Function at 0x10033e48
Capabilities:
Accept command line arguments
Allocate thread local storage
Check os version
Clear file content
Create pipe
Create two anonymous pipes
Extract resource via kernel32 functions
Get common file path
Get disk information
Identify system language via api
Log keystrokes
Parse pe header
Query environment variable
Query or enumerate registry key
Query service status
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008ca2f
call fcn.1008afe8
mov eax, 0x160c
call fcn.10073e40
mov dword [ebp - 0x38], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x48], 0xffffffff
push ebx
push esi
mov byte [ebp - 0x7d], dl
mov ebx, 0xe1ca2961
mov edx, 0x837bc752
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x24], edx
mov esi, 0x39e3
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], ebx
push edi
mov dword [ebp - 0x60], esi
mov edi, 0x6df7
mov dword [ebp - 0x58], 0xfff6
push 2
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x30], eax
pop ecx
jmp 0x10033ebc
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1444], 0x7b5ca98
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10033eab
dec dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
cmp eax, 0xeb59
push 3
setne cl
sub ecx, dword [ebp - 0x24]
pop eax
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1094]
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], 0xfff6
mov dword [ebp - 0x2c], 0xd4e06482
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], eax
push 3
call fcn.10018816
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0x33631af6
push 3
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x10033f62
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1094]
call fcn.10018883
push 3
pop ecx
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10033f41
xor eax, eax
push 2
mov dword [ebp - 0x34], eax
pop ebx
cmp dword [ebp - 0x34], ebx
jge 0x10033f85
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xadc], 0x167d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10033f6d
xor eax, eax
push 1
mov dword [ebp - 0x2c], 0x1b
pop esi
jmp 0x10034113
mov dword [ebp - 0x28], 0xd925b0e4
mov dword [ebp - 0x28], eax
jmp 0x10034106
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x60], 0x7cccaea0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jge 0x10033fd1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x4e0], 0xcf2e
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10033fb9
xor eax, eax
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x68], eax
jl 0x10034103
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x100340f7
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x4e0], ecx
jne 0x100340f5
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x4e0], ecx
je 0x100340e2
mov dword [ebp - 0x4c], 0xc59cdc34
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x4e0], ecx
jne 0x100340f5
mov dword [ebp - 0x4c], ebx
xor eax, eax
cmp dword [ebp - 0x4c], eax
jl 0x100340ec
mov dword [ebp - 0x24], 0x54d8142c
mov dword [ebp - 0x54], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + eax*4 - 0x4e0]
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x4e0], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x4e0]
cmp eax, 4
setne cl
xor eax, eax
cmp ecx, 0x737ae9f9
setne al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
add eax, 0x87a5
cmp eax, 0x93e6
jl 0x10034099
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x1003409b
mov ecx, esi
mov eax, 0xfffa
sub eax, ecx
sub eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x28]
jle 0x100340b6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x100340b8
mov ecx, esi
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x100340d7
push eax
push 0x14f8
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
dec dword [ebp - 0x4c]
jns 0x10034033
jmp 0x100340ec
xor eax, eax
cmp dword [ebp - 0x4dc], eax
jne 0x100340f5
dec dword [ebp - 0x3c]
jns 0x10033fec
xor eax, eax
dec dword [ebp - 0x68]
jns 0x10033fdd
push 3
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
jge 0x10033fa3
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jne 0x10033f94
inc dword [ebp - 0xad8]
lea ecx, [ebp - 0x1094]
or dword [ebp - 4], 0xffffffff
call fcn.1001887e
mov dword [ebp - 0x58], edi
lea ecx, [ebp - 0xf50]
or edi, 0xffffffff
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], 0xa8bc07c2
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], 0x722abac8
mov dword [ebp - 0x38], 0xed09
push 3
call fcn.10018816
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0xa57461d0
mov dword [ebp - 0x24], 0x8d5680a2
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1003419d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6f4], 0xae35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10034185
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100341bd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xecc], 0x4c7ba3f3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100341a5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100341e0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf50]
call fcn.10018883
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100341c5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10034303
mov eax, dword [ebp - 0x6f4]
neg eax
cmp eax, edi
mov eax, dword [ebp - 0x6ec]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
cmp ecx, dword [ebp - 0x10]
je 0x1003421b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x6f4], 0
jne 0x1003421b
xor eax, eax
mov edx, eax
jmp 0x1003421d
mov edx, esi
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x6f4]
xor eax, eax
cmp edx, edi
setne al
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x6f4]
