Function at 0x10031ca5
Capabilities:
Compare security identifiers
Get graphical window text
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x1006b4a8
call fcn.1006a378
sub esp, 0xa7c
push ebx
push esi
push edi
push 3
mov dword [ebp - 0x18], 7
mov esi, 0xdc705be7
pop eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x95f87b70
push eax
mov byte [ebp - 0x51], dl
call fcn.1000d3e3
lea ecx, [ebp - 0x764]
xor ebx, ebx
push ecx
lea eax, [ebp - 0x754]
mov dword [ebp - 4], ebx
movdqa xmm0, xmmword [0x1000b970]
push eax
push ecx
lea ecx, [ebp - 0x594]
movdqu xmmword [ebp - 0x764], xmm0
call fcn.1000d41f
xor eax, eax
lea ecx, [ebp - 0x844]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x834]
movdqa xmm0, xmmword [0x1000b9a0]
push ecx
push eax
push ecx
mov dword [ebp - 0x20], 0x4a037a76
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 0x44], 0x6a8e
movdqu xmmword [ebp - 0x844], xmm0
call fcn.1000d41f
push 2
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x10031d6c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x88], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x10031d5b
push 3
mov dword [ebp - 0x2c], ebx
pop edi
jmp 0x10031d8c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1e4]
mov dword [eax + ecx*4], 0x9bec7a42
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10031d79
xor edi, edi
mov dword [ebp - 0x2c], ebx
inc edi
cmp dword [ebp - 0x2c], edx
jge 0x10031dab
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x188], edi
inc dword [ebp - 0x2c]
jmp 0x10031d97
mov dword [ebp - 0x18], 0xc48b
cmp dword [ebp - 0x88], ebx
jne 0x10031dbd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x14]
add eax, dword [ecx + 4]
mov dword [ebp - 0x3c], eax
jne 0x10031e2c
mov ecx, ebx
cmp dword [ebp - 0x44], ebx
je 0x10031e2e
mov ecx, edi
mov eax, dword [ebp - 0x594]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x14]
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1e4]
setle cl
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
add eax, 0x25f3d189
add eax, ecx
jne 0x10031e6c
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x184]
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x1e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x18], ebx
je 0x10031ea4
mov eax, dword [ebp - 0x6fc]
cmp dword [eax + 4], ebx
mov eax, edi
jne 0x10031ea6
mov eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x6fc]
call fcn.1000d97d
lea ecx, [ebp - 0x594]
call fcn.1000d97d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.1000d97d
push 2
mov dword [ebp - 0x18], 7
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x3c], esi
pop esi
mov dword [ebp - 0x14], 0xffffffff
push esi
call fcn.1000d3e3
mov dword [ebp - 0x28], 0xeb9e9d60
mov dword [ebp - 0x44], 0x26a7609f
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], ebx
jmp 0x10031f19
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x410], 0x63e8e1b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031f08
mov dword [ebp - 0x10], ebx
jmp 0x10031f32
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x47c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10031f23
mov dword [ebp - 0x410], 0xfffffff6
xor edx, edx
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x14]
push 0xfffffffffffffff7
cmp dword [esi + 4], ebx
mov dword [ebp - 0x40c], ecx
setne dl
xor eax, eax
neg edx
cmp ecx, edx
setle al
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [esi + 4]
neg ecx
pop eax
sbb ecx, ecx
xor edx, edx
inc ecx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
imul ecx, eax
mov eax, dword [ebp - 0x44]
cmp ecx, 0x48f4
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x47c]
call fcn.1000d97d
push 3
pop eax
mov dword [ebp - 0x14], eax
mov eax, 0x979c
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x44], 0x7223b16a
mov dword [ebp - 0x20], ebx
jmp 0x10031fee
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x274], 0x82c4475e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10031fdd
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
imul ecx, ecx, 0x2ba2
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
setge dl
sub ecx, edx
xor edx, edx
mov dword [ebp - 0x4dc], ecx
mov eax, dword [ebp - 0x18]
imul eax, ecx
imul ecx, eax, 0xd416
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
lea edx, [eax - 3]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
je 0x10032083
push 0x1488
push 0x187c
call ebx
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 0x24], 0x95f87b70
xor ecx, ecx
mov dword [ebp - 0x18], 0xa5eafb5d
mov dword [ebp - 0x44], 0x276ac116
mov dword [ebp - 0x20], ecx
jmp 0x100320ad
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003209f
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 7
push 4
pop edx
je 0x1003222e
jmp 0x100320c7
push 4
pop edx
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x14], 0xd2466e9f
mov dword [ebp - 0x20], ecx
jmp 0x100320eb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x530], 0xe662
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100320da
mov dword [ebp - 0x44], 0x24cb
cmp dword [ebp - 0x44], 0xcf0
jge 0x100321b8
lea eax, [ebp - 0xa0]
push eax
push 0x1000b220
call fcn.100527da
mov eax, dword [ebp - 0xa0]
pop ecx
pop ecx
test eax, eax
je 0x100321b1
dec eax
lea esi, [ebp - 0x96c]
push 0xa
mov dword [ebp - 0xa0], eax
pop edi
push esi
push 0x1000b220
call fcn.100527da
pop ecx
pop ecx
push 4
pop eax
add esi, eax
dec edi
jne 0x10032135
mov esi, dword [ebp - 0x96c]
xor eax, eax
push 9
xor ecx, ecx
mov edi, eax
pop eax
inc ecx
cmp dword [ebp + eax*4 - 0x96c], esi
jg 0x1003216c
mov esi, dword [ebp + eax*4 - 0x96c]
mov edi, eax
dec eax
cmp eax, ecx
jge 0x1003215a
test edi, edi
jne 0x10032180
push 0x1000b3e0
call fcn.10052b7f
pop ecx
test esi, esi
js 0x10032195
inc esi
push edi
push 0x1000b21c
call fcn.10052b7f
pop ecx
pop ecx
dec esi
jne 0x10032185
push 0x1000b0d9
call fcn.10052df3
mov eax, dword [ebp - 0xa0]
pop ecx
test eax, eax
jne 0x10032125
xor edi, edi
inc edi
dec eax
mov dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x52c]
neg esi
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x52c]
sbb esi, esi
add ecx, 0xffff0004
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [ebp - 0x52c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jne 0x10032207
mov eax, dword [ebp - 0x58]
cmp esi, dword [ebp - 0x14]
jl 0x10032213
mov eax, edi
cmp dword [ebp - 0x14], ecx
jne 0x10032215
mov eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 7
jne 0x100320c4
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
neg edi
mov dword [ebp - 0x58], esi
sbb edi, edi
imul edx, dword [ebp - 0x18], 0x7b396e
mov eax, dword [ebp - 0x18]
xor ecx, ecx
neg edi
push 3
sub edx, 0x15cbe3e6
cmp edx, eax
setle cl
xor edx, edx
cmp edi, ecx
lea ecx, [ebp - 0x1f0]
setle dl
xor eax, eax
sub edx, dword [ebp - 0x18]
cmp esi, edx
sete al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
pop eax
push eax
call fcn.1000d3e3
push 2
pop esi
lea ecx, [ebp - 0x864]
mov dword [ebp - 4], esi
movdqa xmm0, xmmword [0x1000b970]
lea eax, [ebp - 0x854]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x5dc]
movdqu xmmword [ebp - 0x864], xmm0
call fcn.1000d41f
push 3
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x7f4]
movdqa xmm0, xmmword [0x1000b9a0]
lea eax, [ebp - 0x7e4]
push ecx
push eax
push ecx
mov dword [ebp - 0x10], 0x4a037a76
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x34], 0x6a8e
movdqu xmmword [ebp - 0x7f4], xmm0
call fcn.1000d41f
push 4
pop eax
xor edi, edi
mov byte [ebp - 4], al
inc edi
lea ecx, [ebp - 0x5ac]
push edi
call fcn.1000d3e3
mov dword [ebp - 0x44], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x20], edx
jmp 0x1003233d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5ac]
mov dword [eax + ecx*4], 0x6d210ec3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1003232a
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
call fcn.1000d97d
xor edx, edx
mov dword [ebp - 0x2c], edx
jmp 0x10032371
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x90], 6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10032360
mov dword [ebp - 0x2c], edx
jmp 0x1003238e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1f0]
mov dword [eax + ecx*4], 0x9bec7a42
inc dword [ebp - 0x2c]
push 3
pop eax
cmp dword [ebp - 0x2c], eax
jl 0x1003237b
mov dword [ebp - 0x2c], edx
jmp 0x100323a8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x198], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1003239b
mov dword [ebp - 0x18], 0xc48b
cmp dword [ebp - 0x90], edx
jne 0x100323bf
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x14]
add eax, dword [ecx + 4]
mov dword [ebp - 0x3c], eax
jne 0x1003242e
mov ecx, edx
cmp dword [ebp - 0x34], edx
je 0x10032430
mov ecx, edi
mov eax, dword [ebp - 0x5dc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x14]
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1f0]
setle cl
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
add eax, 0x25f3d189
add eax, ecx
jne 0x1003246e
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x194]
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x1f0]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], ecx
je 0x100324a8
mov eax, dword [ebp - 0x5c4]
cmp dword [eax + 4], ecx
mov eax, edi
jne 0x100324aa
mov eax, ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x5c4]
call fcn.1000d97d
lea ecx, [ebp - 0x5dc]
call fcn.1000d97d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.1000d97d
push esi
lea ecx, [ebp - 0x60c]
call fcn.1000d3e3
push 5
pop eax
push edi
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 4], eax
call fcn.1000d3e3
xor edx, edx
mov dword [ebp - 0x28], 0xba20b95a
mov dword [ebp - 0x10], edx
jmp 0x10032511
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100324fe
mov dword [ebp - 0x10], edx
jmp 0x1003252a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5f4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003251b
dec dword [ebp - 0x28]
mov byte [ebp - 0x19], dl
cmp byte [ebp - 0x19], dl
je 0x10032540
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
lea ecx, [ebp - 0x5f4]
call fcn.1000d97d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.1000d97d
mov dword [ebp - 0x2c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], 0xd2cc9105
mov dword [ebp - 0x34], 0x6b719d87
mov dword [ebp - 0x24], 0xb9338886
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10032595
push 0xb0a
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setl cl
add eax, 0xffff5a44
add eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0xa6d0811
setg cl
xor eax, eax
cmp ecx, edi
jge 0x100325f0
cmp dword [ebp - 0x34], eax
je 0x100325f0
mov eax, edi
mov dword [ebp - 0x24], eax
xor edx, edx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
je 0x10032753
movdqa xmm0, xmmword [0x1000b930]
lea ecx, [ebp - 0x794]
push ecx
lea eax, [ebp - 0x784]
push eax
push ecx
lea ecx, [ebp - 0x34c]
movdqu xmmword [ebp - 0x794], xmm0
call fcn.1000d41f
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
je 0x1003272d
mov esi, dword [ebp - 0x34c]
mov dword [ebp - 0x44], 0x3268dd2a
lea ecx, [ebp - 0x394]
push edi
call fcn.1000d3e3
mov dword [ebp - 0x3c], 0x18394d25
xor ecx, ecx
push 2
pop eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], edi
jge 0x100326ba
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100326a0
xor ecx, ecx
cmp dword [ebp - 0x44], ecx
je 0x100326c2
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x394]
mov edx, 0x8c6dcff2
mov dword [eax], edx
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0xffffffff
jb 0x100326e3
cmp dword [ebp - 0x34], ecx
je 0x100326e3
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x34c]
setg dl
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x2f0]
cmp edx, eax
mov eax, dword [ebp - 0x34c]
sete cl
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x2f0], eax
lea ecx, [ebp - 0x394]
call fcn.1000d97d
inc dword [ebp - 0x2c]
jne 0x10032661
push 2
xor eax, eax
pop esi
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x1003273f
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c]
call fcn.1000d97d
jmp 0x100327ea
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
add edx, 0x457c1b23
cmp eax, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x44]
je 0x10032790
mov edx, edi
cmp dword [ebp - 0x10], eax
jne 0x10032792
mov edx, eax
mov dword [ebp - 0x28], 0x18ad385e
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jmp 0x100327e4
mov dword [ebp - 0x24], eax
jmp 0x100327db
mov dword [ebp - 0x10], 0x12
jmp 0x100327d2
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x100327cf
call ebx
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jge 0x100327bb
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jne 0x100327b2
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x100327ad
mov dword [ebp - 0x10], 0x6e5c7a00
xor edx, edx
mov dword [ebp - 0x28], edx
push 3
mov dword [ebp - 0x44], 0x29a275ff
mov dword [ebp - 0x20], edx
pop ecx
jmp 0x10032812
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8b8], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032805
mov ecx, edx
cmp dword [ebp - 0x10], edx
je 0x10032820
mov ecx, edi
mov eax, dword [ebp - 0x10]
imul eax, ecx
test eax, eax
je 0x1003282d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8b8], edi
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jg 0x10032846
cmp dword [ebp - 0x10], edx
je 0x10032846
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, 0xffff0003
mov eax, dword [ebp - 0x10]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x10]
test ecx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x10032881
push eax
push eax
push 0x10bd
call ebx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x41c]
push esi
call fcn.1000d3e3
mov dword [ebp - 0x28], 0xeb9e9d60
xor edx, edx
mov dword [ebp - 0x44], 0x26a7609f
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], edx
jmp 0x100328c1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3f8], 0x63e8e1b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100328b0
mov dword [ebp - 0x10], edx
jmp 0x100328da
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100328cb
mov dword [ebp - 0x3f8], 0xfffffff6
xor edx, edx
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x41c]
xor eax, eax
mov ecx, dword [ebp - 0x14]
push 0xfffffffffffffff7
cmp dword [esi + 4], eax
mov dword [ebp - 0x3f4], ecx
setne dl
neg edx
cmp ecx, edx
pop ecx
setle al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [esi + 4]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
imul eax, ecx
cmp eax, 0x48f4
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x41c]
call fcn.1000d97d
push 7
mov eax, 0x979c
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x504], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0x7223b16a
mov dword [ebp - 0x20], eax
jmp 0x10032997
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x29c], 0x82c4475e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10032986
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
imul ecx, ecx, 0x2ba2
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
setge dl
sub ecx, edx
xor edx, edx
mov dword [ebp - 0x50c], ecx
mov eax, dword [ebp - 0x18]
imul eax, ecx
imul ecx, eax, 0xd416
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
lea edx, [eax - 3]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], cl
je 0x10032a29
push 0x1488
push 0x187c
call ebx
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
xor ecx, ecx
mov dword [ebp - 0x3c], 0xdc705be7
mov dword [ebp - 0x18], 0xa5eafb5d
mov dword [ebp - 0x44], 0x276ac116
mov dword [ebp - 0x20], ecx
jmp 0x10032a51
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10032a43
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], esi
je 0x10032b04
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x14], 0xd2466e9f
push 4
mov dword [ebp - 0x20], ecx
pop ecx
jmp 0x10032a89
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4f0], 0xe662
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032a78
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x4ec]
neg esi
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x4ec]
sbb esi, esi
add ecx, 0xffff0004
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [ebp - 0x4ec]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x60]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jne 0x10032add
mov eax, dword [ebp - 0x60]
cmp esi, dword [ebp - 0x14]
jl 0x10032ae9
mov eax, edi
cmp dword [ebp - 0x14], ecx
jne 0x10032aeb
mov eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 7
jne 0x10032a62
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
neg edi
mov dword [ebp - 0x60], esi
sbb edi, edi
imul ecx, dword [ebp - 0x18], 0x7b396e
mov eax, dword [ebp - 0x18]
xor edx, edx
neg edi
push 3
sub ecx, 0x15cbe3e6
cmp ecx, eax
setle dl
xor ecx, ecx
cmp edi, edx
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x18]
cmp esi, ecx
lea ecx, [ebp - 0x624]
sete al
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
pop eax
mov dword [ebp - 0x14], eax
push esi
call fcn.1000d3e3
mov dword [ebp - 0x44], 0xfffffffb
xor edx, edx
push 5
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x20], edx
jmp 0x10032b95
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x624]
mov dword [eax + ecx*4], 0x6d210ec3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10032b82
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
call fcn.1000d97d
push 3
pop eax
mov dword [ebp - 0x34], 0x95f87b70
lea ecx, [ebp - 0x210]
push eax
call fcn.1000d3e3
mov dword [ebp - 4], 7
xor ecx, ecx
mov dword [ebp - 0x10], 0x62d5e48d
mov dword [ebp - 0x38], 0xa9a97186
push 2
mov dword [ebp - 0x28], 0x57511ecb
mov dword [ebp - 0x20], ecx
pop edi
jmp 0x10032bfa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8d8], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10032bed
mov dword [ebp - 0x10], ecx
jmp 0x10032ca0
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x6e0]
push 3
pop eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], esi
push eax
call fcn.1000d3e3
xor edx, edx
mov dword [ebp - 0x38], 0x76e1ee67
mov dword [ebp - 0x20], edx
jmp 0x10032c44
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6e0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
push 3
pop ecx
cmp dword [ebp - 0x20], ecx
jl 0x10032c34
mov dword [ebp - 0x18], edx
jmp 0x10032c89
mov dword [ebp - 0x38], 0xb40194dd
mov dword [ebp - 0x38], 0xcc2fdcb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], edx
jmp 0x10032c7e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9b4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10032c71
dec dword [ebp - 0x28]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
je 0x10032c51
lea ecx, [ebp - 0x6e0]
call fcn.1000d97d
dec dword [ebp - 0x10]
push 0
pop ecx
cmp dword [ebp - 0x10], 0xfffffff8
jle 0x10032c07
push esi
lea ecx, [ebp - 0x160]
call fcn.1000d3e3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x14], 0xdf82d83d
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0x24], 7
push edi
call fcn.1000d3e3
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10032cf5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xdf603fa7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10032ce2
mov dword [ebp - 0x10], edx
jmp 0x10032d12
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4ac]
mov dword [eax + ecx*4], 0x1f6604c3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10032cff
mov eax, dword [ebp - 0x160]
cmp dword [eax], edx
je 0x10032d35
mov dword [ebp - 0x24], 0xfffffffe
mov ecx, esi
cmp dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x160]
jne 0x10032d37
mov ecx, edx
cmp ecx, dword [eax]
jg 0x10032dca
mov dword [ebp - 0x20], 0xe5de
mov dword [ebp - 0x28], 0x1cdffa87
cmp dword [ebp - 0x44], edx
jne 0x10032d59
mov ecx, edx
cmp dword [ebp - 0x20], edx
je 0x10032d5b
mov ecx, esi
xor eax, eax
cmp ecx, edi
mov ecx, dword [ebp - 0x20]
setl al
sub ecx, eax
neg ecx
push 0
sbb ecx, ecx
inc ecx
pop ecx
sets cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x160]
mov esi, dword [ebp - 0x20]
cmp ecx, dword [eax]
setne dl
add esi, edx
sub esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, 0xfffffffb
setle bl
xor ecx, ecx
cmp ebx, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setge cl
mov dword [ebp - 0x14], ecx
jmp 0x10032ea0
mov esi, dword [ebp - 0x4ac]
push 4
pop ecx
cmp dword [eax], ecx
mov dword [ebp - 0x3c], 3
sbb eax, eax
mov dword [ebp - 0x18], edi
neg eax
mov dword [ebp - 0x28], 0x5cd63ccf
xor edx, edx
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x160]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setl dl
imul eax, edx
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
jmp 0x10032e9a
mov dword [ebp - 0x20], 0x84b879c9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
add eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032e97
push ecx
push 0x600
push 0x26e6
push 0xaaa
push 0x633
push 0xdb6
push 0xb0b
push 0x1ee7
push 0x1f2f
push 0x1372
push 0x43f
push 0x235f
push 0x229
push 0x26da
call dword [sym.imp.GDI32.dll_CreateFontA]
xor ecx, ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x10032e22
lea ecx, [ebp - 0x4ac]
call fcn.1000d97d
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 7
call fcn.1000d97d
movdqa xmm0, xmmword [0x1000b970]
lea ecx, [ebp - 0x834]
push ecx
lea eax, [ebp - 0x824]
push eax
push ecx
lea ecx, [ebp - 0x578]
movdqu xmmword [ebp - 0x834], xmm0
call fcn.1000d41f
lea ecx, [ebp - 0x7b4]
mov byte [ebp - 4], 9
movdqa xmm0, xmmword [0x1000b9c0]
lea eax, [ebp - 0x7a4]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x558]
movdqu xmmword [ebp - 0x7b4], xmm0
call fcn.1000d41f
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
push 5
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x44], 0xaebb1bb3
mov dword [ebp - 0x20], ecx
jmp 0x10032f3d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11c], 0x342e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10032f2c
mov esi, dword [ebp - 0x558]
xor edx, edx
inc edx
mov dword [esi + 0xc], ecx
mov dword [ebp - 0x14], 0x66c4779d
mov dword [ebp - 0x28], edx
cmp dword [esi + 0xc], ecx
je 0x10032f7f
mov eax, dword [ebp - 0x3c]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x11c]
cmp dword [ebp - 0x18], ecx
jne 0x10032f72
mov eax, dword [ebp - 0x14]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x14]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x3c]
je 0x10032fbd
mov eax, edx
cmp dword [ebp - 0x118], ecx
jne 0x10032fbf
mov eax, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], ecx
jmp 0x10033000
mov dword [ebp - 0x44], 0x771b7056
mov dword [ebp - 0x10], ecx
jmp 0x10032ff3
mov byte [ebp - 0x19], cl
cmp byte [ebp - 0x19], 0
je 0x10032ff0
push 0xe7e
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor edx, edx
xor ecx, ecx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10032fd3
cmp dword [ebp - 0x44], ecx
jne 0x10033005
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x10032fc7
inc dword [esi + 0xc]
cmp dword [esi + 0xc], edx
jle 0x10032f4e
lea ecx, [ebp - 0x558]
call fcn.1000d97d
mov dword [ebp - 0x24], 0x4a037a76
xor ecx, ecx
push 4
mov dword [ebp - 0x18], 0xf5540d7f
mov dword [ebp - 0x20], ecx
pop edx
jmp 0x10033045
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8f8], 0x9d05ba77
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10033034
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x1c
je 0x100330a6