Function at 0x10038206
Capabilities:
Accept command line arguments
Allocate thread local storage
Compare security identifiers
Connect pipe
Create process on windows
Delete file
Delete registry value
Get common file path
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1008f73d
call fcn.1008f0d0
mov eax, 0x1260
call fcn.1008cb20
push ebx
push esi
mov dword [ebp - 0x6c], ecx
xor ebx, ebx
or ecx, 0xffffffff
mov byte [ebp - 0x81], dl
mov dword [ebp - 0x3c], ecx
inc ebx
mov dword [ebp - 0x18], 0xf18ee85e
xor eax, eax
mov dword [ebp - 0x14], 0x51acae7b
push edi
mov dword [ebp - 0x20], 0xb903
mov dword [ebp - 0x2c], ebx
push 3
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x1003826c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d0], 0xf0ed
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10038254
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x1003828b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x694], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10038277
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003829d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10038290
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1c8]
jge 0x10038376
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
jne 0x100382cc
mov edx, eax
cmp dword [ebp - 0x1d0], eax
je 0x100382ce
mov edx, ebx
mov eax, dword [ebp - 0x1d0]
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x5bed
test eax, eax
jne 0x100382ed
cmp dword [ebp - 0x1d0], eax
je 0x100382f3
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov dword [ebp - 0x690], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x1d0]
setle cl
cmp ecx, 0xe402095d
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
sub edx, 0x78c0
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1d0]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1cc]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0xe9c], ecx
cmp ecx, dword [ebp - 0x18]
jl 0x10038376
mov eax, ebx
jmp 0x10038378
xor eax, eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d0]
cmp eax, 0x6f4e
setg cl
lea eax, [ecx + 0x50e1]
cmp eax, dword [ebp - 0x1d0]
jle 0x100383e5
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x100383b3
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100383f6
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x100383de
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x694]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x694], ecx
dec dword [ebp - 0x2c]
jns 0x100383c3
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100383bb
jmp 0x100383f6
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x100383f8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffd
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x60], 0x801fc3ee
mov dword [ebp - 0x44], 0xbef7d651
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x18], 0xf39c
mov dword [ebp - 0x20], 0xda8d
mov dword [ebp - 0x44], ecx
push 5
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 0xa93f0451
mov dword [ebp - 0x54], 0xb9d37639
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10038483
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7ec], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003846f
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100384a2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x103c], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003848e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100384b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb44], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100384a7
dec dword [ebp - 0x3c]
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1038], ecx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x20]
cmp eax, ecx
jle 0x100384da
mov edi, ebx
jmp 0x100384de
xor eax, eax
mov edi, eax
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x100384ee
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x7ec]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xc114
mov eax, dword [ebp - 0xb3c]
setl dl
xor ecx, ecx
cmp edx, eax
push 2
setne cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x7e8]
mov eax, dword [ebp - 0x2c]
imul esi, eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x61e33ecd
setle cl
xor edx, edx
sub esi, ecx
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp edi, esi
pop edi
setle dl
mov esi, 0x8bbca631
xor ecx, ecx
cmp edx, eax
setle cl
or edx, 0xffffffff
mov dword [ebp - 0xb3c], ecx
xor eax, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10038572
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8ac], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003855e
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100385a1
mov dword [ebp - 0x2c], 0x265ab3e9
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x1003859e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x8ac], 0x624cdb8f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10038586
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10038577
mov dword [ebp - 0x8ac], 0x77ab3921
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0x590
mov dword [ebp - 0x20], eax
jmp 0x100385cc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x280], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100385bf
mov eax, dword [ebp - 0x1c]
push 6
pop ecx
cmp eax, dword [ebp - 0x1c]
jge 0x100386ad
mov dword [ebp - 0x20], 0x37c0
xor ecx, ecx
mov dword [ebp - 0x18], 0xabff5ecc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0xd69b45c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
push 5
setle cl
imul ecx, dword [ebp - 0x20]
pop eax
push 0xfffffffffffffffc
pop ebx
imul ecx, dword [ebp - 0x20]
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add ecx, 0x12a2ef7e
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x27c], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, dword [ebp - 0x1c]
jle 0x1003869d
cmp dword [ebp - 0x280], eax
jne 0x100386a2
cmp dword [ebp - 0x18], eax
je 0x100386a5
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x1003886c
xor eax, eax
mov dword [ebp - 0x54], 0x3d82f881
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffd
push 0xfffffffffffffffc
pop ebx
jle 0x10038862
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x40], 0xe8e356d6
mov dword [ebp - 0x24], 0xffffffe6
jmp 0x10038848
mov dword [ebp - 0x14], 0x5866b388
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x10038845
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], 0xc51c
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jg 0x1003883c
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], 7
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x280]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], 0x5a1b
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003880e
mov edx, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x3c]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
imul ecx, ecx, 0x1fd1
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0xfff6
test eax, eax
jne 0x1003878f
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x10038791
mov ecx, edi
xor eax, eax
cmp ecx, 0x316a
push 3
setge al
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jl 0x100387c8
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100387ca
mov edx, edi
jmp 0x100387cc
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x14]
jne 0x100387e2
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x100387e4
mov eax, edi
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x27c]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
imul eax, ecx, 0x8194
cmp eax, 0xb022
jge 0x1003880c
mov ecx, edi
jmp 0x10038810
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x14]
push 6
mov dword [ebp + eax*4 - 0x280], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x38]
pop ecx
cmp dword [ebp - 0x38], edi
jle 0x10038719
xor eax, eax
or edx, 0xffffffff
dec dword [ebp - 0x14]
jns 0x100386fc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff7
je 0x100386e6
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
jg 0x100386c9
push 2
pop edi
mov dword [ebp - 0x27c], 0xfffffffb
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10038891
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x43c], 0x937d8e6e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10038879
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100388a7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150], 0xbec0351
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10038896
imul eax, dword [ebp - 0x434], 0xffff
or ecx, 0xffffffff
cmp eax, ecx
jae 0x100388db
mov eax, dword [ebp - 0x434]
mov eax, dword [ebp - 0x434]
mov eax, dword [ebp - 0x430]
mov eax, dword [ebp - 0x434]
mov eax, dword [ebp - 0x434]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x150], ebx
cmp dword [ebp - 0x438], eax
je 0x100388f8
cmp dword [ebp - 0x14c], eax
je 0x100388f8
mov eax, ebx
cmp dword [ebp - 0x434], eax
jne 0x10038906
mov eax, dword [ebp - 0x150]
xor eax, eax
cmp dword [ebp - 0x150], eax
je 0x1003892e
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10038a68
push eax
push eax
push 0x9e7
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x10038a66
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [ebp - 0x14], 0xfff6
mov dword [ebp - 0x28], 0xfffffff8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x438]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, 0x8594
push 3
setge cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x150]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x10038a66
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100389c8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x29c], 0x1beba424
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100389b0
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100389e8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jg 0x10038a5d
mov dword [ebp - 0x18], 0x5c66b319
xor edx, edx
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x43c]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 3
sete dl
or ecx, 0xffffffff
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x29c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
neg ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0xf8c5
setne al
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14c], 0x1947684a
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jle 0x100389f3
xor eax, eax
dec dword [ebp - 0x24]
jns 0x100389a5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10038a88
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbc4], 0x624039b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10038a70
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10038a9d
push ebx
push 0x36
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10038ab0
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
or edx, 0xffffffff
mov ecx, 0x6f9b6917
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x38], 0x928c176b
mov dword [ebp - 0x3c], 0x7d50f82b
mov dword [ebp - 0x988], ecx
mov dword [ebp - 0x984], ecx
mov dword [ebp - 0x980], ecx
mov dword [ebp - 0x97c], ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x15
jl 0x10038b89
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x18], eax
je 0x10038b07
cmp dword [ebp - 0x18], ebx
jge 0x10038b07
mov eax, ebx
push 4
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setle cl
mov dword [ebp - 0x984], ecx
test ecx, ecx
je 0x10038b67
mov dword [ebp - 0x28], 0xd76270e7
mov eax, dword [ebp - 0x54]
sub eax, 0x3d3b
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10038b74
push 0x246f
push 0x9ae
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x10038b74
xor eax, eax
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x18], eax
jne 0x10038b84
inc dword [ebp - 0x40]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x15
push 0
pop eax
jge 0x10038aee
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], 0xf18ee85e
mov dword [ebp - 0x14], 0x51acae7b
mov dword [ebp - 0x20], 0xb903
mov dword [ebp - 0x2c], ebx
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10038bc7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c4], 0xf0ed
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10038baf
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10038be3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5a4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10038bcf
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10038bf5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfa8], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10038be8
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x1bc]
jge 0x10038cce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
jne 0x10038c24
mov edx, eax
cmp dword [ebp - 0x1c4], eax
je 0x10038c26
mov edx, ebx
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x5bed
test eax, eax
jne 0x10038c45
cmp dword [ebp - 0x1c4], eax
je 0x10038c4b
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c4]
sub edx, eax
mov dword [ebp - 0x5a0], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x1c4]
setle cl
cmp ecx, 0xe402095d
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
sub edx, 0x78c0
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c0]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0xfa4], ecx
cmp ecx, dword [ebp - 0x18]
jl 0x10038cce
mov eax, ebx
jmp 0x10038cd0
xor eax, eax
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c4]
cmp eax, 0x6f4e
setg cl
lea eax, [ecx + 0x50e1]
cmp eax, dword [ebp - 0x1c4]
jle 0x10038d3d
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10038d0b
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10038d4e
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x10038d36
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x5a4]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5a4], ecx
dec dword [ebp - 0x2c]
jns 0x10038d1b
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10038d13
jmp 0x10038d4e
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x10038d50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10038d6c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8bc], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10038d58
xor eax, eax
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x2c], esi
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
push 8
pop edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x60], 0x801fc3ee
mov dword [ebp - 0x44], 0xbef7d651
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x18], 0xf39c
mov dword [ebp - 0x20], 0xda8d
mov dword [ebp - 0x44], ecx
push 5
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 0xa93f0451
mov dword [ebp - 0x54], 0xb9d37639
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10038df1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x804], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10038ddd
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10038e10
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1014], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10038dfc
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x10038e29
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc80], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10038e18
dec dword [ebp - 0x3c]
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1010], ecx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x20]
cmp eax, ecx
jle 0x10038e4b
mov edi, ebx
jmp 0x10038e4f
xor eax, eax
mov edi, eax
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x10038e5f
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x804]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xc114
mov eax, dword [ebp - 0xc78]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x800]
imul esi, eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x61e33ecd
setle cl
xor edx, edx
sub esi, ecx
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp edi, esi
mov edi, 0xfffc
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0xc78], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100394fd
push 2
pop esi
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xfa942f34
mov dword [ebp - 0x28], 0x8227fd5d
push 6
pop ecx
mov dword [ebp - 0x44], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], esi
push 0xfffffffffffffff7
mov dword [ebp - 0x44], ebx
pop edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10038f19
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x88], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10038f05
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10039092
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x3c], 0xe86f
mov dword [ebp - 0x40], 0x1ee01e6e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10039089
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x14]
push 4
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x2e755073
pop eax
setne cl
cmp ecx, eax
mov eax, dword [ebp - 0x88]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
inc edx
je 0x10038f88
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
push 6
mov ecx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x88]
cmp eax, ecx
pop eax
setge dl
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
push 3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setge al
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
test eax, eax
