Function at 0x100342dd
Capabilities:
Compare security identifiers
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64c
push esi
push edi
mov dword [ebp - 0x40], 0x76820624
and dword [ebp - 0x518], 0
and dword [ebp - 0x514], 0
and dword [ebp - 0x510], 0
and dword [ebp - 0x50c], 0
lea ecx, [ebp - 0x17a]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x650]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x61c]
call fcn.1002cbd5
mov dword [ebp - 0xb4], 0
jmp 0x1003436e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1003438a
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x5e0], 0xfffffff6
jmp 0x10034361
mov dword [ebp - 0x40], 0xffffffe9
jmp 0x1003439a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xf
je 0x100343e7
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0xfc], 0
jmp 0x100343c3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x100343e5
mov dword [ebp - 0x2b0], 0xd1f2e966
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
jmp 0x100343b6
jmp 0x10034393
mov dword [ebp - 0x40], 0
jmp 0x100343f7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1003440d
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x5e0], 2
jmp 0x100343f0
lea ecx, [ebp - 0x61c]
call fcn.1002cbfb
movzx eax, byte [0x10a22588]
test eax, eax
je 0x10034436
mov esi, 0x10072880
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10037221
mov dword [ebp - 0x50], 0x76820624
and dword [ebp - 0x4dc], 0
and dword [ebp - 0x4d8], 0
and dword [ebp - 0x4d4], 0
and dword [ebp - 0x4d0], 0
lea ecx, [ebp - 0x141]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x630]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x628]
call fcn.1002cbd5
mov dword [ebp - 0xbc], 0
jmp 0x100344a7
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100344c3
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x590], 0xfffffff6
jmp 0x1003449a
mov dword [ebp - 0x50], 0xffffffe9
jmp 0x100344d3
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xf
je 0x10034520
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0xa4], 0
jmp 0x100344fc
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jg 0x1003451e
mov dword [ebp - 0x354], 0xd1f2e966
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
jmp 0x100344ef
jmp 0x100344cc
mov dword [ebp - 0x50], 0
jmp 0x10034530
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x10034546
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x590], 2
jmp 0x10034529
lea ecx, [ebp - 0x628]
call fcn.1002cbfb
mov dword [ebp - 0x598], 0x10072880
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x1003457c
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe6
jle 0x10034682
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x100345a9
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x100345c5
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x494], 0xbe1d925b
jmp 0x1003459c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x494], 0xfffffff1
jmp 0x100345f3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x494], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x494], 0x11
jl 0x1003463b
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc4], 0x13
jmp 0x10034626
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff0
jle 0x10034639
cmp dword [ebp - 0x14], 0
je 0x10034637
jmp 0x10034639
jmp 0x10034619
jmp 0x100345d8
mov dword [ebp - 0x104], 0
jmp 0x10034654
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffe5
jne 0x1003467d
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1003467b
push 0x2471
push 0x2d5
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x10034647
jmp 0x10034575
cmp dword [ebp - 0x14], 0
je 0x1003488f
mov dword [ebp - 0x434], 0xafd77ccc
mov dword [ebp - 0xcc], 0
jmp 0x100346af
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 4
jge 0x100346cb
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x4b4], 0x37a5b7d8
jmp 0x100346a2
mov dword [ebp - 0x14], 3
jmp 0x100346db
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003488d
mov dword [ebp - 0x124], 0
jmp 0x100346fe
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x1003471a
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x424], 0xffffffff
jmp 0x100346f1
mov dword [ebp - 0x40c], 0x2699
cmp dword [ebp - 0x40c], 0xc6f
jge 0x1003478f
lea eax, [ebp - 0x414]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c299
mov eax, dword [ebp - 0x414]
and eax, 0x80000001
jns 0x10034753
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10034774
push fcn.1003148b
mov edx, 0x10007ef0
mov ecx, 0x1065dc18
call fcn.100312b4
mov ecx, eax
call fcn.1002c6b2
jmp 0x1003478f
push fcn.1003148b
mov edx, 0x10007ef8
mov ecx, 0x1065dc18
call fcn.100312b4
mov ecx, eax
call fcn.1002c6b2
mov eax, dword [ebp - 0x14]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x4b4]
cmp dword [ebp + eax*4 - 0x4b4], ecx
jle 0x100347b4
mov dword [ebp - 0x41c], 1
jmp 0x100347bb
and dword [ebp - 0x41c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b4]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4b4]
cmp dword [ebp - 0x35c], eax
jge 0x100347f5
mov dword [ebp - 0x180], 1
jmp 0x100347fc
and dword [ebp - 0x180], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x180]
mov dword [ebp + eax - 0x424], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x180], eax
jle 0x10034826
mov dword [ebp - 0x42c], 1
jmp 0x1003482d
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5a0], eax
xor eax, eax
inc eax
je 0x10034857
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4b4], 0
je 0x10034857
mov dword [ebp - 0x364], 1
jmp 0x1003485e
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x364], eax
jle 0x10034875
mov dword [ebp - 0x36c], 1
jmp 0x1003487c
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x434], eax
jmp 0x100346d4
