Function at 0x10031360
Capabilities:
Allocate thread local storage
Check os version
Create directory
Create pipe
Create process on windows
Delete directory
Enumerate files on windows
Get disk information
Get file attributes
Log keystrokes
Modify service
Parse pe header
Query environment variable
Query or enumerate registry value
Read .ini file
Set environment variable
Set thread local storage value

Disassembly:
mov eax, 0x1008461f
call fcn.10082e08
mov eax, 0x1434
call fcn.1007f6d0
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x61], dl
inc ebx
mov dword [ebp - 0x60], ecx
push 4
mov dword [ebp - 0x18], ebx
or esi, 0xffffffff
pop edi
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x18], eax
jne 0x100313a4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov edx, 0xf607dbc1
cmp dword [ebp - 0x18], ebx
jg 0x10031444
mov dword [ebp - 0x24], 0xf16d
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xb66c146d
mov dword [ebp - 0x40], 0xf84b0f4
mov dword [ebp - 0x40], 0x7de97ee8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
sub eax, 0xa
cmp eax, esi
mov eax, 0xcd1b7e2
setne cl
sub eax, ecx
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff8
jg 0x1003140f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, 0xc254
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
jmp 0x10031454
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031456
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
mov dword [ebp - 0x24], 0xef7d6512
mov dword [ebp - 0x10], 0xffd81438
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0x7374fd5
mov dword [ebp - 0x28], 0xdda8db88
mov dword [ebp - 0x40], 0x752e4a6b
mov dword [ebp - 0x48], 0x9e149cff
cmp dword [ebp - 0x24], eax
jne 0x100314c7
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x1003149d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 0x58f5
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xee24
setg al
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100314c9
mov eax, ebx
inc eax
jne 0x100314d1
cmp dword [ebp - 0x28], eax
je 0x100314d3
mov eax, ebx
imul eax, eax, 0xfc03
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10031500
mov dword [ebp - 0x48], 0x1fa6
cmp dword [ebp - 0x48], eax
jne 0x10031506
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd
jle 0x100314f1
mov dword [ebp - 0x20], 0xfffffffb
lea ecx, [ebp - 0x984]
push ebx
call fcn.1001770e
xor eax, eax
lea ecx, [ebp - 0x9d8]
push ebx
mov dword [ebp - 4], eax
call fcn.1001770e
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1003154f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf8c], 0xf088
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031537
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10031575
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x984]
call fcn.1001779a
mov dword [eax], 0x34f1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031557
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003159b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9d8]
call fcn.1001779a
mov dword [eax], 0x4b664fb7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003157d
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 0xfffffffd
jg 0x100316fe
jmp 0x100315b6
xor eax, eax
mov dword [ebp - 0x3c], 0x9b389519
mov dword [ebp - 0x48], 0x6d4c01e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100315e6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18c], 0x23e64f14
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100315cd
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100315fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100316ab
mov ecx, dword [ebp - 0x188]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x188]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
setne dl
add eax, edx
mov dword [ebp - 0xf84], eax
jne 0x10031653
xor eax, eax
cmp dword [ebp - 0xf84], eax
je 0x1003166f
jmp 0x10031655
xor eax, eax
push eax
lea ecx, [ebp - 0x984]
call fcn.1001779a
cmp dword [eax], 0
je 0x1003166d
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10031674
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ecx - 6]
xor ecx, ecx
cmp eax, 0xfffffffc
setle cl
cmp ecx, 0xb7e59501
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ecx
setl dl
add esi, edx
add esi, dword [ebp - 0x188]
jne 0x100316ab
xor eax, eax
mov ecx, eax
jmp 0x100316ad
mov ecx, ebx
xor eax, eax
cmp ecx, 0xbb9a
setg al
cmp dword [ebp - 0x188], eax
jge 0x100316c6
mov eax, dword [ebp - 0x188]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x9d8]
xor eax, eax
push eax
call fcn.1001779a
xor ecx, ecx
test esi, esi
setne cl
mov dword [eax], esi
xor eax, eax
cmp ecx, 0xe9843c6b
setne al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x100315b4
or esi, 0xffffffff
lea ecx, [ebp - 0x9d8]
call fcn.10017795
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x20], 0xfffffffb
lea ecx, [ebp - 0x99c]
push ebx
call fcn.1001770e
push ebx
lea ecx, [ebp - 0xb1c]
mov dword [ebp - 4], 2
call fcn.1001770e
xor eax, eax
mov byte [ebp - 4], 3
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10031766
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x110c], 0xf088
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1003174e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003178c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x99c]
call fcn.1001779a
mov dword [eax], 0x34f1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003176e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100317b2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb1c]
call fcn.1001779a
mov dword [eax], 0x4b664fb7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031794
xor eax, eax
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 0xfffffffd
jg 0x1003190f
jmp 0x100317c7
xor eax, eax
mov dword [ebp - 0x3c], 0x9b389519
mov dword [ebp - 0x48], 0x6d4c01e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100317f7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a4], 0x23e64f14
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100317de
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003180b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100318bc
mov ecx, dword [ebp - 0x1a0]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x1a4]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1a0]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1a4]
setne dl
add eax, edx
mov dword [ebp - 0x1104], eax
jne 0x10031864
xor eax, eax
cmp dword [ebp - 0x1104], eax
je 0x10031880
jmp 0x10031866
xor eax, eax
push eax
lea ecx, [ebp - 0x99c]
call fcn.1001779a
cmp dword [eax], 0
je 0x1003187e
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10031885
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ecx - 6]
xor ecx, ecx
cmp eax, 0xfffffffc
setle cl
cmp ecx, 0xb7e59501
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ecx
setl dl
add esi, edx
add esi, dword [ebp - 0x1a0]
jne 0x100318bc
xor eax, eax
mov ecx, eax
jmp 0x100318be
mov ecx, ebx
xor eax, eax
cmp ecx, 0xbb9a
setg al
cmp dword [ebp - 0x1a0], eax
jge 0x100318d7
