Function at 0x10037a27
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check os version
Connect pipe
Create directory
Create process on windows
Delete registry key
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get file system object information
Get geographical location
Log keystrokes
Modify service
Parse pe header
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
mov eax, 0x1008dd67
call fcn.1008c840
mov eax, 0x160c
call fcn.10089100
push ebx
push esi
or esi, 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x20], esi
xor eax, eax
push edi
mov dword [ebp - 0x48], 0x6de6
mov ecx, 0xfffd
mov dword [ebp - 0x38], 0x3ae50714
push 3
mov dword [ebp - 0x14], eax
pop ebx
mov byte [ebp - 0x71], dl
cmp dword [ebp - 0x14], ebx
jge 0x10037a7e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037a6a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10037a94
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13c4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037a83
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10037b36
mov dword [ebp - 0x10], 0x4d2e
xor ecx, ecx
mov dword [ebp - 0x24], 0x4adca1a1
mov dword [ebp - 0x3c], 0xfe2cf45
mov dword [ebp - 0x38], 0xfffffff9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc48]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0xc48]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xc48], 0x172ddb74
jge 0x10037b04
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x10]
jne 0x10037b1a
cmp dword [ebp - 0x38], eax
je 0x10037b1d
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
mov dword [ebp - 0x13c4], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x10037aa5
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0xffffffea
jmp 0x10037bc8
mov dword [ebp - 0x24], 0x51ebf0dd
xor edx, edx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x38], 0xfa01
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, 0x6cce
setle dl
xor ecx, ecx
cmp edx, 0xbc6e
setl cl
sub eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10037bc5
push 0x25e8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jg 0x10037b4f
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10037be0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
movdqa xmm0, xmmword [0x10009850]
lea ecx, [ebp - 0x15a8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x72226312
mov dword [ebp - 0x3c], 0x4cb8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x1264]
push eax
movdqu xmmword [ebp - 0x1264], xmm0
call fcn.1001b187
lea ecx, [ebp - 0x25d]
mov esi, eax
call fcn.1000a7d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe40]
push dword [esi]
call fcn.1001b14d
xor eax, eax
xor edi, edi
mov dword [ebp - 4], eax
inc edi
mov dword [ebp - 0x24], 0xf953
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x38], 0xe01afec1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
push 0xfffffffffffffffd
cmp edi, eax
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
add eax, 0x565e
add eax, edx
xor ecx, ecx
cmp eax, esi
setl cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
pop eax
jl 0x10037d25
or esi, 0xffffffff
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xe40]
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.1001b178
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0x104353e
lea ecx, [ebp - 0xe40]
setle dl
xor ebx, ebx
cmp edx, eax
setg bl
call fcn.1001b178
xor ecx, ecx
push 0xfffffffffffffffd
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
setle cl
xor edx, edx
cmp ecx, 0x7d37
setle dl
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x14]
pop eax
jns 0x10037ca9
push 3
pop ebx
jmp 0x10037d28
or esi, 0xffffffff
lea ecx, [ebp - 0xe40]
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x48], 0x6de6
mov edi, 0x3ae50714
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10037d67
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc60], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037d4f
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10037d7d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1484], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037d6c
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10037e1f
mov dword [ebp - 0x10], 0x4d2e
xor ecx, ecx
mov dword [ebp - 0x24], 0x4adca1a1
mov dword [ebp - 0x3c], 0xfe2cf45
mov dword [ebp - 0x38], 0xfffffff9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc60]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0xc60]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xc60], 0x172ddb74
jge 0x10037ded
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x10]
jne 0x10037e03
cmp dword [ebp - 0x38], eax
je 0x10037e06
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
mov dword [ebp - 0x1484], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x10037d8e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0xdb8faaae
mov dword [ebp - 0x24], 0xf230
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
cmp edx, 0x30dfddae
jne 0x10037ea7
mov dword [ebp - 0x38], 0xfffffffb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10037f59
push eax
push 0x1eb9
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10037f59
push 1
lea ecx, [ebp - 0x968]
call fcn.1001b10b
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0xdd3ed23c
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], eax
jge 0x10037eea
push dword [ebp - 0x10]
lea ecx, [ebp - 0x968]
call fcn.1001b178
mov dword [eax], 0xc3f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10037ecd
xor eax, eax
lea ecx, [ebp - 0x968]
push eax
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x968]
push eax
call fcn.1001b178
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x968]
xor eax, eax
mov dword [ebp - 0x10], esi
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0x10]
xor edx, edx
push 0xfffffffffffffffa
cmp dword [eax], ecx
pop eax
setl dl
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10037f4b
push eax
push 0x2377
push 0x39d
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x968]
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x54], 0x6de6
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x38], edi
push 2
call fcn.1001b10b
push 2
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x30], 0x9ad59e57
mov dword [ebp - 0x10], 0x5f6f594a
mov dword [ebp - 0x48], 0x5c9828a5
mov dword [ebp - 0x3c], 0x502d4801
mov dword [ebp - 0x58], 0x66298a20
mov dword [ebp - 0x34], 0xaa55
