Function at 0x10033a51
Capabilities:
Check os version
Connect pipe
Create pipe
Create thread
Delete file
Delete registry value
Enumerate files on windows
Get common file path
Get disk information
Get geographical location
Identify system language via api
Log keystrokes
Parse pe header
Read .ini file
Set environment variable
Set registry value
Set thread local storage value

Disassembly:
mov eax, 0x1007ddb4
call fcn.1007c850
mov eax, 0x151c
call fcn.10079000
push ebx
push esi
push edi
or ebx, 0xffffffff
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x50], ebx
lea ecx, [ebp - 0xab0]
mov dword [ebp - 0x54], 0xa20a2982
xor eax, eax
mov dword [ebp - 0x44], 0x3fc4b03e
inc eax
mov dword [ebp - 0x44], 0x3dda37bb
mov dword [ebp - 0x50], eax
push 3
pop edi
mov dword [ebp - 0x38], 0xddcef989
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0xb151
mov dword [ebp - 0x2c], edi
push edi
mov byte [ebp - 0x5d], dl
call fcn.100176ef
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edi
jge 0x10033ad3
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xb7c], ebx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x10033abf
xor eax, eax
xor esi, esi
mov dword [ebp - 0x3c], eax
inc esi
cmp dword [ebp - 0x3c], esi
jge 0x10033af9
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x694], 0x37aced45
xor eax, eax
inc dword [ebp - 0x3c]
inc eax
cmp dword [ebp - 0x3c], eax
jl 0x10033ade
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10033b0f
push dword [ebp - 0x3c]
call fcn.1001778d
mov dword [eax], 0x3205f5a2
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xab0]
cmp dword [ebp - 0x3c], edi
jl 0x10033afe
mov eax, dword [ebp - 0x38]
push 2
pop eax
push eax
call fcn.1001778d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax]
dec edx
dec dword [eax]
xor eax, eax
cmp edx, ecx
lea ecx, [eax + 1]
jg 0x10033b39
mov ecx, eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xab0]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xb78]
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0x38], 0x786
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x694], eax
mov dword [ebp - 4], ebx
call fcn.10017771
mov eax, 0x256915a
xor ebx, ebx
mov dword [ebp - 0x2e8], eax
inc ebx
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], eax
xor eax, eax
mov dword [ebp - 0x14], 0xcd7d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033bc5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b4], ebx
xor eax, eax
inc dword [ebp - 0x18]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x18], eax
jl 0x10033ba9
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], eax
jl 0x10033c2c
or esi, 0xffffffff
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0xf8c]
push ebx
call fcn.100176ef
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], 0x53061ece
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x10033c0c
push dword [ebp - 0x18]
call fcn.1001778d
mov dword [eax], ebx
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xf8c]
cmp dword [ebp - 0x18], ebx
jl 0x10033bff
dec dword [ebp - 0x50]
mov dword [ebp - 4], esi
call fcn.10017771
dec dword [ebp - 0x2e0]
jns 0x10033bd6
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10033d69
mov dword [ebp - 0x34], 0x72585faf
mov dword [ebp - 0x38], 0xeca5
mov dword [ebp - 0x50], 0xd9140931
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x10033c88
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033c68
push eax
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033c80
push eax
push 0x1445
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
dec dword [ebp - 0x34]
jns 0x10033c51
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jl 0x10033d66
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], 0xa832a49e
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
jne 0x10033cba
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0xae22781
setne cl
xor eax, eax
test ecx, ecx
setg al
cmp eax, ebx
jl 0x10033cde
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2e0], eax
je 0x10033ce0
mov ecx, ebx
mov eax, dword [ebp - 0x2e0]
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
sub edx, 6
mov eax, dword [ebp + eax*4 - 0x2e8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jg 0x10033d2c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x10033d2e
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
push 8
setl cl
pop eax
sub eax, ecx
sub eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x24]
neg eax
push 0xfffffffffffffffa
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e8], ecx
dec dword [ebp - 0x34]
pop ecx
jns 0x10033c94
xor eax, eax
inc dword [ebp - 0x14]
push 0xfffffffffffffffa
pop ecx
cmp dword [ebp - 0x14], edi
jle 0x10033c34
mov dword [ebp - 0x44], 0xfffffff7
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033d8e
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10033da0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov dword [ebp - 0x1c], 0xa61928c1
mov dword [ebp - 0x1c], 0x14
jmp 0x10033dea
cmp dword [ebp - 0x1c], eax
mov byte [ebp - 0x49], al
je 0x10033dc7
cmp byte [ebp - 0x49], 0
je 0x10033de7
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x10033de5
cmp byte [ebp - 0x49], 0
je 0x10033de7
push 0x864
push eax
push 0xd2a
push 0xd30
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jl 0x10033db0
movdqa xmm0, xmmword [0x10007b40]
lea eax, [ebp - 0x10c0]
push 2
pop ebx
push eax
lea eax, [ebp - 0x10d0]
mov dword [ebp - 0x14], ebx
push eax
lea ecx, [ebp - 0x1404]
movdqu xmmword [ebp - 0x10d0], xmm0
call fcn.1001779c
lea ecx, [ebp - 0x14e]
mov esi, eax
call fcn.10008ba3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x894]
push dword [esi]
call fcn.1001774b
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x2cc9105f
mov dword [ebp - 0x24], 0xa6b719d8
mov dword [ebp - 0x44], 0x3888
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10033e77
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1318], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10033e5f
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x14], 0xa
cmp dword [ebp - 0x14], 0xffffffee
jle 0x10033eeb
jmp 0x10033e8e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10033eae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c0], 0xbea12209
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10033e96
xor eax, eax
push eax
lea ecx, [ebp - 0x894]
call fcn.1001778d
mov eax, dword [eax]
mov dword [ebp - 0x10bc], eax
mov dword [ebp - 0x1310], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10033ee2
push eax
push eax
push 0x1d10
call edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffee
jg 0x10033e8c
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x10033f77
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], 0xe7b1
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
push ebx
call fcn.1001778d
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x894]
setl bl
xor eax, eax
push eax
call fcn.1001778d
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ebx, ecx
push 2
setle dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x38]
setle bl
xor ecx, ecx
cmp eax, ebx
pop ebx
setl cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xf341
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
lea ecx, [ebp - 0x894]
jg 0x10033ef7
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.10017771
mov ecx, 0x256915a
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2bc], ecx
lea ecx, [ebp - 0xac8]
mov dword [ebp - 0x28], 0xcd7d
mov dword [ebp - 0x50], ebx
xor ebx, ebx
mov dword [ebp - 0x54], 0xa20a2982
inc ebx
mov dword [ebp - 0x44], 0x3fc4b03e
mov dword [ebp - 0x44], 0x3dda37bb
push 3
mov dword [ebp - 0x50], ebx
pop esi
mov dword [ebp - 0x38], 0xddcef989
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0xb151
mov dword [ebp - 0x2c], esi
push esi
call fcn.100176ef
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x1003401b
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xcd8], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10034007
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x1003403b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x7bc], 0x37aced45
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x10034023
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x10034051
push dword [ebp - 0x3c]
call fcn.1001778d
mov dword [eax], 0x3205f5a2
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xac8]
cmp dword [ebp - 0x3c], esi
jl 0x10034040
mov eax, dword [ebp - 0x38]
push 2
call fcn.1001778d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax]
dec edx
dec dword [eax]
cmp edx, ecx
jle 0x10034076
mov ecx, ebx
jmp 0x1003407a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xac8]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xcd4]
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0x38], 0x786
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x7bc], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10017771
xor eax, eax
mov ecx, 0x1cea026
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0xcc9ca319
mov dword [ebp - 0x34], 0x4a219909
mov dword [ebp - 0x9e4], ecx
mov dword [ebp - 0x9e0], ecx
mov dword [ebp - 0x9dc], ecx
mov dword [ebp - 0x9d8], ecx
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x1003410c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x88], 0x7dd68876
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x100340f4
xor eax, eax
mov dword [ebp - 0x3c], eax
or ecx, 0xffffffff
cmp dword [ebp - 0x3c], esi
jge 0x1003412b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x139c], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10034117
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x1003414b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x8d0], 0x83c17a3f
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10034133
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10034163
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
jne 0x10034163
xor eax, eax
mov esi, eax
jmp 0x10034165
mov esi, ebx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
cmp eax, 0x451d
mov eax, dword [ebp - 0x88]
setne cl
xor edx, edx
test ecx, ecx
push 0xfffffffffffffffc
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x88]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp esi, ecx
pop esi
setl al
mov dword [ebp - 0x1394], eax
mov edx, dword [ebp - 0x88]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8cc]
inc dword [ebp - 0x28]
cmp ecx, eax
jg 0x10034250
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x8cc], esi
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003420f
push 0xf24
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
push 2
pop ebx
inc dword [ebp - 0x9d8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10034234
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7cc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034220
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x3c], 0xada439be
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
jmp 0x100342e5
xor eax, eax
mov dword [ebp - 0x8cc], eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x1003426a
push eax
push eax
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor eax, eax
push 2
mov dword [ebp - 0x34], 0xffffffe9
pop ebx
jmp 0x100342c5
mov dword [ebp - 0x28], eax
jmp 0x100342a1
mov dword [ebp - 0x20], eax
jmp 0x10034299
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034296
push 0x462
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10034280
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1003427b
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x100342c2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x8d0], 0
jne 0x100342c0
dec dword [ebp - 0x20]
jns 0x100342ae
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10034276
xor esi, esi
xor eax, eax
inc esi
jmp 0x10034212
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24c], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100342d4
mov eax, dword [ebp - 0x20]
mov ecx, 0x515e
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10034433
lea eax, [ebp - 0x10f0]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x1100]
mov dword [ebp - 0x28], 5
xorps xmm0, xmm0
lea ecx, [ebp - 0x1464]
push eax
movdqu xmmword [ebp - 0x1100], xmm0
call fcn.1001779c
lea ecx, [ebp - 0x1b5]
mov esi, eax
call fcn.10008ba3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfa0]
push dword [esi]
call fcn.1001774b
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
jge 0x10034377
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10034379
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1003437e
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
add edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x3c]
cmp ecx, 0x452f
je 0x100343ca
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x15
jmp 0x100343c2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jne 0x100343b9
jmp 0x1003441d
mov dword [ebp - 0x3c], 0xd
cmp dword [ebp - 0x3c], 0x1a
jg 0x1003441d
xor eax, eax
or esi, 0xffffffff
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100343ed
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10034411
push dword [ebp - 0x28]
lea ecx, [ebp - 0xfa0]
call fcn.1001778d
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x100343f6
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1a
jle 0x100343dc
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0xfa0]
mov dword [ebp - 4], eax
call fcn.10017771
jmp 0x1003451b
mov dword [ebp - 0xd2c], ecx
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd24], ecx
mov dword [ebp - 0xd20], ecx
mov dword [ebp - 0x30], eax
jmp 0x10034511
mov dword [ebp - 0x38], 0x91450187
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x1003450e
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x1003448c
push eax
push eax
push 0x2135
push 0xa6b
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x24c]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x24c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x24c]
mov eax, dword [ebp - 0xd20]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp + eax*4 - 0x24c]
jg 0x100344d8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x24c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + eax*4 - 0x24c]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x54], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10034470
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x11
jne 0x10034453
xor eax, eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], eax
jge 0x1003457b
or ebx, 0xffffffff
push esi
lea ecx, [ebp - 0xbe8]
call fcn.100176ef
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x1c], 0xc4d8e5cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10034570
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbe8]
call fcn.1001778d
mov dword [eax], 0xd3df75dc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034552
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10034fb9
push 2
pop ebx
push 3
lea ecx, [ebp - 0xe8]
call fcn.100176ef
or eax, 0xffffffff
mov dword [ebp - 4], 5
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100345aa
push dword [ebp - 0x18]
call fcn.1001778d
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0xe8]
jl 0x1003459c
push esi
call fcn.1001778d
mov eax, dword [eax]
add eax, 0xffff
jne 0x100345d1
push ebx
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0xe8]
mov esi, eax
call fcn.1001778d
mov ecx, dword [esi]
xor ebx, ebx
push 2
pop esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe8]
push esi
setg bl
call fcn.1001778d
xor ecx, ecx
cmp dword [eax], ebx
setle cl
cmp ecx, 0xfffffff8
jae 0x10034633
push esi
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push esi
lea ecx, [ebp - 0xe8]
call fcn.1001778d
xor ebx, ebx
lea ecx, [ebp - 0xe8]
push ebx
call fcn.1001778d
push esi
lea ecx, [ebp - 0xe8]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0xe8]
call fcn.1001778d
xor ecx, ecx
cmp dword [eax], 7
setl cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xfffffff0
cmp dword [ebp - 0x1c], 0x16
jle 0x10034699
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], bl
je 0x10034690
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jg 0x1003467f
or ebx, 0xffffffff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], ebx
call fcn.10017771
mov dword [ebp - 0x44], ebx
xor eax, eax
mov dword [ebp - 0x34], 0x8ade19d2
mov dword [ebp - 0x2c], 0xf2887cf2
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x100346df
push 0xfffffffffffffffa
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x151c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100346cb
xor eax, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x100346ef
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x34]
jns 0x100346e7
mov dword [ebp - 0x34], 0x1a
jmp 0x10034713
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034710
push eax
push 0xc7d
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jg 0x100346f8
xor ebx, ebx
lea ecx, [ebp - 0x1098]
inc ebx
push ebx
call fcn.100176ef
push 4
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], 6
call fcn.100176ef
push 7
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x1414]
movdqa xmm0, xmmword [0x10007bd0]
lea eax, [ebp - 0x11b0]
push eax
lea eax, [ebp - 0x11c0]
mov dword [ebp - 0x20], 0xfa5c62e0
push eax
movdqu xmmword [ebp - 0x11c0], xmm0
call fcn.1001779c
lea ecx, [ebp - 0x150]
mov esi, eax
call fcn.10008ba3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xfb0]
push dword [esi]
call fcn.1001774b
xor eax, eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100347ba
push dword [ebp - 0x14]
lea ecx, [ebp - 0xac]
call fcn.1001778d
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003479e
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop esi
jmp 0x100347d3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x778], 0x3ba20b95
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100347c2
push 2
lea ecx, [ebp - 0xac]
call fcn.1001778d
mov dword [eax], 0x1d
jmp 0x10034803
push 2
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x20], 0x20398070
call fcn.1001778d
dec dword [eax]
push 2
lea ecx, [ebp - 0xac]
call fcn.1001778d
cmp dword [eax], 0xfffffff3
jl 0x100347ed
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10034ad6
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x5c], 0xfffffffd
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10034856
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa34], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003483e
xor eax, eax
dec dword [ebp - 0x778]
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10034872
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jg 0x10034ad3
jmp 0x10034883
push 2
pop ecx
push ecx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xac]
call fcn.1001778d
push dword [ebp - 0x20]
or ecx, 0xffffffff
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0xac]
setge bl
call fcn.1001778d
push dword [ebp - 0x20]
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xac]
call fcn.1001778d
mov ecx, dword [ebp - 0x2c]
xor edx, edx
push dword [ebp - 0x20]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xac]
setne dl
add edx, 0x127
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
call fcn.1001778d
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
push dword [ebp - 0x20]
cmp ecx, dword [eax]
lea ecx, [ebp - 0xac]
sete bl
call fcn.1001778d
push dword [ebp - 0x20]
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xac]
call fcn.1001778d
mov ecx, dword [ebp - 0x54]
xor ebx, ebx
push 2
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2c]
lea ecx, [ebp - 0xfb0]
setne bl
call fcn.1001778d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
mov dword [eax], ebx
call fcn.1001778d
cmp ebx, dword [eax]
jl 0x10034962
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.1001778d
cmp dword [eax], 0
jne 0x10034962
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x10034967
xor ebx, ebx
inc ebx
mov esi, ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.1001778d
xor ecx, ecx
cmp dword [eax], ebx
sete cl
cmp ecx, esi
jle 0x100349a1
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034ac1
push 0x16f6
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10034ac1
mov dword [ebp - 0x30], 0x7108
lea ecx, [ebp - 0xac]
push dword [ebp - 0x20]
call fcn.1001778d
mov ecx, dword [ebp - 0x30]
add ecx, 5
cmp dword [eax], ecx
jle 0x100349cb
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100349cd
mov esi, ebx
jmp 0x100349cf
xor eax, eax
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0xac]
call fcn.1001778d
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setl dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x28]
setne bl
xor ecx, ecx
cmp eax, ebx
setl cl
imul ecx, dword [ebp - 0x770]
test ecx, ecx
je 0x10034a1a
xor ebx, ebx
lea ecx, [ebp - 0xac]
push ebx
call fcn.1001778d
cmp dword [eax], ebx
je 0x10034a1a
inc ebx
mov edx, ebx
jmp 0x10034a21
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
push 2
sete cl
xor eax, eax
cmp ecx, 0x493a
setg al
cmp eax, ebx
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
lea esi, [ecx + 1]
lea ecx, [ebp - 0xac]
add esi, eax
call fcn.1001778d
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x5c]
cmp esi, eax
setg cl
cmp ecx, 0x9132
jg 0x10034a76
mov eax, dword [ebp - 0x774]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0x778]
push 2
call fcn.1001778d
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x40]
setg cl
imul ecx, eax
mov dword [ebp - 0xa34], ecx
test ecx, ecx
jne 0x10034ab2
xor eax, eax
mov edx, eax
cmp dword [ebp - 0xa34], eax
je 0x10034ab4
mov edx, ebx
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x28]
push 3
pop esi
push 0
pop eax
cmp dword [ebp - 0x28], esi
jle 0x10034880
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1003481f
lea ecx, [ebp - 0xfb0]
call fcn.10017771
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 6
call fcn.10017771
mov dword [ebp - 0x44], 0x53061ece
or ecx, 0xffffffff
push 0xfffffffffffffffa
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0x15
pop eax
jmp 0x10034b91
mov dword [ebp - 0x30], 0x13dce9d0
mov dword [ebp - 0x30], 0xfffffff1
cmp dword [ebp - 0x30], 0xfffffff4
jl 0x10034b8e
push 4
xor eax, eax
pop edx
mov dword [ebp - 0x18], 0xa7275995
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10034b4e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1474], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10034b3a
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10034b7d
mov dword [ebp - 0x1c], 0xab60e704
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10034b7a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1474], 0xfffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10034b62
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10034b53
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff4
jge 0x10034b2b
push 0xfffffffffffffffa
pop eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x10034b12
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034ba7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], 0x75b57fd5
mov dword [ebp - 0x48], 0x457d6700
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe6
jl 0x10034cfd
jmp 0x10034bda
xor eax, eax
mov dword [ebp - 0x14], 0x82bd7b1c
mov dword [ebp - 0x14], 0xfffffff0
cmp dword [ebp - 0x14], 0x10
jle 0x10034c92
push 2
pop esi
jmp 0x10034bf9
xor eax, eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], 0x4f204795
mov dword [ebp - 0x18], eax
jmp 0x10034c19
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1120], 0xca955a63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10034c08
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
setge dl
add ecx, 0x8a9017ca
add ecx, edx
xor edx, edx
cmp eax, esi
setg dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x111c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x111c], eax
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034c85
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
jg 0x10034bf7
mov ecx, dword [ebp - 0x34]
xor edx, edx
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp eax, ebx
setle cl
xor eax, eax
cmp ecx, edx
jl 0x10034ccd
mov ecx, ebx
cmp dword [ebp - 0x14], eax
jne 0x10034ccf
mov ecx, eax
xor eax, eax
cmp ecx, 0x5e19f8c5
setge al
xor ecx, ecx
cmp eax, 0x2327
setg cl
dec ecx
add ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe6
jge 0x10034bd8
push 2
pop esi
push esi
lea ecx, [ebp - 0x26c]
call fcn.100176ef
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xa221525
mov dword [ebp - 0x18], eax
jmp 0x10034d32
push dword [ebp - 0x18]
call fcn.1001778d
mov dword [eax], 0xd5816210
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x26c]
cmp dword [ebp - 0x18], esi
jl 0x10034d21
push ebx
call fcn.1001778d
xor ecx, ecx
xor ebx, ebx
cmp dword [eax], ebx
setne cl
xor eax, eax
inc eax
mov dword [ebp - 0x2c], ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.1001778d
push ebx
lea ecx, [ebp - 0x26c]
mov esi, eax
call fcn.1001778d
mov ecx, dword [esi]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x26c]
setne bl
xor eax, eax
push eax
sub ebx, 3
call fcn.1001778d
lea ecx, [ebp - 0x26c]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, ebx
push eax
call fcn.1001778d
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor esi, esi
mov dword [ebp - 0x30], ecx
inc esi
push esi
lea ecx, [ebp - 0x26c]
call fcn.1001778d
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x26c]
setge bl
call fcn.1001778d
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor eax, eax
cmp dword [ebp - 0x2c], ecx
setge al
or ebx, 0xffffffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ebx
jmp 0x10034de9
mov dword [ebp - 0x50], esi
dec dword [ebp - 0x50]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xd
jge 0x10034de0
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 6
call fcn.10017771
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10034e22
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1098]
call fcn.1001778d
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10034e08
xor eax, eax
mov dword [ebp - 0x28], 0xc75b57fd
mov dword [ebp - 0x28], eax
jmp 0x10034f02
mov dword [ebp - 0x30], 0x82bd7b1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10034e5a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe5c], 0x457d6700
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10034e41
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff0
jne 0x10034eff
mov dword [ebp - 0x38], 0x795ed7c6
mov dword [ebp - 0x2c], 0x9855eec8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xe54], eax
test eax, eax
je 0x10034e96
xor eax, eax
cmp dword [ebp - 0xe54], eax
je 0x10034e98
mov edx, esi
jmp 0x10034e9a
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 5
jne 0x10034eb2
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x10034eb4
mov ecx, esi
mov eax, dword [ebp - 0x38]
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, 0xfffffff7
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], al
je 0x10034ef0
push eax
push 0x1ab5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff0
je 0x10034e67
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xe
je 0x10034e31
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x1098]
mov dword [ebp - 4], ebx
call fcn.10017771
dec dword [ebp - 0x2c0]
jns 0x10034578
jmp 0x1003452e
push 3
lea ecx, [ebp - 0x460]
call fcn.100176ef
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
jmp 0x10034f57
push dword [ebp - 0x18]
call fcn.1001778d
mov dword [eax], 0x402e31d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
lea ecx, [ebp - 0x460]
jl 0x10034f46
push esi
call fcn.1001778d
and dword [eax], 0
jmp 0x10034f95
push esi
call fcn.1001778d
lea ecx, [ebp - 0xbe8]
push dword [eax]
call fcn.1001778d
push esi
lea ecx, [ebp - 0x460]
mov dword [eax], 0xa11c1574
call fcn.1001778d
inc dword [eax]
push esi
lea ecx, [ebp - 0x460]
call fcn.1001778d
lea ecx, [ebp - 0x460]
cmp dword [eax], esi
jl 0x10034f6e
mov byte [ebp - 4], 0xa
call fcn.10017771
inc dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x10034f2e
lea ecx, [ebp - 0xbe8]
mov dword [ebp - 4], ebx
call fcn.10017771
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1003624b
mov ebx, 0x14f98caf
jmp 0x10034fe8
or ecx, 0xffffffff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x50], 0x6f1860ec
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x50], 0x280643b8
mov dword [ebp - 0x2c], 0xdde9ab5c
cmp dword [ebp - 0x34], eax
je 0x10035015
mov dword [ebp - 0x50], 0x9667
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], ecx
mov ecx, 0xbd46e6c5
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, eax
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2c], 9
xor eax, eax
mov dword [ebp - 0x34], 0xffffffea
cmp dword [ebp - 0x34], 0xffffffeb
jl 0x10035058
mov dword [ebp - 0x2c], 0x96a0
cmp dword [ebp - 0x2c], eax
jne 0x10035058
inc dword [ebp - 0x34]
jmp 0x10035041
mov dword [ebp - 0x3c], 0x72585faf
mov dword [ebp - 0x30], 0xd3df75dc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xe
jg 0x1003510b
or ebx, 0xffffffff
push 4
lea ecx, [ebp - 0xae0]
call fcn.100176ef
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x1c], 0x4f402e31
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100350bb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xae0]
call fcn.1001778d
mov dword [eax], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003509c
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100350d1
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100350e3
push dword [ebp - 0x1c]
call fcn.1001778d
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
lea ecx, [ebp - 0xae0]
jl 0x100350d6
mov dword [ebp - 4], ebx
call fcn.10017771
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xe
jle 0x10035076
xor eax, eax
mov ebx, 0x14f98caf
mov dword [ebp - 0x40], 0xeca5
mov dword [ebp - 0x34], 0x97f6af11
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x5467356a
push 2
mov dword [ebp - 0x54], 0xcef33920
pop ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0xfffffff5
jge 0x1003529c
push 0xfffffffffffffffc
pop esi
jmp 0x10035141
xor eax, eax
mov dword [ebp - 0x14], 0x9ea4
cmp dword [ebp - 0x14], eax
je 0x10035167
cmp dword [ebp - 0x34], eax
jne 0x10035167
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffff6
cmp dword [ebp - 0x1c], 0xb
jl 0x1003528c
mov dword [ebp - 0x30], 0x623b26d5
xor eax, eax
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100351af
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1060], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003519b
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x100351c7
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff5
jl 0x1003513f
xor esi, esi
inc esi
mov dword [ebp - 0x50], 0xd9140931
xor eax, eax
mov dword [ebp - 0x34], 0xf6af1124
mov dword [ebp - 0x50], 0x89226c31
mov dword [ebp - 0x24], 0x83303773
mov dword [ebp - 0x9fc], ebx
mov dword [ebp - 0x9f8], ebx
mov dword [ebp - 0x9f4], ebx
mov dword [ebp - 0x9f0], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 6
je 0x100353a3
or ebx, 0xffffffff
mov dword [ebp - 0x38], 0x9ea4
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], eax
jmp 0x10035309
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1220], 0x6478c38e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100352f8
cmp dword [ebp - 0x38], ebx
jbe 0x1003533a
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
cmp eax, 0x6bc3ec3d
setne cl
xor eax, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x1003533c
mov eax, esi
neg eax
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x1220]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1220]
mov eax, dword [ebp - 0x38]
dec ecx
neg ecx
push 0xfffffffffffffffa
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
pop eax
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x9f4]
push 0
setne cl
add eax, 0x1aed
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, eax
pop eax
setle dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 6
push 2
pop ecx
jne 0x100352e2
mov ebx, 0x14f98caf
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], eax
jl 0x10035ddd
jmp 0x100353b7
mov dword [ebp - 0x34], 0x860b4ffb
mov dword [ebp - 0x1c], 0xab39e224
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
push 2
pop ebx
jge 0x100353e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7f0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100353d1
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10035541
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10035419
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x10035414
push eax
push 0x29e
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100353f9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x1003553e
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x50], 0xac8ef34e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10035532
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x100353ee
mov dword [ebp - 0x1c], eax
jmp 0x10035565
mov dword [ebp - 0x50], 0xfffffffe
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jge 0x1003554f
mov dword [ebp - 0x48], 0x951fe77d
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0x5a7b051a
mov dword [ebp - 0x44], 0x76e5b14f
mov dword [ebp - 0x24], 0x53589fe5
push ebx
call fcn.100176ef
xor eax, eax
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100355cf
push 4
lea ecx, [ebp - 0x3c0]
call fcn.100176ef
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x44], 0x39c9d940
push 3
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x10035e1d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc00], 0xa8eac8b1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035e05
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10035e45
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c0]
call fcn.1001778d
mov dword [eax], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10035e26
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10035e5c
push eax
push eax
push 0x1122
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push esi
lea ecx, [ebp - 0x3c0]
call fcn.1001778d
and dword [eax], 0
jmp 0x10035eab
mov eax, dword [ebp - 0xbf8]
push esi
call fcn.1001778d
push 3
lea ecx, [ebp - 0x3c0]
mov esi, eax
call fcn.1001778d
mov ecx, dword [esi]
push 3
pop esi
push esi
mov ecx, dword [ebp + ecx*4 - 0xc00]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xc00], ecx
lea ecx, [ebp - 0x3c0]
call fcn.1001778d
inc dword [eax]
push esi
lea ecx, [ebp - 0x3c0]
call fcn.1001778d
lea ecx, [ebp - 0x3c0]
cmp dword [eax], 2
jle 0x10035e6d
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10017771
mov dword [ebp - 0x3c], esi
xor eax, eax
xor esi, esi
inc esi
cmp dword [ebp - 0x3c], eax
jl 0x10036238
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x358]
call fcn.100176ef
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x28], 0x532fe223
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10036290
push dword [ebp - 0x14]
lea ecx, [ebp - 0x358]
call fcn.1001778d
mov dword [eax], 0xb9b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10036272
xor eax, eax
mov dword [ebp - 0x14], eax
push 0xfffffffffffffff9
pop ecx
cmp dword [ebp - 0x14], ebx
jge 0x100362af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003629b
xor eax, eax
mov dword [ebp - 0x28], eax
mov ecx, 0x2526041
cmp dword [ebp - 0x28], 3
jg 0x100363d9
jmp 0x100362c5
xor eax, eax
mov dword [ebp - 0x57c], ecx
mov dword [ebp - 0x578], ecx
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], ecx
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 3
jg 0x100363c0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x358]
call fcn.1001778d
cmp dword [eax], 0
je 0x10036397
push dword [ebp - 0x28]
lea ecx, [ebp - 0x358]
call fcn.1001778d
mov esi, eax
lea ecx, [ebp - 0x358]
xor eax, eax
inc eax
push eax
call fcn.1001778d
mov esi, dword [esi]
lea ecx, [ebp - 0x358]
push dword [ebp - 0x28]
imul esi, dword [eax]
call fcn.1001778d
xor ebx, ebx
lea ecx, [ebp - 0x358]
push 3
cmp esi, dword [eax]
setg bl
call fcn.1001778d
cmp ebx, dword [eax]
jg 0x10036379
push dword [ebp - 0x28]
lea ecx, [ebp - 0x358]
call fcn.1001778d
cmp dword [eax], 0
jne 0x10036379
xor esi, esi
inc esi
mov ecx, esi
jmp 0x10036380
xor eax, eax
xor esi, esi
mov ecx, eax
inc esi
xor eax, eax
cmp ecx, esi
setl al
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xb0ad8ea5
je 0x10036397
mov eax, esi
jmp 0x10036399
xor eax, eax
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd4c], eax
inc dword [ebp - 0x578]
cmp dword [ebp - 0x578], 3
jle 0x100362fe
mov ecx, 0x2526041
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd44], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x100362c3
or eax, 0xffffffff
lea ecx, [ebp - 0x358]
mov dword [ebp - 4], eax
call fcn.10017771
mov ebx, 0x256915a
xor eax, eax
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x34], 0xcd7d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003642c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x704], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036418
xor eax, eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], eax
jl 0x10036496
or ebx, 0xffffffff
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0xe70]
push esi
call fcn.100176ef
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x44], 0x53061ece
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], eax
jmp 0x10036471
push dword [ebp - 0x18]
call fcn.1001778d
mov dword [eax], esi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0xe70]
cmp dword [ebp - 0x18], esi
jl 0x10036464
dec dword [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.10017771
dec dword [ebp - 0x2d0]
jns 0x1003643d
xor eax, eax
mov ebx, 0x256915a
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x100365ec
push 0xfffffffffffffffa
pop ebx
mov dword [ebp - 0x28], 0x72585faf
mov dword [ebp - 0x48], 0xeca5
mov dword [ebp - 0x40], 0xd9140931
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x100364fb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100364de
push eax
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100364f6
push eax
push 0x1445
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x100364c7
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x100365da
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], 0xa832a49e
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10036531
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp eax, 0xae22781
setne cl
xor eax, eax
test ecx, ecx
setg al
cmp eax, esi
jl 0x10036555
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x2d0], eax
je 0x10036557
mov ecx, esi
mov eax, dword [ebp - 0x2d0]
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setle dl
sub edx, 6
mov eax, dword [ebp + eax*4 - 0x2d8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
jg 0x100365a3
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x100365a5
mov edx, esi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
push 8
setl cl
pop eax
sub eax, ecx
sub eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2d8], ecx
dec dword [ebp - 0x28]
jns 0x1003650b
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x100364a6
mov ebx, 0x256915a
mov dword [ebp - 0x2f8], ebx
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x34], 0xcd7d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10036627
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7dc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036613
xor eax, eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], eax
jl 0x1003668c
or ebx, 0xffffffff
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x100c]
push esi
call fcn.100176ef
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x44], 0x53061ece
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], eax
jmp 0x1003666c
push dword [ebp - 0x18]
call fcn.1001778d
mov dword [eax], esi
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x100c]
cmp dword [ebp - 0x18], esi
jl 0x1003665f
dec dword [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.10017771
dec dword [ebp - 0x2f0]
jns 0x10036638
xor eax, eax
push 3
mov dword [ebp - 0x34], eax
pop ebx
jmp 0x100367c9
mov dword [ebp - 0x28], 0x72585faf
mov dword [ebp - 0x48], 0xeca5
mov dword [ebp - 0x40], 0xd9140931
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x100366e8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100366cb
push eax
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x100366e3
push eax
push 0x1445
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
dec dword [ebp - 0x28]
jns 0x100366b4
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x100367c6
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x40], 0xa832a49e
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x1003671d
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp eax, 0xae22781
setne cl
xor eax, eax
test ecx, ecx
setg al
cmp eax, esi
jl 0x10036741
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x10036697
push 4
lea ecx, [ebp - 0x3f4]
call fcn.100176ef
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x28], 0x532fe223
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10036817