20c], 0
jne 0x1003355e
dec dword [ebp - 0x18]
jns 0x1003354c
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10033453
push 6
pop ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jl 0x1003343d
mov dword [ebp - 0x28], 0x831713b9
mov dword [ebp - 0x38], 0x61bab593
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x64], 0xfffffffb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x78], 8
mov dword [ebp - 0x74], 0x910a83af
cmp dword [ebp - 0x28], ecx
jle 0x100336bf
mov esi, dword [ebp - 0x74]
push 4
pop edi
mov dword [ebp - 0x1c], 0xd4e7937
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x18], eax
jmp 0x100335dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0x2bf35dd7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100335cb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x14
jle 0x100336a4
mov dword [ebp - 0x58], 0x8dc2
mov dword [ebp - 0x18], 0x9b504dbf
mov dword [ebp - 0x38], 0x5059b8bc
mov eax, dword [ebp - 0x1c]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
sub ecx, 7
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x174]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
imul ecx, edx, 3
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x174]
setg dl
imul edx, eax
mov eax, dword [ebp - 0x18]
imul eax, edx
neg eax
cmp edi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x58]
mov dword [ebp - 0x3c], 0xd863780d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jg 0x100335ee
xor edx, edx
push 6
inc edx
pop ecx
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], ecx
jg 0x100335b8
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100336e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144c], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100336ca
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10033705
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c4], 0xff55e00f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100336ed
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10033723
cmp byte [ebp - 0x51], 0
je 0x10033720
push eax
push 0x14b3
call ebx
push eax
call esi
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
mov byte [ebp - 0x51], al
jle 0x1003370a
cmp byte [ebp - 0x51], 0
je 0x10033735
call edi
xor eax, eax
mov dword [ebp - 0x10], 0x3e64f147
xor edx, edx
mov dword [ebp - 0x1c], 0xc34f1d4b
inc edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10033766
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x17571177
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003374e
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffef
push 0xfffffffffffffff8
pop ecx
je 0x10033a48
push 3
pop edi
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], 0xb53b3045
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], eax
jmp 0x100337a5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x620], 0x7709b807
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033794
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10033810
mov dword [ebp - 0x10], 0xbf079684
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x8c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, esi
setle al
cmp eax, dword [ebp - 0x20]
jge 0x10033807
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
cmp eax, 0x7af9ca3e
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x8c]
jne 0x1003392c
mov dword [ebp - 0x64], 0x6cfc4ff2
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10033858
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b0], 0xc6715623
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033840
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1003386d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10b8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10033860
mov dword [ebp - 0x10], 0x1857497f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x8c], eax
jne 0x1003389e
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0x1b0]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x1b0]
sub edx, 0xff81490
neg edx
push 3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edi
setle cl
mov dword [ebp - 0x10], ecx
mov ecx, 0x4c4a1c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x620]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x10b4], 0x4c7c
sub ecx, eax
mov dword [ebp - 0x64], ecx
jmp 0x10033a20
mov dword [ebp - 0x38], 0xdd1e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], eax
jmp 0x10033a16
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], 0xffffffef
cmp dword [ebp - 0x1c], 0xfffffffc
je 0x10033a10
mov dword [ebp - 0xc64], 0xe5337c48
mov dword [ebp - 0xc60], 0xe5337c48
mov dword [ebp - 0xc5c], 0xe5337c48
push 2
mov dword [ebp - 0xc58], 0xe5337c48
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033992
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6d8], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033985
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100339e5
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x6d4]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x64]
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x6d4]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x6d4]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
imul eax, ecx
test eax, eax
jne 0x100339e5
mov edx, eax
jmp 0x100339ea
xor esi, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0xc5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
pop eax
push 1
pop edx
jne 0x10033955
or esi, 0xffffffff
dec dword [ebp - 0x20]
push 1
pop edx
cmp dword [ebp - 0x20], 0xfffffff7
jl 0x1003393e
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xffffffef
push 0
pop eax
push 1
pop edx
push 0xfffffffffffffff8
pop ecx
jne 0x10033782
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 4
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10033a71
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1324], 0xf75dcec3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033a59
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jg 0x10033b08
push ecx
pop esi
or edi, 0xffffffff
mov dword [ebp - 0x38], 0x715f0ed1
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x40], 0xee85ec41
cmp dword [ebp - 0x38], eax
je 0x10033ae4
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10033aac
cmp dword [ebp - 0x38], eax
je 0x10033aac
mov eax, edx
cmp dword [ebp - 0x10], eax
jl 0x10033ab4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x64], edx
xor edx, edx
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xfffffff6
setne al
cmp eax, dword [ebp - 0x38]
jg 0x10033ad8
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10033adf
xor edx, edx
inc edx
mov eax, edx
jmp 0x10033ae4
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x1320], 0
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], esi
jle 0x10033a85
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x10], 0x69b2e414
xor edx, edx
mov dword [ebp - 0x24], 0xdd5d0881
mov dword [ebp - 0x18], 0xaad90151
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
xor eax, eax
test edx, edx
setg al
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x10
cmp dword [ebp - 0x28], 0x14
jge 0x10033cff
xor edi, edi
inc edi
or esi, 0xffffffff
push 4
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], esi
push 3
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033ba9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11e4], 0xa0d1f89
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033b98
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
cmp eax, edi
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033be3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x44]
cmp eax, 0xfffffff7
jne 0x10033bf2
mov ecx, edi
jmp 0x10033bf6
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x10033ce6
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x3c], 0xdda102f3
mov dword [ebp - 0x30], 0x24ced0f2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jle 0x10033cd9
push 2
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10033c56
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9b8], 0xea989989
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033c45
mov eax, dword [ebp - 0x64]
xor eax, eax
cmp dword [ebp - 0x9b4], eax
jne 0x10033c6f
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x10033c71
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x10033c8c
mov edx, edi
cmp dword [ebp - 0x64], eax
jne 0x10033c8e
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
push 0
setl cl
cmp ecx, 0xfff9
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x9b4]
cmp eax, 0xe27a
setl cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x11e0], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
pop eax
jg 0x10033c3d
push 0xfffffffffffffffa
pop ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jg 0x10033c1f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x14
jl 0x10033b82
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x18], eax
inc ecx
jmp 0x10033d1c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e8], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033d0f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1e8], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff6
jge 0x10033e7b
push 6
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0xb17b722b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10033e6e
mov dword [ebp - 0x4c], 0xf23b1a95
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x10033e43
push 2
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
jge 0x10033d84
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x368], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10033d70
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10033daf
push 0x886
push eax
push 0xab4
push 0x205b
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor eax, eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], eax
jg 0x10033e34
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x4b0], ecx
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x4a8], ecx
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], eax
jg 0x10033e26
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x1e8], ecx
mov eax, dword [ebp - 0x4b0]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10033e13
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc dword [ebp - 0x4b0]
cmp dword [ebp - 0x4b0], eax
jle 0x10033de6
mov ecx, dword [ebp - 0x70]
xor eax, eax
inc dword [ebp - 0x364]
cmp dword [ebp - 0x364], eax
jle 0x10033dc0
inc dword [ebp - 0x4c]
push 1
pop ecx
cmp dword [ebp - 0x4c], eax
jle 0x10033d65
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10033e5f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1e8], 0
jne 0x10033e5d
dec dword [ebp - 0x18]
jns 0x10033e4b
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10033d52
push 6
pop edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jl 0x10033d3c
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x28], 0x831713b9
mov dword [ebp - 0x38], 0x61bab593
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x64], 0xfffffffb
push 6
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jle 0x10033fb9
mov esi, dword [ebp - 0x74]
push 4
pop edi
mov dword [ebp - 0x1c], 0xd4e7937
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x18], eax
jmp 0x10033ed6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 0x2bf35dd7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10033ec5
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x14
jle 0x10033f9e
mov dword [ebp - 0x58], 0x8dc2
mov dword [ebp - 0x18], 0x9b504dbf
mov dword [ebp - 0x38], 0x5059b8bc
mov eax, dword [ebp - 0x1c]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
sub ecx, 7
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x16c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
imul ecx, edx, 3
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x16c]
setg dl
imul edx, eax
mov eax, dword [ebp - 0x18]
imul eax, edx
neg eax
cmp edi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x58]
mov dword [ebp - 0x3c], 0xd863780d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jg 0x10033ee8
xor ecx, ecx
push 6
inc ecx
pop edx
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], edx
jg 0x10033eb2
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x3c], 0x1afd061a
