Function at 0x1003146e
Capabilities:
Compare security identifiers
Connect pipe
Contain obfuscated stackstrings
Delete registry value
Get common file path
Get session user name
Parse pe header
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
mov eax, 0x10088678
call fcn.100870dc
mov eax, 0x1784
call fcn.10084610
mov dword [ebp - 0x30], 0x23ed15d
xor eax, eax
mov dword [ebp - 0x34], 0xf90a
mov dword [ebp - 0x48], 0x5ea2
push ebx
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x58], eax
inc esi
mov dword [ebp - 0x4c], 2
push edi
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x14], eax
jmp 0x100314c8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc8], 0xb8fa48a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100314b7
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x100314d8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0xdb75
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
push esi
setl dl
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x30], 0xc9fb37b0
mov dword [ebp - 0x30], 0xa7bc6c89
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], eax
push 3
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x10031538
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x160], 0xe1757117
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031520
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1003155e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x4d0]
call fcn.10016cc8
mov dword [eax], 0xf1eb7e59
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10031540
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x158], 0x1b
cmp dword [ebp - 0x158], 0x11
jle 0x1003176e
jmp 0x1003157f
xor eax, eax
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
jmp 0x100315a2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3b0], 0x82b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031591
mov eax, dword [ebp - 0x158]
xor ecx, ecx
cmp eax, 0x4bb4
setg cl
imul eax, ecx, 3
test eax, eax
je 0x100315cc
xor eax, eax
cmp dword [ebp - 0x15c], eax
je 0x100315ce
mov eax, esi
jmp 0x100315ce
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x15c], esi
mov eax, dword [ebp - 0x158]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0xba5616d2
sbb eax, eax
xor edx, edx
neg eax
lea ecx, [eax - 0x7f3c88fe]
mov eax, dword [ebp - 0x3b0]
cmp ecx, eax
mov eax, dword [ebp - 0x158]
lea ecx, [ebp - 0x4d0]
setle dl
xor ebx, ebx
cmp edx, eax
setle bl
xor eax, eax
push eax
call fcn.10016cc8
mov dword [eax], ebx
mov eax, dword [ebp - 0x3b0]
add eax, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x15c]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, 0xd476
jne 0x10031651
xor eax, eax
cmp dword [ebp - 0x158], eax
je 0x10031653
mov eax, esi
imul ecx, eax, 0x43c6
xor edx, edx
mov eax, dword [ebp - 0x158]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x4c01e07a
setg al
cmp eax, 0xccce
jge 0x10031897
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 0x8f8], eax
mov dword [ebp - 0x8f4], eax
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x14], 0x23a55a41
mov ecx, dword [ebp - 0x8fc]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x4d0]
setl dl
xor eax, eax
mov dword [ebp - 0x2c], edx
push eax
call fcn.10016cc8
mov edx, dword [ebp - 0x8fc]
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x4d0]
setne al
xor ebx, ebx
sub eax, dword [esi]
cmp eax, 0x4c99
setg bl
xor eax, eax
push eax
call fcn.10016cc8
xor ecx, ecx
cmp dword [eax], ebx
setne cl
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x18]
sub esi, ecx
lea ecx, [ebp - 0x4d0]
sub esi, eax
mov eax, dword [ebp - 0x30]
add esi, eax
xor eax, eax
push eax
call fcn.10016cc8
imul edx, esi, 0x2cc
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xfffffff7
cmp dword [ebp - 0x14], 0x13
jne 0x10031755
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003174c
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x1003173b
xor esi, esi
inc esi
dec dword [ebp - 0x158]
cmp dword [ebp - 0x158], 0x11
jg 0x1003157d
push 3
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10016cc3
mov dword [ebp - 0x2c], 0xffffffff
xor ecx, ecx
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x849b76ee
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x368]
add edx, dword [ebp - 0x370]
mov eax, dword [ebp - 0x368]
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x36c]
cmp ecx, eax
setle dl
imul eax, dword [ebp - 0x368], 0x5416
mov ecx, dword [ebp - 0x36c]
add eax, 0x3051
add eax, edx
imul ecx, eax
xor eax, eax
mov dword [ebp - 0x368], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003181a
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x2c], 0xba4d3ec9
mov dword [ebp - 0x30], 0x333ee676
mov dword [ebp - 0x38], 0xac789480
mov dword [ebp - 0x38], 0xa12b57e8
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10031863
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1738], 0x19ac196a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003184b
xor eax, eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jle 0x10031a5d
mov dword [ebp - 0x20], 0xac204e2
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xa6c65b0b
mov dword [ebp - 0x48], 0xe7bf
mov dword [ebp - 0x20], eax
jmp 0x100318f9
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100318ab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10031758
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x10031758
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100318f6
push 0x1d0
push 0x1fa7
push 0x2516
push 0xee2
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x100318c7
cmp dword [ebp - 0x20], eax
jne 0x10031969
mov eax, dword [ebp - 0x18]
xor edx, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x361a6b71
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xae7
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
add ecx, 0x4e5062a
jne 0x1003195c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1003195e
mov ecx, esi
mov eax, dword [ebp - 0x20]
add eax, ecx
jne 0x10031969
mov ecx, eax
jmp 0x1003196b
mov ecx, esi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x30]
jne 0x10031998
mov ecx, esi
cmp dword [ebp - 0x20], eax
jne 0x1003199a
mov ecx, eax
mov eax, dword [ebp - 0x48]
xor edx, edx
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x3672d714
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x93876a47
mov dword [ebp - 0x34], 0x56e623b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x10031a22
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10031a24
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x10031a3e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10031a40
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
pop eax
jg 0x10031873
mov dword [ebp - 0x14], 0xfffffff9
mov ebx, 0xc9fb37b0
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xba4d3ec9
mov dword [ebp - 0x30], 0x333ee676
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jle 0x10031b47
mov dword [ebp - 0x1c], 0x3672d714
xor edx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x93876a47
mov dword [ebp - 0x34], 0x56e623b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x10031b0c
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10031b0e
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x10031b28
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10031b2a
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
pop eax
jg 0x10031a8e
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xba4d3ec9
mov dword [ebp - 0x30], 0x333ee676
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jle 0x10031c2c
mov dword [ebp - 0x1c], 0x3672d714
xor edx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x93876a47
mov dword [ebp - 0x34], 0x56e623b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x10031bf1
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10031bf3
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x10031c0d
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10031c0f
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
pop eax
jg 0x10031b73
mov dword [ebp - 0x14], 0x40d7f825
mov dword [ebp - 0x48], 0x2314af12
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x30], 0x86992f1e
mov dword [ebp - 0x28], 0xfff9
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x58], 0xaacc
mov dword [ebp - 0x14], 0xfffffffd
jmp 0x10031d7b
mov dword [ebp - 0x24], 0xd05ba772
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe6
jle 0x10031d27
mov dword [ebp - 0x44], 0xc2184e5a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10031cb9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x660], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10031ca1
