Function at 0x10034632
Capabilities:
Create pipe
Delete file
Get common file path
Get geographical location
Get graphical window text
Get keyboard layout
Get memory capacity
Get thread local storage value
Parse pe header
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x100883be
call fcn.10086e88
mov eax, 0x160c
call fcn.10083640
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x24], 0xa624cdb
inc eax
mov dword [ebp - 0x54], ecx
push edi
mov dword [ebp - 0x2c], 0xfffffff8
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], 0
push eax
mov byte [ebp - 0x59], dl
call fcn.100180d9
xor eax, eax
mov dword [ebp - 4], eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x1003469d
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6f0], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10034689
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100346b5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xaf0]
call fcn.10018146
mov dword [eax], ebx
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x100346a2
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
push 6
sbb eax, eax
add eax, 0xffffc643
neg eax
pop ecx
sbb eax, eax
inc eax
push 0xffffffffffffffff
pop esi
add eax, ecx
je 0x10034910
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
jmp 0x10034702
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x107c], 0xcd7820ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100346f1
mov dword [ebp - 0x24], 0x15
jmp 0x10034863
inc eax
mov dword [ebp - 0x10], 0xe64f
push eax
lea ecx, [ebp - 0x534]
call fcn.100180d9
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], 0
jmp 0x1003474a
push dword [ebp - 0x1c]
call fcn.10018146
mov dword [eax], 3
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
lea ecx, [ebp - 0x534]
cmp dword [ebp - 0x1c], eax
jl 0x10034736
mov eax, dword [ebp - 0x10]
xor edi, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
push edi
call fcn.10018146
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10034852
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x58aa
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call fcn.10018146
push 6
pop ecx
mov dword [eax], 0x8cbdb62b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
neg ecx
sub eax, ecx
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x100347c7
xor edi, edi
lea ecx, [ebp - 0x534]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x6ec]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x6ec], eax
je 0x10034837
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x534]
mov eax, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x6ec]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push edi
call fcn.10018146
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10034839
mov ecx, eax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x107c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jle 0x1003477c
xor eax, eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], al
call fcn.10018141
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], 0x36
jl 0x10034713
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d
jg 0x100348a7
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x10034896
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034893
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10034880
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jle 0x1003487b
push 2
pop ebx
xor edi, edi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xaf0]
mov dword [ebp - 0x28], eax
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10018141
xor eax, eax
mov dword [ebp - 0x24], 0xa624cdb
inc eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xae4]
mov dword [ebp - 0x48], edi
push eax
call fcn.100180d9
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], ebx
jge 0x10034907
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6fc], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100348f5
mov dword [ebp - 0x18], 0
jmp 0x1003498e
mov dword [ebp - 0x1c], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x20], 0xef155d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
setne cl
add ecx, dword [ebp - 0x1c]
je 0x1003493e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xaf0]
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
push edi
call fcn.10018146
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
cmp esi, eax
setg cl
mov dword [ebp - 0x20], ecx
jmp 0x100348a9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xae4]
call fcn.10018146
mov dword [eax], ebx
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x1003497b
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
push 6
sbb eax, eax
add eax, 0xffffc643
neg eax
pop ecx
sbb eax, eax
inc eax
add eax, ecx
je 0x10034c00
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
jmp 0x100349d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf74], 0xcd7820ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100349c7
mov dword [ebp - 0x24], 0x15
jmp 0x10034b35
inc eax
mov dword [ebp - 0x10], 0xe64f
push eax
lea ecx, [ebp - 0x540]
call fcn.100180d9
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], 0
jmp 0x10034a1b
push dword [ebp - 0x1c]
call fcn.10018146
mov dword [eax], 3
inc dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x540]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034a0a
mov eax, dword [ebp - 0x10]
xor edi, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
push edi
call fcn.10018146
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x10034b24
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x58aa
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call fcn.10018146
push 6
pop ecx
mov dword [eax], 0x8cbdb62b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
neg ecx
sub eax, ecx
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x10034a9b
xor edi, edi
lea ecx, [ebp - 0x540]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x6f8]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x6f8], eax
je 0x10034b0b
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x540]
mov eax, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push edi
call fcn.10018146
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10034b0d
mov ecx, eax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0xf74], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jle 0x10034a50
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], bl
call fcn.10018141
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], 0x36
jl 0x100349e9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d
jg 0x10034b79
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], eax
jmp 0x10034b68
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10034b65
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10034b52
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jle 0x10034b4d
push 2
pop ebx
xor edi, edi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xae4]
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018141
lea eax, [ebp - 0x10cc]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x10dc]
push eax
lea ecx, [ebp - 0x140c]
movdqu xmmword [ebp - 0x10dc], xmm0
call fcn.10018155
lea ecx, [ebp - 0x1a5]
mov esi, eax
call fcn.10008b83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x73c]
push dword [esi]
call fcn.1001811b
push edi
lea ecx, [ebp - 0x73c]
mov dword [ebp - 4], 4
call fcn.10018146
push 7
pop ecx
push edi
mov dword [eax], ecx
lea ecx, [ebp - 0x73c]
call fcn.10018146
push 9
pop esi
jmp 0x10034c9b
mov dword [ebp - 0x1c], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x20], 0xef155d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
setne cl
add ecx, dword [ebp - 0x1c]
je 0x10034c2e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xae4]
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
push edi
call fcn.10018146
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
cmp esi, eax
setg cl
mov dword [ebp - 0x20], ecx
jmp 0x10034b7b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10034c7f
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
push eax
lea ecx, [ebp - 0x73c]
call fcn.10018146
xor edi, edi
lea ecx, [ebp - 0x73c]
push edi
inc dword [eax]
call fcn.10018146
cmp dword [eax], esi
jle 0x10034c6b
or esi, 0xffffffff
lea ecx, [ebp - 0x73c]
mov dword [ebp - 4], esi
call fcn.10018141
push 6
pop eax
mov dword [ebp - 0x24], 0xa624cdb
lea ecx, [ebp - 0x9b0]
mov dword [ebp - 0x1c], eax
push 3
call fcn.100180d9
push 5
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0x3281
mov dword [ebp - 0x10], 0
jmp 0x10034cf3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9b0]
call fcn.10018146
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034ce0
mov dword [ebp - 0x1c], 0
jmp 0x10034d4b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x407858f9
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x10034d34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf6c], 0x7d65121a
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10034d1b
push eax
lea ecx, [ebp - 0x9b0]
call fcn.10018146
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
inc dword [ebp - 0x48]
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], 0x15
jge 0x10034d02
push eax
lea ecx, [ebp - 0x9b0]
call fcn.10018146
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x9b0]
call fcn.10018141
push 4
pop edi
mov dword [ebp - 0x2c], 0xfffffff8
lea ecx, [ebp - 0x98]
push edi
call fcn.100180d9
push 6
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0
jmp 0x10034dac
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x320], 0x540d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10034d9b
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], edi
jge 0x10034dd8
xor edi, edi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x98]
call fcn.10018146
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10034dbf
mov dword [ebp - 0x2c], 0
xor edi, edi
cmp dword [ebp - 0x2c], 3
jge 0x10034df6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe28], edi
inc dword [ebp - 0x2c]
jmp 0x10034de1
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
push ebx
lea ecx, [ebp - 0x98]
mov dword [eax], 3
call fcn.10018146
cmp dword [eax], edi
jl 0x1003502f
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10034e43
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034e30
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
push ebx
lea ecx, [ebp - 0x98]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
call fcn.10018146
xor ebx, ebx
cmp dword [eax], ebx
je 0x10034e89
push 2
lea ecx, [ebp - 0x98]
call fcn.10018146
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x320], ebx
je 0x10034e89
xor eax, eax
lea esi, [eax + 1]
jmp 0x10034e8b
xor esi, esi
push 2
lea ecx, [ebp - 0x98]
call fcn.10018146
xor ebx, ebx
lea ecx, [ebp - 0x98]
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp eax, esi
setg bl
call fcn.10018146
xor ecx, ecx
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp eax, ebx
sete cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x98]
call fcn.10018146
xor ebx, ebx
lea ecx, [ebp - 0x98]
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp dword [ebp - 0x20], eax
sete bl
call fcn.10018146
mov ecx, dword [ebp - 0x31c]
xor edx, edx
cmp ebx, ecx
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0xe20]
setle cl
sub ecx, eax
je 0x10034f1f
xor eax, eax
cmp dword [ebp - 0xe28], eax
jne 0x10034f1f
mov esi, eax
jmp 0x10034f24
xor eax, eax
lea esi, [eax + 1]
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x320]
jge 0x10034f57
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
xor edi, edi
cmp dword [eax], edi
je 0x10034f57
xor eax, eax
lea esi, [eax + 1]
jmp 0x10034f59
xor esi, esi
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp esi, eax
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x98]
call fcn.10018146
push ebx
lea ecx, [ebp - 0x98]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
mov esi, dword [ebp - 0x48]
sub esi, eax
mov dword [ebp - 0x12c4], esi
call fcn.10018146
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
cmp eax, esi
setne cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x98]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x31c]
call fcn.10018146
push ebx
lea ecx, [ebp - 0x98]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x320]
call fcn.10018146
xor ecx, ecx
cmp dword [eax], 0xcb44
sete cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035006
push 0x104b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
lea ecx, [ebp - 0x98]
call fcn.10018146
push ebx
lea ecx, [ebp - 0x98]
dec dword [eax]
call fcn.10018146
xor edi, edi
push 0xffffffffffffffff
pop esi
cmp dword [eax], edi
jge 0x10034e1c
or esi, esi
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], esi
call fcn.10018141
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10035059
mov dword [ebp - 0x48], 0xd95e17ca
cmp dword [ebp - 0x48], eax
jne 0x1003505f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jl 0x1003504a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
push 7
mov dword [ebp - 0x10], 0x41e55969
pop edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x1003509c
push 9
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x760], ecx
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035087
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x100350c1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x760], 0xf57a7c20
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100350a8
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xc34]
push eax
call fcn.100180d9
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], ebx
jge 0x100350f8
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x708], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100350e6
mov dword [ebp - 0x18], 0
jmp 0x10035114
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc34]
call fcn.10018146
mov dword [eax], ebx
inc dword [ebp - 0x18]
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10035101
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
push 6
sbb eax, eax
add eax, 0xffffc643
neg eax
pop ecx
sbb eax, eax
inc eax
add eax, ecx
je 0x100352fd
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
jmp 0x1003515e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf20], 0xcd7820ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003514d
mov dword [ebp - 0x24], 0x15
jmp 0x100352be
inc eax
mov dword [ebp - 0x10], 0xe64f
push eax
lea ecx, [ebp - 0x648]
call fcn.100180d9
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 0
jmp 0x100351a1
push dword [ebp - 0x1c]
call fcn.10018146
mov dword [eax], 3
inc dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x648]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10035190
mov eax, dword [ebp - 0x10]
xor edi, edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
push edi
call fcn.10018146
mov dword [eax], esi
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x100352aa
or esi, 0xffffffff
mov dword [ebp - 0x1c], 0x58aa
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call fcn.10018146
push 6
pop ecx
mov dword [eax], 0x8cbdb62b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
neg ecx
sub eax, ecx
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x10035221
xor edi, edi
lea ecx, [ebp - 0x648]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x704]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x704], eax
je 0x10035291
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x704]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
push edi
call fcn.10018146
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10035293
mov ecx, eax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0xf20], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jle 0x100351d6
push 7
pop eax
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], al
call fcn.10018141
inc dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x24], 0x36
jl 0x1003516f
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
jmp 0x100352f5
mov dword [ebp - 0x24], eax
jmp 0x100352ed
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100352ea
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x100352d7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2d
jle 0x100352d2
jmp 0x10035366
mov dword [ebp - 0x1c], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x20], 0xef155d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
setne cl
add ecx, dword [ebp - 0x1c]
je 0x1003532b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc34]
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
push edi
call fcn.10018146
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
cmp esi, eax
setg cl
xor esi, esi
mov dword [ebp - 0x20], ecx
inc esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018141
push ebx
lea ecx, [ebp - 0x200]
call fcn.100180d9
push 9
pop eax
push 3
lea ecx, [ebp - 0xafc]
mov dword [ebp - 4], eax
call fcn.100180d9
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x18], 0
jmp 0x100353c0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x200]
call fcn.10018146
mov dword [eax], 0xe60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100353a9
mov dword [ebp - 0x18], 0
jmp 0x100353e5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xafc]
call fcn.10018146
mov dword [eax], 0x96bc97de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100353ce
push esi
lea ecx, [ebp - 0x200]
call fcn.10018146
xor ebx, ebx
cmp dword [eax], ebx
je 0x10035414
push esi
lea ecx, [ebp - 0x200]
call fcn.10018146
cmp dword [eax], ebx
je 0x10035414
xor eax, eax
inc eax
mov esi, eax
jmp 0x10035419
xor eax, eax
xor esi, esi
inc eax
push eax
lea ecx, [ebp - 0x200]
call fcn.10018146
mov eax, dword [eax]
imul eax, esi
test eax, eax
je 0x100354e2
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x28], 0x556123d4
mov dword [ebp - 0x10], ebx
jmp 0x10035456
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144c], 0x9339b884
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10035445
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x200]
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x28]
push ebx
call fcn.10018146
xor edi, edi
lea ecx, [ebp - 0x200]
inc edi
push edi
call fcn.10018146
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x200]
push ebx
call fcn.10018146
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x200]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x1c]
cmp eax, 0x7c39c9d9
setne bl
xor ecx, ecx
imul ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edi
setge cl
add ebx, ecx
sub ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x1440], ecx
jmp 0x100355b6
mov dword [ebp - 0x10], 0x3c94681c
xor eax, eax
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10035514
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x338], 0xc23782ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100354fb
xor eax, eax
xor edi, edi
mov dword [ebp - 0x338], eax
inc edi
jmp 0x100355aa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x100355a4
cmp dword [ebp - 0x1c], eax
jne 0x1003554d
mov eax, dword [ebp - 0x1c]
sub eax, 0xbde6
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
jne 0x1003554d
cmp dword [ebp - 0x10], eax
jne 0x1003554f
mov ecx, eax
jmp 0x10035551
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x10], eax
jmp 0x10035597
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x50], eax
jl 0x10035594
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
jmp 0x1003558a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], bl
je 0x10035587
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10035569
dec dword [ebp - 0x50]
jns 0x10035561
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10035559
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x1003552d
inc dword [ebp - 0x338]
cmp dword [ebp - 0x338], edi
jle 0x10035522
push edi
lea ecx, [ebp - 0x200]
call fcn.10018146
push edi
lea ecx, [ebp - 0xafc]
mov esi, eax
call fcn.10018146
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0xafc]
call fcn.10018141
or esi, 0xffffffff
lea ecx, [ebp - 0x200]
mov dword [ebp - 4], esi
call fcn.10018141
push edi
lea ecx, [ebp - 0x101c]
call fcn.100180d9
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x10], 0x3c7730f9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10035634
push dword [ebp - 0x10]
lea ecx, [ebp - 0x101c]
call fcn.10018146
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035614
xor edi, edi
xor eax, eax
inc edi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003564c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10035672
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1003566d
push 0x71d
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10035654
lea ecx, [ebp - 0x101c]
mov dword [ebp - 4], esi
call fcn.10018141
mov dword [ebp - 0x28], 0xa61928c1
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0x18
jg 0x100357b4
push 3
pop ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 0
jmp 0x100356b8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c4], 0xc70c3099
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100356a7
mov dword [ebp - 0x1c], 0
jmp 0x1003579b
push edi
lea ecx, [ebp - 0x558]
call fcn.100180d9
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], 0
jmp 0x100356f6
push dword [ebp - 0x10]
call fcn.10018146
xor ecx, ecx
inc ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
xor eax, eax
lea ecx, [ebp - 0x558]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100356e6
push 0
call fcn.10018146
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x10035759
xor eax, eax
mov dword [ebp - 0x20], 0x310fecaf
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035741
push 0xd08
push eax
push 0x1b8c
push eax
push 0x790
push 0x1cf8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x20], 0x938dd44a
call fcn.10018146
inc dword [eax]
xor edi, edi
push edi
lea ecx, [ebp - 0x558]
call fcn.10018146
cmp dword [eax], ebx
jle 0x10035712
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035787
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [ebp - 0x558]
mov dword [ebp - 4], esi
call fcn.10018141
inc dword [ebp - 0x1c]
push 1
pop edi
cmp dword [ebp - 0x1c], ebx
jle 0x100356ca
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x18
push 1
pop edi
jle 0x1003569b
xor eax, eax
mov dword [ebp - 0x40], 0xa624cdb
inc eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], 0xa48bbca6
lea ecx, [ebp - 0x74c]
push eax
call fcn.100180d9
mov dword [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x28], 0xb839bf5b
inc eax
mov dword [ebp - 0x10], 0xf51885a1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x1003581e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x74c]
call fcn.10018146
mov dword [eax], 0x3ed23c5a
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100357ff
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0xb
je 0x10035901
xor edi, edi
inc edi
push 0
lea ecx, [ebp - 0x74c]
call fcn.10018146
xor ecx, ecx
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
test eax, eax
setg cl
imul ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x1003585a
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003585c
mov eax, edi
mov dword [ebp - 0x10], eax
xor edx, edx
imul ecx, dword [ebp - 0x10], 0x7a64
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x74c]
mov dword [ebp - 4], esi
call fcn.10018141
lea eax, [ebp - 0x11ac]
mov dword [ebp - 0x24], edi
push eax
lea eax, [ebp - 0x11bc]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x14fc]
movdqu xmmword [ebp - 0x11bc], xmm0
call fcn.10018155
lea ecx, [ebp - 0x1eb]
mov esi, eax
call fcn.10008b83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x75c]
push dword [esi]
call fcn.1001811b
xor ebx, ebx
mov dword [ebp - 4], 0xe
push ebx
lea ecx, [ebp - 0x75c]
call fcn.10018146
push 7
pop ecx
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x75c]
call fcn.10018146
push 9
pop esi
jmp 0x10035a75
xor eax, eax
inc eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x34], 0x898cbdb6
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0xde905f4d
mov dword [ebp - 0x1c], 0
jmp 0x10035935
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0x706b3799
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10035921
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10035979
cmp dword [ebp - 0x18], eax
je 0x10035979
inc eax
push 9
pop ecx
cmp ecx, eax
sbb ecx, ecx
xor ebx, ebx
inc ecx
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0x74c]
setle bl
sub ebx, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor edi, edi
push edi
neg ebx
call fcn.10018146
mov dword [eax], ebx
cmp ebx, dword [ebp - 0x10]
jg 0x100359c5
xor ebx, ebx
lea ecx, [ebp - 0x74c]
push ebx
call fcn.10018146
cmp dword [eax], ebx
je 0x100359c5
xor eax, eax
lea edx, [eax + 1]
jmp 0x100359c7
xor edx, edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, 0xfaa9634d
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xffbe6269
setne al
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
xor edi, edi
xor ecx, ecx
inc edi
cmp edx, edi
setg cl
xor eax, eax
cmp ecx, 0x1f205951
setl al
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
je 0x100358fe
jmp 0x10035832
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035a59
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
push eax
lea ecx, [ebp - 0x75c]
call fcn.10018146
xor ebx, ebx
lea ecx, [ebp - 0x75c]
push ebx
inc dword [eax]
call fcn.10018146
cmp dword [eax], esi
jle 0x10035a45
or esi, 0xffffffff
lea ecx, [ebp - 0x75c]
mov dword [ebp - 4], esi
call fcn.10018141
push 6
pop eax
push 3
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x9c8]
pop ebx
mov dword [ebp - 0x1c], eax
push ebx
call fcn.100180d9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x4c], 0x3281
mov dword [ebp - 0x10], 0
jmp 0x10035acc
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9c8]
call fcn.10018146
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035ab9
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x15
jl 0x10035b33
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x407858f9
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x10035b13
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe00], 0x7d65121a
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035afa
push eax
lea ecx, [ebp - 0x9c8]
call fcn.10018146
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
inc dword [ebp - 0x48]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jge 0x10035ade
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x9c8]
call fcn.10018146
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 4], esi
mov dword [eax], ecx
lea ecx, [ebp - 0x9c8]
call fcn.10018141
push edi
lea ecx, [ebp - 0xb74]
call fcn.100180d9
push 4
pop edi
push edi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0x10
call fcn.100180d9
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0
jmp 0x10035b95
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x300], 0x540d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10035b84
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], edi
jge 0x10035bc1
xor edi, edi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa8]
call fcn.10018146
mov dword [eax], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10035ba8
mov dword [ebp - 0x2c], 0
xor edi, edi
cmp dword [ebp - 0x2c], ebx
jge 0x10035bde
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe40], edi
inc dword [ebp - 0x2c]
jmp 0x10035bca
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
push ebx
lea ecx, [ebp - 0xa8]
mov dword [eax], 3
call fcn.10018146
jmp 0x10035e0d
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10035c2b
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1328], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10035c18
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
push ebx
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
call fcn.10018146
xor ebx, ebx
cmp dword [eax], ebx
je 0x10035c71
push 2
lea ecx, [ebp - 0xa8]
call fcn.10018146
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x300], ebx
je 0x10035c71
xor eax, eax
lea esi, [eax + 1]
jmp 0x10035c73
xor esi, esi
push 2
lea ecx, [ebp - 0xa8]
call fcn.10018146
xor ebx, ebx
lea ecx, [ebp - 0xa8]
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
cmp eax, esi
setg bl
call fcn.10018146
xor ecx, ecx
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
cmp eax, ebx
sete cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xa8]
call fcn.10018146
xor ebx, ebx
lea ecx, [ebp - 0xa8]
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
cmp dword [ebp - 0x48], eax
sete bl
call fcn.10018146
mov ecx, dword [ebp - 0x2fc]
xor edx, edx
cmp ebx, ecx
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0xe38]
setle cl
sub ecx, eax
je 0x10035d07
xor eax, eax
cmp dword [ebp - 0xe40], eax
jne 0x10035d07
mov esi, eax
jmp 0x10035d0c
xor eax, eax
lea esi, [eax + 1]
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x300]
jge 0x10035d3f
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
xor edi, edi
cmp dword [eax], edi
je 0x10035d3f
xor eax, eax
lea esi, [eax + 1]
jmp 0x10035d41
xor esi, esi
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
cmp esi, eax
setge cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xa8]
call fcn.10018146
push ebx
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
mov esi, dword [ebp - 0x48]
sub esi, eax
mov dword [ebp - 0x1324], esi
call fcn.10018146
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
cmp eax, esi
setne cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2fc]
call fcn.10018146
push ebx
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x300]
call fcn.10018146
xor ecx, ecx
cmp dword [eax], 0xcb44
sete cl
xor eax, eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10035dee
push 0x104b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
lea ecx, [ebp - 0xa8]
call fcn.10018146
push ebx
lea ecx, [ebp - 0xa8]
dec dword [eax]
call fcn.10018146
push 0xffffffffffffffff
xor edi, edi
pop esi
cmp dword [eax], edi
jge 0x10035c04
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x10
call fcn.10018141
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10035e40
mov dword [ebp - 0x48], 0xd95e17ca
cmp dword [ebp - 0x48], eax
jne 0x10035e46
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jl 0x10035e31
mov eax, dword [ebp - 0x1c]
push 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
pop edi
jmp 0x10035e65
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x720], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10035e58
push 7
mov dword [ebp - 0x10], 0x41e55969
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], 0
inc eax
cmp dword [ebp - 0x10], eax
jge 0x10035e9e
push 9
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7c4], ecx
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035e89
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x10035ec3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7c4], 0xf57a7c20
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035eaa
mov dword [ebp - 0x18], 0
jmp 0x10035ee2
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb74]
call fcn.10018146
mov dword [eax], edi
xor eax, eax
inc dword [ebp - 0x18]
inc eax
cmp dword [ebp - 0x18], eax
jl 0x10035ecc
movdqa xmm0, xmmword [0x10007c00]
lea eax, [ebp - 0x10ec]
push eax
lea eax, [ebp - 0x10fc]
push eax
lea ecx, [ebp - 0x141c]
movdqu xmmword [ebp - 0x10fc], xmm0
call fcn.10018155
lea ecx, [ebp - 0x1ed]
mov esi, eax
call fcn.10008b83
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x194]
push dword [esi]
call fcn.1001811b
xor eax, eax
mov byte [ebp - 4], 0x12
inc eax
lea ecx, [ebp - 0x89c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0x2a8358bd
push eax
call fcn.100180d9
xor eax, eax
mov byte [ebp - 4], 0x13
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], ebx
jge 0x10035f80
push dword [ebp - 0x10]
lea ecx, [ebp - 0x89c]
call fcn.10018146
mov dword [eax], 0xfffffff6
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035f5c
xor ebx, ebx
xor eax, eax
inc ebx
push 0xfffffffffffffff9
mov dword [ebp - 0x44], eax
pop esi
jmp 0x1003610c
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10035fa6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x10035fbd
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x48]
dec dword [ebp - 0x18]
jns 0x10035fb2
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], eax
jl 0x10036109
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100360e5
mov dword [ebp - 0x28], 0xa4aefc51
lea ecx, [ebp - 0x89c]
push eax
call fcn.10018146
push dword [ebp - 0x18]
lea ecx, [ebp - 0x194]
mov esi, eax
call fcn.10018146
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x10036078
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x194]
push ebx
call fcn.10018146
push 3
lea ecx, [ebp - 0x194]
call fcn.10018146
push edi
lea ecx, [ebp - 0x194]
call fcn.10018146
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x194]
push dword [ebp - 0x18]
call fcn.10018146
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x194]
xor edi, edi
push edi
call fcn.10018146
cmp dword [ebp - 0x1c], edi
je 0x10036066
push ebx
lea ecx, [ebp - 0x194]
call fcn.10018146
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x89c]
push 0
call fcn.10018146
mov dword [eax], esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x194]
call fcn.10018146
xor edi, edi
lea ecx, [ebp - 0x194]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x44]
call fcn.10018146
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x100360cf
push eax
push 0x2b7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
push 0
pop eax
push 2
pop edi
jle 0x10035fe0
push 0xfffffffffffffff9
pop esi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100360fd
push eax
push 0xd03
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
dec dword [ebp - 0x18]
push 0xffffffffffffffff
pop ecx
jns 0x10035fcd
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jle 0x10035f8b
lea ecx, [ebp - 0x89c]
call fcn.10018141
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x10
call fcn.10018141
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
neg eax
push 6
sbb eax, eax
add eax, 0xffffc643
neg eax
pop ecx
sbb eax, eax
inc eax
add eax, ecx
je 0x10038b0b
mov dword [ebp - 0x1c], 0x16df251d
mov dword [ebp - 0x10], 4
push 5
mov dword [ebp - 0x4c], 0x6fb9
pop eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10036194
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcdc], 0xa53d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1003617b
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jg 0x1003624c
or edx, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x9958900f
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10036254
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edi
jg 0x1003623a
mov dword [ebp - 0x20], 0xaa2d
mov dword [ebp - 0x34], 0xfffffffc
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x100361f0
cmp dword [ebp - 0x28], eax
je 0x100361f2
mov eax, ebx
neg eax
cmp eax, 0x6968
jne 0x1003621b
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x28]
jne 0x1003621b
mov eax, ebx
jmp 0x1003621d
xor eax, eax
imul eax, eax, 0xa67f
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x10036234
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jle 0x100361d2
or edx, 0xffffffff
push 6
pop ecx
inc dword [ebp - 0x1c]
push 0
pop eax
push 1
pop ebx
cmp dword [ebp - 0x1c], edi
jle 0x100361a3
mov dword [ebp - 0x10], eax
jmp 0x100362d9
mov dword [ebp - 0x9f8], ecx
mov dword [ebp - 0x9f4], ecx
mov dword [ebp - 0x9f0], ecx
mov dword [ebp - 0x9ec], ecx
mov dword [ebp - 0x20], 0xeee83ade
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1003628c
cmp dword [ebp - 0x9f4], eax
jne 0x1003628c
mov ecx, eax
jmp 0x10036291
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0xcdc]
sub eax, ecx
cmp dword [ebp - 0x10], eax
je 0x100362a1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xcdc]
mov eax, dword [ebp - 0xcdc]
cmp dword [ebp - 0x38], edx
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x20], eax
jmp 0x10036237
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x100362d6
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x100362c4
or ebx, 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], 0xdf75dcec
mov dword [ebp - 0x10], eax
jmp 0x1003631c
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036314
push eax
push eax
push 0x1565
push 0x764
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10036322
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jge 0x100362f0
mov dword [ebp - 0x40], 0xdf1febae
cmp dword [ebp - 0x40], eax
je 0x100363ed
xor eax, eax
mov dword [ebp - 0x48], esi
inc eax
mov dword [ebp - 0x10], esi
push eax
lea ecx, [ebp - 0x9a4]
call fcn.100180d9
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x34], 0xd6a5
mov dword [ebp - 0x10], 0
jmp 0x1003636e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9a4]
call fcn.10018146
mov dword [eax], ebx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x1003635b
mov dword [ebp - 0x40], 0xe
cmp dword [ebp - 0x40], 0x34
jle 0x100363d9
mov dword [ebp - 0x20], 0x363f9e92
cmp dword [ebp - 0x20], 0
jne 0x100363c7
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x9a4]
xor eax, eax
mov dword [ebp - 0x10], eax
push eax
call fcn.10018146
mov ecx, dword [ebp - 0x10]
xor edi, edi
push edi
mov dword [eax], ecx
lea ecx, [ebp - 0x9a4]
mov eax, dword [ebp - 0x48]
call fcn.10018146
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x100363ca
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x34
jg 0x10036383
push 2
pop edi
lea ecx, [ebp - 0x9a4]
mov byte [ebp - 4], 0x10
call fcn.10018141
jmp 0x10036533
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036413
push 0xd85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x1c], eax
je 0x10036437
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10036533
push 0xf68
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x10036533
mov dword [ebp - 0x20], 0xccfe983d
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ecx
jge 0x10036461
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x724], 0xfffffff6
xor eax, eax
inc dword [ebp - 0x40]
inc eax
cmp dword [ebp - 0x40], eax
jl 0x10036446
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x10036483
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x76c], 0x46d23205
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jl 0x1003646a
xor eax, eax
mov dword [ebp - 0x40], 0xffffffe2
cmp dword [ebp - 0x40], 0x1a
jg 0x10036533
jmp 0x10036498
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 0x48], 0xfffffffc
cmp dword [ebp - 0x10], eax
jne 0x100364af
mov esi, eax
jmp 0x100364b4
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x768]
mov eax, dword [ebp - 0x768]
mov eax, dword [ebp - 0x768]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x76c], 0x5b872a60
cmp dword [ebp - 0x10], 0
je 0x100364dc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x724], esi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xea65
cmp esi, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x1a
jle 0x10036496
mov dword [ebp - 0x38], 0xa61928c1
mov dword [ebp - 0x48], 8
push 9
mov dword [ebp - 0x38], 0xfffffff4
pop eax
cmp dword [ebp - 0x38], eax
jle 0x10036608
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x1c], 0
jmp 0x10036578
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf80], 0xad374006
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10036567
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x10]
jne 0x100365a8
mov dword [ebp - 0x10], 0
jmp 0x10036622
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfbc], 0xcd7820ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10036611
xor eax, eax
mov dword [ebp - 0x24], 0xa624cdb
inc eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xb14]
mov dword [ebp - 0x48], 0
push eax
call fcn.100180d9
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x40], edi
jge 0x10036673
mov dword [ebp - 0x1c], 0xfffffffe
or esi, 0xffffffff
mov dword [ebp - 0x38], 0x4f230135
mov dword [ebp - 0x34], 0x64974402
mov dword [ebp - 0x10], 0xd2f2
mov dword [ebp - 0x50], 0xf81606dc
mov dword [ebp - 0x28], 0x690b2811
mov dword [ebp - 0x4c], 0x49145018
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], 0x1bd9f019
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0
jmp 0x10038b66
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8c], 0xb0647dc4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10038b55
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp eax, ebx
setl cl
imul edx, ecx
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, 0x634d71b3
setl al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x38]
sub eax, 0x33933b83
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
dec dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
add eax, ecx
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8c]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0xc8b2
cmp eax, 0x446ca37e
jle 0x10038c44
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
push 9
sbb edx, edx
inc edx
add edx, dword [ebp - 0x44]
imul edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
cmp edx, eax
pop eax
setne cl
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0xef155d2
mov dword [ebp - 0x34], 0x30f94f37
mov dword [ebp - 0x4c], 0x9532bb11
mov dword [ebp - 0x30], 0xd8cb4c23
mov dword [ebp - 0x30], 0x865425a8
mov dword [ebp - 0x30], 0xd416db6d
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], 0xbea5223f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
jmp 0x10038cba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x109c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038cad
mov eax, dword [ebp - 0x34]
xor ecx, ecx
add eax, 0xfff8
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
setne cl
add ecx, dword [ebp - 0x1c]
je 0x10038ced
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb74]
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x24]
push edi
call fcn.10018146
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
cmp esi, eax
setg cl
mov dword [ebp - 0x48], ecx
push 3
lea ecx, [ebp - 0x254]
call fcn.100180d9
mov byte [ebp - 4], 0x2e
push 5
mov dword [ebp - 0x34], 0xfffffff9
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x7d0b0a35
mov dword [ebp - 0x40], 0
jmp 0x10038d67
push dword [ebp - 0x40]
lea ecx, [ebp - 0x254]
call fcn.10018146
mov dword [eax], 0xca2cb51d
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jl 0x10038d50
mov dword [ebp - 0x40], 0
jmp 0x10038d87
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x7ac], 0xd5d70512
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 4
jl 0x10038d76
push 0
lea ecx, [ebp - 0x254]
call fcn.10018146
push 2
pop esi
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x254]
push esi
call fcn.10018146
mov ecx, dword [ebp - 0x34]
xor edx, edx
push ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x254]
setne dl
mov dword [ebp - 0x1c], edx
call fcn.10018146
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x254]
setl bl
xor edi, edi
push edi
call fcn.10018146
xor ecx, ecx
push esi
cmp dword [eax], ebx
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x254]
mov eax, dword [ebp - 0x10]
add eax, 0x5ba13b28
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x1c], eax
call fcn.10018146
xor ecx, ecx
xor ebx, ebx
inc ecx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x254]
setle bl
call fcn.10018146
mov ecx, dword [ebp - 0x7ac]
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x7ac]
push esi
sete dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x10]
setle bl
imul ecx, ebx
imul eax, ecx
lea ecx, [ebp - 0x254]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7ac], eax
call fcn.10018146
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x254]
mov eax, dword [ebp - 0x10]
push edi
call fcn.10018146
mov eax, dword [ebp - 0x7a4]
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x10], eax
call fcn.10018141
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xb74]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10018141
push esi
lea ecx, [ebp - 0x23c]
call fcn.100180d9
push 3
lea ecx, [ebp - 0xc7c]
mov dword [ebp - 4], 0x2f
call fcn.100180d9
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x18], edi
jmp 0x10038ede
push dword [ebp - 0x18]
lea ecx, [ebp - 0x23c]
call fcn.10018146
mov dword [eax], 0xe60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038ec7
mov dword [ebp - 0x18], 0
jmp 0x10038f03
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc7c]
call fcn.10018146
mov dword [eax], 0x96bc97de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10038eec
xor edi, edi
lea ecx, [ebp - 0x23c]
inc edi
push edi
call fcn.10018146
xor ebx, ebx
cmp dword [eax], ebx
je 0x10038f32