mov dword [ebp - 0x10], edx
push 5
pop ecx
cmp dword [ebp - 0x10], eax
jl 0x1003404e
push 0xfffffffffffffffa
xor esi, esi
pop edi
mov dword [ebp - 0x38], edi
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
test eax, eax
mov eax, dword [ebp - 0x10]
setle dl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x38], ecx
jge 0x1003400a
lea edx, [esi + 1]
cmp dword [ebp - 0x38], eax
jne 0x1003400c
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10034034
push 0x164b
push 0x16c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
dec dword [ebp - 0x10]
push 0xfffffffffffffffe
pop eax
push 5
pop ecx
cmp dword [ebp - 0x10], eax
jge 0x10033fd9
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 2
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x56a759f3
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10034080
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x224], 0xc67ee39f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034068
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jge 0x100340a0
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003408e
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100340c8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x21c]
xor edx, edx
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x218]
mov eax, dword [ebp - 0x224]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x218]
inc ecx
cmp ecx, eax
push 0xfffffffffffffffa
setge dl
pop eax
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x218]
test eax, eax
mov eax, 0x5bf8
setg cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0xc653ddb
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0xc8]
jne 0x1003413b
cmp dword [ebp - 0xc8], eax
je 0x1003413b
lea edx, [eax + 1]
jmp 0x1003413d
mov edx, eax
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
add eax, 0xf4a1
cmp eax, edx
setle cl
cmp ecx, 0xfff7
sbb eax, eax
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x20], eax
jle 0x100341e4
xor eax, eax
cmp dword [ebp - 0x218], eax
jne 0x100341e6
mov dword [ebp - 0x28], 0xaa0bdec7
mov dword [ebp - 0x20], 0xffffffe8
cmp dword [ebp - 0x20], 0x38
jg 0x100341ba
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc8], eax
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x100341af
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x38
jle 0x10034193
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10034297
push 3
pop ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x220], 0
jne 0x10034295
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10034284
xor eax, eax
cmp dword [ebp - 0xc8], eax
je 0x1003417f
mov dword [ebp - 0x3c], 0xd782
mov dword [ebp - 0x40], 0x36c21779
cmp dword [ebp - 0x218], eax
jne 0x10034231
mov edx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x3c]
neg edx
push 0xfffffffffffffffa
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0xaada
pop eax
setge cl
cmp eax, ecx
sbb eax, eax
neg eax
imul eax, edx
test eax, eax
jne 0x10034231
mov ecx, eax
jmp 0x10034236
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0xc8]
add eax, ecx
mov ecx, dword [ebp - 0x218]
imul ecx, eax
xor eax, eax
inc eax
push 5
cmp eax, ecx
pop ecx
sbb eax, eax
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
jmp 0x10034295
mov dword [ebp - 0x28], eax
jmp 0x1003427c
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034279
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x10034263
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1003425e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100341c9
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x100342b9
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13e0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100342a5
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 0x18], 0xe
je 0x1003430b
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], 0xffffffe6
jne 0x100342fc
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x100342f0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
je 0x100342dc
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jne 0x100342cc
push 3
pop edx
mov dword [ebp - 0x10], eax
push 2
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10034331
push eax
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1314], 0xff55e00f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10034318
push 3
pop edx
mov dword [ebp - 0x24], ecx
mov eax, 0xee41b66b
mov dword [ebp - 0x20], 0x985a9576
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xd239f94a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10034381
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], 0xb0b56cef
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034369
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100343a1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd5c], 0x79655965
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10034389
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff4
jge 0x100343cb
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff4
jl 0x100343ad
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jg 0x100345a9
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x1c], 0xfffe
mov dword [ebp - 0x18], eax
jmp 0x100343fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x37c], 0x80ae7b1b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100343ed
mov eax, dword [ebp - 0x24]
mov ecx, 0x883e731e
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x37c]
sub eax, 0xe94c
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
jne 0x10034427
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0xd54]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp dword [ebp - 0x1e4], 0x7215766e
jle 0x10034450
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x4c8], 0
je 0x10034456
mov eax, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x20]
xor edx, edx
push 6
mov eax, dword [ebp + eax*4 - 0x4c8]
test eax, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp eax, ebx
mov eax, dword [ebp - 0x1e4]
setg dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
xor eax, eax
cmp ecx, esi
mov ecx, dword [ebp - 0x37c]