je 0x10034247
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10034249
mov ecx, esi
jmp 0x1003424b
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, esi
sete al
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10034273
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x6f4], 0
jne 0x1003430c
jmp 0x100342e9
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x100342e9
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1003429b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x448], 0x6986d6db
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10034283
xor eax, eax
mov dword [ebp - 0x444], eax
jmp 0x100342dc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100342d6
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x100342d1
push eax
push 0x339
push 0x1a20
push 0x10e3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100342ae
inc dword [ebp - 0x444]
cmp dword [ebp - 0x444], ebx
jle 0x100342a3
dec dword [ebp - 0x28]
jns 0x1003427b
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034300
push esi
push 0x1dad
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100341e8
dec dword [ebp - 0x24]
lea ecx, [ebp - 0xf50]
mov dword [ebp - 4], edi
call fcn.1001887e
mov dword [ebp - 0x30], 0x540d7f82
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x30], 0xc
jmp 0x1003434d
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x54], 0xa4d073ff
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffd
jl 0x10034334
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003436c
push 0x1537
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10034382
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1484], 0x7b5ca98
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10034371
dec dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x50]
cmp eax, 0xeb59
push ebx
setne cl
sub ecx, dword [ebp - 0x48]
sub ecx, 3
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x9d8]
call fcn.10018816
push esi
lea ecx, [ebp - 0x288]
mov dword [ebp - 4], ebx
call fcn.10018816
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x54], 0xfff9
mov dword [ebp - 0x2c], 0x4c3f4f88
mov dword [ebp - 0x28], 0xd91f06e8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10034401
push dword [ebp - 0x34]
lea ecx, [ebp - 0x9d8]
call fcn.10018883
mov dword [eax], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x100343e7
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10034427
push dword [ebp - 0x34]
lea ecx, [ebp - 0x288]
call fcn.10018883
mov dword [eax], 0xa66fe7d8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10034409
xor eax, eax
push eax
lea ecx, [ebp - 0x288]
call fcn.10018883
xor edi, edi
lea ecx, [ebp - 0x288]
push edi
mov dword [eax], edi
call fcn.10018883
jmp 0x100345a9
mov dword [ebp - 0x4c], 0x94d03572
mov dword [ebp - 0x24], 0xffffffff
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
neg edx
push edi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x288]
call fcn.10018883
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, 0xec5e
mov ecx, dword [ebp - 0x4c]
push 8
setge dl
xor ebx, ebx
cmp edx, ecx
pop ecx
setle bl
add ebx, dword [eax]
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x288]
push edi
setne al
xor ebx, ebx
cmp eax, 0xffffffff
setle bl
call fcn.10018883
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x2c]
setl cl
sub eax, ecx
je 0x100344c0
mov eax, dword [ebp - 0x4c]
push edi
lea ecx, [ebp - 0x288]
call fcn.10018883
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x288]
mov eax, dword [ebp - 0x4c]
push edi
call fcn.10018883
lea ecx, [ebp - 0x9d8]
push dword [eax]
call fcn.10018883
push edi
lea ecx, [ebp - 0x288]
mov esi, eax
call fcn.10018883
lea ecx, [ebp - 0x9d8]
push dword [eax]
call fcn.10018883
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov dword [esi], ecx
xor ecx, ecx
cmp eax, 0x51ea
setg cl
xor eax, eax
cmp dword [esi], ecx
setle al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0x2305aba9
je 0x10034533
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
jmp 0x1003456b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10034565
mov dword [ebp - 0x2c], 0xffffffe9
jmp 0x1003455c
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034559
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x10034543
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x14
jge 0x1003453a
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003458a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
push eax
lea ecx, [ebp - 0x288]
call fcn.10018883
xor edi, edi
lea ecx, [ebp - 0x288]
push edi
inc dword [eax]
call fcn.10018883
xor esi, esi
inc esi
cmp dword [eax], esi
jle 0x10034448
lea ecx, [ebp - 0x288]
call fcn.1001887e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d8]
call fcn.1001887e
push 4
pop edi
push edi
lea ecx, [ebp - 0x588]
call fcn.10018816
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xd767c8fa
mov dword [ebp - 0x54], 0x307b364f
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
jge 0x10034616
push dword [ebp - 0x30]
lea ecx, [ebp - 0x588]
call fcn.10018883
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x100345f8
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x10034696
mov dword [ebp - 0x1c], 0xf37d45db
mov dword [ebp - 0x1c], eax
jmp 0x10034644
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034641
push eax
push 0xdf2
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003462a
mov dword [ebp - 0x1c], eax
jmp 0x1003468e
mov dword [ebp - 0x30], 0x85faafe3
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1003468b
mov dword [ebp - 0x14], 0x2df3d37a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10034686