jmp 0x100348b7
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x100348b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 0x5fc], 0x10072884
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x10], 0xfffffff2
jmp 0x100348e2
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe6
jle 0x100349e8
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0xd4], 0
jmp 0x1003490f
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x1003492b
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x488], 0xbe1d925b
jmp 0x10034902
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x488], 0xfffffff1
jmp 0x10034959
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x488]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x488], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x488], 0x11
jl 0x100349a1
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x10c], 0x13
jmp 0x1003498c
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xfffffff0
jle 0x1003499f
cmp dword [ebp - 0x10], 0
je 0x1003499d
jmp 0x1003499f
jmp 0x1003497f
jmp 0x1003493e
mov dword [ebp - 0xdc], 0
jmp 0x100349ba
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffe5
jne 0x100349e3
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x100349e1
push 0x2471
push 0x2d5
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x100349ad
jmp 0x100348db
cmp dword [ebp - 0x10], 0
je 0x10034b80
mov dword [ebp - 0x454], 0xafd77ccc
mov dword [ebp - 0x134], 0
jmp 0x10034a15
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10034a31
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x4a4], 0x37a5b7d8
jmp 0x10034a08
mov dword [ebp - 0x10], 3
jmp 0x10034a41
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10034b7e
mov dword [ebp - 0xe4], 0
jmp 0x10034a64
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x10034a80
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x444], 0xffffffff
jmp 0x10034a57
mov eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x4a4]
cmp dword [ebp + eax*4 - 0x4a4], ecx
jle 0x10034aa5
mov dword [ebp - 0x43c], 1
jmp 0x10034aac
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a4]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4a4]
cmp dword [ebp - 0x374], eax
jge 0x10034ae6
mov dword [ebp - 0x164], 1
jmp 0x10034aed
and dword [ebp - 0x164], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x444], ecx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x164], eax
jle 0x10034b17
mov dword [ebp - 0x44c], 1
jmp 0x10034b1e
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5ec], eax
xor eax, eax
inc eax
je 0x10034b48
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4a4], 0
je 0x10034b48
mov dword [ebp - 0x368], 1
jmp 0x10034b4f
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x368], eax
jle 0x10034b66
mov dword [ebp - 0x34c], 1
jmp 0x10034b6d
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x454], eax
jmp 0x10034a3a
jmp 0x10034ba2
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x10034ba2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov byte [0x10a22588], 1
push 1
lea ecx, [ebp - 0x18c]
call fcn.1002cb22
and dword [ebp - 4], 0
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x114], 0
jmp 0x10034bda
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x10034bfc
push dword [ebp - 0x114]
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov dword [eax], 0x51da622a
jmp 0x10034bcd
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
cmp dword [eax], 7
jle 0x10034c1a
mov dword [ebp - 0x1e4], 1
jmp 0x10034c21
and dword [ebp - 0x1e4], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [eax]
jle 0x10034c44
mov dword [ebp - 0x45c], 1
jmp 0x10034c4b
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov esi, eax
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xbc40
jg 0x10034c7f
mov dword [ebp - 0x1e8], 1
jmp 0x10034c86
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x74], eax
mov esi, dword [ebp - 0x74]
neg esi
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
sub esi, dword [eax]
imul esi, esi, 7
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
add esi, dword [eax]
je 0x10034d59
mov dword [ebp - 0x1f8], 1
cmp dword [ebp - 0x1f8], 0
je 0x10034cec
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10034cec
mov dword [ebp - 0x2b4], 1
jmp 0x10034cf3
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0x4da8
jge 0x10034d0b
mov dword [ebp - 0x1f0], 1
jmp 0x10034d12
and dword [ebp - 0x1f0], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1f0]
je 0x10034d35
mov dword [ebp - 0x2b8], 1
jmp 0x10034d3c
and dword [ebp - 0x2b8], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x2b8]
add ecx, dword [eax]
mov dword [ebp - 0x1f8], ecx
jmp 0x10034dd3
mov dword [ebp - 0x74], 0x4f6cbcb1
mov dword [ebp - 0x74], 0
jmp 0x10034d70
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x10034dd3
mov dword [ebp - 0xec], 3
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x10034d99
push 0x20bf
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xec], 0
jmp 0x10034db2
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x10034dd1
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x10034dcf
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x10034da5
jmp 0x10034d69
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.1002cbfb
push 1
lea ecx, [ebp - 0x19c]
call fcn.1002cb22
mov dword [ebp - 4], 1
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x12c], 0
jmp 0x10034e16
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x10034e38
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov dword [eax], 0x51da622a
jmp 0x10034e09
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
cmp dword [eax], 7
jle 0x10034e56
mov dword [ebp - 0x318], 1
jmp 0x10034e5d
and dword [ebp - 0x318], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x318]
cmp ecx, dword [eax]
jle 0x10034e80
mov dword [ebp - 0x3a4], 1
jmp 0x10034e87
and dword [ebp - 0x3a4], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov esi, eax
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xbc40
jg 0x10034ebb
mov dword [ebp - 0x200], 1
jmp 0x10034ec2
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x7c]
neg esi
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
sub esi, dword [eax]
imul esi, esi, 7
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
add esi, dword [eax]
je 0x10034f95
mov dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0
je 0x10034f28
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10034f28
mov dword [ebp - 0x2c0], 1
jmp 0x10034f2f
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0x4da8
jge 0x10034f47
mov dword [ebp - 0x208], 1
jmp 0x10034f4e
and dword [ebp - 0x208], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x208]
je 0x10034f71
mov dword [ebp - 0x348], 1
jmp 0x10034f78
and dword [ebp - 0x348], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x348]
add ecx, dword [eax]
mov dword [ebp - 0x210], ecx
jmp 0x1003500f
mov dword [ebp - 0x7c], 0x4f6cbcb1
mov dword [ebp - 0x7c], 0
jmp 0x10034fac
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x1003500f
mov dword [ebp - 0xf4], 3
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x10034fd5
push 0x20bf
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xf4], 0
jmp 0x10034fee
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1003500d
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x1003500b
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x10034fe1
jmp 0x10034fa5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.1002cbfb
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x84], 0xffff
mov dword [ebp - 0x1c8], 0x3e5ec352
mov dword [ebp - 0x16c], 0xdc509ca4
mov dword [ebp - 0x238], 0xa3fd
mov dword [ebp - 0x3b4], 0xffffffff
push 2
lea ecx, [ebp - 0x544]
call fcn.1002cb22
mov dword [ebp - 4], 2
mov dword [ebp - 0xac], 0
jmp 0x10035084
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x100350a6
push dword [ebp - 0xac]
lea ecx, [ebp - 0x544]
call fcn.1002cc7e
mov dword [eax], 1
jmp 0x10035077
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x100350bf
push 0xefd
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x54], 0x1320f2d6
jg 0x100350d4
mov dword [ebp - 0x2c8], 1
jmp 0x100350db
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x2c8]
test eax, eax
je 0x100350fe
cmp dword [ebp - 0x84], 0
je 0x100350fe
mov dword [ebp - 0x218], 1
jmp 0x10035105
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0xd6b5
jge 0x1003511d
mov dword [ebp - 0x320], 1
jmp 0x10035124
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x320], eax
jg 0x1003513b
mov dword [ebp - 0x220], 1
jmp 0x10035142
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0xff44
je 0x1003515a
mov dword [ebp - 0x2d0], 1
jmp 0x10035161
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x2d0], eax
je 0x1003517b
mov dword [ebp - 0x228], 1
jmp 0x10035182
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x228], eax
jg 0x1003519c
mov dword [ebp - 0x360], 1
jmp 0x100351a3
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
add eax, 8
cmp eax, 0xfffffff8
jge 0x100351c9
mov dword [ebp - 0x230], 1
jmp 0x100351d0
and dword [ebp - 0x230], 0
imul eax, dword [ebp - 0x230], 0x1718
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x16c], eax
jne 0x100351f7
mov dword [ebp - 0x2d8], 1
jmp 0x100351fe
and dword [ebp - 0x2d8], 0
imul eax, dword [ebp - 0x2d8], 0x3725
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x238], eax
jle 0x10035228
mov dword [ebp - 0x3dc], 1
jmp 0x1003522f
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x1c8], eax
je 0x10035255
mov dword [ebp - 0x328], 1
jmp 0x1003525c
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x328]
sub eax, dword [ebp - 0x54]
jne 0x10035272
cmp dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x84]
jl 0x1003528c
mov dword [ebp - 0x240], 1
jmp 0x10035293
and dword [ebp - 0x240], 0
mov esi, dword [ebp - 0x240]
sub esi, dword [ebp - 0x3b4]
push 0
lea ecx, [ebp - 0x544]
call fcn.1002cc7e
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x544]
call fcn.1002cbfb
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10072670
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x8c], 0xffff
mov dword [ebp - 0x190], 0x3e5ec352
mov dword [ebp - 0x174], 0xdc509ca4
mov dword [ebp - 0x268], 0xa3fd
mov dword [ebp - 0x418], 0xffffffff
push 2
lea ecx, [ebp - 0x538]
call fcn.1002cb22
mov dword [ebp - 4], 3
mov dword [ebp - 0xb0], 0
jmp 0x10035337
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10035359
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x538]
call fcn.1002cc7e
mov dword [eax], 1
jmp 0x1003532a
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x10035372
push 0xefd
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x58], 0x1320f2d6
jg 0x10035387
mov dword [ebp - 0x2e0], 1
jmp 0x1003538e
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x2e0]
test eax, eax
je 0x100353b1
cmp dword [ebp - 0x8c], 0
je 0x100353b1
mov dword [ebp - 0x248], 1
jmp 0x100353b8
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 0xd6b5
jge 0x100353d0
mov dword [ebp - 0x350], 1
jmp 0x100353d7
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x350], eax
jg 0x100353ee
mov dword [ebp - 0x250], 1
jmp 0x100353f5
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0xff44
je 0x1003540d
mov dword [ebp - 0x2e8], 1
jmp 0x10035414
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x2e8], eax
je 0x1003542e
mov dword [ebp - 0x258], 1
jmp 0x10035435
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x258], eax
jg 0x1003544f
mov dword [ebp - 0x330], 1
jmp 0x10035456
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
add eax, 8
cmp eax, 0xfffffff8
jge 0x1003547c
mov dword [ebp - 0x260], 1
jmp 0x10035483
and dword [ebp - 0x260], 0
imul eax, dword [ebp - 0x260], 0x1718
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x174], eax
jne 0x100354aa
mov dword [ebp - 0x2f0], 1
jmp 0x100354b1
and dword [ebp - 0x2f0], 0
imul eax, dword [ebp - 0x2f0], 0x3725
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x268], eax
jle 0x100354db
mov dword [ebp - 0x3b8], 1
jmp 0x100354e2
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x190], eax
je 0x10035508
mov dword [ebp - 0x370], 1
jmp 0x1003550f
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x58]
jne 0x10035525
cmp dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x8c]
jl 0x1003553f
mov dword [ebp - 0x270], 1
jmp 0x10035546
and dword [ebp - 0x270], 0
mov esi, dword [ebp - 0x270]
sub esi, dword [ebp - 0x418]
push 0
lea ecx, [ebp - 0x538]
call fcn.1002cc7e
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.1002cbfb
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x24], 0xc58f5537
mov dword [ebp - 0x48], 0
jmp 0x1003558e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xc
jne 0x10035c45
mov dword [ebp - 0x20], 0xc285ce96
mov dword [ebp - 0x3c0], 0x1fd6
cmp dword [ebp - 0x3c0], 0xa53
jge 0x10035774
call fcn.100546d5
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007be8
push 0x10007bec
call fcn.10054c3f
add esp, 0xc
call fcn.100546d5
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10007bf4
push 0x10007bf8
call fcn.10054c3f
add esp, 0xc
lea eax, [ebp - 0xb8]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c299
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + 4]
call fcn.100099fb
movzx eax, al
test eax, eax
je 0x10035774
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xb8]
jge 0x1003565c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x1003563f
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x1003566b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x100356c3
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x2c]
dec eax
imul eax, dword [ebp - 0x2c]
cdq
sub eax, edx
sar eax, 1
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xb8]
je 0x100356c1
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x10035693
jmp 0x10035715
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x94], 1
mov eax, dword [ebp - 0x2c]
dec eax
imul eax, dword [ebp - 0x2c]
cdq
sub eax, edx
sar eax, 1
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xb8]
je 0x10035715
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x100356e7
push fcn.1003148b
push dword [ebp - 0x94]
push dword [ebp - 0x9c]
push dword [ebp - 0xb8]
mov edx, 0x10007f0c
mov ecx, 0x1065dc18
call fcn.100312b4
mov ecx, eax
call fcn.1002c6be
mov edx, 0x10007f04
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c6be
mov edx, 0x10007f00
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c6be
mov ecx, eax
call fcn.1002c6b2
jmp 0x100355f9
mov dword [ebp - 0x504], 0x4579
mov dword [ebp - 0x500], 0x4579
mov dword [ebp - 0x4fc], 0x4579
mov dword [ebp - 0x4f8], 0x4579
lea ecx, [ebp - 0x151]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x638]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1b4]
call fcn.1002cbd5
mov dword [ebp - 4], 4
mov dword [ebp - 0xc0], 0
jmp 0x100357f1
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1003580d
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x3a0], 0xfffffff8
jmp 0x100357e4
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x48], eax
je 0x10035828
mov dword [ebp - 0x338], 1
jmp 0x1003582f
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x3a0]
cmp dword [ebp + eax - 0x3a0], ecx
jne 0x10035856
mov dword [ebp - 0x448], 1
jmp 0x1003585d
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c0], eax
mov esi, dword [ebp - 0x48]
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x10035886
mov dword [ebp - 0x278], 1
jmp 0x1003588d
and dword [ebp - 0x278], 0
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [eax]
jg 0x100358b0
mov dword [ebp - 0x280], 1
jmp 0x100358b7
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x280]
jg 0x100358d1
mov dword [ebp - 0x300], 1
jmp 0x100358d8
and dword [ebp - 0x300], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a0]
cmp dword [ebp - 0x300], eax
jge 0x100358f9
mov dword [ebp - 0x288], 1
jmp 0x10035900
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xffffffff
je 0x10035915
mov dword [ebp - 0x358], 1
jmp 0x1003591c
and dword [ebp - 0x358], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x3a0]
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x358]
add ecx, dword [eax]
imul esi, ecx
mov dword [ebp - 0x290], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0x3a0], ecx
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x1d
jmp 0x10035973
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jl 0x10035c31
mov dword [ebp - 0x3c8], 0x2113
cmp dword [ebp - 0x3c8], 0x1233
jge 0x10035a02
call fcn.10034219
lea eax, [ebp - 0x1b8]
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x420], 0
je 0x10035a02
lea eax, [ebp - 0x3d0]
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x3d0]
dec eax
push eax
mov ecx, 0x10a224f0
call fcn.1002cc7e
push dword [eax]
push 0x10007b8c
call fcn.100549f9
pop ecx
pop ecx
jmp 0x100359ab
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
jmp 0x10035a19
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10035a35
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov dword [eax], 0xdd48
jmp 0x10035a12
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x34]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x10035a5c