mov eax, dword [ebp - 0x1a0]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xb1c]
xor eax, eax
push eax
call fcn.1001779a
xor ecx, ecx
test esi, esi
setne cl
mov dword [eax], esi
xor eax, eax
cmp ecx, 0xe9843c6b
setne al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x100317c5
or esi, 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.10017795
lea ecx, [ebp - 0x99c]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x20], 0xfffffffb
lea ecx, [ebp - 0x9b4]
push ebx
call fcn.1001770e
push 4
pop eax
push ebx
lea ecx, [ebp - 0xc9c]
mov dword [ebp - 4], eax
call fcn.1001770e
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10031978
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xfcc], 0xf088
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10031960
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003199e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9b4]
call fcn.1001779a
mov dword [eax], 0x34f1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031980
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100319c4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc9c]
call fcn.1001779a
mov dword [eax], 0x4b664fb7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100319a6
xor eax, eax
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 0xfffffffd
jg 0x10031b21
jmp 0x100319d9
xor eax, eax
mov dword [ebp - 0x3c], 0x9b389519
mov dword [ebp - 0x48], 0x6d4c01e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10031a09
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x178], 0x23e64f14
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100319f0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031a1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10031ace
mov ecx, dword [ebp - 0x174]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x178]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x174]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x178]
setne dl
add eax, edx
mov dword [ebp - 0xfc4], eax
jne 0x10031a76
xor eax, eax
cmp dword [ebp - 0xfc4], eax
je 0x10031a92
jmp 0x10031a78
xor eax, eax
push eax
lea ecx, [ebp - 0x9b4]
call fcn.1001779a
cmp dword [eax], 0
je 0x10031a90
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x10031a97
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ecx - 6]
xor ecx, ecx
cmp eax, 0xfffffffc
setle cl
cmp ecx, 0xb7e59501
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ecx
setl dl
add esi, edx
add esi, dword [ebp - 0x174]
jne 0x10031ace
xor eax, eax
mov ecx, eax
jmp 0x10031ad0
mov ecx, ebx
xor eax, eax
cmp ecx, 0xbb9a
setg al
cmp dword [ebp - 0x174], eax
jge 0x10031ae9
mov eax, dword [ebp - 0x174]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc9c]
xor eax, eax
push eax
call fcn.1001779a
xor ecx, ecx
test esi, esi
setne cl
mov dword [eax], esi
xor eax, eax
cmp ecx, 0xe9843c6b
setne al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x100319d7
or esi, 0xffffffff
lea ecx, [ebp - 0xc9c]
call fcn.10017795
lea ecx, [ebp - 0x9b4]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x48], 0xfffffff8
lea ecx, [ebp - 0xb34]
push ebx
call fcn.1001770e
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10031b7b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x604], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10031b62
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031b9d
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb34]
call fcn.1001779a
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031b83
xor eax, eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0xd
jge 0x10031be2
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xb34]
push eax
neg esi
call fcn.1001779a
push 0
mov dword [eax], esi
xor eax, eax
cmp esi, 0xfe1
setl al
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x5fc]
cmp dword [ebp - 0x5fc], 0xd
pop eax
jl 0x10031bac
or esi, 0xffffffff
lea ecx, [ebp - 0xb34]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x798]
push ebx
call fcn.1001770e
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x48], 0x76ab2aee
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10031c35
push dword [ebp - 0x24]
lea ecx, [ebp - 0x798]
call fcn.1001779a
mov dword [eax], 0x9f30cc2f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031c17
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031c4d
push 0x2134
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10031c60
push eax
lea ecx, [ebp - 0x798]
call fcn.1001779a
xor eax, eax
push eax
lea ecx, [ebp - 0x798]
call fcn.1001779a
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x4c], 0xfffffffb
lea ecx, [ebp - 0xe74]
mov dword [ebp - 0x24], 0x62a2b3b7
mov dword [ebp - 0x20], 0xde1fc657
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x3c], 0xe9f4
mov dword [ebp - 0x50], 0x30385d06
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x10], 0x79deb476
mov dword [ebp - 0x40], 0x24b13b10
mov dword [ebp - 0x48], 0xfffffffd
push ebx
call fcn.1001770e
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop esi
cmp dword [ebp - 0x18], esi
jge 0x10031cfd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x870], 0x7c1abdf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031ce5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10031d1f
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe74]
call fcn.1001779a
mov dword [eax], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031d05
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10031da9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
neg eax
jne 0x10031d48
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 9
setne cl
add ecx, dword [ebp - 0x20]
jne 0x10031d48
xor eax, eax
mov edx, eax
jmp 0x10031d4a
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
inc ecx
mov dword [ebp - 0x40], ecx
imul ecx, dword [ebp - 0x40], 0xfffffffc
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
add edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x3c]
je 0x10031d77
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x10031d79
mov ecx, eax
mov eax, dword [ebp - 0x24]
add eax, ecx
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
jne 0x10031d94
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x50], eax
je 0x10031d96
mov ecx, ebx
mov eax, dword [ebp - 0x86c]
add eax, ecx
mov dword [ebp - 0x48], eax
jne 0x10031da9
mov eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10031dd7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
lea ecx, [ebp - 0xe74]
setg dl
or eax, 0xffffffff
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
call fcn.10017795
push 4
mov dword [ebp - 0x18], ebx
or edx, 0xffffffff
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x18], eax
jne 0x10031e1c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], ebx
jg 0x10031ebc
mov dword [ebp - 0x24], 0xf16d
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xb66c146d
mov dword [ebp - 0x40], 0xf84b0f4
mov dword [ebp - 0x40], 0x7de97ee8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
sub eax, 0xa
cmp eax, edx
mov eax, 0xcd1b7e2
setne cl
sub eax, ecx