push dword [ebp - 0x10]
lea ecx, [ebp - 0x588]
call fcn.10018883
cmp dword [eax], 0
jne 0x10034684
dec dword [ebp - 0x14]
jns 0x1003466c
xor eax, eax
dec dword [ebp - 0x30]
jns 0x1003465d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003464e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1003461e
mov dword [ebp - 0x10], eax
jmp 0x1003476a
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x4c], 0x3ccd2466
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10018883
xor ebx, ebx
cmp dword [eax], ebx
jne 0x100346d2
push esi
lea ecx, [ebp - 0x588]
call fcn.10018883
cmp dword [eax], ebx
mov eax, ebx
je 0x100346d4
mov eax, esi
push 8
pop ebx
cmp eax, ebx
mov dword [ebp - 0x28], esi
mov edx, dword [ebp - 0x4c]
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
neg edx
sbb edx, edx
sub ecx, eax
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10034733
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x588]
mov eax, dword [ebp - 0x28]
push 3
call fcn.10018883
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x28], esi
je 0x10034733
push 2
pop eax
push eax
lea ecx, [ebp - 0x588]
call fcn.10018883
mov eax, dword [ebp - 0x10]
cmp ebx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
lea ecx, [ebp - 0x588]
je 0x100346a3
or dword [ebp - 4], 0xffffffff
call fcn.1001887e
push 2
pop ebx
mov dword [ebp - 0x38], 0xfffffffa
lea ecx, [ebp - 0x918]
mov dword [ebp - 0x10], 0x948708ef
push ebx
call fcn.10018816
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x100347d2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x918]
call fcn.10018883
mov dword [eax], 0x38e85a7b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x100347b4
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10034842
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 0x123d
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x10]
jl 0x10034800
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1003480a
mov eax, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x918]
call fcn.10018883
push esi
lea ecx, [ebp - 0x918]
mov dword [eax], 0x1880
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
call fcn.10018883
cmp dword [eax], 0
je 0x10034840
mov edx, esi
jmp 0x10034844
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x10]
jg 0x1003485c
mov ecx, esi
cmp dword [ebp - 0x10], eax
jne 0x1003485e
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add ecx, 0x339b8842
xor eax, eax
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003488e
push 0x371
push 0x24c6
push 0x158f
push eax
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.1001887e
mov dword [ebp - 0x40], 0xffffffff
lea ecx, [ebp - 0x2a8]
push esi
call fcn.10018816
push 6
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x6aed1d25
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x100348f2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2a8]
call fcn.10018883
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100348d4
xor eax, eax
push 3
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x10034915
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1040], 0xb1dab551
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100348fd
xor eax, eax
push eax
lea ecx, [ebp - 0x2a8]
call fcn.10018883
xor ebx, ebx
mov dword [eax], ebx
jmp 0x100349a0
xor eax, eax
mov dword [ebp - 0x54], 0xfffffffe
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1003497f
push 0x13cd
push 0x1e6f
push eax
push eax
push 0x1222
push 0x425
push 9
push 0xf1a
push 0x2571
push 0x108d
push 0x182a
push 0x10b1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
xor eax, eax
push eax
lea ecx, [ebp - 0x2a8]
call fcn.10018883
xor ebx, ebx
lea ecx, [ebp - 0x2a8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
call fcn.10018883
inc dword [eax]
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.10018883
cmp dword [eax], 0x1a
jne 0x10034927
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x2a8]
push ebx
call fcn.10018883
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2a8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.10018883
push ebx
lea ecx, [ebp - 0x2a8]
mov esi, eax
call fcn.10018883
xor ebx, ebx
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x1040], ecx
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1040], eax
mov eax, dword [ebp - 0x2c]
sete bl
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
or ebx, 0xffffffff
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], ebx
call fcn.1001887e
mov dword [ebp - 0x58], 0x837bc752
xor eax, eax
mov dword [ebp - 0x2c], 0x462d5e48
xor esi, esi
mov dword [ebp - 0x54], 0x83c8fc55
inc esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], 0x5e3edfa8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x6c], 0x224
mov dword [ebp - 0x30], eax
jmp 0x10034a82
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xc4], 0x4990069f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10034a71
mov dword [ebp - 0x2c], 0xd
jmp 0x10034add
mov dword [ebp - 0x38], 0x5b40194d
lea ecx, [ebp - 0xf68]
push 4
call fcn.10018816
xor eax, eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x30], eax
jmp 0x10034ac3
push dword [ebp - 0x30]
call fcn.10018883
mov dword [eax], 0x822e6e7f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
lea ecx, [ebp - 0xf68]
jl 0x10034ab2
inc dword [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1001887e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xc
jge 0x10034a90
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034af0
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
sete cl
sub ecx, 4
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc4], eax