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10037fc9
push dword [ebp - 0x14]
lea ecx, [ebp - 0x488]
call fcn.1001b178
mov dword [eax], 0x204e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10037faa
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10037fe8
push 0xfffffffffffffffe
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x410], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10037fd4
xor eax, eax
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], eax
jl 0x10038332
jmp 0x10037ffc
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffc
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x2c], 0xcf687292
mov dword [ebp - 0x24], eax
push ebx
call fcn.1001b10b
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10038040
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8b0], 0xd700d1a0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10038027
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038066
push dword [ebp - 0x14]
lea ecx, [ebp - 0x44c]
call fcn.1001b178
mov dword [eax], 0x20bab1f3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038048
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10038320
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], eax
jl 0x10038306
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0xd0811fc8
lea ecx, [ebp - 0x470]
push ebx
call fcn.1001b10b
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x44], 0x494fb389
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100380c8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x470]
call fcn.1001b178
mov dword [eax], 0xa77b69c9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100380aa
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100380e8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb50], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100380d0
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10038121
cmp dword [ebp - 0x20], eax
je 0x100380ff
cmp dword [ebp - 0x30], eax
je 0x100380ff
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
jmp 0x10038101
mov ecx, eax
mov eax, dword [ebp - 0x40c]
cmp ebx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add eax, ecx
je 0x1003811f
xor edx, edx
xor edi, edi
inc edx
inc edi
jmp 0x10038123
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
push 2
sete cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x470]
call fcn.1001b178
mov edx, dword [ebp - 0x20]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x470]
push 2
setl al
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x40c]
mov eax, dword [ebp - 0x408]
call fcn.1001b178
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x44c]
setge dl
xor ebx, ebx
cmp edx, eax
setg bl
xor eax, eax
mov dword [ebp - 0x8b0], ebx
push eax
call fcn.1001b178
mov dword [eax], ebx
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x20]
jne 0x100381b9
mov eax, dword [ebp - 0x40c]
push edi
lea ecx, [ebp - 0x470]
call fcn.1001b178
cmp dword [eax], 0
je 0x100381dd
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100382f8
cmp dword [ebp - 0x20], eax
jmp 0x100382dc
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], eax
jl 0x100382d9
mov dword [ebp - 0x38], 0xc764
lea ecx, [ebp - 0x488]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0xb4c]
xor edx, edx
add ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0xb4c]
cmp edx, ecx
sbb ecx, ecx
neg ecx
add ecx, dword [eax]
xor eax, eax
cmp ecx, 0xe19c
lea ecx, [ebp - 0x44c]
setg al
imul esi, eax
xor eax, eax
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0x410]
xor ebx, ebx
imul ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setl bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x488]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
xor eax, eax
push eax
call fcn.1001b178
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x44c]
xor eax, eax
mov dword [ebp - 0xb50], esi
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0x20]
mov edi, eax
xor eax, eax
cmp esi, ecx
mov ecx, dword [ebp - 0x44]
sete al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x44c]
push 1
setl dl
or eax, 0xffffffff
cmp edx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov eax, dword [ebp - 0x40c]
call fcn.1001b178
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x44]
jns 0x100381f5
xor edi, edi
inc edi
push 3
pop ebx
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], bl
call fcn.1001b173
dec dword [ebp - 0x18]
jns 0x10038082
jmp 0x10038306
lea ecx, [ebp - 0x470]
call fcn.1001b173
push 3
pop ebx
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 2
call fcn.1001b173
dec dword [ebp - 0x30]
jns 0x10037ffa
jmp 0x1003832f
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 2
call fcn.1001b173
or esi, 0xffffffff
push 1
lea ecx, [ebp - 0x488]
call fcn.1001b178
mov edi, 0xfff8
cmp dword [eax], 0
je 0x100383a6
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1003836c
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push 1
lea ecx, [ebp - 0x488]
call fcn.1001b178
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x488]
setle bl
xor eax, eax
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0x34]
sub ebx, ecx
xor ecx, ecx
cmp ebx, dword [eax]
setg cl
cmp ecx, edi
ja 0x100383a6
xor eax, eax
inc eax
jmp 0x100383a8
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x488]
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x18], esi
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0xe2e4ed38
mov dword [ebp - 0x20], 0x860bc23c
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jge 0x100383f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], 0x4caa8e55
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100383da
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jne 0x100383fe
cmp dword [ebp - 0x18], ecx
jne 0x10038400
xor eax, eax
mov dword [ebp - 0x12c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
test eax, eax
setle cl
xor edx, edx
cmp ecx, 0x17be
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [ebp - 0x18], ecx
jg 0x1003846f
xor eax, eax
cmp dword [ebp - 0x12c], eax
jne 0x1003846f
mov edx, eax
jmp 0x10038472
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100384d1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x12c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x100384c6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x100384c1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12c], 9