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10031d08
cmp dword [ebp - 0x14], eax
je 0x10031cfc
dec dword [ebp - 0x30]
je 0x10031cf3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0xffffffff
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x660]
mov eax, dword [ebp - 0x24]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10031d0a
mov edx, esi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
push 0
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
pop eax
jg 0x10031c92
cmp dword [ebp - 0x14], eax
jne 0x10031d33
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x10031d35
mov edx, esi
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, 0x8bb6
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp eax, ecx
push 0
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jl 0x10031c70
mov dword [ebp - 0x44], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x30], 0x23ed15d
mov dword [ebp - 0x34], 0xf90a
mov dword [ebp - 0x48], 0x5ea2
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x58], eax
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], eax
jmp 0x10031dc5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfd8], 0xb8fa48a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031db4
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x10031dd5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0xdb75
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
push esi
setl dl
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xa7bc6c89
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], esi
push 3
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x10031e2a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x13c], 0xe1757117
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10031e12
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10031e50
push dword [ebp - 0x24]
lea ecx, [ebp - 0x560]
call fcn.10016cc8
mov dword [eax], 0xf1eb7e59
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10031e32
xor eax, eax
mov dword [ebp - 0x134], 0x1b
cmp dword [ebp - 0x134], 0x11
jle 0x1003205a
jmp 0x10031e6b
xor eax, eax
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
jmp 0x10031e8e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x308], 0x82b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031e7d
mov eax, dword [ebp - 0x134]
xor ecx, ecx
cmp eax, 0x4bb4
setg cl
imul eax, ecx, 3
test eax, eax
je 0x10031eb8
xor eax, eax
cmp dword [ebp - 0x138], eax
je 0x10031eba
mov eax, esi
jmp 0x10031eba
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x138], esi
mov eax, dword [ebp - 0x134]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0xba5616d2
sbb eax, eax
xor edx, edx
neg eax
lea ecx, [eax - 0x7f3c88fe]
mov eax, dword [ebp - 0x308]
cmp ecx, eax
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x560]
setle dl
xor ebx, ebx
cmp edx, eax
setle bl
xor eax, eax
push eax
call fcn.10016cc8
mov dword [eax], ebx
mov eax, dword [ebp - 0x308]
add eax, ebx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, 0xd476
jne 0x10031f3d
xor eax, eax
cmp dword [ebp - 0x134], eax
je 0x10031f3f
mov eax, esi
imul ecx, eax, 0x43c6
xor edx, edx
mov eax, dword [ebp - 0x134]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x4c01e07a
setg al
cmp eax, 0xccce
jge 0x10032161
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x914], eax
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x14], 0x23a55a41
mov ecx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x560]
setl dl
xor eax, eax
mov dword [ebp - 0x2c], edx
push eax
call fcn.10016cc8
mov edx, dword [ebp - 0x914]
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x560]
setne al
xor ebx, ebx
sub eax, dword [esi]
cmp eax, 0x4c99
setg bl
xor eax, eax
push eax
call fcn.10016cc8
xor ecx, ecx
cmp dword [eax], ebx
setne cl
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x18]
sub esi, ecx
lea ecx, [ebp - 0x560]
sub esi, eax
mov eax, dword [ebp - 0x30]
add esi, eax
xor eax, eax
push eax
call fcn.10016cc8
imul edx, esi, 0x2cc
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xfffffff7
cmp dword [ebp - 0x14], 0x13
jne 0x10032041
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032038
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
je 0x10032027
xor esi, esi
inc esi
dec dword [ebp - 0x134]
cmp dword [ebp - 0x134], 0x11
jg 0x10031e69
push 3
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.10016cc3
mov dword [ebp - 0x2c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x2c], 0xba4d3ec9
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x849b76ee
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x37c]
add edx, dword [ebp - 0x384]
mov eax, dword [ebp - 0x37c]
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x380]
cmp ecx, eax
setle dl
imul eax, dword [ebp - 0x37c], 0x5416
mov ecx, dword [ebp - 0x380]
add eax, 0x3051
add eax, edx
imul ecx, eax
xor eax, eax
mov dword [ebp - 0x37c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003210d
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x30], 0x333ee676
mov dword [ebp - 0x38], 0xac789480
mov dword [ebp - 0x38], 0xa12b57e8
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003214f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1654], 0x19ac196a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10032137
xor eax, eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jle 0x10032bd1
jmp 0x10032193
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032175
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032044
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x10032044
xor eax, eax
mov dword [ebp - 0x20], 0xac204e2
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xa6c65b0b
mov dword [ebp - 0x48], 0xe7bf
mov dword [ebp - 0x20], eax
jmp 0x100321e9
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100321e6
push 0x1d0
push 0x1fa7
push 0x2516
push 0xee2
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x100321b7
cmp dword [ebp - 0x20], eax
jne 0x10032259
mov eax, dword [ebp - 0x18]
xor edx, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x361a6b71
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0xae7
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
add ecx, 0x4e5062a
jne 0x1003224c
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x1003224e
mov ecx, esi
mov eax, dword [ebp - 0x20]
add eax, ecx
jne 0x10032259
mov ecx, eax
jmp 0x1003225b
mov ecx, esi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x30]
jne 0x10032288
mov ecx, esi
cmp dword [ebp - 0x20], eax
jne 0x1003228a
mov ecx, eax
mov eax, dword [ebp - 0x48]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, 0x3b26bdde
mov dword [ebp - 0x28], 0x3672d714
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x38], 0x4bb9cec0
mov dword [ebp - 0x14], 0xfaa058a1
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x30], 0x8404d083
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x18], 0x18e2bb11
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xfffffffb
jl 0x1003247a
push 2
pop ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1003232c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x105c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10032318
xor eax, eax
cmp dword [ebp - 0xa8], eax
jne 0x10032396
mov eax, dword [ebp - 0xa8]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10032386
cmp dword [ebp - 0xa8], eax
jne 0x10032355
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
xor eax, eax
cmp dword [ebp - 0x18], 0xa9b8
jne 0x10032376
cmp dword [ebp - 0xac], eax
je 0x10032376
mov eax, esi
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10032384
mov ecx, esi
jmp 0x10032388
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xa8]
add eax, ecx
jne 0x10032396
mov ecx, eax
jmp 0x10032398
mov ecx, esi
mov eax, dword [ebp - 0xa0]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
sete dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xa8]
cmp edx, eax
setne cl
cmp ecx, 0x35a12a2e
jle 0x100323cd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x105c], eax
test eax, eax
je 0x10032447
push 3
pop eax
push eax
lea ecx, [ebp - 0x730]
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], ebx
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1003241c
push ecx
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x730]
call fcn.10016cc8
mov dword [eax], 0xfffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100323fb
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x730]
call fcn.10016cc8
lea ecx, [ebp - 0x730]
cmp dword [eax], 0
jne 0x10032471
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
call fcn.10016cc3
jmp 0x1003245b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003245b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
dec dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffffb
jl 0x1003247a
xor eax, eax
jmp 0x10032306
or dword [ebp - 4], 0xffffffff
call fcn.10016cc3
mov eax, dword [ebp - 0x40]
mov edx, 0xb6fa
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x14]
sub edx, eax
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor eax, eax
test ecx, ecx
setns al
cmp eax, dword [ebp - 0xa0]
jl 0x100324d8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xac]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0xac]
cmp eax, 0xd624
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
mov byte [ebp - 0x39], al
jge 0x10032553
cmp byte [ebp - 0x39], al
je 0x10032564
push eax
push 0x1cc9
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x10032562
cmp byte [ebp - 0x39], al
je 0x10032562
push eax
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10032590
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1588], 0xeb0647dc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10032577
xor eax, eax
mov dword [ebp - 0x1584], 0xca631852
mov dword [ebp - 0x14], 0xffffffef
jmp 0x100325cc
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100325c9
push eax
push 0xb5d
push 0xf5e
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jg 0x100325a3
lea eax, [ebp - 0x1140]
mov dword [ebp - 0x30], 0x93876a47
push eax
lea eax, [ebp - 0x1150]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1518]
movdqu xmmword [ebp - 0x1150], xmm0
call fcn.10016cd7
lea ecx, [ebp - 0x1cc]
mov esi, eax
call fcn.100094d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1f4]
push dword [esi]
call fcn.10016c9d
push 3
pop ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1f4]
xor eax, eax
mov dword [ebp - 0x34], 0x83648bd9
mov dword [ebp - 0x20], 0x28de637c
push eax
mov dword [ebp - 0x38], 0xd13d8c53
call fcn.10016cc8
lea ecx, [ebp - 0x1f4]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10016cc8
cmp dword [eax], 6
jl 0x1003291c
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0x37bb0086
push 3
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0xf989b1ab
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x1c], eax
jmp 0x1003269d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x224], 0x348cc383
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003268c
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1f4]
mov eax, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor eax, eax
neg esi
dec dword [ebp - 0x14]
push eax
call fcn.10016cc8
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0xffffffff
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp eax, ebx
lea eax, [esi + 1]
setge cl
imul ecx, eax
cmp ecx, dword [ebp - 0x40]
lea ecx, [ebp - 0x1f4]
je 0x10032822
push 2
pop eax
mov dword [ebp - 0x18], 0x2a6ca0ce
mov dword [ebp - 0x1c], 0xfffffffb
push eax
call fcn.10016cc8
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10032711
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
xor edx, edx
add eax, 0xda91
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x2c]
je 0x10032733
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x1f4]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10016cc8
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jg 0x1003275a
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x1003275c
mov esi, ebx
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.10016cc8
xor edx, edx
lea ecx, [esi - 1]
cmp ecx, dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
setge dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, 0xf9eb
setg cl
cmp ecx, edx
jl 0x100327a3
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x224], eax
je 0x100327a5
mov ecx, ebx
mov eax, dword [ebp - 0x224]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0xfffffffb
jmp 0x1003281a
mov dword [ebp - 0x1c], 0xffffffea
cmp dword [ebp - 0x1c], 0x26
jne 0x10032817
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jg 0x1003280e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100327f1
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x224], ecx
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], esi
jle 0x100327e2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x26
je 0x100327da
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jge 0x100327c8
jmp 0x10032833
push 3
pop eax
push eax
call fcn.10016cc8
xor ebx, ebx
inc ebx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
push 2
pop ecx
mov dword [ebp - 0x40], ecx
xor eax, eax
cmp dword [ebp - 0x40], eax
jl 0x100328f4
mov dword [ebp - 0x14], eax
jmp 0x1003285a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1070], 0x49123d22
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10032849
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1f4]
mov eax, dword [ebp + eax*4 - 0x224]
mov dword [ebp - 0x18], 0xa2eedf21
xor eax, eax
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1070], esi
push eax
call fcn.10016cc8
mov ecx, dword [ebp - 0x40]
push 3
mov edx, dword [ebp + ecx*4 - 0x224]
mov ecx, dword [ebp - 0x40]
imul edx, dword [ebp + ecx*4 - 0x224]
xor ecx, ecx
cmp edx, dword [eax]
pop eax
setl cl
cmp eax, ecx
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
neg ecx
mov eax, dword [ebp + eax*4 - 0x224]
sub eax, ecx
sub eax, esi
je 0x100328cd
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x224], 0
je 0x100328cd
mov edx, ebx
jmp 0x100328d1
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x224]
cmp edx, eax
pop eax
sete cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x40]
push 2
pop ecx
jns 0x10032844
push eax
lea ecx, [ebp - 0x1f4]
call fcn.10016cc8
lea ecx, [ebp - 0x1f4]
inc dword [eax]
xor eax, eax
push eax
call fcn.10016cc8
cmp dword [eax], 6
jge 0x10032661
push 3
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f4]
call fcn.10016cc3
xor esi, esi
mov dword [ebp - 0x34], 0x56e623b2
inc esi
lea ecx, [ebp - 0xb6c]
push esi
call fcn.10016c3e
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xb54]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], 0xd2038e85
mov dword [ebp - 0x34], 0x7f3e76e5
push esi
call fcn.10016c3e
push esi
lea ecx, [ebp - 0x838]
mov byte [ebp - 4], 5
call fcn.10016c3e
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100329a3
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb6c]
call fcn.10016cc8
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032985
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100329c3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xebc], 0x90e86489
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100329ab
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100329e6
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb54]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100329cb
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10032a06
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x618], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100329ee
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10032a29
push dword [ebp - 0x20]
lea ecx, [ebp - 0x838]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032a0e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10032a49
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xda8], 9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10032a31
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10032a6b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1210], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10032a52
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10032a8f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10032a8a
push 0x1cd
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10032a73
mov eax, dword [ebp - 0xeb4]
xor ecx, ecx
cmp ecx, eax
lea ecx, [ebp - 0x838]
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x120c]
mov eax, dword [ebp - 0xeb4]
xor eax, eax
push eax
call fcn.10016cc8
mov eax, dword [ebp - 0xda4]
lea ecx, [ebp - 0x838]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10016cc8
mov eax, dword [ebp - 0xda8]
lea ecx, [ebp - 0xb54]
xor eax, eax
push eax
call fcn.10016cc8
lea ecx, [ebp - 0xb6c]
mov dword [eax], 0xefe0
xor eax, eax
push eax
call fcn.10016cc8
xor ecx, ecx
cmp dword [eax], ecx
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x838]
call fcn.10016cc3
lea ecx, [ebp - 0xb54]
call fcn.10016cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb6c]
call fcn.10016cc3
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x10032b99
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10032b9b
mov ecx, esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ecx
jg 0x10032bb5
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10032bb7
mov edx, esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jg 0x10032191
push 7
pop edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x3f0]
push ebx
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10032c0b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f0]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10032bf0
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
mov edi, dword [sym.imp.USER32.dll_GetScrollInfo]
je 0x10032db6
push 2
pop eax
jmp 0x10032c2b
xor esi, esi
inc esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x56a218f0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x10032c46
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push esi
lea ecx, [ebp - 0x3f0]
call fcn.10016cc8
xor esi, esi
cmp dword [eax], esi
je 0x10032e72
xor eax, eax
mov dword [ebp - 0x34], 0x4cd021aa
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032c7b
push eax
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032d9c
movdqa xmm0, xmmword [0x100083b0]
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x1170]
push eax
lea ecx, [ebp - 0x15f0]
movdqu xmmword [ebp - 0x1170], xmm0
call fcn.10016cd7
lea ecx, [ebp - 0x1e5]
mov esi, eax
call fcn.100094d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x4e8]
push dword [esi]
call fcn.10016c9d
xor eax, eax
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10016cc8
and dword [eax], 0
jmp 0x10032d73
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x10032cff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1344], 0xffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10032cee
xor esi, esi
lea ecx, [ebp - 0x3f0]
inc esi
push esi
call fcn.10016cc8
mov ecx, esi
sub ecx, dword [eax]
je 0x10032d2b
mov eax, dword [ebp - 0x1344]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
je 0x10032d2b
xor eax, eax
jmp 0x10032d2f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10016cc8
xor ecx, ecx
cmp esi, dword [eax]
sete cl
sub ecx, 0x30fc
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032d65
push 0x60c
push eax
push eax
call ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10016cc8
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4e8]
push eax
call fcn.10016cc8
cmp dword [eax], 0xf
jne 0x10032ce4
lea ecx, [ebp - 0x4e8]
mov byte [ebp - 4], 7
call fcn.10016cc3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 8
jne 0x10032c83
push 2
pop eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
jne 0x10032c28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f0]
call fcn.10016cc3
push 3
pop esi
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x414]
push esi
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], 9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10032e07
push dword [ebp - 0x28]
lea ecx, [ebp - 0x414]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10032dec
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
je 0x10032ff6
push 2
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x56a218f0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x10032e32
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
lea ecx, [ebp - 0x414]
inc eax
push eax
call fcn.10016cc8
xor esi, esi
cmp dword [eax], esi
je 0x10033151
xor eax, eax
mov dword [ebp - 0x34], 0x4cd021aa
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032e6a
push eax
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10032fdc
xor eax, eax
lea ecx, [ebp - 0x3f0]
inc eax
push eax
call fcn.10016cc8
cmp dword [eax], esi
jne 0x10032db6
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10032eb6
xor eax, eax
lea ecx, [ebp - 0x3f0]
inc eax
push eax
call fcn.10016cc8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3f0]
mov esi, eax
call fcn.10016cc8
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x10032e90
jmp 0x10032da9
movdqa xmm0, xmmword [0x100083b0]
lea eax, [ebp - 0x1260]
push eax
lea eax, [ebp - 0x1270]
push eax
lea ecx, [ebp - 0x1528]
movdqu xmmword [ebp - 0x1270], xmm0
call fcn.10016cd7
lea ecx, [ebp - 0x1cd]
mov esi, eax
call fcn.100094d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x584]
push dword [esi]
call fcn.10016c9d
xor eax, eax
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x584]
call fcn.10016cc8
and dword [eax], 0
jmp 0x10032fb3
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x10032f3f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1404], 0xffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10032f2e
xor esi, esi
lea ecx, [ebp - 0x414]
inc esi
push esi
call fcn.10016cc8
mov ecx, esi
sub ecx, dword [eax]
je 0x10032f6b
mov eax, dword [ebp - 0x1404]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
je 0x10032f6b
xor eax, eax
jmp 0x10032f6f
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x584]
call fcn.10016cc8
xor ecx, ecx
cmp esi, dword [eax]
sete cl
sub ecx, 0x30fc
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10032fa5
push 0x60c
push eax
push eax
call ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x584]
call fcn.10016cc8
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.10016cc8
cmp dword [eax], 0xf
jne 0x10032f24
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 9
call fcn.10016cc3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 8
jne 0x10032ec3
push 2
pop eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
jne 0x10032e17
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10016cc3
push 6
pop eax
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], 0xfffffff9
inc esi
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x38], 0xea53061e
mov dword [ebp - 0x30], 0x31fadacd
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x34], 0x9e885dc1
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10033059
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x135c], 0x5cb5542a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x10033041
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003306c
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], esi
jle 0x10033080
cmp dword [ebp - 0x30], eax
je 0x10033080
mov eax, esi
mov dword [ebp - 0x30], eax
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push 3
setl dl
lea ecx, [ebp - 0x450]
pop eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], 7
push eax
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], 0xb
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x100330e9
push ecx
pop esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x450]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x100330cb
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
je 0x100332d8
push 2
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x56a218f0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x10033114
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push esi
lea ecx, [ebp - 0x450]
call fcn.10016cc8
xor esi, esi
cmp dword [eax], esi
je 0x100333eb
xor eax, eax
mov dword [ebp - 0x34], 0x4cd021aa
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033149
push eax
push 0x2f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100332bb
xor eax, eax
lea ecx, [ebp - 0x414]
inc eax
push eax
call fcn.10016cc8
cmp dword [eax], esi
jne 0x10032ff6
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033195
xor eax, eax
lea ecx, [ebp - 0x414]
inc eax
push eax
call fcn.10016cc8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x414]
mov esi, eax
call fcn.10016cc8
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x1003316f
jmp 0x10032fe9
movdqa xmm0, xmmword [0x100083b0]
lea eax, [ebp - 0x1180]
push eax
lea eax, [ebp - 0x1190]
push eax
lea ecx, [ebp - 0x15a8]
movdqu xmmword [ebp - 0x1190], xmm0
call fcn.10016cd7
lea ecx, [ebp - 0x216]
mov esi, eax
call fcn.100094d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x500]
push dword [esi]
call fcn.10016c9d
xor eax, eax
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x500]
call fcn.10016cc8
and dword [eax], 0
jmp 0x10033292
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ecx
jmp 0x1003321e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x13d4], 0xffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1003320d
xor esi, esi
lea ecx, [ebp - 0x450]
inc esi
push esi
call fcn.10016cc8
mov ecx, esi
sub ecx, dword [eax]
je 0x1003324a
mov eax, dword [ebp - 0x13d4]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
je 0x1003324a
xor eax, eax
jmp 0x1003324e
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x500]
call fcn.10016cc8
xor ecx, ecx
cmp esi, dword [eax]
sete cl
sub ecx, 0x30fc
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033284
push 0x60c
push eax
push eax
call ebx
xor eax, eax
push eax
lea ecx, [ebp - 0x500]
call fcn.10016cc8
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x500]
push eax
call fcn.10016cc8
cmp dword [eax], 0xf
jne 0x10033203
lea ecx, [ebp - 0x500]
mov byte [ebp - 4], 0xb
call fcn.10016cc3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 8
jne 0x100331a2
push 2
pop eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
push 1
pop esi
jne 0x100330f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.10016cc3
xor edi, edi
mov dword [ebp - 0x14], 0xe83c7730
inc edi
mov dword [ebp - 0x48], 0xe52d8cb4
push edi
lea ecx, [ebp - 0xdc0]
call fcn.10016c3e
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x1044]
push 2
mov dword [ebp - 0x30], 0x31d8b9db
pop esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x9f6a715c
mov dword [ebp - 0x38], 0xbf495e3b
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x38], 0x75d5f8d9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], 0xc7153413
push 3
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jge 0x1003337a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16cc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10033362
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x100333a0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdc0]
call fcn.10016cc8
mov dword [eax], 0x6db6d037
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033382
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100333c6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1044]
call fcn.10016cc8
mov dword [eax], 0x82bd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100333a8
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100333e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8e4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100333ce
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033465
xor eax, eax
lea ecx, [ebp - 0x450]
inc eax
push eax
call fcn.10016cc8
cmp dword [eax], esi
jne 0x100332d8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003342f
xor eax, eax
lea ecx, [ebp - 0x450]
inc eax
push eax
call fcn.10016cc8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x450]
mov esi, eax
call fcn.10016cc8
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [ebp - 0x14]
push 2
pop eax
cmp dword [ebp - 0x14], eax
jle 0x10033409
jmp 0x100332c8
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1003345f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1538], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003344b
xor eax, eax
dec dword [ebp - 0x30]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003343c
mov eax, dword [ebp - 0x34]
sub eax, 0x43de4f81
mov dword [ebp - 0x14], eax
jne 0x1003348e
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x8e0], eax
je 0x10033490
mov eax, edi
mov dword [ebp - 0x8e4], eax
lea ecx, [ebp - 0x1044]
call fcn.10016cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc0]
call fcn.10016cc3
push edi
lea ecx, [ebp - 0xf0]
call fcn.10016c3e
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x44], 0x7c7ce53d
mov dword [ebp - 0x24], 0xe197e7c1
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x38], 0xe60e4510
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10033507
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.10016cc8
mov dword [eax], 0xa5d6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100334e9
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x100337b0
mov dword [ebp - 0x40], 0xa1e1c5a3
mov dword [ebp - 0x34], 0x9edb9cc5
mov dword [ebp - 0x28], eax
jmp 0x10033537
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10033526
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf0]
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf0]
mov esi, eax
call fcn.10016cc8
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x44]
add ecx, dword [eax]
cmp ecx, 0x23a266d2
lea ecx, [ebp - 0xf0]
setl bl
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf0]
call fcn.10016cc8
push dword [ebp - 0x44]
imul ecx, ebx, 0xa9b
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf0]
setne bl
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf0]
mov esi, dword [eax]
sub esi, ebx
call fcn.10016cc8
lea ecx, [ebp - 0xf0]
sub esi, dword [eax]
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10016cc8
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10033725
mov dword [ebp - 0x14], 0x37d6c505
mov dword [ebp - 0x30], 0x903a798b
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1003379e
mov dword [ebp - 0x2c], 0x546153b
mov dword [ebp - 0x28], eax
jmp 0x1003361c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x268], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003360b
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x14], 9
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 8
setge al
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10033714
mov dword [ebp - 0x18], 0xbf68d270
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], eax
jg 0x1003370b
mov dword [ebp - 0x34], 0x76fef6f1
lea ecx, [ebp - 0xf0]
mov esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x268], esi
push dword [ebp - 0x40]
call fcn.10016cc8
imul ecx, esi, 0xfffffff8
push 2
pop edx
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp edx, dword [ebp - 0x14]
jne 0x100336aa
mov esi, edi
cmp dword [ebp - 0x268], eax
jne 0x100336ac
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0xf0]
call fcn.10016cc8
xor ecx, ecx
push 3
cmp esi, dword [eax]
pop eax
setne cl
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x40]
call fcn.10016cc8
xor ecx, ecx
cmp dword [eax], 0xfffffff9
setge cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jle 0x10033663
dec dword [ebp - 0x14]
jns 0x10033650
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
push 0
pop eax
jle 0x100335ff
jmp 0x1003379e
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x44]
call fcn.10016cc8
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xf0]
setne bl
xor eax, eax
push eax
call fcn.10016cc8
mov ecx, dword [ebp - 0x34]
mov esi, eax
sub ebx, ecx
xor eax, eax
mov ecx, dword [ebp - 0x48]
cmp ebx, ecx
mov ecx, dword [ebp - 0x24]
setge al
xor edx, edx
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x40]
push dword [ebp - 0x44]
setne bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
cmp dword [esi], ecx
lea ecx, [ebp - 0xf0]
setge bl
call fcn.10016cc8
mov eax, dword [eax]
add eax, ebx
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x44]
push 0
pop eax
jns 0x10033513
push 2
pop esi
push 3
pop ebx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100337c0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.10016cc3
push 6
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xea53061e
mov dword [ebp - 0x30], 0x31fadacd
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x34], 0x9e885dc1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003381d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1374], 0x5cb5542a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033805
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033830
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], edi
jle 0x10033844
cmp dword [ebp - 0x30], eax
je 0x10033844
mov eax, edi
mov dword [ebp - 0x30], eax
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1370], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push esi
setl dl
lea ecx, [ebp - 0xb9c]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x14], 0x99841b3c
call fcn.10016c3e
xor eax, eax
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x100338a1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb9c]
call fcn.10016cc8
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033887
xor eax, eax
mov dword [ebp - 0x14], 7
jmp 0x100338c5
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100338c2
push 0x21fe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
jge 0x100338aa
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x1003393e
push ebx
lea ecx, [ebp - 0xb84]
call fcn.10016c3e
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x28], eax
jmp 0x10033901
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb84]
call fcn.10016cc8
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100338ea
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb9c]
call fcn.10016cc8
push edi
lea ecx, [ebp - 0xb84]
mov esi, dword [eax]
add esi, 5
call fcn.10016cc8
lea ecx, [ebp - 0xb84]
mov byte [ebp - 4], 0x10
mov dword [eax], esi
call fcn.10016cc3
dec dword [ebp - 0x14]
jns 0x100338d3
push 2
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.10016cc3
push 6
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xea53061e
mov dword [ebp - 0x30], 0x31fadacd
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x34], 0x9e885dc1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1003399b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1434], 0x5cb5542a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033983
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100339ae
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], edi
jle 0x100339c2
cmp dword [ebp - 0x30], eax
je 0x100339c2
mov eax, edi
mov dword [ebp - 0x30], eax
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push edi
setl dl
lea ecx, [ebp - 0xdd8]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x14], 0xe83c7730
mov dword [ebp - 0x48], 0xe52d8cb4
call fcn.10016c3e
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xfa4]
mov dword [ebp - 0x30], 0x31d8b9db
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x9f6a715c
mov dword [ebp - 0x38], 0xbf495e3b
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x38], 0x75d5f8d9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], 0xc7153413
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033a6b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x172c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10033a53
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10033a91
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdd8]
call fcn.10016cc8
mov dword [eax], 0x6db6d037
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033a73
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10033ab7
push dword [ebp - 0x20]
lea ecx, [ebp - 0xfa4]
call fcn.10016cc8
mov dword [eax], 0x82bd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033a99
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10033ad7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033abf
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033b05
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10033aff
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1468], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033aeb
xor eax, eax
dec dword [ebp - 0x30]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10033adc
mov eax, dword [ebp - 0x34]
sub eax, 0x43de4f81
mov dword [ebp - 0x14], eax
jne 0x10033b2e
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x8d0], eax
je 0x10033b30
mov eax, edi
mov dword [ebp - 0x8d4], eax
lea ecx, [ebp - 0xfa4]
call fcn.10016cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd8]
call fcn.10016cc3
mov dword [ebp - 0x14], 0xe83c7730
lea ecx, [ebp - 0xdf0]
mov dword [ebp - 0x48], 0xe52d8cb4
push edi
call fcn.10016c3e
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x10e0]
mov dword [ebp - 0x30], 0x31d8b9db
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0x9f6a715c
mov dword [ebp - 0x38], 0xbf495e3b
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x38], 0x75d5f8d9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x30], 0xc7153413
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10033bda
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16e4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10033bc2
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x10033c00
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdf0]
call fcn.10016cc8
mov dword [eax], 0x6db6d037
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10033be2
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10033c26
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10e0]
call fcn.10016cc8
mov dword [eax], 0x82bd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033c08
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10033c46
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x894], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10033c2e
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033c74
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10033c6e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1480], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10033c5a
xor eax, eax
dec dword [ebp - 0x30]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10033c4b
mov eax, dword [ebp - 0x34]
sub eax, 0x43de4f81
mov dword [ebp - 0x14], eax
jne 0x10033c9d
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x890], eax
je 0x10033c9f
mov eax, edi
mov dword [ebp - 0x894], eax
lea ecx, [ebp - 0x10e0]
call fcn.10016cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf0]
call fcn.10016cc3
mov dword [ebp - 0x24], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x38], 0x8e04
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1b
je 0x10033f78
push ebx
lea ecx, [ebp - 0x198]
call fcn.10016c3e
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10033d28
push dword [ebp - 0x28]
lea ecx, [ebp - 0x198]
call fcn.10016cc8
mov dword [eax], 0xbecc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033d0a
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033d47
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push edi
lea ecx, [ebp - 0x198]
call fcn.10016cc8
xor ebx, ebx
cmp dword [eax], ebx
jne 0x10033d6f
push edi
lea ecx, [ebp - 0x198]
call fcn.10016cc8
cmp dword [eax], ebx
jne 0x10033d6f
xor eax, eax
mov esi, eax
jmp 0x10033d71
mov esi, edi
push edi
lea ecx, [ebp - 0x198]
call fcn.10016cc8
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
push edi
call fcn.10016cc8
push edi
lea ecx, [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
call fcn.10016cc8
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x198]
setge bl
call fcn.10016cc8
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
cmp dword [ebp - 0x14], ecx
jle 0x10033e29
push 3
pop ebx
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xbb4]
push ebx
call fcn.10016c3e
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x10033e0d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbb4]
call fcn.10016cc8
mov dword [eax], 0x497f3c88
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10033def
xor eax, eax
lea ecx, [ebp - 0xbb4]
cmp dword [ebp - 0x34], eax
jne 0x10033f5f
mov dword [ebp - 0x14], edi
call fcn.10016cc3
jmp 0x10033f3f
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0xbf2a6bc6
mov dword [ebp - 0x34], 4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
cmp ecx, dword [ebp - 0x18]
jge 0x10033e69
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x10033e6b
mov ecx, edi
mov eax, dword [ebp - 0x14]
sub ecx, eax
je 0x10033e75
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x18]
push edi
call fcn.10016cc8
mov edx, dword [ebp - 0x14]
neg edx
push edi
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
setge cl
imul esi, ecx, 0xffff
lea ecx, [ebp - 0x198]
call fcn.10016cc8
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
sub eax, 0x38aa
cmp eax, edi
jb 0x10033ed9
mov dword [ebp - 0x34], edi
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10033f64
jmp 0x10033f3c
mov dword [ebp - 0x1c], 0x14
cmp dword [ebp - 0x1c], 0x1d
jl 0x10033f3c
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033f11
push eax
push eax
push 0xfcd
push eax
push 0xac1
push eax
push 0xd91
push 0xc9b
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10033f33
push 0x2649
push 0xaa4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jge 0x10033ee8
push 3
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.10016cc3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
push 2
pop esi
je 0x10033f76
jmp 0x10033ce3
call fcn.10016cc3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.10016cc3
push 2
pop esi
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x35984225
mov dword [ebp - 0x28], eax
jmp 0x10033f9f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x360], 0x8a600164
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10033f8e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x360]
mov eax, dword [ebp - 0x360]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x34], 0x6255d580
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10033ff4
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 3
pop eax
push eax
lea ecx, [ebp - 0x444]
call fcn.10016c3e
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0xbcc]
mov dword [ebp - 0x14], 5
push esi
call fcn.10016c3e
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x10034049
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbcc]
call fcn.10016cc8
mov dword [eax], 0xa2afe01b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003402b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100340a3
mov dword [ebp - 0x18], 0xfffffff6
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003406a
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x100340a0
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x1003409b
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbcc]
call fcn.10016cc8
cmp dword [eax], 0
jne 0x10034099
dec dword [ebp - 0x28]
jns 0x10034081
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10034072
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jle 0x1003404e
lea ecx, [ebp - 0xbcc]
mov byte [ebp - 4], 0x18
call fcn.10016cc3
xor eax, eax
mov dword [ebp - 0x28], eax
push 3
pop eax
cmp dword [ebp - 0x28], eax
jge 0x100340e6
push eax
pop edi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x444]
call fcn.10016cc8
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100340c7
xor edi, edi
push 3
inc edi
pop eax
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0xfb4]
mov dword [ebp - 0x34], 7
push eax
call fcn.10016c3e
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x48], 0x82e77e81
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003412b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15a0], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10034112
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003415c
push ecx
pop edi
push dword [ebp - 0x24]
lea ecx, [ebp - 0xfb4]
call fcn.10016cc8
mov dword [eax], 0x4cf59275
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034138
xor edi, edi
xor eax, eax
push 3
inc edi
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10034284
push esi
lea ecx, [ebp - 0x264]
call fcn.10016c3e
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x14], 0x22a149ce
mov dword [ebp - 0x28], eax
jmp 0x10034197
push dword [ebp - 0x28]
call fcn.10016cc8
mov dword [eax], 0x633efc07
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x264]
cmp dword [ebp - 0x28], esi
jl 0x10034186
push edi
call fcn.10016cc8
push edi
lea ecx, [ebp - 0x264]
and dword [eax], 0
call fcn.10016cc8
push 3
pop ecx
cmp dword [eax], ecx
jg 0x10034216
push ecx
pop esi
push edi
lea ecx, [ebp - 0x264]
call fcn.10016cc8
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x15a0]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100341ef
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jl 0x100341df
push edi
lea ecx, [ebp - 0x264]
call fcn.10016cc8
push edi
lea ecx, [ebp - 0x264]
inc dword [eax]
call fcn.10016cc8
cmp dword [eax], esi
jle 0x100341c0
mov esi, dword [ebp - 0x4c]
push edi
lea ecx, [ebp - 0x264]
call fcn.10016cc8
xor ecx, ecx
cmp dword [eax], ecx
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x48]
jg 0x10034250
cmp dword [ebp - 0x1c], eax
jne 0x10034279
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003425f
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1003425f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1003425f
push edi
call dword [sym.imp.USER32.dll_ShowCursor]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0x1a
call fcn.10016cc3
dec dword [ebp - 0x1c]
jns 0x10034168
jmp 0x10034284
lea ecx, [ebp - 0x264]
call fcn.10016cc3
lea ecx, [ebp - 0xfb4]
mov byte [ebp - 4], 0x18
call fcn.10016cc3
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10035bc3
mov dword [ebp - 0x2c], 0x7383
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x34], 0xcf7921e1
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x10
je 0x10034305
mov dword [ebp - 0x48], 0xfffffff9
xor edx, edx
push 6
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jne 0x100342ca
xor eax, eax
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 0x6128b293
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0x1c
xor eax, eax
mov dword [ebp - 0x30], 0x5e2623e
mov dword [ebp - 0x48], 0x374484a8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003435a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x398], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10034341
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034376
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x84], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034362
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1003439c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x748]
call fcn.10016cc8
mov dword [eax], 0x2aec7f51
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1003437e
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x84], ecx
cmp dword [ebp - 0x84], eax
jl 0x100345fc
movdqa xmm0, xmmword [0x100083c0]
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x1490]
movdqu xmmword [ebp - 0x1230], xmm0
call fcn.10016cd7
lea ecx, [ebp - 0x1c9]
mov esi, eax
call fcn.100094d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd8]
push dword [esi]
call fcn.10016c9d
push 2
pop esi
push esi
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x1d
call fcn.10016cc8
push 3
pop ecx
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
xor esi, esi
jmp 0x100345d3
push 2
pop eax
mov dword [ebp - 0x14], 0x457a23
mov dword [ebp - 0x34], edi
push eax
call fcn.10016cc8
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ebp + ecx*4 - 0x398]
add ecx, dword [eax]
jne 0x1003445a
push 2
pop eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
cmp dword [eax], esi
je 0x10034460
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0xd8]
push 2
pop esi
push esi
mov eax, dword [ebp + eax*4 - 0x398]
call fcn.10016cc8
push edi
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xd8]
push esi
call fcn.10016cc8
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0xd8]
push esi
mov eax, dword [ebp + eax*4 - 0x398]
mov eax, dword [ebp - 0x14]
call fcn.10016cc8
mov eax, dword [ebp - 0x84]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x398]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x398]
cmp ecx, eax
mov eax, dword [ebp - 0x398]
setne dl
imul eax, dword [ebp - 0x84]
cmp edx, eax
jge 0x100344f0
xor eax, eax
cmp dword [ebp - 0x80], eax
je 0x100344f2
mov edx, edi
jmp 0x100344f4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x80]
xor ecx, ecx
cmp edx, eax
setne cl
inc ecx
je 0x1003450d
push esi
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
push esi
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0xd8]
push esi
mov eax, dword [ebp + eax*4 - 0x398]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
call fcn.10016cc8
push 3
pop eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
push esi
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
mov eax, dword [eax]
sub eax, 0xb2b0
cmp eax, 0x6f914a12
jge 0x10034574
xor eax, eax
cmp dword [ebp - 0x390], eax
je 0x10034574
mov eax, dword [ebp - 0x14]
push esi
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
mov eax, dword [ebp - 0x14]
sub eax, 0x2d1
neg eax
push 3
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor esi, esi
pop ecx
cmp dword [ebp - 0x14], ecx
jg 0x100345b3
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x398], esi
jne 0x100345b3
inc dword [ebp - 0x14]
jmp 0x1003459a
push 2
pop eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.10016cc8
push 2
lea ecx, [ebp - 0xd8]
dec dword [eax]
pop eax
push eax
call fcn.10016cc8
lea ecx, [ebp - 0xd8]
cmp dword [eax], esi
jge 0x10034423
inc dword [ebp - 0x30]
mov byte [ebp - 4], 0x1c
call fcn.10016cc3
dec dword [ebp - 0x84]
jns 0x100343b1
push 2
pop esi
push edi
lea ecx, [ebp - 0x748]
call fcn.10016cc8
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2c]
jne 0x10034629
mov edx, eax
cmp dword [ebp - 0x38c], eax
je 0x1003462b
mov edx, edi
mov eax, dword [ebp - 0x398]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
cmp eax, 0xfd1f
jl 0x1003465b
push edi
lea ecx, [ebp - 0x748]
call fcn.10016cc8
cmp dword [eax], 0
je 0x1003465b
mov eax, edi
jmp 0x1003465d
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 0x18
call fcn.10016cc3
mov dword [ebp - 0x14], 0x56a218f0
lea ecx, [ebp - 0x7f0]
mov dword [ebp - 0x28], 0xa2768935
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], 0xb534de6f
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x30], 0x370c
push esi
call fcn.10016c3e
xor eax, eax
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100346d5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6d8], 0x1353
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100346bc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x100346f8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x7f0]
call fcn.10016cc8
or dword [eax], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100346dd
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034718
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1084], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10034700
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003472e
push dword [ebp - 0x20]
call fcn.10016cc8
mov dword [eax], 0xc745d07a
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x56c]
cmp dword [ebp - 0x20], esi
jl 0x1003471d
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6d0]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
push eax
call fcn.10016cc8
cmp dword [ebp - 0x6d0], 0xfff9
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
jne 0x10034771
mov eax, dword [ebp - 0x6d0]
mov eax, dword [ebp - 0x1080]
sub eax, dword [ebp - 0x2c]
je 0x10034785
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10034787
jmp 0x10034789
xor eax, eax
mov edi, eax
mov esi, dword [ebp - 0x6cc]
lea ecx, [ebp - 0x7f0]
push eax
call fcn.10016cc8
lea ecx, [ebp - 0x56c]
mov dword [eax], esi
add dword [ebp - 0x28], esi
xor esi, esi
push esi
call fcn.10016cc8
push esi
lea ecx, [ebp - 0x56c]
sub edi, dword [eax]
call fcn.10016cc8
push esi
lea ecx, [ebp - 0x56c]
sub edi, dword [eax]
call fcn.10016cc8
xor ecx, ecx
cmp edi, dword [eax]
mov eax, dword [ebp - 0x28]
setg cl
imul ecx, ecx, 0x7dd7
add eax, ecx
jne 0x100347f7
push esi
lea ecx, [ebp - 0x7f0]
call fcn.10016cc8
cmp dword [eax], esi
jne 0x100347f7
xor eax, eax
xor edi, edi
mov ecx, eax
inc edi
jmp 0x100347fc
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x34]
sub ecx, eax
imul eax, ecx, 0xdc71
lea ecx, [ebp - 0x56c]
sub eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x14], eax
call fcn.10016cc3
lea ecx, [ebp - 0x7f0]
mov byte [ebp - 4], 0x18
call fcn.10016cc3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
je 0x1003483f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x444]
call fcn.10016cc8
cmp dword [eax], esi
je 0x10035c55
push 3
pop eax
push 2
mov dword [ebp - 0x14], 0x25b9b55b
lea ecx, [ebp - 0xe08]
mov dword [ebp - 0x38], eax
pop esi
mov dword [ebp - 0x38], 0x5260417b
mov dword [ebp - 0x38], 0x10f7a73
push esi
call fcn.10016c3e
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x100348a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfe8], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003488e
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100348c9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1750], 0x4de6f885
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100348b1
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100348e5
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe08]
call fcn.10016cc8
mov dword [eax], 0x162c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100348ce
mov dword [ebp - 0x14], 0x18
jmp 0x1003494d
push edi
lea ecx, [ebp - 0x760]
call fcn.10016c3e
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10034927
push dword [ebp - 0x28]
lea ecx, [ebp - 0x760]
call fcn.10016cc8
mov dword [eax], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003490d
xor eax, eax
dec dword [ebp - 0x30]
lea ecx, [ebp - 0x760]
push eax
call fcn.10016cc8
lea ecx, [ebp - 0x760]
cmp dword [eax], 0
jne 0x10034955
mov byte [ebp - 4], 0x20
call fcn.10016cc3
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
je 0x100348f3
jmp 0x1003495a
call fcn.10016cc3
lea ecx, [ebp - 0xe08]
mov byte [ebp - 4], 0x18
call fcn.10016cc3
xor eax, eax
mov dword [ebp - 0x20], 0x4cd021aa
push 4
mov dword [ebp - 0x28], eax
pop esi
cmp dword [ebp - 0x28], esi
jge 0x10034991
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x92c], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1003497d
xor eax, eax
mov dword [ebp - 0x924], eax
jmp 0x100349ae
cmp byte [ebp - 0x39], 0
je 0x100349a8
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
dec dword [ebp - 0x924]
cmp dword [ebp - 0x924], 0xfffffffb
mov byte [ebp - 0x39], al
jg 0x10034999
cmp byte [ebp - 0x39], 0
je 0x100349da
push 0x2240
push 0xb0a
push 0x1ac4
call ebx
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x230]
push edi
call fcn.10016c3e
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10034a12
cmp dword [ebp - 0x18], 7
jne 0x1003429d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.10016cc3
push edi
lea ecx, [ebp - 0x108]
call fcn.10016c3e
mov dword [ebp - 4], 0x30
xor eax, eax
mov dword [ebp - 0x44], 0x7c7ce53d
mov dword [ebp - 0x1c], 0xe197e7c1
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x38], 0xe60e4510
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10035c33
push dword [ebp - 0x18]
lea ecx, [ebp - 0x108]
call fcn.10016cc8
mov dword [eax], 0xa5d6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035c15
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x10036136
mov dword [ebp - 0x24], 0xa1e1c5a3
mov dword [ebp - 0x34], 0x9edb9cc5
mov dword [ebp - 0x18], eax
jmp 0x10035ec3
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10035c77
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb0], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10035c5f
xor eax, eax
mov dword [ebp - 0xb0], eax
jmp 0x10035d5f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10035ca5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x664], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10035c8d
xor eax, eax
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10035cc8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x530], 0x7b1891f7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10035cb0
xor eax, eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], eax
jl 0x10035cf8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035cf0
push eax
push eax
call ebx
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 0x52c]
jns 0x10035cd6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jl 0x10035d59
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x34], 0x9d010789
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x664], 0
jne 0x10035d2e
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x10035d30
mov eax, edi
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10035d4c
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x52c], edi
mov eax, dword [ebp - 0xb0]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jl 0x10035d3a
dec dword [ebp - 0x28]
jns 0x10035d00
xor eax, eax
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x18
jg 0x10035c82
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035d85
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push edi
lea ecx, [ebp - 0x444]
call fcn.10016cc8
cmp dword [eax], 0
jne 0x10035bcd
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop esi
cmp dword [ebp - 0x1c], esi
jge 0x10035dbf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1098], 0x56834504
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035da7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10035ddf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2b8], 0x713a473e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035dc7
xor eax, eax
mov dword [ebp - 0x2b4], edi
cmp dword [ebp - 0x2b4], eax
jl 0x10035e2c
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x34], 0xce45
mov dword [ebp - 0x28], eax
jmp 0x10035e0a
mov dword [ebp - 0x34], 0x48c443eb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10035e00
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp + eax*4 - 0x1098], 0
jne 0x10035e2a
mov dword [ebp - 0x14], eax
jmp 0x10035ea8
push 3
mov dword [ebp - 0x28], eax
pop ecx
cmp dword [ebp - 0x28], ecx
jge 0x10035e54
cmp dword [ebp - 0x14], esi
jle 0x10035e31
jmp 0x10035bba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1dc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035eb2
push dword [ebp - 0x44]
lea ecx, [ebp - 0x108]
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0x108]
mov esi, eax
call fcn.10016cc8
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x44]
add ecx, dword [eax]
cmp ecx, 0x23a266d2
lea ecx, [ebp - 0x108]
setl bl
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0x108]
call fcn.10016cc8
push dword [ebp - 0x44]
imul ecx, ebx, 0xa9b
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x108]
setne bl
call fcn.10016cc8
push dword [ebp - 0x44]
lea ecx, [ebp - 0x108]
mov esi, dword [eax]
sub esi, ebx
call fcn.10016cc8
lea ecx, [ebp - 0x108]
sub esi, dword [eax]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10016cc8
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100360b1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10036146
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.10016cc3
xor eax, eax
lea ecx, [ebp - 0xfd4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfe7d8a87
push edi
call fcn.10016c3e
mov dword [ebp - 4], 0x31
xor eax, eax
mov dword [ebp - 0x38], 0xfc0272a
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x100361a6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfd4]
call fcn.10016cc8
mov dword [eax], 0x5ba7723
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036188
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x100361bf
cmp dword [ebp - 0x1c], ebx
jl 0x100361ae