Function at 0x1003459d
Capabilities:
Accept command line arguments
Allocate thread local storage
Check os version
Create directory
Create process on windows
Delete file
Get common file path
Get graphical window text
Identify system language via api
Modify service
Query service status
Set registry value
Terminate process

Disassembly:
mov eax, 0x10068194
call fcn.10066e98
mov eax, 0x12ec
call fcn.10060cc0
push ebx
push esi
push edi
push 0
pop eax
push 4
pop esi
mov dword [ebp - 0x1c], 0x2352
cmp dword [ebp - 0x1c], 0x62f
push 1
mov byte [ebp - 0x61], dl
mov dword [ebp - 0x4c], ecx
pop ebx
jge 0x100346f2
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x10007c8c
call fcn.1004f8bb
add esp, 0xc
cmp dword [ebp - 0xa0], 0
je 0x100346ed
mov eax, dword [ebp - 0xa8]
xor esi, esi
mov edi, esi
test eax, eax
jle 0x10034630
lea esi, [ebp - 0xa08]
push esi
push 0x10007848
call fcn.1004f8bb
mov eax, dword [ebp - 0xa8]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jl 0x10034613
xor esi, esi
lea edx, [ebp - 0xa08]
lea edx, [edx + eax*4]
lea ecx, [ebp - 0xa08]
call fcn.10033d3d
push 0x3e9
lea eax, [ebp - 0x12f8]
push esi
push eax
call fcn.1000e513
mov ecx, dword [ebp - 0xa8]
add esp, 0xc
mov edx, esi
test ecx, ecx
jle 0x10034679
mov eax, dword [ebp + edx*4 - 0xa08]
inc edx
mov byte [ebp + eax - 0x12f8], 1
cmp edx, ecx
jl 0x10034665
mov esi, dword [ebp - 0xa0]
xor edx, edx
imul esi, ecx
mov edi, ecx
test ecx, ecx
jle 0x100346b2
mov eax, dword [ebp + edx*4 - 0xa08]
jmp 0x1003469d
cmp byte [ebp + eax - 0x12f8], 0
je 0x100346a4
inc eax
cmp eax, esi
jle 0x10034693
jmp 0x100346ad
mov byte [ebp + eax - 0x12f8], 1
dec edi
inc edx
cmp edx, ecx
jl 0x1003468a
push edi
push ebx
push 0x10007df8
call fcn.1004faef
add esp, 0xc
lea eax, [ebp - 0xa8]
inc ebx
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x10007c8c
call fcn.1004f8bb
add esp, 0xc
cmp dword [ebp - 0xa0], 0
jne 0x100345ff
push 4
pop esi
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x44], 0x1c097bc8
mov dword [ebp - 0x28], 0x73196e86
mov dword [ebp - 0x40], 0x51acae7
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x2dd0685
mov dword [ebp - 0x14], eax
jmp 0x1003473f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x684], 0xf27260e9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003472e
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x2eb2fc25
setl al
xor edx, edx
add eax, dword [ebp - 0x20]
cmp eax, 0x4087a912
jne 0x10034775
mov eax, edx
cmp dword [ebp - 0x20], edx
je 0x10034777
mov eax, ebx
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x23d
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
setg cl
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x34]
push 2
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x20]
je 0x100348b5
mov dword [ebp - 0x40], 0xf50e16ff
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x10], edx
pop ebx
jmp 0x100347ef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7fc], 0xa9ac04bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100347de
mov dword [ebp - 0x10], edx
jmp 0x1003480a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6e4], 0xd88c924d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100347f9
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xfffffff7
jl 0x100348ad
mov dword [ebp - 0x14], 0x8d
mov dword [ebp - 0x1c], 0x785e8a77
imul eax, dword [ebp - 0x44], 0x3376
add eax, dword [ebp - 0x40]
jne 0x1003483f
cmp dword [ebp - 0x14], edx
jne 0x1003483f
mov esi, edx
jmp 0x10034844
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0xb5c1
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
sub esi, edx
add esi, dword [ebp - 0x40]
je 0x10034875
cmp dword [ebp - 0x14], 0
je 0x10034875
xor eax, eax
inc eax
jmp 0x10034877
xor eax, eax
imul eax, eax, 0xfffffff7
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x1003489d
push edx
push edx
call edi
xor edx, edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
jge 0x1003481c
push 4
pop esi
dec dword [ebp - 0x6e0]
jmp 0x1003490a
mov dword [ebp - 0x38], 0x24061354
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], 0xe38b13f4
mov dword [ebp - 0x24], 0x16d172e3
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x5249f392
pop ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], edx
jmp 0x100348fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100348eb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x34], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x20], 6
inc ecx
mov dword [ebp - 0x44], 0x1c097bc8
mov dword [ebp - 0x28], 0x73196e86
mov dword [ebp - 0x40], 0x51acae7
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x2dd0685
mov dword [ebp - 0x14], edx
jmp 0x1003495a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x694], 0xf27260e9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10034949
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x2eb2fc25
setl al
xor edx, edx
add eax, dword [ebp - 0x20]
cmp eax, 0x4087a912
jne 0x10034992
cmp dword [ebp - 0x20], edx
jne 0x10034992
mov eax, edx
jmp 0x10034995
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x23d
setg cl
xor eax, eax
cmp ecx, 1
mov ecx, dword [ebp - 0x34]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x20]
je 0x10034acb
mov dword [ebp - 0x40], 0xf50e16ff
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x10], edx
jmp 0x10034a05
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d4], 0xa9ac04bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100349f4
mov dword [ebp - 0x10], edx
jmp 0x10034a20
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x764], 0xd88c924d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034a0f
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xfffffff7
jl 0x10034ac3
mov dword [ebp - 0x14], 0x8d
mov dword [ebp - 0x1c], 0x785e8a77
imul eax, dword [ebp - 0x44], 0x3376
add eax, dword [ebp - 0x40]
jne 0x10034a55
cmp dword [ebp - 0x14], edx
jne 0x10034a55
mov esi, edx
jmp 0x10034a5a
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0xb5c1
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
sub esi, edx
add esi, dword [ebp - 0x40]
je 0x10034a8b
cmp dword [ebp - 0x14], 0
je 0x10034a8b
xor eax, eax
inc eax
jmp 0x10034a8d
xor eax, eax
imul eax, eax, 0xfffffff7
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10034ab3
push edx
push edx
call edi
xor edx, edx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff7
jge 0x10034a32
push 4
pop esi
dec dword [ebp - 0x760]
jmp 0x10034b22
mov dword [ebp - 0x38], 0x24061354
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff8
inc eax
mov dword [ebp - 0x24], 0xe38b13f4
mov dword [ebp - 0x24], 0x16d172e3
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x5249f392
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], edx
jmp 0x10034b14
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7e4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10034b03
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x41c]
push ebx
call fcn.1000ecc1
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x2c], edx
inc ecx
jmp 0x10034b48
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xac], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10034b3b
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
jge 0x10034b6d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x41c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10034b55
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov edi, 0xffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], edx
je 0x10034b92
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0x7a4a12b5
mov dword [ebp - 0x1c], edx
jmp 0x10034cfd
mov dword [ebp - 0x14], edx
jmp 0x10034ba8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12c], 0x11b55e97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10034b97
cmp dword [ebp - 0xac], edx
je 0x10034c65
mov dword [ebp - 0x1c], 0xa6e483bb
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x38], 0xe630971c
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x1d
jl 0x10034ce0
jmp 0x10034be0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], 0x5c6f
mov dword [ebp - 0x38], 0xfffffff8
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x40]
sub ecx, eax
je 0x10034c04
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x128]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xac], ecx
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x40]
sbb edx, edx
imul eax, dword [ebp - 0x10]
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, ebx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jge 0x10034bdd
jmp 0x10034cde
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], edx
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10034c89
push edx
push 0x1585
push 0x1c53
push 0x1756
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x128]
neg eax
cmp ecx, eax
jle 0x10034cbb
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + 4]
setg dl
cmp edx, dword [ebp - 0x10]
jg 0x10034cbb
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034cfd
push edx
push edx
push 0xa39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x41c]
call fcn.1000f797
mov dword [ebp - 0x20], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x3c], 0x571177e8
mov dword [ebp - 0x1c], 0x96c7979b
mov dword [ebp - 0x38], 0x8951bb35
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0xfffffffb
je 0x10034dac
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x10], edx
jmp 0x10034d4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10034d3b
mov dword [ebp - 0x10], edx
jmp 0x10034d67
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x528], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10034d56
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x4d63a88e
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x524], 0xfffffffe
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jne 0x10034d2f
push 6
pop esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], 0xfd3df75d
mov dword [ebp - 0x10], 0x1d832937
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0xfffb
mov dword [ebp - 0x24], 0xa912
mov dword [ebp - 0x34], edx
jmp 0x10034e03
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x888], 0x2c60edac
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10034df2
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xfffffff8
jne 0x10034ead
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], 0x7bff44ca
mov dword [ebp - 0x24], 0x1d11023d
mov dword [ebp - 0x24], 0x889a278c
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0x5954e3f1
mov dword [ebp - 0x24], 0x7bc8b421
mov dword [ebp - 0x34], edx
jmp 0x10034e55
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4dc], 0xffffffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10034e44
mov dword [ebp - 0x10], 0xf394a2a4
cmp dword [ebp - 0x10], edx
je 0x10034e9a
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
jg 0x10034e9d
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034e82
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x494]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10034e6f
xor ecx, ecx
inc ecx
jmp 0x10034e9d
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x1c]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
je 0x10034e19
mov dword [ebp - 0x50], 0x1c097bc8
mov dword [ebp - 0x34], 0x73196e86
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], edx
jmp 0x10034f13
mov dword [ebp - 0x34], 3
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034ee8
push edx
push edx
push 0x1102
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov dword [ebp - 0x34], 0x18
jmp 0x10034f0a
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034f07
push 0x2447