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jl 0x100384a8
xor eax, eax
dec dword [ebp - 0x14]
jns 0x1003849f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
push 0
pop eax
jle 0x10038489
push 3
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x100384ea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe58], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100384d9
push 2
lea ecx, [ebp - 0x1c0]
call fcn.1001b10b
push ebx
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 4], 5
call fcn.1001b10b
push 6
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003853e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x9c4], 0x6af1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10038526
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10038566
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1c0]
call fcn.1001b178
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10038547
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x1003858c
push dword [ebp - 0x34]
lea ecx, [ebp - 0x8c8]
call fcn.1001b178
mov dword [eax], 0xec326874
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x1003856e
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x100385aa
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x928], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 1
jl 0x10038595
xor eax, eax
push eax
lea ecx, [ebp - 0x1c0]
call fcn.1001b178
lea ecx, [ebp - 0x1c0]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001b178
xor edi, edi
push 7
inc edi
cmp dword [eax], 2
pop ecx
jg 0x100386f5
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1c0]
push edi
call fcn.1001b178
push 2
lea ecx, [ebp - 0x8c8]
call fcn.1001b178
push 2
lea ecx, [ebp - 0x8c8]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.1001b178
push 2
lea ecx, [ebp - 0x8c8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9c4]
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1c0]
push eax
call fcn.1001b178
lea ecx, [ebp - 0x1c0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x9c4]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001b178
mov edx, dword [ebp - 0x24]
imul edx, dword [eax]
mov eax, dword [ebp - 0x24]
add edx, 0xd860ad1d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x100386ca
push eax
lea ecx, [ebp - 0x1c0]
call fcn.1001b178
mov esi, eax
lea ecx, [ebp - 0x1c0]
xor eax, eax
push eax
call fcn.1001b178
push 0
mov ecx, dword [eax]
mov edx, dword [ebp + ecx*4 - 0x9c4]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [ebp + eax*4 - 0x9c4]
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x928], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10038683
push eax
lea ecx, [ebp - 0x1c0]
call fcn.1001b178
lea ecx, [ebp - 0x1c0]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001b178
push 7
pop ecx
cmp dword [eax], 2
jle 0x100385d6
or esi, 0xffffffff
lea ecx, [ebp - 0x8c8]
call fcn.1001b173
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], esi
call fcn.1001b173
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10038730
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13dc], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10038718
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], 0x6548aab5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003875d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10d8], 0x7e6aa165
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10038745
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10038781
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003877e
push 0x183e
push 0x2085
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10038762
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10d0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10d0]
mov eax, 0xffff
cmp dword [ebp - 0x20], eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10038ae8
push ebx
lea ecx, [ebp - 0xf9c]
call fcn.1001b10b
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], 0x76f5020f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003880e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf9c]
call fcn.1001b178
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100387f4
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003881f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10038861
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003884b
push 0x18e1
push 0xe25
push eax
push 0xfb4
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf9c]
call fcn.1001b178
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x1003882b
lea ecx, [ebp - 0xf9c]
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x10], 0x4d2e
mov dword [ebp - 0x24], 0x4adca1a1
push 0xfffffffffffffffe
mov dword [ebp - 0x3c], 0xfe2cf45
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xffffffea
jmp 0x1003890c
mov dword [ebp - 0x24], 0x51ebf0dd
xor edx, edx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x38], 0xfa01
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, 0x6cce
setle dl
xor ecx, ecx
cmp edx, 0xbc6e
setl cl
sub eax, ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10038909
push 0x25e8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jg 0x10038893
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10038924
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
movdqa xmm0, xmmword [0x10009850]
lea ecx, [ebp - 0x1538]
mov dword [ebp - 0x58], 0xfffffff9
mov dword [ebp - 0x14], 0x72226312
mov dword [ebp - 0x3c], 0x4cb8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x12f4]
push eax
lea eax, [ebp - 0x1304]
push eax
movdqu xmmword [ebp - 0x1304], xmm0
call fcn.1001b187
lea ecx, [ebp - 0x20e]
mov esi, eax
call fcn.1000a7d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc78]
push dword [esi]
call fcn.1001b14d
push 8
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0xf953
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], 0xe01afec1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp edi, eax
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
add eax, 0x565e
add eax, edx
xor ecx, ecx
cmp eax, esi
setl cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
or esi, 0xffffffff
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x10038a62
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xc78]
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.1001b178
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0x104353e
lea ecx, [ebp - 0xc78]
setle dl
xor ebx, ebx
cmp edx, eax
setg bl
call fcn.1001b178
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
setle cl
xor edx, edx
cmp ecx, 0x7d37
setle dl
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x14]
jns 0x100389e8
push 3
pop ebx
lea ecx, [ebp - 0xc78]
mov dword [ebp - 4], esi
call fcn.1001b173
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0xe58]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0xe58]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xe58], 0x172ddb74
jge 0x10038ab3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x10]
jne 0x10038ac9
cmp dword [ebp - 0x58], eax
je 0x10038acf
xor eax, eax
xor edi, edi
inc eax
inc edi
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
mov dword [ebp - 0x13dc], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x100387d1
mov dword [ebp - 0x54], 0xfa86
lea ecx, [ebp - 0xc90]
push edi
call fcn.1001b10b
push 9
pop edi
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10038b38
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc90]
call fcn.1001b178
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10038b19
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10038b54
push eax
push eax
push 0x1336
push eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0xc90]
push eax
call fcn.1001b178
lea ecx, [ebp - 0xc90]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x18], esi
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0xe2e4ed38
mov dword [ebp - 0x20], 0x860bc23c
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jge 0x10038bb4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], 0x4caa8e55
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10038b9a
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jne 0x10038bbe
cmp dword [ebp - 0x18], ecx
jne 0x10038bc0
xor eax, eax
mov dword [ebp - 0x134], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
test eax, eax
setle cl
xor edx, edx
cmp ecx, 0x17be
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [ebp - 0x18], ecx
jg 0x10038c2f
xor eax, eax
cmp dword [ebp - 0x134], eax
jne 0x10038c2f
mov edx, eax
jmp 0x10038c32
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10038c8e
jmp 0x10038c4d
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10038c86
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10038c81
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x134], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jl 0x10038c6c
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10038c63
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10038c4b
push 2
lea ecx, [ebp - 0x1f0]
call fcn.1001b10b
push ebx
lea ecx, [ebp - 0x7f8]
mov dword [ebp - 4], 0xa
call fcn.1001b10b
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10038cdb
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xb44], 0x6af1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10038cc3
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10038d03
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1f0]
call fcn.1001b178
mov dword [eax], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10038ce4
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jge 0x10038d29
push dword [ebp - 0x34]
lea ecx, [ebp - 0x7f8]
call fcn.1001b178
mov dword [eax], 0xec326874
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jl 0x10038d0b
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10038d47
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x954], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 1
jl 0x10038d32
xor eax, eax
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1001b178
lea ecx, [ebp - 0x1f0]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1001b178
xor ebx, ebx
inc ebx
cmp dword [eax], 2
jg 0x10038e8f
push 7
pop eax
mov dword [ebp - 0x24], 4
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x54], eax
push ebx
call fcn.1001b178
push 2
lea ecx, [ebp - 0x7f8]
call fcn.1001b178
push 2
lea ecx, [ebp - 0x7f8]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.1001b178
push 2
lea ecx, [ebp - 0x7f8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xb44]
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1f0]
push eax
call fcn.1001b178
lea ecx, [ebp - 0x1f0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xb44]
mov eax, dword [ebp - 0x24]
xor eax, eax
push eax
call fcn.1001b178
mov edx, dword [ebp - 0x24]
imul edx, dword [eax]
mov eax, dword [ebp - 0x24]
add edx, 0xd860ad1d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x10038e67
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1001b178
mov esi, eax
lea ecx, [ebp - 0x1f0]
xor eax, eax
push eax
call fcn.1001b178
push 0
mov ecx, dword [eax]
mov edx, dword [ebp + ecx*4 - 0xb44]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [ebp + eax*4 - 0xb44]
cmp eax, edx
pop eax
setl cl
mov dword [ebp - 0x954], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10038e20
push eax
lea ecx, [ebp - 0x1f0]
call fcn.1001b178
lea ecx, [ebp - 0x1f0]
inc dword [eax]
xor eax, eax
push eax
call fcn.1001b178
cmp dword [eax], 2
jle 0x10038d70
or esi, 0xffffffff
lea ecx, [ebp - 0x7f8]
call fcn.1001b173
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 4], esi
call fcn.1001b173
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x54], 0x6548aab5
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x10038edd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11e0], 0x7e6aa165
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10038ec5
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10038f01
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10038efe
push 0x183e
push 0x2085
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10038ee2
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xf48]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x11d8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11d8]
mov eax, 0xffff
cmp dword [ebp - 0x20], eax
push edi
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0x6de6
call fcn.1001b10b
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x10], 0x76f5020f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10038f8a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf48]
call fcn.1001b178
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10038f70
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10038f9b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10038fdd
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10038fc7
push 0x18e1