xor eax, eax
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], 0xe1ca2961
mov dword [ebp - 0x34], 0x9fdf99ff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0xc8c74c3e
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1a
jle 0x10034c3c
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0xe0d1b713
mov dword [ebp - 0x2c], 0xe018
mov dword [ebp - 0x38], 0x9e17716e
mov dword [ebp - 0x38], 0x3312ef31
mov dword [ebp - 0x48], 0xeb4e5227
cmp dword [ebp - 0x34], eax
jne 0x10034bb6
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
cmp edx, esi
jle 0x10034ba7
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
xor esi, esi
mov eax, dword [ebp - 0x34]
inc esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x2c], 0x7b400765
jge 0x10034bff
cmp dword [ebp - 0x24], eax
jne 0x10034bff
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10034c29
push 0xe28
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x10034c29
mov dword [ebp - 0x2c], eax
jmp 0x10034c23
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034c20
push eax
push 0x9c7
push 0x14aa
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff2
jg 0x10034c04
inc dword [ebp - 0x48]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1a
push 0
pop eax
jg 0x10034b60
mov dword [ebp - 0x60], 0x39e3
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 0xb592
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xa
push 2
pop ebx
jne 0x10034cff
push 3
pop ecx
mov dword [ebp - 0x2c], 0x54bc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xee61780e
mov dword [ebp - 0x24], 0xb6eab3cf
mov dword [ebp - 0x30], eax
jmp 0x10034c8e
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x10b0], 0x6273d594
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10034c7d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10034cad
cmp dword [ebp - 0x28], eax
je 0x10034cad
mov eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10b0], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10034cef
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034cd7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x10b0]
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], ebx
jle 0x10034cc6
push 3
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
push 0
pop eax
je 0x10034c60
mov dword [ebp - 0x24], 0xfff6
mov dword [ebp - 0x54], 0x6df7
mov dword [ebp - 0x30], eax
jmp 0x10034d23
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1454], 0x7b5ca98
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10034d12
dec dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
cmp eax, 0xeb59
push 3
setne cl
sub ecx, dword [ebp - 0x58]
pop eax
sub ecx, eax
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x790]
push eax
call fcn.10018816
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x40], 0x4c99fffb
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10034d96
push dword [ebp - 0x30]
lea ecx, [ebp - 0x790]
call fcn.10018883
mov dword [eax], 0x7571177e
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10034d77
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10034fd9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x60], 6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], 0x6985ba5
mov dword [ebp - 0x2c], 0x34f1d4b0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x10034fd6
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x30], 0x373b2c57
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
neg edx
sbb edx, edx
sub ecx, dword [ebp - 0x10]
neg edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
cmp eax, 0x66b7a7b
je 0x10034e08
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x790]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], 0xf147
dec dword [ebp - 0x60]
mov esi, dword [ebp - 0x60]
push dword [ebp - 0x1c]
call fcn.10018883
xor edx, edx
mov dword [eax], esi
lea eax, [esi - 0x2de4e7a9]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xb000
jle 0x10034e88
mov dword [ebp - 0x4c], eax
jmp 0x10034e7d
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10034e71
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10034f44
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x12
jg 0x10034e5d
jmp 0x10034f3f
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x10034f34
xor ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x10034f2b
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0xa65d3384
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
dec eax
sub eax, dword [ebp - 0x58]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xffff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 4
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x2c]
setne cl
sub esi, ecx
lea ecx, [ebp - 0x790]
call fcn.10018883
xor ecx, ecx
cmp esi, 0x278a4911
setne cl
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x2c]
jns 0x10034ea6
xor ecx, ecx
xor eax, eax
inc ecx
dec dword [ebp - 0x3c]
jns 0x10034e97
cmp dword [ebp - 0x30], eax
jne 0x10034fd1
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10034f67
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x7ce2a770
setl cl
xor esi, esi
mov dword [ebp - 0x34], ecx
inc esi
mov eax, dword [ebp - 0x40]
mov ecx, esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
jmp 0x10034f6c
xor esi, esi
mov ecx, eax
inc esi
xor eax, eax
cmp ecx, 0xffffffff
sete al
cmp eax, dword [ebp - 0x40]
jl 0x10034f84
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10034f86
mov edx, esi
jmp 0x10034f88
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
add ecx, dword [ebp - 0x14]
test ecx, ecx
lea ecx, [ebp - 0x790]
setg al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.10018883
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x790]
call fcn.10018883
push 0
mov dword [eax], esi
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x10034dc5
jmp 0x10034fd4
xor esi, esi
inc esi
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10034d9e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x790]
call fcn.1001887e
push 3
lea ecx, [ebp - 0x148]
call fcn.10018816
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x10], 0xbbdebf88
mov dword [ebp - 0x50], 0xb56cef3c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1003503a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x148]
call fcn.10018883
or dword [eax], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1003501e
xor eax, eax
push eax
lea ecx, [ebp - 0x148]
call fcn.10018883
xor ecx, ecx
push ebx
cmp dword [eax], esi
setge cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x148]
call fcn.10018883
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
push 2
cmp ecx, dword [eax]
lea ecx, [ebp - 0x148]
pop eax
push eax
sete bl
call fcn.10018883
cmp ebx, dword [eax]
jne 0x10035087
xor eax, eax
lea ecx, [ebp - 0x148]
push eax
call fcn.10018883
xor eax, eax
lea ecx, [ebp - 0x148]
push eax
call fcn.10018883
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x148]
push esi
call fcn.10018883
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x148]
call fcn.10018883
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x148]
push ebx
call fcn.10018883
xor ecx, ecx
cmp dword [eax], esi
setne cl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x50], 3
jmp 0x100351b1
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xe3c], eax
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xe30], eax
push ebx
call fcn.10018883
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe30], eax
test eax, eax
je 0x10035131
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x10], 0xffffffe8
jmp 0x10035129
push ebx
lea ecx, [ebp - 0x148]
call fcn.10018883
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x30
jne 0x10035115
jmp 0x10035163
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1003515e
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1003515b
push 0x16c2
push eax
push 0x1068
push eax
push 0xa7c
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10035138
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x100351a9
mov dword [ebp - 0x34], eax
jmp 0x100351a1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1003519e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x148]
call fcn.10018883
push 3
pop ecx
mov dword [eax], 0xa18394d2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003517d
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10035172
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1003516d
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffff8
lea ecx, [ebp - 0x148]
jl 0x100350d8
or dword [ebp - 4], 0xffffffff
call fcn.1001887e
push 4
lea ecx, [ebp - 0x4f8]
call fcn.10018816
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xd767c8fa
mov dword [ebp - 0x54], 0x307b364f
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10035219
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4f8]
call fcn.10018883
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x100351fa
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x10035299
mov dword [ebp - 0x1c], 0xf37d45db
mov dword [ebp - 0x1c], eax
jmp 0x10035247
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10035244
push eax
push 0xdf2
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1003522d
mov dword [ebp - 0x1c], eax
jmp 0x10035291
mov dword [ebp - 0x30], 0x85faafe3
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x1003528e
mov dword [ebp - 0x14], 0x2df3d37a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10035289
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f8]
call fcn.10018883
cmp dword [eax], 0
jne 0x10035287
dec dword [ebp - 0x14]
jns 0x1003526f
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10035260
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10035251
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10035221
mov dword [ebp - 0x10], eax
jmp 0x10035373
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x4c], 0x3ccd2466
mov eax, dword [ebp - 0x4c]
push esi
call fcn.10018883
xor ebx, ebx
cmp dword [eax], ebx
jne 0x100352d5
push esi
lea ecx, [ebp - 0x4f8]
call fcn.10018883
cmp dword [eax], ebx
mov eax, ebx
je 0x100352d7
mov eax, esi
push 8
pop ecx
cmp eax, ecx
mov dword [ebp - 0x28], esi
mov edx, dword [ebp - 0x4c]
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
neg edx
push 3
sbb edx, edx
sub ecx, eax
inc edx
sub ecx, edx
neg ecx
pop ebx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 4
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10035339
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x4f8]
mov eax, dword [ebp - 0x28]
push ebx
call fcn.10018883
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x28], esi
je 0x10035339
push 2
pop eax
push eax
lea ecx, [ebp - 0x4f8]
call fcn.10018883
mov eax, dword [ebp - 0x10]
push 8
pop ecx
cmp ecx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
lea ecx, [ebp - 0x4f8]
je 0x100352a6
or dword [ebp - 4], 0xffffffff
call fcn.1001887e
mov dword [ebp - 0x38], 0xfffffffa
lea ecx, [ebp - 0x2e4]
push esi
call fcn.10018816
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x6aed1d25
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x100353e2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2e4]
call fcn.10018883
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100353c4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10035402