setne al
imul ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c8], ecx
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
je 0x10034588
xor ecx, ecx
inc ecx
mov dword [ebp - 0x64], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100344fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5ec], 0xa6f77a31
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100344e6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10034567
mov dword [ebp - 0x4c], eax
jmp 0x10034554
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1003451d
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10034551
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1003454c
push 0x1dd8
push 0x12f3
push 0x239
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10034525
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jle 0x1003450b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10034506
xor ecx, ecx
push 6
inc ecx
pop edx
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x64], eax
je 0x10034573
mov eax, ecx
mov dword [ebp - 0x5ec], eax
inc dword [ebp - 0x28]
push 0
pop eax
cmp dword [ebp - 0x28], edx
jne 0x100344d7
inc dword [ebp - 0x20]
push 3
pop edx
push 0
pop eax
push 1
pop ecx
cmp dword [ebp - 0x20], edx
jle 0x100343da
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
mov dword [ebp - 0x64], 0x20452a26
jle 0x10034607
push 2
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100345dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x334], 0x477862fd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100345c4
xor eax, eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x1c
je 0x10034a56
xor edx, edx
inc edx
mov dword [ebp - 0x18], 0x2167fa5c
mov dword [ebp - 0x18], eax
jmp 0x10034a3d
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 0x10], 0x9ed0
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], 0x8716b5b3
mov dword [ebp - 0x1c], 0xdb2b
mov dword [ebp - 0x58], 0xfffffffd
mov dword [ebp - 0x3c], 0xb5c02ac6
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1003464c
or edx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x130], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034638
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10034653
mov eax, ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffff8
pop eax
cmp dword [ebp - 0x1c], eax
ja 0x10034673
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10034673
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
imul ecx, ecx, 0xeae2
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, 0x5d742ad4
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x38]
je 0x100346a8
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100346ad
xor edi, edi
lea eax, [edi + 1]
xor edx, edx
cmp eax, 0xec0d
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
inc edx
xor eax, eax
cmp ecx, edx
jae 0x1003470d
cmp dword [ebp - 0x1c], eax
jne 0x1003470d
mov dword [ebp - 0x18], eax
jmp 0x100346e5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6a8], 0xf4923579
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100346d4
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x6a8], eax
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10034713
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor edx, edx
inc edx
jmp 0x10034713
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x130]
mov ecx, 0xdc9a81ff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
sbb eax, eax
inc eax
dec eax
je 0x10034738
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10034752
cmp dword [ebp - 0x130], eax
jne 0x10034752
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
push 3
sete cl
pop edi
neg ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x3c], edi
push 4
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], eax
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100347c6
xor edi, edi
push 3
inc edi
pop esi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7f8], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100347a9
mov esi, dword [sym.imp.USER32.dll_GetScrollInfo]
xor eax, eax
push 3
pop edi
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034803
push eax
push 0x9bd
push 0x970
push 0x112d
push 0x1e77
push 0x1024
push 0x1df1
push 0x1ee3
push 0x571
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 4
pop edx
mov eax, dword [ebp - 0x7f0]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
inc ecx
mov eax, dword [ebp - 0x7f0]
mov eax, dword [ebp - 0x7f0]
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x968]
imul eax, dword [ebp - 0x7f8], 0x860b
mov dword [ebp - 0x968], eax
xor eax, eax
mov byte [ebp - 0x51], al
mov dword [ebp - 0x24], 0x31713b91
mov dword [ebp - 0x30], 0x3069be54
mov dword [ebp - 0x38], 0x639956a2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10034871
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x630], 0x21c9b6cd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034859
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc
jge 0x1003499b
mov dword [ebp - 0x1c], 0x2ba8d7d2
mov dword [ebp - 0x30], 0x30fc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100348ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a8], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034894
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100348c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf2c], 0xefe35fe5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100348b1
cmp dword [ebp - 0x24], edi
je 0x10034942
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x24]
cmp eax, 0x23cf
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3a8]
cmp eax, 0x5c22
mov eax, dword [ebp - 0x1c]
setle dl
neg edx
add edx, edx
sub edx, 0xe0e2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x630], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x30], eax
je 0x10034944
mov eax, ecx
jmp 0x10034944
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x10034982
xor eax, eax
mov dword [ebp - 0x18], 0xea38
cmp dword [ebp - 0xf24], eax
jne 0x10034964
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x33
jne 0x10034950
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