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff8
jg 0x10031e82
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, 0xf607dbc1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, 0xc254
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
jmp 0x10031ecc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10031ecc
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
push ebx
lea ecx, [ebp - 0xa14]
call fcn.1001770e
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x24], 0xef7d6512
mov dword [ebp - 0x10], 0xffd81438
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0x7374fd5
mov dword [ebp - 0x28], 0xdda8db88
mov dword [ebp - 0x40], 0x752e4a6b
mov dword [ebp - 0x48], 0x9e149cff
cmp dword [ebp - 0x24], eax
jne 0x10031f52
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x10031f28
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, 0x58f5
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xee24
setg al
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10031f54
mov eax, ebx
inc eax
jne 0x10031f5c
cmp dword [ebp - 0x28], eax
je 0x10031f5e
mov eax, ebx
imul eax, eax, 0xfc03
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10031f8b
mov dword [ebp - 0x48], 0x1fa6
cmp dword [ebp - 0x48], eax
jne 0x10031f91
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd
jle 0x10031f7c
push ebx
lea ecx, [ebp - 0xc54]
call fcn.1001770e
mov byte [ebp - 4], 0xa
xor edx, edx
mov dword [ebp - 0x28], 0xb02971c1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0xc25bfc88
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x10031fed
mov dword [ebp - 0x48], 0x74b1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 6
jle 0x10031fea
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 6
jg 0x10031fd9
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xe
jle 0x10031fc9
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0xbf4]
push ebx
call fcn.1001770e
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x74f0e4f
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003203b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9cc], 0x648261f9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10032022
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003205b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1b8], 7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10032043
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10032081
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xbf4]
call fcn.1001779a
mov dword [eax], 0xa0a9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10032063
xor eax, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x10032151
mov dword [ebp - 0x38], 0x4fc2285f
lea ecx, [ebp - 0xd7c]
mov dword [ebp - 0x38], eax
push esi
call fcn.1001770e
or eax, 0xffffffff
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x38], eax
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100320d2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x710], 0x5db34e6d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100320ba
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100320f7
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd7c]
call fcn.1001779a
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100320da
xor eax, eax
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 3
jge 0x10032128
mov eax, dword [ebp - 0x710]
mov dword [ebp + eax*4 - 0x9cc], 8
inc dword [ebp - 0x710]
cmp dword [ebp - 0x710], 3
jl 0x10032106
xor eax, eax
push eax
lea ecx, [ebp - 0xbf4]
call fcn.1001779a
lea ecx, [ebp - 0xd7c]
dec dword [eax]
mov byte [ebp - 4], 0xb
call fcn.10017795
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x1003208d
cmp dword [ebp - 0x1b8], eax
je 0x100321a3
mov dword [ebp - 0x40], ebx
xor ecx, ecx
mov dword [ebp - 0x50], 0x43c7d757
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x9c4]
mov eax, dword [ebp - 0x9c8]
cmp eax, ebx
setge cl
add ecx, 0x1d12
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
jmp 0x10032202
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], 0x4c116104
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100321bc
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1b8], eax
neg eax
jne 0x100321d0
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100321d2
mov eax, ebx
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
sub eax, dword [ebp - 0x24]
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, 0x742cc323
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x24]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x24], 0xba889b0
lea ecx, [ebp - 0xbf4]
mov byte [ebp - 4], 0xa
call fcn.10017795
xor eax, eax
push 4
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10032236
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xfec], 0xf088
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1003221e
xor eax, eax
mov dword [ebp - 0x44], 0x7013dce9
or ecx, 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x9e4]
mov dword [ebp - 0x38], 0x2ff40fc0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x20bd2ab
mov dword [ebp - 0x38], 0xf3d4e677
push 3
call fcn.1001770e
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x24], eax
jmp 0x10032289
push dword [ebp - 0x24]
call fcn.1001779a
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
lea ecx, [ebp - 0x9e4]
jl 0x1003227c
push esi
call fcn.1001779a
mov edx, dword [eax]
lea ecx, [edx + 1]
mov dword [eax], ecx
test edx, edx
jne 0x100322cf
mov eax, dword [ebp - 0x48]
xor ecx, ecx
sub eax, 0x8d30
cmp eax, 0x244
setg cl
xor eax, eax
add ecx, dword [ebp - 0x40]
cmp ecx, 0x39d6b9c2
setge al
cmp dword [ebp - 0x44], eax
jge 0x100322cf
xor eax, eax
jmp 0x100322d1
mov eax, ebx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 0xa
call fcn.10017795
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1003230b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa14]
call fcn.1001779a
mov dword [eax], 0x34f1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100322ed
xor eax, eax
mov dword [ebp - 0x24], 0xc03342eb
mov dword [ebp - 0x48], 0x18e9934b
mov dword [ebp - 0x24], eax
jmp 0x10032339
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032336
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1003231e
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10032364
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc54]
call fcn.1001779a
mov dword [eax], 0x4b664fb7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10032346
xor eax, eax
mov dword [ebp - 0x28], 0x31713b91
mov dword [ebp - 0x38], 0x2ba8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10032392
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5ac], 0xec0351a9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003237a
xor eax, eax
mov dword [ebp - 0x28], eax
mov ecx, 0xffff
cmp dword [ebp - 0x28], 0xffffffec
jge 0x10032474
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100323c4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x880], 0x76d7be7e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100323ac
xor eax, eax
mov dword [ebp - 0x87c], 0x6e83
mov dword [ebp - 0x40], 0xfff6