mov dword [ebp - 0x308], 1
jmp 0x10035a63
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x308], eax
jle 0x10035a7a
mov dword [ebp - 0x298], 1
jmp 0x10035a81
and dword [ebp - 0x298], 0
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x298]
cmp ecx, dword [eax]
jge 0x10035aad
mov eax, 0xe48c0c84
test eax, eax
je 0x10035aad
mov dword [ebp - 0x460], 1
jmp 0x10035ab4
and dword [ebp - 0x460], 0
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x10035ad5
mov dword [ebp - 0x340], 1
jmp 0x10035adc
and dword [ebp - 0x340], 0
push 3
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [eax]
jl 0x10035aff
mov dword [ebp - 0x3d8], 1
jmp 0x10035b06
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x428], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x428]
mov dword [ebp + eax - 0x3a0], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x578], eax
mov eax, 0xce85
inc eax
cmp eax, dword [ebp - 0x34]
jne 0x10035b42
mov dword [ebp - 0x2a0], 1
jmp 0x10035b49
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2a0], eax
jl 0x10035b60
mov dword [ebp - 0x3e0], 1
jmp 0x10035b67
and dword [ebp - 0x3e0], 0
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
push 2
lea ecx, [ebp - 0x1b4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], eax
jg 0x10035bab
mov eax, 0x11659018
test eax, eax
je 0x10035bab
mov dword [ebp - 0x310], 1
jmp 0x10035bb2
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xee1e3c1d
jae 0x10035bd0
cmp dword [ebp - 0x34], 0
je 0x10035bd0
mov dword [ebp - 0x450], 1
jmp 0x10035bd7
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x10035bf4
mov dword [ebp - 0x3e8], 1
jmp 0x10035bfb
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x24], 0
je 0x10035c1c
cmp dword [ebp - 0x34], 0
je 0x10035c1c
mov dword [ebp - 0x2a8], 1
jmp 0x10035c23
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x20], eax
jmp 0x1003596c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call fcn.1002cbfb
jmp 0x10035587
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x10072670
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x430], 0
push 3
lea ecx, [ebp - 0x550]
call fcn.1002cb22
mov dword [ebp - 4], 5
mov dword [ebp - 0x20c], 0xfa8fad7
mov dword [ebp - 0xc8], 0
jmp 0x10035c9e
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10035cc0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x550]
call fcn.1002cc7e
mov dword [eax], 0xe0f758fc
jmp 0x10035c91
mov dword [ebp - 0x5c], 0
jmp 0x10035cd0
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff3
jne 0x10035f1c
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002cb22
mov byte [ebp - 4], 6
mov dword [ebp - 0x148], 0xe197e7c1
mov dword [ebp - 0x3f0], 6
mov dword [ebp - 0xd0], 0
jmp 0x10035d18
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x10035d3a
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
mov dword [eax], 0x7d7c118
jmp 0x10035d0b
cmp dword [ebp - 0x5c], 0
je 0x10035e78
cmp dword [ebp - 0x430], 0
jne 0x10035df0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
imul eax, dword [eax], 9
test eax, eax
je 0x10035d7a
cmp dword [ebp - 0x148], 0
je 0x10035d7a
mov dword [ebp - 0x1d8], 1
jmp 0x10035d81
and dword [ebp - 0x1d8], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d8]
je 0x10035da4
mov dword [ebp - 0x1e0], 1
jmp 0x10035dab
and dword [ebp - 0x1e0], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x1e0]
sub ecx, dword [eax]
jne 0x10035de3
cmp dword [ebp - 0x5c], 0
jne 0x10035de3
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10035de3
and dword [ebp - 0x1dc], 0
jmp 0x10035ded
mov dword [ebp - 0x1dc], 1
mov eax, dword [ebp - 0x5c]
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
cmp dword [eax], 0xaed1d25b
jne 0x10035e11
mov dword [ebp - 0x1ec], 1
jmp 0x10035e18
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1ec], eax
jne 0x10035e38
cmp dword [ebp - 0x148], 0
je 0x10035e38
mov dword [ebp - 0x1f4], 1
jmp 0x10035e3f
and dword [ebp - 0x1f4], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
mov esi, eax
imul edi, dword [ebp - 0x1f4], 0x639e
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
imul edi, dword [eax]
cmp dword [esi], edi
jne 0x10035e78
mov dword [ebp - 0x1fc], 1
jmp 0x10035e7f
and dword [ebp - 0x1fc], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x1fc]
cmp ecx, dword [eax]
jl 0x10035ea2
mov dword [ebp - 0x204], 1
jmp 0x10035ea9
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x148], eax
push 1
lea ecx, [ebp - 0x550]
call fcn.1002cc7e
mov dword [eax], 0x8ca8
mov dword [ebp - 0x20c], 0x8ca8
mov esi, dword [ebp - 0x20c]
push 1
lea ecx, [ebp - 0x1c4]
call fcn.1002cc7e
cmp esi, dword [eax]
jne 0x10035ef5
mov dword [ebp - 0x214], 1
jmp 0x10035efc
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c4]
call fcn.1002cbfb
jmp 0x10035cc9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x550]
call fcn.1002cbfb
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x30], 0xc58f5537
mov dword [ebp - 0x38], 0
jmp 0x10035f49
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xc
jne 0x100363a6
mov dword [ebp - 0x18], 0xc285ce96
mov dword [ebp - 0x52c], 0x4579
mov dword [ebp - 0x528], 0x4579
mov dword [ebp - 0x524], 0x4579
mov dword [ebp - 0x520], 0x4579
lea ecx, [ebp - 0x159]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x658]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1002cbd5
mov dword [ebp - 4], 7
mov dword [ebp - 0xd8], 0
jmp 0x10035fd7
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10035ff3
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x394], 0xfffffff8
jmp 0x10035fca
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], eax
je 0x1003600e
mov dword [ebp - 0x224], 1
jmp 0x10036015
and dword [ebp - 0x224], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x394]