push 0
pop eax
push 4
pop edx
jl 0x1003487e
cmp byte [ebp - 0x51], 0
je 0x10034a13
or edx, 0xffffffff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100349c3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcd8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100349af
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100349f1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100349e8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcb8], 0x55e00fe1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100349d0
xor eax, eax
dec dword [ebp - 0xcb0]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100349c8
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034a08
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
push eax
push 0x14b3
call ebx
push eax
call esi
inc dword [ebp - 0x28]
push 2
pop ecx
push 0
pop eax
cmp dword [ebp - 0x28], ecx
jle 0x10034601
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x100345bc
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x67f5ed9a
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
je 0x10034a30
inc dword [ebp - 0x330]
cmp dword [ebp - 0x330], 0x1c
jne 0x100345f2
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
cmp dword [ebp - 0x18], esi
jge 0x10034a79
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034a61
xor eax, eax
mov dword [ebp - 0x138], 0xffffffe3
jmp 0x10034a97
mov dword [ebp - 0x3c], 0x29bf39
cmp dword [ebp - 0x3c], eax
jne 0x10034aa0
inc dword [ebp - 0x138]
cmp dword [ebp - 0x138], 0x11
jne 0x10034a85
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034ab4
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
mov byte [ebp - 0x11], al
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x42ca8cda
mov dword [ebp - 0x3c], 0x29b3a00d
mov dword [ebp - 0x40], ecx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10034aea
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x308], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034ad6
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034afc
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x304]
mov eax, dword [ebp - 0x304]
xor eax, eax
cmp dword [ebp - 0x304], esi
jl 0x10034b37
mov ecx, esi
cmp dword [ebp - 0x3c], eax
jne 0x10034b39
mov ecx, eax
mov eax, dword [ebp - 0x304]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x304]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
cmp byte [ebp - 0x11], 0
je 0x10034ce2
mov dword [ebp - 0x24], 0xa4f833fc
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], 0x5bc9807
push 3
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0x1b4373c9
mov dword [ebp - 0x30], 0xea0262b0
mov dword [ebp - 0x3c], 0xfffb
push 7
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10034bb7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0xa8ea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034b9f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10034cc4
or ecx, 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x18], eax
jmp 0x10034bdb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5e8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034bce
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xb4cf22a1
jb 0x10034bfd
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x30], eax
je 0x10034c43
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10034c45
mov edx, esi
jmp 0x10034c47
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa4]
cmp edx, eax
setge cl
sub ecx, 0xb56
mov dword [ebp - 0x5e8], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
mov dword [ebp - 0x30], 0xfffffffc
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x30]
add eax, ecx
cmp eax, dword [ebp - 0x58]
je 0x10034c94
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10034ca8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x28]
sub eax, 0x5eac84c9
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
pop eax
jns 0x10034bc3
mov dword [ebp - 0x28], eax
jmp 0x10034cdb
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xa4], 0
jne 0x10034ce0
inc dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jle 0x10034cc9
call edi
mov esi, 0x3e64f147
mov edi, 0xc34f1d4b
mov dword [ebp - 0x10], esi
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
inc edx
cmp dword [ebp - 0x18], edx
jge 0x10034d17
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88], 0x17571177
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034cff
xor eax, eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffef
je 0x10034fe9
mov ebx, 0xe5337c48
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
push 0xfffffffffffffff8
mov dword [ebp - 0x3c], 0xb53b3045
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
jmp 0x10034d58
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x638], 0x7709b807
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034d47
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10034dc6
mov dword [ebp - 0x10], 0xbf079684
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x88]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setle al
cmp eax, dword [ebp - 0x20]
jge 0x10034dbd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
cmp eax, 0x7af9ca3e
setge cl
cmp ecx, dword [ebp - 0x88]
jne 0x10034edf
xor eax, eax
mov dword [ebp - 0x30], 0x6cfc4ff2
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10034e0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], 0xc6715623
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034df6
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x10034e23
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11fc], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034e16
mov dword [ebp - 0x10], 0x1857497f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x88], eax
jne 0x10034e54
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
cmp ecx, eax
mov eax, dword [ebp - 0x1c0]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x1c0]
sub edx, 0xff81490
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov ecx, 0x4c4a1c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x638]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x11f8], 0x4c7c