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100323f5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x890], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100323dd
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10032428
mov dword [ebp - 0x40], ecx
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp eax, 0xbf33
mov eax, dword [ebp - 0x87c]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x88c]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
add eax, ecx
je 0x10032434
xor eax, eax
cmp dword [ebp - 0x88c], eax
je 0x10032436
mov eax, ebx
jmp 0x10032436
xor eax, eax
mov dword [ebp - 0x5ac], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003244f
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003245f
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
dec dword [ebp - 0x28]
mov ecx, 0xffff
cmp dword [ebp - 0x28], 0xffffffec
push 0
pop eax
jl 0x100323a4
mov dword [ebp - 0x4c], 0x17
cmp dword [ebp - 0x4c], 0xfffffffd
jg 0x100331c1
jmp 0x10032489
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x24], 0x85bf25cb
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x28], eax
jmp 0x10032573
mov dword [ebp - 0x38], 0xfffffff7
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x79536444
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
jmp 0x10032566
mov dword [ebp - 0x10], 0x946507e6
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100324fa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11b8], 0x813f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100324e1
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10032563
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], 0xe0d1b713
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1003255e
mov dword [ebp - 0x20], 0x66c619a8
mov dword [ebp - 0x38], 0xc863cc1
mov dword [ebp - 0x20], eax
jmp 0x10032547
mov dword [ebp - 0x40], 0xe4bf748d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032541
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
inc dword [ebp - 0x40]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10032527
mov eax, dword [ebp - 0x18]
push 0
mov eax, dword [ebp + eax*4 - 0x11b8]
dec dword [ebp - 0x18]
pop eax
jns 0x10032514
dec dword [ebp - 0x10]
jns 0x10032502
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jle 0x100324c7
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffeb
jle 0x100324a6
push 4
pop eax
mov dword [ebp - 0x3c], 0x9b389519
lea ecx, [ebp - 0xb4c]
push eax
call fcn.1001770e
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x30], 0x32fe2236
mov dword [ebp - 0x50], 0x32dc7183
mov dword [ebp - 0x40], 0x926a0939
mov dword [ebp - 0x40], ebx
push 4
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100325dd
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb4c]
call fcn.1001779a
push 4
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100325bc
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x100325fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x224], 0x6f885ea6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100325e5
xor eax, eax
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], eax
jl 0x10032785
mov dword [ebp - 0x2c], 0x7be18795
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov eax, 0xffff
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 0xcd16652d
sbb eax, eax
inc eax
cmp eax, 0xe5e81a7e
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
cmp dword [ebp - 0x2c], ecx
jne 0x10032661
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
jmp 0x100326da
mov dword [ebp - 0x48], 0xa5a165f5
xor edx, edx
mov dword [ebp - 0x44], 0x4c6f4446
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x220]
setle dl
sub eax, edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x220]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfffffff6
setg al
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x30]
je 0x100326c9
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100326cb
mov edx, ebx
jmp 0x100326cd
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x220], esi
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
push 7
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp esi, edx
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
pop edx
setne cl
sub edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x2c]
je 0x1003273c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x220], eax
je 0x1003273e
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
push 2
setle cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xb4c]
pop esi
push esi
call fcn.1001779a
mov ecx, dword [ebp - 0x40]
xor edx, edx
push 5
cmp ecx, dword [eax]
pop eax
setle dl
add edx, eax
mov dword [ebp - 0x40], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setne dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x30]
jns 0x1003260d
lea ecx, [ebp - 0xb4c]
mov byte [ebp - 4], 0xa
call fcn.10017795
or eax, 0xffffffff
mov dword [ebp - 0x48], 0x6d4c01e0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x780]
push ebx
call fcn.1001770e
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x48], 0x76ab2aee
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100327e0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x780]
call fcn.1001779a
mov dword [eax], 0x9f30cc2f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100327c2
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100327f8
push 0x2134
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003280b
push eax
lea ecx, [ebp - 0x780]
call fcn.1001779a
xor eax, eax
push eax
lea ecx, [ebp - 0x780]
call fcn.1001779a
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x780]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 0xa
call fcn.10017795
mov dword [ebp - 0x30], 0x5464
xor eax, eax
mov dword [ebp - 0x24], 0x51723279
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1003285b
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x124], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10032847
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003290c
mov dword [ebp - 0x10], 0x5f996f37
mov dword [ebp - 0x24], 0x8ab5457d
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10032890
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1218], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1003287b
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x100328c7
mov dword [ebp - 0x48], ebx
xor edx, edx
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10032898
cmp dword [ebp - 0x24], eax
je 0x10032904
mov eax, dword [ebp - 0x10]
mov ecx, 0xffff
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 8
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x124]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10032902
mov eax, ebx
jmp 0x10032904
xor eax, eax
mov dword [ebp - 0x1210], eax
jmp 0x10032941
mov dword [ebp - 0x30], eax
jmp 0x1003293b
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x24], eax
jmp 0x10032932
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003292f
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff7