mov dword [ebp - 0x88], eax
setne cl
xor eax, eax
cmp ecx, ebx
sete al
cmp eax, dword [ebp - 0x2c]
jne 0x10038ff3
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10038ff5
mov eax, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jne 0x10039038
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
sub edx, 0xf2a5cf69
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp + eax*4 - 0x88]
jg 0x10039038
xor eax, eax
mov ecx, eax
jmp 0x1003903a
mov ecx, ebx
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
push 0xffffffffffffffff
setge dl
sub edx, 0xc438
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x1532d49a
setne cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
pop ecx
setg al
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x20]
jns 0x10038f42
xor eax, eax
or ecx, ecx
dec dword [ebp - 0x14]
jns 0x10038f25
inc dword [ebp - 0x58]
push 3
mov dword [ebp - 0x20], 0x265ab3e9
pop edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], edx
jmp 0x100390f1
mov dword [ebp - 0x20], 0xa876e6ba
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
jmp 0x100390e3
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100390e0
push eax
push 0x1662
push 0xf39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jne 0x100390b6
cmp dword [ebp - 0x28], eax
jne 0x100390f7
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe9
jge 0x100390a7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100394f1
mov dword [ebp - 0x1c], 0xfffffffe
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0xc80fc3a0
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], ecx
push 4
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x1003913d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x338], 7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10039125
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10039297
mov dword [ebp - 0x30], esi
push 8
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0x77509cb0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10039188
mov dword [ebp - 0x38], 0x63ba
imul eax, dword [ebp - 0x30], 0x6de0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1003918a
mov eax, ebx
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x1c]
jge 0x100391ac
cmp dword [ebp - 0x30], eax
je 0x100391ac
mov eax, ebx
mov dword [ebp - 0x14], eax
xor eax, eax
push 3
mov dword [ebp - 0x30], eax
pop edx
jmp 0x1003928b
mov dword [ebp - 0x3c], 0x17b4
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x338], 0
je 0x10039260
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x338]
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x338]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x338]
cmp ecx, eax
setl dl
inc edx
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x24]
inc eax
imul ecx, eax
cmp edi, ecx
sbb eax, eax
neg eax
cmp eax, 0xa7412631
je 0x10039254
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10039256
mov eax, ebx
push 3
pop edx
dec eax
je 0x10039260
mov eax, ebx
jmp 0x10039262
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10039283
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x338]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x338], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1003926c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x100391bc
inc dword [ebp - 0x1c]
push 5
pop eax
cmp dword [ebp - 0x1c], eax
jne 0x10039145
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
neg ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
neg ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
sub eax, ecx
add eax, dword [ebp - 0x4c]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x4c]
sbb edx, edx
neg edx
sub edx, 0x1ab7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x4c]
jle 0x100393f8
mov dword [ebp - 0x30], 0xab67338d
mov dword [ebp - 0x3c], 0x2ac9e043
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x330], 0xfffffff9
mov eax, dword [ebp - 0x330]
xor eax, eax
cmp dword [ebp - 0x30], 0x3286b001
jne 0x10039352
cmp dword [ebp - 0x30], eax
je 0x10039352
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
sub edx, 0x9bbd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10039388
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x4c], 0xb76a
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100393c1
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x100393c3
mov ecx, ebx
xor eax, eax
cmp ecx, 0xba4bdaca
mov ecx, 0xaed54f57
sete al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x330], eax
jmp 0x100394d4
mov dword [ebp - 0x38], 0xe202
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0xb25d924
mov dword [ebp - 0x28], eax
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10039427
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xeb8], 0xfd707927
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10039416
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
push 6
setl dl
pop eax
cmp eax, edx
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setl bl
xor edx, edx
mov dword [ebp - 0x32c], ebx
mov eax, dword [ebp - 0x38]
cmp ebx, eax
mov eax, dword [ebp - 0x38]
sete dl
xor ecx, ecx
add edx, 0x6deeb808
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x3741
setle al
xor ebx, ebx
imul eax, dword [ebp - 0x1c]
imul eax, eax, 0x7f86
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xeb8], eax
imul eax, eax, 0x799b
inc ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp + eax*4 - 0x8bc], 0x624cdb8f
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], esi
jl 0x10039103
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10038ecd
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x28], 0x1649bc00
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10039531
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x398], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10039519
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop edi
cmp dword [ebp - 0x14], edi
jge 0x10039554
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1024], 0xbbf9acf2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003953c
xor eax, eax
cmp dword [ebp - 0x394], eax
je 0x10039562
mov eax, dword [ebp - 0x390]
mov eax, dword [ebp - 0x398]
xor ecx, ecx
mov dword [ebp - 0x1020], ebx
mov eax, dword [ebp - 0x390]
cmp eax, 0xfffffff6
push 2
setl cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x398]
cmp eax, ecx
mov eax, dword [ebp - 0x394]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffd
pop edx
setg cl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, ebx
sbb eax, eax
neg eax
sub ecx, eax
xor eax, eax
cmp ecx, 0xa6ff
mov ecx, 0x77ab3921
setl al
or esi, 0xffffffff
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x398]
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x28], 0x9ec0021f
xor eax, eax
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1003960c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x81c], 0x8bbca631
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100395f4
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003963b
mov dword [ebp - 0x20], 0x265ab3e9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10039638
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x81c], 0x624cdb8f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10039620
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10039611
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10039669
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8cc], 0x8bbca631
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039651
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10039698
mov dword [ebp - 0x20], 0x265ab3e9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10039695
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8cc], 0x624cdb8f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003967d
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003966e
mov dword [ebp - 0x8cc], ecx
mov esi, 0x4c46983c
push 5
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0xa58], esi
mov dword [ebp - 0xa54], esi
mov dword [ebp - 0xa50], esi
mov dword [ebp - 0xa4c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100396e6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70c], 0xa8eac8b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100396ce
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10039706
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x488], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100396ee
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10039726
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], 0x8e85a7b0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003970e
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_GetDIBits]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
pop ecx
mov dword [ebp - 0x47c], ecx
cmp dword [ebp - 0x47c], eax
jl 0x100398d7
push 6
pop esi
jmp 0x1003974e
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x3c], 0x9fe57f6c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x1003977f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc8], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039767
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x100398b9
jmp 0x1003978f
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x44], 0x56e74e80
inc ecx
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x20], 0x7ef2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100397d0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbd4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100397b8
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x100397f7
push 0x2421
push eax
push eax
push 0x18e1
push 0x20a3
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x47c]
mov eax, dword [ebp + eax*4 - 0x70c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xcc4], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp eax, ecx
jge 0x1003985c
mov eax, dword [ebp - 0x47c]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x70c]
mov eax, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x70c]
cmp eax, edx
mov eax, 0x694a2199
setne cl
cmp ecx, 0xfffa
sbb ecx, ecx
neg ecx
sub eax, ecx
mov dword [ebp - 0xa54], eax
je 0x1003985c
xor eax, eax
mov ecx, eax
jmp 0x10039861
xor esi, esi
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, 0x56bf5ee8
mov eax, dword [ebp + eax*4 - 0x70c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x47c]
setl cl
mov dword [ebp + eax*4 - 0x70c], ecx
lea eax, [ecx - 0x34219488]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x38]
jns 0x1003978d
push 2
pop edx
push 3
pop ecx
push 6
pop esi
mov eax, dword [ebp - 0x47c]
mov eax, dword [ebp + eax*4 - 0x70c]
dec dword [ebp - 0x47c]
jns 0x1003974c
mov esi, 0x4c46983c
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0xcd8], eax
push 5
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x9b8], esi
mov dword [ebp - 0x9b4], esi
mov dword [ebp - 0x9b0], esi
mov dword [ebp - 0x9ac], esi
push 4
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10039926
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x76c], 0xa8eac8b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003990e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10039946
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x498], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003992e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10039966
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd00], 0x8e85a7b0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003994e
xor eax, eax
mov dword [ebp - 0x48c], ecx
cmp dword [ebp - 0x48c], eax
jl 0x10039b00
push 6
pop esi
jmp 0x1003997f
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x3c], 0x9fe57f6c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x100399b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcf0], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039998
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x10039ae7
xor esi, esi
inc esi
jmp 0x100399c3
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x56e74e80
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x20], 0x7ef2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10039a01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbe4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100399e9
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10039a28
push 0x2421
push eax
push eax
push 0x18e1
push 0x20a3
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x48c]
mov eax, dword [ebp + eax*4 - 0x76c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xcec], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp eax, ecx
jge 0x10039a8d
mov eax, dword [ebp - 0x48c]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x76c]
mov eax, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x76c]
cmp eax, edx
mov eax, 0x694a2199
setne cl
cmp ecx, 0xfffa
sbb ecx, ecx
neg ecx
sub eax, ecx
mov dword [ebp - 0x9b4], eax
je 0x10039a8d
xor eax, eax
mov ecx, eax
jmp 0x10039a8f
mov ecx, esi
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, 0x56bf5ee8
mov eax, dword [ebp + eax*4 - 0x76c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x48c]
setl cl
mov dword [ebp + eax*4 - 0x76c], ecx
lea eax, [ecx - 0x34219488]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x38]
jns 0x100399c1
push 2
pop edx
push 3
pop ecx
push 6
pop esi
mov eax, dword [ebp - 0x48c]
mov eax, dword [ebp + eax*4 - 0x76c]
dec dword [ebp - 0x48c]
jns 0x1003997d
mov eax, dword [ebp - 0x48c]
xor ecx, ecx
mov dword [ebp - 0xcfc], eax
inc ecx
mov dword [ebp - 0x24], 0x2b1c
xor eax, eax
mov dword [ebp - 0x14], 0x9d81479b
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10039b46
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe8], 0x145c1747
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10039b2e
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10039b5c
push 0xf67
call esi
mov eax, dword [ebp - 0x24]
sub eax, 0x89a5
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
sub edx, 0x8f69f7fd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp dword [ebp - 0x24], ecx
jne 0x10039d20
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], eax
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0x2b1c
mov dword [ebp - 0x14], 0x9d81479b
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10039bfe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe4], 0x145c1747
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039be6
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10039c0e
push 0xf67
call esi
mov eax, dword [ebp - 0x24]
sub eax, 0x89a5
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
sub edx, 0x8f69f7fd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp dword [ebp - 0x24], ecx
jne 0x10039d9f
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe4], eax
xor eax, eax
xor edx, edx
inc edx
push 5
pop ecx
mov dword [ebp - 0x44], ecx
mov esi, 0x4c46983c
mov dword [ebp - 0xab8], esi
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xaac], esi
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10039cc1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74c], 0xa8eac8b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10039ca9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10039ce1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4d0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10039cc9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10039d03
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd20], 0x8e85a7b0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10039cea
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x4c4], ecx
cmp dword [ebp - 0x4c4], eax
jl 0x10039fab
push 6
pop esi
jmp 0x10039e23
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x10039bc6
xor edx, edx
inc edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10039d50
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6ec], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039d3c
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10039d92
mov dword [ebp - 0x4c], eax
jmp 0x10039d79
mov ecx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xe8], ecx
mov dword [ebp - 0x6ec], edx
inc dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
jle 0x10039d5d
mov eax, dword [ebp + eax*4 - 0xe8]
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x10039d58
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10039d31
jmp 0x10039bc9
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x10039c78
xor edx, edx
inc edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10039dcf
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x644], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039dbb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10039e11
mov dword [ebp - 0x4c], eax
jmp 0x10039df8
mov ecx, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xe4], ecx
mov dword [ebp - 0x644], edx
inc dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
jle 0x10039ddc
mov eax, dword [ebp + eax*4 - 0xe4]
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x10039dd7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10039db0
jmp 0x10039c7b
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x3c], 0x9fe57f6c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10039e56
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd10], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10039e3d
xor eax, eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x10039f8d
jmp 0x10039e69
xor edx, edx
xor eax, eax
inc edx
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x56e74e80
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x20], 0x7ef2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10039ea7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbf4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10039e8f
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x10039ece
push 0x2421
push eax
push eax
push 0x18e1
push 0x20a3
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp + eax*4 - 0x74c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xd0c], ecx
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp eax, ecx
jge 0x10039f33
mov eax, dword [ebp - 0x4c4]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x74c]
mov eax, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x74c]
cmp eax, edx
mov eax, 0x694a2199
setne cl
cmp ecx, 0xfffa
sbb ecx, ecx
neg ecx
sub eax, ecx
mov dword [ebp - 0xab4], eax
je 0x10039f33
xor eax, eax
mov ecx, eax
jmp 0x10039f38
xor esi, esi
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, 0x56bf5ee8
mov eax, dword [ebp + eax*4 - 0x74c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x4c4]
setl cl
mov dword [ebp + eax*4 - 0x74c], ecx
lea eax, [ecx - 0x34219488]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x38]
jns 0x10039e64
push 3
pop ecx
push 6
pop esi
mov eax, dword [ebp - 0x4c4]
mov eax, dword [ebp + eax*4 - 0x74c]
dec dword [ebp - 0x4c4]
jns 0x10039e1e
mov esi, 0x4c46983c
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xd1c], eax
xor eax, eax
mov dword [ebp - 0x28], 0x13638ecf
mov dword [ebp - 0x18], eax
jmp 0x10039fd6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf60], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10039fc5
mov eax, dword [ebp - 0xf5c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003a00e
push 0x20e2
push 0x504
push 0x5a1
push 0x23c5
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x20], 0x20002526
mov dword [ebp - 0x38], 0xac9d73df
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xf0a0cd95
mov dword [ebp - 0x3c], 0x974498b9
mov dword [ebp - 0x3c], 0x83518f4c
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1003a05e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xed0], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003a046
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003a074
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfd8], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003a063
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xed0], ecx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
push 3
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xe9a5
setg al
xor ecx, ecx
add eax, 0x5c9b
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
neg eax
sbb eax, eax
or edx, 0xffffffff
inc eax
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xfd0], eax
add eax, 0xfffffff8
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x81ff29ac
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1003a15c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb58], 0x334
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003a144
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1003a1fc
xor esi, esi
inc esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x1003a1ee
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], eax
jmp 0x1003a19b
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003a198
push 0xd3a
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1003a181
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x1003a1e3
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xb58]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb58], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1003a1d6
mov dword [ebp - 0x28], 0x84bc9c3d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jl 0x1003a1c6
dec dword [ebp - 0x14]
jns 0x1003a1a8
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1003a179
or edx, 0xffffffff
dec dword [ebp - 0x2c]
jns 0x1003a16e
mov esi, 0x4c46983c
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003a212
push 0x391
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0xefa42b48
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0xa519d814
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xeaa29c14
setne cl
mov dword [ebp - 0x14], ecx
mov ecx, 0xffffdac6
mov eax, dword [ebp - 0x20]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x14]
je 0x1003a25c
cmp dword [ebp - 0x14], eax
je 0x1003a25c
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1003a25f
xor ebx, ebx
inc ebx
cmp eax, 0xfffffff8
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14], eax
je 0x1003a280
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x4688d239
setge cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
add eax, 0xfffd
inc ecx
xor edx, edx
cmp ecx, eax
setg dl
cmp edx, 2
jb 0x1003a312
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x1003a2f2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd38], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1003a2da
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003a301
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0xd34], 0x280563ad
xor eax, eax
jmp 0x1003a3d8
or eax, 0xffffffff
mov dword [ebp - 0x28], 0x3e87122a
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1003a33b
push eax
push 0x261e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1003a34f
mov dword [ebp - 0x3c], 0xeda1
dec dword [ebp - 0x3c]
jmp 0x1003a3d5
push 4
mov dword [ebp - 0x3c], 0x108a6652
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1003a36f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9d8], 0x7d63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003a35e
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x9d8]
neg esi
mov eax, dword [ebp - 0x9d8]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [ebp - 0x9d8]
setne dl
xor ebx, ebx
cmp esi, edx
sete bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
je 0x1003a3b1
mov eax, dword [ebp - 0x54]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
mov esi, 0x4c46983c
mov eax, dword [ebp - 0x9cc]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
inc ebx
push 2
pop edi
push 5
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], 0xcbcef054
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003a40c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf0], 0x1ab4456e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003a3f4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1003a42c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f4], 0x45b0e82c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003a414
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003a44f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x470], 0x8a92
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003a437
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1003a461
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3fc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003a454
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1f0]
or edx, 0xffffffff
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0xf0], ecx
mov eax, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f0]
inc dword [ebp - 0x470]
mov eax, dword [ebp - 0x470]
imul ecx, eax, 0x85b3
mov eax, dword [ebp - 0x1f0]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1f0], eax
jl 0x1003a4d5
xor eax, eax
cmp dword [ebp - 0x470], eax
je 0x1003a4d7
mov ecx, ebx
jmp 0x1003a4d9
xor eax, eax
mov ecx, eax
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
sete al
cmp eax, 0xe629bad2
jbe 0x1003a787
xor eax, eax
cmp dword [ebp - 0x468], eax
jne 0x1003a789
mov dword [ebp - 0x40], 0x55a6
mov dword [ebp - 0x28], 0xa4a7b592
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1003a52d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1004], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003a515
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1003a54f
push 6
pop edx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xee8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003a53b
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003a596
dec dword [ebp - 0x3fc]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0xf0]
imul eax, eax, 5
cmp eax, 0x794679f
setne cl
cmp ecx, 0x40e302f9
je 0x1003a57f
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1003a581
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0xee8]
cmp ecx, eax
push 3
setg dl
xor eax, eax
cmp edx, 0x1d3
setl al
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x20], ebx
pop ebx
mov dword [ebp - 0x9f8], esi
xor eax, eax
mov dword [ebp - 0x9f4], esi
mov dword [ebp - 0x9f0], esi
mov dword [ebp - 0x9ec], esi
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
cmp dword [ebp - 0x14], esi
jge 0x1003a5f9
push 5
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc04], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003a5e5
xor eax, eax
push 4
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x1003a618
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x904], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003a604
xor eax, eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], eax
jg 0x1003a675
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003a64c
push eax
push 0x1824
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1003a664
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
inc dword [ebp - 0x8fc]
cmp dword [ebp - 0x8fc], eax
jle 0x1003a626
push 4
pop edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1003a695
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x71c], 0xa8eac8b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003a67d
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1003a6bb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x918], 0x7117
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003a6a3
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1003a728
mov dword [ebp - 0x28], 0x6ee4e912
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x918]
test eax, eax
mov eax, dword [ebp - 0x14]
setne dl
mov eax, dword [ebp + eax*4 - 0x918]
sub edx, eax
mov eax, dword [ebp - 0x14]
sub edx, 0xa4d63a88
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
test eax, eax
setns cl
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x918]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
jns 0x1003a6c3
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x1003a748
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4e8], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003a730
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1003a77f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 0xce55459e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003a767
mov dword [ebp - 0x14], eax
jmp 0x1003a826
xor eax, eax
cmp dword [ebp - 0x468], eax
je 0x1003a4fc
cmp dword [ebp - 0xf0], eax
je 0x1003a4fc
mov dword [ebp - 0x18], eax
push 3
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1003a7c0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003a7af
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x18]
test eax, eax
jne 0x1003a7f2
imul eax, dword [ebp - 0xf0], 0x9320
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xdbc]
mov ecx, dword [ebp - 0xdbc]
mov eax, dword [ebp - 0x1f0]
cmp eax, ecx
setne dl
mov dword [ebp - 0xf0], edx
jmp 0x1003a5bd