sub ecx, eax
mov dword [ebp - 0x30], ecx
jmp 0x10034fd0
push 3
mov dword [ebp - 0x58], 0xdd1e
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff7
jge 0x10034fd0
or ecx, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], 0xffffffef
cmp dword [ebp - 0x1c], 0xfffffffc
je 0x10034fc0
mov dword [ebp - 0xb24], ebx
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xb1c], ebx
push 2
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10034f42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x56c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10034f35
mov eax, dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10034f95
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x568]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x568]
cmp ecx, eax
mov eax, dword [ebp - 0x568]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
imul eax, ecx
test eax, eax
jne 0x10034f95
mov edx, eax
jmp 0x10034f9a
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0xb1c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
pop eax
push 1
pop edx
jne 0x10034f15
or ecx, 0xffffffff
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
push 1
pop edx
jl 0x10034efe
dec dword [ebp - 0x88]
cmp dword [ebp - 0x88], 0xffffffef
push 0
pop eax
push 1
pop edx
jne 0x10034d2f
mov ebx, dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x28], 0x53b26bdd
mov dword [ebp - 0x28], 0x16
cmp dword [ebp - 0x28], 0xffffffe5
jne 0x10035092
push 3
pop ecx
jmp 0x1003500e
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x10035027
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x147c], 0xb023ed15
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035016
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 2
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x10035085
push 2
pop ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jg 0x1003507d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035072
push eax
push 0x26a2
push 0x112c
push 0xb68
push 0x19f6
call ebx
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1003504d
xor edx, edx
inc edx
dec dword [ebp - 0x1c]
jns 0x10035042
push 3
pop ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
je 0x1003500c
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x100350ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0x17571177
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100350a2
xor eax, eax
push 0xffffffffffffffef
pop edi
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], edi
je 0x10035389
jmp 0x100350d4
xor edx, edx
inc edx
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
push 0xfffffffffffffff8
mov dword [ebp - 0x3c], 0xb53b3045
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
jmp 0x100350fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5f0], 0x7709b807
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100350ec
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10035168
mov dword [ebp - 0x10], 0xbf079684
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x90]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, esi
setle al
cmp eax, dword [ebp - 0x20]
jge 0x1003515f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x90]
xor ecx, ecx
cmp eax, 0x7af9ca3e
setge cl
cmp ecx, dword [ebp - 0x90]
jne 0x10035281
xor eax, eax
mov dword [ebp - 0x30], 0x6cfc4ff2
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x100351b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a8], 0xc6715623
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035198
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x100351c5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1214], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100351b8
mov dword [ebp - 0x10], 0x1857497f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x90], eax
jne 0x100351f6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
cmp ecx, eax
mov eax, dword [ebp - 0x1a8]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x1a8]
sub edx, 0xff81490
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov ecx, 0x4c4a1c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5f0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x1210], 0x4c7c
sub ecx, eax
mov dword [ebp - 0x30], ecx
jmp 0x10035374
push 3
mov dword [ebp - 0x58], 0xdd1e
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff7
jge 0x10035374
jmp 0x100352a2
xor edx, edx
inc edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], 0xfffffffc
je 0x10035367
push 2
pop esi
jmp 0x100352bd
xor edx, edx
inc edx
mov ecx, 0xe5337c48
mov dword [ebp - 0xc24], ecx
mov dword [ebp - 0xc20], ecx
mov dword [ebp - 0xc1c], ecx
mov dword [ebp - 0xc18], ecx
mov dword [ebp - 0x18], eax
jmp 0x100352ec
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x650], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100352df
mov eax, dword [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003533f
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x64c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64c]
cmp ecx, eax
mov eax, dword [ebp - 0x64c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
imul eax, ecx
test eax, eax
jne 0x1003533f
mov edx, eax
jmp 0x10035344
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0xc1c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
pop eax
jne 0x100352ba
or esi, 0xffffffff
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff7
jl 0x1003529f
dec dword [ebp - 0x90]
push 0
pop eax
cmp dword [ebp - 0x90], edi
jne 0x100350d1
mov dword [ebp - 0x24], 0x8be1
mov dword [ebp - 0x30], 0x18d303f0
push 9
mov dword [ebp - 0x10], 0xf4f88039
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 0xbc254e7f
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100353cd
push 0xfffffffffffffffa
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb44], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100353b9
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x100353e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x578], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100353d5
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xeb96