jle 0x1003291d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe4
jg 0x10032911
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032959
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1b0], 0x23e64f14
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032948
push ebx
lea ecx, [ebp - 0xb4]
call fcn.1001770e
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x72c]
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x30], 0xfffffffd
push esi
call fcn.1001770e
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x50], 0x21526695
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100329bb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
mov dword [eax], 0xe91a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1003299d
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x100329db
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x204], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100329c3
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10032a01
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x72c]
call fcn.1001779a
mov dword [eax], 0xeec0db1b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x100329e3
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10032c04
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x20], 0xfffffff6
push dword [ebp - 0x2c]
call fcn.1001779a
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
xor eax, eax
push eax
call fcn.1001779a
xor ecx, ecx
cmp dword [eax], 0x350d8af8
setg cl
imul eax, ecx, 0x1b35
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x2c]
call fcn.1001779a
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
push dword [ebp - 0x2c]
imul ecx, dword [eax]
cmp ecx, 0xe34e
lea ecx, [ebp - 0xb4]
setne bl
call fcn.1001779a
mov ecx, dword [ebp - 0x2c]
sub ebx, ecx
mov dword [ebp - 0x48], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb4]
setge bl
xor eax, eax
push eax
call fcn.1001779a
cmp ebx, dword [eax]
jle 0x10032ab7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
cmp dword [eax], 0
jne 0x10032ab7
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
jmp 0x10032abc
xor edi, edi
inc edi
mov esi, edi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor ebx, ebx
sub ecx, 0x56411d7f
cmp ecx, 0xfff8
lea ecx, [ebp - 0xb4]
setne bl
xor eax, eax
push eax
call fcn.1001779a
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x2c]
setge dl
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
push 8
setg al
xor edx, edx
cmp eax, ecx
pop eax
setg dl
add edx, eax
xor eax, eax
cmp edx, dword [esi]
push 4
setl al
pop edx
cmp edx, eax
mov eax, dword [ebp - 0x204]
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, dword [ebp - 0x30]
jge 0x10032c50
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10032b58
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032b55
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x10032b43
mov esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x10], eax
je 0x10032b70
cmp dword [ebp - 0x30], eax
jne 0x10032b77
cmp dword [ebp - 0x20], eax
jne 0x10032b77
mov edi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
xor ebx, ebx
lea ecx, [ebp - 0xb4]
cmp esi, edi
setg bl
add ebx, dword [eax]
xor eax, eax
push eax
call fcn.1001779a
mov ecx, dword [ebp - 0x204]
xor edx, edx
imul ecx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xb4]
setg dl
xor eax, eax
cmp edx, 0x518d
setg al
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
call fcn.1001779a
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, 0x99db
setg al
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x5f31fd02
setge cl
mov dword [ebp - 0x50], ecx
dec dword [ebp - 0x2c]
jns 0x10032a0d
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
push eax
lea ecx, [ebp - 0xb4]
call fcn.1001779a
push ebx
lea ecx, [ebp - 0x72c]
mov esi, eax
call fcn.1001779a
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x72c]
call fcn.10017795
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0xa
call fcn.10017795
mov dword [ebp - 0x20], 0xfffffff6
dec dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10032d7e
xor eax, eax
mov dword [ebp - 0x40], 0x10aa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10032caf
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10032c7d
push 0x132
push 0x1f21
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10032ca7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
cmp dword [eax], 0
jne 0x10032ca5
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x10032c85
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10032c61
push 4
pop edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x10032be0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], edx
lea ecx, [ebp - 0xb4]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x204]
push dword [ebp - 0x2c]
call fcn.1001779a
cmp dword [eax], 0
jne 0x10032cfe
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb4]
call fcn.1001779a
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x72c]
push ebx
mov eax, dword [ebp + eax*4 - 0x204]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x204], ebx
call fcn.1001779a
lea ecx, [ebp - 0xb4]
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x48], eax
push dword [ebp - 0x2c]
call fcn.1001779a
xor eax, eax
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x30]
push 4
pop edx
cmp dword [ebp - 0x30], eax
jle 0x10032cbe
jmp 0x10032be3
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10032d6c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x674], 0xe5c7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10032d54
xor eax, eax
mov dword [ebp - 0x674], 0xfffffffd
cmp dword [ebp - 0x20], eax
jne 0x10032d84
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x36
jge 0x10032d4c
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0xe8c]
push 3
call fcn.1001770e
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x10], 0x39beb064
mov dword [ebp - 0x38], 0x4cdb8faa
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10032dd0
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe8c]
call fcn.1001779a
mov dword [eax], 0xbbca6318
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10032db1
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x10032dea
mov dword [ebp - 0x40], 0x3921ded6
dec dword [ebp - 0x40]
dec dword [ebp - 0x10]
jns 0x10032ddb
lea ecx, [ebp - 0xe8c]
mov byte [ebp - 4], 0xa
call fcn.10017795
cmp byte [ebp - 0x11], 0
je 0x10032f99
mov dword [ebp - 0x18], 0x5b9b55bb
xor eax, eax
mov dword [ebp - 0x28], ebx
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10032e2e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10ac], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032e1a
xor eax, eax
mov dword [ebp - 0x18], 0xffffffee
jmp 0x10032f86
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], eax
jl 0x10032f83
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10032e70
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x21c], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032e58