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edx, edx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 9
je 0x10034ef1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jle 0x10034ec7
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034f2b
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov dword [ebp - 0x40], 0x51acae7
xor ecx, ecx
mov dword [ebp - 0x3c], 0xbe44
inc ecx
mov dword [ebp - 0x1c], 0x8ee41b66
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], edx
jmp 0x10034f5c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1d4], 0x19d87263
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x10034f4b
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10034f82
push 0x87f
push edx
push edx
push 0x160c
push edx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor ecx, ecx
xor edx, edx
inc ecx
cmp dword [ebp - 0x3c], edx
je 0x10034fa5
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
movdqa xmm0, xmmword [0x10008000]
lea eax, [ebp - 0x6f4]
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x10], 0x3dd33a4a
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x704]
push ecx
push eax
push ecx
mov dword [ebp - 0x1c], 0x907c4e7c
lea ecx, [ebp - 0x674]
movdqu xmmword [ebp - 0x704], xmm0
call fcn.10032c46
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0xd
cmp dword [ebp - 0x10], 0xffffffe3
jg 0x100350de
mov esi, dword [ebp - 0x674]
mov dword [ebp - 0x34], 0xffff
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x1c], 0x40ca7005
mov dword [ebp - 0x1c], 0xa67d9261
mov dword [ebp - 0x1c], 0xffffffff
push 3
call fcn.1000ecc1
mov dword [ebp - 0x28], edi
jmp 0x1003504c
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x35c]
mov dword [eax + ecx*4], 0xa73a151c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10035039
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x10]
sub edx, 0x3ac2
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x53bf844b
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul ecx, eax, 0xe1cc
mov eax, dword [ebp - 0x35c]
mov dword [eax + 8], ecx
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x35c]
call fcn.1000f797
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x1003500b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.1000f797
movdqa xmm0, xmmword [0x10008040]
lea ecx, [ebp - 0x744]
push ecx
lea eax, [ebp - 0x734]
mov dword [ebp - 0x24], 0xfffffffa
push eax
push ecx
lea ecx, [ebp - 0x4f0]
movdqu xmmword [ebp - 0x744], xmm0
call fcn.10032c46
mov eax, dword [ebp - 0x4f0]
xor ecx, ecx
mov dword [ebp - 0x24], 0x8cb5c746
mov dword [eax + 8], ecx
mov byte [ebp - 0x2d], cl
cmp byte [ebp - 0x2d], cl
je 0x10035151
push 0x2478
push ecx
push 0x15c9
push ecx
push 0x56b
push 0x70
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f0]
call fcn.1000f797
xor eax, eax
lea ecx, [ebp - 0x14c]
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x7b5b
mov dword [ebp - 0x38], 0xb7d6
mov dword [ebp - 0x10], 0xa275ff44
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x28], 0x585fafe4
push 3
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 0x24], 0x4b4fbf64
mov dword [ebp - 0x2c], edx
jmp 0x100351b7
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0x8bbeb927
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100351a4
mov dword [ebp - 0x2c], edx
jmp 0x100351d3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x53c], 0xbfe2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100351c2
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 1
setge cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
cmp eax, 0xc509
setg cl
cmp ecx, dword [ebp - 0x34]
jg 0x10035201
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x40], edx
je 0x10035213
cmp dword [ebp - 0x10], edx
je 0x10035213
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edi, dword [ebp - 0x14c]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, 0x2f860ef9
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [edi + 4]
setle al
add eax, 0x7f45b6d4
jne 0x1003525a
cmp dword [ebp - 0x28], eax
jne 0x1003525a
mov esi, eax
jmp 0x1003525f
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [edi + 4]
cmp esi, eax
mov eax, 0x951a
setl cl
sub eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, edx
xor edx, edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jl 0x1003532a
mov dword [ebp - 0x1c], 0x98c53483
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x100352a4
push edx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x14c]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
test eax, eax
je 0x100352c3
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], edx
je 0x100352fb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], 0xa44b
mov eax, dword [ebp - 0x10]
setle dl
imul eax, edx
xor edx, edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edx
je 0x100352fb
xor eax, eax
inc eax
jmp 0x100352fd
mov eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], edx
jle 0x10035317
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x53c], 0xfb6c7178
dec dword [ebp - 0x10]
jns 0x1003528d
lea ecx, [ebp - 0x14c]
call fcn.1000f797
mov dword [ebp - 0x24], 0x2dd0685
xor ecx, ecx
push 3
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x28], ecx
pop edx
jmp 0x1003535a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x608], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1003534d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], edx
jge 0x10035388
xor edx, edx
inc edx
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x608], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10035373
jmp 0x1003538b
xor edx, edx
inc edx
mov dword [ebp - 0x34], ecx
jmp 0x100353a1
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4e0], 0xf27260e9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x10035390
push 7
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], 0xbb743d8
mov dword [ebp - 0x34], 0xe1a8
mov dword [ebp - 0x1c], 0x3c47aa29
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x10], 0x18158fb5
mov dword [ebp - 0x44], 0xd93cbfb4
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x54], 0xd2ad05b3
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x3c], ecx
jmp 0x10035401
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x124], 0xf89c8946
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jl 0x100353f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x28], ecx
jne 0x1003544d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x10035439
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jne 0x1003544a
mov edx, ecx
jmp 0x1003544d
xor edx, edx
inc edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0xb300
jne 0x1003546a
xor eax, eax
cmp dword [ebp - 0x34], eax
jne 0x1003546a
mov ecx, eax
jmp 0x1003546f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x6243
jne 0x10035496
cmp dword [ebp - 0x34], 0
je 0x10035496
xor eax, eax
inc eax
jmp 0x10035498
xor eax, eax
mov ecx, dword [ebp - 0x28]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x11e75876
setl al
xor ecx, ecx
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
add eax, 0xe7e1dec
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x28], eax
je 0x100354d6
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], 0xfff9
xor edx, edx
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x28], 0x81fd
push 0xfffffffffffffffc
pop edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x124]
cmp eax, edi
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0x2eb2fc25
setl al
add eax, dword [ebp - 0x14]
cmp eax, 0x4087a912
jne 0x1003554b
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1003554e
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x23d
setg cl
xor eax, eax
xor edx, edx
inc edx
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
je 0x10036273
movdqa xmm0, xmmword [0x10008020]
lea ecx, [ebp - 0x724]
push ecx
lea eax, [ebp - 0x714]
mov dword [ebp - 0x48], 0xf50e16ff
push eax
push ecx
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x24], 0xfffffffa
movdqu xmmword [ebp - 0x724], xmm0
call fcn.10032c46
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x404]
mov bl, byte [ebp + 0xb]
and dword [eax], 0
push 2
lea ecx, [ebp - 0x3ec]
call fcn.1000ecc1
push 3
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 3
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x1003561b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3ec]
mov dword [eax + ecx*4], 0x7be7e550
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10035608
mov dword [ebp - 0x10], edx
jmp 0x10035636
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3d4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10035626
mov eax, dword [ebp - 0x3ec]
mov esi, dword [ebp - 0x3d4]
mov dword [eax + 4], 0x6e838462
mov dword [esi + 8], 0xfffffff3
mov dword [ebp - 0x1c], 0x18dc
cmp dword [ebp - 0x1c], 0x975
jge 0x1003571a
lea eax, [ebp - 0xb8]
push eax
push 0x10007848
call fcn.1004f8bb
pop ecx
pop ecx
jmp 0x10035703
dec eax
push 0x108a6d80
push 0x10007e08
mov dword [ebp - 0xb8], eax
call fcn.1004f8bb
xor eax, eax
push 0x64
push eax
mov dword [ebp - 0x940], eax
lea eax, [ebp - 0x93c]
push eax
call fcn.1004fba0
mov dl, byte [0x108a6d80]
add esp, 0x14
test dl, dl
je 0x100356d4
mov ecx, 0x108a6d80
movsx eax, dl
inc dword [ebp + eax*4 - 0xac4]
inc ecx
mov al, byte [ecx]
mov dl, al
test al, al
jne 0x100356c1
xor eax, eax
mov ecx, eax
cmp dword [ebp + eax*4 - 0x940], ecx
jle 0x100356eb
mov ecx, dword [ebp + eax*4 - 0x940]
lea ebx, [eax + 0x61]
inc eax
cmp eax, 0x1a
jl 0x100356d8
movsx eax, bl
push eax
push ecx
push 0x10007e0c
call fcn.1004faef
add esp, 0xc
mov eax, dword [ebp - 0xb8]
test eax, eax
jne 0x10035682
dec eax
xor edx, edx
mov dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffd
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jl 0x10035743
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x1003573e
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
dec dword [ebp - 0x14]
jns 0x1003572c
inc dword [esi + 8]
cmp dword [esi + 8], 7
jne 0x10035656
lea ecx, [ebp - 0x3d4]
call fcn.1000f797
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 2
call fcn.1000f797
mov eax, dword [ebp - 0x404]
inc dword [eax]
cmp dword [eax], 0x1a
jle 0x100355e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x404]
call fcn.1000f797
xor eax, eax
lea ecx, [ebp - 0x500]
inc eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x25260
push 3
call fcn.1000ecc1
mov dword [ebp - 0x1c], 0x2282d564
mov dword [ebp - 0x14], ebx
jmp 0x100357cb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x500]
mov dword [eax + ecx*4], 0x8795010f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100357b8
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x500]
call fcn.1000f797
push 2
lea ecx, [ebp - 0x320]
call fcn.1000ecc1
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x10035804
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100357f6
mov dword [ebp - 0x10], edx
jmp 0x1003581e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x320]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003580e
mov ebx, dword [ebp - 0x320]
push 4
mov dword [ebp - 0x38], ebx
pop esi
mov dword [ebx + 4], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x2099
cmp dword [ebp - 0x1c], 0x12d4
jge 0x10035914
lea eax, [ebp - 0x9c]
push eax
push 0x1000784c
call fcn.1004f8bb
mov eax, dword [ebp - 0x9c]
pop ecx
pop ecx
test eax, eax
je 0x1003590d
dec eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x118]
push eax
push 0x1000784c
call fcn.1004f8bb
xor eax, eax
mov edi, eax
mov ebx, eax
mov esi, eax
pop ecx
pop ecx
cmp dword [ebp - 0x118], eax
jle 0x100358ec
lea eax, [ebp - 0x240]
push eax
push 0x1000784c
call fcn.1004f8bb
mov eax, dword [ebp - 0x240]
pop ecx
pop ecx
and eax, 0x80000001
jns 0x100358ba
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, esi
and ecx, 0x80000001
jns 0x100358c9
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, eax
jge 0x100358d0
inc edi
jmp 0x100358d3
jle 0x100358d3
inc ebx
inc esi
cmp esi, dword [ebp - 0x118]
jl 0x10035895
cmp edi, ebx
je 0x100358ec
push 0x10007c5c
call fcn.1004fca6
jmp 0x100358f8
push edi
push 0x100078c8
call fcn.1004faef
pop ecx
mov eax, dword [ebp - 0x9c]
pop ecx
test eax, eax
jne 0x1003586b
mov ebx, dword [ebp - 0x38]
push 4
pop esi
dec eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebx + 4]
mov eax, dword [ebp + eax*4 - 0x6c]
add eax, dword [ebx + 4]
inc dword [ebx + 4]
cmp dword [ebx + 4], 0
mov dword [ebp - 0x1c], eax
jle 0x10035833
xor edx, edx
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10035973
push edx
push 0x57
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x320]
call fcn.1000f797
mov dword [ebp - 0x10], 0x477862fd
lea ecx, [ebp - 0x668]
xor eax, eax
mov dword [ebp - 0x40], 0x300ce3d9
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0x8fb
mov dword [ebp - 0x40], 0x6ba8a7e8
mov dword [ebp - 0x24], 0
push 3
call fcn.1000ecc1
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x38], 0xffffffff
push 2
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x10], edx
pop ebx
jmp 0x100359e0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x550], 0xdeea39b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100359cf
mov dword [ebp - 0x10], edx
jmp 0x100359fd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x668]
mov dword [eax + ecx*4], 0xadab8f5b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100359ea
push 5
mov dword [ebp - 0x10], edx
pop edi
jmp 0x10035bdc
mov dword [ebp - 0x2c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
inc ecx
mov dword [ebp - 0x20], 0x477a14a9
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
jmp 0x10035a45
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7f4], 0xf19
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10035a34
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
imul eax, dword [ebp - 0x40], 9
cmp eax, dword [ebp - 0x3c]
jl 0x10035a63
cmp dword [ebp - 0x3c], edx
jne 0x10035a63
mov ecx, edx
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x299f
setge cl
xor edx, edx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x20]
sub ecx, 0x52f0
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
cmp eax, 0xd1a9
jle 0x10035ad1
xor eax, eax
cmp dword [ebp - 0x40], eax
jne 0x10035ad1
mov ecx, eax
jmp 0x10035ad6
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, 0x2510a741
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
sub edx, 0x7067
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
dec eax
add eax, ecx
xor ecx, ecx
imul eax, dword [ebp - 0x10]
inc ecx
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x2c], edx
je 0x10035b6d
movdqa xmm0, xmmword [0x10008050]
lea eax, [ebp - 0x6c4]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x6d4]
push ecx
push eax
push ecx
mov dword [ebp - 0x24], edx
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x24], 0x8a5f0362
movdqu xmmword [ebp - 0x6d4], xmm0
call fcn.10032c46
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x798]
call fcn.1000f797
jmp 0x10035bd7
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], 0xffffffff
jmp 0x10035b8d
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], 0
je 0x10035b8a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd
jl 0x10035b79
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x12
jge 0x10035bd9
mov dword [ebp - 0x5c], 0x17d3e822
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x5c]
test eax, eax
sets cl
xor edx, edx
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
cmp ecx, 0x6664
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x12
jl 0x10035b9c
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jg 0x10035a0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x668]
call fcn.1000f797
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x10035c0d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84c], 0xa9ac04bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10035bfc
mov dword [ebp - 0x10], ecx
jmp 0x10035c28
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6f4], 0xd88c924d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10035c17
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0xfffffff7
jl 0x10036188
mov esi, 0x878ed7c3
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x24], 0xb50bf34f
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x510]
mov dword [ebp - 0x24], 0xdd688769
push 3
call fcn.1000ecc1
mov dword [ebp - 0x24], 0xfffffffe
xor edx, edx
mov dword [ebp - 0x314], esi
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x308], esi
push 3
mov dword [ebp - 0x14], edx
pop esi
jmp 0x10035ca0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035c8d
dec dword [ebp - 0x308]
mov byte [ebp - 0x2d], dl
cmp byte [ebp - 0x2d], dl
je 0x10035cb9
xor eax, eax
lea ecx, [ebp - 0x520]
inc eax
push eax
call fcn.1000ecc1
push ebx
lea ecx, [ebp - 0x620]
mov dword [ebp - 4], edi
call fcn.1000ecc1
xor eax, eax
mov byte [ebp - 4], 6
inc eax
mov dword [ebp - 0x24], edi
push eax
lea ecx, [ebp - 0x464]
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 0x24], 0x6088b922
mov dword [ebp - 0x10], edx
jmp 0x100361d9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x520]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x100361ca
mov dword [ebp - 0x10], edx
jmp 0x100361f9
push 4
pop edi
push edi
lea ecx, [ebp - 0x690]
call fcn.1000ecc1
mov dword [ebp - 0x24], 0xd444182b
xor edx, edx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], 0x50ba1bf2
mov dword [ebp - 0x24], 0xfcf09cc2
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], 0x2af0488f
mov dword [ebp - 0x10], edx
jmp 0x100362c2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x690]
mov dword [eax + ecx*4], 0x464b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100362af
mov dword [ebp - 0x10], edx
jmp 0x100362d9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x870], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100362cc
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x690]
call fcn.1000f797
xor eax, eax
mov dword [ebp - 0x1c], 0x24061354
inc eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x5c], 0x3de467b4
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x10], eax
push eax
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x10], edx
jmp 0x10036345
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x10], ecx
jl 0x10036336
mov dword [ebp - 0x10], edx
jmp 0x10036363
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f4], 0x41ec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036352
mov dword [ebp - 0x2c], 0xffffffee
cmp dword [ebp - 0x2c], 0xfffffffe
jge 0x10036577
jmp 0x1003637e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0x56e3
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], edx
jmp 0x100363a8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1003639b
cmp dword [ebp - 0x2c], edx
je 0x100363cf
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
test ecx, ecx
je 0x100363cf
xor eax, eax
inc eax
jmp 0x100363d1
mov eax, edx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
jg 0x1003656a
lea edi, [ebp - 0x6b4]
lea eax, [ebp - 0x6a4]
push ecx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 3
lea ecx, [ebp - 0x380]
push edi
movdqu xmmword [ebp - 0x6b4], xmm0
call fcn.10032c46
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xe4]
cmp dword [eax + ecx*4], edx
je 0x10036497
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x6352
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x1c]
add ecx, 0x3d34
imul ecx, dword [ebp - 0x54]
cmp ecx, 0xfffffff8
setg al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], edx
je 0x10036460
cmp dword [ebp - 0x1a0], edx
je 0x10036460
xor eax, eax
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], esi
xor ecx, ecx
mov dword [ebp - 0x25c], esi
mov eax, dword [ebp - 0x48]
cmp edx, eax
setge cl
mov dword [ebp - 0x2f4], ecx
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
xor eax, eax
inc eax
xor edx, edx
jmp 0x10036499
mov eax, edx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
cmp dword [eax + ecx*4], edx
jne 0x100364ad
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
sub eax, 0x5db2
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xfffffff8
cmp eax, 0x285618a3
mov eax, dword [ebp - 0x380]
setle cl
dec ecx
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x25c], ecx
mov eax, dword [eax]
add eax, ecx
cmp eax, 0xfffa
jne 0x1003650a
cmp dword [ebp - 0x1a4], edx
je 0x1003650a
mov eax, dword [ebp - 0x380]
cmp dword [eax + 0xc], edx
je 0x1003650a
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [ebp - 0x2f0]
jg 0x10036522
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5c], eax
jge 0x10036541
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xe4]
cmp dword [ecx + eax*4], 0
je 0x10036547
xor eax, eax
inc eax
jmp 0x10036549
mov ecx, dword [ebp - 0xe4]
xor eax, eax
mov dword [ecx], eax
lea ecx, [ebp - 0x380]
call fcn.1000f797
inc dword [ebp - 0x10]
lea eax, [ebp - 0x6a4]
xor edx, edx
cmp dword [ebp - 0x10], edx
jle 0x100363ef
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffe
jl 0x1003637b
mov byte [ebp - 0x15], dl
mov dword [ebp - 0x1c], 0x1893
cmp dword [ebp - 0x1c], 0x8e9
jge 0x100366fc
or dword [ebp - 0x140], 0xffffffff
xor eax, eax
or dword [ebp - 0xd4], 0xffffffff
inc eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd4]
push eax
push ecx
lea eax, [ebp - 0x140]
mov ecx, 0x1065aaa0
push eax
call fcn.1000e663
pop ecx
mov ecx, eax
call fcn.1000e663
mov ebx, dword [ebp - 0x140]
mov edi, dword [ebp - 0xd4]
test ebx, ebx
jne 0x100365db
test edi, edi
je 0x100366fc
mov eax, dword [0x1096ac58]
mov ecx, 0x1096ac58
push ebx
mov dword [0x1096ac5c], eax
call fcn.10032c6c
xor esi, esi
test ebx, ebx
jle 0x1003660e
mov eax, dword [0x1096ac58]
mov ecx, 0x1065aaa0
lea eax, [eax + esi*4]
push eax
call fcn.1000e663
inc esi
cmp esi, ebx
jl 0x100365f6
push dword [0x1096ac5c]
push dword [0x1096ac58]
call fcn.10013347
mov esi, dword [ebp - 0x1c]
mov edx, 0x10007e14
pop ecx
pop ecx
push esi
push ecx
mov ecx, 0x1065a9f8
call fcn.10013431
pop ecx
mov ecx, eax
call fcn.1000e973
mov dl, 0x3a
mov ecx, eax
call fcn.10033afa
inc esi
mov dword [ebp - 0x1c], esi
push eax
jmp 0x100366e2
lea eax, [ebp - 0x120]
mov ecx, 0x1065aaa0
push eax
dec edi
call fcn.1000e663
mov esi, dword [0x1096ac5c]
lea edx, [ebp - 0x120]
mov ebx, dword [0x1096ac58]
lea ecx, [ebp - 0x4e4]
push esi
push ebx
call fcn.1004354c
sub esi, ebx
pop ecx
sar esi, 2
mov eax, dword [eax]
sub eax, ebx
sar eax, 2
pop ecx
mov ecx, dword [ebp - 0x120]
cmp eax, esi
jae 0x100366c6
test eax, eax
js 0x100366c6
cmp dword [ebx + eax*4], ecx
jne 0x100366c6
inc eax
push eax
push ecx
push ecx
mov ecx, 0x1065a9f8
call fcn.1000e973
mov edx, 0x10007e1c
mov ecx, eax
call fcn.10013431
pop ecx
mov ecx, eax
call fcn.1000e973
jmp 0x100366dd
push ecx
mov ecx, 0x1065a9f8
call fcn.1000e973
mov edx, 0x10007e28
mov ecx, eax
call fcn.10013431
push 0x1065a9f8
call fcn.10013226
pop ecx
test edi, edi
jne 0x10036650
dec edi
mov dword [ebp - 0xd4], edi
jmp 0x100365a2
cmp byte [ebp - 0x15], 0
je 0x10036716
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.1000f797
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], 0xe38b13f4
mov dword [ebp - 0x1c], 0x2189
cmp dword [ebp - 0x1c], 0xa1a
jge 0x100369e5
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x100078b4
call fcn.1004f8bb
add esp, 0x10
lea ecx, [ebp - 0x338]
push dword [ebp - 0x70]
call fcn.1000ecc1
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 8
call fcn.10033088
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 9
call fcn.10033088
push 0xa
pop eax
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], al
call fcn.10033088
mov byte [ebp - 4], 0xb
xor edi, edi
mov ebx, dword [ebp - 0x338]
cmp dword [ebp - 0x70], edi
jle 0x100367e2
mov esi, ebx
push esi
push 0x1000784c
call fcn.1004f8bb
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x7bc]
push eax
lea ecx, [ebp - 0xc4]
call fcn.1003309d
inc edi
add esi, 4
cmp edi, dword [ebp - 0x70]
jl 0x100367b9
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x70], 0
push 4
pop edi
jle 0x10036972
mov esi, ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.100330e4
test eax, eax
je 0x1003695a
push esi
lea ecx, [ebp - 0xc4]
call fcn.10033184
mov ebx, dword [ebp - 0xd0]
lea eax, [ebp - 0x230]
sub ebx, dword [esi]
lea ecx, [ebp - 0xc4]
push eax
mov dword [ebp - 0x230], ebx
call fcn.100330e4
test eax, eax
je 0x100368a1
push esi
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x138]
call fcn.1003309d
mov eax, dword [ebp - 0xd0]
sub eax, dword [esi]
mov dword [ebp - 0x1dc], eax
movzx eax, byte [0x1096adcf]
push eax
lea eax, [ebp - 0x1dc]
push eax
push ecx
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0x138]
call fcn.10033d9c
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xc4]
sub eax, dword [esi]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x234]
push eax
call fcn.10033184
jmp 0x1003695a
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0x1e4]
sub edi, dword [esi]
lea ecx, [ebp - 0xc4]
push eax
mov dword [ebp - 0x1e4], edi
call fcn.100330e4
test eax, eax
je 0x1003692a
push esi
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1003309d
mov eax, dword [ebp - 0xc8]
sub eax, dword [esi]
mov dword [ebp - 0x248], eax
movzx eax, byte [0x1096adcf]
push eax
lea eax, [ebp - 0x248]
push eax
push ecx
lea eax, [ebp - 0x7dc]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.10033d9c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
sub eax, dword [esi]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.10033184
jmp 0x10036957
cmp dword [esi], ebx
jne 0x1003693c
lea eax, [ebp - 0x844]
lea ecx, [ebp - 0x138]
jmp 0x10036950
cmp dword [esi], edi
jne 0x100369f6
lea eax, [ebp - 0x7ec]
lea ecx, [ebp - 0x1b4]
push esi
push eax
call fcn.1003309d
push 4
pop edi
mov eax, dword [ebp - 0x1c]
add esi, edi
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x70]
jl 0x100367f5
mov ebx, dword [ebp - 0x338]
push 0x1000787c
call fcn.1004fca6
xor esi, esi
pop ecx
cmp dword [ebp - 0x70], esi
jle 0x100369aa
push ebx
lea ecx, [ebp - 0x138]
call fcn.100330e4
neg eax
sbb eax, eax
inc eax
push eax
push 0x10007ca0
call fcn.1004faef
inc esi
add ebx, edi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x70]
jl 0x10036984
push 0x100077b5
call fcn.1004fca6
pop ecx
lea ecx, [ebp - 0x1b4]
call fcn.1002ecb0
lea ecx, [ebp - 0x138]
call fcn.1002ecb0
lea ecx, [ebp - 0xc4]
call fcn.1002ecb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.1000f797
mov dword [ebp - 0x20], 0xe0cf
dec dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
jmp 0x10036a16
push 0x10007880
jmp 0x100369af
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10036a13
push ebx
push 0x187b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jge 0x100369fd
xor eax, eax
mov dword [ebp - 0x24], 0x16d172e3
inc eax
mov dword [ebp - 0x24], 0x8a8f
mov dword [ebp - 0x38], 3
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x1c], 4
push eax
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 4], 0xc
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0x3607a988
mov dword [ebp - 0x20], ebx
jmp 0x10036a6f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x350]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10036a60
inc dword [ebp - 0x28]
mov dword [ebp - 0x20], 0x16
jmp 0x10036b8e
mov dword [ebp - 0x34], ebx
jmp 0x10036a99
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x780], 0xfffffffa
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10036a88
cmp dword [ebp - 0x1c], ebx
jne 0x10036b98
mov dword [ebp - 0x28], 0x19
cmp dword [ebp - 0x28], 0x11
jle 0x10036b8b
lea esi, [ebp - 0x714]
lea edi, [ebp - 0x704]
movdqa xmm0, xmmword [0x10007fe0]
push ecx
push edi
push esi
lea ecx, [ebp - 0x374]
movdqu xmmword [ebp - 0x714], xmm0
call fcn.10032c46
mov dword [ebp - 0x34], ebx
jmp 0x10036af9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x78c], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jl 0x10036ae8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x374]
push 7
pop ebx
mov eax, dword [edx]
cmp eax, 0xe136dc99
mov dword [ebp - 0x778], eax
mov eax, dword [edx]
sbb ecx, ecx
add eax, ebx
mov dword [ebp - 0x788], ebx
inc ecx
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
inc edx
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x350]
setle al
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x374]
setle dl
imul edx, dword [ecx]
sub edx, dword [eax + 8]
neg edx
sbb edx, edx
inc edx
neg edx
mov dword [ecx], edx
lea ecx, [ebp - 0x374]
call fcn.1000f797
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
push 0
pop ebx
jg 0x10036ac5
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x13
je 0x10036a83
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.1000f797
push 2
pop ebx
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x2bc]
push ebx
call fcn.1000ecc1
mov dword [ebp - 0x1c], 0x26ca
cmp dword [ebp - 0x1c], 0x8fc
jge 0x10036ca3
push 0x106be3f4
push 0x10007848
call fcn.1004f8bb
pop ecx
pop ecx
mov ecx, dword [0x106be3f4]
xor edi, edi
mov ebx, 0x108a6ad0
test ecx, ecx
jle 0x10036c10
mov esi, ebx
push esi
push 0x10007848
call fcn.1004f8bb
pop ecx
pop ecx
mov ecx, dword [0x106be3f4]
inc edi
add esi, 4
cmp edi, ecx
jl 0x10036bf5
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0x3b9aca01
test ecx, ecx
jle 0x10036c88
xor eax, eax
lea esi, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, esi
cdq
idiv ecx
mov eax, dword [ebx]
sub eax, dword [edx*4 + 0x108a6ad0]
push eax
call fcn.100515b1
pop ecx
cmp eax, dword [ebp - 0x1c]
jge 0x10036c72
mov eax, esi
cdq
idiv dword [0x106be3f4]
mov eax, dword [ebx]
sub eax, dword [edx*4 + 0x108a6ad0]
push eax
call fcn.100515b1
mov dword [ebp - 0x1c], eax
lea edi, [esi - 1]
mov eax, esi
pop ecx
mov ecx, dword [0x106be3f4]
cdq
idiv ecx
mov dword [ebp - 0x38], edx
jmp 0x10036c7b
mov ecx, dword [0x106be3f4]
mov edx, dword [ebp - 0x38]
add ebx, 4
inc esi
lea eax, [esi - 1]
cmp eax, ecx
jl 0x10036c29
jmp 0x10036c8b
mov edx, dword [ebp + 8]
lea eax, [edx + 1]
push eax
lea eax, [edi + 1]
push eax
push 0x100078a8
call fcn.1004faef
add esp, 0xc
push 2
pop ebx
mov dword [ebp - 0x24], 0xffff
xor edx, edx
mov dword [ebp - 0x1c], 0x5d732ada
mov dword [ebp - 0x38], 0x617c0ec0
mov dword [ebp - 0x10], edx
jmp 0x10036cd2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2bc]
mov dword [eax + ecx*4], 0x91a0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036cbf
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x10036ced
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], 0xb02971c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10036cdf
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], edx
jl 0x10036d15
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10036d0d
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
dec dword [ebp - 0x60]
jns 0x10036cfa
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x60]
mov edx, ecx
mov eax, dword [ebp - 0x60]
sub edx, eax
mov eax, dword [ebp - 0x60]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x60]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2bc]
setne cl
cmp ecx, dword [eax]
jge 0x10036d5f
xor ecx, ecx
cmp dword [ebp - 0x38], ecx
je 0x10036d61
xor eax, eax
inc eax
jmp 0x10036d63
xor ecx, ecx
mov eax, ecx
xor edx, edx
add eax, 0xffff1fae
inc edx
cmp eax, edx
jle 0x10036d7d
mov eax, dword [ebp - 0x2bc]
cmp dword [eax + 4], ecx
jne 0x10036d7d
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x38], 0xfffffffb
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x60], eax
call fcn.1000f797
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xf2e5664d
mov dword [ebp - 0x24], 0xba07e4fc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x3d37a5b7
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0x2db8e964
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x89fff12f
mov dword [ebp - 0x24], 0x4ea14c55
mov dword [ebp - 0x1c], 0x1c93
cmp dword [ebp - 0x1c], 0x106b
jge 0x10036e55
push 0x108a6d74
push 0x108a6ac4
push 0x10007c8c
call fcn.1004f8bb
mov eax, dword [0x108a6ac4]
add esp, 0xc
xor edi, edi
test eax, eax
jle 0x10036e52
xor esi, esi
test eax, eax
jle 0x10036e3d
cmp edi, esi
jne 0x10036e29
push dword [0x108a6d74]
push 0x10007ca0
call fcn.1004faef
pop ecx
jmp 0x10036e33
push 0x10007e34
call fcn.1004faef
inc esi
pop ecx
cmp esi, dword [0x108a6ac4]
jl 0x10036e12
push 0x100077b5
inc edi
call fcn.1004fca6
mov eax, dword [0x108a6ac4]
pop ecx
cmp edi, eax
jl 0x10036e0c
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0xa023703a
mov dword [ebp - 0x24], 0x4bda99da
mov dword [ebp - 0x24], eax
push 3
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xebbfad0d
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], 0x95e04a27
mov dword [ebp - 0x24], 0
push esi
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x20], edx
jmp 0x10036ecd
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x534]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10036eba
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ebp - 0x20], 0x14
push 5
pop edi
jne 0x10036f89
xor eax, eax
lea ecx, [ebp - 0x38c]
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], edx
push eax
call fcn.1000ecc1
xor edx, edx
mov dword [ebp - 0x24], 0xf08664a1
inc edx
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x48], 0xa1d127a4
mov dword [ebp - 0x10], ecx
jmp 0x10036f2d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x854], 0xfe30
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10036f1c
mov dword [ebp - 0x10], ecx
jmp 0x10036f46
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10036f37
mov eax, dword [ebp - 0x38c]
mov edx, dword [eax]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
setl cl
imul ecx, edx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x38c]
call fcn.1000f797
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x14
push 0
pop edx
je 0x10036ee6
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10036faf
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push 0x114f
push 0x1019
push 0x189d
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x534]
call fcn.1000f797
mov dword [ebp - 0x24], 0x5249f392
lea ecx, [ebp - 0x2d4]
push ebx
call fcn.1000ecc1
xor eax, eax
mov dword [ebp - 4], 0xe
inc eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x10], 0xaa0d
lea ecx, [ebp - 0x2c8]
push eax
call fcn.1000ecc1
mov dword [ebp - 0x20], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], edx
jmp 0x10037019
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2d4]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10037006
mov dword [ebp - 0x10], edx
xor edx, edx
inc edx
jmp 0x10037039
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c8]
mov dword [eax + ecx*4], 0x2d3f5047
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10037026
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x2d4]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 4]
dec eax
sub edx, eax
mov eax, dword [ebp - 0x2c8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [esi + 4]
setl cl
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x100371ab
push 0xa
pop eax
cmp dword [ebp - 0x10], eax
jle 0x10037075