cmp dword [ebp + eax - 0x394], ecx
jne 0x1003603c
mov dword [ebp - 0x47c], 1
jmp 0x10036043
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x594], eax
mov esi, dword [ebp - 0x38]
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x1003606c
mov dword [ebp - 0x21c], 1
jmp 0x10036073
and dword [ebp - 0x21c], 0
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [eax]
jg 0x10036096
mov dword [ebp - 0x22c], 1
jmp 0x1003609d
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x22c]
jg 0x100360b7
mov dword [ebp - 0x234], 1
jmp 0x100360be
and dword [ebp - 0x234], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x234], eax
jge 0x100360df
mov dword [ebp - 0x23c], 1
jmp 0x100360e6
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0xffffffff
je 0x100360fb
mov dword [ebp - 0x244], 1
jmp 0x10036102
and dword [ebp - 0x244], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x394]
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x244]
add ecx, dword [eax]
imul esi, ecx
mov dword [ebp - 0x24c], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp + eax - 0x394], ecx
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x1d
jmp 0x10036159
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe5
jl 0x10036392
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
jmp 0x1003617a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10036196
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov dword [eax], 0xdd48
jmp 0x10036173
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x100361bd
mov dword [ebp - 0x254], 1
jmp 0x100361c4
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x254], eax
jle 0x100361db
mov dword [ebp - 0x25c], 1
jmp 0x100361e2
and dword [ebp - 0x25c], 0
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [eax]
jge 0x1003620e
mov eax, 0xe48c0c84
test eax, eax
je 0x1003620e
mov dword [ebp - 0x3f8], 1
jmp 0x10036215
and dword [ebp - 0x3f8], 0
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x10036236
mov dword [ebp - 0x264], 1
jmp 0x1003623d
and dword [ebp - 0x264], 0
push 3
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [eax]
jl 0x10036260
mov dword [ebp - 0x438], 1
jmp 0x10036267
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x400], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0x394], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x59c], eax
mov eax, 0xce85
inc eax
cmp eax, dword [ebp - 0x28]
jne 0x100362a3
mov dword [ebp - 0x26c], 1
jmp 0x100362aa
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x26c], eax
jl 0x100362c1
mov dword [ebp - 0x458], 1
jmp 0x100362c8
and dword [ebp - 0x458], 0
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x28], eax
jg 0x1003630c
mov eax, 0x11659018
test eax, eax
je 0x1003630c
mov dword [ebp - 0x274], 1
jmp 0x10036313
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0xee1e3c1d
jae 0x10036331
cmp dword [ebp - 0x28], 0
je 0x10036331
mov dword [ebp - 0x408], 1
jmp 0x10036338
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jg 0x10036355
mov dword [ebp - 0x440], 1
jmp 0x1003635c
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x30], 0
je 0x1003637d
cmp dword [ebp - 0x28], 0
je 0x1003637d
mov dword [ebp - 0x27c], 1
jmp 0x10036384
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x18], eax
jmp 0x10036152
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d4]
call fcn.1002cbfb
jmp 0x10035f42
mov dword [ebp - 0x410], 0x2364
cmp dword [ebp - 0x410], 0xcd3
jge 0x10036488
lea eax, [ebp - 0x150]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x3b0], 0
je 0x10036488
lea eax, [ebp - 0x158]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
cmp dword [ebp - 0x158], 1
jl 0x10036420
push 0x10007f14
call fcn.100549f9
pop ecx
cmp dword [ebp - 0x158], 2
jl 0x10036434
push 0x10007f18
call fcn.100549f9
pop ecx
and dword [ebp - 0xe0], 0
jmp 0x1003644a
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
inc eax
inc eax
cmp eax, dword [ebp - 0x158]
jge 0x10036478
mov eax, dword [ebp - 0xe0]
add eax, 9
cdq
push 0xa
pop ecx
idiv ecx
push edx
push 0x10007b74
call fcn.100549f9
pop ecx
pop ecx
jmp 0x1003643d
push 0x10007add
call fcn.10054d82
pop ecx
jmp 0x100363d3
mov dword [ebp - 0x98], 0x3f467215
mov dword [ebp - 0x4f0], 1
mov dword [ebp - 0x4ec], 1
mov dword [ebp - 0x4e8], 1
mov dword [ebp - 0x4e4], 1
lea ecx, [ebp - 0x149]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x640]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5bc]
call fcn.1002cbd5
mov dword [ebp - 4], 8
mov eax, 0xfff8
test eax, eax
je 0x1003653b
mov eax, dword [ebp - 0x98]
imul ecx, dword [ebp - 0x98], 0x9c9f
lea eax, [eax + ecx + 0x7b04800f]
test eax, eax
je 0x1003653b
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x10036536
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x100366f7
mov dword [ebp - 0x3ac], 0x876a
mov dword [ebp - 0x98], 0
jmp 0x1003655e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x1b
jg 0x100366f7
mov dword [ebp - 0x4c], 0xb6bc3ec3
mov dword [ebp - 0x4c], 0
jmp 0x10036582
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x100366a2
mov dword [ebp - 0xe8], 0xffffffff
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x100365ae
jmp 0x100366a2
mov dword [ebp - 0xe8], 3
jmp 0x100365c7
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1003669d
push 3
lea ecx, [ebp - 0x46c]
call fcn.1002cb22
mov byte [ebp - 4], 9
mov dword [ebp - 0xa8], 0
jmp 0x100365fe
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10036620
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x46c]
call fcn.1002cc7e
mov dword [eax], 0xe665969a
jmp 0x100365f1
push 2
lea ecx, [ebp - 0x46c]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10036656
push 2
lea ecx, [ebp - 0x46c]
call fcn.1002cc7e
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x284]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x46c]
call fcn.1002cc7e
cmp dword [eax], 3
jg 0x10036689
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10036687
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10036632
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x46c]
call fcn.1002cbfb
jmp 0x100365ba
jmp 0x1003657b
mov dword [ebp - 0x4c], 0
jmp 0x100366b2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x100366f2
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xf0], 3
jmp 0x100366db
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x100366f0
mov dword [ebp - 0x3ac], 0xd5467356
jmp 0x100366ce
jmp 0x100366ab
jmp 0x10036551
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.1002cbfb
mov eax, dword [ebp - 0x2dc]
mov dword [0x10072880], eax
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x3bc], 0
push 3
lea ecx, [ebp - 0x568]
call fcn.1002cb22
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x2cc], 0xfa8fad7
mov dword [ebp - 0xf8], 0
jmp 0x10036759
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x1003677b
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x568]
call fcn.1002cc7e
mov dword [eax], 0xe0f758fc
jmp 0x1003674c
mov dword [ebp - 0x64], 0
jmp 0x1003678b
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff3
jne 0x100369d7
push 3
lea ecx, [ebp - 0x1a8]
call fcn.1002cb22
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x160], 0xe197e7c1
mov dword [ebp - 0x3c4], 6
mov dword [ebp - 0x100], 0
jmp 0x100367d3
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x100367f5
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
mov dword [eax], 0x7d7c118
jmp 0x100367c6
cmp dword [ebp - 0x64], 0
je 0x10036933
cmp dword [ebp - 0x3bc], 0
jne 0x100368ab
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
imul eax, dword [eax], 9
test eax, eax
je 0x10036835
cmp dword [ebp - 0x160], 0
je 0x10036835
mov dword [ebp - 0x28c], 1
jmp 0x1003683c
and dword [ebp - 0x28c], 0
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28c]
je 0x1003685f
mov dword [ebp - 0x294], 1
jmp 0x10036866
and dword [ebp - 0x294], 0
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x294]
sub ecx, dword [eax]
jne 0x1003689e
cmp dword [ebp - 0x64], 0
jne 0x1003689e
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x1003689e
and dword [ebp - 0x29c], 0
jmp 0x100368a8
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
cmp dword [eax], 0xaed1d25b
jne 0x100368cc
mov dword [ebp - 0x2a4], 1
jmp 0x100368d3
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x2a4], eax
jne 0x100368f3
cmp dword [ebp - 0x160], 0
je 0x100368f3
mov dword [ebp - 0x2ac], 1
jmp 0x100368fa
and dword [ebp - 0x2ac], 0
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
mov esi, eax
imul edi, dword [ebp - 0x2ac], 0x639e
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
imul edi, dword [eax]
cmp dword [esi], edi
jne 0x10036933
mov dword [ebp - 0x2bc], 1
jmp 0x1003693a
and dword [ebp - 0x2bc], 0
push 0
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x2bc]
cmp ecx, dword [eax]
jl 0x1003695d
mov dword [ebp - 0x2c4], 1
jmp 0x10036964
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x160], eax
push 1
lea ecx, [ebp - 0x568]
call fcn.1002cc7e
mov dword [eax], 0x8ca8
mov dword [ebp - 0x2cc], 0x8ca8
mov esi, dword [ebp - 0x2cc]
push 1
lea ecx, [ebp - 0x1a8]
call fcn.1002cc7e
cmp esi, dword [eax]
jne 0x100369b0
mov dword [ebp - 0x2d4], 1
jmp 0x100369b7
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x3c4], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1a8]
call fcn.1002cbfb
jmp 0x10036784
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.1002cbfb
mov eax, dword [ebp - 0x178]
mov dword [0x10072884], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x178]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax + ecx]
call fcn.100341d8
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x5e8], 0x16db6d03
mov dword [ebp - 0x5f0], 0xaf8b5131
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x10036a55
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x108], 0xfffffffc
jmp 0x10036a6e
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xfffffffc
jle 0x10036b12
mov dword [ebp - 0x5f8], 0x5223fa3a
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x608], 1
mov dword [ebp - 0x110], 0x82bdb979
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x110], eax
jge 0x10036abd
mov dword [ebp - 0x2e4], 1
jmp 0x10036ac4
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x2e4]
jle 0x10036ade
mov dword [ebp - 0x2ec], 1
jmp 0x10036ae5
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 1
jne 0x10036afa
mov dword [ebp - 0x2f4], 1
jmp 0x10036b01
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x110], eax
jmp 0x10036a61
mov dword [ebp - 0xa0], 0x3f467215
mov dword [ebp - 0x4c8], 1
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0x4c0], 1
mov dword [ebp - 0x4bc], 1
lea ecx, [ebp - 0x179]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5cc]
call fcn.1002cbd5
mov dword [ebp - 4], 0xc
mov eax, 0xfff8
test eax, eax
je 0x10036bc5
mov eax, dword [ebp - 0xa0]
imul ecx, dword [ebp - 0xa0], 0x9c9f
lea eax, [eax + ecx + 0x7b04800f]
test eax, eax
je 0x10036bc5
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10036bc0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10036e6c
mov dword [ebp - 0x3f4], 0x876a
mov dword [ebp - 0xa0], 0
jmp 0x10036be8
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x1b
jg 0x10036e6c
mov dword [ebp - 0x3c], 0xb6bc3ec3
mov dword [ebp - 0x3c], 0
jmp 0x10036c0c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10036d26
mov dword [ebp - 0x118], 0xffffffff
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x5cc]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10036c38
jmp 0x10036d26
mov dword [ebp - 0x118], 3
jmp 0x10036c51
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x10036d21
push 3
lea ecx, [ebp - 0x478]
call fcn.1002cb22
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x120], 0
jmp 0x10036c88
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x10036caa
push dword [ebp - 0x120]
lea ecx, [ebp - 0x478]
call fcn.1002cc7e
mov dword [eax], 0xe665969a
jmp 0x10036c7b
push 2
lea ecx, [ebp - 0x478]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10036ce0
push 2
lea ecx, [ebp - 0x478]
call fcn.1002cc7e
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2fc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x478]
call fcn.1002cc7e
cmp dword [eax], 3
jg 0x10036d0d
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x10036d0b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10036cbc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x478]
call fcn.1002cbfb
jmp 0x10036c44
jmp 0x10036c05
mov dword [ebp - 0x3c], 0
jmp 0x10036d36
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10036e67
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x3cc], 0x1b37
cmp dword [ebp - 0x3cc], 0x879
jge 0x10036e34
lea eax, [ebp - 0x168]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x3d4], 0
je 0x10036e34
lea eax, [ebp - 0x3a8]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
lea eax, [ebp - 0x3e4]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov dword [ebp - 0x170], 1
jmp 0x10036ddc
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x3a8]
jge 0x10036dff
lea eax, [ebp - 0x3ec]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
jmp 0x10036dcf
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jge 0x10036e19
mov dword [ebp - 0x304], 0x10007b98
jmp 0x10036e23
mov dword [ebp - 0x304], 0x10007b9c
push dword [ebp - 0x304]
call fcn.10054d82
pop ecx
jmp 0x10036d77
mov dword [ebp - 0x128], 3
jmp 0x10036e4d
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x10036e62
mov dword [ebp - 0x3f4], 0xd5467356
jmp 0x10036e40
jmp 0x10036d2f
jmp 0x10036bdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5cc]
call fcn.1002cbfb
push dword [ebp - 0x178]
mov edx, 0x10072614
mov ecx, dword [ebp - 0x3fc]
call fcn.100341e4
pop ecx
push 2
lea ecx, [ebp - 0x380]
call fcn.1002cb22
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x44], 0
jmp 0x10036eb6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10036ecc
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x404], 0x648261f
jmp 0x10036eaf
mov dword [ebp - 0x44], 0
jmp 0x10036edc
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10036ef8
push dword [ebp - 0x44]
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
mov dword [eax], 0xe19d29be
jmp 0x10036ed5
push 1
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10036f2e
push 1
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
cmp dword [eax], 1
jge 0x10036f5c
push 1
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x404], 0xe446df37
jmp 0x10036f0a
push 0
lea ecx, [ebp - 0x380]
call fcn.1002cc7e
mov dword [eax], 0xfffffffc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x380]
call fcn.1002cbfb
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x610], 0x16db6d03
mov dword [ebp - 0x5d8], 0xaf8b5131
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10036fbf
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x130], 0xfffffffc
jmp 0x10036fd8
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffc
jle 0x1003707c
mov dword [ebp - 0x5e4], 0x5223fa3a
mov dword [ebp - 0x574], 1
mov dword [ebp - 0x5d0], 1
mov dword [ebp - 0x138], 0x82bdb979
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x138], eax
jge 0x10037027
mov dword [ebp - 0x314], 1
jmp 0x1003702e
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x314]
jle 0x10037048
mov dword [ebp - 0x31c], 1
jmp 0x1003704f
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 1
jne 0x10037064
mov dword [ebp - 0x324], 1
jmp 0x1003706b
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x138], eax
jmp 0x10036fcb
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x344], 0xe75d5f8d
mov dword [ebp - 0x140], 0
jmp 0x100370a6
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x100370c2
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x55c], 0xec2e0cf5
jmp 0x10037099
mov dword [ebp - 0x60], 0
jmp 0x100370d2
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jg 0x10037178
mov dword [ebp - 0x11c], 0
jmp 0x100370f5
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x10037111
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x388], 0xbb11accb
jmp 0x100370e8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x388], 0
jmp 0x1003713f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x388]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x388], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x388], 2
jg 0x10037173
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x10037171
push 0
push 0x158c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x10037124
jmp 0x100370cb
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x55c]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x60]
add eax, 8
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x60], eax
jl 0x100371b4
mov dword [ebp - 0x334], 1
jmp 0x100371bb
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x55c]
mov dword [ebp - 0x32c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0x55c], ecx
mov eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x334]
cmp eax, 0xb82c4475
jae 0x10037200
mov dword [ebp - 0x33c], 1
jmp 0x10037207
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x344], eax
mov esi, 0x10072880
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret