Function at 0x10034057
Capabilities:
Accept command line arguments
Check os version
Create a process with modified i/o handles and window
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file attributes
Identify system language via api
Log keystrokes
Modify service
Parse pe header
Query environment variable
Read .ini file
Set thread local storage value
Start service
Terminate process

Disassembly:
mov eax, 0x1007c643
call fcn.1007a810
mov eax, 0x18f4
call fcn.10076fc0
push ebx
push esi
push edi
push 2
or esi, 0xffffffff
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x1014]
xor eax, eax
mov dword [ebp - 0x24], 8
pop ebx
inc eax
mov dword [ebp - 0x28], 0xaee5a986
mov dword [ebp - 0x1c], eax
push ebx
mov byte [ebp - 0x61], dl
call fcn.10018ca8
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], 0x3e7a3298
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100340d2
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1014]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100340b8
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x100340db
mov ecx, eax
jmp 0x100340e0
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28], 9
push 0xfffffffffffffffe
pop edi
push 4
pop edx
test eax, eax
je 0x1003415f
push 7
mov dword [ebp - 0x44], 0x5d367296
mov dword [ebp - 0x28], 0xffffffe9
pop edi
jmp 0x10034155
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
sub ecx, 0x3ca3
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setne al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
sub eax, 6
neg eax
sbb eax, eax
add eax, 3
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jge 0x10034110
jmp 0x10034374
push 3
lea ecx, [ebp - 0x374]
call fcn.10018ca8
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 4], bl
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x2c], 0x75314680
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100341ad
push dword [ebp - 0x10]
lea ecx, [ebp - 0x374]
call fcn.10018d32
mov dword [eax], 0x8b01197b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003418e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100341cb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12e4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100341b6
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100341e6
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100341e3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100341d0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x374]
push ebx
call fcn.10018d32
xor ebx, ebx
cmp dword [eax], ebx
je 0x1003421a
xor eax, eax
lea ecx, [ebp - 0x374]
inc eax
push eax
call fcn.10018d32
cmp dword [eax], ebx
je 0x1003421a
xor eax, eax
inc eax
mov edi, eax
jmp 0x10034221
xor eax, eax
xor ebx, ebx
mov edi, eax
inc eax
push eax
lea ecx, [ebp - 0x374]
call fcn.10018d32
push 2
lea ecx, [ebp - 0x374]
mov esi, dword [eax]
pop eax
push eax
add esi, edi
call fcn.10018d32
mov ecx, dword [ebp - 0x14]
mov edi, eax
xor eax, eax
cmp esi, ecx
mov ecx, dword [ebp - 0x24]
setle al
xor edx, edx
cmp eax, ecx
setg dl
or ecx, 0xffffffff
sub ecx, edx
imul ecx, dword [edi]
cmp ecx, 0xad706983
jbe 0x10034281
xor eax, eax
lea ecx, [ebp - 0x374]
push eax
call fcn.10018d32
xor ebx, ebx
cmp dword [eax], ebx
jne 0x10034281
xor esi, esi
xor eax, eax
inc esi
jmp 0x10034286
xor esi, esi
inc esi
mov eax, esi
xor ecx, ecx
cmp eax, 9
sete cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12e4]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x100342c8
push esi
lea ecx, [ebp - 0x374]
call fcn.10018d32
cmp dword [eax], ebx
jne 0x100342c8
xor eax, eax
mov esi, eax
inc eax
jmp 0x100342cd
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x374]
call fcn.10018d32
xor edi, edi
lea ecx, [ebp - 0x374]
inc edi
push edi
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
call fcn.10018d32
xor edx, edx
cmp esi, 0x71f6e690
setne dl
sub edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
lea ecx, [ebp - 0x1014]
setg bl
imul ebx, dword [ebp - 0x44]
sub ebx, dword [ebp - 0x40]
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x12e4], ebx
push eax
call fcn.10018d32
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x40]
setne cl
imul eax, ecx
mov ecx, dword [ebp - 0x14]
neg ecx
imul eax, eax, 0x584e2110
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffa
jb 0x10034357
cmp dword [ebp - 0x2c], eax
je 0x10034357
mov eax, edi
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x374]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
call fcn.10018d2d
push 2
pop ebx
push 7
or esi, 0xffffffff
pop edi
lea ecx, [ebp - 0x1014]
mov dword [ebp - 4], esi
call fcn.10018d2d
push 4
pop eax
push eax
lea ecx, [ebp - 0x12fc]
call fcn.10018ca8
xor esi, esi
mov dword [ebp - 4], ebx
inc esi
lea ecx, [ebp - 0x2cc]
push esi
call fcn.10018ca8
push 3
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 3
call fcn.10018ca8
push 4
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100343da
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x102c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100343c5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10034406
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2cc]
call fcn.10018d32
mov dword [eax], 0x73838a1f
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x100343e2
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003442e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x638]
call fcn.10018d32
mov dword [eax], 0x8fecf792
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1003440f
xor eax, eax
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10018d32
lea ecx, [ebp - 0x2cc]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10018d32
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jg 0x1003467c
xor eax, eax
mov dword [ebp - 0x14], 0x849f845
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10018d32
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x102c], 0
jne 0x1003467c
xor eax, eax
lea ecx, [ebp - 0x2cc]
push eax
call fcn.10018d32
cmp dword [eax], 0
jne 0x10034650
push 2
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x10034652
push 3
lea ecx, [ebp - 0x788]
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100344e7
push 4
pop esi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x788]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100344cb
xor esi, esi
inc esi
push 2
pop eax
push eax
lea ecx, [ebp - 0x788]
call fcn.10018d32
push 2
lea ecx, [ebp - 0x788]
and dword [eax], 0
pop eax
push eax
call fcn.10018d32
push 2
pop ecx
cmp dword [eax], ecx
jg 0x10034633
push 6
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003453c
push eax
push 0x254
push 0xbfa
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop eax
jmp 0x10034602
push esi
lea ecx, [ebp - 0x6ec]
call fcn.10018ca8
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10034584
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6ec]
call fcn.10018d32
mov dword [eax], 9
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10034563
xor eax, eax
push eax
lea ecx, [ebp - 0x6ec]
call fcn.10018d32
push 2
pop ecx
mov dword [eax], ecx
jmp 0x100345d7
xor eax, eax
lea ecx, [ebp - 0x2cc]
push eax
call fcn.10018d32
mov esi, eax
lea ecx, [ebp - 0x2cc]
xor eax, eax
push eax
call fcn.10018d32
mov ecx, dword [esi]
mov ecx, dword [ebp + ecx*4 - 0x102c]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x102c], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x6ec]
call fcn.10018d32
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x6ec]
push eax
call fcn.10018d32
cmp dword [eax], 0
jge 0x10034597
lea ecx, [ebp - 0x6ec]
mov byte [ebp - 4], 5
call fcn.10018d2d
inc dword [ebp - 0x24]
push 2
pop eax
push 1
pop esi
cmp dword [ebp - 0x24], eax
jle 0x10034547
push 2
pop esi
push esi
lea ecx, [ebp - 0x788]
call fcn.10018d32
push esi
lea ecx, [ebp - 0x788]
inc dword [eax]
call fcn.10018d32
push 1
cmp dword [eax], esi
pop esi
jle 0x10034513
push 4
pop eax
lea ecx, [ebp - 0x788]
mov byte [ebp - 4], al
call fcn.10018d2d
dec dword [ebp - 0x14]
push 1
pop esi
jns 0x100344ac
xor eax, eax
push eax
lea ecx, [ebp - 0x2cc]
call fcn.10018d32
lea ecx, [ebp - 0x2cc]
inc dword [eax]
xor eax, eax
push eax
call fcn.10018d32
push 2
pop ecx
push 1
pop esi
cmp dword [eax], ecx
jle 0x1003445f
xor eax, eax
lea ecx, [ebp - 0x638]
push eax
call fcn.10018d32
and dword [eax], 0
jmp 0x100346ce
xor eax, eax
mov dword [ebp - 0x1c], 0x657e3b6f
mov dword [ebp - 0x1c], eax
jmp 0x100346bb
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100346b8
push eax
push eax
push 0x5a8
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1003469d
push eax
lea ecx, [ebp - 0x638]
call fcn.10018d32
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x638]
push eax
call fcn.10018d32
cmp dword [eax], 0
jge 0x1003468f
lea ecx, [ebp - 0x638]
call fcn.10018d2d
push 2
pop eax
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], al
call fcn.10018d2d
push 3
pop esi
mov dword [ebp - 0x28], 0xfffffff8
lea ecx, [ebp - 0x108c]
push esi
call fcn.10018ca8
push 7
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x105c]
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0xa5b7d8cf
push esi
call fcn.10018ca8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1120]
mov dword [ebp - 0x34], 0xf08664a1
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x5c], 0x5d1cb6a7
mov dword [ebp - 0x34], 0x5530c4e2
push esi
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1003478d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x105c]
call fcn.10018d32
mov dword [eax], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1003476f
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100347a9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1120]
call fcn.10018d32
mov dword [eax], 0x77cccaea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034792
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x100347d6
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100347d8
mov esi, eax
jmp 0x100347db
xor eax, eax
xor esi, esi
inc esi
push eax
lea ecx, [ebp - 0x105c]
call fcn.10018d32
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
push 2
setge dl
xor ecx, ecx
neg edx
or esi, 0xffffffff
cmp edx, esi
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
pop eax
cmp dword [ebp - 0x28], eax
jg 0x100348cf
xor eax, eax
mov dword [ebp - 0x2c], 0x3ddca272
inc eax
lea ecx, [ebp - 0x1044]
mov dword [ebp - 0x4c], eax
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0xe13f5e3d
push 3
call fcn.10018ca8
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x44], 0x3bd791f9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10034874
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1044]
call fcn.10018d32
mov dword [eax], 0xd64bda99
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10034855
xor eax, eax
inc dword [ebp - 0x44]
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x100348ae
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1044]
push eax
call fcn.10018d32
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
cmp esi, eax
pop eax
setge cl
mov dword [ebp - 0x5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
push 0
pop eax
jle 0x10034882
lea ecx, [ebp - 0x1044]
mov byte [ebp - 4], 9
call fcn.10018d2d
inc dword [ebp - 0x28]
push 2
pop eax
cmp dword [ebp - 0x28], eax
jle 0x10034818
or esi, 0xffffffff
lea ecx, [ebp - 0x1120]
call fcn.10018d2d
push 7
pop eax
lea ecx, [ebp - 0x105c]
mov byte [ebp - 4], al
call fcn.10018d2d
push 4
pop eax
push eax
lea ecx, [ebp - 0x1138]
call fcn.10018ca8
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x44], 0x3b8cff26
mov dword [ebp - 0x34], 0xdaffa898
mov dword [ebp - 0x20], eax
jmp 0x1003492a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x12fc]
call fcn.10018d32
mov dword [eax], 0xbbca
inc dword [ebp - 0x20]
push 4
pop eax
cmp dword [ebp - 0x20], eax
jl 0x10034913
push 2
pop eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x13c8]
mov dword [ebp - 0x34], 0xebaeef20
mov dword [ebp - 0x34], 0x45f1dbec
push eax
call fcn.10018ca8
push 3
lea ecx, [ebp - 0x1074]
mov byte [ebp - 4], 0xc
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0xd
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10034995
push dword [ebp - 0x20]
lea ecx, [ebp - 0x13c8]
call fcn.10018d32
push 2
mov dword [eax], 0xc0d37ad4
inc dword [ebp - 0x20]
pop eax
cmp dword [ebp - 0x20], eax
jl 0x10034974
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100349b7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1874], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1003499e
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100349cd
push dword [ebp - 0x20]
call fcn.10018d32
mov dword [eax], 0x57e71f09
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0x1074]
jl 0x100349bc
xor esi, esi
inc esi
push esi
call fcn.10018d32
lea ecx, [ebp - 0x1074]
inc dword [eax]
call fcn.10018d2d
lea ecx, [ebp - 0x13c8]
mov byte [ebp - 4], 0xb
call fcn.10018d2d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10034a24
push dword [ebp - 0x20]
lea ecx, [ebp - 0x108c]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10034a09
xor eax, eax
mov dword [ebp - 0x24], 0x6de713a4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x76acb8f
mov dword [ebp - 0x34], eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034a57
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4b4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034a43
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x10034a94
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4b0], eax
test eax, eax
jne 0x10034a91
mov ecx, dword [ebp - 0x4b0]
xor edx, edx
mov eax, dword [ebp - 0x4b0]
cmp ecx, eax
setge dl
mov dword [ebp - 0x4b0], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10034add
push 0xfe9
push 0xdbc
push 0x1e
push 0x1207
push 0x2b2
push 0x1eee
push 0xbec
push 0xe85
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x10034b06
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1138]
call fcn.10018d32
push 4
pop edx
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10034ae8
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jge 0x10034ba7
push 2
pop ecx
push ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x108c]
call fcn.10018d32
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
lea ecx, [ebp - 0x1138]
call fcn.10018d2d
lea ecx, [ebp - 0x108c]
call fcn.10018d2d
or ebx, 0xffffffff
lea ecx, [ebp - 0x12fc]
mov dword [ebp - 4], ebx
call fcn.10018d2d
mov dword [ebp - 0x3c], 9
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x28], 0xf57440e7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x44], 0x3ce85dc3
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sbb esi, esi
mov eax, dword [ebp - 0x28]
neg esi
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x3c]
jne 0x10034d7b
cmp dword [ebp - 0x3c], eax
jne 0x10034d7b
mov ecx, eax
jmp 0x10034d80
push 4
pop edx
push edx
lea ecx, [ebp - 0xaf8]
call fcn.10018ca8
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x38], 0x532fe223
mov dword [ebp - 0x34], 0x3a23fe5e
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 0xddcd1665
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xa6edad94
push 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034c0b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xaf8]
call fcn.10018d32
push 4
mov dword [eax], 0xb9b5
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x10034bea
xor eax, eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], eax
jl 0x10034d31
or eax, 0xffffffff
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x9b2b534d
push ebx
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1c], eax
jmp 0x10034c55
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9f0]
call fcn.10018d32
mov dword [eax], 0xce4b0ad8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034c3e
push dword [ebp - 0x38]
lea ecx, [ebp - 0xaf8]
call fcn.10018d32
cmp dword [eax], 0
je 0x10034cc2
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], eax
jmp 0x10034cbb
mov dword [ebp - 0x24], eax
push 4
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x10034ca6
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaf8]
call fcn.10018d32
push 4
mov dword [eax], esi
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x10034c89
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034cb8
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10034c7b
jmp 0x10034cfe
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10034ce4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1620], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034ccc
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034cf6
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
cmp dword [ebp - 0x1620], eax
jne 0x10034d26
push esi
lea ecx, [ebp - 0x9f0]
call fcn.10018d32
lea ecx, [ebp - 0x9f0]
dec dword [eax]
mov byte [ebp - 4], 0xe
call fcn.10018d2d
dec dword [ebp - 0x38]
jns 0x10034c17
jmp 0x10034d31
lea ecx, [ebp - 0x9f0]
call fcn.10018d2d
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0xb
call fcn.10018d2d
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x34], eax
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034d68
or edx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x170c], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10034d56
dec dword [ebp - 0x44]
dec dword [ebp - 0x28]
jns 0x10034ba4
xor eax, eax
jmp 0x10034b18
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0x4c3e
mov ecx, 0xb9cbadbe
setle al
add eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
neg eax
cmp eax, dword [ebp - 0x3c]
jl 0x10034daa
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x10034dac
inc eax
jmp 0x10034dac
xor eax, eax
xor edx, edx
cmp eax, 0xed99
mov eax, dword [ebp - 0x3c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x40]
test edx, edx
jne 0x10034e19
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10034e19
mov edx, eax
jmp 0x10034e1e
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp eax, edx
setle cl
xor eax, eax
cmp dword [ebp - 0x44], ecx
jl 0x10034e46
cmp dword [ebp - 0x3c], eax
je 0x10034e46
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10034e49
xor ebx, ebx
inc ebx
add eax, 0x447e91ec
xor ecx, ecx
cmp esi, eax
setne cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10034e69
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 2
or esi, 0xffffffff
lea ecx, [ebp - 0xfc0]
mov dword [ebp - 0x38], esi
pop eax
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], 0xaee5a986
mov dword [ebp - 0x1c], ebx
push eax
call fcn.10018ca8
push 7
mov dword [ebp - 4], 0x10
pop eax
mov dword [ebp - 0x44], 0x3e7a3298
mov dword [ebp - 0x14], eax
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x10034ecf
push ecx
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfc0]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10034eb2
xor ebx, ebx
xor eax, eax
inc ebx
cmp dword [ebp - 0x38], eax
jne 0x10034ed8
mov ecx, eax
jmp 0x10034ee0
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28], 9
test eax, eax
je 0x10034f63
mov dword [ebp - 0x44], 0x5d367296
push 4
mov dword [ebp - 0x28], 0xffffffe9
pop edx
cmp dword [ebp - 0x28], edx
jl 0x10035179
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
sub ecx, 0x3ca3
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, ebx
setne al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
sub eax, 6
neg eax
sbb eax, eax
add eax, 3
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jge 0x10034f14
jmp 0x10035179
push 3
lea ecx, [ebp - 0x284]
call fcn.10018ca8
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x40], 5
push 0xfffffffffffffffe
mov dword [ebp - 0x2c], 0x75314680
pop eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10034fb2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x284]
call fcn.10018d32
mov dword [eax], 0x8b01197b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034f93
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10034fd0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10d8], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10034fbb
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10034feb
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10034fe8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10034fd5
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x284]
push ebx
call fcn.10018d32
xor ebx, ebx
cmp dword [eax], ebx
je 0x1003501f
xor eax, eax
lea ecx, [ebp - 0x284]
inc eax
push eax
call fcn.10018d32
cmp dword [eax], ebx
je 0x1003501f
xor eax, eax
inc eax
mov edi, eax
jmp 0x10035026
xor eax, eax
xor ebx, ebx
mov edi, eax
inc eax
push eax
lea ecx, [ebp - 0x284]
call fcn.10018d32
push 2
lea ecx, [ebp - 0x284]
mov esi, dword [eax]
pop eax
push eax
add esi, edi
call fcn.10018d32
mov ecx, dword [ebp - 0x14]
mov edi, eax
xor eax, eax
cmp esi, ecx
mov ecx, dword [ebp - 0x24]
setle al
xor edx, edx
cmp eax, ecx
setg dl
or ecx, 0xffffffff
sub ecx, edx
imul ecx, dword [edi]
cmp ecx, 0xad706983
jbe 0x10035086
xor eax, eax
lea ecx, [ebp - 0x284]
push eax
call fcn.10018d32
xor ebx, ebx
cmp dword [eax], ebx
jne 0x10035086
xor esi, esi
xor eax, eax
inc esi
jmp 0x1003508b
xor esi, esi
inc esi
mov eax, esi
xor ecx, ecx
cmp eax, 9
sete cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10d8]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x100350cd
push esi
lea ecx, [ebp - 0x284]
call fcn.10018d32
cmp dword [eax], ebx
jne 0x100350cd
xor eax, eax
mov esi, eax
inc eax
jmp 0x100350d2
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x284]
call fcn.10018d32
xor edi, edi
lea ecx, [ebp - 0x284]
inc edi
push edi
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
call fcn.10018d32
xor edx, edx
cmp esi, 0x71f6e690
setne dl
sub edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
lea ecx, [ebp - 0xfc0]
setg bl
imul ebx, dword [ebp - 0x44]
sub ebx, dword [ebp - 0x40]
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x10d8], ebx
push eax
call fcn.10018d32
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x40]
setne cl
imul eax, ecx
mov ecx, dword [ebp - 0x14]
neg ecx
imul eax, eax, 0x584e2110
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffa
jb 0x1003515c
cmp dword [ebp - 0x2c], eax
je 0x1003515c
mov eax, edi
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x284]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
call fcn.10018d2d
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or esi, 0xffffffff
lea ecx, [ebp - 0xfc0]
mov dword [ebp - 4], esi
call fcn.10018d2d
push 4
pop eax
push eax
lea ecx, [ebp - 0x1314]
call fcn.10018ca8
xor ebx, ebx
mov dword [ebp - 4], 0x12
inc ebx
lea ecx, [ebp - 0x32c]
push ebx
call fcn.10018ca8
push 3
lea ecx, [ebp - 0x764]
mov byte [ebp - 4], 0x13
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100351e4
push 7
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcc0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100351cf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10035210
push dword [ebp - 0x20]
lea ecx, [ebp - 0x32c]
call fcn.10018d32
mov dword [eax], 0x73838a1f
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x100351ec
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035238
push dword [ebp - 0x20]
lea ecx, [ebp - 0x764]
call fcn.10018d32
mov dword [eax], 0x8fecf792
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10035219
xor eax, eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.10018d32
lea ecx, [ebp - 0x32c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10018d32
push 2
pop ecx
cmp dword [eax], ecx
jg 0x10035462
xor eax, eax
mov dword [ebp - 0x14], 0x849f845
push eax
lea ecx, [ebp - 0x32c]
call fcn.10018d32
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xcc0], 0
jne 0x1003545f
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
call fcn.10018d32
cmp dword [eax], 0
jne 0x10035436
push 2
pop eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x10035438
push 3
lea ecx, [ebp - 0x650]
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100352e8
push 4
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x650]
call fcn.10018d32
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100352cc
xor ebx, ebx
inc ebx
push 2
pop eax
push eax
lea ecx, [ebp - 0x650]
call fcn.10018d32
and dword [eax], 0
jmp 0x10035404
push 6
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1003532c
push eax
push 0x254
push 0xbfa
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100353ea
push ebx
lea ecx, [ebp - 0x6e0]
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035372
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6e0]
call fcn.10018d32
mov dword [eax], 9
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x1003534e
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x6e0]
call fcn.10018d32
push 2
pop ecx
mov dword [eax], ecx
jmp 0x100353c5
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
call fcn.10018d32
mov esi, eax
lea ecx, [ebp - 0x32c]
xor eax, eax
push eax
call fcn.10018d32
mov ecx, dword [esi]
mov ecx, dword [ebp + ecx*4 - 0xcc0]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xcc0], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x6e0]
call fcn.10018d32
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x6e0]
push eax
call fcn.10018d32
cmp dword [eax], 0
jge 0x10035385
lea ecx, [ebp - 0x6e0]
mov byte [ebp - 4], 0x15
call fcn.10018d2d
inc dword [ebp - 0x24]
push 2
pop eax
cmp dword [ebp - 0x24], eax
jle 0x10035334
push eax
lea ecx, [ebp - 0x650]
call fcn.10018d32
inc dword [eax]
push 2
pop eax
push eax
lea ecx, [ebp - 0x650]
call fcn.10018d32
push 2
pop ecx
cmp dword [eax], ecx
jle 0x100352ff
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 0x14
call fcn.10018d2d
dec dword [ebp - 0x14]
jns 0x100352ad
xor eax, eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.10018d32
lea ecx, [ebp - 0x32c]
inc dword [eax]
xor eax, eax
push eax
call fcn.10018d32
push 2
pop ecx
cmp dword [eax], ecx
jle 0x10035260
or esi, 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x764]
push eax
call fcn.10018d32
and dword [eax], 0
jmp 0x100354b4
xor eax, eax
mov dword [ebp - 0x1c], 0x657e3b6f
mov dword [ebp - 0x1c], eax
jmp 0x100354a1
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003549e
push eax
push eax
push 0x5a8
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10035483
push eax
lea ecx, [ebp - 0x764]
call fcn.10018d32
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x764]
push eax
call fcn.10018d32
cmp dword [eax], 0
jge 0x10035475
lea ecx, [ebp - 0x764]
call fcn.10018d2d
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0x12
call fcn.10018d2d
push 3
mov dword [ebp - 0x48], 0xfffffff8
lea ecx, [ebp - 0xcd8]
pop ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0xa5b7d8cf
push ebx
call fcn.10018ca8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x34], 0xf08664a1
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x5c], 0x5d1cb6a7
mov dword [ebp - 0x34], 0x5530c4e2
push ebx
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003555c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcd8]
call fcn.10018d32
mov dword [eax], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1003553e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035578
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1150]
call fcn.10018d32
mov dword [eax], 0x77cccaea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035561
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jg 0x100355a8
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x100355aa
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x100355af
xor eax, eax
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
lea ecx, [ebp - 0xcd8]
call fcn.10018d32
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
push 2
setge dl
xor ecx, ecx
neg edx
or esi, 0xffffffff
cmp edx, esi
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x28], eax
pop eax
cmp dword [ebp - 0x28], eax
jg 0x100356a2
push 4
mov dword [ebp - 0x2c], 0x3ddca272
lea ecx, [ebp - 0xfa8]
pop eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0xe13f5e3d
push 3
call fcn.10018ca8
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x44], 0x3bd791f9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10035645
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xfa8]
call fcn.10018d32
mov dword [eax], 0xd64bda99
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10035626
xor eax, eax
inc dword [ebp - 0x44]
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jg 0x10035681
push ecx
pop ebx
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0xfa8]
push eax
call fcn.10018d32
xor ecx, ecx
push 0
mov dword [eax], esi
mov eax, dword [ebp - 0x4c]
cmp esi, eax
pop eax
setge cl
mov dword [ebp - 0x5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10035655
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xfa8]
mov byte [ebp - 4], 0x18
call fcn.10018d2d
inc dword [ebp - 0x28]
push 2
pop eax
cmp dword [ebp - 0x28], eax
jle 0x100355ec
or esi, 0xffffffff
lea ecx, [ebp - 0x1150]
call fcn.10018d2d
lea ecx, [ebp - 0xcd8]
mov byte [ebp - 4], 0x12
call fcn.10018d2d
push 3
lea ecx, [ebp - 0xee8]
call fcn.10018ca8
push 2
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x141c]
pop eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xebaeef20
mov dword [ebp - 0x34], 0x45f1dbec
push eax
call fcn.10018ca8
push 3
lea ecx, [ebp - 0xed0]
mov byte [ebp - 4], 0x1b
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x1c
push 2
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x10035732
push ecx
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x141c]
call fcn.10018d32
mov dword [eax], 0xc0d37ad4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035711
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10035754
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x18bc], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1003573b
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1003576a
push dword [ebp - 0x20]
call fcn.10018d32
mov dword [eax], 0x57e71f09
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0xed0]
jl 0x10035759
push ebx
call fcn.10018d32
lea ecx, [ebp - 0xed0]
inc dword [eax]
call fcn.10018d2d
lea ecx, [ebp - 0x141c]
mov byte [ebp - 4], 0x1a
call fcn.10018d2d
push 4
pop eax
push eax
lea ecx, [ebp - 0x1168]
call fcn.10018ca8
mov byte [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x24], 0x6de713a4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x76acb8f
mov dword [ebp - 0x34], eax
push 2
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x100357e0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3d8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100357cc
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1003581d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3d4], eax
test eax, eax
jne 0x1003581a
mov ecx, dword [ebp - 0x3d4]
xor edx, edx
mov eax, dword [ebp - 0x3d4]
cmp ecx, eax
setge dl
mov dword [ebp - 0x3d4], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10035868
push 0xfe9
push 0xdbc
push 0x1e
push 0x1207
push 0x2b2
push 0x1eee
push 0xbec
push 0xe85
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 4
pop eax
mov dword [ebp - 0x58], 0x3b8cff26
lea ecx, [ebp - 0xbb8]
push eax
call fcn.10018ca8
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x28], 0x532fe223
mov dword [ebp - 0x34], 0x3a23fe5e
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 0xddcd1665
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xa6edad94
push 4
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jge 0x100358db
push edi
pop ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbb8]
call fcn.10018d32
mov dword [eax], 0xb9b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100358b7
xor ebx, ebx
xor eax, eax
push 4
inc ebx
pop edi
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], eax
jl 0x10035a0e
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x9b2b534d
push 3
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x1f
push 3
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x1003592a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa08]
call fcn.10018d32
mov dword [eax], 0xce4b0ad8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10035913
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbb8]
call fcn.10018d32
cmp dword [eax], 0
je 0x10035997
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], eax
jmp 0x10035990
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1003597b
push dword [ebp - 0x24]
lea ecx, [ebp - 0xbb8]
call fcn.10018d32
push 4
mov dword [eax], ebx
inc dword [ebp - 0x24]
pop eax
cmp dword [ebp - 0x24], eax
jl 0x1003595b
push 4
xor eax, eax
pop edi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1003598d
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10035950
jmp 0x100359d5
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100359bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16e0], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100359a2
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100359cd
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
cmp dword [ebp - 0x16e0], eax
jne 0x10035a00
push ebx
lea ecx, [ebp - 0xa08]
call fcn.10018d32
lea ecx, [ebp - 0xa08]
dec dword [eax]
mov byte [ebp - 4], 0x1e
call fcn.10018d2d
dec dword [ebp - 0x28]
push 0xffffffffffffffff
pop esi
jns 0x100358eb
jmp 0x10035a0b
lea ecx, [ebp - 0xa08]
call fcn.10018d2d
or esi, 0xffffffff
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], 0x1d
call fcn.10018d2d
mov dword [ebp - 0x34], 0xdaffa898
xor eax, eax
mov dword [ebp - 0x28], 0x7e2799ac
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff6
je 0x10035ac7
push 4
pop ebx
push ebx
lea ecx, [ebp - 0xcf0]
call fcn.10018ca8
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035a74
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xcf0]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10035a5a
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10035a96
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcf0]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10035a7c
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035aa6
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
lea ecx, [ebp - 0xcf0]
mov byte [ebp - 4], 0x1d
call fcn.10018d2d
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jne 0x10035a3d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035aed
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x170], 0x4fd3df75
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10035acf
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x170], 0xfffffff7
jmp 0x10035b11
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035b0b
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
inc dword [ebp - 0x170]
cmp dword [ebp - 0x170], 0x11
jge 0x10035af9
mov dword [ebp - 0x20], eax
push 4
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10035b46
push eax
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1314]
call fcn.10018d32
mov dword [eax], 0xbbca
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10035b27
xor ebx, ebx
inc ebx
push 2
pop eax
push 3
pop edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x668]
push edi
call fcn.10018ca8
push 4
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x3d0]
pop eax
mov dword [ebp - 0x24], 0x250db856
mov dword [ebp - 0x40], 0x323f
push eax
call fcn.10018ca8
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x50], 0x7baed967
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10035baf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x668]
call fcn.10018d32
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10035b91
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10035bdd
push ecx
pop ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
mov dword [eax], 0xd0c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035bbc
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], eax
jmp 0x10035c03
mov dword [ebp - 0x44], 0x629a
dec dword [ebp - 0x44]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035c00
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jg 0x10035be2
mov dword [ebp - 0x20], 0xfffffff7
jmp 0x10035e65
mov dword [ebp - 0x14], 0x7110
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x2c], 0xa67f8b4d
mov dword [ebp - 0x3c], 0xaeb382e5
push edi
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10035c5e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1020], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10035c45
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10035c82
push dword [ebp - 0x10]
lea ecx, [ebp - 0x818]
call fcn.10018d32
push 3
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035c67
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x818]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10018d32
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x668]
mov eax, dword [ebp - 0x40]
push 2
pop eax
push eax
call fcn.10018d32
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x668]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10018d32
push 2
pop eax
push eax
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
mov eax, dword [ebp - 0x1020]
lea ecx, [ebp - 0x818]
mov eax, dword [ebp - 0x1020]
mov eax, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10018d32
push 2
pop eax
push eax
lea ecx, [ebp - 0x668]
call fcn.10018d32
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x668]
xor eax, eax
push eax
call fcn.10018d32
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x24]
sub edx, ecx
neg edx
push 3
sbb edx, edx
inc edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x3c], eax
pop edi
cmp dword [ebp - 0x3c], edi
jg 0x10035e53
jmp 0x10035d35
xor eax, eax
push 4
mov dword [ebp - 0x2c], 0xd19708e6
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x10035d55
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10bc], 0xd5126306
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10035d44
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
mov eax, dword [eax]
mov dword [ebp - 0x10b0], eax
test eax, eax
je 0x10035d82
mov eax, dword [ebp - 0x50]
neg eax
je 0x10035d82
xor eax, eax
lea esi, [eax + 1]
jmp 0x10035d86
xor eax, eax
mov esi, eax
push 2
pop eax
push eax
lea ecx, [ebp - 0x818]
call fcn.10018d32
cmp esi, dword [eax]
jl 0x10035db2
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
cmp dword [eax], 0
jne 0x10035db2
xor eax, eax
mov esi, eax
jmp 0x10035db7
xor eax, eax
lea esi, [eax + 1]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
xor ecx, ecx
cmp dword [eax], 0x912742e
sete cl
xor edx, edx
cmp ecx, 0x6d79c1f6
lea ecx, [ebp - 0x3d0]
setl dl
xor eax, eax
cmp edx, esi
setne al
mov dword [ebp - 0x1020], eax
push dword [ebp - 0x3c]
call fcn.10018d32
xor eax, eax
cmp dword [ebp - 0x3c], eax
jg 0x10035e0a
cmp dword [ebp - 0x10b8], eax
je 0x10035e0a
lea esi, [eax + 1]
jmp 0x10035e0c
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3d0]
call fcn.10018d32
xor ebx, ebx
xor edx, edx
inc ebx
mov eax, dword [eax]
add eax, esi
sub eax, dword [ebp - 0x10b0]
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x10035d33
or esi, 0xffffffff
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 0x22
call fcn.10018d2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jge 0x10035c15
lea ecx, [ebp - 0x3d0]
call fcn.10018d2d
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 0x1d
call fcn.10018d2d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10035ea2
push dword [ebp - 0x20]
lea ecx, [ebp - 0xee8]
call fcn.10018d32
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10035e8f
mov dword [ebp - 0x3c], 0x5ed9
lea ecx, [ebp - 0xd08]
mov dword [ebp - 0x44], 0x80fc3a06
push 4
mov dword [ebp - 0x2c], esi
pop eax
mov dword [ebp - 0x40], 0xb17b
mov dword [ebp - 0x34], 0xbb1d4416
mov dword [ebp - 0x50], eax
push ebx
call fcn.10018ca8
xor eax, eax
mov byte [ebp - 4], 0x24
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10035f01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8c], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10035ee9
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10035f1a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd08]
call fcn.10018d32
and dword [eax], 0
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10035f06
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setg dl
xor ebx, ebx
inc ebx
cmp ebx, edx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x3c]
test eax, eax
je 0x10035fb7
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10035f67
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13e0], esi
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10035f4d
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10035f79
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jl 0x10035fcf
push 2
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xa9ef8169
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x10035fad
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x171c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10035f99
xor eax, eax
dec dword [ebp - 0x40]
dec dword [ebp - 0x3c]
jns 0x10035f84
jmp 0x10035fcf
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10035fcf
push 0x305
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc88]
neg eax
sbb eax, eax
neg eax
neg eax
jne 0x10035ff7
mov eax, dword [ebp - 0x3c]
xor eax, eax
lea ecx, [ebp - 0xd08]
push eax
call fcn.10018d32
mov ecx, dword [ebp - 0xc8c]
mov byte [ebp - 4], 0x1d
mov dword [eax], ecx
lea ecx, [ebp - 0xd08]
call fcn.10018d2d
xor eax, eax
mov dword [ebp - 0x20], eax
push 4
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10036047
push eax
pop ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1168]
call fcn.10018d32
and dword [eax], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003602b
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], 0xd313dd33
mov dword [ebp - 0x2c], 0x45b3659
mov dword [ebp - 0x3c], 0xfffffff6
jmp 0x1003610a
push ebx
lea ecx, [ebp - 0xa20]
call fcn.10018ca8
mov byte [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x44], 0xaa0a5dec
mov dword [ebp - 0x44], 0x813a3dbc
mov dword [ebp - 0x1c], eax
jmp 0x10036093
push dword [ebp - 0x1c]
call fcn.10018d32
mov dword [eax], esi
inc dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0xa20]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x10036086
imul eax, dword [ebp - 0x3c], 0x3535
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
xor eax, eax
push eax
call fcn.10018d32
xor eax, eax
lea ecx, [ebp - 0xa20]
push eax
call fcn.10018d32
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor ebx, ebx
inc ebx
cmp ebx, ecx
lea ecx, [ebp - 0xa20]
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0x1d
call fcn.10018d2d
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x18
jge 0x10036061
push 3
pop ebx
mov dword [ebp - 0x48], ebx
xor eax, eax
cmp dword [ebp - 0x48], eax
jl 0x100369b5
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x10], 0xe1c97412
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x2c], 0xae11
push 4
mov dword [ebp - 0x4c], 0x6ff7dd1a
mov dword [ebp - 0x1c], eax
pop ecx
jmp 0x10036161
cmp dword [ebp - 0x1c], ecx
jl 0x10036150
mov dword [ebp - 0x50], 0xfffc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x100369db
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100369c7
push 0xfffffffffffffffe
mov dword [ebp - 0x19c], eax
pop esi
jmp 0x10036b4c