xor eax, eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jg 0x10032f7a
mov dword [ebp - 0x24], 0x1c3a23fe
mov dword [ebp - 0x38], 0x79facd4a
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x10032f64
push 3
lea ecx, [ebp - 0x9fc]
call fcn.1001770e
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x28], eax
jmp 0x10032eca
push dword [ebp - 0x28]
call fcn.1001779a
mov dword [eax], 0xce4b0ad8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
lea ecx, [ebp - 0x9fc]
jl 0x10032eb9
mov eax, dword [ebp - 0x24]
push ebx
call fcn.1001779a
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10032eed
mov esi, ebx
cmp dword [ebp - 0x48], eax
jne 0x10032eef
mov esi, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x10ac]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x10ac]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x21c]
setl dl
xor ecx, ecx
cmp esi, eax
setl cl
xor eax, eax
or esi, 0xffffffff
cmp ecx, esi
setne al
cmp edx, eax
jg 0x10032f42
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10032f3a
cmp dword [ebp - 0x24], eax
jne 0x10032f4a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
jne 0x10032f32
jmp 0x10032f4a
xor eax, eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xa
call fcn.10017795
dec dword [ebp - 0x24]
jns 0x10032ea1
xor eax, eax
inc dword [ebp - 0x21c]
cmp dword [ebp - 0x21c], 3
jle 0x10032e83
push 2
pop esi
dec dword [ebp - 0x20]
jns 0x10032e4d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jle 0x10032e3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov dword [ebp - 0x30], 0xd386cce5
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 0xfffffff7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x30], ebx
jb 0x10032fe0
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
add eax, 4
add eax, edx
je 0x10032fe2
mov eax, ebx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100330b3
mov dword [ebp - 0x24], 0x11
jmp 0x1003308f
mov dword [ebp - 0x20], 0x19
jmp 0x10033082
mov dword [ebp - 0x30], 0x12
jmp 0x1003304d
mov dword [ebp - 0x2c], 0x3cf81320
mov dword [ebp - 0x2c], eax
jmp 0x10033032
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
jmp 0x10033029
cmp dword [ebp - 0x20], eax
jne 0x1003302f
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
je 0x10033021
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jge 0x10033019
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003304a
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe8
jl 0x1003300d
mov dword [ebp - 0x30], eax
jmp 0x10033079
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033076
push 0x17f7
push eax
push eax
push 0x10ff
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x11
jle 0x10033058
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x13
jl 0x10033004
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x13
jg 0x10032ffb
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100330b0
push eax
push 0xfc1
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jge 0x10032fef
cmp dword [ebp - 0x4c], eax
jne 0x1003316e
mov ecx, dword [ebp - 0x1ac]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1b0]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1ac]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1b0]
setne dl
add eax, edx
mov dword [ebp - 0xfe4], eax
jne 0x10033116
xor eax, eax
cmp dword [ebp - 0xfe4], eax
je 0x10033132
xor eax, eax
push eax
lea ecx, [ebp - 0xa14]
call fcn.1001779a
cmp dword [eax], 0
je 0x10033130
mov ecx, ebx
xor eax, eax
cmp ecx, 0xbb9a
setg al
cmp dword [ebp - 0x1ac], eax
jge 0x10033189
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc54]
xor eax, eax
push eax
call fcn.1001779a
xor ecx, ecx
test esi, esi
push 2
setne cl
mov dword [eax], esi
xor eax, eax
cmp ecx, 0xe9843c6b
pop esi
setne al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffffd
jle 0x10032487
lea ecx, [ebp - 0xc54]
call fcn.10017795
or edi, 0xffffffff
lea ecx, [ebp - 0xa14]
mov dword [ebp - 4], edi
call fcn.10017795
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10033202
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x858], 0x26bdde0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100331ea
xor eax, eax
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], eax
jl 0x100332d8
jmp 0x10033213
xor ebx, ebx
inc ebx
movdqa xmm0, xmmword [0x10007e00]
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x114c]
push eax
lea ecx, [ebp - 0x134c]
movdqu xmmword [ebp - 0x114c], xmm0
call fcn.100177a9
lea ecx, [ebp - 0x179]
mov esi, eax
call fcn.10008f23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x64c]
push dword [esi]
call fcn.1001776f
push ebx
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], 0x15
call fcn.1001779a
push ebx
lea ecx, [ebp - 0x64c]
mov dword [eax], ebx
call fcn.1001779a
xor ebx, ebx
cmp dword [eax], ebx
jl 0x100332ae
xor esi, esi
inc esi
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x858], ebx
jne 0x100332ae
push esi
lea ecx, [ebp - 0x64c]
call fcn.1001779a
push esi
lea ecx, [ebp - 0x64c]
dec dword [eax]
call fcn.1001779a
cmp dword [eax], ebx
jge 0x10033284
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100332bf
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], edi
call fcn.10017795
dec dword [ebp - 0x4c]
jns 0x10033210
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x4c], eax
jmp 0x10033344
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x19
jge 0x10033341
xor esi, esi
inc esi
mov dword [ebp - 0x20], 0x28fdeb77
mov dword [ebp - 0x20], eax
jmp 0x10033319
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033316
push eax
push 0x536
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10033302
mov dword [ebp - 0x20], 0xd
jmp 0x10033332
cmp dword [ebp - 0x858], eax
jne 0x10033338
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10033327
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jl 0x100332f6
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffff9
jne 0x100332e3
xor edi, edi
mov dword [ebp - 0x48], 0xfffffff8
inc edi
lea ecx, [ebp - 0xb64]
push edi
call fcn.1001770e
mov dword [ebp - 4], 0x16
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10033391
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x61c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10033378
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100333b3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb64]
call fcn.1001779a
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033399
xor eax, eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0xd
jge 0x100333f8
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xb64]
push eax
neg esi
call fcn.1001779a
push 0
mov dword [eax], esi
xor eax, eax
cmp esi, 0xfe1
setl al
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x614]
cmp dword [ebp - 0x614], 0xd
pop eax
jl 0x100333c2
or esi, 0xffffffff
lea ecx, [ebp - 0xb64]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x48], 0xfffffff8
lea ecx, [ebp - 0xa2c]
push edi
call fcn.1001770e
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10033447
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x658], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003342e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033469
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa2c]
call fcn.1001779a
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003344f
xor eax, eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0xd
jge 0x100334ae
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xa2c]
push eax
neg esi
call fcn.1001779a
push 0
mov dword [eax], esi
xor eax, eax
cmp esi, 0xfe1
setl al
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x650]
cmp dword [ebp - 0x650], 0xd
pop eax
jl 0x10033478
or esi, 0xffffffff
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 4], esi
call fcn.10017795
push 4
pop eax
mov dword [ebp - 0x28], 0x69fdf99f
lea ecx, [ebp - 0x4dc]
push eax
call fcn.1001770e
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x4c], 0xdb88dcfd
mov dword [ebp - 0x50], 0xff68e10d
mov dword [ebp - 0x48], 7
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10033518
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4dc]
call fcn.1001779a
push 4
mov dword [eax], edi
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x100334fb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc
jge 0x1003376a
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 0xfffffff0
cmp dword [ebp - 0x20], 0xfffffff6
jg 0x1003370a
push edi
lea ecx, [ebp - 0x2e4]
call fcn.1001770e
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x40], 0x2a3c
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033582
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2e4]
call fcn.1001779a
mov dword [eax], 0xf25cbd94
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033564
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100335a4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11d0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003358b
xor eax, eax
push eax
lea ecx, [ebp - 0x2e4]
call fcn.1001779a
and dword [eax], 0
jmp 0x100336d5
push 8
pop eax
mov dword [ebp - 0x10], eax
xor eax, eax
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x100335e3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x136c], 0x2891ba80
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100335cb
xor eax, eax
push eax
lea ecx, [ebp - 0x4dc]
call fcn.1001779a
cmp dword [eax], 0
je 0x100335fd
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100335ff
jmp 0x10033601
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x2e4]
call fcn.1001779a
mov edx, dword [ebp - 0x40]
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp edx, ecx
setg al
xor ecx, ecx
cmp dword [esi], eax
sete cl
mov dword [ebp - 0x1364], ecx
lea ecx, [ebp - 0x4dc]
mov eax, dword [ebp - 0x10]
xor eax, eax
inc eax
push eax
call fcn.1001779a
mov dword [ebp - 0x4c], 0xbd3e
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
lea ecx, [ebp - 0x4dc]
setge dl
xor eax, eax
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x48], edx
push eax
call fcn.1001779a
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x4dc]
imul esi, edi
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.1001779a
xor edx, edx
test esi, esi
setne dl
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x2e4]
push eax
call fcn.1001779a
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
je 0x100336bd
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x100336bd
xor edi, edi
inc edi
jmp 0x100336c2
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x2e4]
xor eax, eax
push eax
call fcn.1001779a
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x2e4]
push eax
call fcn.1001779a
cmp dword [eax], 0x11
jne 0x100335b8
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x18
call fcn.10017795
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x10033539
xor eax, eax
mov dword [ebp - 0x4c], 7
jmp 0x10033754
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003373d
push 0x2100
push 0x16e4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033751
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xa
jge 0x10033713
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jl 0x10033525
or esi, 0xffffffff
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 4], esi
call fcn.10017795
mov dword [ebp - 0x4c], esi
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop esi
cmp dword [ebp - 0x24], esi
jge 0x100337a0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8c0], 0x26bdde0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10033788
xor eax, eax
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], eax
jl 0x10033872
movdqa xmm0, xmmword [0x10007e00]
lea eax, [ebp - 0xffc]
push eax
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x127c]
movdqu xmmword [ebp - 0x100c], xmm0
call fcn.100177a9
lea ecx, [ebp - 0x17a]
mov esi, eax
call fcn.10008f23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x634]
push dword [esi]
call fcn.1001776f
push edi
lea ecx, [ebp - 0x634]
mov dword [ebp - 4], 0x1a
call fcn.1001779a
push edi
lea ecx, [ebp - 0x634]
mov dword [eax], edi
call fcn.1001779a
xor esi, esi
jmp 0x1003383e
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x8c0], esi
jne 0x10033842
push edi
lea ecx, [ebp - 0x634]
call fcn.1001779a
push edi
lea ecx, [ebp - 0x634]
dec dword [eax]
call fcn.1001779a
cmp dword [eax], esi
jge 0x10033818
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033853
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 0xffffffff
lea ecx, [ebp - 0x634]
mov dword [ebp - 4], eax
call fcn.10017795
dec dword [ebp - 0x4c]
jns 0x100337ac
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x4c], eax
jmp 0x100338d0
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x24], eax
jmp 0x100338c7
mov dword [ebp - 0x20], 0x28fdeb77
mov dword [ebp - 0x20], eax
jmp 0x100338a6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100338a3
push eax
push 0x536
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1003388f
mov dword [ebp - 0x20], 0xd
jmp 0x100338bf
cmp dword [ebp - 0x8c0], eax
jne 0x100338c4
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100338b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jl 0x10033883
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffff9
jne 0x10033877
or eax, 0xffffffff
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x10], eax
push esi
call fcn.1001770e
mov dword [ebp - 4], 0x1b
mov eax, 0xffff
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003391c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x554]
call fcn.1001779a
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10033901
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033935
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor eax, eax
push eax
lea ecx, [ebp - 0x554]
call fcn.1001779a
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10033956
push eax
lea ecx, [ebp - 0x554]
call fcn.1001779a
xor eax, eax
push eax
lea ecx, [ebp - 0x554]
call fcn.1001779a
mov ecx, edi
sub ecx, dword [eax]
je 0x1003396b
mov eax, dword [ebp - 0x10]
xor eax, eax
lea ecx, [ebp - 0x554]
push eax
call fcn.1001779a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x554]
imul eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10017795
or eax, 0xffffffff
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x100339c2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x868], 0x26bdde0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100339aa
xor eax, eax
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x4c], eax
jl 0x10033a94
movdqa xmm0, xmmword [0x10007e00]
lea eax, [ebp - 0x10bc]
push eax
lea eax, [ebp - 0x10cc]
push eax
lea ecx, [ebp - 0x12a4]
movdqu xmmword [ebp - 0x10cc], xmm0
call fcn.100177a9
lea ecx, [ebp - 0x17c]
mov esi, eax
call fcn.10008f23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x584]
push dword [esi]
call fcn.1001776f
push edi
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], 0x1c
call fcn.1001779a
push edi
lea ecx, [ebp - 0x584]
mov dword [eax], edi
call fcn.1001779a
xor esi, esi
jmp 0x10033a60
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x868], esi
jne 0x10033a64
push edi
lea ecx, [ebp - 0x584]
call fcn.1001779a
push edi
lea ecx, [ebp - 0x584]
dec dword [eax]
call fcn.1001779a
cmp dword [eax], esi
jge 0x10033a3a
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10033a75
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 0xffffffff
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], eax
call fcn.10017795
dec dword [ebp - 0x4c]
jns 0x100339ce
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x4c], eax
jmp 0x10033af2
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x24], eax
jmp 0x10033ae9
mov dword [ebp - 0x20], 0x28fdeb77
mov dword [ebp - 0x20], eax
jmp 0x10033ac8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033ac5
push eax
push 0x536
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10033ab1
mov dword [ebp - 0x20], 0xd
jmp 0x10033ae1
cmp dword [ebp - 0x868], eax
jne 0x10033ae6
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10033ad6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x19
jl 0x10033aa5
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xfffffff9
jne 0x10033a99
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x130c]
movdqu xmmword [ebp - 0x102c], xmm0
call fcn.100177a9
lea ecx, [ebp - 0x18d]
mov esi, eax
call fcn.10008f23
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1248]
push dword [esi]
call fcn.1001776f
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff7
push 3
mov dword [ebp - 0x28], eax
pop ebx
jmp 0x10033b7b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10033b6e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd5c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10033b59
xor eax, eax
mov dword [ebp - 0xd5c], 0x462751c7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10033b50
lea ecx, [ebp - 0x1248]
call fcn.10017795
push 4
pop esi
mov dword [ebp - 0x28], 0x69fdf99f
lea ecx, [ebp - 0x4f4]
push esi
call fcn.1001770e
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x4c], 0xdb88dcfd
mov dword [ebp - 0x50], 0xff68e10d
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10033be1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4f4]
call fcn.1001779a
mov dword [eax], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10033bc7
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10033e31
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 0xfffffff0
cmp dword [ebp - 0x20], 0xfffffff6
jg 0x10033dde
push edi
lea ecx, [ebp - 0x2f4]
call fcn.1001770e
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x40], 0x2a3c
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033c46
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f4]
call fcn.1001779a
mov dword [eax], 0xf25cbd94
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033c28
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033c66
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11e8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033c4e
xor eax, eax
push eax
lea ecx, [ebp - 0x2f4]
call fcn.1001779a
lea ecx, [ebp - 0x2f4]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001779a
cmp dword [eax], 0x11
je 0x10033dc0
push 8
pop eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10033cb4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1384], 0x2891ba80
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10033c9c
xor eax, eax
push eax
lea ecx, [ebp - 0x4f4]
call fcn.1001779a
cmp dword [eax], 0
je 0x10033cce
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10033cd0
jmp 0x10033cd2
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x2f4]
call fcn.1001779a
mov edx, dword [ebp - 0x40]
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp edx, ecx
setg al
xor ecx, ecx
cmp dword [esi], eax
sete cl
mov dword [ebp - 0x137c], ecx
lea ecx, [ebp - 0x4f4]
mov eax, dword [ebp - 0x10]
xor eax, eax
inc eax
push eax
call fcn.1001779a
mov dword [ebp - 0x4c], 0xbd3e
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
lea ecx, [ebp - 0x4f4]
setge dl
xor eax, eax
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x48], edx
push eax
call fcn.1001779a
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x4f4]
imul esi, edi
imul esi, dword [eax]
xor eax, eax
push eax
call fcn.1001779a
xor edx, edx
test esi, esi
setne dl
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x2f4]
push eax
call fcn.1001779a
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
je 0x10033d8e
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10033d8e
xor edi, edi
inc edi
jmp 0x10033d93
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x2f4]
xor eax, eax
push eax
call fcn.1001779a
lea ecx, [ebp - 0x2f4]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001779a
push 4
pop esi
cmp dword [eax], 0x11
jne 0x10033c8c
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 0x1d
call fcn.10017795
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x10033bfd
xor eax, eax
mov dword [ebp - 0x4c], 7
jmp 0x10033e28
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033e11
push 0x2100
push 0x16e4
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10033e25
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xa
jge 0x10033de7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jl 0x10033be9
or ebx, 0xffffffff
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 4], ebx
call fcn.10017795
mov dword [ebp - 0x30], edi
mov eax, 0x967c74e2
mov dword [ebp - 0x3c], 0x9e885dc1
mov dword [ebp - 0x40], 0xc5c6a81d
mov dword [ebp - 0x28], 0xd4f509e1
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0xcd8], eax
mov dword [ebp - 0xcd4], eax
mov dword [ebp - 0xcd0], eax
mov dword [ebp - 0xccc], eax
xor eax, eax
push 2
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x24], eax
pop esi
jmp 0x10033ea9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x298], 0xfff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10033e98
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x30]
setg cl
dec edx
add edx, ecx
neg edx
sbb edx, edx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xe249
setne cl
cmp dword [ebp - 0x30], ecx
jge 0x10033f17