Function at 0x10036773
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov eax, 0x1007132b
call fcn.10070238
sub esp, 0x244
push ebx
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x20], edi
xor esi, esi
mov byte [ebp - 0x38], dl
mov dword [ebp - 0x40], ecx
inc esi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x12
jne 0x100367de
mov dword [ebp - 0x1c], 0x1f665683
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x100367d3
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], ebx
jmp 0x100367ca
mov dword [ebp - 0x28], 0xa971
cmp dword [ebp - 0x28], ebx
jne 0x100367d0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
jne 0x100367bb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
je 0x100367b3
inc dword [ebp - 0x20]
jmp 0x1003679d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100367f4
push 0x1f7c
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x20], 0xfffffffa
push esi
call fcn.1001795c
mov dword [ebp - 0x24], 0x30688cdf
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003683f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0xf7d1649b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036831
mov dword [ebp - 0x14], ebx
jmp 0x10036858
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10036849
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
mov dword [ebp - 0x48], eax
setne cl
cmp ecx, dword [ebp - 0x20]
je 0x10036875
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0xb0]
mov ecx, 0xffff
setl dl
add edx, 0x7f03
push 3
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0xfffc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov edx, dword [ebp - 0x1c]
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 0xffffeb4a
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xad479ea5
cmp edx, eax
setne cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edi
pop edi
setg cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x37
jle 0x10036a28
mov dword [ebp - 0x44], 0x9a26
mov dword [ebp - 0x1c], 0xfd77138b
mov dword [ebp - 0x34], 0x1b6befc5
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x1003693b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
dec dword [ebp - 0x24]
jns 0x10036924
mov dword [ebp - 0x24], 6
jmp 0x10036a16
mov dword [ebp - 0x14], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
cmp eax, 0x8a61
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x52f52174
setle al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x28], eax
setge cl
cmp dword [ebp - 0x44], ecx
jne 0x10036997
mov eax, ebx
cmp dword [ebp - 0x48], ebx
je 0x10036999
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, edi
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x14]
je 0x100369b2
cmp dword [ebp - 0x34], ebx
jne 0x10036a20
jmp 0x10036a04
mov dword [ebp - 0x1c], ebx
jmp 0x100369fe
mov eax, 0x790eb5cf
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x14], 0xfffffff6
jmp 0x100369ef
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100369ec
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jge 0x100369dd
mov eax, dword [ebp - 0x154]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x3a
jne 0x100369b7
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036a13
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
jle 0x10036947
inc dword [ebp - 0x20]
jmp 0x100368fd
lea ecx, [ebp - 0xb0]
call fcn.100179de
push 4
lea ecx, [ebp - 0x150]
call fcn.1001795c
mov dword [ebp - 0x14], ebx
jmp 0x10036a54
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
push 4
pop ecx
cmp dword [ebp - 0x14], ecx
jl 0x10036a45
mov dword [ebp - 0x14], ebx
jmp 0x10036a72
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x144], 0xf47a6d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10036a61
mov dword [ebp - 0x14], ebx
jmp 0x10036a89
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x214], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036a7c
mov dword [ebp - 0x14], ebx
jmp 0x10036aa4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x198], 0x9cd4431f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036a93
mov dword [ebp - 0x14], ebx
jmp 0x10036ac0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0xa7b445ac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10036aaf
mov edx, dword [ebp - 0x150]
mov eax, ecx
sub eax, dword [edx + 8]
mov dword [ebp - 0x140], eax
jne 0x10036b1b
cmp dword [ebp - 0x140], ebx
jne 0x10036af6
mov edx, dword [edx + 8]
xor ecx, ecx
mov eax, dword [ebp - 0x13c]
cmp eax, edx
mov eax, ebx
setne cl
add ecx, edx
je 0x10036af8
mov eax, esi
imul ecx, eax, 0xfffe
xor edx, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x194]
cmp ecx, eax
mov eax, ebx
setne dl
cmp edx, 0x393e75cb
jge 0x10036b1d
mov eax, esi
imul eax, eax, 0xafa0
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036b38
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea ecx, [ebp - 0x150]
call fcn.100179de
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x16c]
push 2
call fcn.1001795c
mov dword [ebp - 0x20], ebx
jmp 0x10036b69
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1e0], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10036b58
mov dword [ebp - 0x20], ebx
jmp 0x10036b83
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x16c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036b73
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036b9c
push 0x407
call dword [sym.imp.GDI32.dll_UpdateColors]
mov dword [ebp - 0x24], ebx
jmp 0x10036bc9
mov dword [ebp - 0x1c], 0xffffffff
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
jmp 0x10036bc1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e0], 0xcc14173b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036bb0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10036ba1
lea ecx, [ebp - 0x16c]
call fcn.100179de
mov eax, dword [ebp + 8]
mov ecx, dword [0x100778ac]
mov dword [ebp - 0x44], ecx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
cmp byte [ebp - 0x38], bl
je 0x10036ed2
cmp ecx, esi
jne 0x10036ed2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
jmp 0x10036c1b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc4], 0xc92ea21e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036c0a
mov dword [ebp - 0x20], ebx
jmp 0x10036c37
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x204], 0x7142b622
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10036c26
mov dword [ebp - 0x1c], 0x1b
jmp 0x10036d4d
mov dword [ebp - 0x20], 0x9737e0d1
lea ecx, [ebp - 0x120]
push esi
call fcn.1001795c
mov dword [ebp - 0x24], ebx
jmp 0x10036c73
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xe018ebdb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10036c60
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
shl eax, 2
test eax, eax
jne 0x10036c8c
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x10036c8e
mov eax, esi
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0xc4], edx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
cmp ecx, 0x1d9
jl 0x10036cb2
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x10036cb4
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
cmp eax, dword [ebp - 0x1c]
jle 0x10036cc5
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x120]
mov dword [eax], edx
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
mov byte [ebp - 0x15], bl
xor edx, edx
cmp ecx, 0xe10d32de
setne dl
add eax, 0x7b400765
add eax, edx
je 0x10036d10
cmp byte [ebp - 0x15], bl
je 0x10036d2f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10036d2f
cmp byte [ebp - 0x15], bl
je 0x10036d23
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
jne 0x10036e39
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036d3f
push ebx
push ebx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea ecx, [ebp - 0x120]
call fcn.100179de
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
jle 0x10036c48
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xa4]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009040]
mov dword [ebp - 0x24], esi
mov dword [eax + 8], 4
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1c], 0xceafd94f
push eax
mov dword [ebp - 0x20], 0x7865e1b
mov dword [ebp - 0x28], 0xbd76df3e
push ebx
movdqu xmmword [ebp - 0x1c8], xmm0
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
call fcn.1001a9f7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0xf506
cmp dword [ebp - 0x1c], ebx
jne 0x10036e16
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
sub edx, 0x7dd34c5d
cmp edx, 0xfffffff6
setg al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, 0xed45b0e8
mov ecx, ebx
jb 0x10036e18
mov ecx, esi
mov eax, dword [ebp - 0x24]
add eax, ecx
je 0x10036e44
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036ebd
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x10036ebd
push 0xaf5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x2c], 0xfffffff7
cmp dword [ebp - 0x24], ebx
je 0x10036e6f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0xffff5062
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
mov eax, esi
jne 0x10036e71
mov eax, ebx
xor ecx, ecx
add eax, 0x9b88
cmp eax, 0xfffffffc
setge cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x8c53
setl cl
xor eax, eax
cmp ecx, 0xffff8148
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x69d1fe9
setle cl
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa4]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xa4]
call fcn.100179de
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x100778ac
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x184]
push 2
call fcn.1001795c
mov dword [ebp - 0x20], ebx
jmp 0x10036ef8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f8], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10036ee7
mov dword [ebp - 0x20], ebx
jmp 0x10036f12
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x184]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036f02
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036f2b
push 0x407
call dword [sym.imp.GDI32.dll_UpdateColors]
mov dword [ebp - 0x24], ebx
jmp 0x10036f58
mov dword [ebp - 0x1c], 0xffffffff
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
jmp 0x10036f50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f8], 0xcc14173b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036f3f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10036f30
lea ecx, [ebp - 0x184]
call fcn.100179de
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x100379a4
mov dword [ebp - 0x2c], 0xfffffffb
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x106ec6e5
mov dword [ebp - 0x1c], 0x96f377cc
push 2
mov dword [ebp - 0x20], 0x100778b0
call fcn.1001795c
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0xffffffff
push esi
call fcn.1001795c
mov dword [ebp - 0x14], 0x2d14b432
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10036fdc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0x17d1dc6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036fc9
mov dword [ebp - 0x14], ebx
jmp 0x10036ff8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0xffb9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10036fe7
mov dword [ebp - 0x14], ebx
jmp 0x10037015
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0x4380d33b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10037002
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x2c]
test eax, eax
je 0x10037037
mov eax, dword [ebp - 0x2c]
mov ecx, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x10037039
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10037069
inc dword [ebp - 0x18c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], eax
mov eax, esi
je 0x1003706b
mov eax, ebx
add eax, ecx
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x138]
setg dl
xor ecx, ecx
mov dword [eax], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, esi
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x138]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.100179de
cmp dword [ebp - 0x40], 0
mov dword [ebp - 0x28], ebx
jle 0x10037563
push 4
lea ecx, [ebp - 0xf0]
call fcn.1001795c
mov dword [ebp - 0x14], ebx
jmp 0x100370e3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
push 4
pop ecx
cmp dword [ebp - 0x14], ecx
jl 0x100370d4
mov dword [ebp - 0x14], ebx
jmp 0x10037101
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], 0xf47a6d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100370f0
mov dword [ebp - 0x14], ebx
jmp 0x10037118
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x234], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003710b
mov dword [ebp - 0x14], ebx
jmp 0x10037133
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a8], 0x9cd4431f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10037122
mov dword [ebp - 0x14], ebx
jmp 0x1003714f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ec], 0xa7b445ac
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003713e
mov edx, dword [ebp - 0xf0]
mov eax, ecx
sub eax, dword [edx + 8]
mov dword [ebp - 0x110], eax
jne 0x100371aa
cmp dword [ebp - 0x110], ebx
jne 0x10037185
mov edx, dword [edx + 8]
xor ecx, ecx
mov eax, dword [ebp - 0x10c]
cmp eax, edx
mov eax, ebx
setne cl
add ecx, edx
je 0x10037187
mov eax, esi
imul ecx, eax, 0xfffe
xor edx, edx
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x1a4]
cmp ecx, eax
mov eax, ebx
setne dl
cmp edx, 0x393e75cb
jge 0x100371ac
mov eax, esi
imul eax, eax, 0xafa0
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100371c8
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea ecx, [ebp - 0xf0]
call fcn.100179de
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xfc]
push 2
pop edi
push edi
mov eax, dword [eax]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], eax
call fcn.1001795c
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x34], 0x3e8e1b88
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xd9bacc5d
mov dword [ebp - 0x4c], 0xf934f545
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], 0xcfce2949
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
push edi
call fcn.1001795c
mov dword [ebp - 0x2c], 0x6a76
mov dword [ebp - 0x8c], 0xa2ef
mov dword [ebp - 0x14], ebx
jmp 0x10037257
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10037244
mov dword [ebp - 0x14], ebx
jmp 0x1003726b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10037261
mov dword [ebp - 0x14], ebx
jmp 0x10037288
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10037275
mov edi, ebx
cmp dword [ebp - 0x24], ebx
je 0x10037296
mov edi, esi
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
jne 0x100372b0
mov ecx, ebx
cmp dword [ebp - 0x8c], ebx
je 0x100372b2
mov ecx, esi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x12c]
setge cl
cmp ecx, dword [eax]
je 0x100372d3
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x2c]
xor edx, edx
imul ecx, dword [ebp - 0x34], 0x4b58
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
cmp esi, edx
sbb edx, edx
add eax, edi
neg edx
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, 0xfffffffa
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003731f
push 0x16fb
push ebx
push ebx
push ebx
push ebx
push 0xdeb
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x12c]
call fcn.100179de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.100179de
mov eax, dword [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x20], eax
mov edi, dword [eax]
mov dword [ebp - 0x30], 0x175b
cmp dword [ebp - 0x30], 0xb58
mov dword [ebp - 0x4c], edi
jge 0x100373e6
push 0x10926d78
push 0x10007e48
call fcn.10057cab
mov eax, dword [0x10926d78]
mov dword [ebp - 0x30], ebx
pop ecx
pop ecx
test eax, eax
jle 0x10037399
mov edi, 0x10926d80
push edi
push 0x10007e48
call fcn.10057cab
mov eax, dword [0x10926d78]
inc ebx
pop ecx
add edi, 4
pop ecx
cmp ebx, eax
jl 0x1003737d
xor ebx, ebx
lea edx, [eax*4 + 0x10926d80]
mov byte [ebp - 0x84], bl
push dword [ebp - 0x84]
mov eax, edx
mov ecx, 0x10926d80
sub eax, ecx
sar eax, 2
push eax
call fcn.100360ab
pop ecx
pop ecx
mov edi, esi
mov ecx, edi
call fcn.10036749
test al, al
je 0x100373da
push edi
push 0x100080d8
call fcn.10058109
pop ecx
pop ecx
inc edi
cmp edi, 0x9e
jl 0x100373c2
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037408
push 0x85c
push ebx
push 0x1990
push 0x140
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10037418
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x1003742b
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xd4e06482
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x1c], 0xb
jmp 0x10037460
mov dword [ebp - 0x34], 0x46df37d4
dec dword [ebp - 0x34]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
jne 0x10037453
mov dword [ebp - 0x1c], 0xffffffe8
cmp dword [ebp - 0x1c], 0xf
push 3
pop edi
jne 0x1003754b
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1003749a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98], 0xba07e4fc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037489
mov dword [ebp - 0x94], ebx
jmp 0x1003752b
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x1c], ebx
je 0x10037504
mov dword [ebp - 0x30], ebx
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
jmp 0x100374fc
mov dword [ebp - 0x14], ebx
jmp 0x100374d3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4], 0x9725
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100374c2
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100374f9
push ebx
push ebx
push 0xb4d
push 0xf23
push 0xa8c
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x26
jl 0x100374bd
jmp 0x10037525
mov dword [ebp - 0x14], ebx
jmp 0x10037520
mov dword [ebp - 0x30], 0xfffffffe
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd4]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10037509
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], 0x18
jge 0x100374aa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
je 0x1003747a
mov eax, dword [ebp - 0x20]
xor esi, esi
inc esi
add eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
cmp ecx, dword [ebp - 0x40]
jl 0x100370c2
jmp 0x10037568
mov eax, 0x100778b0
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0x1c], 0x5d6c05ba
mov dword [ebp - 0x3c], 0xb653b1da
mov dword [ebp - 0x1c], 0x16
cmp dword [ebp - 0x1c], 0xd
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
je 0x10037634
push 3
pop edx
mov dword [ebp - 0x24], ebx
jmp 0x100375ab
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1003759d
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0x6c], 0xfffffff9
jne 0x10037627
mov dword [ebp - 0x2c], 0x7249aaed
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
push 3
sbb ecx, ecx
inc ecx
sub eax, ecx
xor ecx, ecx
cmp eax, 8
mov eax, dword [ebp - 0x1c]
setge cl
cmp edx, eax
sbb eax, eax
inc eax
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 3
pop edx
setne al
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0xfffffff9
je 0x100375b9
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
jne 0x10037598
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003764f
push ebx
push 0x1dd8
push ebx
push 0x2047
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x40], 0x6007
cmp dword [ebp - 0x40], 0x618f
mov dword [ebp - 0x2c], eax
jle 0x100376be
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x34], ebx
mov esi, eax
mov dword [ebp - 0x28], 0x5b64
mov dword [ebp - 0x3c], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10618818
xor eax, edi
cdq
push edx
push eax
call fcn.10017642
inc ebx
cmp ebx, 0x31df
jl 0x1003767a
dec esi
dec dword [ebp - 0x28]
push 0
pop ebx
jne 0x10037677
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x4eec
jl 0x1003766e
inc edi
cmp edi, 0x6d2f
jl 0x10037669
mov edi, dword [ebp - 0x14]
xor esi, esi
inc esi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x40], 0x5f1a
jge 0x100376dd
mov edx, 0x10008820
mov ecx, 0x10618818
call fcn.1001a339
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 0x6045
cmp dword [ebp - 0x34], 0x633b
jle 0x10037751
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
cdq
idiv ecx
lea ecx, [ebp - 0x24c]
mov eax, edx
cdq
push edx
push eax
call fcn.1000a64e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037717
mov eax, dword [eax]
push eax
call fcn.10058109
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x24c]
call fcn.10018112
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x3cc8
jl 0x100376f8
inc edi
cmp edi, 0x19ff
jl 0x100376f3
push 0xe6b
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x5596960f
cmp dword [ebp - 0x34], 0x5e81
jge 0x1003776c
push 0x10008868
call fcn.10058109
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1a8]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009010]
lea ecx, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x80], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x1b8], xmm0
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.1001a9f7
mov dword [ebp - 0x1c], ebx
jmp 0x100377ea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x178], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100377d9
push 2
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x10037805
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100377f8
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x100378ac
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0xc3c39ba0
mov dword [ebp - 0x28], 0xdc53
mov dword [ebp - 0x3c], 0x3a60
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jle 0x1003784d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ecx + 0xc], 9
test eax, eax
jne 0x10037862
mov eax, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10037864
mov eax, esi
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x14
jne 0x100378a3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003788d
push 0xa8b
push 0x1235
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x178]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x14
je 0x10037873
mov ecx, dword [ebp - 0x30]
dec dword [ebp - 0x1c]
jns 0x1003781c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100378cd
push ebx
push ebx
push 0x1345
push 0x1158
push ebx
push 0x162e
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
lea ecx, [ebp - 0x80]
call fcn.100179de
cmp dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x20]
jne 0x100379a1
cmp byte [ebp - 0x38], 0
je 0x100378f6
cmp dword [ebp - 0x44], esi
jne 0x100378f6
mov edx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx + 8]
add ecx, 0xc
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], ecx
call fcn.10053321
pop ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], ebx
push eax
push edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
call fcn.1003b1ef
mov eax, dword [ebp - 0x14]
mov edi, ebx
mov ecx, dword [ebp - 0x5c]
test eax, eax
jle 0x10037982
mov eax, edi
and eax, 0x80000001
jns 0x1003794b
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x3c]
add eax, edi
add eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x30]
jmp 0x10037960
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x14]
cmp word [ecx + edx*2], bx
jne 0x1003795d
mov eax, dword [ebp - 0x20]
mov word [ecx + edx*2], si
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x28]
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x14]
cmp edi, eax
jl 0x1003793d
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov dword [edx + 4], eax
test ecx, ecx
je 0x100379a1
push ecx
call fcn.100582d9
pop ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push 3
pop edi
push esi
lea ecx, [ebp - 0x68]
call fcn.1001795c
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x28], 0xa94b2ab7
push edi
call fcn.1001795c
mov dword [ebp - 0x28], 0x77045b36
or edx, 0xffffffff
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jge 0x100379ee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
jmp 0x100379db
mov dword [ebp - 0x14], ebx
jmp 0x10037a02
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100379f3
mov dword [ebp - 0x14], ebx
jmp 0x10037a19
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x224], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10037a0c
mov eax, dword [ebp - 0x68]
cmp dword [eax], ebx
jne 0x10037a5a
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp dword [eax + 4], ebx
setg cl
mov dword [eax], ecx
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
add ecx, dword [eax]
jne 0x10037a50
mov eax, dword [ebp - 0xbc]
cmp dword [eax + 8], ebx
mov eax, ebx
je 0x10037a52
mov eax, esi
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x10037a5c
mov ebx, esi
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp ebx, dword [eax]
sete cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
shl ecx, 2
sub edx, ecx
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x21c], edx
call fcn.100179de
lea ecx, [ebp - 0x68]
call fcn.100179de
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret