Function at 0x10035642
Capabilities:
Accept command line arguments
Clear file content
Connect pipe
Create pipe
Create two anonymous pipes
Get file attributes
Parse pe header
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov eax, 0x10088e0f
call fcn.100873c8
mov eax, 0x1a9c
call fcn.10083b80
mov dword [ebp - 0x28], 0x394a
xor eax, eax
mov dword [ebp - 0x50], ecx
xor ecx, ecx
mov dword [ebp - 0x14], 0xcacff8ee
inc ecx
push ebx
mov dword [ebp - 0x20], 0x8b421dd2
mov dword [ebp - 0x24], eax
push esi
push edi
mov byte [ebp - 0x6d], dl
cmp dword [ebp - 0x24], ecx
jge 0x10035699
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x51c], 0x7a10dd66
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10035681
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x100356a2
mov edx, ecx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
setne cl
sub ecx, dword [ebp - 0x20]
push 5
pop ecx
push 3
pop ebx
je 0x100357b6
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
jmp 0x100357ab
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x10035735
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003572d
push 0x3bc
push 0x7ce
push 0x1d08
push 0x9f7
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x100356fe
push 5
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x100357a0
mov dword [ebp - 0x2c], 0x1e6e836
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10035778
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x51c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x51c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0x34], eax
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10035749
mov dword [ebp - 0x2c], eax
jmp 0x10035795
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035792
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x1003577d
inc dword [ebp - 0x20]
push 5
pop ecx
cmp dword [ebp - 0x20], eax
jle 0x1003573a
inc dword [ebp - 0x28]
push 5
pop ecx
cmp dword [ebp - 0x28], eax
jle 0x100356ef
jmp 0x100357dc
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100357ce
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1258], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100357bd
dec dword [ebp - 0x1254]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100357f6
push 0x1ab
push 0x21f0
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
movdqa xmm0, xmmword [0x10008030]
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x1298]
push eax
lea ecx, [ebp - 0x1988]
movdqu xmmword [ebp - 0x1298], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x227]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x16b4]
push dword [esi]
call fcn.10019950
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0x6f1bf506
mov dword [ebp - 0x1c], ebx
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x1c], eax
jl 0x100359b2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xa
cmp dword [ebp - 0x2c], 0x12
jge 0x1003596f
xor ebx, ebx
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x1508]
push eax
lea eax, [ebp - 0x1518]
push eax
lea ecx, [ebp - 0x1728]
movdqu xmmword [ebp - 0x1518], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1de]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x7ec]
push dword [esi]
call fcn.10019950
xor eax, eax
inc eax
mov byte [ebp - 4], al
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
push 3
mov dword [ebp - 0x34], 0xfaeb382e
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1003592e
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x7ec]
push dword [ebp - 0x14]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7ec]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7ec]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7ec]
call fcn.10019992
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x7ec]
xor eax, eax
inc eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax]
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100358d6
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10035949
push ebx
push 0x160a
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 4], bl
call fcn.10019976
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x12
jl 0x10035874
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
or esi, 0xffffffff
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035984
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100359a9
push eax
push eax
push eax
push 0x4fc
push 0x708
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1003585e
lea ecx, [ebp - 0x16b4]
mov dword [ebp - 4], esi
call fcn.10019976
movdqa xmm0, xmmword [0x10008030]
lea eax, [ebp - 0x12a8]
push eax
lea eax, [ebp - 0x12b8]
push eax
lea ecx, [ebp - 0x1910]
movdqu xmmword [ebp - 0x12b8], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1e0]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x166c]
push dword [esi]
call fcn.10019950
push 3
pop eax
mov dword [ebp - 0x1c], 0x6f1bf506
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x10035a45
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035a40
push eax
push eax
push eax
push 0x4fc
push 0x708
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10035a1b
lea ecx, [ebp - 0x166c]
call fcn.10019976
movdqa xmm0, xmmword [0x10008030]
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x1458]
push eax
lea ecx, [ebp - 0x1830]
movdqu xmmword [ebp - 0x1458], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1d1]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x16cc]
push dword [esi]
call fcn.10019950
push 3
pop eax
mov dword [ebp - 0x1c], 0x6f1bf506
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x10035ad5
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035ad0
push eax
push eax
push eax
push 0x4fc
push 0x708
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10035aab
lea ecx, [ebp - 0x16cc]
call fcn.10019976
xor eax, eax
mov dword [ebp - 0x34], 0xf73838a1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10035b0b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1878], 0x4a53aa9a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10035af2
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035b1e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x121c]
mov dword [ebp - 0x186c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x2f4a8b10
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x38], 0xfffffff6
push 4
call fcn.100198f4
push 2
pop esi
mov dword [ebp - 4], esi
push 5
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xd5228033
mov dword [ebp - 0x24], eax
jmp 0x10035b82
push dword [ebp - 0x24]
call fcn.10019992
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
lea ecx, [ebp - 0x121c]
jl 0x10035b74
dec dword [ebp - 0x4c]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10019976
push 3
pop eax
mov dword [ebp - 0x28], 0x5d6c05ba
lea ecx, [ebp - 0xe1c]
push eax
call fcn.100198f4
push 3
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x4c], 0x6d7d0454
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10035bf4
push ecx
pop ebx
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe1c]
call fcn.10019992
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10035bd2
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 3
pop ecx
mov dword [ebp - 0x28], 0xffffffee
cmp dword [ebp - 0x28], 0x19
jg 0x10035c95
xor ebx, ebx
jmp 0x10035c0c
push 3
pop ecx
push ecx
mov dword [ebp - 0x4c], 0x54320e32
lea ecx, [ebp - 0xdec]
call fcn.100198f4
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], ebx
jmp 0x10035c3f
push dword [ebp - 0x24]
lea ecx, [ebp - 0xdec]
call fcn.10019992
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x24]
push 3
pop eax
cmp dword [ebp - 0x24], eax
jl 0x10035c28
cmp dword [ebp - 0x4c], ebx
je 0x10035c4f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xdec]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
push esi
call fcn.10019992
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp ecx, 5
lea ecx, [ebp - 0xdec]
push 3
setle dl
mov dword [eax], edx
pop eax
mov byte [ebp - 4], al
call fcn.10019976
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
jle 0x10035c09
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov dword [ebp - 0x28], esi
xor eax, eax
cmp dword [ebp - 0x28], eax
jl 0x10035e10
xor ebx, ebx
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x20], eax
inc ecx
mov dword [ebp - 0x24], ebx
jmp 0x10035cc4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x888], 0x50e35260
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10035cb3
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10035ce2
push 0x1cf2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x10035e01
jmp 0x10035cf3
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xe04]
push esi
call fcn.100198f4
push 5
pop eax
xor ecx, ecx
mov byte [ebp - 4], al
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x10035d21
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x22c], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10035d10
mov dword [ebp - 0x14], ebx
jmp 0x10035d42
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe04]
call fcn.10019992
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035d2b
mov dword [ebp - 0x22c], 0x1c5a3d7f
lea ecx, [ebp - 0xe1c]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
push dword [ebp - 0x20]
call fcn.10019992
mov edx, 0x494dfd99
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xe04]
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x20]
mov esi, eax
xor eax, eax
inc eax
cmp eax, ecx
push 3
sbb ecx, ecx
inc ecx
cmp ecx, 0x967268f5
mov ecx, dword [ebp - 0x1c]
sbb edx, edx
xor eax, eax
inc edx
cmp edx, ecx
setne al
or ecx, 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
lea ecx, [ebp - 0xe04]
pop eax
setge dl
sub edx, dword [esi]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], al
call fcn.10019976
inc dword [ebp - 0x20]
push 2
pop esi
cmp dword [ebp - 0x20], esi
jle 0x10035cf0
dec dword [ebp - 0x28]
jns 0x10035ca5
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
or eax, 0xffffffff
lea ecx, [ebp - 0xe1c]
mov dword [ebp - 4], eax
call fcn.10019976
movdqa xmm0, xmmword [0x10008030]
lea eax, [ebp - 0x12c8]
push eax
lea eax, [ebp - 0x12d8]
push eax
lea ecx, [ebp - 0x19d0]
movdqu xmmword [ebp - 0x12d8], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1d5]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1684]
push dword [esi]
call fcn.10019950
push 6
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1840]
lea eax, [ebp - 0x15a8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x15b8]
push eax
movdqu xmmword [ebp - 0x15b8], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1d7]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x69c]
push dword [esi]
call fcn.10019950
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x38], 0x60693009
inc eax
mov dword [ebp - 0x38], 0x513244d5
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], 0xab61
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x4c], 0xba167c28
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10035f07
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a78], 0xbc9fa8bc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10035eee
xor eax, eax
push eax
lea ecx, [ebp - 0x69c]
call fcn.10019992
lea ecx, [ebp - 0x69c]
mov dword [eax], 0x15
xor eax, eax
push eax
call fcn.10019992
cmp dword [eax], 0
jge 0x10035f9d
xor ebx, ebx
mov dword [ebp - 0x34], 0xfffffff8
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], 0x6a07563f
mov dword [ebp - 0x24], ebx
jmp 0x10035f5f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1928], 0x182b4746
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10035f4e
push ebx
lea ecx, [ebp - 0x69c]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x69c]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x4c]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x69c]
dec dword [eax]
call fcn.10019992
cmp dword [eax], ebx
jl 0x10035f2e
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 6
pop eax
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], al
call fcn.10019976
push 3
pop eax
mov dword [ebp - 0x1c], 0x6f1bf506
lea ecx, [ebp - 0x24c]
push eax
call fcn.100198f4
push 3
pop eax
push eax
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 8
call fcn.100198f4
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x34], 0xf30b
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1003601a
push ecx
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24c]
call fcn.10019992
mov dword [eax], 0xbbca6318
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10035ff3
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10036049
push 3
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x12c]
call fcn.10019992
mov dword [eax], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10036025
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
push eax
lea ecx, [ebp - 0x12c]
call fcn.10019992
lea ecx, [ebp - 0x12c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019992
cmp dword [eax], 2
jg 0x1003620c
xor eax, eax
mov dword [ebp - 0x4c], 0xfaa32f3f
push eax
lea ecx, [ebp - 0x12c]
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
mov edi, eax
lea ecx, [ebp - 0x12c]
xor eax, eax
push eax
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
lea ecx, [ebp - 0x12c]
mov esi, dword [eax]
xor eax, eax
add esi, dword [edi]
push eax
call fcn.10019992
add esi, 0xc109
lea ecx, [ebp - 0x12c]
sub esi, 0xa1245c81
mov eax, dword [eax]
add esi, eax
neg esi
sbb esi, esi
xor eax, eax
push eax
inc esi
call fcn.10019992
xor ecx, ecx
cmp esi, dword [eax]
setge cl
xor ebx, ebx
cmp ecx, 0x9507
lea ecx, [ebp - 0x12c]
setne bl
xor eax, eax
push eax
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
lea ecx, [ebp - 0x24c]
mov esi, dword [eax]
add esi, ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.10019992
xor ecx, ecx
cmp esi, dword [eax]
setge cl
dec ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x12c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
push 2
lea ecx, [ebp - 0x24c]
mov edi, eax
call fcn.10019992
push ebx
lea ecx, [ebp - 0x24c]
mov esi, eax
call fcn.10019992
xor edx, edx
mov ecx, dword [eax]
cmp ecx, dword [esi]
mov eax, dword [edi]
setne dl
sub eax, edx
imul esi, eax, 0xdfdd
xor eax, eax
lea ecx, [ebp - 0x12c]
push eax
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
xor ebx, ebx
lea ecx, [ebp - 0x12c]
cmp esi, dword [eax]
sete bl
xor eax, eax
push eax
call fcn.10019992
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x12c]
push eax
call fcn.10019992
lea ecx, [ebp - 0x24c]
push dword [eax]
call fcn.10019992
lea ecx, [ebp - 0x12c]
mov eax, dword [eax]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
xor eax, eax
push eax
call fcn.10019992
lea ecx, [ebp - 0x12c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019992
cmp dword [eax], 2
jle 0x1003606f
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x12c]
call fcn.10019976
push 6
pop eax
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], al
call fcn.10019976
mov dword [ebp - 0x28], 0x394a
xor eax, eax
mov dword [ebp - 0x14], 0xcacff8ee
xor ecx, ecx
mov dword [ebp - 0x20], 0x8b421dd2
inc ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10036262
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x52c], 0x7a10dd66
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003624a
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x1003626b
mov edx, ecx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x20]
je 0x10036374
push 3
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x1003639a
xor ebx, ebx
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x100362f5
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x100362f0
push 0x3bc
push 0x7ce
push 0x1d08
push 0x9f7
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
dec dword [ebp - 0x20]
jns 0x100362c4
mov dword [ebp - 0x20], ebx
jmp 0x1003635b
mov dword [ebp - 0x2c], 0x1e6e836
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x10036339
push 5
pop ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x52c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x52c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1003630c
mov dword [ebp - 0x2c], ebx
jmp 0x10036353
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10036350
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1003633e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x100362fa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100362b5
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x10036398
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1003638c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12f8], 8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003637b
dec dword [ebp - 0x12f4]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100363b6
push 0x1ab
push 0x21f0
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov esi, 0xa5d6c05b
cmp dword [ebp - 0x1c], eax
jl 0x10036888
jmp 0x100363ce
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], 0xa
cmp dword [ebp - 0x2c], 0x12
jge 0x100364e5
xor ebx, ebx
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x1468]
push eax
lea eax, [ebp - 0x1478]
push eax
lea ecx, [ebp - 0x1850]
movdqu xmmword [ebp - 0x1478], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1d9]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6a8]
push dword [esi]
call fcn.10019950
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0xfaeb382e
mov dword [ebp - 0x14], ebx
jmp 0x1003649c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x6a8]
push dword [ebp - 0x14]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10019992
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x6a8]
xor eax, eax
inc eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax]
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
push 3
pop eax
cmp dword [ebp - 0x14], eax
jle 0x10036444
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x100364ba
push ebx
push 0x160a
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 6
pop eax
lea ecx, [ebp - 0x6a8]
mov byte [ebp - 4], al
call fcn.10019976
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x12
jl 0x100363e7
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov esi, 0xa5d6c05b
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100364fa
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov dword [ebp - 0x54], 0x1cd1
inc ecx
mov dword [ebp - 0x24], eax
jmp 0x1003651a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5c], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1003650c
mov dword [ebp - 0x5c], 0x1b
cmp dword [ebp - 0x5c], 0xfffffffd
je 0x1003663b
xor ebx, ebx
jmp 0x10036537
xor ecx, ecx
inc ecx
push ecx
lea ecx, [ebp - 0x2e0]
call fcn.100198f4
xor eax, eax
mov byte [ebp - 4], 0xb
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x18394d25
mov dword [ebp - 0x24], ebx
jmp 0x1003656d
push dword [ebp - 0x24]
call fcn.10019992
mov dword [eax], 0x34111d01
xor eax, eax
inc dword [ebp - 0x24]
inc eax
lea ecx, [ebp - 0x2e0]
cmp dword [ebp - 0x24], eax
jl 0x10036559
push ebx
call fcn.10019992
push ebx
lea ecx, [ebp - 0x2e0]
call fcn.10019992
cmp dword [eax], ebx
je 0x1003659d
push ebx
lea ecx, [ebp - 0x2e0]
call fcn.10019992
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x2e0]
push ebx
call fcn.10019992
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x2e0]
push ebx
call fcn.10019992
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x2e0]
push ebx
call fcn.10019992
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x2e0]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
push ebx
call fcn.10019992
xor ecx, ecx
inc ecx
cmp dword [eax], ecx
jl 0x100365ed
mov eax, ecx
cmp dword [ebp - 0x34], ebx
jne 0x100365ef
mov eax, ebx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x2e0]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x5c]
push ebx
call fcn.10019992
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
push 6
setg dl
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x4c], edx
pop eax
mov byte [ebp - 4], al
call fcn.10019976
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffffd
jne 0x10036534
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003664e
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
mov byte [ebp - 0x2d], al
xor edx, edx
mov dword [ebp - 0x24], 0xe6768459
inc edx
mov dword [ebp - 0x4c], 0xf890ba5f
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x34], 0xdffa
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jge 0x1003668d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6c], 0x9ea4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10036678
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100366ae
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1890], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10036699
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100366c4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1318], 0xc5a74d4b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100366b3
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, 0xdd61fb9a
mov dword [ebp - 0x188c], eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1314], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
cmp ecx, 7
mov ecx, 0xca862934
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x6c]
mov edx, 0xd4e70302
setl cl
cmp ecx, 0xaba4a2c6
sbb ecx, ecx
inc ecx
cmp edx, eax
sbb eax, eax
xor edx, edx
neg eax
add ecx, eax
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], eax
jne 0x10036758
cmp dword [ebp - 0x1314], eax
je 0x1003675b
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x6c]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x6c]
jg 0x1003679e
cmp dword [ebp - 0x18], eax
je 0x1003679e
lea edx, [eax + 1]
jmp 0x100367a0
mov edx, eax
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
cmp byte [ebp - 0x2d], 0
je 0x1003687f
mov dword [ebp - 0xb94], esi
xor eax, eax
mov dword [ebp - 0xb90], esi
inc eax
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0x14], eax
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jg 0x1003680a
mov dword [ebp - 0x34], 0xfffffff7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xb94]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb94], ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100367e2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffeb
jl 0x10036865
xor ebx, ebx
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x1003682a
push 0x223e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10036854
push 0x6e2
push ebx
push ebx
push 0xa17
push 0x143c
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jge 0x10036815
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
push eax
push eax
push eax
push 0x4fc
push 0x708
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
dec dword [ebp - 0x1c]
jns 0x100363cc
or eax, 0xffffffff
lea ecx, [ebp - 0x1684]
mov dword [ebp - 4], eax
call fcn.10019976
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov dword [ebp - 0x2c], 0xf75dcec3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100368b5
push eax
call edi
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor esi, esi
mov dword [ebp - 0x2c], eax
inc esi
cmp dword [ebp - 0x2c], esi
jl 0x10036a7d
push 2
lea ecx, [ebp - 0x6c0]
call fcn.100198f4
mov dword [ebp - 4], 0xc
mov eax, 0x7a3a11c1
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x674], eax
xor eax, eax
mov dword [ebp - 0x34], 0x278c007c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003692c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6c0]
call fcn.10019992
mov dword [eax], 0x2a4f402e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003690d
xor eax, eax
mov dword [ebp - 0x674], esi
cmp dword [ebp - 0x674], eax
jl 0x10036a59
push dword [ebp - 0x674]
lea ecx, [ebp - 0x6c0]
call fcn.10019992
cmp dword [eax], 0
je 0x100369e6
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003697d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10036965
xor eax, eax
mov dword [ebp - 0x98], eax
jmp 0x100369db
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100369ab
push eax
push 0x1efc
push 0x23f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100369d5
push 0x2b2
push 0x13bf
push 0x21a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xffffffe3
jl 0x10036985
jmp 0x10036a05
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10036a05
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
lea ecx, [ebp - 0x6c0]
inc eax
push eax
call fcn.10019992
cmp dword [eax], 0
je 0x10036a48
xor eax, eax
lea ecx, [ebp - 0x6c0]
inc eax
push eax
call fcn.10019992
push dword [ebp - 0x674]
lea ecx, [ebp - 0x6c0]
mov esi, eax
call fcn.10019992
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x10036a48
xor eax, eax
inc eax
jmp 0x10036a4a
xor eax, eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x674]
jns 0x1003693e
or eax, 0xffffffff
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 4], eax
call fcn.10019976
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
push eax
pop esi
cmp dword [ebp - 0x2c], eax
jge 0x100368ca
xor eax, eax
mov esi, 0xf73838a1
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10036aa7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18a8], 0x4a53aa9a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10036a8e
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036abe
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x189c], eax
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10036aee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18c0], 0x4a53aa9a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10036ad5
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036b05
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18b4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xf75dcec3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10036b24
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10036cd2
push 2
lea ecx, [ebp - 0x6d8]
call fcn.100198f4
mov dword [ebp - 4], 0xd
mov eax, 0x7a3a11c1
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
xor eax, eax
mov dword [ebp - 0x34], 0x278c007c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10036b8e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6d8]
call fcn.10019992
mov dword [eax], 0x2a4f402e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10036b6f
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0x64c], ecx
cmp dword [ebp - 0x64c], eax
jl 0x10036cbe
push dword [ebp - 0x64c]
lea ecx, [ebp - 0x6d8]
call fcn.10019992
cmp dword [eax], 0
je 0x10036c4b
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
inc ecx
cmp dword [ebp - 0x24], ecx
jge 0x10036be2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10036bca
xor eax, eax
mov dword [ebp - 0xc4], eax
jmp 0x10036c40
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036c10
push eax
push 0x1efc
push 0x23f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10036c3a
push 0x2b2
push 0x13bf
push 0x21a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
dec dword [ebp - 0xc4]
cmp dword [ebp - 0xc4], 0xffffffe3
jl 0x10036bea
jmp 0x10036c6a
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10036c6a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
lea ecx, [ebp - 0x6d8]
inc eax
push eax
call fcn.10019992
cmp dword [eax], 0
je 0x10036cad
xor eax, eax
lea ecx, [ebp - 0x6d8]
inc eax
push eax
call fcn.10019992
push dword [ebp - 0x64c]
lea ecx, [ebp - 0x6d8]
mov esi, eax
call fcn.10019992
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x10036cad
xor eax, eax
inc eax
jmp 0x10036caf
xor eax, eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x64c]
jns 0x10036ba3
or eax, 0xffffffff
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 4], eax
call fcn.10019976
inc dword [ebp - 0x2c]
xor eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
jge 0x10036b2c
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x168]
call fcn.100198f4
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x34], 0xc1348862
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10036d2a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x168]
call fcn.10019992
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10036d0c
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10036d40
push dword [ebp - 0x14]
call fcn.10019992
mov dword [eax], 8
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x168]
cmp dword [ebp - 0x14], ebx
jl 0x10036d2f
push 2
pop esi
push esi
call fcn.10019992
push 3
pop eax
push eax
lea ecx, [ebp - 0x168]
call fcn.10019992
mov eax, dword [eax]
neg eax
je 0x10036de4
push esi
lea ecx, [ebp - 0x168]
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x168]
push eax
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x168]
push eax
call fcn.10019992
push esi
lea ecx, [ebp - 0x168]
call fcn.10019992
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x168]
setne bl
call fcn.10019992
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0x5984
lea ecx, [ebp - 0x168]
setge bl
xor eax, eax
push eax
call fcn.10019992
sub ebx, dword [eax]
sub ebx, 0x189d9e62
je 0x10036de4
xor eax, eax
lea esi, [eax + 1]
jmp 0x10036de8
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
push eax
call fcn.10019992
push 6
pop ecx
cmp ecx, esi
push 2
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x168]
setle bl
call fcn.10019992
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
mov esi, eax
setg dl
cmp edx, 0xfff7
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
cmp ebx, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [esi]
setl cl
xor eax, eax
cmp ecx, 0xefc16765
jne 0x10036e50
mov esi, ebx
cmp dword [ebp - 0x14], eax
jne 0x10036e52
mov esi, eax
push eax
lea ecx, [ebp - 0x168]
call fcn.10019992
xor ecx, ecx
cmp esi, 0x3cb8e004
setge cl
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], eax
call fcn.10019976
push 9
pop eax
push 2
pop esi
mov dword [ebp - 0x2c], 0x76e6bacd
lea ecx, [ebp - 0x55c]
mov dword [ebp - 0x28], eax
push esi
call fcn.100198f4
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x1030]
or eax, 0xffffffff
mov dword [ebp - 0x38], 0x142b622b
push 3
mov dword [ebp - 0x38], eax
pop eax
mov dword [ebp - 0x38], ebx
push eax
call fcn.100198f4
push esi
lea ecx, [ebp - 0xe34]
mov byte [ebp - 4], 0x10
call fcn.100198f4
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10036ef9
push dword [ebp - 0x20]
lea ecx, [ebp - 0x55c]
call fcn.10019992
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036edc
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10036f22
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1030]
call fcn.10019992
push 3
and dword [eax], 0
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x10036f04
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10036f3e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe34]
call fcn.10019992
mov dword [eax], 0x495ee35d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036f27
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
setge dl
dec ecx
add ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
cmp dword [ebp - 0x2c], edx
jne 0x10036f8d
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10036f83
push dword [ebp - 0x28]
lea ecx, [ebp - 0x55c]
call fcn.10019992
mov dword [eax], 0xa96141e4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10036f6c
jmp 0x1003707d
mov dword [ebp - 0x40], 0x4df6f978
mov dword [ebp - 0x38], 0x18ebdb8
mov dword [ebp - 0x38], 0xff68e10d
mov dword [ebp - 0x38], 0xf7b40076
mov dword [ebp - 0x38], 0x12ef314d
mov dword [ebp - 0x38], 0xfffffff6
push 3
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0x610cb4e3
mov dword [ebp - 0x38], 0x48968f25
mov dword [ebp - 0x38], 0x8d6e8597
mov dword [ebp - 0x28], eax
jmp 0x10037066
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x55c]
push dword [ebp - 0x28]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x55c]
call fcn.10019992
mov eax, dword [eax]
add eax, 0x37e0d1b3
je 0x1003700d
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1003700f
mov eax, ebx
jmp 0x1003700f
xor eax, eax
add eax, 0xfffffff7
je 0x10037041
mov dword [ebp - 0x34], 0xf215a609
lea ecx, [ebp - 0x55c]
push dword [ebp - 0x28]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x55c]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10019992
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
jmp 0x10037063
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x1003705e
push dword [ebp - 0x40]
lea ecx, [ebp - 0x55c]
call fcn.10019992
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10037048
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10036fdc
push ebx
lea ecx, [ebp - 0xe34]
call fcn.10019992
dec dword [eax]
lea ecx, [ebp - 0xe34]
call fcn.10019976
lea ecx, [ebp - 0x1030]
call fcn.10019976
or esi, 0xffffffff
lea ecx, [ebp - 0x55c]
mov dword [ebp - 4], esi
call fcn.10019976
xor eax, eax
mov dword [ebp - 0x2c], 0xf75dcec3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100370ba
push eax
call edi
xor eax, eax
mov dword [ebp - 0x2c], eax
push 2
pop edi
cmp dword [ebp - 0x2c], ebx
jl 0x1003726c
push edi
lea ecx, [ebp - 0x6f0]
call fcn.100198f4
mov dword [ebp - 4], 0x12
mov eax, 0x7a3a11c1
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], eax
xor eax, eax
mov dword [ebp - 0x34], 0x278c007c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037128
push dword [ebp - 0x24]
lea ecx, [ebp - 0x6f0]
call fcn.10019992
mov dword [eax], 0x2a4f402e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1003710a
xor eax, eax
mov dword [ebp - 0x664], ebx
cmp dword [ebp - 0x664], eax
jl 0x10037250
push dword [ebp - 0x664]
lea ecx, [ebp - 0x6f0]
call fcn.10019992
cmp dword [eax], 0
je 0x100371df
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10037172
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xac], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1003715e
xor eax, eax
mov dword [ebp - 0xac], eax
jmp 0x100371d4
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100371a4
push eax
push 0x1efc
push 0x23f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100371ce
push 0x2b2
push 0x13bf
push 0x21a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
dec dword [ebp - 0xac]
cmp dword [ebp - 0xac], 0xffffffe3
jl 0x1003717a
jmp 0x100371fe
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100371fe
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push ebx
lea ecx, [ebp - 0x6f0]
call fcn.10019992
cmp dword [eax], 0
je 0x1003723a
push ebx
lea ecx, [ebp - 0x6f0]
call fcn.10019992
push dword [ebp - 0x664]
lea ecx, [ebp - 0x6f0]
mov esi, eax
call fcn.10019992
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x1003723a
mov eax, ebx
jmp 0x1003723c
xor eax, eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x664]
push 0xffffffffffffffff
pop esi
jns 0x1003713a
or esi, esi
lea ecx, [ebp - 0x6f0]
mov dword [ebp - 4], esi
call fcn.10019976
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jge 0x100370c9
xor eax, eax
mov ecx, 0x9ff60657
mov dword [ebp - 0xa24], ecx
mov dword [ebp - 0xa20], ecx
mov dword [ebp - 0xa1c], ecx
mov dword [ebp - 0xa18], ecx
mov dword [ebp - 0x2c], 0x95364446
mov dword [ebp - 0x38], 0x1a0734f0
mov dword [ebp - 0x34], 0x9e17716e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100372bc
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11f4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100372a7
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jg 0x1003739d
push 5
pop edx
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x10037391
mov dword [ebp - 0x1c], 0x622b6078
mov dword [ebp - 0x4c], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xa24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
test eax, eax
mov eax, dword [ebp - 0x11f4]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x11f0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xa24]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1003732e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xd82c32b9
setne cl
xor eax, eax
cmp ecx, 0x12ef
jg 0x10037352
mov edx, ebx
cmp dword [ebp - 0x2c], eax
jne 0x10037354
mov edx, eax
mov eax, dword [ebp - 0x28]
neg edx
push 3
mov ecx, dword [ebp + eax*4 - 0xa24]
mov eax, dword [ebp - 0x28]
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
pop ecx
sbb edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x11f4]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x28]
push 5
pop edx
cmp dword [ebp - 0x28], ecx
jle 0x100372e0
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x100372ce
mov dword [ebp - 0x28], 0x63126ff2
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x3c], 0x65352f76
mov dword [ebp - 0x20], 0x409884cb
push edi
call fcn.100198f4
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x34], 0xfffc
mov dword [ebp - 0x24], eax
jmp 0x100373e4
push dword [ebp - 0x24]
call fcn.10019992
mov dword [eax], 0xd68f9855
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x5f0]
cmp dword [ebp - 0x24], edi
jl 0x100373d3
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], 0xf8f5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
sub eax, 0xfffa
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
xor eax, eax
push eax
dec esi
call fcn.10019992
xor ecx, ecx
mov edx, 0xffff
push 5
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
pop eax
setge cl
cmp ecx, eax
ja 0x10037629
mov dword [ebp - 0x4c], 0xce7
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], 0xec287848
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10037482
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0xe2718b96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003746a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10037498
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e8], 0x5dd68647
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037487
mov dword [ebp - 0x3c], 0x84ed
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
cmp esi, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], ebx
jbe 0x100374d3
mov ecx, ebx
cmp dword [ebp - 0xa8], eax
jne 0x100374d5
mov ecx, eax
mov eax, dword [ebp - 0x4c]
add eax, ecx
jne 0x100374e1
cmp dword [ebp - 0x24], eax
je 0x100374f8
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.10019992
cmp dword [eax], 0
je 0x100374f6
mov ecx, ebx
jmp 0x100374fa
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, esi
setg al
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
jge 0x10037514
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10037516
mov edi, eax
jmp 0x10037518
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0x5f0]
call fcn.10019992
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0xa8]
setne al
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esi], edx
mov dword [ebp - 0x1e8], 0x5eba
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub eax, 0x7a2aa563
je 0x1003758c
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1003758e
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1a
je 0x100375b1
push 9
pop eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jne 0x1003757e
jmp 0x100375b1
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x44], eax
jmp 0x100375ac
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x1e8]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jle 0x1003759a
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0x7dcc
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0xa8]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x18]
je 0x100375e9
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x5f0]
xor eax, eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x44]
xor edx, edx
push 2
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ebx, ebx
cmp esi, edx
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
cmp ebx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
inc ebx
jmp 0x1003768d
mov dword [ebp - 0x34], edx
xor edx, edx
mov dword [ebp - 0x4c], 0xf543a9b1
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
lea ecx, [ebp - 0x5f0]
setge dl
xor eax, eax
sub edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
push eax
add esi, edx
call fcn.10019992
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
cmp esi, eax
sete dl
sub edx, 0x679d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
push 6
mov dword [ebp - 0x20], 0xe
pop eax
cmp dword [ebp - 0x20], eax
jge 0x100376d2
push 6
xor eax, eax
pop ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100376ca
push eax
push 0x1c4a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 6
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100376a1
or esi, 0xffffffff
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 4], esi
call fcn.10019976
push 3
pop eax
mov dword [ebp - 0x14], 0xfffffffa
lea ecx, [ebp - 0xe4c]
push eax
call fcn.100198f4
xor eax, eax
mov dword [ebp - 4], 0x14
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1003772e
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe4c]
call fcn.10019992
push 3
mov dword [eax], 0xa1372625
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x1003770d
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100377c4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x14], 0xfffffff1
cmp dword [ebp - 0x14], 0x13
jge 0x100377e2
mov dword [ebp - 0x24], 0x37a3a11c
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
cmp eax, 8
setne cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xe4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x24]
setle al
xor edx, edx
cmp ecx, eax
setle dl
mov dword [esi], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
jl 0x10037752
or esi, 0xffffffff
jmp 0x100377e2
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100377e2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0xe4c]
mov dword [ebp - 4], esi
call fcn.10019976
movdqa xmm0, xmmword [0x10007f70]
lea eax, [ebp - 0x1528]
push eax
lea eax, [ebp - 0x1538]
mov dword [ebp - 0x54], 0xf73838a1
push eax
lea ecx, [ebp - 0x19a0]
movdqu xmmword [ebp - 0x1538], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1db]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x608]
push dword [esi]
call fcn.10019950
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x3c], 0x94a1888
mov dword [ebp - 0x4c], 0xe136dc99
mov dword [ebp - 0x3c], eax
push 3
pop eax
cmp dword [ebp - 0x3c], eax
jg 0x10037931
jmp 0x10037869
xor ebx, ebx
inc ebx
mov dword [ebp - 0x4c], 0x470ed99e
lea ecx, [ebp - 0x608]
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x3c]
call fcn.10019992
xor ebx, ebx
cmp dword [eax], ebx
jne 0x100378a9
xor eax, eax
lea ecx, [ebp - 0x608]
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp dword [eax], ecx
setle dl
imul eax, edx, 0x82ca
test eax, eax
je 0x100378d3
push 3
pop eax
push eax
lea ecx, [ebp - 0x608]
call fcn.10019992
cmp dword [eax], ebx
je 0x100378d3
push edi
lea ecx, [ebp - 0x608]
call fcn.10019992
cmp dword [eax], ebx
je 0x100378d3
xor eax, eax
lea esi, [eax + 1]
jmp 0x100378d7
xor eax, eax
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x608]
call fcn.10019992
push dword [ebp - 0x3c]
xor ebx, ebx
lea ecx, [ebp - 0x608]
mov eax, dword [eax]
add eax, esi
cmp eax, 0xafbd13d8
setne bl
call fcn.10019992
xor ecx, ecx
push 7
cmp dword [eax], ebx
setne cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
pop ecx
sub ecx, eax
cmp ecx, 7
push 3
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x3c]
pop eax
cmp dword [ebp - 0x3c], eax
jle 0x10037866
or esi, 0xffffffff
lea ecx, [ebp - 0x608]
mov dword [ebp - 4], esi
call fcn.10019976
push edi
lea ecx, [ebp - 0x1a8]
call fcn.100198f4
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003797d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1a8]
call fcn.10019992
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037962
xor eax, eax
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10019992
lea ecx, [ebp - 0x1a8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10019992
xor ebx, ebx
inc ebx
cmp dword [eax], 0xf
je 0x10037b2c
mov eax, 0xffff
lea ecx, [ebp - 0xe64]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
push edi
call fcn.100198f4
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x4c], 0xcecb2ec6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100379ed
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30c], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100379d5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10037a13
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe64]
call fcn.10019992
mov dword [eax], 0xaf1e2cd8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100379f5
xor eax, eax
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10019992
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10037a2f
mov eax, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x30c]
lea ecx, [ebp - 0x1a8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x308]
xor eax, eax
push eax
call fcn.10019992
cmp dword [ebp - 0x30c], esi
jle 0x10037a6b
push ebx
lea ecx, [ebp - 0x1a8]
call fcn.10019992
cmp dword [eax], 0
je 0x10037a6b
mov edi, ebx
xor eax, eax
jmp 0x10037a6f
xor eax, eax
mov edi, eax
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10019992
push ebx
lea ecx, [ebp - 0xe64]
mov esi, dword [eax]
imul esi, edi
call fcn.10019992
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x30c]
cmp esi, eax
setge cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x1a8]
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
sub esi, ecx
add eax, 7
cmp eax, esi
mov eax, dword [ebp - 0x30c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setne cl
cmp ecx, 0xfffffffe
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xe64]
mov byte [ebp - 4], 0x16
call fcn.10019976
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.10019992
lea ecx, [ebp - 0x1a8]
inc dword [eax]
xor eax, eax
push eax
call fcn.10019992
push 2
pop edi
push 0xffffffffffffffff
cmp dword [eax], 0xf
pop esi
jne 0x100379a6
or esi, esi
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.10019992
lea ecx, [ebp - 0x1a8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], esi
call fcn.10019976
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10037b65
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18d8], 0x4a53aa9a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10037b54
push 3
pop eax
mov dword [ebp - 0x2c], 0xb26bdde0
lea ecx, [ebp - 0x1048]
push eax
call fcn.100198f4
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x38], 0x15256ee9
mov dword [ebp - 0x38], 0x348f4a8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x24891023
push 9
mov dword [ebp - 0x38], esi
pop ecx
mov dword [ebp - 0x38], 0xfb26c4f3
mov dword [ebp - 0x38], ecx
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10037bde
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1048]
call fcn.10019992
push 3
mov dword [eax], 0x6318d581
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x10037bbd
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10037cc2
mov dword [ebp - 0x24], 0xb023ed15
lea ecx, [ebp - 0x1148]
push ebx
call fcn.100198f4
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10037c25
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1148]
call fcn.10019992
mov dword [eax], 0xe94f934f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10037c07
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jg 0x10037c9c
push 6
pop ecx
mov dword [ebp - 0x1c], 0xb7f37c04
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x9f4ffcf3
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x9fa85f88
mov dword [ebp - 0x38], 0xf05f4326
mov dword [ebp - 0x38], 0xd5b611fb
mov dword [ebp - 0x38], 0xc7fffaa2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], 0x992d
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10037c94
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xfffffffc
dec dword [ebp - 0x4c]
dec dword [ebp - 0x1c]
jns 0x10037c7f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10037c30
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037cb0
push 0x180f
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
lea ecx, [ebp - 0x1148]
mov byte [ebp - 4], 0x18
call fcn.10019976
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff2
jge 0x10037be6
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], esi
call fcn.10019976
push edi
lea ecx, [ebp - 0x11c4]
call fcn.100198f4
mov dword [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x1c], 0xc184c506
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037d1c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x11c4]
call fcn.10019992
mov dword [eax], 0x5b57
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037cfe
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10037d3a
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037d35
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10037d24
lea ecx, [ebp - 0x11c4]
mov dword [ebp - 4], esi
call fcn.10019976
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10037f75
push ebx
lea ecx, [ebp - 0x720]
call fcn.100198f4
lea eax, [ebp - 0x1328]
mov dword [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x1338]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1740]
movdqu xmmword [ebp - 0x1338], xmm0
call fcn.100199a1
lea ecx, [ebp - 0x1dd]
mov esi, eax
call fcn.10009013
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x708]
push dword [esi]
call fcn.10019950
mov byte [ebp - 4], 0x1c
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10037ddd
push dword [ebp - 0x24]
lea ecx, [ebp - 0x720]
call fcn.10019992
mov dword [eax], 0xa8ea
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10037dbf
xor eax, eax
push eax
lea ecx, [ebp - 0x708]
call fcn.10019992
and dword [eax], 0
jmp 0x10037e77
mov dword [ebp - 0x18], 0xfe77dd68
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10037e69
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10037e64
mov dword [ebp - 0x1c], 0x4c90d297
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10037e47
mov dword [ebp - 0x34], 0x947597a6
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10037e42
push eax
push 0x1828
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x10037e23
push dword [ebp - 0x24]
lea ecx, [ebp - 0x720]
call fcn.10019992
cmp dword [eax], 0
jne 0x10037e62
dec dword [ebp - 0x24]
push 0
pop eax
jns 0x10037e14
xor eax, eax
dec dword [ebp - 0x18]
jns 0x10037e09
push eax
lea ecx, [ebp - 0x708]
call fcn.10019992
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x708]
push eax
call fcn.10019992
cmp dword [eax], 0
jle 0x10037df1
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x15
jl 0x10037f4a
jmp 0x10037ea1
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10037ec4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xfc], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10037eac
xor eax, eax
cmp dword [ebp - 0xfc], eax
je 0x10037eda
push eax
lea ecx, [ebp - 0x720]
call fcn.10019992
xor eax, eax
push eax
lea ecx, [ebp - 0x720]
call fcn.10019992
mov eax, dword [ebp - 0xfc]
lea ecx, [ebp - 0x708]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0xfc]
xor eax, eax
push eax
call fcn.10019992
lea ecx, [ebp - 0x720]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.10019992
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
cmp eax, 0x3ca4d9a5
mov eax, dword [ebp - 0xfc]
setg cl
xor edx, edx
or esi, 0xffffffff
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x15
jge 0x10037e9f
lea ecx, [ebp - 0x708]
call fcn.10019976
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], esi
call fcn.10019976
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov dword [ebp - 0x28], 0x90ac204e
mov dword [ebp - 0x40], ebx
push 3
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x4c], 0xf839313
mov dword [ebp - 0x34], 0x8cdab0b8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jl 0x1003815d
push edi
lea ecx, [ebp - 0x39c]
call fcn.100198f4
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0x3e1e01b1
mov dword [ebp - 0x1c], 0x3c57643
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10037fe8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x39c]
call fcn.10019992
and dword [eax], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10037fcd
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x100380f5
mov dword [ebp - 0x4c], 0xfffffffe
lea ecx, [ebp - 0x39c]
push dword [ebp - 0x14]
call fcn.10019992
cmp dword [eax], 0
jne 0x10038017
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], 0xf34111d0
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10038050
push dword [ebp - 0x14]
lea ecx, [ebp - 0x39c]
call fcn.10019992
push dword [ebp - 0x14]
lea ecx, [ebp - 0x39c]
call fcn.10019992
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [eax], ecx
setge dl
cmp edx, dword [ebp - 0x28]
jge 0x10038053
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x39c]
push ebx
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x39c]
push eax
call fcn.10019992
lea ecx, [ebp - 0x39c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x14]
call fcn.10019992
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push dword [ebp - 0x14]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x39c]
setg bl
call fcn.10019992
mov eax, dword [eax]
add eax, ebx
je 0x100380a8
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x100380ad
mov eax, dword [ebp - 0x28]
xor eax, eax
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x28], eax
je 0x100380dc
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x100380ec
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100380d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x100380bd
jmp 0x100380ec
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100380ec
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
dec dword [ebp - 0x14]
jns 0x10037ff4
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10038101
mov eax, ebx
mov dword [ebp - 0x40], eax
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0xfffffff9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffd
setge cl
sub ecx, 0x78317d23
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
cmp eax, esi
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x39c]
mov dword [ebp - 4], esi
call fcn.10019976
inc dword [ebp - 0x28]
push 3
pop eax
cmp dword [ebp - 0x28], eax
jge 0x10037f9f
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10038173
push 0x837
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18cc], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x8ec0ae97
mov dword [ebp - 0x34], 0x41fc9a57
mov dword [ebp - 0x38], esi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100381ab
push 0xe4e
push eax
push eax
push 0x1ddd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
push 0xfffffffffffffffe
pop esi
push 3
mov dword [ebp - 0x2c], eax
pop ebx
cmp dword [ebp - 0x2c], esi
jle 0x1003820e
mov dword [ebp - 0x24], 0xf5cd53bc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x100381e0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x16fc], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x100381c8
xor eax, eax
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x100381fb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x16fc], 0x328f6c74
dec dword [ebp - 0x24]
jns 0x100381e8
mov eax, dword [ebp - 0x2c]
neg eax
push 0
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x2c]
pop eax
jmp 0x100381b4
push 4
lea ecx, [ebp - 0x150]
call fcn.100198f4
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x34], 0xc1348862
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10038256
push dword [ebp - 0x24]
lea ecx, [ebp - 0x150]
call fcn.10019992
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1003823b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003826c
push dword [ebp - 0x14]
call fcn.10019992
mov dword [eax], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0x150]
jl 0x1003825b
push edi
call fcn.10019992
push ebx
lea ecx, [ebp - 0x150]
call fcn.10019992
mov eax, dword [eax]
neg eax
je 0x1003830b
push edi
lea ecx, [ebp - 0x150]
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10019992
push edi
lea ecx, [ebp - 0x150]
call fcn.10019992
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x150]
setne bl
call fcn.10019992
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0x5984
lea ecx, [ebp - 0x150]
setge bl
xor eax, eax
push eax
call fcn.10019992
sub ebx, dword [eax]
sub ebx, 0x189d9e62
je 0x1003830b
xor eax, eax
lea esi, [eax + 1]
jmp 0x1003830f
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
push eax
call fcn.10019992
push 6
pop ecx
cmp ecx, esi
push edi
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x150]
setle bl
call fcn.10019992
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
mov esi, eax
setg dl
cmp edx, 0xfff7
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
cmp ebx, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [esi]
setl cl
xor eax, eax
cmp ecx, 0xefc16765
jne 0x10038376
mov esi, ebx
cmp dword [ebp - 0x14], eax
jne 0x10038378
mov esi, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.10019992
xor ecx, ecx
cmp esi, 0x3cb8e004
setge cl
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], eax
call fcn.10019976
push 4
lea ecx, [ebp - 0x15c]
call fcn.100198f4
mov dword [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x34], 0xc1348862
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x100383ee
push dword [ebp - 0x24]
lea ecx, [ebp - 0x15c]
call fcn.10019992
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100383cf
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10038404
push dword [ebp - 0x14]
call fcn.10019992
mov dword [eax], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
lea ecx, [ebp - 0x15c]
jl 0x100383f3
push edi
call fcn.10019992
push 3
pop eax
push eax
lea ecx, [ebp - 0x15c]
call fcn.10019992
mov eax, dword [eax]
neg eax
je 0x100384a9
push edi
lea ecx, [ebp - 0x15c]
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x15c]
push eax
call fcn.10019992
xor eax, eax
lea ecx, [ebp - 0x15c]
push eax
call fcn.10019992
push edi
lea ecx, [ebp - 0x15c]
call fcn.10019992
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
push edi
cmp dword [eax], ecx
lea ecx, [ebp - 0x15c]
setne bl
call fcn.10019992
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
cmp ecx, 0x5984
lea ecx, [ebp - 0x15c]
setge bl
xor eax, eax
push eax
call fcn.10019992
sub ebx, dword [eax]
sub ebx, 0x189d9e62
je 0x100384a6
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x100384ad
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x14], eax
push ebx
call fcn.10019992
push 6
pop ecx
cmp ecx, esi
push edi
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x15c]
setle bl
call fcn.10019992
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, ebx
mov esi, eax
setg dl
cmp edx, 0xfff7
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
cmp ebx, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [esi]
setl cl
xor eax, eax
cmp ecx, 0xefc16765
jne 0x10038511
mov esi, ebx
cmp dword [ebp - 0x14], eax
jne 0x10038513
mov esi, eax
push eax
lea ecx, [ebp - 0x15c]
call fcn.10019992
xor ecx, ecx
cmp esi, 0x3cb8e004
setge cl
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], eax
call fcn.10019976
mov dword [ebp - 0x28], 0x63126ff2
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x3c], 0x65352f76
mov dword [ebp - 0x20], 0x409884cb
push edi
call fcn.100198f4
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x34], 0xfffc
mov dword [ebp - 0x24], eax
jmp 0x10038584
push dword [ebp - 0x24]
call fcn.10019992
mov dword [eax], 0xd68f9855
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x62c]
cmp dword [ebp - 0x24], edi
jl 0x10038573
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], 0xf8f5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
sub eax, 0xfffa
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
xor eax, eax
push eax
dec esi
call fcn.10019992
xor ecx, ecx
push 5
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
pop eax
setge cl
cmp ecx, eax
ja 0x100387c4
mov dword [ebp - 0x4c], 0xce7
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], 0xec287848
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1003861d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xe2718b96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038605
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10038633
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x260], 0x5dd68647
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038622
mov dword [ebp - 0x3c], 0x84ed
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
cmp esi, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], ebx
jbe 0x1003866e
mov ecx, ebx
cmp dword [ebp - 0xb0], eax
jne 0x10038670
mov ecx, eax
mov eax, dword [ebp - 0x4c]
add eax, ecx
jne 0x1003867c
cmp dword [ebp - 0x24], eax
je 0x10038693
push ebx
lea ecx, [ebp - 0x62c]
call fcn.10019992
cmp dword [eax], 0
je 0x10038691
mov ecx, ebx
jmp 0x10038695
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, esi
setg al
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
jge 0x100386af
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100386b1
mov edi, eax
jmp 0x100386b3
xor eax, eax
mov edi, ebx
push eax
lea ecx, [ebp - 0x62c]
call fcn.10019992
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0xb0]
setne al
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esi], edx
mov dword [ebp - 0x260], 0x5eba
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub eax, 0x7a2aa563
je 0x10038727
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10038729
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1a
je 0x1003874c
push 9
pop eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jne 0x10038719
jmp 0x1003874c
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x44], eax
jmp 0x10038747
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x260]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jle 0x10038735
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, 0x7dcc
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0xb0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb0]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x18]
je 0x10038784
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x62c]
xor eax, eax
push eax
call fcn.10019992
mov ecx, dword [ebp - 0x44]
xor edx, edx
push 2
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ebx, ebx
cmp esi, edx
setl bl
xor ecx, ecx
imul ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
cmp ebx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
inc ebx
jmp 0x1003882d
mov eax, 0xffff
xor edx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0xf543a9b1
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
lea ecx, [ebp - 0x62c]
setge dl
xor eax, eax
sub edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
push eax
add esi, edx
call fcn.10019992
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
cmp esi, eax
sete dl
sub edx, 0x679d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
push 6
mov dword [ebp - 0x20], 0xe
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10038872
push 6
xor eax, eax
pop ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003886a
push eax
push 0x1c4a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 6
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10038841
or esi, 0xffffffff
lea ecx, [ebp - 0x62c]
mov dword [ebp - 4], esi
call fcn.10019976
push 9
pop eax
mov dword [ebp - 0x2c], 0x76e6bacd
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x28], eax
push edi
call fcn.100198f4
push 3
mov dword [ebp - 4], 0x21
lea ecx, [ebp - 0x1060]
pop eax
mov dword [ebp - 0x38], 0x142b622b
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], ebx
push eax
call fcn.100198f4
push edi
lea ecx, [ebp - 0xe7c]
mov byte [ebp - 4], 0x22
call fcn.100198f4
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x100388f7
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4a8]
call fcn.10019992
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100388dd
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10038920
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1060]
call fcn.10019992
push 3
and dword [eax], 0
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x10038902
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003893c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe7c]
call fcn.10019992
mov dword [eax], 0x495ee35d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10038925
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
setge dl
dec ecx
add ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
cmp dword [ebp - 0x2c], edx
jne 0x1003898b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10038981
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4a8]
call fcn.10019992
mov dword [eax], 0xa96141e4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1003896a
jmp 0x10038a78
mov dword [ebp - 0x40], 0x4df6f978
mov dword [ebp - 0x38], 0x18ebdb8
mov dword [ebp - 0x38], 0xff68e10d
mov dword [ebp - 0x38], 0xf7b40076
mov dword [ebp - 0x38], 0x12ef314d
mov dword [ebp - 0x38], 0xfffffff6
push 3
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x38], 0x610cb4e3
mov dword [ebp - 0x38], 0x48968f25
mov dword [ebp - 0x38], 0x8d6e8597
mov dword [ebp - 0x28], eax
jmp 0x10038a61
inc dword [ebp - 0x40]
lea ecx, [ebp - 0x4a8]
push dword [ebp - 0x28]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x4a8]
call fcn.10019992
mov eax, dword [eax]
add eax, 0x37e0d1b3
je 0x10038a0b
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10038a0d
mov eax, ebx
jmp 0x10038a0d
xor eax, eax
add eax, 0xfffffff7
je 0x10038a3f
mov dword [ebp - 0x34], 0xf215a609
lea ecx, [ebp - 0x4a8]
push dword [ebp - 0x28]
call fcn.10019992
push ebx
lea ecx, [ebp - 0x4a8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10019992
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
jmp 0x10038a5e
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x10038a59
push dword [ebp - 0x40]
lea ecx, [ebp - 0x4a8]
call fcn.10019992
mov dword [eax], esi
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x10038a46
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100389da
push ebx
lea ecx, [ebp - 0xe7c]
call fcn.10019992
dec dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.10019976
lea ecx, [ebp - 0x1060]
call fcn.10019976
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 4], esi
call fcn.10019976
mov ecx, 0x9ff60657
xor eax, eax
mov dword [ebp - 0xa34], ecx
mov dword [ebp - 0xa30], ecx
mov dword [ebp - 0xa2c], ecx
mov dword [ebp - 0xa28], ecx
mov dword [ebp - 0x2c], 0x95364446
mov dword [ebp - 0x38], 0x1a0734f0
mov dword [ebp - 0x34], 0x9e17716e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10038aee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1210], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10038ad9
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jg 0x10038bcf
push 5
pop edx
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jg 0x10038bc3
mov dword [ebp - 0x1c], 0xfff6
mov dword [ebp - 0x2c], 0xd16df251
mov dword [ebp - 0x24], eax
jmp 0x10038bf3