push 0xe25
push eax
push 0xfb4
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf48]
call fcn.1001b178
dec dword [ebp - 0x10]
push 0
pop eax
jns 0x10038fa7
lea ecx, [ebp - 0xf48]
mov dword [ebp - 4], esi
call fcn.1001b173
push 0xfffffffffffffffe
mov dword [ebp - 0x38], 0x3ae50714
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xffffffea
jmp 0x1003907a
mov dword [ebp - 0x24], 0x51ebf0dd
xor edx, edx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x54], 0xfa01
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, 0x6cce
setle dl
xor ecx, ecx
cmp edx, 0xbc6e
setl cl
sub eax, ecx
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10039077
push 0x25e8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jg 0x10039001
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10039092
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
movdqa xmm0, xmmword [0x10009850]
lea ecx, [ebp - 0x1560]
mov dword [ebp - 0x14], 0x72226312
mov dword [ebp - 0x3c], 0x4cb8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x1274]
push eax
lea eax, [ebp - 0x1284]
push eax
movdqu xmmword [ebp - 0x1284], xmm0
call fcn.1001b187
lea ecx, [ebp - 0x245]
mov esi, eax
call fcn.1000a7d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xca8]
push dword [esi]
call fcn.1001b14d
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x24], 0xf953
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], 0xe01afec1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp ebx, eax
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
add eax, 0x565e
add eax, edx
xor ecx, ecx
cmp eax, esi
setl cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x100391ca
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xca8]
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.1001b178
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, 0x104353e
lea ecx, [ebp - 0xca8]
setle dl
xor ebx, ebx
cmp edx, eax
setg bl
call fcn.1001b178
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
setle cl
xor edx, edx
cmp ecx, 0x7d37
setle dl
xor eax, eax
or ecx, 0xffffffff
cmp edx, ecx
setg al
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x14]
jns 0x1003914d
xor ebx, ebx
inc ebx
or eax, 0xffffffff
lea ecx, [ebp - 0xca8]
mov dword [ebp - 4], eax
call fcn.1001b173
push edi
lea ecx, [ebp - 0xa84]
call fcn.1001b10b
mov dword [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x4a5ea964
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10039223
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa84]
call fcn.1001b178
mov dword [eax], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10039205
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003923b
push ebx
push 0x1e97
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x10039337
push 2
lea ecx, [ebp - 0x560]
call fcn.1001b10b
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
jmp 0x10039271
push dword [ebp - 0x10]
call fcn.1001b178
mov dword [eax], 0xb8c3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x560]
jl 0x10039260
push ebx
call fcn.1001b178
lea ecx, [ebp - 0x560]
cmp dword [eax], 0
jne 0x1003932f
push ebx
call fcn.1001b178
push 2
lea ecx, [ebp - 0xa84]
mov esi, eax
call fcn.1001b178
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa84]
mov edi, dword [eax]
sub edi, dword [esi]
call fcn.1001b178
mov dword [eax], edi
test edi, edi
je 0x100392da
push ebx
lea ecx, [ebp - 0x560]
call fcn.1001b178
cmp dword [eax], 0
je 0x100392da
xor esi, esi
xor ebx, ebx
inc esi
inc ebx
xor eax, eax
jmp 0x100392de
xor eax, eax
mov esi, eax
add esi, 0xffff8e85
lea ecx, [ebp - 0x560]
neg esi
push eax
sbb esi, esi
inc esi
call fcn.1001b178
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
imul ecx, esi
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0xe
call fcn.1001b173
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10039248
jmp 0x10039334
call fcn.1001b173
push 3
pop edi
or eax, 0xffffffff
lea ecx, [ebp - 0xa84]
mov dword [ebp - 4], eax
call fcn.1001b173
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10039360
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe70], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003934f
push 4
lea ecx, [ebp - 0x9e8]
call fcn.1001b10b
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100393aa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9e8]
call fcn.1001b178
mov dword [eax], 0xe57bf5cd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003938b
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x100393c5
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffffb
setg cl
cmp dword [ebp - 0x20], ecx
jle 0x100393c5
xor eax, eax
mov edi, eax
jmp 0x100393c8
xor edi, edi
inc edi
push 2
lea ecx, [ebp - 0x9e8]
call fcn.1001b178
push 2
lea ecx, [ebp - 0x9e8]
mov esi, eax
call fcn.1001b178
xor ebx, ebx
inc ebx
cmp ebx, edi
mov ecx, dword [eax]
sbb eax, eax
mov dword [esi], ecx
neg eax
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10039425
push ebx
push 0x1690
push 0x231
call dword [sym.imp.USER32.dll_AttachThreadInput]
or edi, 0xffffffff
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 4], edi
call fcn.1001b173
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x10039451
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13f4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10039440
push 8
pop eax
mov dword [ebp - 0x38], eax
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0x38], 0xc0ec0dce
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10039495
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108], 0x2971
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039484
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
inc eax
jne 0x100394ea
imul eax, dword [ebp - 0x104], 0xb5b3
test eax, eax
jne 0x100394be
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x38], eax
jg 0x100394ea
xor eax, eax
mov edx, eax
jmp 0x100394ed
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x44]
cmp edx, eax
push 6
setg cl
imul eax, ecx, 0x5116
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
jne 0x10039515
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x54]
sub ecx, eax
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xfffffff0
cmp dword [ebp - 0x20], 0xffffffe8
jl 0x10039b48
movdqa xmm0, xmmword [0x100097d0]
lea eax, [ebp - 0x1374]
push eax
lea eax, [ebp - 0x1384]
push eax
lea ecx, [ebp - 0x1548]
movdqu xmmword [ebp - 0x1384], xmm0
call fcn.1001b187
lea ecx, [ebp - 0x209]
mov esi, eax
call fcn.1000a7d3
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1454]
push dword [esi]
call fcn.1001b14d
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100395d5
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x114], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100395c0
xor eax, eax
mov dword [ebp - 0x114], eax
jmp 0x100395e9
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], ebx
jle 0x100395dd
lea ecx, [ebp - 0x1454]
call fcn.1001b173
mov dword [ebp - 0x2c], 0x4d2e
lea ecx, [ebp - 0x2d0]
push 2
call fcn.1001b10b
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x18], 0x9bdba76a
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10039651
xor edi, edi
inc edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2d0]
call fcn.1001b178
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039633
xor eax, eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], eax
jl 0x1003994e
push 4
lea ecx, [ebp - 0x27c]
call fcn.1001b10b
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x10039691
push dword [ebp - 0x10]
call fcn.1001b178
mov dword [eax], 0x88adae8c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
lea ecx, [ebp - 0x27c]
jl 0x10039680
xor edi, edi
inc edi
push edi
call fcn.1001b178
and dword [eax], 0
jmp 0x1003991c
push edi
lea ecx, [ebp - 0x1a8]
call fcn.1001b10b
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100396e6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1a8]
call fcn.1001b178
xor edi, edi
inc edi
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100396c9
xor eax, eax
push eax
lea ecx, [ebp - 0x1a8]
call fcn.1001b178
xor edi, edi
lea ecx, [ebp - 0x1a8]
inc edi
mov dword [eax], edi
xor eax, eax
push eax
call fcn.1001b178
cmp dword [eax], 0
jl 0x100398e8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2d0]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.1001b178
lea ecx, [ebp - 0x2d0]
push dword [eax]
call fcn.1001b178
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x27c]
push 2
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.1001b178
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2d0]
call fcn.1001b178
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2d0]
mov esi, eax
call fcn.1001b178
mov ecx, dword [esi]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x27c]
setl bl
call fcn.1001b178
cmp ebx, dword [eax]
jl 0x1003979a
xor eax, eax
lea ecx, [ebp - 0x2d0]
push eax
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.1001b178
lea ecx, [ebp - 0x2d0]
push dword [eax]
call fcn.1001b178
push edi
lea ecx, [ebp - 0x27c]
mov esi, eax
call fcn.1001b178
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0xffff
sbb ecx, ecx
xor edx, edx
neg ecx
inc ecx
cmp ecx, 0xfffffffb
setl dl
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setne cl
xor ebx, ebx
cmp dword [esi], ecx
lea ecx, [ebp - 0x1a8]
setle bl
xor eax, eax
push eax
call fcn.1001b178
push dword [ebp - 0x18]
xor ecx, ecx
cmp ebx, dword [eax]
mov eax, 0xfff8
setne cl
cmp eax, ecx
lea ecx, [ebp - 0x2d0]
sbb esi, esi
neg esi
call fcn.1001b178
lea ecx, [ebp - 0x1a8]
mov eax, dword [eax]
imul eax, esi
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
call fcn.1001b178
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
je 0x10039898
xor eax, eax
mov dword [ebp - 0x14], eax
inc eax
cmp dword [ebp - 0x14], eax
jg 0x100398be
xor ebx, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jl 0x1003988e
push eax
lea ecx, [ebp - 0x27c]
call fcn.1001b178
lea ecx, [ebp - 0x2d0]
push dword [eax]
call fcn.1001b178
cmp dword [eax], ebx
jne 0x1003988b
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.1001b178
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1003988b
dec dword [ebp - 0x30]
push 1
pop eax
jns 0x10039852
xor eax, eax
inc eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x1003984a
jmp 0x100398be
mov dword [ebp - 0x30], 1
xor eax, eax
cmp dword [ebp - 0x30], eax
jl 0x100398be
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x100398b9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x100398a6
xor eax, eax
lea ecx, [ebp - 0x1a8]
push eax
call fcn.1001b178
lea ecx, [ebp - 0x1a8]
dec dword [eax]
xor eax, eax
push eax
call fcn.1001b178
push 1
pop edi
cmp dword [eax], 0
jge 0x1003970e
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100398ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x12
call fcn.1001b173
push edi
lea ecx, [ebp - 0x27c]
call fcn.1001b178
inc dword [eax]
push edi
lea ecx, [ebp - 0x27c]
call fcn.1001b178
cmp dword [eax], edi
jle 0x100396ae
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x11
call fcn.1001b173
dec dword [ebp - 0x18]
jns 0x10039661
push 3
pop ebx
or edi, 0xffffffff
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 4], edi
call fcn.1001b173
mov dword [ebp - 0x24], 0x4adca1a1
lea ecx, [ebp - 0x4a0]
push 1
call fcn.1001b10b
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100399a1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4a0]
call fcn.1001b178
mov dword [eax], 0x1f7e2799
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039982
xor eax, eax
push eax
lea ecx, [ebp - 0x4a0]
call fcn.1001b178
and dword [eax], 0
jmp 0x100399e6
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x100399ca
push 0xe72
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push eax
lea ecx, [ebp - 0x4a0]
call fcn.1001b178
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.1001b178
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4a0]
push eax
call fcn.1001b178
cmp dword [eax], 0x12
jl 0x100399b2
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 4], edi
call fcn.1001b173
mov dword [ebp - 0x3c], 0xfe2cf45
push 0xfffffffffffffffd
mov dword [ebp - 0x38], 0xfffffff9
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], 0x5d09ea98
push 0xfffffffffffffffa
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x30]
pop esi
mov dword [ebp - 0x30], esi
jmp 0x10039abd
mov dword [ebp - 0x18], 0x2e8588d0
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], 0x18
cmp dword [ebp - 0x14], 0xffffffe7
jg 0x10039aba
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x10039a9a
cmp byte [ebp - 0x25], 0
je 0x10039a6a
push 0xda6
push eax
push 0xe65
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10039a91
mov dword [ebp - 0x10], 0xb4746a1c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
jmp 0x10039a88
mov dword [ebp - 0x54], 0xe7631615
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
je 0x10039a7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jg 0x10039a6f
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
mov byte [ebp - 0x25], al
jl 0x10039a51
cmp byte [ebp - 0x25], 0
je 0x10039ab1
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jle 0x10039a4c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jg 0x10039a33
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0xe70]
cmp eax, 0xfe5a
mov eax, dword [ebp - 0xe70]
setl cl
add eax, ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xdcefbde2
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xe70], 0x172ddb74
jge 0x10039b0a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x2c]
jne 0x10039b20
cmp dword [ebp - 0x38], eax
je 0x10039b23
xor eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setg dl
mov dword [ebp - 0x13f4], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x10039568
jmp 0x10039b4b
push 0xfffffffffffffffa
pop esi
mov dword [ebp - 0x18], 0xdf75dcec
mov ebx, 0xfff9
mov dword [ebp - 0x18], 0x13
cmp dword [ebp - 0x18], 0xffffffed
jg 0x10039cc6
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10039b8c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70], 0x394a2a4f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039b76
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], ecx
je 0x10039cb6
mov dword [ebp - 0x24], 0x71c097bc
lea ecx, [ebp - 0x56c]
push 4
call fcn.1001b10b
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
jmp 0x10039bd0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x56c]
call fcn.1001b178
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10039bbd
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x70]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10039c02
mov eax, dword [ebp - 0x18]
push 2
lea ecx, [ebp - 0x56c]
call fcn.1001b178
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x56c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
push 2
call fcn.1001b178
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
xor eax, eax
cmp dword [ebp - 0x70], eax
jne 0x10039c49
push eax
lea ecx, [ebp - 0x56c]
call fcn.1001b178
cmp dword [eax], 0
jne 0x10039c49
xor eax, eax
mov esi, eax
jmp 0x10039c4c
xor esi, esi
inc esi
push 1
lea ecx, [ebp - 0x56c]
call fcn.1001b178
xor edi, edi
inc edi
cmp edi, esi
push 3
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x56c]
pop eax
push eax
setl bl
call fcn.1001b178
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10039c8c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
or edi, 0xffffffff
lea ecx, [ebp - 0x56c]
mov dword [ebp - 4], edi
call fcn.1001b173
inc dword [ebp - 0x70]
mov ebx, 0xfff9
push 7
pop eax
push 0xfffffffffffffffa
pop esi
cmp dword [ebp - 0x70], eax
jne 0x10039b9b
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
push 0xfffffffffffffffa
pop esi
jle 0x10039b6a
mov ebx, 0xfa86
lea ecx, [ebp - 0xcc0]
mov dword [ebp - 0x54], ebx
push 1
call fcn.1001b10b
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10039d13
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcc0]
call fcn.1001b178
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039cf4
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10039d2f
push eax
push eax
push 0x1336
push eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0xcc0]
push eax
call fcn.1001b178
lea ecx, [ebp - 0xcc0]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], edi
call fcn.1001b173
mov dword [ebp - 0x54], ebx
lea ecx, [ebp - 0xfa8]
push 1
call fcn.1001b10b
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10039d99
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfa8]
call fcn.1001b178
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039d7a
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10039db5
push eax
push eax
push 0x1336
push eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0xfa8]
push eax
call fcn.1001b178
lea ecx, [ebp - 0xfa8]
mov dword [eax], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], edi
call fcn.1001b173
mov dword [ebp - 0x18], 0xdf75dcec
mov dword [ebp - 0x18], 0x13
cmp dword [ebp - 0x18], 0xffffffed
jg 0x10039f49
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10039e13
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], 0x394a2a4f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039dfd
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], ecx
je 0x10039f3c
mov dword [ebp - 0x24], 0x71c097bc
lea ecx, [ebp - 0x4b8]
push 4
call fcn.1001b10b
xor eax, eax
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x10], eax
jmp 0x10039e5b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4b8]
call fcn.1001b178
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10039e44
mov eax, dword [ebp - 0x24]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x18]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x10039e90
mov eax, dword [ebp - 0x18]
push 2
lea ecx, [ebp - 0x4b8]
call fcn.1001b178
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4b8]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
push 2
call fcn.1001b178
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor eax, eax
cmp dword [ebp - 0x78], eax
jne 0x10039ed7
push eax
lea ecx, [ebp - 0x4b8]
call fcn.1001b178
cmp dword [eax], 0
jne 0x10039ed7
xor eax, eax
mov esi, eax
jmp 0x10039eda
xor esi, esi
inc esi
push 1
lea ecx, [ebp - 0x4b8]
call fcn.1001b178
xor edi, edi
inc edi
cmp edi, esi
push 3
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4b8]
pop eax
push eax
setl bl
call fcn.1001b178
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x10039f1a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
or edi, 0xffffffff
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 4], edi
call fcn.1001b173
inc dword [ebp - 0x78]
push 7
pop eax
cmp dword [ebp - 0x78], eax
jne 0x10039e22
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jle 0x10039df1
mov dword [ebp - 0x14], 0xbac64a68
lea ecx, [ebp - 0x608]
push 2
call fcn.1001b10b
mov dword [ebp - 4], 0x19
xor eax, eax
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x20], ecx
xor ebx, ebx
mov dword [ebp - 0x54], 0x8f3b1ad3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10039f9a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x608]
call fcn.1001b178
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10039f7e
push 0xfffffffffffffffe
pop ecx
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
jmp 0x1003a151
mov dword [ebp - 0x24], 0xac8ef34e
mov dword [ebp - 0x38], 0x6a83cd0c
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jge 0x10039fd8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0xe6da504
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10039fbe
xor eax, eax
inc eax
mov dword [ebp - 0xbc], ebx
cmp dword [ebp - 0xbc], eax
jg 0x1003a14e
mov dword [ebp - 0x30], 0x86bd085c
mov dword [ebp - 0x3c], 0x539aea1d
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jl 0x1003a139
mov dword [ebp - 0x18], 0x315362d
mov dword [ebp - 0x18], ebx
jmp 0x1003a04b
mov dword [ebp - 0x10], 0x26f3f17e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jl 0x1003a048
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003a03e
push 0x1f56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1003a021
xor eax, eax
inc eax
xor ebx, ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x1003a010
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x608]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0xbc]
call fcn.1001b178
xor esi, esi
inc esi
cmp dword [eax], esi
jle 0x1003a093
push esi
lea ecx, [ebp - 0x608]
call fcn.1001b178
cmp dword [eax], ebx
je 0x1003a093
xor eax, eax
inc eax
jmp 0x1003a095
xor eax, eax
push 6
pop ecx
neg eax
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0xbc]
push dword [ebp - 0xbc]
setne bl
lea ecx, [ebp - 0x608]
add ebx, 9
imul ebx, eax
call fcn.1001b178
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1003a0cf
cmp dword [ebp - 0x24], eax
jne 0x1003a0d1
mov esi, eax
mov dword [ebp - 0x20], esi
xor edx, edx
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setg dl
xor ecx, ecx
cmp edx, eax
push 1
setl cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
test eax, eax
sets cl
xor eax, eax
cmp ecx, 0x7051
setg al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov eax, 0xc525ac89
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x30]
pop eax
push 0
pop ebx
jns 0x1003a004
inc dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], eax
jle 0x10039fea
push 0xfffffffffffffffe
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jle 0x10039fa5
push eax
lea ecx, [ebp - 0x608]
call fcn.1001b178
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x608]
sete dl
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edi
call fcn.1001b173
mov dword [ebp - 0x18], 0xdf75dcec
mov dword [ebp - 0x18], 0x13
cmp dword [ebp - 0x18], 0xffffffed
jg 0x1003a300
xor eax, eax
jmp 0x1003a1a1
or edi, 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003a1c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0x394a2a4f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003a1ad
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], ecx
je 0x1003a2ee
mov dword [ebp - 0x24], 0x71c097bc
lea ecx, [ebp - 0x554]
push 4
call fcn.1001b10b
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x10], eax
jmp 0x1003a20b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x554]
call fcn.1001b178
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003a1f4
mov eax, dword [ebp - 0x24]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x18]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003a240
xor edi, edi
inc edi
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffed
jle 0x1003a19e
jmp 0x1003a303
xor edi, edi
inc edi
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x14], eax
jmp 0x1003a47c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x77963f6d
mov dword [ebp - 0x54], 0x8c74c3ee
cmp dword [ebp - 0x14], eax
je 0x1003a35e
mov dword [ebp - 0x10], eax
jmp 0x1003a342
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbd0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a335
mov eax, dword [ebp - 0xbcc]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbcc], eax
jmp 0x1003a3b1
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe6
je 0x1003a390
mov dword [ebp - 0x54], 0xa11015aa
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
mov dword [ebp - 0x54], edx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
jne 0x1003a36e
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1003a485
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x1003a3b3
push eax
push 0x1222
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3a
jg 0x1003a479
mov dword [ebp - 0x38], 1
xor edx, edx
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], 0xfffffffc
mov eax, dword [ebp - 0x10]
cmp eax, esi
setg dl
sub edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 2
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
xor edx, edx
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ebx, ebx
cmp edx, 0x31137833
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1003a467
push eax
push 0x11a1
push 0x1ade
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x3a
jle 0x1003a3c0
xor edi, edi
inc edi
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jge 0x1003a31a
mov dword [ebp - 0x14], 0x1e559696
push 5
pop ecx
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x354], ecx
mov dword [ebp - 0x350], ecx
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003a4c9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x214], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1003a4b0
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003a518
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1003a4f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5a8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003a4d7
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], eax
jl 0x1003a515
cmp dword [ebp - 0x14], eax
jle 0x1003a4ce
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x214], 0x49f6d4a0
mov edi, 0xfffb
mov eax, dword [ebp - 0x214]
cmp eax, 0x78f4f823
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x50], 0xfa86
mov dword [ebp - 0x30], 0x25d16df2
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x38], 0x8f1e
mov dword [ebp - 0x54], 0x96f3
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
xor ebx, ebx
xor eax, eax
inc ebx
cmp ecx, ebx
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], eax
jg 0x1003a7b6
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0xc24]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0x75e6
mov dword [ebp - 0x24], 0x67aac3bc
push ebx
call fcn.1001b10b
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1003a617
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], al
je 0x1003a7c8