mov eax, dword [ebp - 0x10]
setge dl
mov esi, dword [sym.imp.GDI32.dll_IntersectClipRect]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x574]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x574]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0xa4d9
neg edx
sbb edx, edx
add edx, 0x6e9
imul eax, edx, 0x4481
xor edx, edx
inc edx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jg 0x10035532
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100354bf
push 0x85c
push 0x23eb
push 0x311
push 0x53b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xb3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x578]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xb40]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
sete dl
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
xor eax, eax
xor edx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
inc edx
jmp 0x1003551e
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003551b
push 0x2cb
push 0x25f6
push eax
call edi
xor edx, edx
xor eax, eax
inc edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jle 0x10035500
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], edx
jle 0x10035492
mov dword [ebp - 0x28], 0xf89b546
mov dword [ebp - 0x3c], 0x4d64
push 0xfffffffffffffffa
mov dword [ebp - 0x1c], 0x3b15a8df
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], eax
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1003556f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2cc], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1003555b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1003558f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x478], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035577
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100355b2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x122c], 0x1914cc5c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1003559a
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1003560c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x28], 0xc700
jg 0x100355d6
xor eax, eax
cmp dword [ebp - 0x2cc], eax
je 0x100355d6
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2cc]
xor ecx, ecx
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2cc]
cmp eax, edx
mov dword [ebp - 0x2c8], eax
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1003560a
mov ecx, edx
jmp 0x1003560e
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x122c], ecx
xor edx, edx
mov eax, dword [ebp - 0x478]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe5
jge 0x10035755
xor edx, edx
push 2
inc edx
pop ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1003566c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd00], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035654
xor eax, eax
mov dword [ebp - 0x1c], 0xd
cmp dword [ebp - 0x1c], 0xc
jle 0x10035742
mov dword [ebp - 0x3c], 0x8224
push 3
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 0x8e961cae
mov dword [ebp - 0x18], eax
jmp 0x100356aa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1244], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035699
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x44]
jle 0x100356c0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2cc]
test eax, eax
sets cl
xor eax, eax
cmp ecx, 0x7e5f8f0b
setle al
cmp eax, dword [ebp - 0x478]
jne 0x100356ee
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100356f0
mov ecx, edx
jmp 0x100356f2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x44]
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x78]
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setg cl
imul eax, ecx, 0xd7fc
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0xcfc], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1003573c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
push 1
pop edx
jg 0x1003567d
xor edx, edx
push 2
inc edx
pop ecx
dec dword [ebp - 0x38]
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffe5
push 0
pop eax
jl 0x10035649
mov dword [ebp - 0x28], 0x53b26bdd
mov dword [ebp - 0x28], 0x16
cmp dword [ebp - 0x28], 0xffffffe5
jne 0x10035801
xor ecx, ecx
push 3
inc ecx
pop edx
jmp 0x10035777
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x10035790
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1494], 0xb023ed15
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003577f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 2
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x100357f4
push 2
pop edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jg 0x100357ec
push 2
pop ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100357de
push eax
push 0x26a2
push 0x112c
push 0xb68
push 0x19f6
call ebx
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x100357b9
xor ecx, ecx
push 2
inc ecx
pop edx
dec dword [ebp - 0x1c]
jns 0x100357ab
push 3
pop edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
je 0x10035775
push 3
pop edx
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1003582e
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
push 3
mov dword [ebp + eax*4 - 0x125c], edx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10035814
push 3
xor eax, eax
pop edx
push 2
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x100358ef
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], eax
jmp 0x100358e3
mov dword [ebp - 0x28], 0xfaaaeb9a
mov dword [ebp - 0x28], eax
jmp 0x100358d7
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], eax
jl 0x100358d4
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x10035894
mov dword [ebp - 0x1c], 0x2733582f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10035891
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x125c], 0xc3414b58
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10035879
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1003586a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100358cf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xa59
push 0x136b
push 0x1acd
push 0x18af
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 3
pop edx
push 2
xor eax, eax
pop ecx
dec dword [ebp - 0x44]
jns 0x1003585e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x10035853
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x10035844
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10035839
mov dword [ebp - 0x28], 0x53b26bdd
mov dword [ebp - 0x28], 0x16
cmp dword [ebp - 0x28], 0xffffffe5
jne 0x100359a4
xor ecx, ecx
inc ecx
jmp 0x10035917
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x10035930
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14ac], 0xb023ed15
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003591f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push 2
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x10035994
push 2
pop edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jg 0x1003598c
push 2
pop ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003597e
push eax
push 0x26a2
push 0x112c
push 0xb68
push 0x19f6
call ebx
push 2
xor eax, eax
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x10035959
xor ecx, ecx
push 2
inc ecx
pop edx
dec dword [ebp - 0x1c]
jns 0x1003594b
push 3
pop edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
je 0x10035915
push 2
pop ecx
xor eax, eax
mov dword [ebp - 0x28], 0x5b9b55bb
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100359d0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x698], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100359b8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x100359f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd7c], 0xa9177c83
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100359d8
xor eax, eax
mov dword [ebp - 0x28], 0xffffffe6
jmp 0x10035b8b
mov dword [ebp - 0x1c], 0x7689351f
xor ebx, ebx
mov dword [ebp - 0x3c], 0x80b09de2
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10035a29
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x810], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10035a15
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12
jle 0x10035b88
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x3c], 0xf2ef51ae
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x6cae8ef3
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10035a7c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe74], 0xffdeabfd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035a64
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035a92
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa88], 0xaf36eaf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10035a81
mov eax, dword [ebp - 0x28]
neg eax
push 5
sbb eax, eax
neg eax
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x694]
dec dword [ebp - 0xa88]
pop eax
cmp dword [ebp - 0xe70], eax
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
setne cl
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
jne 0x10035af1
mov ecx, eax
cmp dword [ebp - 0x80c], eax
je 0x10035af3
mov ecx, ebx
mov eax, dword [ebp - 0x694]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x694], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xd7c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
jne 0x10035b32
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x810], eax
je 0x10035b34
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd7c]
push 0xfffffffffffffff8
setne cl
xor edx, edx
cmp ecx, 0xffea
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp dword [ebp - 0x68], eax
jne 0x10035b6a
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10035b6c
mov eax, ebx
add eax, 7
push 0
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
pop eax
push 3
pop edx
push 2
pop ecx
jg 0x10035a36
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jne 0x100359fc
mov dword [ebp - 0x24], 0x8be1
mov dword [ebp - 0x30], 0x18d303f0
push 9
mov dword [ebp - 0x10], 0xf4f88039
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x30], 0xbc254e7f
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10035bd9
push 0xfffffffffffffffa
pop ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbe4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10035bc5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035bef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x584], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035bde
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xeb96
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [ebp - 0xbdc], edx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0xbdc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x580]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x580]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0xa4d9
neg edx
sbb edx, edx
xor ebx, ebx
add edx, 0x6e9
inc ebx
imul eax, edx, 0x4481
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x10035d29
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035cbc
push 0x85c
push 0x23eb
push 0x311
push 0x53b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xbdc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x584]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xbe0]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
sete dl
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
jmp 0x10035d15
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035d12
push 0x2cb
push 0x25f6
push eax
call edi
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10035cfa
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], ebx
jle 0x10035c8f
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x30], 0xf7e4
mov dword [ebp - 0x3c], 0x4dde9a
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10035d61
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x434], 0x624039b6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10035d49
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop edi
jmp 0x10035d87
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10035d84
push 0x12f
push 0x2371
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10035d69
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x42c], eax
jne 0x10035dae
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x434]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x10], 7
test eax, eax
jne 0x10035dc2