Function at 0x10034a62
Capabilities:
Extract resource via kernel32 functions
Get file system object information
Get session user name
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065599
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x308
mov dword [esp + 0x4c], ecx
mov eax, 0xc7a0
push ebx
xor ebx, ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 8
mov dword [esp + 0x20], 0x6951ad38
mov dword [esp + 0x20], ebx
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
mov byte [esp + 0x13], bl
push esi
push edi
cmp byte [esp + 0x1b], bl
je 0x10034ada
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
inc dword [esp + 0x224]
lea ecx, [esp + 0xac]
push 3
pop esi
push esi
call fcn.100248e9
mov dword [esp + 0x31c], ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x10], 0xb000
push 1
call fcn.100248e9
xor edx, edx
inc edx
mov byte [esp + 0x31c], dl
mov dword [esp + 0x34], 0x826f3938
mov dword [esp + 0xc], ebx
jmp 0x10034b36
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x70], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10034b26
mov dword [esp + 0xc], ebx
jmp 0x10034b58
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10034b42
mov dword [esp + 0xc], ebx
jmp 0x10034b7a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0xcaa8e55a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10034b64
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034cd9
mov dword [esp + 0x1c], 0x1dfc
cmp dword [esp + 0x1c], 0xa4d
jge 0x10034cce
lea eax, [esp + 0x1e8]
mov ecx, 0x10655530
push eax
call fcn.10024266
mov edi, dword [esp + 0x1e8]
cmp edi, 5
jg 0x10034bdb
push 0xffffffffffffffff
mov ecx, 0x10655478
call fcn.10024597
push eax
call fcn.100287b2
pop ecx
jmp 0x10034c99
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
cmp edi, eax
jl 0x10034c99
push 2
pop esi
mov ebx, eax
cmp esi, edi
jg 0x10034c20
push esi
push ecx
push ebx
mov ecx, 0x10655478
call fcn.10024597
mov dl, 0x20
mov ecx, eax
call fcn.10037b6e
pop ecx
mov ecx, eax
call fcn.10024597
push eax
call fcn.100287b2
mov eax, dword [esp + 0x18]
pop ecx
inc eax
inc esi
mov dword [esp + 0x14], eax
cmp esi, edi
jg 0x10034c53
push esi
push ecx
push ebx
mov ecx, 0x10655478
call fcn.10024597
mov dl, 0x20
mov ecx, eax
call fcn.10037b6e
pop ecx
mov ecx, eax
call fcn.10024597
push eax
call fcn.100287b2
mov eax, dword [esp + 0x18]
pop ecx
inc eax
inc esi
mov dword [esp + 0x14], eax
cmp esi, edi
jg 0x10034c86
push esi
push ecx
push ebx
mov ecx, 0x10655478
call fcn.10024597
mov dl, 0x20
mov ecx, eax
call fcn.10037b6e
pop ecx
mov ecx, eax
call fcn.10024597
push eax
call fcn.100287b2
mov eax, dword [esp + 0x18]
pop ecx
inc eax
add ebx, 3
inc esi
mov dword [esp + 0x14], eax
cmp eax, edi
jle 0x10034bf3
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
jle 0x10034cce
lea esi, [eax + 1]
push esi
push ecx
push eax
mov ecx, 0x10655478
call fcn.10024597
mov dl, 0x20
mov ecx, eax
call fcn.10037b6e
pop ecx
mov ecx, eax
call fcn.10024597
push eax
call fcn.100287b2
mov eax, esi
pop ecx
cmp eax, edi
jl 0x10034ca0
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
inc edx
mov esi, dword [esp + 0xac]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi], ebx
mov eax, dword [esi]
cmp dword [esp + eax*4 + 0x70], edx
jl 0x10034d5c
mov dword [esp + 0x20], 0x39f5fa31
cmp dword [esp + 0x10], ebx
je 0x10034d3a
mov eax, dword [esp + 0xac]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x70]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xac]
mov ecx, dword [eax]
mov eax, dword [esp + 0x90]
mov dword [eax], ecx
imul eax, dword [esp + 0x10], 0xcbe9
add eax, 0xfaeb
cmp eax, dword [esp + 0x70]
mov eax, edx
je 0x10034d3c
mov eax, ebx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x90]
mov dword [ecx], eax
jmp 0x10034d86
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034d7f
push 0x2163
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor edx, edx
inc edx
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0xac]
cmp dword [ecx], ebx
jne 0x10034d99
dec dword [esi]
jns 0x10034ce8
push ecx
call fcn.1004d337
or dword [esp + 0x320], 0xffffffff
pop ecx
push esi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
call fcn.1004d337
mov eax, dword [0x10f86140]
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
pop ecx
test al, 1
jne 0x10034e80
or eax, 1
mov dword [0x10f86140], eax
push ebx
mov dword [esp + 0x320], 2
push ebx
mov dword [0x10f86120], ebx
mov dword [0x10f86124], ebx
call fcn.1003780d
mov dword [0x10f86120], eax
mov dword [0x10f86128], ebx
mov dword [0x10f86130], ebx
mov byte [esp + 0x31c], 4
mov ecx, 0x10f86128
mov dword [esp + 0x1bc], eax
lea eax, [esp + 0x1bc]
push eax
push 0x10
push ebx
lea eax, [esp + 0x25c]
mov dword [0x10f8613c], 0x3f800000
push eax
mov dword [0x10f8612c], ebx
call fcn.100375e5
push 0x10065ca5
mov dword [0x10f86134], 7
mov dword [0x10f86138], 8
call fcn.1004d19e
or dword [esp + 0x320], 0xffffffff
pop ecx
mov dword [esp + 0xc], 0x2eac
mov dword [esp + 0x20], 0xb4e
mov dword [esp + 0x3c], 0x8c9a
mov dword [esp + 0x1c], 0x3047
mov dword [esp + 0x24], 0x835a7ab5
mov dword [esp + 0x10], 0x3ea3
mov dword [esp + 0x34], 0xdb553a81
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
push 3
mov dword [esp + 0x84], ebx
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10034ee7
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x234], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10034ed4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
dec dword [esp + 0x10]
cmp eax, ecx
jg 0x10034f02
xor esi, esi
inc esi
jmp 0x10034f04
mov esi, ebx
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x238]
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xe88b1495
setne al
xor ecx, ecx
cmp eax, 0x6864
setge cl
sub esi, ecx
imul esi, dword [esp + 0x7c]
mov dword [esp + 0x7c], esi
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jg 0x10034fd1
xor edx, edx
inc edx
mov eax, dword [esp + 0x234]
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x74], ebx
je 0x10034f75
mov ecx, edx
cmp dword [esp + 0x7c], ebx
jne 0x10034f77
mov ecx, ebx
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x234], ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x74], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x10034f5c
imul eax, dword [esp + 0x58], 0x2710
add eax, dword [esp + 0x40]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
push eax
call fcn.10036db7
push 3
pop ecx
mov esi, dword [eax]
mov dword [esp + 0x14], 0xcd453606
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x34], esi
mov dword [esp + 0x14], ebx
jmp 0x10035023
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1ec], 0xae35
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10035010
push 2
pop edx
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x1003517d
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], 0x91a83acd
mov dword [esp + 0x1c], 0x3fde7504
mov dword [esp + 0xc], ebx
jmp 0x10035067
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x108], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10035058
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x1ec]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], ebx
jmp 0x10035166
mov dword [esp + 0x1c], 0x1c3d076c
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x10], ebx
jmp 0x100350ae
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b4], 0x13072c02
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003509b
cmp dword [esp + 0xc], ebx
je 0x100350c9
cmp dword [esp + 0x10c], ebx
je 0x100350c9
xor ecx, ecx
inc ecx
jmp 0x100350cb
mov ecx, ebx
mov eax, dword [esp + 0x1f4]
imul eax, ecx
push 2
mov dword [esp + 0x2c0], eax
mov eax, dword [esp + 0x110]
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x1f0]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x1f4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
dec eax
cmp edx, eax
setg cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 2
mov eax, dword [esp + 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + eax*4 + 0x1f0]
mov eax, dword [esp + 0x20]
cmp eax, 0xfffffffc
setne cl
xor eax, eax
cmp edx, ecx
pop edx
sete al
mov dword [esp + 0x24], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jle 0x10035085
dec dword [esp + 0x14]
jns 0x1003503a
push 3
pop ecx
test esi, esi
je 0x10035356
mov dword [esp + 0xc], 0xfffffffd
mov dword [esp + 0x24], 0x270f
cmp dword [esp + 0x24], 0x636
jge 0x10035278
lea eax, [esp + 0x110]
push eax
push ecx
lea eax, [esp + 0x220]
mov ecx, 0x10655530
push eax
call fcn.10036adc
pop ecx
mov ecx, eax
call fcn.10036adc
mov esi, dword [esp + 0x218]
xor edx, edx
mov edi, dword [esp + 0x21c]
inc edx
add esi, edx
mov eax, edx
mov ecx, ebx
adc edi, ebx
cmp edi, dword [esp + 0x114]
jg 0x10035257
jl 0x100351f3
cmp esi, dword [esp + 0x110]
ja 0x10035257
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
push ebx
push 0xa
push edi
push esi
call fcn.100641d0
push dword [esp + 0x20]
push dword [esp + 0x20]
push edx
push eax
call fcn.10051010
push ebx
mov ecx, edx
mov dword [esp + 0x28], eax
push 0xa
push ecx
push eax
mov dword [esp + 0x4c], ecx
call fcn.100641d0
mov ecx, eax
mov dword [esp + 0x1c], eax
or ecx, edx
mov dword [esp + 0x20], edx
je 0x1003524f
add esi, 1
adc edi, ebx
cmp edi, dword [esp + 0x114]
jl 0x100351fb
jg 0x1003524f
cmp esi, dword [esp + 0x110]
jbe 0x100351fb
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
push ebx
push 0xa
push ecx
push eax
call fcn.100641d0
push edx
push eax
mov ecx, 0x10655478
call fcn.100246a9
push eax
call fcn.100287b2
mov esi, dword [esp + 0x38]
pop ecx
xor edi, edi
inc edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], 0x4549c4b
mov dword [esp + 0x1c], 6
mov dword [esp + 0x10], ebx
jmp 0x100352a5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], 0x7ce53d8d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10035295
mov eax, dword [esp + 0xc]
xor ebx, ebx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add ecx, 0x50fa
cmp ecx, eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [esp + 0xc]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, dword [esp + 0x38]
jl 0x1003530a
mov eax, dword [esp + 0xc]
dec dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], edi
mov dword [esp + 0x1fc], esi
jmp 0x10036a9b
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebx
jmp 0x1003537a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x254], 0xec0ae971
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10035367
mov dword [esp + 0x14], ebx
jmp 0x100353a4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x254]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x254], ecx
mov eax, dword [esp + 0x24]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10035386
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100353c7
push ebx
push 0x442
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 2
pop edx
mov eax, dword [0x10f86140]
test al, 2
jne 0x1003546d
or eax, edx
mov dword [0x10f86140], eax
push ebx
mov dword [esp + 0x320], 5
push ebx
mov dword [0x10f86100], ebx
mov dword [0x10f86104], ebx
call fcn.1003780d
mov dword [0x10f86100], eax
mov dword [0x10f86108], ebx
mov dword [0x10f86110], ebx
mov byte [esp + 0x31c], 7
mov ecx, 0x10f86108
mov dword [esp + 0x1d0], eax
lea eax, [esp + 0x1d0]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1e8]
mov dword [0x10f8611c], 0x3f800000
push eax
mov dword [0x10f8610c], ebx
call fcn.100375e5
push 0x10065ca0
mov dword [0x10f86114], 7
mov dword [0x10f86118], 8
call fcn.1004d19e
or dword [esp + 0x320], 0xffffffff
pop ecx
lea eax, [esp + 0x58]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x1b0], xmm0
call fcn.10036e19
push dword [esp + 0x1dc]
movdqa xmm0, xmmword [0x100087a0]
lea ecx, [esp + 0x68]
movdqu xmmword [esp + 0x29c], xmm0
mov esi, dword [eax]
lea eax, [esp + 0x2ac]
push eax
lea eax, [esp + 0x2a0]
mov dword [esp + 0x1c], 0x76820624
push eax
push ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.100293d1
mov dword [esp + 0x31c], 8
mov dword [esp + 0x14], 0x15
cmp dword [esp + 0x14], 0x13
je 0x10035812
push 2
lea ecx, [esp + 0xc0]
call fcn.100248e9
mov byte [esp + 0x31c], 9
mov dword [esp + 0x24], 0xd9796a0b
mov dword [esp + 0x24], 0x20ce
cmp dword [esp + 0x24], 0xe05
jge 0x100356a9
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xe4]
push eax
push 0x10008380
call fcn.1004cd7b
add esp, 0x14
mov dword [esp + 0x1c8], ebx
lea eax, [esp + 0x1c8]
mov dword [esp + 0x140], ebx
lea ecx, [esp + 0x140]
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
push eax
push dword [esp + 0x54]
call fcn.1002522b
mov byte [esp + 0x31c], 0xa
mov esi, ebx
cmp dword [esp + 0x50], 0
mov edi, dword [esp + 0x140]
jle 0x100355d8
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x1e8]
push eax
push 0x100080f8
call fcn.1004cd7b
mov ecx, dword [esp + 0x1f0]
add esp, 0xc
mov eax, dword [esp + 0x1e0]
dec ecx
imul ecx, dword [esp + 0xc8]
dec eax
add eax, ecx
mov dword [edi + esi*4], eax
inc esi
cmp esi, dword [esp + 0x50]
jl 0x10035597
push dword [esp + 0x144]
push edi
call fcn.10028a04
cmp dword [esp + 0xf0], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x10035695
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x1fc]
push eax
push 0x100080f8
call fcn.1004cd7b
mov ecx, dword [esp + 0x204]
add esp, 0xc
mov eax, dword [esp + 0x1c0]
dec ecx
imul ecx, dword [esp + 0xc8]
dec eax
add ecx, eax
cmp dword [esp + 0x50], 0
mov eax, ebx
jle 0x10035643
cmp dword [edi + eax*4], ecx
jge 0x10035646
inc eax
cmp eax, dword [esp + 0x50]
jl 0x10035637
cmp dword [edi + eax*4], ecx
jne 0x1003564f
push 0x10008394
jmp 0x10035681
sub ecx, eax
mov eax, ecx
push 3
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x10035664
push 0x1000839c
jmp 0x10035681
cmp edx, 1
jne 0x10035670
push 0x100083a4
jmp 0x10035681
cmp edx, 2
jne 0x1003567c
push 0x100083ac
jmp 0x10035681
push 0x100083b4
call fcn.1004d431
inc esi
pop ecx
cmp esi, dword [esp + 0xe8]
jl 0x100355f7
lea ecx, [esp + 0x140]
mov byte [esp + 0x31c], 9
call fcn.10024a9b
mov dword [esp + 0xc], ebx
jmp 0x100356bf
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x44], 0xa2961c0f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100356af
mov dword [esp + 0xc], ebx
jmp 0x100356de
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100356cc
push 3
pop eax
mov dword [esp + 0x44], ebx
cmp dword [esp + 0x44], eax
jg 0x100357cb
mov edi, dword [esp + 0x64]
push 2
lea ecx, [esp + 0x120]
call fcn.100248e9
mov dword [esp + 0x10], ebx
jmp 0x10035724
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003570e
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0xbc]
cmp dword [eax], 1
jne 0x1003573f
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x44]
mov eax, dword [edi + 8]
push 0xfffffffffffffffc
mov dword [edx + 4], eax
mov eax, dword [esp + 0x68]
pop esi
cmp esi, dword [eax + ecx*4]
sbb esi, esi
xor eax, eax
inc esi
cmp dword [edx + 4], ebx
sete al
xor ecx, ecx
cmp eax, 0x4dde9a
setl cl
sub ecx, 0xffff
neg ecx
sbb ecx, ecx
inc ecx
imul esi, ecx
cmp esi, 0xfffffffb
ja 0x10035792
mov eax, dword [esp + 0xbc]
cmp dword [eax], ebx
je 0x10035792
xor eax, eax
inc eax
jmp 0x10035794
mov eax, ebx
push dword [esp + 0x11c]
mov dword [esp + 0x28], eax
call fcn.1004d337
pop ecx
push 3
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
inc dword [esp + 0x48]
pop eax
cmp dword [esp + 0x44], eax
jle 0x100356fa
mov byte [esp + 0x31c], 8
cmp dword [esp + 0xbc], 0
je 0x100357ff
push dword [esp + 0xbc]
call fcn.1004d337
pop ecx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0x13
jne 0x100354ed
mov esi, dword [esp + 0x34]
push 3
pop eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jl 0x1003583c
mov dword [esp + 0x24], 0xc512dc6d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
jns 0x1003581f
or dword [esp + 0x31c], 0xffffffff
cmp dword [esp + 0x64], 0
je 0x10035861
push dword [esp + 0x64]
call fcn.1004d337
pop ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
cmp byte [ebp + 0xc], 0
jne 0x1003586f
test esi, esi
jne 0x100363dc
push 1
lea ecx, [esp + 0xd0]
call fcn.100248e9
mov dword [esp + 0x10], 0x8e56f9b2
mov dword [esp + 0x1c], 0x53494abc
mov dword [esp + 0xc], 0xa2b8ea2c
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x28], 9
mov dword [esp + 0x10], ebx
jmp 0x100358c1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xdde0bcd8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100358ab
mov dword [esp + 0x10], ebx
jmp 0x1003598f
mov dword [esp + 0x14], 0x9fb023ed
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1003598b
mov dword [esp + 0x1c], 0x26c7f05f
mov ecx, 0xe24307a3
mov dword [esp + 0x20], 0x28c7fffa
mov eax, dword [esp + 0x14]
sub ecx, eax
xor eax, eax
cmp ecx, 0x5f88
push 0
setne al
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setne dl
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xd0]
cmp eax, dword [ecx + edx*4]
pop eax
setge al
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xcc]
mov esi, dword [ecx + eax*4]
sub esi, dword [ecx + edx*4]
xor edx, edx
mov eax, dword [esp + 0xc]
add eax, 7
cmp esi, eax
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
dec dword [esp + 0x14]
jns 0x100358e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x100358d1
mov eax, dword [esp + 0xc]
cmp dword [esp + 0xcc], 0
mov dword [esp + 0x20], eax
je 0x100359cd
push dword [esp + 0xcc]
call fcn.1004d337
pop ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2f0]
mov ecx, dword [esp + 0x58]
push eax
call fcn.1002a836
mov esi, eax
lea edi, [esp + 0x1b0]
pop ecx
push 0xfffffffffffffffc
pop eax
movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x128]
push 2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x2c], 0xcec3
pop edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], eax
push edi
call fcn.100248e9
mov dword [esp + 0xc], ebx
jmp 0x10035a32
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0x832937a3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10035a1c
mov dword [esp + 0xc], ebx
jmp 0x10035a51
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x268], 0xcc59
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10035a3e
inc dword [esp + 0x274]
cmp dword [esp + 0x128], 0
je 0x10035a8b
push dword [esp + 0x128]
call fcn.1004d337
pop ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
xor esi, esi
inc esi
cmp byte [ebp + 0xc], 0
je 0x10035c11
cmp dword [esp + 0x1b4], 0
je 0x10035c11
mov dword [esp + 0x28], 0xfffffff7
lea ecx, [esp + 0x164]
mov dword [esp + 0x3c], esi
push 3
mov dword [esp + 0x2c], 0x13fe662d
pop eax
mov dword [esp + 0x28], 0x8d963785
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x1c], 0xffffffff
push eax
call fcn.100248e9
mov dword [esp + 0x31c], 0xb
lea ecx, [esp + 0x17c]
mov dword [esp + 0x24], 0x9ba87a5
push 4
call fcn.100248e9
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0xc], ebx
jmp 0x10035b24
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2d0], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10035b11
push 3
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10035b4a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0x6fd43ddc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10035b34
mov dword [esp + 0xc], ebx
jmp 0x10035b6c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0x972737ae
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10035b56
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x17c]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
sub ecx, eax
mov eax, dword [esp + 0x20]
push dword [esp + 0x17c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
call fcn.1004d337
or dword [esp + 0x320], 0xffffffff
cmp dword [esp + 0x168], 0
pop ecx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
je 0x10035bf5
push dword [esp + 0x164]
call fcn.1004d337
pop ecx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x204], eax
cmp dword [esp + 0x34], 0
jne 0x100363dc
cmp dword [esp + 0x1ac], 0
jle 0x100363dc
mov dword [esp + 0x28], 0xbcd8c45c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10035c4a
push 0x210
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10035c75
push 0x11f6
push ebx
push ebx
push ebx
push ebx
push 0x1ae2
push 0xeaf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push edi
lea ecx, [esp + 0x138]
call fcn.100248e9
push esi
lea ecx, [esp + 0x198]
mov dword [esp + 0x320], 0xc
call fcn.100248e9
mov dword [esp + 0xc], ebx
jmp 0x10035cb6
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x42eb90da
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10035ca0
mov dword [esp + 0xc], ebx
jmp 0x10035cd8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], 0x3638ecf5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10035cc2
mov eax, dword [esp + 0x194]
mov dword [eax], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10035cfd
push 0xffc
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [esp + 0x194]
inc dword [eax]
cmp dword [eax], esi
jle 0x10035ce7
push eax
call fcn.1004d337
or dword [esp + 0x320], 0xffffffff
cmp dword [esp + 0x138], 0
pop ecx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], ebx
je 0x10035d5a
push dword [esp + 0x134]
call fcn.1004d337
pop ecx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x14], 0x73d2d672
lea ecx, [esp + 0x158]
mov dword [esp + 0x1c], 0x2b534de6
mov dword [esp + 0x20], 0xce4b
mov dword [esp + 0x1c], 0xffffffff
push esi
call fcn.100248e9
mov dword [esp + 0x31c], 0xd
mov dword [esp + 0x24], 7
mov dword [esp + 0xc], ebx
jmp 0x10035db3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1cc], 0xda2282d5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10035da0
mov dword [esp + 0xc], ebx
jmp 0x10035dd5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10035dbf
mov dword [esp + 0x24], 0x2520
cmp dword [esp + 0x24], 0x12f7
jge 0x10035f2a
lea eax, [esp + 0x9c]
mov ecx, 0x10655530
push eax
call fcn.10024266
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x10035f22
dec eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c4]
push eax
push ecx
lea eax, [esp + 0x100]
push eax
push ecx
lea eax, [esp + 0x6c]
mov ecx, 0x10655530
push eax
call fcn.10024266
pop ecx
mov ecx, eax
call fcn.10024266
pop ecx
mov ecx, eax
call fcn.10024266
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0xfc]
push esi
call fcn.100248e9
mov byte [esp + 0x31c], 0xe
dec esi
mov edi, dword [esp + 0xfc]
mov dword [esp + 0x5c], esi
js 0x10035e90
lea eax, [edi + esi*4]
mov edi, eax
push edi
mov ecx, 0x10655530
call fcn.10024266
sub edi, 4
dec esi
jns 0x10035e74
mov edi, dword [esp + 0xfc]
mov dword [esp + 0x5c], esi
mov eax, dword [edi]
mov ecx, 0x10655478
cmp eax, dword [esp + 0x1c4]
mov eax, dword [esp + 0x100]
jne 0x10035ec7
sub eax, edi
sar eax, 2
mov eax, dword [edi + eax*4 - 4]
cmp eax, dword [esp + 0xf8]
jne 0x10035ec0
mov edx, 0x100083bc
jmp 0x10035ee3
mov edx, 0x100083c4
jmp 0x10035ee3
sub eax, edi
mov edx, 0x100083cc
sar eax, 2
mov eax, dword [edi + eax*4 - 4]
cmp eax, dword [esp + 0xf8]
je 0x10035ee3
mov edx, 0x100083d4
call fcn.100287e4
push eax
call fcn.100287b2
pop ecx
push edi
mov byte [esp + 0x320], 0xd
call fcn.1004d337
mov eax, dword [esp + 0x40]
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
pop ecx
test eax, eax
jne 0x10035e12
xor esi, esi
inc esi
dec eax
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x158]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, esi
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x24], ecx
or dword [esp + 0x31c], 0xffffffff
push dword [esp + 0x158]
call fcn.1004d337
cmp dword [esp + 0x1b4], 0
pop ecx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
je 0x100363dc
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x10008800]
lea eax, [esp + 0x29c]
push eax
lea eax, [esp + 0x290]
mov dword [esp + 0x2c], 0x3aa9ac70
push eax
mov dword [esp + 0x34], 0xcfe04822
lea ecx, [esp + 0xe8]
mov dword [esp + 0x34], 0x49f845d8
mov dword [esp + 0x34], 0xc662a2b3
push ebx
movdqu xmmword [esp + 0x298], xmm0
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
call fcn.100293d1
push esi
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x320], 0xf
call fcn.100248e9
push 3
pop edi
push edi
lea ecx, [esp + 0x18c]
mov byte [esp + 0x320], 0x10
call fcn.100248e9
push esi
lea ecx, [esp + 0x174]
mov byte [esp + 0x320], 0x11
call fcn.100248e9
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x1003608e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1a0]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1003607c
mov dword [esp + 0xc], ebx
jmp 0x100360ac
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1003609a
mov dword [esp + 0xc], ebx
jmp 0x100360ce
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x100360b8
mov eax, dword [esp + 0x188]
inc dword [eax + 8]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], 4
mov dword [esp + 0x10], ebx
jmp 0x10036103
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1d4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100360f0
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x170], 0
mov dword [esp + 0x1d4], eax
je 0x10036140
push dword [esp + 0x170]
call fcn.1004d337
pop ecx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
push dword [esp + 0x188]
call fcn.1004d337
cmp dword [esp + 0x1a4], 0
pop ecx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
je 0x1003618e
push dword [esp + 0x1a0]
call fcn.1004d337
pop ecx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], ebx
or dword [esp + 0x31c], 0xffffffff
cmp dword [esp + 0xdc], 0
je 0x100361c2
push dword [esp + 0xdc]
call fcn.1004d337
pop ecx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov ecx, dword [esp + 0x1b0]
call fcn.10034a31
mov dword [esp + 0x24], 0x15fc
mov esi, eax
cmp dword [esp + 0x24], 0xf2e
mov dword [esp + 0x34], eax
jge 0x10036286
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0xbc]
push eax
push 0x100083dc
call fcn.1004cd7b
movd xmm0, dword [esp + 0xc4]
add esp, 4
movsd xmm1, qword [0x10008778]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [esp], xmm1
call fcn.1004dc30
movd xmm0, dword [esp + 0xc0]
movsd xmm1, qword [0x10008778]
cvtdq2pd xmm0, xmm0
fmul qword [esp + 0x268]
divsd xmm1, xmm0
fstp qword [esp + 0x50]
movsd qword [esp], xmm1
call fcn.1004dc30
movsd xmm0, qword [0x10008760]
movsd xmm1, qword [esp + 0x50]
fstp qword [esp + 0x30]
subsd xmm0, qword [esp + 0x30]
divsd xmm1, xmm0
movsd qword [esp], xmm1
push 0x100083e4
call fcn.1004d1c8
add esp, 0xc
xor edi, edi
mov dword [esp + 0xc], 0x3e76e5b1
inc edi
mov dword [esp + 0x14], ebx
push edi
lea ecx, [esp + 0x88]
call fcn.100248e9
mov dword [esp + 0x1c], 0x11e043ee
mov dword [esp + 0x20], 0x3a7ef23e
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x3c], 0x760b96b
mov dword [esp + 0x48], 0xdffc5a25
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x10], ebx
jmp 0x100362f2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100362e0
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x14], ebx
jne 0x10036369
mov eax, dword [esp + 0x84]
cmp dword [eax], ebx
jne 0x1003633c
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x84]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
sub edx, ecx
add edx, 0x16816
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x84]
mov edx, ebx
setge cl
mov dword [eax], ecx
test ecx, ecx
je 0x1003633e
mov edx, edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov ecx, ebx
setne dl
sub edx, dword [esp + 0x3c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0xc]
je 0x1003636b
mov ecx, edi
mov eax, dword [esp + 0x48]
add eax, ecx
cmp eax, 0x90438315
ja 0x10036380
mov ecx, edi
cmp dword [esp + 0x14], ebx
jne 0x10036382
mov ecx, ebx
mov eax, dword [esp + 0x28]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [esp + 0x84], 0
mov dword [esp + 0x20], ecx
je 0x100363ce
push dword [esp + 0x84]
call fcn.1004d337
pop ecx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
lea eax, [esp + 0x58]
push eax
call fcn.10036e19
mov dword [eax], esi
jmp 0x100363df
xor edi, edi
inc edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x28], edi
push 3
mov dword [esp + 0x4c], 0xfffffff7
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x1003640f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2c4], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x100363fc
mov dword [esp + 0xc], ebx
jmp 0x10036427
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x60], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1003641b
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x10036493
mov dword [esp + 0x10], ebx
jmp 0x10036450
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2e0], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10036441
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x48], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003648d
push 0x17ec
push 0x2495
push ebx
push 0x1031
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
dec dword [esp + 0x14]
jns 0x1003643b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100364b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
lea ecx, [esp + 0x1ac]
call fcn.10030c95
mov dword [esp + 0xc], 0xe8cff0ea
mov dword [esp + 0x28], 0x17f7
cmp dword [esp + 0x28], 0x454
jge 0x10036601
lea eax, [esp + 0xa4]
mov ecx, 0x10655530
push eax
call fcn.10024266
mov esi, dword [esp + 0xa4]
test esi, esi
je 0x100365f9
lea eax, [esp + 0x208]
dec esi
push eax
mov ecx, 0x10655530
mov dword [esp + 0x4c], esi
call fcn.10024266
mov eax, dword [0x10f858a0]
mov ecx, 0x10f858a0
mov edi, dword [esp + 0x208]
push edi
mov dword [0x10f858a4], eax
call fcn.100249e4
mov dword [esp + 0x28], ebx
test edi, edi
jle 0x10036552
mov eax, dword [0x10f858a0]
mov ecx, 0x10655530
lea eax, [eax + ebx*4]
push eax
call fcn.10024266
inc ebx
cmp ebx, edi
jl 0x10036538
xor ebx, ebx
mov eax, ebx
mov dword [esp + 0x20], eax
test edi, edi
jle 0x100365c2
mov eax, dword [0x10f858a0]
xor edx, edx
inc edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], edx
mov esi, ebx
mov dword [esp + 0x14], edi
mov ecx, edx
cmp edx, edi
jge 0x100365aa
mov edx, dword [ebx + eax]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + ecx*4]
cmp dword [esp + 0x1c], edx
jle 0x1003659d
mov dword [ebx + eax], edx
inc esi
mov eax, dword [0x10f858a0]
mov edx, dword [esp + 0x1c]
mov dword [eax + ecx*4], edx
mov eax, dword [0x10f858a0]
inc ecx
cmp ecx, edi
jl 0x10036578
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], esi
inc edx
add ebx, 4
dec dword [esp + 0x14]
mov dword [esp + 0x10], edx
jne 0x10036572
mov esi, dword [esp + 0x48]
xor ebx, ebx
mov eax, dword [esp + 0x20]
push eax
push ecx
mov edx, 0x1000830c
mov ecx, 0x10655478
call fcn.100287e4
pop ecx
mov ecx, eax
call fcn.10024597
mov edx, 0x10008304
mov ecx, eax
call fcn.100287e4
push eax
call fcn.100287b2
pop ecx
test esi, esi
jne 0x100364fd
xor edi, edi
inc edi
dec esi
mov dword [esp + 0xa4], esi
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x100087c0]
lea eax, [esp + 0x28c]
push eax
lea eax, [esp + 0x280]
mov dword [esp + 0x18], 0x1ac48889
push eax
mov dword [esp + 0x34], edi
lea ecx, [esp + 0xf8]
mov dword [esp + 0x34], edi
push ebx
movdqu xmmword [esp + 0x288], xmm0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
call fcn.100293d1
mov dword [esp + 0x31c], 0x12
mov dword [esp + 0xc], 0xffffffef
jmp 0x1003689b
mov dword [esp + 0x14], 0xb108f825
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 5
mov dword [esp + 0x28], 0x6cd83398
mov dword [esp + 0x28], 0x48407374
mov dword [esp + 0x28], 0xda8db884
mov dword [esp + 0x28], 0x7fc0
mov dword [esp + 0x10], ebx
jmp 0x100366d8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x24c], 0x1636717b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100366c5
mov dword [esp + 0x28], 0x13cb
cmp dword [esp + 0x28], 0xd29
jge 0x100367d9
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x58]
push eax
push 0x10008144
call fcn.1004cd7b
add esp, 0xc
lea ecx, [esp + 0x240]
push dword [esp + 0x54]
call fcn.100248e9
cmp dword [esp + 0x54], 0
mov edi, ebx
jle 0x10036745
mov esi, dword [esp + 0x240]
push esi
push 0x100080bc
call fcn.1004cd7b
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [esp + 0x54]
jl 0x1003672e
cmp dword [esp + 0xa8], 0
mov edi, ebx
mov dword [esp + 0x20], ebx
jle 0x100367ca
lea eax, [esp + 0x1d8]
push eax
push 0x100080bc
call fcn.1004cd7b
mov esi, dword [esp + 0x5c]
mov eax, ebx
dec esi
mov dword [esp + 0x24], eax
pop ecx
pop ecx
mov ecx, ebx
js 0x100367af
mov ebx, dword [esp + 0x240]
mov edi, dword [esp + 0x1d8]
lea eax, [esi + ecx]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebx + eax*4], edi
jg 0x1003679e
lea ecx, [eax + 1]
mov eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x100367a5
lea esi, [eax - 1]
mov eax, dword [esp + 0x1c]
cmp ecx, esi
jle 0x10036786
mov edi, dword [esp + 0x20]
xor ebx, ebx
push eax
push 0x100080d8
call fcn.1004d1c8
inc edi
pop ecx
pop ecx
mov dword [esp + 0x20], edi
cmp edi, dword [esp + 0xa8]
jl 0x10036755
lea ecx, [esp + 0x240]
call fcn.10024a9b
xor edi, edi
inc edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100367eb
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x14], eax
jmp 0x1003688c
mov dword [esp + 0x28], 0xbbef
lea ecx, [esp + 0x14c]
mov dword [esp + 0x28], 0x1f1eb32a
mov dword [esp + 0x28], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x874b28e
push 2
call fcn.100248e9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x7d77fc7d
mov dword [esp + 0x10], ebx
jmp 0x10036851
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003683b
dec dword [esp + 0x1c]
cmp dword [esp + 0x14c], 0
je 0x10036888
push dword [esp + 0x14c]
call fcn.1004d337
pop ecx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 7
je 0x100367f7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff6
jge 0x10036673
push 0xfffffffffffffff8
mov dword [esp + 0x14], ebx
pop esi
jmp 0x100368c7
mov dword [esp + 0x28], esi
mov dword [esp + 0x48], 0x3c12d493
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffee
jg 0x100368af
or dword [esp + 0x31c], 0xffffffff
cmp dword [esp + 0xec], 0
je 0x10036902
push dword [esp + 0xec]
call fcn.1004d337
pop ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x100369ac
push 3
mov dword [esp + 0x14], 0xecb45710
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10036932
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2a8], 0x41b3c692
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1003691f
mov dword [esp + 0xc], ebx
jmp 0x10036951
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x300], 0x733c6338
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1003693e
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1003698b
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 5
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x2a8]
mov dword [esp + 0x28], eax
dec dword [esp + 0x10]
jns 0x10036966
mov edx, dword [esp + 0x40]
call fcn.10034a58
mov esi, eax
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0x200], esi
call fcn.10036db7
mov dword [eax], esi
push edi
lea ecx, [esp + 0x210]
call fcn.100248e9
mov dword [esp + 0x20], 0xcc89
mov dword [esp + 0x28], 0xcb6a
mov dword [esp + 0x40], 0xcb6d64bd
mov dword [esp + 0x40], 0x8a6ebbfa
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x100369fd
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100369e7
cmp dword [esp + 0x20], ebx
jne 0x10036a2b
mov eax, dword [esp + 0x20c]
cmp dword [eax], ebx
jne 0x10036a1c
mov eax, ebx
cmp dword [esp + 0x28], edi
jl 0x10036a1e
mov eax, edi
cmp edi, eax
sbb eax, eax
neg eax
cmp eax, 0x4c55
jl 0x10036a2d
mov ebx, edi
mov eax, dword [esp + 0x20]
sub ebx, eax
xor eax, eax
cmp ebx, 0x5f40e13f
setg al
xor ecx, ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
sbb edx, edx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x20c]
setne cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov esi, dword [eax]
mov eax, esi
mov ecx, dword [esp + 0x40]
neg eax
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xffffffff
setl al
cmp eax, 0xae9f9034
sbb eax, eax
inc eax
sub eax, esi
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
push dword [esp + 0x20c]
mov dword [esp + 0x4c], eax
call fcn.1004d337
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1fc]
mov ecx, dword [esp + 0x314]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret